tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
platform_system_sepolicy/vendor/file_contexts

135 lines
14 KiB
Text
Raw Normal View History

Move hals to vendor partition. Bug: 34135607 Test: hals work Merged-In: I6a1f87438bb5b540fce900e9ec5df07d3f4f6bd4 Change-Id: I6a1f87438bb5b540fce900e9ec5df07d3f4f6bd4
2017-02-13 18:09:56 +01:00
#############################
# Default HALs
#
Add atrace HAL 1.0 sepolicy Bug: 111098596 Test: atrace/systrace Change-Id: I06ca76750d640c98849c475c8a237d62c8e582b9
2018-09-20 01:06:28 +02:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.atrace@1\.0-service u:object_r:hal_atrace_default_exec:s0
Rename audio hal service The audio HAL service name previously contained the audio HAL version of the first audio HAL it supported. Nevertheless, the same service can and do host all audio HAL versions. Aka there is only one audio HAL service, and the version in its name is technical dept and should not be changed. This caused many confusions during vendor HAL upgrade as the service version number was erroneously updated leading to device boot loop. The new service name is: android.hardware.audio.service The old one was: android.hardware.audio@2.0-service Keeping both names valid as most phones will not rename the service immediately. Bug: 78516186 Test: boot & check the audio HAL is up with the old and new name Change-Id: I2ce0182fd919af6eb8325d49682b4374be00344e Signed-off-by: Kevin Rocard <krocard@google.com>
2019-07-04 01:31:20 +02:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.audio(@2\.0-|\.)service u:object_r:hal_audio_default_exec:s0
Add android.hardware.audio@7.0-service.example service This service will demonstrate a minimal audio HAL V7.0 Bug: 142480271 Test: atest VtsHalAudioV7_0TargetTest (HAL and test are not available in AOSP yet) Change-Id: I2e7f166a47f21eb6c8621d0ddb33cfea84aa20da
2020-09-25 01:35:34 +02:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.audio@7\.0-service\.example u:object_r:hal_audio_default_exec:s0
AIDL effect: Add default Effect factory implementation to platform sepolicy Add example implementation services: IFactory under android.hardware.audio.effect. An audio HAL AIDL example service will register with the default implementations. Bug: 238913361 Test: m, and flash with Pixel 6a. Change-Id: Ib331899fd47b6b334b120e20617174d01e71ddb8
2022-07-13 06:24:12 +02:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.audio\.service-aidl\.example u:object_r:hal_audio_default_exec:s0
/(vendor|system/vendor)/bin/hw/android\.hardware\.audio\.effect\.service-aidl\.example u:object_r:hal_audio_default_exec:s0
Adding support for AIDL AudioControl HAL Bug: 170335834 Test: built and ran without sepolicy issues Change-Id: Ia25b82aaf676fd2bd37e60bc0d2960f398fa3c90
2020-10-23 22:30:14 +02:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.automotive\.audiocontrol@1\.0-service u:object_r:hal_audiocontrol_default_exec:s0
/(vendor|system/vendor)/bin/hw/android\.hardware\.automotive\.audiocontrol@2\.0-service u:object_r:hal_audiocontrol_default_exec:s0
/(vendor|system/vendor)/bin/hw/android\.hardware\.automotive\.audiocontrol-service.example u:object_r:hal_audiocontrol_default_exec:s0
SEPolicy rules for CAN bus HAL Bug: 135918744 Test: VTS (separate new change) Change-Id: Idd3ca882e3bd36b95a5412bdfbf6fe9d6e911ba9
2019-07-24 02:38:51 +02:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.automotive\.can@1\.0-service u:object_r:hal_can_socketcan_exec:s0
Revert^2 "Updates sepolicy for EVS HAL" 418f41ad13eced0ad509e7315af1b26cfa3eca8c Bug: 216727303 Test: m -j selinux_policy on failed targets reported in b/218802298 Change-Id: Iec8fd2a1e9073bf3dc679e308407572a8fcf44d9
2022-02-10 15:09:02 +01:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.automotive\.evs(.*)? u:object_r:hal_evs_default_exec:s0
Update default VHAL name in selinux policy. Test: Presubmit Bug: 192276902 Change-Id: I0851826f69b22a06830b40c72c7e9fa720810053
2021-07-03 03:02:36 +02:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.automotive\.vehicle@2\.0-((default|emulator)-)*(service|protocan-service) u:object_r:hal_vehicle_default_exec:s0
Allow AIDL VHAL service. Test: None Bug: 215419573 Change-Id: Iaeb91e06a1a8e2218ab5cb98f05c024546c0c2e7
2022-01-20 04:00:51 +01:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.automotive\.vehicle@V1-(default|emulator)-service u:object_r:hal_vehicle_default_exec:s0
Create selinux policy for remoteaccess HAL. Will add fuzzer once the service is implemented. Test: Run remoteaccess HAL on gcar_emu. Verify the service is running. Bug: 241483300 Change-Id: I01b31a88414536ddd90f9098f422ae43a48cf726
2022-09-14 02:06:55 +02:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.automotive\.remoteaccess@V1-default-service u:object_r:hal_remoteaccess_default_exec:s0
Fix File Context Entry for Bluetooth Services. Test: Boot on HiKey960 and check dmesg errors. Change-Id: I9ac0968753c7cd9a23c63eac98b20a7778277716 Signed-off-by: Harpreet \"Eli\" Sangha <eliptus@google.com>
2019-11-26 08:49:47 +01:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.bluetooth@1\.[0-9]+-service u:object_r:hal_bluetooth_default_exec:s0
/(vendor|system/vendor)/bin/hw/android\.hardware\.bluetooth@1\.[0-9]+-service\.btlinux u:object_r:hal_bluetooth_btlinux_exec:s0
Add sepolicy for biometrics.face@1.[0-9] Bug: 151331855 Bug: 145027036 Test: build and run on cuttlefish Change-Id: Iae0f157d3a670b506d6cc82686318544db41d559
2020-03-23 22:04:58 +01:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.biometrics\.face@1\.[0-9]+-service\.example u:object_r:hal_face_default_exec:s0
Add sepolicy for IFace Bug: 168730443 Test: run on cuttlefish Change-Id: Ie3cf791e7aac090788c7213d23487ae9f50b0690
2020-09-25 20:38:42 +02:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.biometrics\.face-service\.example u:object_r:hal_face_default_exec:s0
Add sepolicy for IFingerprint Bug: 152416783 Test: run on cuttlefish Change-Id: I58d7c3bc9c81612b03bab3b9da938c091c02e3c1
2020-09-02 22:32:05 +02:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.biometrics\.fingerprint@2\.1-service u:object_r:hal_fingerprint_default_exec:s0
Add SEPolicy for fingerprint2.2 example HAL Bug: 172957689 Test: atest CtsBiometricsTestCases Change-Id: I0de92a880e4ca04765da3e3184e5ad0382dc958a
2020-12-03 03:45:34 +01:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.biometrics\.fingerprint@2\.2-service\.example u:object_r:hal_fingerprint_default_exec:s0
Restrict the policy for IFingerprint to example only Bug: 152416783 Test: run on cuttlefish Change-Id: I3df58ca37c4d7f183690ab4f6917515f9a3eb5be
