tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
platform_system_sepolicy/private/property_contexts

1190 lines
72 KiB
Text
Raw Normal View History

Add policy for property service. New property_contexts file for property selabel backend. New property.te file with property type declarations. New property_service security class and set permission. Allow rules for setting properties.
2012-04-04 16:11:16 +02:00
##########################
# property service keys
#
#
Align SELinux property policy with init property_perms. Introduce a net_radio_prop type for net. properties that can be set by radio or system. Introduce a system_radio_prop type for sys. properties that can be set by radio or system. Introduce a dhcp_prop type for properties that can be set by dhcp or system. Drop the rild_prop vs radio_prop distinction; this was an early experiment to see if we could separate properties settable by rild versus other radio UID processes but it did not pan out. Remove the ability to set properties from unconfineddomain. Allow init to set any property. Allow recovery to set ctl_default_prop to restart adbd. Change-Id: I5ccafcb31ec4004dfefcec8718907f6b6f3e0dfd Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-06-19 16:27:02 +02:00
net.rmnet u:object_r:net_radio_prop:s0
net.gprs u:object_r:net_radio_prop:s0
net.ppp u:object_r:net_radio_prop:s0
net.qmi u:object_r:net_radio_prop:s0
net.lte u:object_r:net_radio_prop:s0
net.cdma u:object_r:net_radio_prop:s0
Move net.dns* to it's own label. Move net.dns* from net_radio_prop to the newly created label net_dns_prop. This allows finer grain control over this specific property. Prior to this change, this property was readable to all SELinux domains, and writable by the following SELinux domains: * system_server * system_app (apps which run as UID=system) * netmgrd * radio This change: 1) Removes read access to this property to everyone EXCEPT untrusted_app and system_server. 2) Limit write access to system_server. In particular, this change removes read access to priv_apps. Any priv_app which ships with the system should not be reading this property. Bug: 34115651 Test: Device boots, wifi turns on, no problems browsing the internet Change-Id: I8a32e98c4f573d634485c4feac91baa35d021d38
2017-02-10 01:08:11 +01:00
net.dns u:object_r:net_dns_prop:s0
Align SELinux property policy with init property_perms. Introduce a net_radio_prop type for net. properties that can be set by radio or system. Introduce a system_radio_prop type for sys. properties that can be set by radio or system. Introduce a dhcp_prop type for properties that can be set by dhcp or system. Drop the rild_prop vs radio_prop distinction; this was an early experiment to see if we could separate properties settable by rild versus other radio UID processes but it did not pan out. Remove the ability to set properties from unconfineddomain. Allow init to set any property. Allow recovery to set ctl_default_prop to restart adbd. Change-Id: I5ccafcb31ec4004dfefcec8718907f6b6f3e0dfd Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-06-19 16:27:02 +02:00
ril. u:object_r:radio_prop:s0
Remove special case handling of "ro." properties Currently, properties that begin with "ro." are special cased to skip over the "ro." part of the prefix before matching with entries in property_contexts. A change to init is removing this special case and therefore, the "ro." prefixes must be explicitly added to property_contexts. Bug 26425619 Change-Id: I343f139a39abef99924e84e0d27699284f335d63
2016-01-11 22:06:25 +01:00
ro.ril. u:object_r:radio_prop:s0
Rework the radio vs rild property split. Only label properties with the ril. prefix with rild_prop. Allow rild and system (and radio) to set radio_prop. Only rild can set rild_prop presently.
2012-04-04 22:01:19 +02:00
gsm. u:object_r:radio_prop:s0
Add policy for property service. New property_contexts file for property selabel backend. New property.te file with property type declarations. New property_service security class and set permission. Allow rules for setting properties.
2012-04-04 16:11:16 +02:00
persist.radio u:object_r:radio_prop:s0
net. u:object_r:system_prop:s0
dev. u:object_r:system_prop:s0
Remove special case handling of "ro." properties Currently, properties that begin with "ro." are special cased to skip over the "ro." part of the prefix before matching with entries in property_contexts. A change to init is removing this special case and therefore, the "ro." prefixes must be explicitly added to property_contexts. Bug 26425619 Change-Id: I343f139a39abef99924e84e0d27699284f335d63
2016-01-11 22:06:25 +01:00
ro.runtime. u:object_r:system_prop:s0
Remove access to ro.runtime.firstboot from apps ro.runtime.firstboot system property is only used internally by system_server to distinguish between first start after boot from consecutive starts (for example, this happens when full-disk encryption is enabled). The value of the property is a millisecond-precise timestamp which can help track individual device. Thus apps should not have access to this property. Test: Device boots fine, reading ro.runtime.firstboot from an app results in an error and SELinux denial. Bug: 33700679 Change-Id: I4c3c26a35c5dd840bced3a3e53d071f45317f63c
2016-12-27 23:05:46 +01:00
ro.runtime.firstboot u:object_r:firstboot_prop:s0
Add policy for property service. New property_contexts file for property selabel backend. New property.te file with property type declarations. New property_service security class and set permission. Allow rules for setting properties.
2012-04-04 16:11:16 +02:00
hw. u:object_r:system_prop:s0
Remove special case handling of "ro." properties Currently, properties that begin with "ro." are special cased to skip over the "ro." part of the prefix before matching with entries in property_contexts. A change to init is removing this special case and therefore, the "ro." prefixes must be explicitly added to property_contexts. Bug 26425619 Change-Id: I343f139a39abef99924e84e0d27699284f335d63
2016-01-11 22:06:25 +01:00
ro.hw. u:object_r:system_prop:s0
Add policy for property service. New property_contexts file for property selabel backend. New property.te file with property type declarations. New property_service security class and set permission. Allow rules for setting properties.
2012-04-04 16:11:16 +02:00
sys. u:object_r:system_prop:s0
Allow system_server to set audio properties Defined a new signal intended to allow the system to reboot the audio/soundtrigger HAL process. Fixes: 153461865 Test: See main change in topic Change-Id: I1e4a770670bb1274fa6a23cd0641f2554d4679f7
2020-04-10 22:06:15 +02:00
sys.audio. u:object_r:audio_prop:s0
Add sysprop for init's perf_event_open LSM hook check Written exclusively by init. Made it readable by shell for CTS, and for easier platform debugging. Bug: 137092007 Change-Id: Ia5b056117502c272bc7169661069d0c8020695e2
2020-01-14 19:20:06 +01:00
sys.init.perf_lsm_hooks u:object_r:init_perf_lsm_hooks_prop:s0
Allow cppreopts to work with selinux (cherry picked from commit d3edd6b577c1e40834af69420bd77b60c359ef8e) Bug: 29278988 Change-Id: I199572377a6b5c33116c718a545159ddcf50df30
2016-06-23 00:47:09 +02:00
sys.cppreopt u:object_r:cppreopt_prop:s0
Add rules for lpdump and lpdumpd - lpdump is a binary on the device that talks to lpdumpd via binder. - lpdumpd is a daemon on the device that actually reads dynamic partition metadata. Only lpdump can talk to it. Bug: 126233777 Test: boots (sanity) Test: lpdump Change-Id: I0e21f35ac136bcbb0603940364e8117f2d6ac438
2019-03-14 23:45:03 +01:00
sys.lpdumpd u:object_r:lpdumpd_prop:s0
Enable SELinux on vold This change enables SELinux security enforcement on vold. For the vold.te file ONLY, this change is conceptually a revert of 77d4731e9d30c8971e076e2469d6957619019921 and 50e37b93ac97631dcac6961285b92af5026557af, with the following additional changes: 1) Removal of "allow vold proc:file write;" and "allow vold self:capability { sys_boot };". As of system/vold change adfba3626e76c1931649634275d241b226cd1b9a, vold no longer performs it's own reboots, so these capabilities are no longer needed. 2) Addition of the powerctl property, which vold contacts to tell init to reboot. 3) Removal of "allow vold kernel:system module_request;". As of CTS commit f2cfdf5c057140d9442fcfeb4e4a648e8258b659, Android devices no longer ship with loadable modules, hence we don't require this rule. 4) Removal of "fsetid" from "self:capability". Any setuid / setgid bits SHOULD be cleared if vold is able to change the permissions of files. IMHO, it was a mistake to ever include this capability in the first place. Testing: As much as possible, I've tested filesystem related functionality, including factory reset and device encryption. I wasn't able to test fstrim functionality, which is a fairly new feature. I didn't see any policy denials in dmesg. It's quite possible I've missed something. If we experience problems, I happy to roll back this change. Bug: 9629920 Change-Id: I683afa0dffe9f28952287bfdb7ee4e0423c2e97a
2013-06-29 05:15:37 +02:00
sys.powerctl u:object_r:powerctl_prop:s0
Add policy for property service. New property_contexts file for property selabel backend. New property.te file with property type declarations. New property_service security class and set permission. Allow rules for setting properties.
2012-04-04 16:11:16 +02:00
service. u:object_r:system_prop:s0
Align SELinux property policy with init property_perms. Introduce a net_radio_prop type for net. properties that can be set by radio or system. Introduce a system_radio_prop type for sys. properties that can be set by radio or system. Introduce a dhcp_prop type for properties that can be set by dhcp or system. Drop the rild_prop vs radio_prop distinction; this was an early experiment to see if we could separate properties settable by rild versus other radio UID processes but it did not pan out. Remove the ability to set properties from unconfineddomain. Allow init to set any property. Allow recovery to set ctl_default_prop to restart adbd. Change-Id: I5ccafcb31ec4004dfefcec8718907f6b6f3e0dfd Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-06-19 16:27:02 +02:00
dhcp. u:object_r:dhcp_prop:s0
Allow Bluetooth app to initiate DHCP service on bt-pan interface. bug:15407087 Change-Id: I3dea9c1110583f11f093d048455a1cc739d05658
2014-06-18 15:20:36 +02:00
dhcp.bt-pan.result u:object_r:pan_result_prop:s0
SELinux policy for Bluetooth properties. Properties under bluetooth. and persist.service.bdroid. are considered Bluetooth-related properties. Change-Id: Iee937d9a1184c2494deec46f9ed7090c643acda7
2013-05-06 19:18:27 +02:00
bluetooth. u:object_r:bluetooth_prop:s0
Add policy for property service. New property_contexts file for property selabel backend. New property.te file with property type declarations. New property_service security class and set permission. Allow rules for setting properties.
2012-04-04 16:11:16 +02:00
Give system_server / system_app ability to write some properties Allow writing to persist.sys and debug. This addresses the following denials (which are actually being enforced): <4>[ 131.700473] avc: denied { set } for property=debug.force_rtl scontext=u:r:system_server:s0 tcontext=u:object_r:shell_prop:s0 tclass=property_service <3>[ 131.700625] init: sys_prop: permission denied uid:1000 name:debug.force_rtl <4>[ 132.630062] avc: denied { set } for property=persist.sys.dalvik.vm.lib scontext=u:r:system_app:s0 tcontext=u:object_r:system_prop:s0 tclass=property_service <3>[ 132.630184] init: sys_prop: permission denied uid:1000 name:persist.sys.dalvik.vm.lib Change-Id: I5d114c0d963bf393f49f1bf13d1ed84137fbcca6
2013-11-01 18:45:03 +01:00
debug. u:object_r:debug_prop:s0
debuggerd: Allow "debug.db.uid" usage Allow the use of debug.db.uid on userdebug / eng builds. Setting this property allows debuggerd to suspend a process if it detects a crash. Make debug.db.uid only accessible to the su domain. This should not be used on a user build. Only support reading user input on userdebug / eng builds. Steps to reproduce with the "crasher" program: adb root adb shell setprop debug.db.uid 20000 mmm system/core/debuggerd adb sync adb shell crasher Addresses the following denials: <5>[ 580.637442] type=1400 audit(1392412124.612:149): avc: denied { read } for pid=182 comm="debuggerd" name="input" dev="tmpfs" ino=5665 scontext=u:r:debuggerd:s0 tcontext=u:object_r:input_device:s0 tclass=dir <5>[ 580.637589] type=1400 audit(1392412124.612:150): avc: denied { open } for pid=182 comm="debuggerd" name="input" dev="tmpfs" ino=5665 scontext=u:r:debuggerd:s0 tcontext=u:object_r:input_device:s0 tclass=dir <5>[ 580.637706] type=1400 audit(1392412124.612:151): avc: denied { read write } for pid=182 comm="debuggerd" name="event5" dev="tmpfs" ino=6723 scontext=u:r:debuggerd:s0 tcontext=u:object_r:input_device:s0 tclass=chr_file <5>[ 580.637823] type=1400 audit(1392412124.612:152): avc: denied { open } for pid=182 comm="debuggerd" name="event5" dev="tmpfs" ino=6723 scontext=u:r:debuggerd:s0 tcontext=u:object_r:input_device:s0 tclass=chr_file <5>[ 580.637958] type=1400 audit(1392412124.612:153): avc: denied { ioctl } for pid=182 comm="debuggerd" path="/dev/input/event5" dev="tmpfs" ino=6723 scontext=u:r:debuggerd:s0 tcontext=u:object_r:input_device:s0 tclass=chr_file Bug: 12532622 Change-Id: I63486edb73efb1ca12e9eb1994ac9e389251a3f1
2014-02-06 01:36:25 +01:00
debug.db. u:object_r:debuggerd_prop:s0
Increase communication surface between dumpstate and Shell: - Add a new 'dumpstate' context for system properties. This context will be used to share state between dumpstate and Shell. For example, as dumpstate progresses, it will update a system property, which Shell will use to display the progress in the UI as a system notification. The user could also rename the bugreport file, in which case Shell would use another system property to communicate such change to dumpstate. - Allow Shell to call 'ctl.bugreport stop' so the same system notification can be used to stop dumpstate. BUG: 25794470 Change-Id: I74b80bda07292a91358f2eea9eb8444caabc5895
2015-12-02 03:03:05 +01:00
dumpstate. u:object_r:dumpstate_prop:s0
Let system_server writes to dumpstate.options property. Currently, we define 4 hardcoded init services to launch dumpstate with different command-line options (since dumpstate must be launched by root): - bugreport - bugreportplus - bugreportwear - bugreportremote This approach does not scale well; a better option is to have just one service, and let the framework pass the extra arguments through a system property. BUG: 31649719 Test: manual Change-Id: I7ebbb7ce6a0fd3588baca6fd76653f87367ed0e5
2016-09-21 19:44:11 +02:00
dumpstate.options u:object_r:dumpstate_options_prop:s0
Adds new policy for init_svc_debug_prop. Used to restrict properties init.svc_debug_pid.* Bug: 138114550 Test: getprop | grep init.svc_debug_pid only shows results on root Change-Id: I0c10699deec4c548a2463a934e96b897ddee1678
2019-07-25 20:29:17 +02:00
init.svc_debug_pid. u:object_r:init_svc_debug_prop:s0
llkd: Add stack symbol checking llkd needs the ptrace capabilities and dac override to monitor for live lock conditions on the stack dumps. Test: compile Bug: 33808187 Change-Id: Ibc1e4cc10395fa9685c4ef0ca214daf212a5e126
2018-08-08 01:03:47 +02:00
llk. u:object_r:llkd_prop:s0
khungtask. u:object_r:llkd_prop:s0
ro.llk. u:object_r:llkd_prop:s0
ro.khungtask. u:object_r:llkd_prop:s0
limit shell's access to log.* properties Restrict the ability of the shell to set the log.* properties. Namely: only allow the shell to set such properities on eng and userdebug builds. The shell (and other domains) can continue to read log.* properties on all builds. While there: harmonize permissions for log.* and persist.log.tag. Doing so introduces two changes: - log.* is now writable from from |system_app|. This mirrors the behavior of persist.log.tag, which is writable to support "Developer options" -> "Logger buffer sizes" -> "Off". (Since this option is visible on user builds, the permission is enabled for all builds.) - persist.log.tag can now be set from |shell| on userdebug_or_eng(). BUG=28221972 TEST=manual (see below) Testing details - user build (log.tag) $ adb shell setprop log.tag.foo V $ adb shell getprop log.tag <blank line> $ adb bugreport | grep log.tag.foo [ 146.525836] init: avc: denied { set } for property=log.tag.foo pid=4644 uid=2000 gid=2000 scontext=u:r:shell:s0 tcontext=u:object_r:log_prop:s0 tclass=property_service permissive=0 [ 146.525878] init: sys_prop: permission denied uid:2000 name:log.tag.foo - userdebug build (log.tag) $ adb shell getprop log.tag.foo <blank line> $ adb shell setprop log.tag.foo V $ adb shell getprop log.tag.foo V - user build (persist.log.tag) $ adb shell getprop | grep log.tag <no match> - Developer options -> Logger buffer sizes -> Off $ adb shell getprop | grep log.tag [persist.log.tag]: [Settings] [persist.log.tag.snet_event_log]: [I] Change-Id: Idf00e7a623723a7c46bf6d01e386aeca92b2ad75
2016-04-15 20:10:06 +02:00
log. u:object_r:log_prop:s0
Regression for log.tag properties Allow log.tag and persist.log.tag as log_tag_prop Bug: 28942894 Change-Id: I05766b99b9535a79a39adc55cad004decd52956e
2016-06-06 21:10:00 +02:00
log.tag u:object_r:log_tag_prop:s0
allow system server to set log.tag.WifiHAL On eng and userdebug builds (only), allow system server to change the value of log.tag.WifiHAL. WifiStateMachine will set this property to 'D' by default. If/when a user enables "Developer options -> Enable Wi-Fi Verbose Logging", WifiStateMachine change log.tag.WifiHAL to 'V'. BUG=27857554 TEST=manual (see below) Test detail 1. on user build: $ adb shell setprop log.tag.WifiHAL V $ adb shell getprop log.tag.WifiHAL <blank line> $ adb bugreport | grep log.tag.WifiHAL <11>[ 141.918517] init: avc: denied { set } for property=log.tag.WifiHAL pid=4583 uid=2000 gid=2000 scontext=u:r:shell:s0 tcontext=u:object_r:wifi_log_prop:s0 tclass=property_service permissive=0 <11>[ 141.918566] init: sys_prop: permission denied uid:2000 name:log.tag.WifiHAL 2. on userdebug build: $ adb shell getprop log.tag.WifiHAL $ <blank line> $ adb shell setprop log.tag.WifiHAL V $ adb shell getprop log.tag.WifiHAL V 3. on userdebug build with modified WifiStateMachine: $ adb shell getprop log.tag.WifiHAL D Change-Id: I9cdd52a2b47a3dd1065262ea8c329130b7b044db
2016-04-15 20:10:39 +02:00
log.tag.WifiHAL u:object_r:wifi_log_prop:s0
expose control over unpriv perf access to shell This allows the shell user to control whether unprivileged access to perf events is allowed. To enable unprivileged access to perf: adb shell setprop security.perf_harden 0 To disable it again: adb shell setprop security.perf_harden 1 This allows Android to disable this kernel attack surface by default, while still allowing profiling tools to work automatically. It can also be manually toggled, but most developers won't ever need to do that if tools end up incorporating this. Bug: 29054680 Change-Id: Idcf6a2f6cbb35b405587deced7da1f6749b16a5f
2016-05-31 22:01:08 +02:00
security.perf_harden u:object_r:shell_prop:s0
Allow tracing service to access kallsyms on userdebug This CL allows the traced_probes service to temporarily lower kptr_restrict and read /proc/kallsyms. This is allowed only on userdebug/eng builds. The lowering of kptr_restrict is done via an init property because the kernel checks that the kptr_restrict writer is CAP_SYS_ADMIN, regardless of the /proc file ACLs [1]. [1] https://github.com/torvalds/linux/blob/4cbffc461ec91287c4cb1d0e27b01b988d0b8fba/kernel/sysctl.c#L2254 Bug: 136133013 Design doc: go/perfetto-kallsyms Test: perfetto_integrationtests --gtest_filter=PerfettoTest.KernelAddressSymbolization in r.android.com/1454882 Change-Id: Ic06e7a9a74c0f3e42fa63f7f41decc385c9fea2c
2020-10-09 10:15:10 +02:00
security.lower_kptr_restrict u:object_r:lower_kptr_restrict_prop:s0
Add policy for property service. New property_contexts file for property selabel backend. New property.te file with property type declarations. New property_service security class and set permission. Allow rules for setting properties.
2012-04-04 16:11:16 +02:00
service.adb.root u:object_r:shell_prop:s0
Add adbd_prop, system_adbd_prop property types. service.adb.tls.port contains the adbd tcp port running the TLS server. persist.sys.adb.wifi tells adbd when to enable the TLS server. Bug: 149348431 Bug: 111434128 Test: Enable wireless debugging, check if TLS port information is displayed in the Developer options > Wireless debuggging. Change-Id: I5b5c5a3d064bc003f41386ede9051609fefec53e
2020-02-12 19:18:10 +01:00
service.adb.tls.port u:object_r:adbd_prop:s0
persist.adb.wifi. u:object_r:adbd_prop:s0
persist.adb.tls_server.enable u:object_r:system_adbd_prop:s0
Add policy for property service. New property_contexts file for property selabel backend. New property.te file with property type declarations. New property_service security class and set permission. Allow rules for setting properties.
