tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
platform_system_sepolicy/vendor/file_contexts

83 lines
8.5 KiB
Text
Raw Normal View History

Move hals to vendor partition. Bug: 34135607 Test: hals work Merged-In: I6a1f87438bb5b540fce900e9ec5df07d3f4f6bd4 Change-Id: I6a1f87438bb5b540fce900e9ec5df07d3f4f6bd4
2017-02-13 18:09:56 +01:00
#############################
# Default HALs
#
Add atrace HAL 1.0 sepolicy Bug: 111098596 Test: atrace/systrace (cherry picked from commit 9ed5cf6e430a864630c2451bf35f18ac7668c12b) Change-Id: I97772ff21754d03a0aea0d53b39e8da5312a17c0
2018-09-20 01:06:28 +02:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.atrace@1\.0-service u:object_r:hal_atrace_default_exec:s0
Rename audio hal service The audio HAL service name previously contained the audio HAL version of the first audio HAL it supported. Nevertheless, the same service can and do host all audio HAL versions. Aka there is only one audio HAL service, and the version in its name is technical dept and should not be changed. This caused many confusions during vendor HAL upgrade as the service version number was erroneously updated leading to device boot loop. The new service name is: android.hardware.audio.service The old one was: android.hardware.audio@2.0-service Keeping both names valid as most phones will not rename the service immediately. Bug: 78516186 Test: boot & check the audio HAL is up with the old and new name Change-Id: I2ce0182fd919af6eb8325d49682b4374be00344e Signed-off-by: Kevin Rocard <krocard@google.com>
2019-07-04 01:31:20 +02:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.audio(@2\.0-|\.)service u:object_r:hal_audio_default_exec:s0
Move automotive HALs sepolicy to system/ Bug: 70637118 Test: build, flash and boot bat_land and owl automotive builds Change-Id: I6db23258de30174d6db09d241e91b08aa5afedef
2018-04-10 23:07:14 +02:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.automotive\.audiocontrol@1\.0-service u:object_r:hal_audiocontrol_default_exec:s0
SEPolicy rules for CAN bus HAL Bug: 135918744 Test: VTS (separate new change) Change-Id: Idd3ca882e3bd36b95a5412bdfbf6fe9d6e911ba9
2019-07-24 02:38:51 +02:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.automotive\.can@1\.0-service u:object_r:hal_can_socketcan_exec:s0
Update sepolicy for EVS v1.x Modify vendor file context and hal_evs_server policy to enable EVS v1.1 service. Change-Id: I1e717b3209200300005c3fa7f91423589505a41c Signed-off-by: Changyeon Jo <changyeon@google.com>
2019-07-29 18:07:42 +02:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.automotive\.evs@1\.[0-9]-service u:object_r:hal_evs_default_exec:s0
Move automotive HALs sepolicy to system/ Bug: 70637118 Test: build, flash and boot bat_land and owl automotive builds Change-Id: I6db23258de30174d6db09d241e91b08aa5afedef
2018-04-10 23:07:14 +02:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.automotive\.vehicle@2\.0-service u:object_r:hal_vehicle_default_exec:s0
Bluetooth hal: move to vendor partition. Bug: 35328775 Test: works in both binderized and passthrough modes Change-Id: I1f827b4983e5e67c516e4488ad3497dd62db7e20
2017-02-27 17:59:39 +01:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.bluetooth@1\.0-service u:object_r:hal_bluetooth_default_exec:s0
btlinux: Move HAL definitions from system/bt Test: ls -laZ /vendor/bin/hw/android.hardware.bluetooth* Change-Id: I394594ad041f87583ca6b5b44d836cfab5da8103 Signed-off-by: Dmitry Shmidt <dimitrysh@google.com> Merged-In: I394594ad041f87583ca6b5b44d836cfab5da8103
2018-04-05 21:46:05 +02:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.bluetooth@1\.0-service\.btlinux u:object_r:hal_bluetooth_btlinux_exec:s0
Label /vendor/bin/hw on devices without vendor partition SELinux labeling of filesystem files ignores symlinks. Unfortunately, /vendor is a symlink on devices without vendor partition (e.g., hikey). Thus, policy in directories which are used both for devices with vendor partition and for devices without vendor partition must be adjusted to match both /vendor and /system/vendor. It is assumed that the /vendor symlink, if it exists at all, always points to /system/vendor. The alternative solution of adjusting vendor policy file labelling rules at vendor policy build time, when the actual on-device paths are known, was considered to make it harder to see how files are labelled by looking solely at the source tree. Test: Files under /vendor/bin/hw correctly labelled on sailfish, angler, and a device which uses the /vendor symlink. Bug: 35431549 Change-Id: If6ccb2c9cb85b0589db03ab86de8071e15d5366f