2020-09-25 19:55:45 +02:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.biometrics\.fingerprint-service\.example u:object_r:hal_fingerprint_default_exec:s0
Add sepolicy for IBootControl 1.1 and the default HAL. Bug: 138861550 Test: manual test Change-Id: Ibc9a55266a2726cb8dc8550be0264db30b66109e
2019-08-30 22:55:50 +02:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.boot@1\.[0-9]+-service u:object_r:hal_bootctl_default_exec:s0
Add sepolicy for IBootControl AIDL Test: th Bug: 227536004 Change-Id: I1206b4aae1aab904a76836c893ee583b5ce54624
2022-03-31 05:05:23 +02:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.boot-service.default u:object_r:hal_bootctl_default_exec:s0
Add broadcast radio HAL 2.0 default implementation to the sepolicy. Test: VTS Bug: 69958777 Change-Id: I6db7dd9afc9c7f254a0233ff3144b02e48727038
2017-12-07 18:48:16 +01:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.broadcastradio@\d+\.\d+-service u:object_r:hal_broadcastradio_default_exec:s0
Applying new IBroadcastRadio AIDL Update Sepolicy for AIDL broadcast radio HAL. Ignore fuzzer default AIDL implementation for now. Bug: 170336130 Test: m -j Change-Id: Ie55c08c6a721de1f8dc40acc81de68565f99f7d7
2022-05-18 19:51:18 +02:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.broadcastradio-service.default u:object_r:hal_broadcastradio_default_exec:s0
Allow camera provider services following AIDL naming conventions Android 13 moved to using AIDL for HALs, which have different version and naming conventions as compared to the new deprecated HIDL. This CL updates the regex to include camera provider implementations that follow AIDL naming conventions in the allowlist. Bug: 219974678 Test: Manually tested that AIDL implementation is allowed to run Change-Id: Ic005703bdaaa6376ca4714f22f89271b2a8878f2
2022-06-15 00:06:25 +02:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.camera\.provider(@2\.[0-9]+|-V1)-service_64 u:object_r:hal_camera_default_exec:s0
/(vendor|system/vendor)/bin/hw/android\.hardware\.camera\.provider(@2\.[0-9]+|-V1)-service u:object_r:hal_camera_default_exec:s0
/(vendor|system/vendor)/bin/hw/android\.hardware\.camera\.provider(@2\.[0-9]+|-V1)-service-lazy_64 u:object_r:hal_camera_default_exec:s0
/(vendor|system/vendor)/bin/hw/android\.hardware\.camera\.provider(@2\.[0-9]+|-V1)-service-lazy u:object_r:hal_camera_default_exec:s0
/(vendor|system/vendor)/bin/hw/android\.hardware\.camera\.provider(@2\.[0-9]+|-V1)-external-service u:object_r:hal_camera_default_exec:s0
/(vendor|system/vendor)/bin/hw/android\.hardware\.camera\.provider(@2\.[0-9]+|-V1)-external-service-lazy u:object_r:hal_camera_default_exec:s0
configstore: assign label to all minor versions of configstore service Added rule: /(vendor|system/vendor)/bin/hw/android\.hardware\.configstore@1\.[0-9]-service u:object_r:hal_configstore_default_exec:s0 Bug: 37727469 Test: Built and tested on Sailfish Change-Id: Icf167fad1c7e601c3662f527d1e3e844ff517b58
2017-05-02 07:54:19 +02:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.configstore@1\.[0-9]+-service u:object_r:hal_configstore_default_exec:s0
Added default policy for Confirmation UI HAL Bug: 63928580 Test: Manually tested. Change-Id: If6bb10cb7c009883d853e46dcdeb92cd33877d53
2018-01-09 23:42:53 +01:00
/(vendor|sustem/vendor)/bin/hw/android\.hardware\.confirmationui@1\.0-service u:object_r:hal_confirmationui_default_exec:s0
Update file_contexts for contexthub HAL 1.1 Bug: 135951924 Test: Verify this lets contexthub HAL 1.1 run on a device that supports it Change-Id: I049e77d476ac0d090e48895a19a454b764aac74c
2020-02-15 02:09:10 +01:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.contexthub@1\.[0-9]+-service u:object_r:hal_contexthub_default_exec:s0
Context Hub stable AIDL sepolicy Bug: 194285834 Test: TreeHugger Change-Id: I88675f7f61821619abbff87fa5ee321836745324
2021-08-11 00:06:43 +02:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.contexthub-service\.example u:object_r:hal_contexthub_default_exec:s0
Label /vendor/bin/hw on devices without vendor partition SELinux labeling of filesystem files ignores symlinks. Unfortunately, /vendor is a symlink on devices without vendor partition (e.g., hikey). Thus, policy in directories which are used both for devices with vendor partition and for devices without vendor partition must be adjusted to match both /vendor and /system/vendor. It is assumed that the /vendor symlink, if it exists at all, always points to /system/vendor. The alternative solution of adjusting vendor policy file labelling rules at vendor policy build time, when the actual on-device paths are known, was considered to make it harder to see how files are labelled by looking solely at the source tree. Test: Files under /vendor/bin/hw correctly labelled on sailfish, angler, and a device which uses the /vendor symlink. Bug: 35431549 Change-Id: If6ccb2c9cb85b0589db03ab86de8071e15d5366f
2017-02-16 21:59:44 +01:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.drm@1\.0-service u:object_r:hal_drm_default_exec:s0
Allow lazy drm services to run Change-Id: I13f7bb0d04b5388180683edd6d5dc75555ada644
2018-12-07 19:28:27 +01:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.drm@1\.0-service-lazy u:object_r:hal_drm_default_exec:s0
clearkey aidl file_contexts: update path regex Bug: 221078453 Change-Id: Ic7c0e5a68554f254afb7fbe886fce106c34056ff
2022-03-09 23:57:07 +01:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.drm-service(-lazy)?\.clearkey u:object_r:hal_drm_clearkey_aidl_exec:s0
Update sepolicy to support cas@1.2 Test: Manual bug: 141783130 Change-Id: I973cb5d59d74c495eea18f4865baf0bd6f55e2fb
2019-10-15 02:37:17 +02:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.cas@1\.[0-2]-service u:object_r:hal_cas_default_exec:s0
/(vendor|system/vendor)/bin/hw/android\.hardware\.cas@1\.[0-2]-service-lazy u:object_r:hal_cas_default_exec:s0
Add android.hardware.dumpstate@1.1-service.example to file_contexts Bug: 152067221 Test: VtsHalDumpstateV1_1TargetTest Signed-off-by: Roman Kiryanov <rkir@google.com> Change-Id: I448e1e4bd94c16f0f8cbd07a7d8390c0201056fa
2020-03-23 19:24:38 +01:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.dumpstate@1\.[0-1]-service\.example u:object_r:hal_dumpstate_default_exec:s0
Update sepolicy to add dumpstate device service for AIDL HAL - Add hal_dumpstate_service AIDL service to hal_dumpstate.te, service.te - Add default example hal_dumpstate service to file_contexts, service_contexts - Adde hal_dumpstate_service to API level 31 compatibility ignore list (31.0.ignore.cil) Bug: 205760700 Test: VtsHalDumpstateTargetTest, dumpstate, dumpstate_test, dumpsys Change-Id: If49fa16ac5ab1d3a1930bb800d530cbd32c5dec1