2012-04-04 16:11:16 +02:00
Label persist audio properties label all persist.audio.* properties and allow mediaserver access to them. Change-Id: If5755d9783dce298e66a25bcb7f17ff17bd83ea7
2012-11-28 02:34:54 +01:00
persist.audio. u:object_r:audio_prop:s0
Allow system apps (Settings) to configure Bluetooth properties Bug: 27078729 Change-Id: I74115521e1def661dea5575eb532b93fe7f1f4ad
2016-02-09 00:39:00 +01:00
persist.bluetooth. u:object_r:bluetooth_prop:s0
Add sepolicy for persist.nfc_cfg. Add a new nfc_cfg persist property for nfc features Bug: 142626304 Test: set property and load target files. Change-Id: I853c97e8113dbcf729cf59ad45895402b0c82b3e
2020-01-06 17:25:11 +01:00
persist.nfc_cfg. u:object_r:nfc_prop:s0
Add SELinux settings to support tracing during boot. This CL adds the SELinux settings required to support tracing during boot. https://android-review.googlesource.com/#/c/157163/ BUG: 21739901 Change-Id: Ib3a7107776141ac8cf4f1ca06674f47a0d4b6ae0
2015-06-24 08:24:17 +02:00
persist.debug. u:object_r:persist_debug_prop:s0
add logd. as logd_prop We already have ro.logd. and persist.logd. as logd_prop, but not logd. so this change adds it. New properties should be read-write by default so logd. should be preferred to ro.logd. Test: set logd.buffer_type appropriately. Change-Id: I51ed19f0093a0302709116944153f37067814d08
2020-07-14 18:55:35 +02:00
logd. u:object_r:logd_prop:s0
selinux: logd Development settings - logd Development Settings failed to access persist.logd.size Change-Id: I0732b44fcbffbf3c187bcb23df2db807fa3e8fde
2014-06-12 21:47:22 +02:00
persist.logd. u:object_r:logd_prop:s0
Whitelist exported platform properties This CL lists all the exported platform properties in private/exported_property_contexts. Additionally accessing core_property_type from vendor components is restricted. Instead public_readable_property_type is used to allow vendor components to read exported platform properties, and accessibility from vendor_init is also specified explicitly. Note that whitelisting would be applied only if PRODUCT_COMPATIBLE_PROPERTY is set on. Bug: 38146102 Test: tested on walleye with PRODUCT_COMPATIBLE_PROPERTY=true Change-Id: I304ba428cc4ca82668fec2ddeb17c971e7ec065e
2017-10-19 09:54:49 +02:00
ro.logd. u:object_r:logd_prop:s0
SELinux rule for ro.device_owner and persist.logd.security They are introduced for the device owner process logging feature. That is, for enterprise-owned devices with device owner app provisioned, the device owner may choose to turn on additional device-wide logging for auditing and intrusion detection purposes. Logging includes histories of app process startup, commands issued over ADB and lockscreen unlocking attempts. These logs will available to the device owner for analysis, potentially shipped to a remote server if it chooses to. ro.device_owner will be a master switch to turn off logging, if the device has no device owner provisioned. persist.logd.security is a switch that device owner can toggle (via DevicePoliyManager) to enable/disable logging. Writing to both properties should be only allowed by the system server. Bug: 22860162 Change-Id: Iabfe2347b094914813b9d6e0c808877c25ccd038
2016-01-04 16:20:45 +01:00
persist.logd.security u:object_r:device_logging_prop:s0
logpersist: reserve persist.logd.logpersistd shell, system_app and logd access granted on debug builds only Bug: 28936216 Change-Id: Ib9648e8565cc0ea0077cf0950b0e4ac6fe0a3135
2016-06-06 21:18:46 +02:00
persist.logd.logpersistd u:object_r:logpersistd_logging_prop:s0
logcatd: trampoline persist.logd.logpersistd to logd.logpersistd Bug: 28936216 Change-Id: I90dc7ca296dc5c9b6d13e7920ebb864981a112b5
2016-07-08 17:41:08 +02:00
logd.logpersistd u:object_r:logpersistd_logging_prop:s0
Regression for log.tag properties Allow log.tag and persist.log.tag as log_tag_prop Bug: 28942894 Change-Id: I05766b99b9535a79a39adc55cad004decd52956e
2016-06-06 21:10:00 +02:00
persist.log.tag u:object_r:log_tag_prop:s0
persist.mmc.* only set in init Bug: 26976972 Change-Id: I0e44bfc6774807a3bd2ba05637a432675d855118
2016-02-04 19:55:43 +01:00
persist.mmc. u:object_r:mmc_prop:s0
Revert "Temporarily revert the SELinux policy for persist.netd.stable_secret." This change must only be submitted when device-specific policies have been reverted. This reverts commit 07e631d2e0a01226ea83e517305d1eceb1b1a158. Bug: 17613910 Test: builds Change-Id: Ie33e293107bf1eba2498f2422d941544c76b8cad Merged-In: I356c39a5dc955b3d7c28d8c7baf2887a17beb272
2017-07-11 02:43:19 +02:00
persist.netd.stable_secret u:object_r:netd_stable_secret_prop:s0
Add label for persist.pm.mock-upgrade This property is used for testing purposes when verifying the behavior when an OTA occurs. It should be readable by the system server, and be settable by the shell. Test: Set property from shell, read with PackageManager Bug: 140992644 Change-Id: I39ad9b7961208f02fa45011215c2ff5ac03b7380
2019-10-09 18:09:48 +02:00
persist.pm.mock-upgrade u:object_r:mock_ota_prop:s0
Allow profcollectd to store and read its application specific node ID in properties This node ID will be used to uniquely and anonymously identify a device by profcollectd on engineering (userdebug or eng) builds. Test: build Change-Id: If01f71c62479d63d4d19aac15da24bc835621e66
2021-03-22 15:02:22 +01:00
persist.profcollectd.node_id u:object_r:profcollectd_node_id_prop:s0 exact string
Add policy for property service. New property_contexts file for property selabel backend. New property.te file with property type declarations. New property_service security class and set permission. Allow rules for setting properties.
2012-04-04 16:11:16 +02:00
persist.sys. u:object_r:system_prop:s0
Allow logd.auditd to reboot to safe mode Bug: 26902605 Change-Id: Ica825cf2af74f5624cf4091544bd24bb5482dbe7
2016-02-06 00:42:32 +01:00
persist.sys.safemode u:object_r:safemode_prop:s0
Add persist.sys.theme. This property will be set by system_server (to indicate the currently selected theme for device), and can be accessed by vendor init.rc. avc: denied { read } for property=persist.sys.theme pid=0 uid=0 gid=0 scontext=u:r:vendor_init:s0 tcontext=u:object_r:theme_prop:s0 tclass=file Bug: 113028175 Test: Set a vendor init trigger that waits on `persist.sys.theme`. Check that the trigger fires without denial. Change-Id: Ia85b1a8dfc118efdbb9337ca017c8fb7958dc386 Merged-In: Ibb4e392d5059b76059f36f7d11ba82cd65cbe970 (cherry picked from commit 75182a1ea645d3fa1e4c3e9f77851d90ff7cc803)
2019-06-15 02:00:16 +02:00
persist.sys.theme u:object_r:theme_prop:s0
Sepolicy: add dynamic_system_prop and allow shell and system_app (Settings) to set it to enable Dynamic System Update. Also allow priv_app (user of the API) to read it. Bug: 119647479 Bug: 129060539 Test: run the following command on crosshatch-user: adb shell setprop persist.sys.fflag.override.settings_dynamic_system 1 Change-Id: I24a5382649c64d36fd05a59bc87faca87e6f0eb8 Merged-In: I24a5382649c64d36fd05a59bc87faca87e6f0eb8
2019-04-26 10:14:52 +02:00
persist.sys.fflag.override.settings_dynamic_system u:object_r:dynamic_system_prop:s0
Add ro.sys.safemode property. Bug: 28008032 Change-Id: I29e076ee9c62a0fb3b386f79509935a1961f95e1
2016-03-03 01:14:17 +01:00
ro.sys.safemode u:object_r:safemode_prop:s0
Allow logd.auditd to reboot to safe mode Bug: 26902605 Change-Id: Ica825cf2af74f5624cf4091544bd24bb5482dbe7
2016-02-06 00:42:32 +01:00
persist.sys.audit_safemode u:object_r:safemode_prop:s0
Revert^2 "SELinux policy for system server JVMTI" This reverts commit baa06ee2cd8b2f6c8bd0c2d873dc2888d6296353. Reason for revert: Added missing property name in vendor_init.te. Bug: none Test: none (other than neverallow checking) Change-Id: I9e93bf4ea6ca3a4634f8f4cbce2f13c5f410883b
2019-11-25 23:03:59 +01:00
persist.sys.dalvik.jvmtiagent u:object_r:system_jvmti_agent_prop:s0
Add policy for property service. New property_contexts file for property selabel backend. New property.te file with property type declarations. New property_service security class and set permission. Allow rules for setting properties.
2012-04-04 16:11:16 +02:00
persist.service. u:object_r:system_prop:s0
SELinux policy for Bluetooth properties. Properties under bluetooth. and persist.service.bdroid. are considered Bluetooth-related properties. Change-Id: Iee937d9a1184c2494deec46f9ed7090c643acda7
2013-05-06 19:18:27 +02:00
persist.service.bdroid. u:object_r:bluetooth_prop:s0
Add policy for property service. New property_contexts file for property selabel backend. New property.te file with property type declarations. New property_service security class and set permission. Allow rules for setting properties.
2012-04-04 16:11:16 +02:00
persist.security. u:object_r:system_prop:s0
sepolicy: allow shell to read/write traced prop This is to fix the CTS failures given by the bugs below where devices where traced is not enabled by default causes test failures. Bug: 78215159 Bug: 78347829 Change-Id: Ib0f6a1cdb770528dbbeb857368534ff5040e464e
2018-04-20 20:09:45 +02:00
persist.traced.enable u:object_r:traced_enabled_prop:s0
Allow traced to lazily start heapprofd. Bug: 126724929 Change-Id: I15f0ae10d5e45fc65850635230e377b6f77ad4d7
2019-03-13 19:22:23 +01:00
traced.lazy. u:object_r:traced_lazy_prop:s0
Add persist.heapprofd.enable property. This is analoguous to what Perfetto does with persist.traced.enable. Test: m Test: flash walleye Test: setprop persist.heapprofd.enable 1 setprop persist.heapprofd.enable 0 Change-Id: I997272ef8c6fe078aca2388ed0cf2ecc3de612a5
2018-12-10 17:20:20 +01:00
persist.heapprofd.enable u:object_r:heapprofd_enabled_prop:s0
traced_perf sepolicy tweaks * allow shell to enable/disable the daemon via a sysprop * don't audit signals, as some denials are expected * exclude zygote from the profileable set of targets on debug builds. I've not caught any crashes in practice, but believe there's a possibility that the zygote forks while holding a non-whitelisted fd due to the signal handler. Change-Id: Ib237d4edfb40b200a3bd52e6341f13c4777de3f1
2020-02-19 15:59:17 +01:00
persist.traced_perf.enable u:object_r:traced_perf_enabled_prop:s0
sepolicy(hal_wifi): Allow wifi HAL to access persist.vendor.debug properties We want to tweak some device params at runtime via shell (alleviates the need to recompile HAL for changing device configuration). This will help us test/teamfood couple of new features under development. Bug: 173044646 Test: Wifi HAL can read persist.vendor.debug.wifi properties. Change-Id: Iabd07e72aa5f0d97519a37d0ebb1e0a3458b6d06
2020-11-12 23:21:41 +01:00
persist.vendor.debug.wifi. u:object_r:persist_vendor_debug_wifi_prop:s0
Add persist.vendor.overlay. to properties Allow the system_server to change. Allow the zygote to read it as well. Test: Have system_server set a property Change-Id: Ie90eec8b733fa7193861026a3a6e0fb0ba5d5318
2016-11-09 21:19:05 +01:00
persist.vendor.overlay. u:object_r:overlay_prop:s0
make ril.cdma.inecmmode system property internal so that it cannot reveal a system api that requires READ_PRIVILEGED_PHONE_STATE Bug: 183410189 Test: adb shell getprop -Z Change-Id: I65f4121fc300447af7d516676166bc8b0b53b727
2021-04-30 06:52:42 +02:00
ril.cdma.inecmmode u:object_r:radio_cdma_ecm_prop:s0 exact bool
Add persist.vendor.overlay. to properties Allow the system_server to change. Allow the zygote to read it as well. Test: Have system_server set a property Change-Id: Ie90eec8b733fa7193861026a3a6e0fb0ba5d5318
2016-11-09 21:19:05 +01:00
ro.boot.vendor.overlay. u:object_r:overlay_prop:s0
Assign a label to the ro.boottime.* properties system/core commit 331cf2fb7c16b5b25064f8d2f00284105a9b413f created a number of new properties of the form: [ro.boottime.init]: [5294587604] [ro.boottime.InputEventFind]: [10278767840] [ro.boottime.adbd]: [8359267180] ... These properties were assigned the default_prop SELinux label because a better label did not exist. Properties labeled with the default_prop label are readable to any SELinux domain, which is overly broad. bullhead:/ $ getprop -Z ro.boottime.adbd u:object_r:default_prop:s0 Instead, create a new label for the ro.boottime.* properties so we can apply more fine grain read access control to these properties. bullhead:/ $ getprop -Z ro.boottime.adbd u:object_r:boottime_prop:s0 New SELinux property labels have minimal permissions by default. As a result, after this change, ro.boottime.* properties will only be readable to system_server, bootstat, init (because it manages the property space), and "adb root" (because no SELinux permissions are enforced there). Additional read access can be granted as-needed. This is part of a larger effort to implement fine-grain access control on the properties managed by init. Test: Device boots and no SELinux denials on boot. Change-Id: Ibf981cb81898f4356fdc5c1b6f15dd93c0d6d84d
2016-12-14 04:50:36 +01:00
ro.boottime. u:object_r:boottime_prop:s0
Restrict access to ro.serialno and ro.boot.serialno This restricts access to ro.serialno and ro.boot.serialno, the two system properties which contain the device's serial number, to a select few SELinux domains which need the access. In particular, this removes access to these properties from Android apps. Apps can access the serial number via the public android.os.Build API. System properties are not public API for apps. The reason for the restriction is that serial number is a globally unique identifier which cannot be reset by the user. Thus, it can be used as a super-cookie by apps. Apps need to wean themselves off of identifiers not resettable by the user. Test: Set up fresh GMS device, install some apps via Play, update some apps, use Chrome Test: Access the device via ADB (ADBD exposes serial number) Test: Enable MTP over USB, use mtp-detect to confirm that serial number is reported in MTP DeviceInfo Bug: 31402365 Bug: 33700679 Change-Id: I4713133b8d78dbc63d8272503e80cd2ffd63a2a7
2016-12-21 00:31:37 +01:00
ro.serialno u:object_r:serialno_prop:s0
Restrict access to Bluetooth system properties This removes access to Bluetooth system properties from arbitrary SELinux domains. Access remains granted to init, bluetooth, and system_app domains. neverallow rules / CTS enforce that access is not granted to Zygote and processes spawned from Zygote expcept for system_app and bluetooth. The reason is that some of these properties may leak persistent identifiers not resettable by the user. Test: Bluetooth pairing and data transfer works Bug: 33700679 Change-Id: Icdcb3927a423c4011a62942340a498cc1b302472
2016-12-28 03:05:46 +01:00
ro.boot.btmacaddr u:object_r:bluetooth_prop:s0
Restrict access to ro.serialno and ro.boot.serialno This restricts access to ro.serialno and ro.boot.serialno, the two system properties which contain the device's serial number, to a select few SELinux domains which need the access. In particular, this removes access to these properties from Android apps. Apps can access the serial number via the public android.os.Build API. System properties are not public API for apps. The reason for the restriction is that serial number is a globally unique identifier which cannot be reset by the user. Thus, it can be used as a super-cookie by apps. Apps need to wean themselves off of identifiers not resettable by the user. Test: Set up fresh GMS device, install some apps via Play, update some apps, use Chrome Test: Access the device via ADB (ADBD exposes serial number) Test: Enable MTP over USB, use mtp-detect to confirm that serial number is reported in MTP DeviceInfo Bug: 31402365 Bug: 33700679 Change-Id: I4713133b8d78dbc63d8272503e80cd2ffd63a2a7
2016-12-21 00:31:37 +01:00
ro.boot.serialno u:object_r:serialno_prop:s0
Restrict access to Bluetooth system properties This removes access to Bluetooth system properties from arbitrary SELinux domains. Access remains granted to init, bluetooth, and system_app domains. neverallow rules / CTS enforce that access is not granted to Zygote and processes spawned from Zygote expcept for system_app and bluetooth. The reason is that some of these properties may leak persistent identifiers not resettable by the user. Test: Bluetooth pairing and data transfer works Bug: 33700679 Change-Id: Icdcb3927a423c4011a62942340a498cc1b302472
2016-12-28 03:05:46 +01:00
ro.bt. u:object_r:bluetooth_prop:s0
Switch /data/misc/reboot/last_reboot_reason to persistent property Switch from /data/misc/reboot/last_reboot_reason to persistent Android property persist.sys.boot.reason for indicating why the device is rebooted or shutdown. Introduce protection for all boot reason properties Protect the following properties with these labels ro.boot.bootreason u:object_r:bootloader_boot_reason_prop:s0 sys.boot.reason u:object_r:sys_boot_reason_prop:s0 persist.sys.boot.reason u:object_r:last_boot_reason_prop:s0 Setup the current as-need access rules for each. ToDo: Remove u:object_r:reboot_data_file after internal fixes. Test: system/core/bootstat/boot_reason_test.sh Bug: 64687998 Change-Id: I3771c73933e8ae2d94aee936c7a38b6282611b80
2017-08-14 23:25:10 +02:00
ro.boot.bootreason u:object_r:bootloader_boot_reason_prop:s0
persist.sys.boot.reason u:object_r:last_boot_reason_prop:s0
sys.boot.reason u:object_r:system_boot_reason_prop:s0
persist.sys.boot.reason is cleared once read by bootstat To ensure a surprise reboot does not take the last boot reason on face value especially if coming from more than one boot sessions ago. We shift and clear the value from persist.sys.boot.reason to sys.boot.reason.last and establish a correct last reboot reason in the canonical sys.boot.reason property. As a result, the power manager should read the canonical sys.boot.reason for a definitive result rather than relying on the possibly incorrect values in the persistent storage. sys.boot.reason should be a core property as it represents the canonical boot reason API. Test: compile Bug: 86671991 Bug: 63736262 Change-Id: If3742c487d6c0ab69c464f056bf48c786b66a945
2018-06-05 18:41:59 +02:00
sys.boot.reason.last u:object_r:last_boot_reason_prop:s0
Revert "Revert "Put pm.* property in new pm_prop context"" This reverts commit 248b6dc64444ea3260fba8e9cb390e59e2b941ab. Reason for revert: The dashboard complains that devices don't boot after this revert. Change-Id: I6a4648b64b096cbaa97c67aae6bc38b76d54cb48
2017-11-16 06:28:14 +01:00
pm. u:object_r:pm_prop:s0
FrameworksServicesTests: allow access to test.sys.boot.reason property com.android.server.power.PowerManagerServiceTest#testGetLastShutdownReasonInternal due to "RuntimeException: failed to set system property" W/roidJUnitRunner: type=1400 audit(0.0:6): avc: denied { write } for name="property_service" dev="tmpfs" ino=13178 scontext=u:r:platform_app:s0:c512,c768 tcontext=u:object_r:property_socket:s0 tclass=sock_file permissive=0 W/libc : Unable to set property "test.sys.boot.reason" to "shutdown,thermal": connection failed; errno=13 (Permission denied) Had to use precise property definition as com.android.phone accesses test properties as well. Test: compile Bug: 78245377 Change-Id: I2cc810846f8615f2a2fae8e0d4f41de585b7abd7
2015-10-25 01:20:18 +02:00
test.sys.boot.reason u:object_r:test_boot_reason_prop:s0
Add userspace_reboot_test_prop This property type represents properties used in CTS tests of userspace reboot. For example, test.userspace_reboot.requested property which is used to check that userspace reboot was successful and didn't result in full reboot, e.g.: * before test setprop test.userspace_reboot.requested 1 * adb reboot userspace * wait for boot to complete * verify that value of test.userspace_reboot.requested is still 1 Test: adb shell setprop test.userspace_reboot.requested 1 Bug: 150901232 Change-Id: I45d187f386149cec08318ea8545ab864b5810ca8 Merged-In: I45d187f386149cec08318ea8545ab864b5810ca8 (cherry picked from commit 3bd53a9ceecc37c79090c59776408b3d4733b036)
2020-03-12 15:45:00 +01:00
test.userspace_reboot.requested u:object_r:userspace_reboot_test_prop:s0
Selinux: Allow lmkd write access to sys.lmk. properties Allow lmkd write access to sys.lmk. properties to be able to set sys.lmk.minfree_levels. Bug: 111521182 Test: getprop sys.lmk.minfree_levels returns value set by lmkd Change-Id: I86ff11d75917966857d3a76876a56799bb92a5ad Signed-off-by: Suren Baghdasaryan <surenb@google.com>
2018-07-25 02:04:18 +02:00
sys.lmk. u:object_r:system_lmk_prop:s0
Allow traced to notify traceur via property This CL introduces allows traced to set the sys.traceur.trace_end_signal property at the end of the tracer. In turn that property notifies the the Traceur app. This is to allowing Traceur to be killed during a long-trace and avoid wasting resources making it a persistent service. See aosp/886616 for the matching traceur change. Test: manual Bug: 116754732 Change-Id: I89e2f02b3f973813ce8ff3507d397a06502f84c1
2019-02-01 23:52:02 +01:00
sys.trace. u:object_r:system_trace_prop:s0
Add entries for some properties in default_prop Currently default_prop is readable by coredomain and appdomain. That's too broad, and we are going to restrict the access so every property should be added to property_contexts. This adds some missing properties to property_contexts. Newly added property contexts are: - wrap.*: used by zygote to give arguments. It's assigned as zygote_wrap_prop, and will be readable from coredomain. - partition.{mount_name}.verified: used by dm-verity. It's assigned as vertiy_status_prop, and will only be accessible from init. - (ro.)?setupwizard.*: used by setup wizard. It's assigned as setupwizard_prop, and will be readable from coredomain. Other properties, such as ro.gfx.*, media.stagefright.*, ro.storage_manager.* are also added to existing contexts. Bug: 170590987 Test: boot crosshatch and see no denials Change-Id: Ife9d69a62ee8bd7395a70cd104271898c8a72540
2020-11-05 14:17:26 +01:00
wrap. u:object_r:zygote_wrap_prop:s0 prefix string
Move policy files Update the file_contexts for the new location of the policy files, as well as update the policy for the management of these types. Change-Id: Idc475901ed437efb325807897e620904f4ff03e9
2013-01-23 23:02:43 +01:00
Added read only suspend hal properties Bug: 170587692 Test: Inspected logs to confirm android.system.suspend can access the properties Change-Id: Ie6a84afe490df0d2b11ff4f06588c7bca68d9850
2020-10-30 21:55:21 +01:00
# Suspend service properties
suspend.max_sleep_time_millis u:object_r:suspend_prop:s0 exact uint
suspend.base_sleep_time_millis u:object_r:suspend_prop:s0 exact uint
suspend.backoff_threshold_count u:object_r:suspend_prop:s0 exact uint
suspend.short_suspend_threshold_millis u:object_r:suspend_prop:s0 exact uint
suspend.sleep_time_scale_factor u:object_r:suspend_prop:s0 exact double
suspend.failed_suspend_backoff_enabled u:object_r:suspend_prop:s0 exact bool
suspend.short_suspend_backoff_enabled u:object_r:suspend_prop:s0 exact bool
Support TCP based fastbootd in recovery mode. The IPv6 link-local address is used to avoid expose device to out of network segment. BUG: 155198345 Test: manual test. Change-Id: I0ce8c12de9976c01e57a6433c7fb50235e907dc5
2020-04-24 08:43:13 +02:00
# Fastbootd protocol control property
fastbootd.protocol u:object_r:fastbootd_protocol_prop:s0 exact enum usb tcp
Allow vendor_init to set service.adb.tcp.port adbd and apps (SystemUI and CTS test apps) need to read it. BUG: 162205386 Test: Connect to device which sets service.adb.tcp.port in vendor partition through TCP adb. Change-Id: Ia37dd0dd3239381feb2a4484179a0c7847166b29
2020-07-28 00:15:53 +02:00
# adbd protoctl configuration property
service.adb.tcp.port u:object_r:adbd_config_prop:s0 exact int
Add the `service.adb.transport` property adbd reads this property. Bug: 176210699 Test: boot the system image, check if adb works Signed-off-by: Roman Kiryanov <rkir@google.com> Change-Id: I78847022413100331678b68a720aa1f1c8a31130
2021-01-20 22:07:47 +01:00
service.adb.transport u:object_r:adbd_config_prop:s0 exact string
Allow vendor_init to set service.adb.tcp.port adbd and apps (SystemUI and CTS test apps) need to read it. BUG: 162205386 Test: Connect to device which sets service.adb.tcp.port in vendor partition through TCP adb. Change-Id: Ia37dd0dd3239381feb2a4484179a0c7847166b29
2020-07-28 00:15:53 +02:00
SELinux rule for ro.device_owner and persist.logd.security They are introduced for the device owner process logging feature. That is, for enterprise-owned devices with device owner app provisioned, the device owner may choose to turn on additional device-wide logging for auditing and intrusion detection purposes. Logging includes histories of app process startup, commands issued over ADB and lockscreen unlocking attempts. These logs will available to the device owner for analysis, potentially shipped to a remote server if it chooses to. ro.device_owner will be a master switch to turn off logging, if the device has no device owner provisioned. persist.logd.security is a switch that device owner can toggle (via DevicePoliyManager) to enable/disable logging. Writing to both properties should be only allowed by the system server. Bug: 22860162 Change-Id: Iabfe2347b094914813b9d6e0c808877c25ccd038
2016-01-04 16:20:45 +01:00
# Boolean property set by system server upon boot indicating
Rename ro.device_owner system property This is renamed to ro.organization_owned to cover the extended usage now that there is a new management mode for fully-managed organization owned devices: organization-owned managed profile. A device is considered fully-managed if there is a device owner or an organization-owned managed profile. Bug: 148437300 Test: atest FrameworksServicesTests:DevicePolicyManagerTest Test: atest FrameworksServicesTests:SecurityEventTest Test: atest FrameworksCoreTests:EventLogTest Test: atest com.android.cts.devicepolicy.DeviceOwnerTest#testSecurityLoggingWithSingleUser Test: atest com.android.cts.devicepolicy.DeviceOwnerTest#testSecurityLoggingWithTwoUsers Test: atest com.android.cts.devicepolicy.DeviceOwnerTest#testSecurityLoggingEnabledLogged Change-Id: Ic3288fe343d3b51c59f08678e114fe9a81cb39a4
2020-02-17 12:00:13 +01:00
# if device is fully owned by organization instead of being
# a personal device.
ro.organization_owned u:object_r:device_logging_prop:s0
SELinux rule for ro.device_owner and persist.logd.security They are introduced for the device owner process logging feature. That is, for enterprise-owned devices with device owner app provisioned, the device owner may choose to turn on additional device-wide logging for auditing and intrusion detection purposes. Logging includes histories of app process startup, commands issued over ADB and lockscreen unlocking attempts. These logs will available to the device owner for analysis, potentially shipped to a remote server if it chooses to. ro.device_owner will be a master switch to turn off logging, if the device has no device owner provisioned. persist.logd.security is a switch that device owner can toggle (via DevicePoliyManager) to enable/disable logging. Writing to both properties should be only allowed by the system server. Bug: 22860162 Change-Id: Iabfe2347b094914813b9d6e0c808877c25ccd038
2016-01-04 16:20:45 +01:00
Move policy files Update the file_contexts for the new location of the policy files, as well as update the policy for the management of these types. Change-Id: Idc475901ed437efb325807897e620904f4ff03e9
2013-01-23 23:02:43 +01:00
# selinux non-persistent properties
New "selinux.restorecon" control property. This new property is used as a control verb for running a recursive restorecon at the path contained in the property value. Defines a new label and grants access to vold, which invokes it when mounting private adopted volumes. Bug: 21121357 Change-Id: I8ff12a146e54a505aa5b43a542578891563d647a
2015-06-09 20:01:04 +02:00
selinux.restorecon_recursive u:object_r:restorecon_prop:s0
Add policy for property service. New property_contexts file for property selabel backend. New property.te file with property type declarations. New property_service security class and set permission. Allow rules for setting properties.