2017-02-16 21:59:44 +01:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.biometrics\.fingerprint@2\.1-service u:object_r:hal_fingerprint_default_exec:s0
Switch Boot Control HAL policy to _client/_server This switches Boot Control HAL policy to the design which enables us to conditionally remove unnecessary rules from domains which are clients of Boot Control HAL. Domains which are clients of Boot Control HAL, such as update_server, are granted rules targeting hal_bootctl only when the Boot Control HAL runs in passthrough mode (i.e., inside the client's process). When the HAL runs in binderized mode (i.e., in another process/domain, with clients talking to the HAL over HwBinder IPC), rules targeting hal_bootctl are not granted to client domains. Domains which offer a binderized implementation of Boot Control HAL, such as hal_bootctl_default domain, are always granted rules targeting hal_bootctl. P. S. This commit removes direct access to Boot Control HAL from system_server because system_server is not a client of this HAL. This commit also removes bootctrl_block_device type which is no longer used. Finally, boot_control_hal attribute is removed because it is now covered by the hal_bootctl attribute. Test: Device boots up, no new denials Test: Reboot into recovery, sideload OTA update succeeds Test: Apply OTA update via update_engine: 1. make dist 2. Ensure device has network connectivity 3. ota_call.py -s <serial here> out/dist/sailfish-ota-*.zip Bug: 34170079 Change-Id: I9c410c092069e431a3852b66c04c4d2a9f1a25cf
2017-03-17 03:17:15 +01:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.boot@1\.0-service u:object_r:hal_bootctl_default_exec:s0
Add broadcast radio HAL 2.0 default implementation to the sepolicy. Test: VTS Bug: 69958777 Change-Id: I6db7dd9afc9c7f254a0233ff3144b02e48727038
2017-12-07 18:48:16 +01:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.broadcastradio@\d+\.\d+-service u:object_r:hal_broadcastradio_default_exec:s0
Camera HAL: Allow minor version changes to camera.provider Test: Adding a camera.provider@2.5 to a device works correctly Merged-In: I516698afedad1294c0af3f4efedb0aed0a141780 Change-Id: I516698afedad1294c0af3f4efedb0aed0a141780
2018-12-13 00:31:56 +01:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.camera\.provider@2\.[0-9]+-service_64 u:object_r:hal_camera_default_exec:s0
/(vendor|system/vendor)/bin/hw/android\.hardware\.camera\.provider@2\.[0-9]+-service u:object_r:hal_camera_default_exec:s0
/(vendor|system/vendor)/bin/hw/android\.hardware\.camera\.provider@2\.[0-9]+-external-service u:object_r:hal_camera_default_exec:s0
configstore: assign label to all minor versions of configstore service Added rule: /(vendor|system/vendor)/bin/hw/android\.hardware\.configstore@1\.[0-9]-service u:object_r:hal_configstore_default_exec:s0 Bug: 37727469 Test: Built and tested on Sailfish Change-Id: Icf167fad1c7e601c3662f527d1e3e844ff517b58
2017-05-02 07:54:19 +02:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.configstore@1\.[0-9]+-service u:object_r:hal_configstore_default_exec:s0
Added default policy for Confirmation UI HAL Bug: 63928580 Test: Manually tested. Change-Id: If6bb10cb7c009883d853e46dcdeb92cd33877d53
2018-01-09 23:42:53 +01:00
/(vendor|sustem/vendor)/bin/hw/android\.hardware\.confirmationui@1\.0-service u:object_r:hal_confirmationui_default_exec:s0
Label /vendor/bin/hw on devices without vendor partition SELinux labeling of filesystem files ignores symlinks. Unfortunately, /vendor is a symlink on devices without vendor partition (e.g., hikey). Thus, policy in directories which are used both for devices with vendor partition and for devices without vendor partition must be adjusted to match both /vendor and /system/vendor. It is assumed that the /vendor symlink, if it exists at all, always points to /system/vendor. The alternative solution of adjusting vendor policy file labelling rules at vendor policy build time, when the actual on-device paths are known, was considered to make it harder to see how files are labelled by looking solely at the source tree. Test: Files under /vendor/bin/hw correctly labelled on sailfish, angler, and a device which uses the /vendor symlink. Bug: 35431549 Change-Id: If6ccb2c9cb85b0589db03ab86de8071e15d5366f
2017-02-16 21:59:44 +01:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.contexthub@1\.0-service u:object_r:hal_contexthub_default_exec:s0
/(vendor|system/vendor)/bin/hw/android\.hardware\.drm@1\.0-service u:object_r:hal_drm_default_exec:s0