2021-11-16 10:06:00 +01:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.dumpstate-service\.example u:object_r:hal_dumpstate_default_exec:s0
Label /vendor/bin/hw on devices without vendor partition SELinux labeling of filesystem files ignores symlinks. Unfortunately, /vendor is a symlink on devices without vendor partition (e.g., hikey). Thus, policy in directories which are used both for devices with vendor partition and for devices without vendor partition must be adjusted to match both /vendor and /system/vendor. It is assumed that the /vendor symlink, if it exists at all, always points to /system/vendor. The alternative solution of adjusting vendor policy file labelling rules at vendor policy build time, when the actual on-device paths are known, was considered to make it harder to see how files are labelled by looking solely at the source tree. Test: Files under /vendor/bin/hw correctly labelled on sailfish, angler, and a device which uses the /vendor symlink. Bug: 35431549 Change-Id: If6ccb2c9cb85b0589db03ab86de8071e15d5366f
2017-02-16 21:59:44 +01:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.gatekeeper@1\.0-service u:object_r:hal_gatekeeper_default_exec:s0
Add GNSS AIDL interfaces (system/sepolicy) Bug: 159467682 Test: built and run on cuttlefish Change-Id: I071e8427ea0251139661aa8123376c56e0839390
2020-09-15 20:35:29 +02:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.gnss-service.example u:object_r:hal_gnss_default_exec:s0
Add sepolicy for GNSS HAL 2.0 and 1.1 Bug: 112260995 Bug: 120277977 Test: atest VtsHalGnssV2_0TargetTest Change-Id: I196d8506b2f7c2153e1f647ea5ba61b81bf3d881
2018-12-12 21:15:41 +01:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.gnss@[0-9]\.[0-9]-service u:object_r:hal_gnss_default_exec:s0
Label /vendor/bin/hw on devices without vendor partition SELinux labeling of filesystem files ignores symlinks. Unfortunately, /vendor is a symlink on devices without vendor partition (e.g., hikey). Thus, policy in directories which are used both for devices with vendor partition and for devices without vendor partition must be adjusted to match both /vendor and /system/vendor. It is assumed that the /vendor symlink, if it exists at all, always points to /system/vendor. The alternative solution of adjusting vendor policy file labelling rules at vendor policy build time, when the actual on-device paths are known, was considered to make it harder to see how files are labelled by looking solely at the source tree. Test: Files under /vendor/bin/hw correctly labelled on sailfish, angler, and a device which uses the /vendor symlink. Bug: 35431549 Change-Id: If6ccb2c9cb85b0589db03ab86de8071e15d5366f
2017-02-16 21:59:44 +01:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.graphics\.allocator@2\.0-service u:object_r:hal_graphics_allocator_default_exec:s0
gralloc3: add sepolicy for allocator/mapper 3.0 IAllocator and IMappaer are being rev'd to 3.0. Update sepolicy to allow them to be used. Test: compile with allocator/mapper patches add boot the device Bug: 120493579 Change-Id: Id241c6bd79c02ec93d8dd415539f90a18f733d03
2019-01-06 00:22:41 +01:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.graphics\.allocator@3\.0-service u:object_r:hal_graphics_allocator_default_exec:s0
gralloc: add IAllocator/IMapper 4.0 sepolicy Add support for gralloc 4.0 to sepolicy Bug: 136016160 Test: Compiles and boots Change-Id: I148cc19176275e8cbd19cc95aa95d4d450353b7a
2019-06-20 23:10:59 +02:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.graphics\.allocator@4\.0-service u:object_r:hal_graphics_allocator_default_exec:s0
Add sepolicy for graphics IAllocator AIDL based HAL Bug: 217776226 Bug: 218383959 Test: Boots to home with the new HAL Change-Id: I8d0d2182d389c39b54f492d4d6df64ca14737997
2022-02-24 20:38:31 +01:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.graphics\.allocator-V1-service u:object_r:hal_graphics_allocator_default_exec:s0
[SEPolicy] Add composer 2.3 Use regular expression for all composer service versions. BUG: 115554640 Test: Build, flash and boot Change-Id: Ie84ebb0a43c9eaad66829b15deaa8b3046bd7fe4
2018-12-21 15:42:33 +01:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.graphics\.composer@[0-9]\.[0-9]-service u:object_r:hal_graphics_composer_default_exec:s0
Composer stable AIDL HAL sepolicy Test: build + presubmit Bug: 198690444 Change-Id: I6a26823c4ad363d137526c96580b05363d0ac894
2021-10-20 02:09:30 +02:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.graphics\.composer3-service\.example u:object_r:hal_graphics_composer_default_exec:s0
Label /vendor/bin/hw on devices without vendor partition SELinux labeling of filesystem files ignores symlinks. Unfortunately, /vendor is a symlink on devices without vendor partition (e.g., hikey). Thus, policy in directories which are used both for devices with vendor partition and for devices without vendor partition must be adjusted to match both /vendor and /system/vendor. It is assumed that the /vendor symlink, if it exists at all, always points to /system/vendor. The alternative solution of adjusting vendor policy file labelling rules at vendor policy build time, when the actual on-device paths are known, was considered to make it harder to see how files are labelled by looking solely at the source tree. Test: Files under /vendor/bin/hw correctly labelled on sailfish, angler, and a device which uses the /vendor symlink. Bug: 35431549 Change-Id: If6ccb2c9cb85b0589db03ab86de8071e15d5366f
2017-02-16 21:59:44 +01:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.health@1\.0-service u:object_r:hal_health_default_exec:s0
selinux changes for android.hardware.health@2.0 health@2.0 is a service used by BatteryService in framework. Test: health hal works Change-Id: I6cccf3ab085686fd67b0e048aaf201e64ec311c4
2017-06-02 22:59:39 +02:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.health@2\.0-service u:object_r:hal_health_default_exec:s0
Add health 2.1 HAL Test: VTS health 2.1 HAL test Bug: 137670450 Change-Id: Iedc6972154c6e948eaf22b4650da39a9e73cb6f8
2019-10-07 23:24:41 +02:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.health@2\.1-service u:object_r:hal_health_default_exec:s0
Add health AIDL HAL. Test: pass Bug: 177269435 Change-Id: I755d5158715b38a89a28af753ad4c27cdfa93546
2021-10-20 22:43:45 +02:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.health-service\.example u:object_r:hal_health_default_exec:s0