2012-04-04 16:11:16 +02:00
# default property context
* u:object_r:default_prop:s0
# data partition encryption properties
vold. u:object_r:vold_prop:s0
Remove special case handling of "ro." properties Currently, properties that begin with "ro." are special cased to skip over the "ro." part of the prefix before matching with entries in property_contexts. A change to init is removing this special case and therefore, the "ro." prefixes must be explicitly added to property_contexts. Bug 26425619 Change-Id: I343f139a39abef99924e84e0d27699284f335d63
2016-01-11 22:06:25 +01:00
ro.crypto. u:object_r:vold_prop:s0
Allow vold to set MLS level on per-user directories. We want to extend vold_prepare_subdirs to set the MLS level to the correct per-user value for selected user-specific directories. Grant vold_prepare_subdirs the access it needs to do this, and allow vold to access the temporary property controlling this. Bug: 141677108 Test: Manual, with and without property set. Change-Id: I572462cfd9b8869381f2af5faa29165bb8373d4b
2020-02-11 15:43:05 +01:00
allow system_server to set ro.build.fingerprint Some devices leave "ro.build.fingerprint" undefined at build time, since they need to build it from the components at runtime. See https://android.googlesource.com/platform/frameworks/base/+/5568772e8161205b86905d815783505fd3d461d8 for details. Allow system_server to set ro.build.fingerprint Addresses the following denial/error: avc: denied { set } for property=build.fingerprint scontext=u:r:system_server:s0 tcontext=u:object_r:default_prop:s0 tclass=property_service init: sys_prop: permission denied uid:1000 name:ro.build.fingerprint Bug: 18188956 Change-Id: I98b25773904a7be3e3d2926daa82c1d08f9bcc29
2014-11-18 23:36:23 +01:00
# ro.build.fingerprint is either set in /system/build.prop, or is
# set at runtime by system_server.
Relabel ro.build. properties - exported_fingerprint_prop is deleted - other ro.build. properties become build_prop Bug: 155844385 Test: sepolicy_tests Change-Id: Ic1194e8e7c23394e5a7c6176f9f9598109bb5fb7 Merged-In: Ic1194e8e7c23394e5a7c6176f9f9598109bb5fb7 (cherry picked from commit 1d63d5d0756d0d47ef6ec816b3c35b3b96bd50d4)
2020-05-06 13:07:33 +02:00
ro.build.fingerprint u:object_r:fingerprint_prop:s0 exact string
allow system_server to set ro.build.fingerprint Some devices leave "ro.build.fingerprint" undefined at build time, since they need to build it from the components at runtime. See https://android.googlesource.com/platform/frameworks/base/+/5568772e8161205b86905d815783505fd3d461d8 for details. Allow system_server to set ro.build.fingerprint Addresses the following denial/error: avc: denied { set } for property=build.fingerprint scontext=u:r:system_server:s0 tcontext=u:object_r:default_prop:s0 tclass=property_service init: sys_prop: permission denied uid:1000 name:ro.build.fingerprint Bug: 18188956 Change-Id: I98b25773904a7be3e3d2926daa82c1d08f9bcc29
2014-11-18 23:36:23 +01:00
make ro.persistent_properties.ready accessible for hidl client - compared to ro.boottime, this one does not pass time info bug: 35178781 bug: 34274385 Test: reboot Change-Id: I6a7bf636a3f201653e2890751d5fa210274c9ede
2017-03-01 04:21:31 +01:00
ro.persistent_properties.ready u:object_r:persistent_properties_ready_prop:s0
Add policy for property service. New property_contexts file for property selabel backend. New property.te file with property type declarations. New property_service security class and set permission. Allow rules for setting properties.
2012-04-04 16:11:16 +02:00
# ctl properties
Replace ctl_default_prop access with explicit service property keys. The ctl_default_prop label is a bit too generic for some of the priveleged domains when describing access rights. Instead, be explicit about which services are being started and stopped by introducing new ctl property keys. Change-Id: I1d0c6f6b3e8bd63da30bd6c7b084da44f063246a Signed-off-by: rpcraig <rpcraig@tycho.ncsc.mil>
2014-02-18 19:24:26 +01:00
ctl.bootanim u:object_r:ctl_bootanim_prop:s0
Add policy for property service. New property_contexts file for property selabel backend. New property.te file with property type declarations. New property_service security class and set permission. Allow rules for setting properties.
2012-04-04 16:11:16 +02:00
ctl.dumpstate u:object_r:ctl_dumpstate_prop:s0
Replace ctl_default_prop access with explicit service property keys. The ctl_default_prop label is a bit too generic for some of the priveleged domains when describing access rights. Instead, be explicit about which services are being started and stopped by introducing new ctl property keys. Change-Id: I1d0c6f6b3e8bd63da30bd6c7b084da44f063246a Signed-off-by: rpcraig <rpcraig@tycho.ncsc.mil>
2014-02-18 19:24:26 +01:00
ctl.fuse_ u:object_r:ctl_fuse_prop:s0
ctl.mdnsd u:object_r:ctl_mdnsd_prop:s0
Add policy for property service. New property_contexts file for property selabel backend. New property.te file with property type declarations. New property_service security class and set permission. Allow rules for setting properties.
2012-04-04 16:11:16 +02:00
ctl.ril-daemon u:object_r:ctl_rildaemon_prop:s0
Allow system_app to start bugreport and to create /data/anr/traces.txt. Resolves denials such as: avc: denied { set } for property =ctl.bugreport scontext=u:r:system_app:s0 tcontext=u:object_r:ctl_default_prop:s0 tclass=property_service avc: denied { write } for pid=4415 comm=5369676E616C2043617463686572 name="anr" dev="dm-0" ino=358337 scontext=u:r:system_app:s0 tcontext=u:object_r:anr_data_file:s0 tclass=dir avc: denied { add_name } for pid=4415 comm=5369676E616C2043617463686572 name="traces.txt" scontext=u:r:system_app:s0 tcontext=u:object_r:anr_data_file:s0 tclass=dir avc: denied { create } for pid=4415 comm=5369676E616C2043617463686572 name="traces.txt" scontext=u:r:system_app:s0 tcontext=u:object_r:anr_data_file:s0 tclass=file Change-Id: I71d0ede049136d72f28bdc85d52fcefa2f7d128f Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-03-06 20:47:22 +01:00
ctl.bugreport u:object_r:ctl_bugreport_prop:s0
Create context for ctl.console (cherry picked from commit c2e31a77825b4b404549396f5bcf1834d6ab0d3a) Change-Id: I92218709fa8cdb71c0369aca8fdd7922df45f7d0
2015-04-24 23:39:16 +02:00
ctl.console u:object_r:ctl_console_prop:s0
Add policy for property service. New property_contexts file for property selabel backend. New property.te file with property type declarations. New property_service security class and set permission. Allow rules for setting properties.
2012-04-04 16:11:16 +02:00
ctl. u:object_r:ctl_default_prop:s0
Allow NFC to read/write nfc. system properties. (cherry pick of commit 05383ebfb439bed8436912ed28db550e8842b343) Bug: 17298769 Change-Id: I1994ff9f9da9b13249099f6c9bcec88dcdc2bb97
2014-09-26 00:13:41 +02:00
Update sepolicy to use inclusive language See https://source.android.com/setup/contribute/respectful-code for reference #inclusivefixit Bug: 161896447 Test: Build Change-Id: If612f2270c8ba1d7fc2cbda3b2e8ca3818c0a1be
2020-07-27 18:30:34 +02:00
# Don't allow uncontrolled access to all services
Finer grained permissions for ctl. properties Currently, permissions for ctl. property apply to each action verb, so if a domain has permissions for controlling service 'foo', then it can start, stop, and restart foo. This change implements finer grainer permissions such that permission can be given to strictly start a given service, but not stop or restart it. This new permission scheme is mandatory for the new control functions, sigstop_on, sigstop_off, interface_start, interface_stop, interface_restart. Bug: 78511553 Test: see appropriate successes and failures based on permissions Merged-In: Ibe0cc0d6028fb0ed7d6bcba626721e0d84cc20fa Change-Id: Ibe0cc0d6028fb0ed7d6bcba626721e0d84cc20fa (cherry picked from commit 2208f96e9e6264553fcc8a58b86f4f21a092468c)
2018-05-04 02:00:16 +02:00
ctl.sigstop_on$ u:object_r:ctl_sigstop_prop:s0
ctl.sigstop_off$ u:object_r:ctl_sigstop_prop:s0
ctl.start$ u:object_r:ctl_start_prop:s0
ctl.stop$ u:object_r:ctl_stop_prop:s0
ctl.restart$ u:object_r:ctl_restart_prop:s0
ctl.interface_start$ u:object_r:ctl_interface_start_prop:s0
ctl.interface_stop$ u:object_r:ctl_interface_stop_prop:s0
ctl.interface_restart$ u:object_r:ctl_interface_restart_prop:s0
Revert "Revert "Reduce the number of processes that can start adbd"" This reverts commit b5dc6137adf0c5ced252c6bedc48b00317e0a4e0. Reason for revert: Reverted incorrect change Change-Id: Ieafa3338e28ffeed40bcceb73486cffbfbd08b9d
2018-06-26 21:52:21 +02:00
# Restrict access to starting/stopping adbd
ctl.start$adbd u:object_r:ctl_adbd_prop:s0
ctl.stop$adbd u:object_r:ctl_adbd_prop:s0
ctl.restart$adbd u:object_r:ctl_adbd_prop:s0
Allow system_server and shell to start gsid on-demand. gsid is started lazily to reduce memory pressure. It can be started either via gsi_tool (invoked by adb shell), or by DynamicAndroidService via system_server. Bug: 126622385 Test: no denials running "gsi_tool status" Change-Id: I90a5f3f28fe4f294fb60e7c87a62e76716fbd5c0
2019-02-28 03:31:11 +01:00
# Restrict access to starting/stopping gsid.
ctl.start$gsid u:object_r:ctl_gsid_prop:s0
ctl.stop$gsid u:object_r:ctl_gsid_prop:s0
ctl.restart$gsid u:object_r:ctl_gsid_prop:s0
Allow apexd to stop itself apexd stops itself when it finds that it is running on a device with flattened APEXes (i.e. ro.apex.updatable = false). Bug: 133907211 Test: launch sdk_phone_x86_64 adb logcat -d | grep apexd | wc -l returns 3 Change-Id: I7fa161b069aa34adb028194b55f367fe740a0cfc
2019-06-13 02:45:05 +02:00
# Restrict access to stopping apexd.
ctl.stop$apexd u:object_r:ctl_apexd_prop:s0
Fix: dumpstate HAL service property context http://aosp/678384 changed property format Fixes: 137695210 Test: inject timeout and take BR see dumpstate restarted Change-Id: Ie24e2d42e92410a935ca4c9364b476d72aa459f3
2019-07-17 18:39:33 +02:00
# Restrict access to restart dumpstate
ctl.interface_restart$android.hardware.dumpstate u:object_r:ctl_dumpstate_prop:s0
Add sepolicy for starting the snapuserd daemon through init. Restrict access to controlling snapuserd via ctl properties. Allow update_engine to control snapuserd, and connect/write to its socket. update_engine needs this access so it can create the appropriate dm-user device (which sends queries to snapuserd), which is then used to build the update snapshot. This also fixes a bug where /dev/dm-user was not properly labelled. As a result, snapuserd and update_engine have been granted r_dir_perms to dm_user_device. Bug: 168554689 Test: full ota with VABC enabled Change-Id: I1f65ba9f16a83fe3e8ed41a594421939a256aec0
2020-11-13 09:45:59 +01:00
# Restrict access to control snapuserd
ctl.start$snapuserd u:object_r:ctl_snapuserd_prop:s0
ctl.stop$snapuserd u:object_r:ctl_snapuserd_prop:s0
ctl.restart$snapuserd u:object_r:ctl_snapuserd_prop:s0
Allow NFC to read/write nfc. system properties. (cherry pick of commit 05383ebfb439bed8436912ed28db550e8842b343) Bug: 17298769 Change-Id: I1994ff9f9da9b13249099f6c9bcec88dcdc2bb97
2014-09-26 00:13:41 +02:00
# NFC properties
nfc. u:object_r:nfc_prop:s0
Dependencies for new goldfish service domains. In order to support the new goldfish service domains in a change with the same Change-Id for the build project, we need the following changes in external/sepolicy: - /system/bin/logcat needs its own type so that it can be used as an entrypoint for the goldfish-logcat service. A neverallow rule prevents us from allowing entrypoint to any type not in exec_type. - The config. and dalvik. property namespaces need to be labeled with something other than default_prop so that the qemu-props service can set them. A neverallow rule prevents us from allowing qemu-props to set default_prop. We allow rx_file_perms to logcat_exec for any domain that was previously allowed read_logd() as many programs will read the logs by running logcat. We do not do this for all domains as it would violate a neverallow rule on the kernel domain executing any file without transitioning to another domain, and as we ultimately want to apply the same restriction to the init domain (and possibly others). Change-Id: Idce1fb5ed9680af84788ae69a5ace684c6663974 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-09-04 14:44:49 +02:00
# These properties are not normally set by processes other than init.
# They are only distinguished here for setting by qemu-props on the
# emulator/goldfish.
config. u:object_r:config_prop:s0
Remove special case handling of "ro." properties Currently, properties that begin with "ro." are special cased to skip over the "ro." part of the prefix before matching with entries in property_contexts. A change to init is removing this special case and therefore, the "ro." prefixes must be explicitly added to property_contexts. Bug 26425619 Change-Id: I343f139a39abef99924e84e0d27699284f335d63
2016-01-11 22:06:25 +01:00
ro.config. u:object_r:config_prop:s0
Dependencies for new goldfish service domains. In order to support the new goldfish service domains in a change with the same Change-Id for the build project, we need the following changes in external/sepolicy: - /system/bin/logcat needs its own type so that it can be used as an entrypoint for the goldfish-logcat service. A neverallow rule prevents us from allowing entrypoint to any type not in exec_type. - The config. and dalvik. property namespaces need to be labeled with something other than default_prop so that the qemu-props service can set them. A neverallow rule prevents us from allowing qemu-props to set default_prop. We allow rx_file_perms to logcat_exec for any domain that was previously allowed read_logd() as many programs will read the logs by running logcat. We do not do this for all domains as it would violate a neverallow rule on the kernel domain executing any file without transitioning to another domain, and as we ultimately want to apply the same restriction to the init domain (and possibly others). Change-Id: Idce1fb5ed9680af84788ae69a5ace684c6663974 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-09-04 14:44:49 +02:00
dalvik. u:object_r:dalvik_prop:s0
Remove special case handling of "ro." properties Currently, properties that begin with "ro." are special cased to skip over the "ro." part of the prefix before matching with entries in property_contexts. A change to init is removing this special case and therefore, the "ro." prefixes must be explicitly added to property_contexts. Bug 26425619 Change-Id: I343f139a39abef99924e84e0d27699284f335d63
2016-01-11 22:06:25 +01:00
ro.dalvik. u:object_r:dalvik_prop:s0
Separate permissions to set WiFi related properties wificond would like to be able to set WiFi related properties without access to the rest of the system properties. Today, this only involves marking the driver as loaded or unloaded. avc: denied { write } for name="property_service" dev="tmpfs" ino=10100 scontext=u:r:wificond:s0 tcontext=u:object_r:property_socket:s0 tclass=sock_file permissive=0 Bug: 29579539 Test: No avc denials related to system properties across various WiFi events. Change-Id: I6d9f1de3fbef04cb7750cc3753634f9e02fdb71f (cherry picked from commit 1ebfdd6a14fb21705664c8e144f151b39c3d73f8)
2016-06-29 20:28:20 +02:00
Revert^2 "Add qemu.hw.mainkeys to system property_contexts" 509b35e5d9b72f725d17fab35ecb11b9b706a399 Bug: 180412668 Merged-In: I4067bba36613fa41e3c7a085da76cda4784753ad Change-Id: I4067bba36613fa41e3c7a085da76cda4784753ad
2021-02-17 18:54:30 +01:00
# qemu_hw_prop is read/written by both system and vendor.
[Bug Fix] Add `exact string` to property qemu.hw.mainkeys qemu.hw.mainkeys exists both in plat_property_contexts and vendor_property_contexts. This would cause breakage in GSI build for certain vendors. To fix, add `exact {type}` to make the property defined in system takes precedence. Bug: 180412668 Signed-off-by: Weilun Du <wdu@google.com> Change-Id: I1268e6a202d561a1e43f3d71fb38c6000042306b
2021-03-19 18:36:56 +01:00
qemu.hw.mainkeys u:object_r:qemu_hw_prop:s0 exact string
Revert^2 "Add qemu.hw.mainkeys to system property_contexts" 509b35e5d9b72f725d17fab35ecb11b9b706a399 Bug: 180412668 Merged-In: I4067bba36613fa41e3c7a085da76cda4784753ad Change-Id: I4067bba36613fa41e3c7a085da76cda4784753ad
2021-02-17 18:54:30 +01:00
Move qemu.sf.lcd_density into system/sepolicy qemu.sf.lcd_density is rerefenced by surfaceflinger and zygote. Bug: 178144237 Test: presubmit Signed-off-by: Roman Kiryanov <rkir@google.com> Change-Id: Iede75d1170aeac9d020d60a3a66a1f69cee46abf Merged-In: Iede75d1170aeac9d020d60a3a66a1f69cee46abf
2021-02-24 00:08:56 +01:00
# qemu_sf_lcd_density_prop is read/written by both system and vendor.
qemu.sf.lcd_density u:object_r:qemu_sf_lcd_density_prop:s0 exact int
Separate permissions to set WiFi related properties wificond would like to be able to set WiFi related properties without access to the rest of the system properties. Today, this only involves marking the driver as loaded or unloaded. avc: denied { write } for name="property_service" dev="tmpfs" ino=10100 scontext=u:r:wificond:s0 tcontext=u:object_r:property_socket:s0 tclass=sock_file permissive=0 Bug: 29579539 Test: No avc denials related to system properties across various WiFi events. Change-Id: I6d9f1de3fbef04cb7750cc3753634f9e02fdb71f (cherry picked from commit 1ebfdd6a14fb21705664c8e144f151b39c3d73f8)
2016-06-29 20:28:20 +02:00
# Shared between system server and wificond
sepolicy: Relabel wifi. properties as wifi_prop * These properties are used by the wifi hal and it works as expected on devices with compatible property. However, on devices without compatible property, these prperties are labeled as "default_prop" because public/property_contexts is not used. Thus they can't be set by the hal. * To tackle the problem, label them as "wifi_prop" in private/property_contexts which also works on devices without compatible property. The label will be overridden later by public/property_contexts rules if exist. Change-Id: If8b8bd5bea64f2ea08864cc62f6dc405cb394e00
2019-12-29 16:17:07 +01:00
wifi. u:object_r:wifi_prop:s0
Separate permissions to set WiFi related properties wificond would like to be able to set WiFi related properties without access to the rest of the system properties. Today, this only involves marking the driver as loaded or unloaded. avc: denied { write } for name="property_service" dev="tmpfs" ino=10100 scontext=u:r:wificond:s0 tcontext=u:object_r:property_socket:s0 tclass=sock_file permissive=0 Bug: 29579539 Test: No avc denials related to system properties across various WiFi events. Change-Id: I6d9f1de3fbef04cb7750cc3753634f9e02fdb71f (cherry picked from commit 1ebfdd6a14fb21705664c8e144f151b39c3d73f8)
2016-06-29 20:28:20 +02:00
wlan. u:object_r:wifi_prop:s0
sepolicy: allow hwservicemanager to set properties Allow hwservicemanager to set properties starting with the prefix "hwservicemanager." b/31458381 b/31240290 Test: passing build and runtime tests Change-Id: Id92e2170f52893bbf236987ee59383df2264952f Signed-off-by: Iliyan Malchev <malchev@google.com>
2016-09-20 00:23:41 +02:00
Sync internal master and AOSP sepolicy. Bug: 37916906 Test: Builds 'n' boots. Change-Id: Ia1d86264446ebecc1ca79f32f11354921bc77668 Merged-In: I208ec6a864127a059fb389417a9c6b259d7474cb
2017-09-26 21:58:29 +02:00
# Lowpan properties
lowpan. u:object_r:lowpan_prop:s0
ro.lowpan. u:object_r:lowpan_prop:s0
Property to enable heap profile from process startup. This is world-readable so it can be checked in libc's process init. Test: m Test: flash sailfish Bug: 117821125 Change-Id: Iac7317ceb75b5ad9cfb9adabdf16929263fa8a9d
2018-11-08 14:58:13 +01:00
# heapprofd properties
heapprofd. u:object_r:heapprofd_prop:s0
sepolicy: allow hwservicemanager to set properties Allow hwservicemanager to set properties starting with the prefix "hwservicemanager." b/31458381 b/31240290 Test: passing build and runtime tests Change-Id: Id92e2170f52893bbf236987ee59383df2264952f Signed-off-by: Iliyan Malchev <malchev@google.com>
2016-09-20 00:23:41 +02:00
# hwservicemanager properties
hwservicemanager. u:object_r:hwservicemanager_prop:s0
Whitelist exported platform properties This CL lists all the exported platform properties in private/exported_property_contexts. Additionally accessing core_property_type from vendor components is restricted. Instead public_readable_property_type is used to allow vendor components to read exported platform properties, and accessibility from vendor_init is also specified explicitly. Note that whitelisting would be applied only if PRODUCT_COMPATIBLE_PROPERTY is set on. Bug: 38146102 Test: tested on walleye with PRODUCT_COMPATIBLE_PROPERTY=true Change-Id: I304ba428cc4ca82668fec2ddeb17c971e7ec065e
2017-10-19 09:54:49 +02:00
Correct labels on files / props in odm_dlkm. All files under odm_dlkm are tagged vendor_file. All build props for odm_dlkm are mapped as build_vendor_prop. Test: build and `ls /odm_dlkm -lZ` `adb shell getprop -Z | grep odm_dlkm` Bug: 154633114 Change-Id: Ifca69d0b7a8da945910a9cb0fa907735cd866f12