Change sepolicy to allow cas@1.1 service Modify sepolicy configure file, so that cas@1.1 service can run Test: Manual bug: 124016538 Change-Id: I0b160bc1c575aa18ffead7ff136509fc9dcfb472 Merged-In: I142a6cd66a81ad9e0c8b4d87da672fb8f5c181d6
2019-02-05 02:19:22 +01:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.cas@1\.[01]-service u:object_r:hal_cas_default_exec:s0
/(vendor|system/vendor)/bin/hw/android\.hardware\.cas@1\.[01]-service-lazy u:object_r:hal_cas_default_exec:s0
Label /vendor/bin/hw on devices without vendor partition SELinux labeling of filesystem files ignores symlinks. Unfortunately, /vendor is a symlink on devices without vendor partition (e.g., hikey). Thus, policy in directories which are used both for devices with vendor partition and for devices without vendor partition must be adjusted to match both /vendor and /system/vendor. It is assumed that the /vendor symlink, if it exists at all, always points to /system/vendor. The alternative solution of adjusting vendor policy file labelling rules at vendor policy build time, when the actual on-device paths are known, was considered to make it harder to see how files are labelled by looking solely at the source tree. Test: Files under /vendor/bin/hw correctly labelled on sailfish, angler, and a device which uses the /vendor symlink. Bug: 35431549 Change-Id: If6ccb2c9cb85b0589db03ab86de8071e15d5366f
2017-02-16 21:59:44 +01:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.dumpstate@1\.0-service u:object_r:hal_dumpstate_default_exec:s0
/(vendor|system/vendor)/bin/hw/android\.hardware\.gatekeeper@1\.0-service u:object_r:hal_gatekeeper_default_exec:s0
Add sepolicy for GNSS HAL 2.0 and 1.1 Bug: 112260995 Bug: 120277977 Test: atest VtsHalGnssV2_0TargetTest Change-Id: I196d8506b2f7c2153e1f647ea5ba61b81bf3d881
2018-12-12 21:15:41 +01:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.gnss@[0-9]\.[0-9]-service u:object_r:hal_gnss_default_exec:s0
Label /vendor/bin/hw on devices without vendor partition SELinux labeling of filesystem files ignores symlinks. Unfortunately, /vendor is a symlink on devices without vendor partition (e.g., hikey). Thus, policy in directories which are used both for devices with vendor partition and for devices without vendor partition must be adjusted to match both /vendor and /system/vendor. It is assumed that the /vendor symlink, if it exists at all, always points to /system/vendor. The alternative solution of adjusting vendor policy file labelling rules at vendor policy build time, when the actual on-device paths are known, was considered to make it harder to see how files are labelled by looking solely at the source tree. Test: Files under /vendor/bin/hw correctly labelled on sailfish, angler, and a device which uses the /vendor symlink. Bug: 35431549 Change-Id: If6ccb2c9cb85b0589db03ab86de8071e15d5366f
2017-02-16 21:59:44 +01:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.graphics\.allocator@2\.0-service u:object_r:hal_graphics_allocator_default_exec:s0
gralloc3: add sepolicy for allocator/mapper 3.0 IAllocator and IMappaer are being rev'd to 3.0. Update sepolicy to allow them to be used. Test: compile with allocator/mapper patches add boot the device Bug: 120493579 Change-Id: Id241c6bd79c02ec93d8dd415539f90a18f733d03
2019-01-06 00:22:41 +01:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.graphics\.allocator@3\.0-service u:object_r:hal_graphics_allocator_default_exec:s0
gralloc: add IAllocator/IMapper 4.0 sepolicy Add support for gralloc 4.0 to sepolicy Bug: 136016160 Test: Compiles and boots Change-Id: I148cc19176275e8cbd19cc95aa95d4d450353b7a
2019-06-20 23:10:59 +02:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.graphics\.allocator@4\.0-service u:object_r:hal_graphics_allocator_default_exec:s0
[SEPolicy] Add composer 2.3 Use regular expression for all composer service versions. BUG: 115554640 Test: Build, flash and boot Merged-In: Ie84ebb0a43c9eaad66829b15deaa8b3046bd7fe4 Change-Id: Ie84ebb0a43c9eaad66829b15deaa8b3046bd7fe4
2018-12-20 08:25:26 +01:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.graphics\.composer@[0-9]\.[0-9]-service u:object_r:hal_graphics_composer_default_exec:s0
Label /vendor/bin/hw on devices without vendor partition SELinux labeling of filesystem files ignores symlinks. Unfortunately, /vendor is a symlink on devices without vendor partition (e.g., hikey). Thus, policy in directories which are used both for devices with vendor partition and for devices without vendor partition must be adjusted to match both /vendor and /system/vendor. It is assumed that the /vendor symlink, if it exists at all, always points to /system/vendor. The alternative solution of adjusting vendor policy file labelling rules at vendor policy build time, when the actual on-device paths are known, was considered to make it harder to see how files are labelled by looking solely at the source tree. Test: Files under /vendor/bin/hw correctly labelled on sailfish, angler, and a device which uses the /vendor symlink. Bug: 35431549 Change-Id: If6ccb2c9cb85b0589db03ab86de8071e15d5366f