health.filesystem HAL renamed to health.storage ...to reflect that the HAL operates on storage devices, not filesystem. Bug: 111655771 Test: compiles Change-Id: Ibb0572cb1878359e5944aa6711331f0c7993ba6e
2018-09-19 19:24:45 +02:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.health\.storage@1\.0-service u:object_r:hal_health_storage_default_exec:s0
Add health storage AIDL service. Test: adb shell sm idle-maint run Bug: 177470478 Change-Id: Id7ee5af64e8d21eafd041c9e8fa1382f65a3958b
2021-01-16 01:33:41 +01:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.health\.storage-service\.default u:object_r:hal_health_storage_default_exec:s0
Add SELinux policy for credstore and update for IC HAL port from HIDL to AIDL. The credstore service is a system service which backs the android.security.identity.* Framework APIs. It essentially calls into the Identity Credential HAL while providing persistent storage for credentials. Bug: 111446262 Test: atest android.security.identity.cts Test: VtsHalIdentityTargetTest Test: android.hardware.identity-support-lib-test Change-Id: I5cd9a6ae810e764326355c0842e88c490f214c60
2020-01-17 22:47:53 +01:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.identity-service.example u:object_r:hal_identity_default_exec:s0
Permissions for InputClassifier HAL Add the required permissions for the InputClassifier HAL. Bug: 62940136 Test: no selinux denials in logcat when HAL is used inside input flinger. Change-Id: Ibc9b115a83719421d56ecb4bca2fd196ec71fd76
2018-01-17 21:27:06 +01:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.input\.classifier@1\.0-service u:object_r:hal_input_classifier_default_exec:s0
Add sepolicy for IInputProcessor HAL This sepolicy is needed so that the vendor can launch a new HAL process, and then this HAL process could join the servicemanager as an impl for IInputProcessor. This HAL will be used to contain the previous impl of InputClassifier and also new features that we are going to add. Bug: 210158587 Test: use together with a HAL implementation, make sure HAL runs Change-Id: I476c215ad622ea18b4ce5cba9c07ae3257a65817
2022-01-12 00:06:14 +01:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.input\.processor-service u:object_r:hal_input_processor_default_exec:s0
Label /vendor/bin/hw on devices without vendor partition SELinux labeling of filesystem files ignores symlinks. Unfortunately, /vendor is a symlink on devices without vendor partition (e.g., hikey). Thus, policy in directories which are used both for devices with vendor partition and for devices without vendor partition must be adjusted to match both /vendor and /system/vendor. It is assumed that the /vendor symlink, if it exists at all, always points to /system/vendor. The alternative solution of adjusting vendor policy file labelling rules at vendor policy build time, when the actual on-device paths are known, was considered to make it harder to see how files are labelled by looking solely at the source tree. Test: Files under /vendor/bin/hw correctly labelled on sailfish, angler, and a device which uses the /vendor symlink. Bug: 35431549 Change-Id: If6ccb2c9cb85b0589db03ab86de8071e15d5366f
2017-02-16 21:59:44 +01:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.ir@1\.0-service u:object_r:hal_ir_default_exec:s0
Add policy for new AIDL IR hal IR interface is converted to AIDL and this contains the necessary permissions for the default service to serve the interface. Test: atest VtsHalIrTargetTest hal_implementation_test Test: check for permission issues after tests Bug: 205000342 Change-Id: I8d9d81d957bf6ef3c6d815ce089549f8f5337555
2021-11-09 22:01:09 +01:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.ir-service\.example u:object_r:hal_ir_default_exec:s0
Label /vendor/bin/hw on devices without vendor partition SELinux labeling of filesystem files ignores symlinks. Unfortunately, /vendor is a symlink on devices without vendor partition (e.g., hikey). Thus, policy in directories which are used both for devices with vendor partition and for devices without vendor partition must be adjusted to match both /vendor and /system/vendor. It is assumed that the /vendor symlink, if it exists at all, always points to /system/vendor. The alternative solution of adjusting vendor policy file labelling rules at vendor policy build time, when the actual on-device paths are known, was considered to make it harder to see how files are labelled by looking solely at the source tree. Test: Files under /vendor/bin/hw correctly labelled on sailfish, angler, and a device which uses the /vendor symlink. Bug: 35431549 Change-Id: If6ccb2c9cb85b0589db03ab86de8071e15d5366f
2017-02-16 21:59:44 +01:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.keymaster@3\.0-service u:object_r:hal_keymaster_default_exec:s0
Add file context for keymaster 4.0 service. Test: Boot the device Change-Id: Ia468941e78803edebe311c73f424a41ac1faeaee
2018-01-03 18:55:13 +01:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.keymaster@4\.0-service u:object_r:hal_keymaster_default_exec:s0
Add Keymaster 4.1 Bug: 140193672 Bug: 140192237 Bug: 140824829 Test: Manual boot test Change-Id: Iccc8cc5e8fc7c9301478faa50d0e18fa917283fb
2019-11-13 01:50:44 +01:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.keymaster@4\.1-service u:object_r:hal_keymaster_default_exec:s0
Label /vendor/bin/hw on devices without vendor partition SELinux labeling of filesystem files ignores symlinks. Unfortunately, /vendor is a symlink on devices without vendor partition (e.g., hikey). Thus, policy in directories which are used both for devices with vendor partition and for devices without vendor partition must be adjusted to match both /vendor and /system/vendor. It is assumed that the /vendor symlink, if it exists at all, always points to /system/vendor. The alternative solution of adjusting vendor policy file labelling rules at vendor policy build time, when the actual on-device paths are known, was considered to make it harder to see how files are labelled by looking solely at the source tree. Test: Files under /vendor/bin/hw correctly labelled on sailfish, angler, and a device which uses the /vendor symlink. Bug: 35431549 Change-Id: If6ccb2c9cb85b0589db03ab86de8071e15d5366f
2017-02-16 21:59:44 +01:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.light@2\.0-service u:object_r:hal_light_default_exec:s0
Allow lazy HAL to run Test: Manual Change-Id: Ic4c3fd5b2d8d709573f8cc6332a6340d28d3ba26
