tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
platform_system_sepolicy/private/hal_graphics_allocator.te

25 lines
1.2 KiB
Text
Raw Normal View History

Move Graphics Allocator HAL IPC rules to proper location Every client of Graphics Allocator HAL needs permission to (Hw)Binder IPC into the HAL. Test: Device boots, no denials to do with hal_graphics_allocator (also, removing the binder_call(hal_graphics_allocator_client, hal_graphics_allocator_server) leads to denials) Test: GUI works, YouTube works Bug: 34170079 Change-Id: I5c64d966862a125994dab903c2eda5815e336a94
2017-03-20 23:02:20 +01:00
# HwBinder IPC from client to server
binder_call(hal_graphics_allocator_client, hal_graphics_allocator_server)
hal_attribute_hwservice_client drop '_client' Since this attribute just associates a hal_attribute with a given hwservice in the standard way. Bug: 80319537 Test: boot + sanity + test for denials Change-Id: I545de165515387317e6920ce8f5e8c491f9ab24e
2018-06-06 18:30:18 +02:00
hal_attribute_hwservice(hal_graphics_allocator, hal_graphics_allocator_hwservice)
Restrict access to hwservicemanager This adds fine-grained policy about who can register and find which HwBinder services in hwservicemanager. Test: Play movie in Netflix and Google Play Movies Test: Play video in YouTube app and YouTube web page Test: In Google Camera app, take photo (HDR+ and conventional), record video (slow motion and normal), and check that photos look fine and videos play back with sound. Test: Cast screen to a Google Cast device Test: Get location fix in Google Maps Test: Make and receive a phone call, check that sound works both ways and that disconnecting the call frome either end works fine. Test: Run RsHelloCompute RenderScript demo app Test: Run fast subset of media CTS tests: make and install CtsMediaTestCases.apk adb shell am instrument -e size small \ -w 'android.media.cts/android.support.test.runner.AndroidJUnitRunner' Test: Play music using Google Play music Test: Adjust screen brightness via the slider in Quick Settings Test: adb bugreport Test: Enroll in fingerprint screen unlock, unlock screen using fingerprint Test: Apply OTA update: Make some visible change, e.g., rename Settings app. make otatools && \ make dist Ensure device has network connectivity ota_call.py -s <serial here> --file out/dist/sailfish-ota-*.zip Confirm the change is now live on the device Bug: 34454312 (cherry picked from commit 632bc494f199d9d85c37c1751667fe41f4b094cb) Merged-In: Iecf74000e6c68f01299667486f3c767912c076d3 Change-Id: I7a9a487beaf6f30c52ce08e04d415624da49dd31
2017-04-14 04:05:27 +02:00
allow hal_graphics_allocator_client hal_graphics_mapper_hwservice:hwservice_manager find;
Add hal_graphics_mapper_service type This is used for mapper sphal library which is defined in VINTF and queried via servicemanager. Bug: 317178925 Test: cuttlefish loads mapper.minigbm Change-Id: Ibddc0239e52065a89c656f885f34835406665009
2024-01-31 01:32:48 +01:00
allow hal_graphics_allocator_client hal_graphics_mapper_service:service_manager find;
same_process_hal_file: access to individual coredomains Remove blanket coredomain access to same_process_hal_file in favor of granular access. This change takes into account audits from go/sedenials (our internal dogfood program) Bug: 37211678 Test: m selinux_policy Change-Id: I5634fb65c72d13007e40c131a600585a05b8c4b5
2018-10-18 21:39:35 +02:00
allow hal_graphics_allocator_client same_process_hal_file:file { execute read open getattr map };