2017-02-16 21:59:44 +01:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.health@1\.0-service u:object_r:hal_health_default_exec:s0
selinux changes for android.hardware.health@2.0 health@2.0 is a service used by BatteryService in framework. Test: health hal works Change-Id: I6cccf3ab085686fd67b0e048aaf201e64ec311c4
2017-06-02 22:59:39 +02:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.health@2\.0-service u:object_r:hal_health_default_exec:s0
health.filesystem HAL renamed to health.storage ...to reflect that the HAL operates on storage devices, not filesystem. Bug: 111655771 Test: compiles Change-Id: Ibb0572cb1878359e5944aa6711331f0c7993ba6e Merged-In: Ibb0572cb1878359e5944aa6711331f0c7993ba6e
2018-09-19 19:24:45 +02:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.health\.storage@1\.0-service u:object_r:hal_health_storage_default_exec:s0
Permissions for InputClassifier HAL Add the required permissions for the InputClassifier HAL. Bug: 62940136 Test: no selinux denials in logcat when HAL is used inside input flinger. Change-Id: Ibc9b115a83719421d56ecb4bca2fd196ec71fd76
2018-01-17 21:27:06 +01:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.input\.classifier@1\.0-service u:object_r:hal_input_classifier_default_exec:s0
Label /vendor/bin/hw on devices without vendor partition SELinux labeling of filesystem files ignores symlinks. Unfortunately, /vendor is a symlink on devices without vendor partition (e.g., hikey). Thus, policy in directories which are used both for devices with vendor partition and for devices without vendor partition must be adjusted to match both /vendor and /system/vendor. It is assumed that the /vendor symlink, if it exists at all, always points to /system/vendor. The alternative solution of adjusting vendor policy file labelling rules at vendor policy build time, when the actual on-device paths are known, was considered to make it harder to see how files are labelled by looking solely at the source tree. Test: Files under /vendor/bin/hw correctly labelled on sailfish, angler, and a device which uses the /vendor symlink. Bug: 35431549 Change-Id: If6ccb2c9cb85b0589db03ab86de8071e15d5366f
2017-02-16 21:59:44 +01:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.ir@1\.0-service u:object_r:hal_ir_default_exec:s0
/(vendor|system/vendor)/bin/hw/android\.hardware\.keymaster@3\.0-service u:object_r:hal_keymaster_default_exec:s0
Add file context for keymaster 4.0 service. Test: Boot the device Change-Id: Ia468941e78803edebe311c73f424a41ac1faeaee
2018-01-03 18:55:13 +01:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.keymaster@4\.0-service u:object_r:hal_keymaster_default_exec:s0
Label /vendor/bin/hw on devices without vendor partition SELinux labeling of filesystem files ignores symlinks. Unfortunately, /vendor is a symlink on devices without vendor partition (e.g., hikey). Thus, policy in directories which are used both for devices with vendor partition and for devices without vendor partition must be adjusted to match both /vendor and /system/vendor. It is assumed that the /vendor symlink, if it exists at all, always points to /system/vendor. The alternative solution of adjusting vendor policy file labelling rules at vendor policy build time, when the actual on-device paths are known, was considered to make it harder to see how files are labelled by looking solely at the source tree. Test: Files under /vendor/bin/hw correctly labelled on sailfish, angler, and a device which uses the /vendor symlink. Bug: 35431549 Change-Id: If6ccb2c9cb85b0589db03ab86de8071e15d5366f
2017-02-16 21:59:44 +01:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.light@2\.0-service u:object_r:hal_light_default_exec:s0
Allow lazy HAL to run Test: Manual Change-Id: Ic4c3fd5b2d8d709573f8cc6332a6340d28d3ba26
2019-01-17 00:37:39 +01:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.light@2\.0-service-lazy u:object_r:hal_light_default_exec:s0
lowpan: Added support for LoWPAN Service and android.hardware.lowpan Bug: b/64090883 Bug: b/33073713 Test: Manual Change-Id: I7aa23c31b1fccae56c1a0e0bd4cfe370aeb911dd
2017-04-21 23:25:53 +02:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.lowpan@1\.0-service u:object_r:hal_lowpan_default_exec:s0