2019-01-17 00:37:39 +01:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.light@2\.0-service-lazy u:object_r:hal_light_default_exec:s0
Label android.hardware.lights-service.example as hal_light_default_exec Bug: 152544844 Test: ls -Z /vendor/bin/hw/android.hardware.lights-service.example Signed-off-by: Roman Kiryanov <rkir@google.com> Change-Id: I32a6a443c57986b37fdcca788bfe01bf0cdd3e07
2020-03-26 22:30:51 +01:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.lights-service\.example u:object_r:hal_light_default_exec:s0
lowpan: Added support for LoWPAN Service and android.hardware.lowpan Bug: b/64090883 Bug: b/33073713 Test: Manual Change-Id: I7aa23c31b1fccae56c1a0e0bd4cfe370aeb911dd
2017-04-21 23:25:53 +02:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.lowpan@1\.0-service u:object_r:hal_lowpan_default_exec:s0
Label /vendor/bin/hw on devices without vendor partition SELinux labeling of filesystem files ignores symlinks. Unfortunately, /vendor is a symlink on devices without vendor partition (e.g., hikey). Thus, policy in directories which are used both for devices with vendor partition and for devices without vendor partition must be adjusted to match both /vendor and /system/vendor. It is assumed that the /vendor symlink, if it exists at all, always points to /system/vendor. The alternative solution of adjusting vendor policy file labelling rules at vendor policy build time, when the actual on-device paths are known, was considered to make it harder to see how files are labelled by looking solely at the source tree. Test: Files under /vendor/bin/hw correctly labelled on sailfish, angler, and a device which uses the /vendor symlink. Bug: 35431549 Change-Id: If6ccb2c9cb85b0589db03ab86de8071e15d5366f
2017-02-16 21:59:44 +01:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.memtrack@1\.0-service u:object_r:hal_memtrack_default_exec:s0
Reland: Memtrack HAL stable aidl sepolicy Bug: 175021432 Test: Check logcat for denials Change-Id: Id92fc543791072d8682e3a89cbf08370007108bf
2020-12-07 02:51:08 +01:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.memtrack-service.example u:object_r:hal_memtrack_default_exec:s0
Label /vendor/bin/hw on devices without vendor partition SELinux labeling of filesystem files ignores symlinks. Unfortunately, /vendor is a symlink on devices without vendor partition (e.g., hikey). Thus, policy in directories which are used both for devices with vendor partition and for devices without vendor partition must be adjusted to match both /vendor and /system/vendor. It is assumed that the /vendor symlink, if it exists at all, always points to /system/vendor. The alternative solution of adjusting vendor policy file labelling rules at vendor policy build time, when the actual on-device paths are known, was considered to make it harder to see how files are labelled by looking solely at the source tree. Test: Files under /vendor/bin/hw correctly labelled on sailfish, angler, and a device which uses the /vendor symlink. Bug: 35431549 Change-Id: If6ccb2c9cb85b0589db03ab86de8071e15d5366f
2017-02-16 21:59:44 +01:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.nfc@1\.0-service u:object_r:hal_nfc_default_exec:s0
Add sepolicy for NFC 1.1 HAL service Bug: 72746517 Test: Boot a device and check NFC 1.1 service loads Change-Id: Ia281af8add0371525971f076bf513c694e7ea912
2018-01-31 20:10:23 +01:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.nfc@1\.1-service u:object_r:hal_nfc_default_exec:s0
Add sepolicy for nfc hal v1.2 Bug: 130509605 Test: No avc denial log and NFC works with hal v1.2 Change-Id: If54884f76a32705d11f2085f66fe83b9e0354f79
2019-04-22 13:52:55 +02:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.nfc@1\.2-service u:object_r:hal_nfc_default_exec:s0
Move mediacodec to vendor partition. Test: Camera, Photos, YouTube and Play Movies apps. Bug: 35328855 Change-Id: I3643b668817a7336f7ccda781734920fbbcc2c63
2017-02-28 05:35:43 +01:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.media\.omx@1\.0-service u:object_r:mediacodec_exec:s0
Label /vendor/bin/hw on devices without vendor partition SELinux labeling of filesystem files ignores symlinks. Unfortunately, /vendor is a symlink on devices without vendor partition (e.g., hikey). Thus, policy in directories which are used both for devices with vendor partition and for devices without vendor partition must be adjusted to match both /vendor and /system/vendor. It is assumed that the /vendor symlink, if it exists at all, always points to /system/vendor. The alternative solution of adjusting vendor policy file labelling rules at vendor policy build time, when the actual on-device paths are known, was considered to make it harder to see how files are labelled by looking solely at the source tree. Test: Files under /vendor/bin/hw correctly labelled on sailfish, angler, and a device which uses the /vendor symlink. Bug: 35431549 Change-Id: If6ccb2c9cb85b0589db03ab86de8071e15d5366f
2017-02-16 21:59:44 +01:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.power@1\.0-service u:object_r:hal_power_default_exec:s0
Create Power Stats AIDL interface Bug: 162472196 Test: m Merged-In: I948ef2959b25d776d3b01985fea5eb695fd4fc1e Change-Id: I12dc33ce055c7275559cce33142cfb2aacc5471f
2020-08-03 23:31:43 +02:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.power-service\.example u:object_r:hal_power_default_exec:s0
Rename PowerStats HAL service Bug: 169864180 Test: m Merged-In: I79ddf26acf398e80c6ff4a96c26b04aef73feac3 Change-Id: Ic458514285f819f44e50e2bee26a08fc6cf54261
2020-10-06 00:48:37 +02:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.power.stats-service\.example u:object_r:hal_power_stats_default_exec:s0
Add power.stats HAL 1.0 sepolicy BUG: 117424656 BUG: 111185513 Test: run vts -m VtsHalPowerStatsV1_0Target Change-Id: Icb0790219df4189c0dabbe41221e69e56d000755
2018-10-19 22:19:36 +02:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.power\.stats@1\.0-service u:object_r:hal_power_stats_default_exec:s0
Add sepolicy for radio.config Bug: 64131518 Test: Compile and flash the device, check whether service vendor.radio-config-hal-1-0 starts Change-Id: Id728658b4acdda87748259b74e6b7438f6283ea5
2018-01-24 00:05:57 +01:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.radio\.config@1\.0-service u:object_r:hal_radio_config_default_exec:s0
Add sepolicy for radio sap 1.2 Bug: 74114758 Test: Checked radio-service and sap-service is on the lshal after running the service Change-Id: I1b18711286e000a7d17664e7d3a2045aeeb8c285