Restrict access to hwservicemanager This adds fine-grained policy about who can register and find which HwBinder services in hwservicemanager. Test: Play movie in Netflix and Google Play Movies Test: Play video in YouTube app and YouTube web page Test: In Google Camera app, take photo (HDR+ and conventional), record video (slow motion and normal), and check that photos look fine and videos play back with sound. Test: Cast screen to a Google Cast device Test: Get location fix in Google Maps Test: Make and receive a phone call, check that sound works both ways and that disconnecting the call frome either end works fine. Test: Run RsHelloCompute RenderScript demo app Test: Run fast subset of media CTS tests: make and install CtsMediaTestCases.apk adb shell am instrument -e size small \ -w 'android.media.cts/android.support.test.runner.AndroidJUnitRunner' Test: Play music using Google Play music Test: Adjust screen brightness via the slider in Quick Settings Test: adb bugreport Test: Enroll in fingerprint screen unlock, unlock screen using fingerprint Test: Apply OTA update: Make some visible change, e.g., rename Settings app. make otatools && \ make dist Ensure device has network connectivity ota_call.py -s <serial here> --file out/dist/sailfish-ota-*.zip Confirm the change is now live on the device Bug: 34454312 (cherry picked from commit 632bc494f199d9d85c37c1751667fe41f4b094cb) Merged-In: Iecf74000e6c68f01299667486f3c767912c076d3 Change-Id: I7a9a487beaf6f30c52ce08e04d415624da49dd31
2017-04-14 04:05:27 +02:00
Add sepolicy for gralloc-alloc HAL Allow SurfaceFlinger to call into IAllocator, and allow everyone to access IAllocator's fd. Specifically, hwbinder_use(...) for avc: denied { call } for scontext=u:r:hal_graphics_allocator:s0 tcontext=u:r:hwservicemanager:s0 tclass=binder permissive=1 avc: denied { transfer } for scontext=u:r:hal_graphics_allocator:s0 tcontext=u:r:hwservicemanager:s0 tclass=binder permissive=1 allow ... ion_device:chr_file r_file_perms for avc: denied { read } for name="ion" dev="tmpfs" ino=15014 scontext=u:r:hal_graphics_allocator:s0 tcontext=u:object_r:ion_device:s0 tclass=chr_file permissive=1 avc: denied { open } for path="/dev/ion" dev="tmpfs" ino=15014 scontext=u:r:hal_graphics_allocator:s0 tcontext=u:object_r:ion_device:s0 tclass=chr_file permissive=1 avc: denied { ioctl } for path="/dev/ion" dev="tmpfs" ino=15014 ioctlcmd=4900 scontext=u:r:hal_graphics_allocator:s0 tcontext=u:object_r:ion_device:s0 tclass=chr_file permissive=1 allow ... gpu_device:chr_file rw_file_perms; for avc: denied { read write } for name="kgsl-3d0" dev="tmpfs" ino=14956 scontext=u:r:hal_graphics_allocator:s0 tcontext=u:object_r:gpu_device:s0 tclass=chr_file permissive=1 avc: denied { open } for path="/dev/kgsl-3d0" dev="tmpfs" ino=14956 scontext=u:r:hal_graphics_allocator:s0 tcontext=u:object_r:gpu_device:s0 tclass=chr_file permissive=1 avc: denied { ioctl } for path="/dev/kgsl-3d0" dev="tmpfs" ino=14956 ioctlcmd=940 scontext=u:r:hal_graphics_allocator:s0 tcontext=u:object_r:gpu_device:s0 tclass=chr_file permissive=1 binder_call(surfaceflinger, ...) for avc: denied { call } for scontext=u:r:surfaceflinger:s0 tcontext=u:r:hal_graphics_allocator:s0 tclass=binder permissive=1 allow ... ...:fd use for avc: denied { use } for path="anon_inode:dmabuf" dev="anon_inodefs" ino=12794 scontext=u:r:surfaceflinger:s0 tcontext=u:r:hal_graphics_allocator:s0 tclass=fd permissive=1 Bug: 32021161 Test: make bootimage Change-Id: Ie7700142313407ac438c43dd1a85544dc4c67f13
2016-10-12 15:38:00 +02:00
# GPU device access
allow hal_graphics_allocator gpu_device:chr_file rw_file_perms;
Adds GPU sepolicy to support devices with DRM gralloc/rendering ... such as Cuttlefish (Cloud Android virtual device) which has a DRM virtio-gpu based gralloc and (sometimes) DRM virtio-gpu based rendering (when forwarding rendering commands to the host machine with Mesa3D in the guest and virglrenderer on the host). After this change is submitted, changes such as aosp/1997572 can be submitted to removed sepolicy that is currently duplicated across device/google/cuttlefish and device/linaro/dragonboard as well. Adds a sysfs_gpu type (existing replicated sysfs_gpu definitions across several devices are removed in the attached topic). The uses of `sysfs_gpu:file` comes from Mesa using libdrm's `drmGetDevices2()` which calls into `drmParsePciDeviceInfo()` to get vendor id, device id, version etc. Bug: b/161819018 Test: launch_cvd Test: launch_cvd --gpu_mode=gfxstream Change-Id: I4f7d4b0fb90bfeef72f94396ff0c5fe44d53510c Merged-In: I4f7d4b0fb90bfeef72f94396ff0c5fe44d53510c