Label /vendor/bin/hw on devices without vendor partition SELinux labeling of filesystem files ignores symlinks. Unfortunately, /vendor is a symlink on devices without vendor partition (e.g., hikey). Thus, policy in directories which are used both for devices with vendor partition and for devices without vendor partition must be adjusted to match both /vendor and /system/vendor. It is assumed that the /vendor symlink, if it exists at all, always points to /system/vendor. The alternative solution of adjusting vendor policy file labelling rules at vendor policy build time, when the actual on-device paths are known, was considered to make it harder to see how files are labelled by looking solely at the source tree. Test: Files under /vendor/bin/hw correctly labelled on sailfish, angler, and a device which uses the /vendor symlink. Bug: 35431549 Change-Id: If6ccb2c9cb85b0589db03ab86de8071e15d5366f
2017-02-16 21:59:44 +01:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.memtrack@1\.0-service u:object_r:hal_memtrack_default_exec:s0
/(vendor|system/vendor)/bin/hw/android\.hardware\.nfc@1\.0-service u:object_r:hal_nfc_default_exec:s0
Add sepolicy for NFC 1.1 HAL service Bug: 72746517 Test: Boot a device and check NFC 1.1 service loads Change-Id: Ia281af8add0371525971f076bf513c694e7ea912
2018-01-31 20:10:23 +01:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.nfc@1\.1-service u:object_r:hal_nfc_default_exec:s0
Add sepolicy for nfc hal v1.2 Bug: 130509605 Test: No avc denial log and NFC works with hal v1.2 Change-Id: If54884f76a32705d11f2085f66fe83b9e0354f79
2019-04-22 13:52:55 +02:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.nfc@1\.2-service u:object_r:hal_nfc_default_exec:s0
Move mediacodec to vendor partition. Test: Camera, Photos, YouTube and Play Movies apps. Bug: 35328855 Change-Id: I3643b668817a7336f7ccda781734920fbbcc2c63
2017-02-28 05:35:43 +01:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.media\.omx@1\.0-service u:object_r:mediacodec_exec:s0
Label /vendor/bin/hw on devices without vendor partition SELinux labeling of filesystem files ignores symlinks. Unfortunately, /vendor is a symlink on devices without vendor partition (e.g., hikey). Thus, policy in directories which are used both for devices with vendor partition and for devices without vendor partition must be adjusted to match both /vendor and /system/vendor. It is assumed that the /vendor symlink, if it exists at all, always points to /system/vendor. The alternative solution of adjusting vendor policy file labelling rules at vendor policy build time, when the actual on-device paths are known, was considered to make it harder to see how files are labelled by looking solely at the source tree. Test: Files under /vendor/bin/hw correctly labelled on sailfish, angler, and a device which uses the /vendor symlink. Bug: 35431549 Change-Id: If6ccb2c9cb85b0589db03ab86de8071e15d5366f
2017-02-16 21:59:44 +01:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.power@1\.0-service u:object_r:hal_power_default_exec:s0
Add power.stats HAL 1.0 sepolicy Also giving statsd permission to access it. This change copies the internal sepolicy to AOSP. Bug: 111185513 Bug: 120551881 Test: make Change-Id: I7e0386777e05580299caf9b97cb7804459f1a9d0
2018-12-10 23:59:57 +01:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.power\.stats@1\.0-service u:object_r:hal_power_stats_default_exec:s0
Add sepolicy for radio.config Bug: 64131518 Test: Compile and flash the device, check whether service vendor.radio-config-hal-1-0 starts Change-Id: Id728658b4acdda87748259b74e6b7438f6283ea5
2018-01-24 00:05:57 +01:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.radio\.config@1\.0-service u:object_r:hal_radio_config_default_exec:s0
Add sepolicy for radio sap 1.2 Bug: 74114758 Test: Checked radio-service and sap-service is on the lshal after running the service Change-Id: I1b18711286e000a7d17664e7d3a2045aeeb8c285
2018-03-29 22:59:00 +02:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.radio@1\.2-radio-service u:object_r:hal_radio_default_exec:s0
/(vendor|system/vendor)/bin/hw/android\.hardware\.radio@1\.2-sap-service u:object_r:hal_radio_default_exec:s0
Add selinux policy for Sensors HAL 2.0 Bug: 122267378 Test: Builds, no dmesg errors when starting Sensors HAL 2.0 Change-Id: Ieb52449579f72421bf8f36fb6af0cb110d04bd1c
2019-01-22 21:59:52 +01:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.sensors@[0-9]\.[0-9]-service u:object_r:hal_sensors_default_exec:s0