2018-03-29 22:59:00 +02:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.radio@1\.2-radio-service u:object_r:hal_radio_default_exec:s0
/(vendor|system/vendor)/bin/hw/android\.hardware\.radio@1\.2-sap-service u:object_r:hal_radio_default_exec:s0
Enable Telephony AIDL-HIDL shim HAL Bug: 203699028 Test: Boot with ag/16078505 applied Change-Id: Ib9afbe2217670ccfc163812c6b73d9d11d748d2d
2021-10-21 20:40:31 +02:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.radio-service\.compat u:object_r:hal_radio_default_exec:s0
Add rebootescrow default HAL rules Bug: 63928581 Test: build and check HAL label Change-Id: I057b26eb20c5a6b022c7f391a6c8535f2953051c
2020-01-15 22:14:35 +01:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.rebootescrow-service\.default u:object_r:hal_rebootescrow_default_exec:s0
Add sensors multihal support in file_contexts regex Bug: 144722764 Test: N/A Change-Id: Ic595d9c21639bdf2874dc6734344ff1a41767399
2019-11-19 00:14:54 +01:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.sensors@[0-9]\.[0-9]-service(\.multihal)? u:object_r:hal_sensors_default_exec:s0
Sensors stable AIDL HAL sepolicy Bug: 195593357 Test: TreeHugger Change-Id: I02b88a93d829654a1ce946681b59e648b2cd7550
2021-10-15 17:47:13 +02:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.sensors-service\.example u:object_r:hal_sensors_default_exec:s0
Add sensor multi-HAL AIDL sepolicy Bug: 228525902 Test: Device can boot to home. Change-Id: I9d27967213df83b20cb49014317dcfb7afac1880
2022-04-08 12:31:30 +02:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.sensors-service(\.multihal)? u:object_r:hal_sensors_default_exec:s0
SE Policy for Secure Element app and Secure Element HAL Test: App startup on boot Change-Id: I7740aafc088aadf676328e3f1bb8db5175d97102
2018-01-04 19:33:20 +01:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.secure_element@1\.0-service u:object_r:hal_secure_element_default_exec:s0
Dice HAL: Add policy for dice HAL. And allow diced to talk to the dice HAL. Bug: 198197213 Test: N/A Change-Id: I74797b13656b38b50d7cd28a4c4c6ec4c8d1d1aa
2021-11-10 23:52:05 +01:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.security\.dice-service\.non-secure-software u:object_r:hal_dice_default_exec:s0
Clean up keymint service policy. Test: VtsAidlKeyMintTargetTest Change-Id: Id6e83d63ffb1de7c48dbdf435fd9988e9174cfe2
2020-12-11 02:48:31 +01:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.security\.keymint-service u:object_r:hal_keymint_default_exec:s0
Move rild to vendor partition. Test: Basic telephony sanity Bug: 35672432 Change-Id: I7d17cc7efda9902013c21d508cefc77baccc06a8
2017-02-24 00:18:44 +01:00
/(vendor|system/vendor)/bin/hw/rild u:object_r:rild_exec:s0
thermal: sepolicy for thermalservice and Thermal HAL revision 1.1 Add sepolicy for thermalserviced daemon, IThermalService binder service, IThermalCallback hwservice, and Thermal HAL revision 1.1. Test: manual: marlin with modified thermal-engine.conf Bug: 30982366 Change-Id: I207fa0f922a4e658338af91dea28c497781e8fe9 (cherry picked from commit ec3b6b7e25f709fcc9c177beebafae885d641f6d)
2017-06-09 20:27:08 +02:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.thermal@1\.[01]-service u:object_r:hal_thermal_default_exec:s0
Add CEC HAL 1.1 Update contexts to include CEC HAL v1.1 Bug: 169121290 Test: make Change-Id: Ia28afad7d9963886b0d4286436e2024cdd93c8d4
2021-02-15 09:26:36 +01:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.tv\.cec@1\.[01]-service u:object_r:hal_tv_cec_default_exec:s0
Add sepolicy for tv.input Test: build, flash; adb shell lshal Bug: 36562029 Change-Id: If8f6d8dbd99d31e6627fa4b7c1fd4faea3b75cf2
2017-03-30 00:03:59 +02:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.tv\.input@1\.0-service u:object_r:hal_tv_input_default_exec:s0
TV Input HAL 2.0 sepolicy Bug: 227673740 Test: atest VtsHalTvInputTargetTest Change-Id: I53f6537a8f911661e368824a5a5dc5db57413980
2022-08-18 04:05:25 +02:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.tv\.input-service\.example u:object_r:hal_tv_input_default_exec:s0
Add Tuner HAL 1.1 service into the default tuner domain Test: cuttlefish, atest VtsHalTvTunerV1_1TargetTest Bug: b/159058358 Change-Id: I67fbfb29c3097953e6d30d17a8d40d586162088f
2020-07-16 03:25:11 +02:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.tv\.tuner@1\.[01]-service u:object_r:hal_tv_tuner_default_exec:s0
Add properties to configure whether the lazy tuner is enabled. ro.tuner.lazyhal: system_vendor_config_prop to decide whether the lazy tuner HAL is enabled. tuner.server.enable: system_internal_prop to decide whether tuner server should be enabled. Bug: 236002754 Test: Check tuner HAL and framework behavior Change-Id: I6a2ebced0e0261f669e7bda466f46556dedca016
2022-08-09 23:57:02 +02:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.tv\.tuner-service\.example(-lazy)? u:object_r:hal_tv_tuner_default_exec:s0
Label /vendor/bin/hw on devices without vendor partition SELinux labeling of filesystem files ignores symlinks. Unfortunately, /vendor is a symlink on devices without vendor partition (e.g., hikey). Thus, policy in directories which are used both for devices with vendor partition and for devices without vendor partition must be adjusted to match both /vendor and /system/vendor. It is assumed that the /vendor symlink, if it exists at all, always points to /system/vendor. The alternative solution of adjusting vendor policy file labelling rules at vendor policy build time, when the actual on-device paths are known, was considered to make it harder to see how files are labelled by looking solely at the source tree. Test: Files under /vendor/bin/hw correctly labelled on sailfish, angler, and a device which uses the /vendor symlink. Bug: 35431549 Change-Id: If6ccb2c9cb85b0589db03ab86de8071e15d5366f
2017-02-16 21:59:44 +01:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.usb@1\.0-service u:object_r:hal_usb_default_exec:s0
Add selinux rules for android.hardware.usb.IUsb AIDL migration Covers the rules needed for the default AIDL implementation. Bug: 200993386 Signed-off-by: Badhri Jagan Sridharan <badhri@google.com> Change-Id: Ib152d12686e225e3c1074295a70c624a5115e9bd
2022-01-20 23:27:15 +01:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.usb-service\.example u:object_r:hal_usb_default_exec:s0
Add sepolicy for usb gadget hal v1.1 Bug: 147645728 Test: build pass and service running correctly Change-Id: I52b6bcae2c05998e3f22c39998597e2ecef55036
2019-11-28 08:02:26 +01:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.usb\.gadget@1\.1-service u:object_r:hal_usb_gadget_default_exec:s0