2022-02-24 19:32:16 +01:00
allow hal_graphics_allocator gpu_device:dir r_dir_perms;
Add sepolicy for gralloc-alloc HAL Allow SurfaceFlinger to call into IAllocator, and allow everyone to access IAllocator's fd. Specifically, hwbinder_use(...) for avc: denied { call } for scontext=u:r:hal_graphics_allocator:s0 tcontext=u:r:hwservicemanager:s0 tclass=binder permissive=1 avc: denied { transfer } for scontext=u:r:hal_graphics_allocator:s0 tcontext=u:r:hwservicemanager:s0 tclass=binder permissive=1 allow ... ion_device:chr_file r_file_perms for avc: denied { read } for name="ion" dev="tmpfs" ino=15014 scontext=u:r:hal_graphics_allocator:s0 tcontext=u:object_r:ion_device:s0 tclass=chr_file permissive=1 avc: denied { open } for path="/dev/ion" dev="tmpfs" ino=15014 scontext=u:r:hal_graphics_allocator:s0 tcontext=u:object_r:ion_device:s0 tclass=chr_file permissive=1 avc: denied { ioctl } for path="/dev/ion" dev="tmpfs" ino=15014 ioctlcmd=4900 scontext=u:r:hal_graphics_allocator:s0 tcontext=u:object_r:ion_device:s0 tclass=chr_file permissive=1 allow ... gpu_device:chr_file rw_file_perms; for avc: denied { read write } for name="kgsl-3d0" dev="tmpfs" ino=14956 scontext=u:r:hal_graphics_allocator:s0 tcontext=u:object_r:gpu_device:s0 tclass=chr_file permissive=1 avc: denied { open } for path="/dev/kgsl-3d0" dev="tmpfs" ino=14956 scontext=u:r:hal_graphics_allocator:s0 tcontext=u:object_r:gpu_device:s0 tclass=chr_file permissive=1 avc: denied { ioctl } for path="/dev/kgsl-3d0" dev="tmpfs" ino=14956 ioctlcmd=940 scontext=u:r:hal_graphics_allocator:s0 tcontext=u:object_r:gpu_device:s0 tclass=chr_file permissive=1 binder_call(surfaceflinger, ...) for avc: denied { call } for scontext=u:r:surfaceflinger:s0 tcontext=u:r:hal_graphics_allocator:s0 tclass=binder permissive=1 allow ... ...:fd use for avc: denied { use } for path="anon_inode:dmabuf" dev="anon_inodefs" ino=12794 scontext=u:r:surfaceflinger:s0 tcontext=u:r:hal_graphics_allocator:s0 tclass=fd permissive=1 Bug: 32021161 Test: make bootimage Change-Id: Ie7700142313407ac438c43dd1a85544dc4c67f13
2016-10-12 15:38:00 +02:00
allow hal_graphics_allocator ion_device:chr_file r_file_perms;
Add missing permission for accessing the DMA-BUF system heap This patch fixes the following denials: avc: denied { open } for comm="composer@2.4-se" path="/dev/dma_heap/system" dev="tmpfs" ino=700 scontext=u:r:hal_graphics_composer_default:s0 tcontext=u:object_r:dmabuf_system_heap_device:s0 tclass=chr_file permissive=1 avc: denied { open } for comm="android.hardwar" path="/dev/dma_heap/system" dev="tmpfs" ino=700 scontext=u:r:hal_sensors_default:s0 tcontext=u:object_r:dmabuf_system_heap_device:s0 tclass=chr_file permissive=1 avc: denied { open } for comm="android.hardwar" path="/dev/dma_heap/system" dev="tmpfs" ino=700 scontext=u:r:hal_camera_default:s0 tcontext=u:object_r:dmabuf_system_heap_device:s0 tclass=chr_file permissive=1 avc: denied { open } for comm="BootAnimation" path="/dev/dma_heap/system" dev="tmpfs" ino=700 scontext=u:r:bootanim:s0 tcontext=u:object_r:dmabuf_system_heap_device:s0 tclass=chr_file permissive=1 avc: denied { open } for comm="Binder:470_2" path="/dev/dma_heap/system" dev="tmpfs" ino=700 scontext=u:r:surfaceflinger:s0 tcontext=u:object_r:dmabuf_system_heap_device:s0 tclass=chr_file permissive=1 avc: denied { read } for comm="HwBinder:946_2" name="system" dev="tmpfs" ino=588 scontext=u:r:cameraserver:s0 tcontext=u:object_r:dmabuf_system_heap_device:s0 tclass=chr_file permissive=1 avc: denied { open } for comm="HwBinder:946_2" path="/dev/dma_heap/system" dev="tmpfs" ino=588 scontext=u:r:cameraserver:s0 tcontext=u:object_r:dmabuf_system_heap_device:s0 tclass=chr_file permissive=1 Bug: 178865267 Test: boot without these denials Signed-off-by: Hyesoo Yu <hyesoo.yu@samsung.com> Change-Id: Ic31dffd1328a8693b721433e1dcbbc650d3a3c07