SE Policy for Secure Element app and Secure Element HAL Test: App startup on boot Change-Id: I7740aafc088aadf676328e3f1bb8db5175d97102
2018-01-04 19:33:20 +01:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.secure_element@1\.0-service u:object_r:hal_secure_element_default_exec:s0
Move rild to vendor partition. Test: Basic telephony sanity Bug: 35672432 Change-Id: I7d17cc7efda9902013c21d508cefc77baccc06a8
2017-02-24 00:18:44 +01:00
/(vendor|system/vendor)/bin/hw/rild u:object_r:rild_exec:s0
thermal: sepolicy for thermalservice and Thermal HAL revision 1.1 Add sepolicy for thermalserviced daemon, IThermalService binder service, IThermalCallback hwservice, and Thermal HAL revision 1.1. Test: manual: marlin with modified thermal-engine.conf Bug: 30982366 Change-Id: I207fa0f922a4e658338af91dea28c497781e8fe9 (cherry picked from commit ec3b6b7e25f709fcc9c177beebafae885d641f6d)
2017-06-09 20:27:08 +02:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.thermal@1\.[01]-service u:object_r:hal_thermal_default_exec:s0
Add sepolicy for tv.cec Bug: 36562029 Test: m -j40 and CEC functionality works well Change-Id: I5a693e65abdd5139a848d939149a475056cc41e8
2017-04-05 04:20:48 +02:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.tv\.cec@1\.0-service u:object_r:hal_tv_cec_default_exec:s0
Add sepolicy for tv.input Test: build, flash; adb shell lshal Bug: 36562029 Change-Id: If8f6d8dbd99d31e6627fa4b7c1fd4faea3b75cf2
2017-03-30 00:03:59 +02:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.tv\.input@1\.0-service u:object_r:hal_tv_input_default_exec:s0
Tuner Hal 1.0 Enable ITuner service Test: cuttlefish Bug: 135708935 Change-Id: Ica063458860df45f0e2ab640a2ab35cd4da3da8e
2019-08-09 23:27:17 +02:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.tv\.tuner@1\.0-service u:object_r:hal_tv_tuner_default_exec:s0
Label /vendor/bin/hw on devices without vendor partition SELinux labeling of filesystem files ignores symlinks. Unfortunately, /vendor is a symlink on devices without vendor partition (e.g., hikey). Thus, policy in directories which are used both for devices with vendor partition and for devices without vendor partition must be adjusted to match both /vendor and /system/vendor. It is assumed that the /vendor symlink, if it exists at all, always points to /system/vendor. The alternative solution of adjusting vendor policy file labelling rules at vendor policy build time, when the actual on-device paths are known, was considered to make it harder to see how files are labelled by looking solely at the source tree. Test: Files under /vendor/bin/hw correctly labelled on sailfish, angler, and a device which uses the /vendor symlink. Bug: 35431549 Change-Id: If6ccb2c9cb85b0589db03ab86de8071e15d5366f
2017-02-16 21:59:44 +01:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.usb@1\.0-service u:object_r:hal_usb_default_exec:s0
/(vendor|system/vendor)/bin/hw/android\.hardware\.vibrator@1\.0-service u:object_r:hal_vibrator_default_exec:s0
/(vendor|system/vendor)/bin/hw/android\.hardware\.vr@1\.0-service u:object_r:hal_vr_default_exec:s0
SE Policy for Wifi Offload HAL Update SE Policy to allow calls to and callbacks from Wifi Offload HAL HIDL binderized service. Cherry pick from d56aa1982d15acfc2408271138dac43f1e5dc987 Bug: 32842314 Test: Unit tests, Mannual test to ensure Wifi can be brought up and connected to an AP, ensure that Offload HAL service is running and that that wificond can get the service handle by calling hwservicemanager. Change-Id: I0fc51a4152f1891c8d88967e75d45ded115e766e
2017-03-01 19:25:44 +01:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.wifi\.offload@1\.0-service u:object_r:hal_wifi_offload_default_exec:s0
Label /vendor/bin/hw on devices without vendor partition SELinux labeling of filesystem files ignores symlinks. Unfortunately, /vendor is a symlink on devices without vendor partition (e.g., hikey). Thus, policy in directories which are used both for devices with vendor partition and for devices without vendor partition must be adjusted to match both /vendor and /system/vendor. It is assumed that the /vendor symlink, if it exists at all, always points to /system/vendor. The alternative solution of adjusting vendor policy file labelling rules at vendor policy build time, when the actual on-device paths are known, was considered to make it harder to see how files are labelled by looking solely at the source tree. Test: Files under /vendor/bin/hw correctly labelled on sailfish, angler, and a device which uses the /vendor symlink. Bug: 35431549 Change-Id: If6ccb2c9cb85b0589db03ab86de8071e15d5366f