sepolicy: Add UWB HAL interface in AOSP Adding sepolicy rules for the AOSP HAL interface. Ignore-AOSP-First: Dependent changes in internal-only projects. Bug: 195308730 Test: Compiles Change-Id: I56302b570a749f7d72b6fe8f4f4a8767ea4785c1 Merged-In: I56302b570a749f7d72b6fe8f4f4a8767ea4785c1
2021-08-23 18:29:00 +02:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.uwb-service u:object_r:hal_uwb_default_exec:s0
Label /vendor/bin/hw on devices without vendor partition SELinux labeling of filesystem files ignores symlinks. Unfortunately, /vendor is a symlink on devices without vendor partition (e.g., hikey). Thus, policy in directories which are used both for devices with vendor partition and for devices without vendor partition must be adjusted to match both /vendor and /system/vendor. It is assumed that the /vendor symlink, if it exists at all, always points to /system/vendor. The alternative solution of adjusting vendor policy file labelling rules at vendor policy build time, when the actual on-device paths are known, was considered to make it harder to see how files are labelled by looking solely at the source tree. Test: Files under /vendor/bin/hw correctly labelled on sailfish, angler, and a device which uses the /vendor symlink. Bug: 35431549 Change-Id: If6ccb2c9cb85b0589db03ab86de8071e15d5366f
2017-02-16 21:59:44 +01:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.vibrator@1\.0-service u:object_r:hal_vibrator_default_exec:s0
stable aidl vibrator policy Bug: 141828236 Test: boot, dumpsys -l Change-Id: Id3fc8724238883116e840794309efbf6c91226c9
2019-10-26 00:04:45 +02:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.vibrator-service.example u:object_r:hal_vibrator_default_exec:s0
Label /vendor/bin/hw on devices without vendor partition SELinux labeling of filesystem files ignores symlinks. Unfortunately, /vendor is a symlink on devices without vendor partition (e.g., hikey). Thus, policy in directories which are used both for devices with vendor partition and for devices without vendor partition must be adjusted to match both /vendor and /system/vendor. It is assumed that the /vendor symlink, if it exists at all, always points to /system/vendor. The alternative solution of adjusting vendor policy file labelling rules at vendor policy build time, when the actual on-device paths are known, was considered to make it harder to see how files are labelled by looking solely at the source tree. Test: Files under /vendor/bin/hw correctly labelled on sailfish, angler, and a device which uses the /vendor symlink. Bug: 35431549 Change-Id: If6ccb2c9cb85b0589db03ab86de8071e15d5366f
2017-02-16 21:59:44 +01:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.vr@1\.0-service u:object_r:hal_vr_default_exec:s0
/(vendor|system/vendor)/bin/hw/android\.hardware\.wifi@1\.0-service u:object_r:hal_wifi_default_exec:s0
Allow lazy wifi HAL to run Test: Manually check that lazy wifi HAL runs Bug: 123307146 Change-Id: I22f9bc7a097056215d249b692b6f39a71b6b9811
2019-01-15 19:06:20 +01:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.wifi@1\.0-service-lazy u:object_r:hal_wifi_default_exec:s0
sepolicy(hostapd): Add a HIDL interface for hostapd Change sepolicy permissions to now classify hostapd as a HAL exposing HIDL interface. Sepolicy denial for accessing /data/vendor/misc/wifi/hostapd: 12-27 23:40:55.913 4952 4952 W hostapd : type=1400 audit(0.0:19): avc: denied { write } for name="hostapd" dev="sda13" ino=4587601 scontext=u:r:hal_wifi_hostapd_default:s0 tcontext=u:object_r:system_data_file:s0 tclass=dir permissive=0 01-02 19:07:16.938 5791 5791 W hostapd : type=1400 audit(0.0:31): avc: denied { search } for name="net" dev="sysfs" ino=30521 scontext=u:r:hal_wifi_hostapd_default:s0 tcontext=u:object_r:sysfs_net:s0 tclass=dir permissive=0 Bug: 36646171 Test: Device boots up and able to turn on SoftAp. Change-Id: Ibacfcc938deab40096b54b8d0e608d53ca91b947
2017-12-23 00:03:15 +01:00
/(vendor|system/vendor)/bin/hw/hostapd u:object_r:hal_wifi_hostapd_default_exec:s0
sepolicy: Move hostapd to vendor Move hostapd to vendor/bin/ because it's only used by WIFI HAL. This commit is for sepolicy corresponding changes. Bug: 34236942 Bug: 34237659 Test: Hotspot works fine. Integration test. Change-Id: I2ee165970a20f4015d5d62fc590d448e9acb92c1
2017-02-11 18:51:10 +01:00
/(vendor|system/vendor)/bin/hw/wpa_supplicant u:object_r:hal_wifi_supplicant_default_exec:s0
Move install_recovery.sh file_contexts mapping The type is declared in vendor policy, so the mapping should live there as well. Fixes: 185288751 Test: TH Change-Id: Ia446d7b5eb0444cdbd48d3628f54792d8a6b2786
2021-04-20 10:20:43 +02:00
/(vendor|system/vendor)/bin/install-recovery\.sh u:object_r:vendor_install_recovery_exec:s0
Initial sepolicy for vndservicemanager. vndservicemanager is the context manager for binder services that are solely registered and accessed from vendor processes. Bug: 36052864 Test: vendorservicemanager runs Change-Id: Ifbf536932678d0ff13d019635fe6347e185ef387
2017-03-22 00:01:52 +01:00
/(vendor|system/vendor)/bin/vndservicemanager u:object_r:vndservicemanager_exec:s0
sepolicy: relabel /vendor The CL splits /vendor labeling from /system. Which was allowing all processes read, execute access to /vendor. Following directories will remain world readable /vendor/etc /vendor/lib(64)/hw/ Following are currently world readable but their scope will be minimized to platform processes that require access /vendor/app /vendor/framework/ /vendor/overlay Files labelled with 'same_process_hal_file' are allowed to be read + executed from by the world. This is for Same process HALs and their dependencies. Bug: 36527360 Bug: 36832490 Bug: 36681210 Bug: 36680116 Bug: 36690845 Bug: 36697328 Bug: 36696623 Bug: 36806861 Bug: 36656392 Bug: 36696623 Bug: 36792803 All of the tests were done on sailfish, angler, bullhead, dragon Test: Boot and connect to wifi Test: Run chrome and load websites, play video in youtube, load maps w/ current location, take pictures and record video in camera, playback recorded video. Test: Connect to BT headset and ensure BT audio playback works. Test: OTA sideload using recovery Test: CTS SELinuxHostTest pass Change-Id: I278435b72f7551a28f3c229f720ca608b77a7029 Signed-off-by: Sandeep Patil <sspatil@google.com>
2017-04-02 02:17:12 +02:00
#############################
# Same process HALs installed by platform into /vendor
#
/(vendor|system/vendor)/lib(64)?/hw/android\.hardware\.graphics\.mapper@2\.0-impl\.so u:object_r:same_process_hal_file:s0