2020-07-16 02:11:17 +02:00
# Common default properties for vendor, odm, vendor_dlkm, and odm_dlkm.
Add default namespaces of odm properties Since /odm is an extension of /vendor, its default property contexts should be consistent with ones of /vendor. Bug: 36796459 Test: tested on wahoo devices Change-Id: Ia67ebe81e9c7102aab35a34f14738ed9a24811d3
2018-01-18 05:25:28 +01:00
init.svc.odm. u:object_r:vendor_default_prop:s0
Whitelist exported platform properties This CL lists all the exported platform properties in private/exported_property_contexts. Additionally accessing core_property_type from vendor components is restricted. Instead public_readable_property_type is used to allow vendor components to read exported platform properties, and accessibility from vendor_init is also specified explicitly. Note that whitelisting would be applied only if PRODUCT_COMPATIBLE_PROPERTY is set on. Bug: 38146102 Test: tested on walleye with PRODUCT_COMPATIBLE_PROPERTY=true Change-Id: I304ba428cc4ca82668fec2ddeb17c971e7ec065e
2017-10-19 09:54:49 +02:00
init.svc.vendor. u:object_r:vendor_default_prop:s0
ro.hardware. u:object_r:vendor_default_prop:s0
Add default namespaces of odm properties Since /odm is an extension of /vendor, its default property contexts should be consistent with ones of /vendor. Bug: 36796459 Test: tested on wahoo devices Change-Id: Ia67ebe81e9c7102aab35a34f14738ed9a24811d3
2018-01-18 05:25:28 +01:00
ro.odm. u:object_r:vendor_default_prop:s0
Whitelist exported platform properties This CL lists all the exported platform properties in private/exported_property_contexts. Additionally accessing core_property_type from vendor components is restricted. Instead public_readable_property_type is used to allow vendor components to read exported platform properties, and accessibility from vendor_init is also specified explicitly. Note that whitelisting would be applied only if PRODUCT_COMPATIBLE_PROPERTY is set on. Bug: 38146102 Test: tested on walleye with PRODUCT_COMPATIBLE_PROPERTY=true Change-Id: I304ba428cc4ca82668fec2ddeb17c971e7ec065e
2017-10-19 09:54:49 +02:00
ro.vendor. u:object_r:vendor_default_prop:s0
Correct labels on files / props in vendor_dlkm. All files under vendor_dlkm are tagged vendor_file. All build props for vendor_dlkm are mapped as build_vendor_prop. Test: build and `ls /vendor_dlkm -lZ` `adb shell getprop -Z | grep vendor_dlkm` Bug: 154633114 Change-Id: Ie9dc26d948357767fec09aca645606310ad3425c
2020-05-14 05:44:19 +02:00
ro.vendor_dlkm. u:object_r:vendor_default_prop:s0
Correct labels on files / props in odm_dlkm. All files under odm_dlkm are tagged vendor_file. All build props for odm_dlkm are mapped as build_vendor_prop. Test: build and `ls /odm_dlkm -lZ` `adb shell getprop -Z | grep odm_dlkm` Bug: 154633114 Change-Id: Ifca69d0b7a8da945910a9cb0fa907735cd866f12
2020-07-16 02:11:17 +02:00
ro.odm_dlkm. u:object_r:vendor_default_prop:s0
Add default namespaces of odm properties Since /odm is an extension of /vendor, its default property contexts should be consistent with ones of /vendor. Bug: 36796459 Test: tested on wahoo devices Change-Id: Ia67ebe81e9c7102aab35a34f14738ed9a24811d3
2018-01-18 05:25:28 +01:00
odm. u:object_r:vendor_default_prop:s0
persist.odm. u:object_r:vendor_default_prop:s0
Whitelist exported platform properties This CL lists all the exported platform properties in private/exported_property_contexts. Additionally accessing core_property_type from vendor components is restricted. Instead public_readable_property_type is used to allow vendor components to read exported platform properties, and accessibility from vendor_init is also specified explicitly. Note that whitelisting would be applied only if PRODUCT_COMPATIBLE_PROPERTY is set on. Bug: 38146102 Test: tested on walleye with PRODUCT_COMPATIBLE_PROPERTY=true Change-Id: I304ba428cc4ca82668fec2ddeb17c971e7ec065e
2017-10-19 09:54:49 +02:00
persist.vendor. u:object_r:vendor_default_prop:s0
vendor. u:object_r:vendor_default_prop:s0
Add label for time (zone) system properties This adds a label for system properties that will affect system-wide time / time detection logic. The first example will be something like: persist.time.detection_impl_version Bug: 78217059 Test: build Change-Id: I46044f1e28170760001da9acf2496a1e3037e48a
2018-06-25 16:36:51 +02:00
# Properties that relate to time / time zone detection behavior.
persist.time. u:object_r:time_prop:s0
sepolicy for server configurable flags Test: manual on device Change-Id: Ibafe1b345489c88a49a7ed3e2e61e5cc5e1880a1
2018-10-26 05:09:55 +02:00
# Properties that relate to server configurable flags
Sort device_config property context rules Clean up, no functionality change. Test: TreeHugger Change-Id: I5069bb224f22a34bafc4040eaf60ff095f8c3ed6
2020-10-27 11:57:42 +01:00
device_config.reset_performed u:object_r:device_config_reset_performed_prop:s0
Update sepolicy with new native boot flag for activity_manager Whitelist the persistent system properties that will be used as flags in activity manager experiments. Bug: 120794810 Test: m, flash, test getting flag value in ActivityManagerService.java Change-Id: I90a10bc87d6db3a64347b62fd02e6f0b12ac9fa8
2019-01-17 22:30:05 +01:00
persist.device_config.activity_manager_native_boot. u:object_r:device_config_activity_manager_native_boot_prop:s0
Sort device_config property context rules Clean up, no functionality change. Test: TreeHugger Change-Id: I5069bb224f22a34bafc4040eaf60ff095f8c3ed6
2020-10-27 11:57:42 +01:00
persist.device_config.attempted_boot_count u:object_r:device_config_boot_count_prop:s0
persist.device_config.configuration. u:object_r:device_config_configuration_prop:s0
Allow connectivity namespace to enable native level access flags. Follow the steps: go/android-native-flag-api-manual Bug: 179099277 Test: m -j Test: manually verify connection to wifi after flash Change-Id: Ieb5355d40aec9ed7a42b7ae5b250b696fcf00810
2021-02-02 11:27:38 +01:00
persist.device_config.connectivity. u:object_r:device_config_connectivity_prop:s0
Sort device_config property context rules Clean up, no functionality change. Test: TreeHugger Change-Id: I5069bb224f22a34bafc4040eaf60ff095f8c3ed6
2020-10-27 11:57:42 +01:00
persist.device_config.input_native_boot. u:object_r:device_config_input_native_boot_prop:s0
persist.device_config.media_native. u:object_r:device_config_media_native_prop:s0
persist.device_config.netd_native. u:object_r:device_config_netd_native_prop:s0
persist.device_config.profcollect_native_boot. u:object_r:device_config_profcollect_native_boot_prop:s0
persist.device_config.runtime_native. u:object_r:device_config_runtime_native_prop:s0
persist.device_config.runtime_native_boot. u:object_r:device_config_runtime_native_boot_prop:s0
Selinux changes for statsd flags Test: manually verified statsd can get values using GetServerConfigurableFlag Bug: 172842175 Change-Id: I05cb2242dc758e32a22ddf30cb6f09088b70f5d4
2020-11-18 04:26:23 +01:00
persist.device_config.statsd_native. u:object_r:device_config_statsd_native_prop:s0
persist.device_config.statsd_native_boot. u:object_r:device_config_statsd_native_boot_prop:s0
Sort device_config property context rules Clean up, no functionality change. Test: TreeHugger Change-Id: I5069bb224f22a34bafc4040eaf60ff095f8c3ed6
2020-10-27 11:57:42 +01:00
persist.device_config.storage_native_boot. u:object_r:device_config_storage_native_boot_prop:s0
Add sepolicy swcodec native flag namespace. Test: add sepolicy, build, check GetServerConfigurableFlag function Bug: 179286276 Change-Id: Ia16d110900251b3fb3e3959d73524c8814199270
2021-02-11 18:12:51 +01:00
persist.device_config.swcodec_native. u:object_r:device_config_swcodec_native_prop:s0
Sort device_config property context rules Clean up, no functionality change. Test: TreeHugger Change-Id: I5069bb224f22a34bafc4040eaf60ff095f8c3ed6
2020-10-27 11:57:42 +01:00
persist.device_config.window_manager_native_boot. u:object_r:device_config_window_manager_native_boot_prop:s0
apexd_prop is defined for PRODUCT_COMPATIBLE_PROPERTY = false case apexd_prop is also defined in private/propery_contexts in order to make the type to exist even when PRODUCT_COMPATIBLE_PROPERTY is false (i.e., Pixel 1). Bug: 119220815 Test: m plat_property_contexts for sailfish the built plat_property_contexts has apexd_prop defined Change-Id: I9ef71410533c1f64fc6a3112cfcb199d23aaf3db
2018-11-08 03:24:34 +01:00
Sepolicy for mm_events Allow mm_events to periodically arm the mm_events perfetto trace config if mm_events is enabled. Bug: 183037386 Test: boot; setprop persist.mm_events.enabled true; No avc denials Change-Id: Ia9760001e7fb591f18e3e816a63281167a658c74
2021-03-16 19:30:36 +01:00
# MM Events config props
persist.mm_events.enabled u:object_r:mm_events_config_prop:s0 exact bool
Re-add sys_traced prop Add permissions for: persist.device_config.global_settings.sys_traced Bug: b/71737179 Test: As follows: patch aosp/891475 patch aosp/891853 patch ag/6224352 $ adb shell walleye:/ $ ps -A | grep traced nobody 1135 1 52288 2200 0 0 S traced nobody 1136 1 52288 2256 0 0 S traced_probes walleye:/ $ settings put global sys_traced 0 walleye:/ $ ps -A | grep traced 1|walleye:/ $ walleye:/ $ settings put global sys_traced 1 1|walleye:/ $ ps -A | grep traced nobody 12386 1 52288 2208 0 0 S traced nobody 12387 1 52288 2248 0 0 S traced_probes Change-Id: I8898672c8fdc9c5d87a31b90f6c7d5c03bef78ed
2019-04-05 17:41:30 +02:00
# Properties that relate to legacy server configurable flags
persist.device_config.global_settings.sys_traced u:object_r:device_config_sys_traced_prop:s0
apexd_prop is defined for PRODUCT_COMPATIBLE_PROPERTY = false case apexd_prop is also defined in private/propery_contexts in order to make the type to exist even when PRODUCT_COMPATIBLE_PROPERTY is false (i.e., Pixel 1). Bug: 119220815 Test: m plat_property_contexts for sailfish the built plat_property_contexts has apexd_prop defined Change-Id: I9ef71410533c1f64fc6a3112cfcb199d23aaf3db
2018-11-08 03:24:34 +01:00
apexd. u:object_r:apexd_prop:s0
Add apexd_config_prop type This type is used for properties that provides per-device configuration for apexd behaviour (so far - timeouts for creating/deleting dm device). Test: builds Bug: 182296338 Change-Id: Ib815f081d3ab94aa8c941ac68b57ebe661acedb9
2021-03-13 02:35:51 +01:00
apexd.config.dm_delete.timeout u:object_r:apexd_config_prop:s0 exact uint
apexd.config.dm_create.timeout u:object_r:apexd_config_prop:s0 exact uint
Add persist.apexd. property context. For persistent properties related to apexd. Bug: 121302351 Test: apexd can get the prop Change-Id: Id9fd25923385188f46a9804155168c52f6b1187e
2019-01-09 12:04:03 +01:00
persist.apexd. u:object_r:apexd_prop:s0
Add permissions for bpf.progs_loaded property Change-Id: If4e550e4186415c5a1088bb53b0755b69f92560a Signed-off-by: Joel Fernandes <joelaf@google.com>
2019-01-11 14:32:45 +01:00
bpf.progs_loaded u:object_r:bpf_progs_loaded_prop:s0
Add sepolicy for gsid properties, and allow system_server to read them. Bug: 123777418 Test: manual test Change-Id: I9f8c721dfd074e638573d85cf1d8045a69c3854e
2019-02-07 22:14:20 +01:00
gsid. u:object_r:gsid_prop:s0
ro.gsid. u:object_r:gsid_prop:s0
NNAPI property to disable extensions use on GSI/AOSP product partition. Property is NNAPI client-readable and writeable only by init/build.prop. Bug: 129666983 Bug: 120483623 Test: flashed crosshatch/Cts tests for NNAPI Change-Id: Ic4c0f176440610a2c54c078863f3d5382323cc65
2019-04-02 16:34:16 +02:00
# Property for disabling NNAPI vendor extensions on product image (used on GSI /product image,
# which can't use NNAPI vendor extensions).
ro.nnapi.extensions.deny_on_product u:object_r:nnapi_ext_deny_product_prop:s0
Use a property instead of file to communicate cold boot done Ueventd can't set properties currently, but this is an artificial limitation, since ueventd communicates to init that it has finished cold boot via a file, and init polls this file instead of returning to the epoll loop, where properties are handled. A related change replaces that file with a property and thus frees ueventd to be able to set properties. This change creates the cold_boot_done property type for this property and gives only ueventd permissions to set it. Bug: 62301678 Test: boot, check that properties are set Change-Id: I40843b423b192ea841db6a82f648e5bab9738e0e
2019-06-18 18:53:51 +02:00
# Property that is set once ueventd finishes cold boot.
ro.cold_boot_done u:object_r:cold_boot_done_prop:s0
Allow charger to read ro.charger.* Allow charger to read system properties with this prefix so that charger's behavior is controlled by runtime. Test: run offline charging on walleye Bug: 124118169 Change-Id: I4266b2d043a5323b4adbd1636ada46b7e08ca667
2019-07-08 19:57:46 +02:00
Permit dropping caches from the shell through sys.drop_caches. * Permits setting the sys.drop_caches property from shell. * Permits init to read and write to the drop_caches file. * Can only be set to 3 (drop_caches) and 0 (unset). Bug: 178647679 Test: flashed user build and set property; no avc denials. Test: flashed userdebug build and dropped caches w/o root. Change-Id: Idcedf83f14f6299fab383f042829d8d548fb4f5d
2021-02-11 03:45:35 +01:00
# Properties that control performance operations.
# Leave space to later set drop_caches to 1, 2, and 4.
perf.drop_caches u:object_r:perf_drop_caches_prop:s0 exact enum 0 3
Allow charger to read ro.charger.* Allow charger to read system properties with this prefix so that charger's behavior is controlled by runtime. Test: run offline charging on walleye Bug: 124118169 Change-Id: I4266b2d043a5323b4adbd1636ada46b7e08ca667
2019-07-08 19:57:46 +02:00
# Charger properties
Add charger related property contexts ro.enable_boot_charger_mode and sys.boot_from_charger_mode are moved to new property contexts for charger props to remove exported*_prop. Bug: 155844385 Test: boot device with ro.enable_boot_charger_mode Change-Id: I17d195d3c9c002a42125d46a5efcdb890f1c2a5c
2020-07-10 07:15:15 +02:00
ro.charger. u:object_r:charger_prop:s0
sys.boot_from_charger_mode u:object_r:charger_status_prop:s0 exact int
ro.enable_boot_charger_mode u:object_r:charger_config_prop:s0 exact bool
Allow update_engine to read virtual ab feature flag. Test: adb shell getprop -Z [the two flags] Bug: 135752105 Change-Id: I3e0372e969ea0161787c32560a8c40fed2953619
2019-07-25 22:28:19 +02:00
# Virtual A/B properties
Grant gmscore permission to read virtual ab properties Bug: 168059475 Test: Serve an update over gmscore Change-Id: Iefd88f4189b50ee68ee09bcb5a20556ba4ea3e1a
2020-09-09 15:22:39 +02:00
ro.virtual_ab.enabled u:object_r:virtual_ab_prop:s0 exact bool
ro.virtual_ab.retrofit u:object_r:virtual_ab_prop:s0 exact bool
Add sepolicy for the new Virtual A/B feature flag. ro.virtual_ab.compression.enabled is the flag gating Virtual A/B compression-related features. Bug: 168257347 Test: adb shell getprop Change-Id: Ied0bda0f3ea963e9d4010adf36ed0dfaf0b97d1c
2020-09-12 00:09:35 +02:00
ro.virtual_ab.compression.enabled u:object_r:virtual_ab_prop:s0 exact bool
Add a new context for property ota.warm_reset The property is set to inform kernel to do a warm_reset on the next reboot. This is useful to persist the logs to debug device boot failures. More details in http://go/rvc-ota-persist-logs. The property is set to 1 by update_engine after an OTA. And it's set to 0 by update_verifier or vold after we mark the current slot boot successful. The property is read by vendor_init. And according to its value, vendor_init writes a particular sysfs file to schedule a warm reset on the following reboot. Without the new context, the denial message says: [ 13.423163] audit: type=1107 audit(1746393.166:8): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=u:r:init:s0 msg='avc: denied { read } for property=ota.warm_reset pid=0 uid=0 gid=0 scontext=u:r:vendor_init:s0 tcontext=u:object_r:default_prop:s0 tclass=file permissive=0' [ 23.096497] init: Unable to set property 'OTA.warm_reset' from uid:0 gid:2001 pid:841: SELinux permission check failed [ 23.096574] type=1107 audit(1573768000.668:42): uid=0 auid=4294967295 ses=4294967295 subj=u:r:init:s0 msg='avc: denied { set } for property=OTA.warm_reset pid=841 uid=0 gid=2001 scontext=u:r:update_verifier:s0 tcontext=u:object_r:default_prop:s0 tclass=property_service permissive=0' [ 23.108430] update_verifier: Failed to reset the warm reset flag Bug: 143489994 Test: check the property can be set by update_engine, and read by vendor_init Change-Id: I87c12a53a138b72ecfed3ab6a4d846c20f5a8484
2019-11-14 23:18:40 +01:00
Add secontext for ro.product.ab_ota_partitions Bug: 162148770 Test: build Change-Id: Iff509cb573462718b876db02f88a3d4a21667267
2020-07-29 07:35:21 +02:00
ro.product.ab_ota_partitions u:object_r:ota_prop:s0 exact string
Add a new context for property ota.warm_reset The property is set to inform kernel to do a warm_reset on the next reboot. This is useful to persist the logs to debug device boot failures. More details in http://go/rvc-ota-persist-logs. The property is set to 1 by update_engine after an OTA. And it's set to 0 by update_verifier or vold after we mark the current slot boot successful. The property is read by vendor_init. And according to its value, vendor_init writes a particular sysfs file to schedule a warm reset on the following reboot. Without the new context, the denial message says: [ 13.423163] audit: type=1107 audit(1746393.166:8): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=u:r:init:s0 msg='avc: denied { read } for property=ota.warm_reset pid=0 uid=0 gid=0 scontext=u:r:vendor_init:s0 tcontext=u:object_r:default_prop:s0 tclass=file permissive=0' [ 23.096497] init: Unable to set property 'OTA.warm_reset' from uid:0 gid:2001 pid:841: SELinux permission check failed [ 23.096574] type=1107 audit(1573768000.668:42): uid=0 auid=4294967295 ses=4294967295 subj=u:r:init:s0 msg='avc: denied { set } for property=OTA.warm_reset pid=841 uid=0 gid=2001 scontext=u:r:update_verifier:s0 tcontext=u:object_r:default_prop:s0 tclass=property_service permissive=0' [ 23.108430] update_verifier: Failed to reset the warm reset flag Bug: 143489994 Test: check the property can be set by update_engine, and read by vendor_init Change-Id: I87c12a53a138b72ecfed3ab6a4d846c20f5a8484
2019-11-14 23:18:40 +01:00
# Property to set/clear the warm reset flag after an OTA update.
ota.warm_reset u:object_r:ota_prop:s0
Give ota.other.vbmeta_digest the proper context Give it the u:object_r:ota_prop:s0 since the prop is only set after an update. Bug: 177625570 Test: boot the device, check the prop is written by update_engine Change-Id: I4cf21d2a6af2a2083d4a5eba7751011cc6d0c522