2017-02-16 21:59:44 +01:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.wifi@1\.0-service u:object_r:hal_wifi_default_exec:s0
Allow lazy wifi HAL to run Test: Manually check that lazy wifi HAL runs Bug: 123307146 Change-Id: I22f9bc7a097056215d249b692b6f39a71b6b9811
2019-01-15 19:06:20 +01:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.wifi@1\.0-service-lazy u:object_r:hal_wifi_default_exec:s0
sepolicy(hostapd): Add a HIDL interface for hostapd Change sepolicy permissions to now classify hostapd as a HAL exposing HIDL interface. Sepolicy denial for accessing /data/vendor/misc/wifi/hostapd: 12-27 23:40:55.913 4952 4952 W hostapd : type=1400 audit(0.0:19): avc: denied { write } for name="hostapd" dev="sda13" ino=4587601 scontext=u:r:hal_wifi_hostapd_default:s0 tcontext=u:object_r:system_data_file:s0 tclass=dir permissive=0 01-02 19:07:16.938 5791 5791 W hostapd : type=1400 audit(0.0:31): avc: denied { search } for name="net" dev="sysfs" ino=30521 scontext=u:r:hal_wifi_hostapd_default:s0 tcontext=u:object_r:sysfs_net:s0 tclass=dir permissive=0 Bug: 36646171 Test: Device boots up and able to turn on SoftAp. Change-Id: Ibacfcc938deab40096b54b8d0e608d53ca91b947
2017-12-23 00:03:15 +01:00
/(vendor|system/vendor)/bin/hw/hostapd u:object_r:hal_wifi_hostapd_default_exec:s0
sepolicy: Move hostapd to vendor Move hostapd to vendor/bin/ because it's only used by WIFI HAL. This commit is for sepolicy corresponding changes. Bug: 34236942 Bug: 34237659 Test: Hotspot works fine. Integration test. Change-Id: I2ee165970a20f4015d5d62fc590d448e9acb92c1
2017-02-11 18:51:10 +01:00
/(vendor|system/vendor)/bin/hw/wpa_supplicant u:object_r:hal_wifi_supplicant_default_exec:s0
Initial sepolicy for vndservicemanager. vndservicemanager is the context manager for binder services that are solely registered and accessed from vendor processes. Bug: 36052864 Test: vendorservicemanager runs Change-Id: Ifbf536932678d0ff13d019635fe6347e185ef387
2017-03-22 00:01:52 +01:00
/(vendor|system/vendor)/bin/vndservicemanager u:object_r:vndservicemanager_exec:s0
sepolicy: relabel /vendor The CL splits /vendor labeling from /system. Which was allowing all processes read, execute access to /vendor. Following directories will remain world readable /vendor/etc /vendor/lib(64)/hw/ Following are currently world readable but their scope will be minimized to platform processes that require access /vendor/app /vendor/framework/ /vendor/overlay Files labelled with 'same_process_hal_file' are allowed to be read + executed from by the world. This is for Same process HALs and their dependencies. Bug: 36527360 Bug: 36832490 Bug: 36681210 Bug: 36680116 Bug: 36690845 Bug: 36697328 Bug: 36696623 Bug: 36806861 Bug: 36656392 Bug: 36696623 Bug: 36792803 All of the tests were done on sailfish, angler, bullhead, dragon Test: Boot and connect to wifi Test: Run chrome and load websites, play video in youtube, load maps w/ current location, take pictures and record video in camera, playback recorded video. Test: Connect to BT headset and ensure BT audio playback works. Test: OTA sideload using recovery Test: CTS SELinuxHostTest pass Change-Id: I278435b72f7551a28f3c229f720ca608b77a7029 Signed-off-by: Sandeep Patil <sspatil@google.com>
2017-04-02 02:17:12 +02:00
#############################
# Same process HALs installed by platform into /vendor
#
/(vendor|system/vendor)/lib(64)?/hw/android\.hardware\.graphics\.mapper@2\.0-impl\.so u:object_r:same_process_hal_file:s0
Add IMapper2.1 same process hal permissions Bug: 135166668 Test: build, boot, VtsHalGraphicsComposerV2_2TargetTest Change-Id: Iedc11b73d3e3ba54dcd622b128cb513adec11d69
2019-06-14 21:28:58 +02:00
/(vendor|system/vendor)/lib(64)?/hw/android\.hardware\.graphics\.mapper@2\.0-impl-2\.1\.so u:object_r:same_process_hal_file:s0
gralloc3: add sepolicy for allocator/mapper 3.0 IAllocator and IMappaer are being rev'd to 3.0. Update sepolicy to allow them to be used. Test: compile with allocator/mapper patches add boot the device Bug: 120493579 Change-Id: Id241c6bd79c02ec93d8dd415539f90a18f733d03
2019-01-06 00:22:41 +01:00
/(vendor|system/vendor)/lib(64)?/hw/android\.hardware\.graphics\.mapper@3\.0-impl\.so u:object_r:same_process_hal_file:s0
gralloc: add IAllocator/IMapper 4.0 sepolicy Add support for gralloc 4.0 to sepolicy Bug: 136016160 Test: Compiles and boots Change-Id: I148cc19176275e8cbd19cc95aa95d4d450353b7a
2019-06-20 23:10:59 +02:00
/(vendor|system/vendor)/lib(64)?/hw/android\.hardware\.graphics\.mapper@4\.0-impl\.so u:object_r:same_process_hal_file:s0