2021-02-16 06:57:42 +01:00
allow hal_graphics_allocator dmabuf_system_heap_device:chr_file r_file_perms;
Grant CAP_SYS_NICE to processes that need it. New binder kernel changes extend the areas where binder will set real-time scheduling priorities on threads; to make sure the driver can correctly determine whether a process is allowed to run at real-time priority or not, add the capability to the services that need it. Bug: 37293077 Test: processes run at real-time prio on incoming real-time binder calls. Change-Id: Ia4b3e5ecb1f5e18e7272bdaaad5c31a856719633
2017-05-09 18:53:46 +02:00
Grant surfaceflinger and graphics allocator access to the secure heap Transfers access permissions into the system policy which would otherwise be setup on a per-device basis in exactly the same recurring way. For surfacefliner it avoids errors when it (via its dependent graphics libraries) tries to allocate memory from the protected heap, e.g. when operating on a Vulkan device with protected memory support. Bug: 235618476 Change-Id: I7f9a176c067ead2f3bd38b8c34fc55fa39d87655
2023-01-18 17:00:52 +01:00
# Access the secure heap
allow hal_graphics_allocator dmabuf_system_secure_heap_device:chr_file r_file_perms;
Grant CAP_SYS_NICE to processes that need it. New binder kernel changes extend the areas where binder will set real-time scheduling priorities on threads; to make sure the driver can correctly determine whether a process is allowed to run at real-time priority or not, add the capability to the services that need it. Bug: 37293077 Test: processes run at real-time prio on incoming real-time binder calls. Change-Id: Ia4b3e5ecb1f5e18e7272bdaaad5c31a856719633
2017-05-09 18:53:46 +02:00
# allow to run with real-time scheduling policy
sepolicy: Add rules for non-init namespaces In kernel 4.7, the capability and capability2 classes were split apart from cap_userns and cap2_userns (see kernel commit 8e4ff6f228e4722cac74db716e308d1da33d744f). Since then, Android cannot be run in a container with SELinux in enforcing mode. This change applies the existing capability rules to user namespaces as well as the root namespace so that Android running in a container behaves the same on pre- and post-4.7 kernels. This is essentially: 1. New global_capability_class_set and global_capability2_class_set that match capability+cap_userns and capability2+cap2_userns, respectively. 2. s/self:capability/self:global_capability_class_set/g 3. s/self:capability2/self:global_capability2_class_set/g 4. Add cap_userns and cap2_userns to the existing capability_class_set so that it covers all capabilities. This set was used by several neverallow and dontaudit rules, and I confirmed that the new classes are still appropriate. Test: diff new policy against old and confirm that all new rules add only cap_userns or cap2_userns; Boot ARC++ on a device with the 4.12 kernel. Bug: crbug.com/754831 Change-Id: I4007eb3a2ecd01b062c4c78d9afee71c530df95f
2017-11-09 23:51:26 +01:00
allow hal_graphics_allocator self:global_capability_class_set sys_nice;
Add IAllocator stable-aidl Test: Builds & boots; no sepolicy errors logged Bug: 193558894 Change-Id: I11e162310548b67addc032ccc0d499cbf391e7f9
2022-01-18 22:58:19 +01:00
# IAllocator stable-aidl
hal_attribute_service(hal_graphics_allocator, hal_graphics_allocator_service)
binder_call(hal_graphics_allocator_server, servicemanager)
binder_call(hal_graphics_allocator_client, servicemanager)
Reference in a new issue Copy permalink