2021-02-18 00:01:35 +01:00
# The vbmeta digest for the inactive slot. It can be set after installing
# ota updates to the b partition of a/b devices.
ota.other.vbmeta_digest u:object_r:ota_prop:s0 exact string
Add sepolicy for sdkext module prop Add a domain for derive_sdk which is allowed to set persist.com.android.sdkext.sdk_info, readable by all apps (but should only be read by the BCP). Bug: 137191822 Test: run derive_sdk, getprop persist.com.android.sdkext.sdk_info Change-Id: I389116f45faad11fa5baa8d617dda30fb9acec7a
2019-11-25 14:10:10 +01:00
# Module properties
Rename sdkext sepolicy to sdkextensions The module is getting renamed, so rename all the policy relating to it at the same time. Bug: 137191822 Test: presubmit Change-Id: Ia9d966ca9884ce068bd96cf5734e4a459158c85b Merged-In: Ia9d966ca9884ce068bd96cf5734e4a459158c85b (cherry picked from commit 6505573c36dcc6153af37895e968400f722119ea)
2020-01-06 18:29:13 +01:00
com.android.sdkext. u:object_r:module_sdkextensions_prop:s0
persist.com.android.sdkext. u:object_r:module_sdkextensions_prop:s0
Add userspace_reboot_log_prop This properties are used to compute UserspaceRebootAtom and are going to be written by system_server. Also removed now unused userspace_reboot_prop. Test: builds Bug: 148767783 Change-Id: Iee44b4ca9f5d3913ac71b2ac6959c232f060f0ed
2020-02-07 01:10:29 +01:00
Add selinux policy for the new net.464xlat.cellular.enabled prop. This property is written by an .rc file - see aosp/1553819 - and read by the connectivity mainline code in the system server. Test: m Bug: 182333299 Change-Id: Ibac622f6a31c075b64387aadb201ad6cdd618ebd
2021-03-10 06:45:07 +01:00
# Connectivity module
net.464xlat.cellular.enabled u:object_r:net_464xlat_fromvendor_prop:s0 exact bool
Properly set the property_context for net.tcp_init_rwnd. This property is many years old and it does not have a property context associated with it. It is set by the system server (in particular, ConnectivityService code, in the Tethering module) and read by init, which does: on property:net.tcp_def_init_rwnd=* write /proc/sys/net/ipv4/tcp_default_init_rwnd ${net.tcp_def_init_rwnd} There is no need to add read access to init because init can read and write any property. Test: m Fix: 170917042 Change-Id: I594b09656a094cd2ef3e4fd9703e46bf7b2edd4c
2021-03-10 07:31:36 +01:00
net.tcp_def_init_rwnd u:object_r:net_connectivity_prop:s0 exact int
Add selinux policy for the new net.464xlat.cellular.enabled prop. This property is written by an .rc file - see aosp/1553819 - and read by the connectivity mainline code in the system server. Test: m Bug: 182333299 Change-Id: Ibac622f6a31c075b64387aadb201ad6cdd618ebd
2021-03-10 06:45:07 +01:00
Add userspace_reboot_log_prop This properties are used to compute UserspaceRebootAtom and are going to be written by system_server. Also removed now unused userspace_reboot_prop. Test: builds Bug: 148767783 Change-Id: Iee44b4ca9f5d3913ac71b2ac6959c232f060f0ed
2020-02-07 01:10:29 +01:00
# Userspace reboot properties
sys.userspace_reboot.log. u:object_r:userspace_reboot_log_prop:s0
persist.sys.userspace_reboot.log. u:object_r:userspace_reboot_log_prop:s0
selinux policy for buffer queue config Test: boot and check for no policy violations Change-Id: I1ea2a79b9a45b503dcb061c196c5af1d0ddab653
2020-01-20 06:11:07 +01:00
# Integer property which is used in libgui to configure the number of frames
# tracked by buffer queue's frame event timing history. The property is set
# by devices with video decoding pipelines long enough to overflow the default
# history size.
ro.lib_gui.frame_event_history_size u:object_r:bq_config_prop:s0
Merge public/property_contexts into private Originally public/property_contexts was introduced to create a whitelist of system properties which can be accessed from vendor, and to be used from VTS to ensure that the whitelist isn't modified. But it doesn't fit well on sepolicy public/private split as the split isn't for stability, but for letting vendor compile their sepolicy with public types. Also it doesn't make sense only to check the whitelist on VTS, because platform internal ones must also be unchanged. This commit merges public/property_contexts into private as before. This gives consistency with other context files such as file_contexts which are already containing entries for vendor but are only defined in private. This also simplifies property_contexts as there will be only one property_contexts file. Another benefit is that VTS will check all entries defined by system, not only exported ones. Bug: 150331497 Test: m && run VtsTrebleSysProp manually Change-Id: Ib9429e27b645ef21a36946fbaea069a718c3c6eb Merged-In: Ib9429e27b645ef21a36946fbaea069a718c3c6eb (cherry picked from commit 31391fa78e5da1ed29d5bccd4d46165b69adcbfb)
2020-03-09 11:48:37 +01:00
sepolicy: Give access to ahal to flinger standby prop Allow Vendor Audio HAL to update Audio Flinger standby idle timeout. Bug: 181967247 Change-Id: I7ae992bde5fdcf81ce2ca7a5a93e5e70aab1b56c
2021-03-31 03:54:32 +02:00
af.fast_track_multiplier u:object_r:audio_config_prop:s0 exact int
ro.af.client_heap_size_kbyte u:object_r:audio_config_prop:s0 exact int
ro.audio.flinger_standbytime_ms u:object_r:audio_config_prop:s0 exact int
Merge public/property_contexts into private Originally public/property_contexts was introduced to create a whitelist of system properties which can be accessed from vendor, and to be used from VTS to ensure that the whitelist isn't modified. But it doesn't fit well on sepolicy public/private split as the split isn't for stability, but for letting vendor compile their sepolicy with public types. Also it doesn't make sense only to check the whitelist on VTS, because platform internal ones must also be unchanged. This commit merges public/property_contexts into private as before. This gives consistency with other context files such as file_contexts which are already containing entries for vendor but are only defined in private. This also simplifies property_contexts as there will be only one property_contexts file. Another benefit is that VTS will check all entries defined by system, not only exported ones. Bug: 150331497 Test: m && run VtsTrebleSysProp manually Change-Id: Ib9429e27b645ef21a36946fbaea069a718c3c6eb Merged-In: Ib9429e27b645ef21a36946fbaea069a718c3c6eb (cherry picked from commit 31391fa78e5da1ed29d5bccd4d46165b69adcbfb)
2020-03-09 11:48:37 +01:00
Move audio config props to audio_config_prop Bug: 155844385 Test: sepolicy_tests Change-Id: Ic199925b5e3e1c80f1e692c8c5fc2cbb73eda0f5
2020-05-06 12:17:42 +02:00
audio.camerasound.force u:object_r:audio_config_prop:s0 exact bool
audio.deep_buffer.media u:object_r:audio_config_prop:s0 exact bool
audio.offload.video u:object_r:audio_config_prop:s0 exact bool
audio.offload.min.duration.secs u:object_r:audio_config_prop:s0 exact int
Merge public/property_contexts into private Originally public/property_contexts was introduced to create a whitelist of system properties which can be accessed from vendor, and to be used from VTS to ensure that the whitelist isn't modified. But it doesn't fit well on sepolicy public/private split as the split isn't for stability, but for letting vendor compile their sepolicy with public types. Also it doesn't make sense only to check the whitelist on VTS, because platform internal ones must also be unchanged. This commit merges public/property_contexts into private as before. This gives consistency with other context files such as file_contexts which are already containing entries for vendor but are only defined in private. This also simplifies property_contexts as there will be only one property_contexts file. Another benefit is that VTS will check all entries defined by system, not only exported ones. Bug: 150331497 Test: m && run VtsTrebleSysProp manually Change-Id: Ib9429e27b645ef21a36946fbaea069a718c3c6eb Merged-In: Ib9429e27b645ef21a36946fbaea069a718c3c6eb (cherry picked from commit 31391fa78e5da1ed29d5bccd4d46165b69adcbfb)
2020-03-09 11:48:37 +01:00
Add ro.audio.offload_wakelock to audio_config_prop Add ro.audio.offload_wakelock to audio_config_prop to allow AudioFlinger to read this property. Bug: 178789331 Test: build pass, property can be successfully set and read Signed-off-by: JJ Lee <leejj@google.com> Change-Id: I4650e03eb0a406b7531c08001adcfebe822bd75b
2021-05-10 08:11:46 +02:00
ro.audio.ignore_effects u:object_r:audio_config_prop:s0 exact bool
ro.audio.monitorRotation u:object_r:audio_config_prop:s0 exact bool
ro.audio.offload_wakelock u:object_r:audio_config_prop:s0 exact bool
Move ro.audio.* props to audio_config_prop Bug: 155844385 Test: boot, play sound and see no denials Change-Id: If457a6a1fe083d77a3387051edcf40fb12a0624c
2020-06-23 16:52:55 +02:00
Move more properties out of exported3_default_prop This is to remove exported3_default_prop. Contexts of these properties are changed. - ro.boot.wificountrycode This becomes wifi_config_prop - ro.opengles.version This becomes graphics_config_prop. Also it's read by various domains, so graphics_config_prop is now readable from coredomain. - persist.config.calibration_fac This becomes camera_calibration_prop. It's only readable by appdomain. Bug: 155844385 Test: no denials on Pixel devices Test: connect wifi Change-Id: If2b6c10fa124e29d1612a8f94ae18b223849e2a9
2020-07-20 13:26:07 +02:00
persist.config.calibration_fac u:object_r:camera_calibration_prop:s0 exact string
Move camera config props to camera_config_prop Bug: 155844385 Test: sepolicy_tests Change-Id: Iebe81d9af48e68e6499272bd5815e959f5945567
2020-05-06 17:36:05 +02:00
config.disable_cameraservice u:object_r:camera_config_prop:s0 exact bool
camera.disable_zsl_mode u:object_r:camera_config_prop:s0 exact bool
camera.fifo.disable u:object_r:camera_config_prop:s0 exact bool
ro.camera.notify_nfc u:object_r:camera_config_prop:s0 exact bool
ro.camera.enableLazyHal u:object_r:camera_config_prop:s0 exact bool
Merge public/property_contexts into private Originally public/property_contexts was introduced to create a whitelist of system properties which can be accessed from vendor, and to be used from VTS to ensure that the whitelist isn't modified. But it doesn't fit well on sepolicy public/private split as the split isn't for stability, but for letting vendor compile their sepolicy with public types. Also it doesn't make sense only to check the whitelist on VTS, because platform internal ones must also be unchanged. This commit merges public/property_contexts into private as before. This gives consistency with other context files such as file_contexts which are already containing entries for vendor but are only defined in private. This also simplifies property_contexts as there will be only one property_contexts file. Another benefit is that VTS will check all entries defined by system, not only exported ones. Bug: 150331497 Test: m && run VtsTrebleSysProp manually Change-Id: Ib9429e27b645ef21a36946fbaea069a718c3c6eb Merged-In: Ib9429e27b645ef21a36946fbaea069a718c3c6eb (cherry picked from commit 31391fa78e5da1ed29d5bccd4d46165b69adcbfb)
2020-03-09 11:48:37 +01:00
Define vendor side property "ro.camerax.extensions.enabled" Add "ro.camerax.extensions.enabled" vendor-specific property. Allow public apps to read this property. Bug: 171572972 Test: Camera CTS Change-Id: Id5fadedff6baaaebe5306100c2a054e537aa61ed
2020-11-18 23:08:41 +01:00
ro.camerax.extensions.enabled u:object_r:camerax_extensions_prop:s0 exact bool
Add missing dalvik.vm properties. Add missing properties identified by SRC=frameworks/native/cmds/installd/dexopt.cpp; \ CTX=system/sepolicy/private/property_contexts; \ for i in `grep -oE 'dalvik\.vm\.[^"]*' $SRC`; do \ grep -qF "$i " $CTX || echo "$i"; \ done Test: aosp_taimen-userdebug boots. Change-Id: I0678e0bfb1d50045ade37f504311ad39801f2135
2020-04-27 12:34:33 +02:00
# Should always_debuggable be bool? It's checked against the string "1".
dalvik.vm.always_debuggable u:object_r:dalvik_config_prop:s0 exact int
dalvik.vm.appimageformat u:object_r:dalvik_config_prop:s0 exact string
dalvik.vm.backgroundgctype u:object_r:dalvik_config_prop:s0 exact string
dalvik.vm.boot-dex2oat-cpu-set u:object_r:dalvik_config_prop:s0 exact string
dalvik.vm.boot-dex2oat-threads u:object_r:dalvik_config_prop:s0 exact int
dalvik.vm.boot-image u:object_r:dalvik_config_prop:s0 exact string
Added permissions for new dexopt flags on methods/classes percent change. Bug: 172490638 Test: Make Change-Id: Ia08895f9ccfba3b860e59d810ef67668f52c675e
2020-11-11 23:51:46 +01:00
dalvik.vm.bgdexopt.new-classes-percent u:object_r:dalvik_config_prop:s0 exact int
dalvik.vm.bgdexopt.new-methods-percent u:object_r:dalvik_config_prop:s0 exact int
Add missing dalvik.vm properties. Add missing properties identified by SRC=frameworks/native/cmds/installd/dexopt.cpp; \ CTX=system/sepolicy/private/property_contexts; \ for i in `grep -oE 'dalvik\.vm\.[^"]*' $SRC`; do \ grep -qF "$i " $CTX || echo "$i"; \ done Test: aosp_taimen-userdebug boots. Change-Id: I0678e0bfb1d50045ade37f504311ad39801f2135
2020-04-27 12:34:33 +02:00
dalvik.vm.checkjni u:object_r:dalvik_config_prop:s0 exact bool
dalvik.vm.dex2oat-Xms u:object_r:dalvik_config_prop:s0 exact string
dalvik.vm.dex2oat-Xmx u:object_r:dalvik_config_prop:s0 exact string
dalvik.vm.dex2oat-cpu-set u:object_r:dalvik_config_prop:s0 exact string
dalvik.vm.dex2oat-filter u:object_r:dalvik_config_prop:s0 exact string
dalvik.vm.dex2oat-flags u:object_r:dalvik_config_prop:s0 exact string
dalvik.vm.dex2oat-max-image-block-size u:object_r:dalvik_config_prop:s0 exact int
dalvik.vm.dex2oat-minidebuginfo u:object_r:dalvik_config_prop:s0 exact bool
dalvik.vm.dex2oat-resolve-startup-strings u:object_r:dalvik_config_prop:s0 exact bool
dalvik.vm.dex2oat-threads u:object_r:dalvik_config_prop:s0 exact int
dalvik.vm.dex2oat-updatable-bcp-packages-file u:object_r:dalvik_config_prop:s0 exact string
dalvik.vm.dex2oat-very-large u:object_r:dalvik_config_prop:s0 exact int
dalvik.vm.dex2oat-swap u:object_r:dalvik_config_prop:s0 exact bool
dalvik.vm.dex2oat64.enabled u:object_r:dalvik_config_prop:s0 exact bool
dalvik.vm.dexopt.secondary u:object_r:dalvik_config_prop:s0 exact bool
Added SELinux context for dalvik.vm.dexopt.thermal-cutoff property Test: Boot Bug: 165935246 Bug: 181795682 Change-Id: I266623fab1053ad1e058f041ccbe39880d74b768 Merged-In: I266623fab1053ad1e058f041ccbe39880d74b768
2021-05-13 02:23:49 +02:00
dalvik.vm.dexopt.thermal-cutoff u:object_r:dalvik_config_prop:s0 exact int
Add missing dalvik.vm properties. Add missing properties identified by SRC=frameworks/native/cmds/installd/dexopt.cpp; \ CTX=system/sepolicy/private/property_contexts; \ for i in `grep -oE 'dalvik\.vm\.[^"]*' $SRC`; do \ grep -qF "$i " $CTX || echo "$i"; \ done Test: aosp_taimen-userdebug boots. Change-Id: I0678e0bfb1d50045ade37f504311ad39801f2135
2020-04-27 12:34:33 +02:00
dalvik.vm.execution-mode u:object_r:dalvik_config_prop:s0 exact string
dalvik.vm.extra-opts u:object_r:dalvik_config_prop:s0 exact string
dalvik.vm.foreground-heap-growth-multiplier u:object_r:dalvik_config_prop:s0 exact string
dalvik.vm.gctype u:object_r:dalvik_config_prop:s0 exact string
dalvik.vm.heapgrowthlimit u:object_r:dalvik_config_prop:s0 exact string
dalvik.vm.heapmaxfree u:object_r:dalvik_config_prop:s0 exact string
dalvik.vm.heapminfree u:object_r:dalvik_config_prop:s0 exact string
dalvik.vm.heapsize u:object_r:dalvik_config_prop:s0 exact string
dalvik.vm.heapstartsize u:object_r:dalvik_config_prop:s0 exact string
dalvik.vm.heaptargetutilization u:object_r:dalvik_config_prop:s0 exact string
dalvik.vm.hot-startup-method-samples u:object_r:dalvik_config_prop:s0 exact int
dalvik.vm.image-dex2oat-Xms u:object_r:dalvik_config_prop:s0 exact string
dalvik.vm.image-dex2oat-Xmx u:object_r:dalvik_config_prop:s0 exact string
dalvik.vm.image-dex2oat-cpu-set u:object_r:dalvik_config_prop:s0 exact string
dalvik.vm.image-dex2oat-filter u:object_r:dalvik_config_prop:s0 exact string
dalvik.vm.image-dex2oat-flags u:object_r:dalvik_config_prop:s0 exact string
dalvik.vm.image-dex2oat-threads u:object_r:dalvik_config_prop:s0 exact int
dalvik.vm.isa.arm.features u:object_r:dalvik_config_prop:s0 exact string
dalvik.vm.isa.arm.variant u:object_r:dalvik_config_prop:s0 exact string
dalvik.vm.isa.arm64.features u:object_r:dalvik_config_prop:s0 exact string
dalvik.vm.isa.arm64.variant u:object_r:dalvik_config_prop:s0 exact string
dalvik.vm.isa.mips.features u:object_r:dalvik_config_prop:s0 exact string
dalvik.vm.isa.mips.variant u:object_r:dalvik_config_prop:s0 exact string
dalvik.vm.isa.mips64.features u:object_r:dalvik_config_prop:s0 exact string
dalvik.vm.isa.mips64.variant u:object_r:dalvik_config_prop:s0 exact string
dalvik.vm.isa.unknown.features u:object_r:dalvik_config_prop:s0 exact string
dalvik.vm.isa.unknown.variant u:object_r:dalvik_config_prop:s0 exact string
dalvik.vm.isa.x86.features u:object_r:dalvik_config_prop:s0 exact string
dalvik.vm.isa.x86.variant u:object_r:dalvik_config_prop:s0 exact string
dalvik.vm.isa.x86_64.features u:object_r:dalvik_config_prop:s0 exact string
dalvik.vm.isa.x86_64.variant u:object_r:dalvik_config_prop:s0 exact string
dalvik.vm.jitinitialsize u:object_r:dalvik_config_prop:s0 exact string
dalvik.vm.jitmaxsize u:object_r:dalvik_config_prop:s0 exact string
dalvik.vm.jitprithreadweight u:object_r:dalvik_config_prop:s0 exact int
dalvik.vm.jitthreshold u:object_r:dalvik_config_prop:s0 exact int
dalvik.vm.jittransitionweight u:object_r:dalvik_config_prop:s0 exact int
dalvik.vm.jniopts u:object_r:dalvik_config_prop:s0 exact string
dalvik.vm.lockprof.threshold u:object_r:dalvik_config_prop:s0 exact int
dalvik.vm.method-trace u:object_r:dalvik_config_prop:s0 exact bool
dalvik.vm.method-trace-file u:object_r:dalvik_config_prop:s0 exact string
dalvik.vm.method-trace-file-siz u:object_r:dalvik_config_prop:s0 exact int
dalvik.vm.method-trace-stream u:object_r:dalvik_config_prop:s0 exact bool
dalvik.vm.profilesystemserver u:object_r:dalvik_config_prop:s0 exact bool
dalvik.vm.profilebootclasspath u:object_r:dalvik_config_prop:s0 exact bool
Add profile saver properties to selinux rules Test: manual Bug: 184714236 Bug: 185979271 Change-Id: I5135e182ba26150cd917ded72d2af72c1c5b15a1
2021-05-06 02:10:59 +02:00
dalvik.vm.ps-min-save-period-ms u:object_r:dalvik_config_prop:s0 exact int
dalvik.vm.ps-resolved-classes-delay-ms u:object_r:dalvik_config_prop:s0 exact int
Add missing dalvik.vm properties. Add missing properties identified by SRC=frameworks/native/cmds/installd/dexopt.cpp; \ CTX=system/sepolicy/private/property_contexts; \ for i in `grep -oE 'dalvik\.vm\.[^"]*' $SRC`; do \ grep -qF "$i " $CTX || echo "$i"; \ done Test: aosp_taimen-userdebug boots. Change-Id: I0678e0bfb1d50045ade37f504311ad39801f2135
2020-04-27 12:34:33 +02:00
dalvik.vm.restore-dex2oat-cpu-set u:object_r:dalvik_config_prop:s0 exact string
dalvik.vm.restore-dex2oat-threads u:object_r:dalvik_config_prop:s0 exact int
dalvik.vm.usejit u:object_r:dalvik_config_prop:s0 exact bool
dalvik.vm.usejitprofiles u:object_r:dalvik_config_prop:s0 exact bool
dalvik.vm.zygote.max-boot-retry u:object_r:dalvik_config_prop:s0 exact int
Relabel various exported3_default_prop This removes bad context names "exported*_prop". Property contexts of following properties are changed. All properties are settable only by vendor-init. - ro.config.per_app_memcg This becomes lmkd_config_prop. - ro.zygote This becomes dalvik_config_prop. - ro.oem_unlock_supported This becomes oem_unlock_prop. It's readable by system_app which includes Settings apps. - ro.storage_manager.enabled This becomes storagemanagr_config_prop. It's readable by coredomain. Various domains in coredomain seem to read it. - sendbug.preferred.domain This bcomes sendbug_config_prop. It's readable by appdomain. There are still 3 more exported3_default_prop, which are going to be tracked individually. Bug: 155844385 Test: selinux denial check on Pixel devices Change-Id: I340c903ca7bda98a92d0f157c65f6833ed00df05
2020-07-16 15:25:47 +02:00
ro.zygote u:object_r:dalvik_config_prop:s0 exact string
Merge public/property_contexts into private Originally public/property_contexts was introduced to create a whitelist of system properties which can be accessed from vendor, and to be used from VTS to ensure that the whitelist isn't modified. But it doesn't fit well on sepolicy public/private split as the split isn't for stability, but for letting vendor compile their sepolicy with public types. Also it doesn't make sense only to check the whitelist on VTS, because platform internal ones must also be unchanged. This commit merges public/property_contexts into private as before. This gives consistency with other context files such as file_contexts which are already containing entries for vendor but are only defined in private. This also simplifies property_contexts as there will be only one property_contexts file. Another benefit is that VTS will check all entries defined by system, not only exported ones. Bug: 150331497 Test: m && run VtsTrebleSysProp manually Change-Id: Ib9429e27b645ef21a36946fbaea069a718c3c6eb Merged-In: Ib9429e27b645ef21a36946fbaea069a718c3c6eb (cherry picked from commit 31391fa78e5da1ed29d5bccd4d46165b69adcbfb)
2020-03-09 11:48:37 +01:00
Add new context dalvik_runtime_prop persist.sys.dalvik.vm.lib.2 is moved to a new context dalvik_runtime_prop from bad context name. Bug: 154885206 Test: boot device and see logcat Change-Id: I9dea95105c266088d5f071bf2d890048f0999b0b
2020-05-12 15:51:48 +02:00
persist.sys.dalvik.vm.lib.2 u:object_r:dalvik_runtime_prop:s0 exact string
Add keyguard_config_prop for keyguard property keyguard.no_require_sim becomes keyguard_config_prop to remove exported*_default_prop Bug: 155844385 Test: boot and see no denials Change-Id: Icffa88b650a1d35d8c1cd29f89daf0644a79ddd3
2020-07-07 05:46:24 +02:00
keyguard.no_require_sim u:object_r:keyguard_config_prop:s0 exact bool
Merge public/property_contexts into private Originally public/property_contexts was introduced to create a whitelist of system properties which can be accessed from vendor, and to be used from VTS to ensure that the whitelist isn't modified. But it doesn't fit well on sepolicy public/private split as the split isn't for stability, but for letting vendor compile their sepolicy with public types. Also it doesn't make sense only to check the whitelist on VTS, because platform internal ones must also be unchanged. This commit merges public/property_contexts into private as before. This gives consistency with other context files such as file_contexts which are already containing entries for vendor but are only defined in private. This also simplifies property_contexts as there will be only one property_contexts file. Another benefit is that VTS will check all entries defined by system, not only exported ones. Bug: 150331497 Test: m && run VtsTrebleSysProp manually Change-Id: Ib9429e27b645ef21a36946fbaea069a718c3c6eb Merged-In: Ib9429e27b645ef21a36946fbaea069a718c3c6eb (cherry picked from commit 31391fa78e5da1ed29d5bccd4d46165b69adcbfb)