sepolicy: relabel /vendor The CL splits /vendor labeling from /system. Which was allowing all processes read, execute access to /vendor. Following directories will remain world readable /vendor/etc /vendor/lib(64)/hw/ Following are currently world readable but their scope will be minimized to platform processes that require access /vendor/app /vendor/framework/ /vendor/overlay Files labelled with 'same_process_hal_file' are allowed to be read + executed from by the world. This is for Same process HALs and their dependencies. Bug: 36527360 Bug: 36832490 Bug: 36681210 Bug: 36680116 Bug: 36690845 Bug: 36697328 Bug: 36696623 Bug: 36806861 Bug: 36656392 Bug: 36696623 Bug: 36792803 All of the tests were done on sailfish, angler, bullhead, dragon Test: Boot and connect to wifi Test: Run chrome and load websites, play video in youtube, load maps w/ current location, take pictures and record video in camera, playback recorded video. Test: Connect to BT headset and ensure BT audio playback works. Test: OTA sideload using recovery Test: CTS SELinuxHostTest pass Change-Id: I278435b72f7551a28f3c229f720ca608b77a7029 Signed-off-by: Sandeep Patil <sspatil@google.com>
2017-04-02 02:17:12 +02:00
/(vendor|system/vendor)/lib(64)?/hw/android\.hardware\.renderscript@1\.0-impl\.so u:object_r:same_process_hal_file:s0
sepolicy: add missing labels for same process HALs. Some of the same process HAL labeling was missing from Marlin. These are identified by tracking library dependencies. Bug: 37084733 Test: Build and boot sailfish. The change allows the labelled libraries to be opened by any domain. So, the boot test is sufficient. Change-Id: Id55e834d6863ca644f912efdd690fccb71d3eaf3 Signed-off-by: Sandeep Patil <sspatil@google.com>
2017-04-06 22:50:23 +02:00
/(vendor|system/vendor)/lib(64)?/hw/gralloc\.default\.so u:object_r:same_process_hal_file:s0
sepolicy: relabel /vendor The CL splits /vendor labeling from /system. Which was allowing all processes read, execute access to /vendor. Following directories will remain world readable /vendor/etc /vendor/lib(64)/hw/ Following are currently world readable but their scope will be minimized to platform processes that require access /vendor/app /vendor/framework/ /vendor/overlay Files labelled with 'same_process_hal_file' are allowed to be read + executed from by the world. This is for Same process HALs and their dependencies. Bug: 36527360 Bug: 36832490 Bug: 36681210 Bug: 36680116 Bug: 36690845 Bug: 36697328 Bug: 36696623 Bug: 36806861 Bug: 36656392 Bug: 36696623 Bug: 36792803 All of the tests were done on sailfish, angler, bullhead, dragon Test: Boot and connect to wifi Test: Run chrome and load websites, play video in youtube, load maps w/ current location, take pictures and record video in camera, playback recorded video. Test: Connect to BT headset and ensure BT audio playback works. Test: OTA sideload using recovery Test: CTS SELinuxHostTest pass Change-Id: I278435b72f7551a28f3c229f720ca608b77a7029 Signed-off-by: Sandeep Patil <sspatil@google.com>
2017-04-02 02:17:12 +02:00
sepolicy: Move hostapd to vendor Move hostapd to vendor/bin/ because it's only used by WIFI HAL. This commit is for sepolicy corresponding changes. Bug: 34236942 Bug: 34237659 Test: Hotspot works fine. Integration test. Change-Id: I2ee165970a20f4015d5d62fc590d448e9acb92c1
2017-02-11 18:51:10 +01:00
#############################
# Data files
#
sepolicy(hostapd): Add a HIDL interface for hostapd Change sepolicy permissions to now classify hostapd as a HAL exposing HIDL interface. Sepolicy denial for accessing /data/vendor/misc/wifi/hostapd: 12-27 23:40:55.913 4952 4952 W hostapd : type=1400 audit(0.0:19): avc: denied { write } for name="hostapd" dev="sda13" ino=4587601 scontext=u:r:hal_wifi_hostapd_default:s0 tcontext=u:object_r:system_data_file:s0 tclass=dir permissive=0 01-02 19:07:16.938 5791 5791 W hostapd : type=1400 audit(0.0:31): avc: denied { search } for name="net" dev="sysfs" ino=30521 scontext=u:r:hal_wifi_hostapd_default:s0 tcontext=u:object_r:sysfs_net:s0 tclass=dir permissive=0 Bug: 36646171 Test: Device boots up and able to turn on SoftAp. Change-Id: Ibacfcc938deab40096b54b8d0e608d53ca91b947
2017-12-23 00:03:15 +01:00
/data/vendor/wifi/hostapd(/.*)? u:object_r:hostapd_data_file:s0
wpa_supplicant: move control sockets to /data/vendor Treble compliance. Bug: 70228425 Bug: 70393317 Test: complete wifi test in b/70393317 Test: Test wifi on Taimen and Sailfish Test: verify sockets exist in /data/vendor/wifi/wpa/sockets Change-Id: I217c0eda0e5af50bb603cfcc35d60bf0d9cad72e
2018-01-24 17:49:16 +01:00
/data/vendor/wifi/wpa(/.*)? u:object_r:wpa_data_file:s0
Reference in a new issue Copy permalink