Add IMapper2.1 same process hal permissions Bug: 135166668 Test: build, boot, VtsHalGraphicsComposerV2_2TargetTest Change-Id: Iedc11b73d3e3ba54dcd622b128cb513adec11d69
2019-06-14 21:28:58 +02:00
/(vendor|system/vendor)/lib(64)?/hw/android\.hardware\.graphics\.mapper@2\.0-impl-2\.1\.so u:object_r:same_process_hal_file:s0
gralloc3: add sepolicy for allocator/mapper 3.0 IAllocator and IMappaer are being rev'd to 3.0. Update sepolicy to allow them to be used. Test: compile with allocator/mapper patches add boot the device Bug: 120493579 Change-Id: Id241c6bd79c02ec93d8dd415539f90a18f733d03
2019-01-06 00:22:41 +01:00
/(vendor|system/vendor)/lib(64)?/hw/android\.hardware\.graphics\.mapper@3\.0-impl\.so u:object_r:same_process_hal_file:s0
gralloc: add IAllocator/IMapper 4.0 sepolicy Add support for gralloc 4.0 to sepolicy Bug: 136016160 Test: Compiles and boots Change-Id: I148cc19176275e8cbd19cc95aa95d4d450353b7a
2019-06-20 23:10:59 +02:00
/(vendor|system/vendor)/lib(64)?/hw/android\.hardware\.graphics\.mapper@4\.0-impl\.so u:object_r:same_process_hal_file:s0
sepolicy: relabel /vendor The CL splits /vendor labeling from /system. Which was allowing all processes read, execute access to /vendor. Following directories will remain world readable /vendor/etc /vendor/lib(64)/hw/ Following are currently world readable but their scope will be minimized to platform processes that require access /vendor/app /vendor/framework/ /vendor/overlay Files labelled with 'same_process_hal_file' are allowed to be read + executed from by the world. This is for Same process HALs and their dependencies. Bug: 36527360 Bug: 36832490 Bug: 36681210 Bug: 36680116 Bug: 36690845 Bug: 36697328 Bug: 36696623 Bug: 36806861 Bug: 36656392 Bug: 36696623 Bug: 36792803 All of the tests were done on sailfish, angler, bullhead, dragon Test: Boot and connect to wifi Test: Run chrome and load websites, play video in youtube, load maps w/ current location, take pictures and record video in camera, playback recorded video. Test: Connect to BT headset and ensure BT audio playback works. Test: OTA sideload using recovery Test: CTS SELinuxHostTest pass Change-Id: I278435b72f7551a28f3c229f720ca608b77a7029 Signed-off-by: Sandeep Patil <sspatil@google.com>
2017-04-02 02:17:12 +02:00
/(vendor|system/vendor)/lib(64)?/hw/android\.hardware\.renderscript@1\.0-impl\.so u:object_r:same_process_hal_file:s0
sepolicy: add missing labels for same process HALs. Some of the same process HAL labeling was missing from Marlin. These are identified by tracking library dependencies. Bug: 37084733 Test: Build and boot sailfish. The change allows the labelled libraries to be opened by any domain. So, the boot test is sufficient. Change-Id: Id55e834d6863ca644f912efdd690fccb71d3eaf3 Signed-off-by: Sandeep Patil <sspatil@google.com>
2017-04-06 22:50:23 +02:00
/(vendor|system/vendor)/lib(64)?/hw/gralloc\.default\.so u:object_r:same_process_hal_file:s0
sepolicy: relabel /vendor The CL splits /vendor labeling from /system. Which was allowing all processes read, execute access to /vendor. Following directories will remain world readable /vendor/etc /vendor/lib(64)/hw/ Following are currently world readable but their scope will be minimized to platform processes that require access /vendor/app /vendor/framework/ /vendor/overlay Files labelled with 'same_process_hal_file' are allowed to be read + executed from by the world. This is for Same process HALs and their dependencies. Bug: 36527360 Bug: 36832490 Bug: 36681210 Bug: 36680116 Bug: 36690845 Bug: 36697328 Bug: 36696623 Bug: 36806861 Bug: 36656392 Bug: 36696623 Bug: 36792803 All of the tests were done on sailfish, angler, bullhead, dragon Test: Boot and connect to wifi Test: Run chrome and load websites, play video in youtube, load maps w/ current location, take pictures and record video in camera, playback recorded video. Test: Connect to BT headset and ensure BT audio playback works. Test: OTA sideload using recovery Test: CTS SELinuxHostTest pass Change-Id: I278435b72f7551a28f3c229f720ca608b77a7029 Signed-off-by: Sandeep Patil <sspatil@google.com>
2017-04-02 02:17:12 +02:00
Deprecate libhwbinder/libhidltransport from VNDK. Since these libraries were vndk-sp, previously, passthrough HALs were able to load them. However, now that they have been removed from the vndk-sp set (these libraries are empty), marking them as same_process_hal_file so that vendor passthrough implementations that still link against these empty libraries can still use them. Bug: 135686713 Test: boot device using these libraries from an sphal (otherwise, bootloops) Change-Id: Ic5170eb0fcbb87c82bbea840dcfcb17899eaa899
2019-09-27 00:46:34 +02:00
#############################
# Libraries removed from vndk-sp (must still be accessible by passthrough HALs using them)
#
/(vendor|system/vendor)/lib(64)?/libhwbinder.so u:object_r:same_process_hal_file:s0
/(vendor|system/vendor)/lib(64)?/libhidltransport.so u:object_r:same_process_hal_file:s0
sepolicy: Move hostapd to vendor Move hostapd to vendor/bin/ because it's only used by WIFI HAL. This commit is for sepolicy corresponding changes. Bug: 34236942 Bug: 34237659 Test: Hotspot works fine. Integration test. Change-Id: I2ee165970a20f4015d5d62fc590d448e9acb92c1
2017-02-11 18:51:10 +01:00
#############################
# Data files
#
sepolicy(hostapd): Add a HIDL interface for hostapd Change sepolicy permissions to now classify hostapd as a HAL exposing HIDL interface. Sepolicy denial for accessing /data/vendor/misc/wifi/hostapd: 12-27 23:40:55.913 4952 4952 W hostapd : type=1400 audit(0.0:19): avc: denied { write } for name="hostapd" dev="sda13" ino=4587601 scontext=u:r:hal_wifi_hostapd_default:s0 tcontext=u:object_r:system_data_file:s0 tclass=dir permissive=0 01-02 19:07:16.938 5791 5791 W hostapd : type=1400 audit(0.0:31): avc: denied { search } for name="net" dev="sysfs" ino=30521 scontext=u:r:hal_wifi_hostapd_default:s0 tcontext=u:object_r:sysfs_net:s0 tclass=dir permissive=0 Bug: 36646171 Test: Device boots up and able to turn on SoftAp. Change-Id: Ibacfcc938deab40096b54b8d0e608d53ca91b947
2017-12-23 00:03:15 +01:00
/data/vendor/wifi/hostapd(/.*)? u:object_r:hostapd_data_file:s0
wpa_supplicant: move control sockets to /data/vendor Treble compliance. Bug: 70228425 Bug: 70393317 Test: complete wifi test in b/70393317 Test: Test wifi on Taimen and Sailfish Test: verify sockets exist in /data/vendor/wifi/wpa/sockets Change-Id: I217c0eda0e5af50bb603cfcc35d60bf0d9cad72e
2018-01-24 17:49:16 +01:00
/data/vendor/wifi/wpa(/.*)? u:object_r:wpa_data_file:s0
Reference in a new issue Copy permalink