2020-03-09 11:48:37 +01:00
media: add codec2_config_prop This covers properties required by codec2 hal clients/service Bug: 181380463 Change-Id: I88f87d8693fa49beda0a26c6d0492a12177f108b
2021-03-19 17:55:36 +01:00
media.c2.dmabuf.padding u:object_r:codec2_config_prop:s0 exact int
Relabel media.recorder.show_manufacturer_and_model To remove exported*_default_prop Bug: 155844385 Test: capture video Test: atest writerTest Change-Id: I74223c8daa44acf0aba33bff31cfe21f6242f941
2020-07-06 15:24:11 +02:00
media.recorder.show_manufacturer_and_model u:object_r:media_config_prop:s0 exact bool
Move media.* properties to media_config_prop Bug: 154885206 Bug: 155844385 Test: m selinux_policy Change-Id: Idfbafd29c51f7ce4512ea0d88fc7534e28eb1738
2020-05-11 10:33:27 +02:00
media.stagefright.cache-params u:object_r:media_config_prop:s0 exact string
Add entries for some properties in default_prop Currently default_prop is readable by coredomain and appdomain. That's too broad, and we are going to restrict the access so every property should be added to property_contexts. This adds some missing properties to property_contexts. Newly added property contexts are: - wrap.*: used by zygote to give arguments. It's assigned as zygote_wrap_prop, and will be readable from coredomain. - partition.{mount_name}.verified: used by dm-verity. It's assigned as vertiy_status_prop, and will only be accessible from init. - (ro.)?setupwizard.*: used by setup wizard. It's assigned as setupwizard_prop, and will be readable from coredomain. Other properties, such as ro.gfx.*, media.stagefright.*, ro.storage_manager.* are also added to existing contexts. Bug: 170590987 Test: boot crosshatch and see no denials Change-Id: Ife9d69a62ee8bd7395a70cd104271898c8a72540
2020-11-05 14:17:26 +01:00
media.stagefright.enable-aac u:object_r:media_config_prop:s0 exact bool
media.stagefright.enable-fma2dp u:object_r:media_config_prop:s0 exact bool
media.stagefright.enable-http u:object_r:media_config_prop:s0 exact bool
media.stagefright.enable-player u:object_r:media_config_prop:s0 exact bool
media.stagefright.enable-qcp u:object_r:media_config_prop:s0 exact bool
media.stagefright.enable-scan u:object_r:media_config_prop:s0 exact bool
Move media.* properties to media_config_prop Bug: 154885206 Bug: 155844385 Test: m selinux_policy Change-Id: Idfbafd29c51f7ce4512ea0d88fc7534e28eb1738
2020-05-11 10:33:27 +02:00
media.stagefright.thumbnail.prefer_hw_codecs u:object_r:media_config_prop:s0 exact bool
persist.sys.media.avsync u:object_r:media_config_prop:s0 exact bool
Merge public/property_contexts into private Originally public/property_contexts was introduced to create a whitelist of system properties which can be accessed from vendor, and to be used from VTS to ensure that the whitelist isn't modified. But it doesn't fit well on sepolicy public/private split as the split isn't for stability, but for letting vendor compile their sepolicy with public types. Also it doesn't make sense only to check the whitelist on VTS, because platform internal ones must also be unchanged. This commit merges public/property_contexts into private as before. This gives consistency with other context files such as file_contexts which are already containing entries for vendor but are only defined in private. This also simplifies property_contexts as there will be only one property_contexts file. Another benefit is that VTS will check all entries defined by system, not only exported ones. Bug: 150331497 Test: m && run VtsTrebleSysProp manually Change-Id: Ib9429e27b645ef21a36946fbaea069a718c3c6eb Merged-In: Ib9429e27b645ef21a36946fbaea069a718c3c6eb (cherry picked from commit 31391fa78e5da1ed29d5bccd4d46165b69adcbfb)
2020-03-09 11:48:37 +01:00
persist.bluetooth.a2dp_offload.cap u:object_r:bluetooth_a2dp_offload_prop:s0 exact string
persist.bluetooth.a2dp_offload.disabled u:object_r:bluetooth_a2dp_offload_prop:s0 exact bool
persist.bluetooth.bluetooth_audio_hal.disabled u:object_r:bluetooth_audio_hal_prop:s0 exact bool
persist.bluetooth.btsnoopenable u:object_r:exported_bluetooth_prop:s0 exact bool
Rename exported3_radio_prop to radio_control_prop The context name exported3_radio_prop is ambiguous and does not reflect the usage and role of the properties. This changes its name to radio_control_prop. Some downstream branches are still using exported3_radio_prop, so get_prop(domain, radio_control_prop) is added to avoid regression. It's just a workaround and to be removed soon, after all exported3_radio_prop are cleaned up. Bug: 162214733 Test: boot a device with a sim and see basic functions work Change-Id: If5fe3be7c64b36435c4ad0dc9a8089077295d502 Merged-In: If5fe3be7c64b36435c4ad0dc9a8089077295d502
2020-07-28 08:17:24 +02:00
persist.radio.multisim.config u:object_r:radio_control_prop:s0 exact string
Merge public/property_contexts into private Originally public/property_contexts was introduced to create a whitelist of system properties which can be accessed from vendor, and to be used from VTS to ensure that the whitelist isn't modified. But it doesn't fit well on sepolicy public/private split as the split isn't for stability, but for letting vendor compile their sepolicy with public types. Also it doesn't make sense only to check the whitelist on VTS, because platform internal ones must also be unchanged. This commit merges public/property_contexts into private as before. This gives consistency with other context files such as file_contexts which are already containing entries for vendor but are only defined in private. This also simplifies property_contexts as there will be only one property_contexts file. Another benefit is that VTS will check all entries defined by system, not only exported ones. Bug: 150331497 Test: m && run VtsTrebleSysProp manually Change-Id: Ib9429e27b645ef21a36946fbaea069a718c3c6eb Merged-In: Ib9429e27b645ef21a36946fbaea069a718c3c6eb (cherry picked from commit 31391fa78e5da1ed29d5bccd4d46165b69adcbfb)
2020-03-09 11:48:37 +01:00
Add existing ro.hdmi sysprops to sepolicy Bug: 185198967 Change-Id: I8efaa7b220c7bba34f2431b1a044c21cd6a1e198 Test: make
2021-04-14 15:20:10 +02:00
persist.sys.hdmi.keep_awake u:object_r:hdmi_config_prop:s0 exact bool
ro.hdmi.cec_device_types u:object_r:hdmi_config_prop:s0 exact string
ro.hdmi.device_type u:object_r:hdmi_config_prop:s0 exact string
ro.hdmi.set_menu_language u:object_r:hdmi_config_prop:s0 exact bool
ro.hdmi.cec.source.set_menu_language.enabled u:object_r:hdmi_config_prop:s0 exact bool
ro.hdmi.property_sytem_audio_device_arc_port u:object_r:hdmi_config_prop:s0 exact string
ro.hdmi.cec_audio_device_forward_volume_keys_system_audio_mode_off u:object_r:hdmi_config_prop:s0 exact bool
ro.hdmi.property_is_device_hdmi_cec_switch u:object_r:hdmi_config_prop:s0 exact bool
ro.hdmi.wake_on_hotplug u:object_r:hdmi_config_prop:s0 exact bool
ro.hdmi.cec.source.send_standby_on_sleep u:object_r:hdmi_config_prop:s0 exact enum to_tv broadcast none
Add existing ro.hdmi sysprop to sepolicy Bug: 186998799 Test: make Change-Id: If99e3c029b992cea5b4af1b4f062d3b19e601df9
2021-05-05 08:53:35 +02:00
ro.hdmi.cec.source.playback_device_action_on_routing_control u:object_r:hdmi_config_prop:s0 exact enum none wake_up_only wake_up_and_send_active_source
Merge public/property_contexts into private Originally public/property_contexts was introduced to create a whitelist of system properties which can be accessed from vendor, and to be used from VTS to ensure that the whitelist isn't modified. But it doesn't fit well on sepolicy public/private split as the split isn't for stability, but for letting vendor compile their sepolicy with public types. Also it doesn't make sense only to check the whitelist on VTS, because platform internal ones must also be unchanged. This commit merges public/property_contexts into private as before. This gives consistency with other context files such as file_contexts which are already containing entries for vendor but are only defined in private. This also simplifies property_contexts as there will be only one property_contexts file. Another benefit is that VTS will check all entries defined by system, not only exported ones. Bug: 150331497 Test: m && run VtsTrebleSysProp manually Change-Id: Ib9429e27b645ef21a36946fbaea069a718c3c6eb Merged-In: Ib9429e27b645ef21a36946fbaea069a718c3c6eb (cherry picked from commit 31391fa78e5da1ed29d5bccd4d46165b69adcbfb)
2020-03-09 11:48:37 +01:00
Added permissions for new dexopt flags. Bug: 173137187 Test: build Merged-In: Iad1d23277915e1dbf655b0f2820320f15462ab33 Change-Id: Iad1d23277915e1dbf655b0f2820320f15462ab33
2020-10-30 00:38:45 +01:00
pm.dexopt.ab-ota u:object_r:exported_pm_prop:s0 exact string
pm.dexopt.bg-dexopt u:object_r:exported_pm_prop:s0 exact string
pm.dexopt.boot u:object_r:exported_pm_prop:s0 exact string
pm.dexopt.disable_bg_dexopt u:object_r:exported_pm_prop:s0 exact bool
pm.dexopt.downgrade_after_inactive_days u:object_r:exported_pm_prop:s0 exact int
pm.dexopt.first-boot u:object_r:exported_pm_prop:s0 exact string
pm.dexopt.inactive u:object_r:exported_pm_prop:s0 exact string
pm.dexopt.install u:object_r:exported_pm_prop:s0 exact string
pm.dexopt.install-fast u:object_r:exported_pm_prop:s0 exact string
pm.dexopt.install-bulk u:object_r:exported_pm_prop:s0 exact string
pm.dexopt.install-bulk-secondary u:object_r:exported_pm_prop:s0 exact string
pm.dexopt.install-bulk-downgraded u:object_r:exported_pm_prop:s0 exact string
pm.dexopt.install-bulk-secondary-downgraded u:object_r:exported_pm_prop:s0 exact string
pm.dexopt.shared u:object_r:exported_pm_prop:s0 exact string
Merge public/property_contexts into private Originally public/property_contexts was introduced to create a whitelist of system properties which can be accessed from vendor, and to be used from VTS to ensure that the whitelist isn't modified. But it doesn't fit well on sepolicy public/private split as the split isn't for stability, but for letting vendor compile their sepolicy with public types. Also it doesn't make sense only to check the whitelist on VTS, because platform internal ones must also be unchanged. This commit merges public/property_contexts into private as before. This gives consistency with other context files such as file_contexts which are already containing entries for vendor but are only defined in private. This also simplifies property_contexts as there will be only one property_contexts file. Another benefit is that VTS will check all entries defined by system, not only exported ones. Bug: 150331497 Test: m && run VtsTrebleSysProp manually Change-Id: Ib9429e27b645ef21a36946fbaea069a718c3c6eb Merged-In: Ib9429e27b645ef21a36946fbaea069a718c3c6eb (cherry picked from commit 31391fa78e5da1ed29d5bccd4d46165b69adcbfb)
2020-03-09 11:48:37 +01:00
ro.apk_verity.mode u:object_r:apk_verity_prop:s0 exact int
ro.bluetooth.a2dp_offload.supported u:object_r:bluetooth_a2dp_offload_prop:s0 exact bool
ro.boot.vendor.overlay.theme u:object_r:exported_overlay_prop:s0 exact string
ro.bt.bdaddr_path u:object_r:exported_bluetooth_prop:s0 exact string
Export missing audio volume properties The following properties are used in AudioService: ro.config.alarm_vol_default ro.config.alarm_vol_steps ro.config.media_vol_default ro.config.system_vol_default ro.config.system_vol_steps ro.config.vc_call_vol_default Test: properties can be set from vendor with PRODUCT_COMPATIBLE_PROPERTY_OVERRIDE := true Change-Id: Ib90103173989fcb0723f3d8465df3cd03334cc53
2020-03-10 22:51:09 +01:00
ro.config.alarm_alert u:object_r:systemsound_config_prop:s0 exact string
ro.config.alarm_vol_default u:object_r:systemsound_config_prop:s0 exact int
ro.config.alarm_vol_steps u:object_r:systemsound_config_prop:s0 exact int
ro.config.media_vol_default u:object_r:systemsound_config_prop:s0 exact int
ro.config.media_vol_steps u:object_r:systemsound_config_prop:s0 exact int
ro.config.notification_sound u:object_r:systemsound_config_prop:s0 exact string
ro.config.ringtone u:object_r:systemsound_config_prop:s0 exact string
ro.config.system_vol_default u:object_r:systemsound_config_prop:s0 exact int
ro.config.system_vol_steps u:object_r:systemsound_config_prop:s0 exact int
ro.config.vc_call_vol_default u:object_r:systemsound_config_prop:s0 exact int
Rename exported2_config_prop to systemsound_config_prop Fixing bad names (exported*_prop) on property contexts. Bug: 152468650 Test: m sepolicy_tests Change-Id: Ie98212ee0fa89966e70faa83322b65b613f3b3f5
2020-04-01 03:01:16 +02:00
Add new context packagemanager_config_prop To remove bad context names exported[23]_default_prop Bug: 155844385 Test: m selinux_policy Change-Id: Ic4bbc8e45d810368a96f6985c2234798e73be82d Merged-In: Ic4bbc8e45d810368a96f6985c2234798e73be82d (cherry picked from commit 072b01438e02e9d3cfba04c768e7a440549cc8b1)
2020-06-16 13:00:41 +02:00
ro.control_privapp_permissions u:object_r:packagemanager_config_prop:s0 exact enum disable enforce log
ro.cp_system_other_odex u:object_r:packagemanager_config_prop:s0 exact bool
Merge public/property_contexts into private Originally public/property_contexts was introduced to create a whitelist of system properties which can be accessed from vendor, and to be used from VTS to ensure that the whitelist isn't modified. But it doesn't fit well on sepolicy public/private split as the split isn't for stability, but for letting vendor compile their sepolicy with public types. Also it doesn't make sense only to check the whitelist on VTS, because platform internal ones must also be unchanged. This commit merges public/property_contexts into private as before. This gives consistency with other context files such as file_contexts which are already containing entries for vendor but are only defined in private. This also simplifies property_contexts as there will be only one property_contexts file. Another benefit is that VTS will check all entries defined by system, not only exported ones. Bug: 150331497 Test: m && run VtsTrebleSysProp manually Change-Id: Ib9429e27b645ef21a36946fbaea069a718c3c6eb Merged-In: Ib9429e27b645ef21a36946fbaea069a718c3c6eb (cherry picked from commit 31391fa78e5da1ed29d5bccd4d46165b69adcbfb)
2020-03-09 11:48:37 +01:00
Rename exported and exported2 vold prop This is a subtask to clean up bad context names "exported*_prop". Bug: 152469526 Test: m Change-Id: Ie2d4046732e9d6562294fa664dcd7f019aa7c229
2020-04-06 13:49:17 +02:00
ro.crypto.allow_encrypt_override u:object_r:vold_config_prop:s0 exact bool
ro.crypto.dm_default_key.options_format.version u:object_r:vold_config_prop:s0 exact int
ro.crypto.fde_algorithm u:object_r:vold_config_prop:s0 exact string
ro.crypto.fde_sector_size u:object_r:vold_config_prop:s0 exact int
ro.crypto.scrypt_params u:object_r:vold_config_prop:s0 exact string
ro.crypto.set_dun u:object_r:vold_config_prop:s0 exact bool
ro.crypto.volume.contents_mode u:object_r:vold_config_prop:s0 exact string
ro.crypto.volume.filenames_mode u:object_r:vold_config_prop:s0 exact string
ro.crypto.volume.metadata.encryption u:object_r:vold_config_prop:s0 exact string
ro.crypto.volume.metadata.method u:object_r:vold_config_prop:s0 exact string
ro.crypto.volume.options u:object_r:vold_config_prop:s0 exact string
Merge public/property_contexts into private Originally public/property_contexts was introduced to create a whitelist of system properties which can be accessed from vendor, and to be used from VTS to ensure that the whitelist isn't modified. But it doesn't fit well on sepolicy public/private split as the split isn't for stability, but for letting vendor compile their sepolicy with public types. Also it doesn't make sense only to check the whitelist on VTS, because platform internal ones must also be unchanged. This commit merges public/property_contexts into private as before. This gives consistency with other context files such as file_contexts which are already containing entries for vendor but are only defined in private. This also simplifies property_contexts as there will be only one property_contexts file. Another benefit is that VTS will check all entries defined by system, not only exported ones. Bug: 150331497 Test: m && run VtsTrebleSysProp manually Change-Id: Ib9429e27b645ef21a36946fbaea069a718c3c6eb Merged-In: Ib9429e27b645ef21a36946fbaea069a718c3c6eb (cherry picked from commit 31391fa78e5da1ed29d5bccd4d46165b69adcbfb)
2020-03-09 11:48:37 +01:00
Rename exported_dalvik_prop to dalvik_config_prop This is to clean up bad name "exported_dalvik_prop" Bug: 154465224 Test: sepolicy_tests Test: treble_sepolicy_tests 26.0 ~ 29.0 Change-Id: Ie5e738b5985c1db1bca7a857971d8490a7980b5b
2020-04-20 12:36:33 +02:00
ro.dalvik.vm.native.bridge u:object_r:dalvik_config_prop:s0 exact string
Merge public/property_contexts into private Originally public/property_contexts was introduced to create a whitelist of system properties which can be accessed from vendor, and to be used from VTS to ensure that the whitelist isn't modified. But it doesn't fit well on sepolicy public/private split as the split isn't for stability, but for letting vendor compile their sepolicy with public types. Also it doesn't make sense only to check the whitelist on VTS, because platform internal ones must also be unchanged. This commit merges public/property_contexts into private as before. This gives consistency with other context files such as file_contexts which are already containing entries for vendor but are only defined in private. This also simplifies property_contexts as there will be only one property_contexts file. Another benefit is that VTS will check all entries defined by system, not only exported ones. Bug: 150331497 Test: m && run VtsTrebleSysProp manually Change-Id: Ib9429e27b645ef21a36946fbaea069a718c3c6eb Merged-In: Ib9429e27b645ef21a36946fbaea069a718c3c6eb (cherry picked from commit 31391fa78e5da1ed29d5bccd4d46165b69adcbfb)
2020-03-09 11:48:37 +01:00
Add external_storage properties. Since these need to be set from a vendor context. Bug: 152170470 Bug: 153525566 Test: N/A Change-Id: I2e90ad08fa0a5bd2b4759d92f95d35cec2b316df
2020-04-10 14:11:49 +02:00
external_storage.projid.enabled u:object_r:storage_config_prop:s0 exact bool
external_storage.casefold.enabled u:object_r:storage_config_prop:s0 exact bool
Add sdcardfs variable to storage_config_props This property allows us to disable sdcardfs if it is present. The old property ended up getting repurposed, so a new one was needed. Mediaprovider will also need to access this to determine what actions it needs to take. Test: builds Bug: 155222498 Change-Id: I66ac106613cbb374f54659601e4ba3f61eaecd2f
2020-05-12 07:50:40 +02:00
external_storage.sdcardfs.enabled u:object_r:storage_config_prop:s0 exact bool
Add external_storage.cross_user.enabled property This allows the FUSE daemon handle FUSE_LOOKUP requests across user boundaries. Workaround to support some OEMs for their app cloning feature in R Bug: 162476851 Bug: 172177780 Test: Manual Change-Id: Ic1408f413ec3dc4917d3acfda2c5f62f9c16f187
2020-09-02 10:37:09 +02:00
external_storage.cross_user.enabled u:object_r:storage_config_prop:s0 exact bool
Add external_storage properties. Since these need to be set from a vendor context. Bug: 152170470 Bug: 153525566 Test: N/A Change-Id: I2e90ad08fa0a5bd2b4759d92f95d35cec2b316df
2020-04-10 14:11:49 +02:00
Relabel various exported3_default_prop This removes bad context names "exported*_prop". Property contexts of following properties are changed. All properties are settable only by vendor-init. - ro.config.per_app_memcg This becomes lmkd_config_prop. - ro.zygote This becomes dalvik_config_prop. - ro.oem_unlock_supported This becomes oem_unlock_prop. It's readable by system_app which includes Settings apps. - ro.storage_manager.enabled This becomes storagemanagr_config_prop. It's readable by coredomain. Various domains in coredomain seem to read it. - sendbug.preferred.domain This bcomes sendbug_config_prop. It's readable by appdomain. There are still 3 more exported3_default_prop, which are going to be tracked individually. Bug: 155844385 Test: selinux denial check on Pixel devices Change-Id: I340c903ca7bda98a92d0f157c65f6833ed00df05
2020-07-16 15:25:47 +02:00
ro.config.per_app_memcg u:object_r:lmkd_config_prop:s0 exact bool
Move ro.lmk. properties to lmkd_config_prop Bug: 155844385 Test: sepolicy_tests Change-Id: I6a4412b3e7d3c46eae699bd8e7d2941f56b31773
2020-05-06 10:11:46 +02:00
ro.lmk.critical u:object_r:lmkd_config_prop:s0 exact int
ro.lmk.critical_upgrade u:object_r:lmkd_config_prop:s0 exact bool
ro.lmk.debug u:object_r:lmkd_config_prop:s0 exact bool
ro.lmk.downgrade_pressure u:object_r:lmkd_config_prop:s0 exact int
ro.lmk.kill_heaviest_task u:object_r:lmkd_config_prop:s0 exact bool
ro.lmk.kill_timeout_ms u:object_r:lmkd_config_prop:s0 exact int
Add entries for some properties in default_prop Currently default_prop is readable by coredomain and appdomain. That's too broad, and we are going to restrict the access so every property should be added to property_contexts. This adds some missing properties to property_contexts. Newly added property contexts are: - wrap.*: used by zygote to give arguments. It's assigned as zygote_wrap_prop, and will be readable from coredomain. - partition.{mount_name}.verified: used by dm-verity. It's assigned as vertiy_status_prop, and will only be accessible from init. - (ro.)?setupwizard.*: used by setup wizard. It's assigned as setupwizard_prop, and will be readable from coredomain. Other properties, such as ro.gfx.*, media.stagefright.*, ro.storage_manager.* are also added to existing contexts. Bug: 170590987 Test: boot crosshatch and see no denials Change-Id: Ife9d69a62ee8bd7395a70cd104271898c8a72540
2020-11-05 14:17:26 +01:00
ro.lmk.log_stats u:object_r:lmkd_config_prop:s0 exact bool
Move ro.lmk. properties to lmkd_config_prop Bug: 155844385 Test: sepolicy_tests Change-Id: I6a4412b3e7d3c46eae699bd8e7d2941f56b31773
2020-05-06 10:11:46 +02:00
ro.lmk.low u:object_r:lmkd_config_prop:s0 exact int
ro.lmk.medium u:object_r:lmkd_config_prop:s0 exact int
ro.lmk.psi_partial_stall_ms u:object_r:lmkd_config_prop:s0 exact int
ro.lmk.psi_complete_stall_ms u:object_r:lmkd_config_prop:s0 exact int
ro.lmk.swap_free_low_percentage u:object_r:lmkd_config_prop:s0 exact int
ro.lmk.swap_util_max u:object_r:lmkd_config_prop:s0 exact int
ro.lmk.thrashing_limit u:object_r:lmkd_config_prop:s0 exact int
Add lmkd. ro.lmk.thrashing_limit_critical property policies Add policies to control ro.lmk.thrashing_limit_critical lmkd property. Bug: 181778155 Signed-off-by: Suren Baghdasaryan <surenb@google.com> Change-Id: I25eeb84e6e073510e2f516fd38b80c67afe26917
2021-03-03 21:49:31 +01:00
ro.lmk.thrashing_limit_critical u:object_r:lmkd_config_prop:s0 exact int
Move ro.lmk. properties to lmkd_config_prop Bug: 155844385 Test: sepolicy_tests Change-Id: I6a4412b3e7d3c46eae699bd8e7d2941f56b31773
2020-05-06 10:11:46 +02:00
ro.lmk.thrashing_limit_decay u:object_r:lmkd_config_prop:s0 exact int
ro.lmk.use_minfree_levels u:object_r:lmkd_config_prop:s0 exact bool
ro.lmk.upgrade_pressure u:object_r:lmkd_config_prop:s0 exact int
Add lmkd. property policies lmkd.reinit property allows vendors to trigger lmkd reinitialization. Add lmkd_prop to support lmkd.* properties inlcuding lmkd.reinit. Bug: 155149944 Test: setprop lmkd.reinit 1 Signed-off-by: Suren Baghdasaryan <surenb@google.com> Change-Id: I6ba598bad7ebb40fd6f23de473f25f32e53c996d
2020-05-05 21:41:02 +02:00
lmkd.reinit u:object_r:lmkd_prop:s0 exact int
Merge public/property_contexts into private Originally public/property_contexts was introduced to create a whitelist of system properties which can be accessed from vendor, and to be used from VTS to ensure that the whitelist isn't modified. But it doesn't fit well on sepolicy public/private split as the split isn't for stability, but for letting vendor compile their sepolicy with public types. Also it doesn't make sense only to check the whitelist on VTS, because platform internal ones must also be unchanged. This commit merges public/property_contexts into private as before. This gives consistency with other context files such as file_contexts which are already containing entries for vendor but are only defined in private. This also simplifies property_contexts as there will be only one property_contexts file. Another benefit is that VTS will check all entries defined by system, not only exported ones. Bug: 150331497 Test: m && run VtsTrebleSysProp manually Change-Id: Ib9429e27b645ef21a36946fbaea069a718c3c6eb Merged-In: Ib9429e27b645ef21a36946fbaea069a718c3c6eb (cherry picked from commit 31391fa78e5da1ed29d5bccd4d46165b69adcbfb)
2020-03-09 11:48:37 +01:00
Allow XML file paths to be customized with sysprop Three properties are declared as vendor-init-settable: ro.media.xml_variant.codecs ro.media.xml_variant.codecs_performance ro.media.xml_variant.profiles media_codecs.xml can now be named media_codecs${ro.media.xml_variant.codecs}.xml media_codecs_performance.xml can now be named media_codecs_performance${ro.media.xml_variant.codecs_performance}.xml media_profiles_V1_0 can now be named media_profiles${ro.media.xml_variant.profiles}.xml Test: Rename "media_codecs.xml" to "media_codecs_test.xml", set ro.media.xml_variant.codecs to "_test", then call "stagefright -i". Test: Rename "media_codecs_performance.xml" to "media_codecs_performance_test.xml", set ro.media.xml_variant.codecs_performance to "_test", then run android.media.cts.VideoDecoderPerfTest. Test: Rename "media_profiles_V1_0.xml" to "media_profiles_test.xml", set ro.media.xml_variant.profiles to "_test", then run vts_mediaProfiles_validate_test. Bug: 142102953 Change-Id: I407a0a327fcc8e799bb4079b11048a497565be48
2020-03-07 13:15:38 +01:00
ro.media.xml_variant.codecs u:object_r:media_variant_prop:s0 exact string
ro.media.xml_variant.codecs_performance u:object_r:media_variant_prop:s0 exact string
ro.media.xml_variant.profiles u:object_r:media_variant_prop:s0 exact string
Relabel minui properties as recovery_config_prop To clean up bad context name exported[23]_default_prop Bug: 155844385 Test: m selinux_policy Test: enter recovery mode Change-Id: I312b6fa911a90dfc069a973c7916c67d92b7baa5
2020-06-16 12:18:24 +02:00
ro.minui.default_rotation u:object_r:recovery_config_prop:s0 exact string
ro.minui.overscan_percent u:object_r:recovery_config_prop:s0 exact int
ro.minui.pixel_format u:object_r:recovery_config_prop:s0 exact string
Merge public/property_contexts into private Originally public/property_contexts was introduced to create a whitelist of system properties which can be accessed from vendor, and to be used from VTS to ensure that the whitelist isn't modified. But it doesn't fit well on sepolicy public/private split as the split isn't for stability, but for letting vendor compile their sepolicy with public types. Also it doesn't make sense only to check the whitelist on VTS, because platform internal ones must also be unchanged. This commit merges public/property_contexts into private as before. This gives consistency with other context files such as file_contexts which are already containing entries for vendor but are only defined in private. This also simplifies property_contexts as there will be only one property_contexts file. Another benefit is that VTS will check all entries defined by system, not only exported ones. Bug: 150331497 Test: m && run VtsTrebleSysProp manually Change-Id: Ib9429e27b645ef21a36946fbaea069a718c3c6eb Merged-In: Ib9429e27b645ef21a36946fbaea069a718c3c6eb (cherry picked from commit 31391fa78e5da1ed29d5bccd4d46165b69adcbfb)
2020-03-09 11:48:37 +01:00
Relabel various exported3_default_prop This removes bad context names "exported*_prop". Property contexts of following properties are changed. All properties are settable only by vendor-init. - ro.config.per_app_memcg This becomes lmkd_config_prop. - ro.zygote This becomes dalvik_config_prop. - ro.oem_unlock_supported This becomes oem_unlock_prop. It's readable by system_app which includes Settings apps. - ro.storage_manager.enabled This becomes storagemanagr_config_prop. It's readable by coredomain. Various domains in coredomain seem to read it. - sendbug.preferred.domain This bcomes sendbug_config_prop. It's readable by appdomain. There are still 3 more exported3_default_prop, which are going to be tracked individually. Bug: 155844385 Test: selinux denial check on Pixel devices Change-Id: I340c903ca7bda98a92d0f157c65f6833ed00df05
2020-07-16 15:25:47 +02:00
ro.oem_unlock_supported u:object_r:oem_unlock_prop:s0 exact int
Merge public/property_contexts into private Originally public/property_contexts was introduced to create a whitelist of system properties which can be accessed from vendor, and to be used from VTS to ensure that the whitelist isn't modified. But it doesn't fit well on sepolicy public/private split as the split isn't for stability, but for letting vendor compile their sepolicy with public types. Also it doesn't make sense only to check the whitelist on VTS, because platform internal ones must also be unchanged. This commit merges public/property_contexts into private as before. This gives consistency with other context files such as file_contexts which are already containing entries for vendor but are only defined in private. This also simplifies property_contexts as there will be only one property_contexts file. Another benefit is that VTS will check all entries defined by system, not only exported ones. Bug: 150331497 Test: m && run VtsTrebleSysProp manually Change-Id: Ib9429e27b645ef21a36946fbaea069a718c3c6eb Merged-In: Ib9429e27b645ef21a36946fbaea069a718c3c6eb (cherry picked from commit 31391fa78e5da1ed29d5bccd4d46165b69adcbfb)
2020-03-09 11:48:37 +01:00
ro.rebootescrow.device u:object_r:rebootescrow_hal_prop:s0 exact string
Add entries for some properties in default_prop Currently default_prop is readable by coredomain and appdomain. That's too broad, and we are going to restrict the access so every property should be added to property_contexts. This adds some missing properties to property_contexts. Newly added property contexts are: - wrap.*: used by zygote to give arguments. It's assigned as zygote_wrap_prop, and will be readable from coredomain. - partition.{mount_name}.verified: used by dm-verity. It's assigned as vertiy_status_prop, and will only be accessible from init. - (ro.)?setupwizard.*: used by setup wizard. It's assigned as setupwizard_prop, and will be readable from coredomain. Other properties, such as ro.gfx.*, media.stagefright.*, ro.storage_manager.* are also added to existing contexts. Bug: 170590987 Test: boot crosshatch and see no denials Change-Id: Ife9d69a62ee8bd7395a70cd104271898c8a72540
2020-11-05 14:17:26 +01:00
ro.storage_manager.enabled u:object_r:storagemanager_config_prop:s0 exact bool
ro.storage_manager.show_opt_in u:object_r:storagemanager_config_prop:s0 exact bool
Merge public/property_contexts into private Originally public/property_contexts was introduced to create a whitelist of system properties which can be accessed from vendor, and to be used from VTS to ensure that the whitelist isn't modified. But it doesn't fit well on sepolicy public/private split as the split isn't for stability, but for letting vendor compile their sepolicy with public types. Also it doesn't make sense only to check the whitelist on VTS, because platform internal ones must also be unchanged. This commit merges public/property_contexts into private as before. This gives consistency with other context files such as file_contexts which are already containing entries for vendor but are only defined in private. This also simplifies property_contexts as there will be only one property_contexts file. Another benefit is that VTS will check all entries defined by system, not only exported ones. Bug: 150331497 Test: m && run VtsTrebleSysProp manually Change-Id: Ib9429e27b645ef21a36946fbaea069a718c3c6eb Merged-In: Ib9429e27b645ef21a36946fbaea069a718c3c6eb (cherry picked from commit 31391fa78e5da1ed29d5bccd4d46165b69adcbfb)
2020-03-09 11:48:37 +01:00
ro.vehicle.hal u:object_r:vehicle_hal_prop:s0 exact string
ro.vendor.build.security_patch u:object_r:vendor_security_patch_level_prop:s0 exact string
Rename context names of zram properties Moving from old bad name "exported*_prop". Bug: 154885206 Bug: 155844385 Test: m selinux_policy Change-Id: I21af42980e5e6e2c3cabea6c36825fa2836a55bc
2020-05-08 13:42:25 +02:00
ro.zram.mark_idle_delay_mins u:object_r:zram_config_prop:s0 exact int
ro.zram.first_wb_delay_mins u:object_r:zram_config_prop:s0 exact int
ro.zram.periodic_wb_delay_hours u:object_r:zram_config_prop:s0 exact int
zram.force_writeback u:object_r:zram_config_prop:s0 exact bool
persist.sys.zram_enabled u:object_r:zram_control_prop:s0 exact bool
Merge public/property_contexts into private Originally public/property_contexts was introduced to create a whitelist of system properties which can be accessed from vendor, and to be used from VTS to ensure that the whitelist isn't modified. But it doesn't fit well on sepolicy public/private split as the split isn't for stability, but for letting vendor compile their sepolicy with public types. Also it doesn't make sense only to check the whitelist on VTS, because platform internal ones must also be unchanged. This commit merges public/property_contexts into private as before. This gives consistency with other context files such as file_contexts which are already containing entries for vendor but are only defined in private. This also simplifies property_contexts as there will be only one property_contexts file. Another benefit is that VTS will check all entries defined by system, not only exported ones. Bug: 150331497 Test: m && run VtsTrebleSysProp manually Change-Id: Ib9429e27b645ef21a36946fbaea069a718c3c6eb Merged-In: Ib9429e27b645ef21a36946fbaea069a718c3c6eb (cherry picked from commit 31391fa78e5da1ed29d5bccd4d46165b69adcbfb)
2020-03-09 11:48:37 +01:00
Relabel various exported3_default_prop This removes bad context names "exported*_prop". Property contexts of following properties are changed. All properties are settable only by vendor-init. - ro.config.per_app_memcg This becomes lmkd_config_prop. - ro.zygote This becomes dalvik_config_prop. - ro.oem_unlock_supported This becomes oem_unlock_prop. It's readable by system_app which includes Settings apps. - ro.storage_manager.enabled This becomes storagemanagr_config_prop. It's readable by coredomain. Various domains in coredomain seem to read it. - sendbug.preferred.domain This bcomes sendbug_config_prop. It's readable by appdomain. There are still 3 more exported3_default_prop, which are going to be tracked individually. Bug: 155844385 Test: selinux denial check on Pixel devices Change-Id: I340c903ca7bda98a92d0f157c65f6833ed00df05
2020-07-16 15:25:47 +02:00
sendbug.preferred.domain u:object_r:sendbug_config_prop:s0 exact string
Merge public/property_contexts into private Originally public/property_contexts was introduced to create a whitelist of system properties which can be accessed from vendor, and to be used from VTS to ensure that the whitelist isn't modified. But it doesn't fit well on sepolicy public/private split as the split isn't for stability, but for letting vendor compile their sepolicy with public types. Also it doesn't make sense only to check the whitelist on VTS, because platform internal ones must also be unchanged. This commit merges public/property_contexts into private as before. This gives consistency with other context files such as file_contexts which are already containing entries for vendor but are only defined in private. This also simplifies property_contexts as there will be only one property_contexts file. Another benefit is that VTS will check all entries defined by system, not only exported ones. Bug: 150331497 Test: m && run VtsTrebleSysProp manually Change-Id: Ib9429e27b645ef21a36946fbaea069a718c3c6eb Merged-In: Ib9429e27b645ef21a36946fbaea069a718c3c6eb (cherry picked from commit 31391fa78e5da1ed29d5bccd4d46165b69adcbfb)
2020-03-09 11:48:37 +01:00
Rename system_radio_prop For whatever reason sys.usb.config* has been labeled as system_radio_prop, which doesn't make sense. Changing context name as usb_prop. For the same reason exported_system_radio_prop is also renamed to usb-related names. Bug: 71814576 Bug: 154885206 Test: m selinux_policy Change-Id: If30bc620dbeac926a8b9bcde908357fda739a6c1 Merged-In: If30bc620dbeac926a8b9bcde908357fda739a6c1 (cherry picked from commit 44fbcdb677d040a7ff9949db8457347a5299b4a0)
2020-04-27 14:13:01 +02:00
persist.sys.usb.usbradio.config u:object_r:usb_control_prop:s0 exact string
sys.usb.config u:object_r:usb_control_prop:s0 exact string
sys.usb.configfs u:object_r:usb_control_prop:s0 exact int
sys.usb.controller u:object_r:usb_control_prop:s0 exact string
sys.usb.state u:object_r:usb_control_prop:s0 exact string
sys.usb.mtp.device_type u:object_r:usb_config_prop:s0 exact int
sys.usb.config. u:object_r:usb_prop:s0
Merge public/property_contexts into private Originally public/property_contexts was introduced to create a whitelist of system properties which can be accessed from vendor, and to be used from VTS to ensure that the whitelist isn't modified. But it doesn't fit well on sepolicy public/private split as the split isn't for stability, but for letting vendor compile their sepolicy with public types. Also it doesn't make sense only to check the whitelist on VTS, because platform internal ones must also be unchanged. This commit merges public/property_contexts into private as before. This gives consistency with other context files such as file_contexts which are already containing entries for vendor but are only defined in private. This also simplifies property_contexts as there will be only one property_contexts file. Another benefit is that VTS will check all entries defined by system, not only exported ones. Bug: 150331497 Test: m && run VtsTrebleSysProp manually Change-Id: Ib9429e27b645ef21a36946fbaea069a718c3c6eb Merged-In: Ib9429e27b645ef21a36946fbaea069a718c3c6eb (cherry picked from commit 31391fa78e5da1ed29d5bccd4d46165b69adcbfb)
2020-03-09 11:48:37 +01:00
Rename contexts of ffs props Bug: 71814576 Bug: 154885206 Test: m sepolicy_test Change-Id: Idacc3635851b14b833bccca177d784f4bb92c763
2020-04-27 16:49:15 +02:00
sys.usb.ffs.aio_compat u:object_r:ffs_config_prop:s0 exact bool
sys.usb.ffs.max_read u:object_r:ffs_config_prop:s0 exact int
sys.usb.ffs.max_write u:object_r:ffs_config_prop:s0 exact int
sys.usb.ffs.ready u:object_r:ffs_control_prop:s0 exact bool
sys.usb.ffs.mtp.ready u:object_r:ffs_control_prop:s0 exact bool
Add tombstone_config_prop and move related prop tombstoned.max_tombstone_coun becomes tombstone_config_prop to remove exported*_default_prop Bug: 155844385 Test: tombstoned is running and logcat shows no denials Change-Id: I57bebb5766d790dc52d40a6d106f480e0e34fa4e
2020-07-07 06:35:34 +02:00
tombstoned.max_tombstone_count u:object_r:tombstone_config_prop:s0 exact int
Merge public/property_contexts into private Originally public/property_contexts was introduced to create a whitelist of system properties which can be accessed from vendor, and to be used from VTS to ensure that the whitelist isn't modified. But it doesn't fit well on sepolicy public/private split as the split isn't for stability, but for letting vendor compile their sepolicy with public types. Also it doesn't make sense only to check the whitelist on VTS, because platform internal ones must also be unchanged. This commit merges public/property_contexts into private as before. This gives consistency with other context files such as file_contexts which are already containing entries for vendor but are only defined in private. This also simplifies property_contexts as there will be only one property_contexts file. Another benefit is that VTS will check all entries defined by system, not only exported ones. Bug: 150331497 Test: m && run VtsTrebleSysProp manually Change-Id: Ib9429e27b645ef21a36946fbaea069a718c3c6eb Merged-In: Ib9429e27b645ef21a36946fbaea069a718c3c6eb (cherry picked from commit 31391fa78e5da1ed29d5bccd4d46165b69adcbfb)
2020-03-09 11:48:37 +01:00
Fix permissions for vold.post_fs_data_done The system property "vold.post_fs_data_done" is used by init and vold to communicate with each other in order to set up FDE on devices that use FDE. It needs to be gettable and settable by vold, and settable by init and vendor_init. This was the case in Android 11 and earlier; however, the change https://android-review.googlesource.com/c/platform/system/sepolicy/+/1277447 ("Rename exported and exported2 vold prop") broke this by giving this property the type "vold_config_prop", which made it no longer settable by vold. Since none of the existing property types appear to be appropriate for this particular property, define a new type "vold_post_fs_data_prop" and grant the needed domains permission to get/set it. This is one of a set of changes that is needed to get FDE working again so that devices that launched with FDE can be upgraded to Android 12. Bug: 186165644 Test: Tested FDE on Cuttlefish Change-Id: I2fd8af0091f8b921ec37381ad3b85a156d074566
2021-04-23 01:09:56 +02:00
vold.post_fs_data_done u:object_r:vold_post_fs_data_prop:s0 exact int
Merge public/property_contexts into private Originally public/property_contexts was introduced to create a whitelist of system properties which can be accessed from vendor, and to be used from VTS to ensure that the whitelist isn't modified. But it doesn't fit well on sepolicy public/private split as the split isn't for stability, but for letting vendor compile their sepolicy with public types. Also it doesn't make sense only to check the whitelist on VTS, because platform internal ones must also be unchanged. This commit merges public/property_contexts into private as before. This gives consistency with other context files such as file_contexts which are already containing entries for vendor but are only defined in private. This also simplifies property_contexts as there will be only one property_contexts file. Another benefit is that VTS will check all entries defined by system, not only exported ones. Bug: 150331497 Test: m && run VtsTrebleSysProp manually Change-Id: Ib9429e27b645ef21a36946fbaea069a718c3c6eb Merged-In: Ib9429e27b645ef21a36946fbaea069a718c3c6eb (cherry picked from commit 31391fa78e5da1ed29d5bccd4d46165b69adcbfb)
2020-03-09 11:48:37 +01:00
apexd.status u:object_r:apexd_prop:s0 exact enum starting activated ready
Add odsign status properties. These properties are used to communicate odsign status, and allow init to evict keys and start zygote at the correct moments in time. Bug: 165630556 Test: no denials from init/odsign Change-Id: I813e5c1c93d6f00a251a9cce02d0b74e5372c1ce
2021-03-16 08:34:30 +01:00
odsign.key.done u:object_r:odsign_prop:s0 exact bool
odsign.verification.done u:object_r:odsign_prop:s0 exact bool
odsign.verification.success u:object_r:odsign_prop:s0 exact bool
Add boot_status_prop for boot completed props Assigning a new context boot_status_prop for following two properties: - sys.boot_completed - dev.bootcomplete Bug: 154885206 Test: boot cf_x86 and crosshatch, see no denials Change-Id: Ieadabf90a9a1b54b52a1283bd648c11c95d558dd Merged-In: Ieadabf90a9a1b54b52a1283bd648c11c95d558dd (cherry picked from commit 2973c9605555c119243ef85119576b2d01a12060)
2020-04-24 08:03:01 +02:00
dev.bootcomplete u:object_r:boot_status_prop:s0 exact bool
sys.boot_completed u:object_r:boot_status_prop:s0 exact bool
Merge public/property_contexts into private Originally public/property_contexts was introduced to create a whitelist of system properties which can be accessed from vendor, and to be used from VTS to ensure that the whitelist isn't modified. But it doesn't fit well on sepolicy public/private split as the split isn't for stability, but for letting vendor compile their sepolicy with public types. Also it doesn't make sense only to check the whitelist on VTS, because platform internal ones must also be unchanged. This commit merges public/property_contexts into private as before. This gives consistency with other context files such as file_contexts which are already containing entries for vendor but are only defined in private. This also simplifies property_contexts as there will be only one property_contexts file. Another benefit is that VTS will check all entries defined by system, not only exported ones. Bug: 150331497 Test: m && run VtsTrebleSysProp manually Change-Id: Ib9429e27b645ef21a36946fbaea069a718c3c6eb Merged-In: Ib9429e27b645ef21a36946fbaea069a718c3c6eb (cherry picked from commit 31391fa78e5da1ed29d5bccd4d46165b69adcbfb)
2020-03-09 11:48:37 +01:00
Move props out of exported3_system_prop This is to remove bad context name "exported3_system_prop". - persist.sys.device_provisioned -> provisioned_prop - sys.retaildemo.enabled -> retaildemo_prop Bug: 154885206 Test: boot device and see no denials Change-Id: Ia19a19d93d0689deb56d66fe0b039ace44e4836f
2020-05-13 18:38:40 +02:00
persist.sys.device_provisioned u:object_r:provisioned_prop:s0 exact string
Merge public/property_contexts into private Originally public/property_contexts was introduced to create a whitelist of system properties which can be accessed from vendor, and to be used from VTS to ensure that the whitelist isn't modified. But it doesn't fit well on sepolicy public/private split as the split isn't for stability, but for letting vendor compile their sepolicy with public types. Also it doesn't make sense only to check the whitelist on VTS, because platform internal ones must also be unchanged. This commit merges public/property_contexts into private as before. This gives consistency with other context files such as file_contexts which are already containing entries for vendor but are only defined in private. This also simplifies property_contexts as there will be only one property_contexts file. Another benefit is that VTS will check all entries defined by system, not only exported ones. Bug: 150331497 Test: m && run VtsTrebleSysProp manually Change-Id: Ib9429e27b645ef21a36946fbaea069a718c3c6eb Merged-In: Ib9429e27b645ef21a36946fbaea069a718c3c6eb (cherry picked from commit 31391fa78e5da1ed29d5bccd4d46165b69adcbfb)
2020-03-09 11:48:37 +01:00
persist.sys.theme u:object_r:theme_prop:s0 exact string
Move props out of exported3_system_prop This is to remove bad context name "exported3_system_prop". - persist.sys.device_provisioned -> provisioned_prop - sys.retaildemo.enabled -> retaildemo_prop Bug: 154885206 Test: boot device and see no denials Change-Id: Ia19a19d93d0689deb56d66fe0b039ace44e4836f
2020-05-13 18:38:40 +02:00
sys.retaildemo.enabled u:object_r:retaildemo_prop:s0 exact int
Merge public/property_contexts into private Originally public/property_contexts was introduced to create a whitelist of system properties which can be accessed from vendor, and to be used from VTS to ensure that the whitelist isn't modified. But it doesn't fit well on sepolicy public/private split as the split isn't for stability, but for letting vendor compile their sepolicy with public types. Also it doesn't make sense only to check the whitelist on VTS, because platform internal ones must also be unchanged. This commit merges public/property_contexts into private as before. This gives consistency with other context files such as file_contexts which are already containing entries for vendor but are only defined in private. This also simplifies property_contexts as there will be only one property_contexts file. Another benefit is that VTS will check all entries defined by system, not only exported ones. Bug: 150331497 Test: m && run VtsTrebleSysProp manually Change-Id: Ib9429e27b645ef21a36946fbaea069a718c3c6eb Merged-In: Ib9429e27b645ef21a36946fbaea069a718c3c6eb (cherry picked from commit 31391fa78e5da1ed29d5bccd4d46165b69adcbfb)
2020-03-09 11:48:37 +01:00
sys.user.0.ce_available u:object_r:exported3_system_prop:s0 exact bool
Move aac_drc props to aac_drc_prop Bug: 155844385 Test: sepolicy_tests Change-Id: I1755672b5cef876955f93020c519aaaabf814bbf
2020-05-06 11:30:20 +02:00
aac_drc_boost u:object_r:aac_drc_prop:s0 exact int
aac_drc_cut u:object_r:aac_drc_prop:s0 exact int
aac_drc_enc_target_level u:object_r:aac_drc_prop:s0 exact int
aac_drc_heavy u:object_r:aac_drc_prop:s0 exact int
aac_drc_reference_level u:object_r:aac_drc_prop:s0 exact int
ro.aac_drc_effect_type u:object_r:aac_drc_prop:s0 exact int
Merge public/property_contexts into private Originally public/property_contexts was introduced to create a whitelist of system properties which can be accessed from vendor, and to be used from VTS to ensure that the whitelist isn't modified. But it doesn't fit well on sepolicy public/private split as the split isn't for stability, but for letting vendor compile their sepolicy with public types. Also it doesn't make sense only to check the whitelist on VTS, because platform internal ones must also be unchanged. This commit merges public/property_contexts into private as before. This gives consistency with other context files such as file_contexts which are already containing entries for vendor but are only defined in private. This also simplifies property_contexts as there will be only one property_contexts file. Another benefit is that VTS will check all entries defined by system, not only exported ones. Bug: 150331497 Test: m && run VtsTrebleSysProp manually Change-Id: Ib9429e27b645ef21a36946fbaea069a718c3c6eb Merged-In: Ib9429e27b645ef21a36946fbaea069a718c3c6eb (cherry picked from commit 31391fa78e5da1ed29d5bccd4d46165b69adcbfb)
2020-03-09 11:48:37 +01:00
build.version.extensions. u:object_r:module_sdkextensions_prop:s0 prefix int
Relabel drm related props from exported*_prop To clean up bad context name exported[23]_default_prop Bug: 155844385 Test: m selinux_policy Change-Id: I9f9ddb0d44c4cea9bd1724df730bb7be9a6fb2d2
2020-05-25 08:36:44 +02:00
drm.64bit.enabled u:object_r:mediadrm_config_prop:s0 exact bool
media.mediadrmservice.enable u:object_r:mediadrm_config_prop:s0 exact bool
drm.service.enabled u:object_r:drm_service_config_prop:s0 exact bool
Merge public/property_contexts into private Originally public/property_contexts was introduced to create a whitelist of system properties which can be accessed from vendor, and to be used from VTS to ensure that the whitelist isn't modified. But it doesn't fit well on sepolicy public/private split as the split isn't for stability, but for letting vendor compile their sepolicy with public types. Also it doesn't make sense only to check the whitelist on VTS, because platform internal ones must also be unchanged. This commit merges public/property_contexts into private as before. This gives consistency with other context files such as file_contexts which are already containing entries for vendor but are only defined in private. This also simplifies property_contexts as there will be only one property_contexts file. Another benefit is that VTS will check all entries defined by system, not only exported ones. Bug: 150331497 Test: m && run VtsTrebleSysProp manually Change-Id: Ib9429e27b645ef21a36946fbaea069a718c3c6eb Merged-In: Ib9429e27b645ef21a36946fbaea069a718c3c6eb (cherry picked from commit 31391fa78e5da1ed29d5bccd4d46165b69adcbfb)
2020-03-09 11:48:37 +01:00
dumpstate.dry_run u:object_r:exported_dumpstate_prop:s0 exact bool
dumpstate.unroot u:object_r:exported_dumpstate_prop:s0 exact bool
Reland "Add persist.dumpstate.verbose_logging.enabled to system/..." This reverts commit 409c038d3c356c5a9eb418b966d08375c0b65f37. Reason for revert: fixed breakage Bug: 163759751 Test: lunch sdk; m selinux_policy Change-Id: I59d170cd3a764209d353d77372387fdc8719ea7f
2020-08-18 04:25:32 +02:00
persist.dumpstate.verbose_logging.enabled u:object_r:hal_dumpstate_config_prop:s0 exact bool
Merge public/property_contexts into private Originally public/property_contexts was introduced to create a whitelist of system properties which can be accessed from vendor, and to be used from VTS to ensure that the whitelist isn't modified. But it doesn't fit well on sepolicy public/private split as the split isn't for stability, but for letting vendor compile their sepolicy with public types. Also it doesn't make sense only to check the whitelist on VTS, because platform internal ones must also be unchanged. This commit merges public/property_contexts into private as before. This gives consistency with other context files such as file_contexts which are already containing entries for vendor but are only defined in private. This also simplifies property_contexts as there will be only one property_contexts file. Another benefit is that VTS will check all entries defined by system, not only exported ones. Bug: 150331497 Test: m && run VtsTrebleSysProp manually Change-Id: Ib9429e27b645ef21a36946fbaea069a718c3c6eb Merged-In: Ib9429e27b645ef21a36946fbaea069a718c3c6eb (cherry picked from commit 31391fa78e5da1ed29d5bccd4d46165b69adcbfb)
2020-03-09 11:48:37 +01:00
Remove exported2_default_prop This cleans up remaining exported2_default_prop. Three properties are changed. - ro.arch It becomes build_prop. - hal.instrumentation.enable It becomes hal_instrumentation_prop. - ro.property_service.version It becomes property_service_version_prop. Bug: 155844385 Test: selinux denial test on Pixel devices Change-Id: I7ee0bd8c522cc09ee82ef89e6a13bbbf65291291
2020-07-24 17:34:56 +02:00
hal.instrumentation.enable u:object_r:hal_instrumentation_prop:s0 exact bool
Merge public/property_contexts into private Originally public/property_contexts was introduced to create a whitelist of system properties which can be accessed from vendor, and to be used from VTS to ensure that the whitelist isn't modified. But it doesn't fit well on sepolicy public/private split as the split isn't for stability, but for letting vendor compile their sepolicy with public types. Also it doesn't make sense only to check the whitelist on VTS, because platform internal ones must also be unchanged. This commit merges public/property_contexts into private as before. This gives consistency with other context files such as file_contexts which are already containing entries for vendor but are only defined in private. This also simplifies property_contexts as there will be only one property_contexts file. Another benefit is that VTS will check all entries defined by system, not only exported ones. Bug: 150331497 Test: m && run VtsTrebleSysProp manually Change-Id: Ib9429e27b645ef21a36946fbaea069a718c3c6eb Merged-In: Ib9429e27b645ef21a36946fbaea069a718c3c6eb (cherry picked from commit 31391fa78e5da1ed29d5bccd4d46165b69adcbfb)
2020-03-09 11:48:37 +01:00
Add contexts for init.svc.* props To remove bad context names "exported*_prop". Other init.svc.* properties explicitly become system internal prop. Bug: 155844385 Test: boot and see no denials Change-Id: I7a3b4103a4cea77035a6e831e3b6a49a45f15a35
2020-05-14 12:43:08 +02:00
# default contexts only accessible by coredomain
Fix init.svc. property contexts entry It should be prefix, not exact Bug: N/A Test: see selinux contexts of init.svc. properties Change-Id: I3fd71c80f752773b784ddb1d7bfa9ab1854d281f
2020-07-22 12:14:56 +02:00
init.svc. u:object_r:init_service_status_private_prop:s0 prefix string
Add contexts for init.svc.* props To remove bad context names "exported*_prop". Other init.svc.* properties explicitly become system internal prop. Bug: 155844385 Test: boot and see no denials Change-Id: I7a3b4103a4cea77035a6e831e3b6a49a45f15a35
2020-05-14 12:43:08 +02:00
Make init.svc.adbd globally readable. Debuggable Java apps need to be able to tell if adbd is currently running, in order to avoid waking the CPU up to connect to its jdwp service. Bug: http://b/171820667 Test: treehugger Change-Id: I79ce63134f37a007208f66c89a1e0320c651b5a8
2020-11-06 22:25:27 +01:00
# Globally-readable init service props
init.svc.adbd u:object_r:init_service_status_prop:s0 exact string
Add contexts for init.svc.* props To remove bad context names "exported*_prop". Other init.svc.* properties explicitly become system internal prop. Bug: 155844385 Test: boot and see no denials Change-Id: I7a3b4103a4cea77035a6e831e3b6a49a45f15a35
2020-05-14 12:43:08 +02:00
init.svc.bugreport u:object_r:init_service_status_prop:s0 exact string
Allow init.svc.bugreportd to be vendor readable Export the new bugreport entry which was added in b/111441001, similarly to previously exported properties. Bug: 161999587 Test: m selinux_policy Change-Id: I139567ba028e90d3e07df94f57ccf7d5d5225209
2020-07-24 19:54:08 +02:00
init.svc.bugreportd u:object_r:init_service_status_prop:s0 exact string
Add contexts for init.svc.* props To remove bad context names "exported*_prop". Other init.svc.* properties explicitly become system internal prop. Bug: 155844385 Test: boot and see no denials Change-Id: I7a3b4103a4cea77035a6e831e3b6a49a45f15a35
2020-05-14 12:43:08 +02:00
init.svc.console u:object_r:init_service_status_prop:s0 exact string
init.svc.dumpstatez u:object_r:init_service_status_prop:s0 exact string
init.svc.mediadrm u:object_r:init_service_status_prop:s0 exact string
Allow init.svc.statsd to be world readable Instead of having hacky entry "init.svc." in vendor's sepolicy, this adds init.svc.statsd explicitly which should be readable by CTS. Bug: 161922998 Test: m selinux_policy Change-Id: I3fd3bab40d2ccf2581bd7ab55894a693cdf446b2 Merged-In: I3fd3bab40d2ccf2581bd7ab55894a693cdf446b2 (cherry picked from commit 116190b00473c5628d5c5bb73460f7d48a05f0db)
2020-07-23 01:33:24 +02:00
init.svc.statsd u:object_r:init_service_status_prop:s0 exact string
Add contexts for init.svc.* props To remove bad context names "exported*_prop". Other init.svc.* properties explicitly become system internal prop. Bug: 155844385 Test: boot and see no denials Change-Id: I7a3b4103a4cea77035a6e831e3b6a49a45f15a35
2020-05-14 12:43:08 +02:00
init.svc.surfaceflinger u:object_r:init_service_status_prop:s0 exact string
init.svc.tombstoned u:object_r:init_service_status_prop:s0 exact string
init.svc.zygote u:object_r:init_service_status_prop:s0 exact string
Merge public/property_contexts into private Originally public/property_contexts was introduced to create a whitelist of system properties which can be accessed from vendor, and to be used from VTS to ensure that the whitelist isn't modified. But it doesn't fit well on sepolicy public/private split as the split isn't for stability, but for letting vendor compile their sepolicy with public types. Also it doesn't make sense only to check the whitelist on VTS, because platform internal ones must also be unchanged. This commit merges public/property_contexts into private as before. This gives consistency with other context files such as file_contexts which are already containing entries for vendor but are only defined in private. This also simplifies property_contexts as there will be only one property_contexts file. Another benefit is that VTS will check all entries defined by system, not only exported ones. Bug: 150331497 Test: m && run VtsTrebleSysProp manually Change-Id: Ib9429e27b645ef21a36946fbaea069a718c3c6eb Merged-In: Ib9429e27b645ef21a36946fbaea069a718c3c6eb (cherry picked from commit 31391fa78e5da1ed29d5bccd4d46165b69adcbfb)
2020-03-09 11:48:37 +01:00
Move libc.debug. props to libc_debug_prop Bug: 155844385 Test: sepolicy_tests Change-Id: I15421ada0c58c3c8d07d824e83cf44f6c4590ca8
2020-05-06 15:20:35 +02:00
libc.debug.malloc.options u:object_r:libc_debug_prop:s0 exact string
libc.debug.malloc.program u:object_r:libc_debug_prop:s0 exact string
libc.debug.hooks.enable u:object_r:libc_debug_prop:s0 exact string
Merge public/property_contexts into private Originally public/property_contexts was introduced to create a whitelist of system properties which can be accessed from vendor, and to be used from VTS to ensure that the whitelist isn't modified. But it doesn't fit well on sepolicy public/private split as the split isn't for stability, but for letting vendor compile their sepolicy with public types. Also it doesn't make sense only to check the whitelist on VTS, because platform internal ones must also be unchanged. This commit merges public/property_contexts into private as before. This gives consistency with other context files such as file_contexts which are already containing entries for vendor but are only defined in private. This also simplifies property_contexts as there will be only one property_contexts file. Another benefit is that VTS will check all entries defined by system, not only exported ones. Bug: 150331497 Test: m && run VtsTrebleSysProp manually Change-Id: Ib9429e27b645ef21a36946fbaea069a718c3c6eb Merged-In: Ib9429e27b645ef21a36946fbaea069a718c3c6eb (cherry picked from commit 31391fa78e5da1ed29d5bccd4d46165b69adcbfb)
2020-03-09 11:48:37 +01:00
[MTE] Add memtag sysprop sepolicy. These flags should be writeable to the shell for both root and non-root users. They should be readable everywhere, as they're read in libc during initialization (and there's nothing secret to hide). We just don't want to allow apps to set these properties. These properties are non-persistent, are for local developer debugging only. Bug: 135772972 Bug: 172365548 Test: `adb shell setprop memtag.123 0` in non-root shell succeeds. Change-Id: If9ad7123829b0be27c29050f10081d2aecdef670
2020-12-04 02:23:06 +01:00
# shell-only props for ARM memory tagging (MTE).
arm64.memtag. u:object_r:arm64_memtag_prop:s0 prefix string
Merge public/property_contexts into private Originally public/property_contexts was introduced to create a whitelist of system properties which can be accessed from vendor, and to be used from VTS to ensure that the whitelist isn't modified. But it doesn't fit well on sepolicy public/private split as the split isn't for stability, but for letting vendor compile their sepolicy with public types. Also it doesn't make sense only to check the whitelist on VTS, because platform internal ones must also be unchanged. This commit merges public/property_contexts into private as before. This gives consistency with other context files such as file_contexts which are already containing entries for vendor but are only defined in private. This also simplifies property_contexts as there will be only one property_contexts file. Another benefit is that VTS will check all entries defined by system, not only exported ones. Bug: 150331497 Test: m && run VtsTrebleSysProp manually Change-Id: Ib9429e27b645ef21a36946fbaea069a718c3c6eb Merged-In: Ib9429e27b645ef21a36946fbaea069a718c3c6eb (cherry picked from commit 31391fa78e5da1ed29d5bccd4d46165b69adcbfb)
2020-03-09 11:48:37 +01:00
net.redirect_socket_calls.hooked u:object_r:socket_hook_prop:s0 exact bool
persist.sys.locale u:object_r:exported_system_prop:s0 exact string
persist.sys.timezone u:object_r:exported_system_prop:s0 exact string
persist.sys.test_harness u:object_r:test_harness_prop:s0 exact bool
Remove exported2_default_prop This cleans up remaining exported2_default_prop. Three properties are changed. - ro.arch It becomes build_prop. - hal.instrumentation.enable It becomes hal_instrumentation_prop. - ro.property_service.version It becomes property_service_version_prop. Bug: 155844385 Test: selinux denial test on Pixel devices Change-Id: I7ee0bd8c522cc09ee82ef89e6a13bbbf65291291
2020-07-24 17:34:56 +02:00
ro.arch u:object_r:build_prop:s0 exact string
Merge public/property_contexts into private Originally public/property_contexts was introduced to create a whitelist of system properties which can be accessed from vendor, and to be used from VTS to ensure that the whitelist isn't modified. But it doesn't fit well on sepolicy public/private split as the split isn't for stability, but for letting vendor compile their sepolicy with public types. Also it doesn't make sense only to check the whitelist on VTS, because platform internal ones must also be unchanged. This commit merges public/property_contexts into private as before. This gives consistency with other context files such as file_contexts which are already containing entries for vendor but are only defined in private. This also simplifies property_contexts as there will be only one property_contexts file. Another benefit is that VTS will check all entries defined by system, not only exported ones. Bug: 150331497 Test: m && run VtsTrebleSysProp manually Change-Id: Ib9429e27b645ef21a36946fbaea069a718c3c6eb Merged-In: Ib9429e27b645ef21a36946fbaea069a718c3c6eb (cherry picked from commit 31391fa78e5da1ed29d5bccd4d46165b69adcbfb)
2020-03-09 11:48:37 +01:00
Add bootloader_prop for ro.boot. properties ro.boot. properties assigned as "exported2_default_prop" are now "bootloader_prop", to remove bad context name "exported2_default_prop". Two things to clarify: 1) We have both the prefix entry and the exact entries. Although the exact entries may be redundant, we may want to keep them. Vendors are still allowed to have properties starting with "ro.boot." on vendor_property_contexts file. The exact entries can prevent vendors from modifying them to random contexts. 2) ro.boot. is special as it is originally for kernel command line "androidboot.". But some ro.boot. properties are being used as if they were normal. To avoid regression, ro.boot. properties having contexts other than "exported2_default_prop" are not changed here. They will be tracked later. Bug: 155844385 Test: m selinux_policy Change-Id: Ic0f4117ae68a828787304187457b5e1e105a52c7 Merged-In: Ic0f4117ae68a828787304187457b5e1e105a52c7
2020-07-23 10:54:35 +02:00
# ro.boot. properties are set based on kernel commandline arguments, which are vendor owned.
ro.boot. u:object_r:bootloader_prop:s0
ro.boot.avb_version u:object_r:bootloader_prop:s0 exact string
ro.boot.baseband u:object_r:bootloader_prop:s0 exact string
ro.boot.bootdevice u:object_r:bootloader_prop:s0 exact string
ro.boot.bootloader u:object_r:bootloader_prop:s0 exact string
ro.boot.boottime u:object_r:bootloader_prop:s0 exact string
ro.boot.console u:object_r:bootloader_prop:s0 exact string
ro.boot.hardware u:object_r:bootloader_prop:s0 exact string
ro.boot.hardware.color u:object_r:bootloader_prop:s0 exact string
ro.boot.hardware.sku u:object_r:bootloader_prop:s0 exact string
ro.boot.keymaster u:object_r:bootloader_prop:s0 exact string
ro.boot.mode u:object_r:bootloader_prop:s0 exact string
Label `ro.boot.qemu` This is an Android Studio Emulator (aka ranchu) specific property, it is used for emulator specific workarounds. Bug: 182291166 Test: presubmit Signed-off-by: Roman Kiryanov <rkir@google.com> Change-Id: I2b8daf7c8ddb05b4082e4229f7b606c6ad4e717e
2021-04-15 05:36:55 +02:00
# Populated on Android Studio Emulator (for emulator specific workarounds)
ro.boot.qemu u:object_r:bootloader_prop:s0 exact bool
Add bootloader_prop for ro.boot. properties ro.boot. properties assigned as "exported2_default_prop" are now "bootloader_prop", to remove bad context name "exported2_default_prop". Two things to clarify: 1) We have both the prefix entry and the exact entries. Although the exact entries may be redundant, we may want to keep them. Vendors are still allowed to have properties starting with "ro.boot." on vendor_property_contexts file. The exact entries can prevent vendors from modifying them to random contexts. 2) ro.boot. is special as it is originally for kernel command line "androidboot.". But some ro.boot. properties are being used as if they were normal. To avoid regression, ro.boot. properties having contexts other than "exported2_default_prop" are not changed here. They will be tracked later. Bug: 155844385 Test: m selinux_policy Change-Id: Ic0f4117ae68a828787304187457b5e1e105a52c7 Merged-In: Ic0f4117ae68a828787304187457b5e1e105a52c7
2020-07-23 10:54:35 +02:00
ro.boot.revision u:object_r:bootloader_prop:s0 exact string
ro.boot.vbmeta.avb_version u:object_r:bootloader_prop:s0 exact string
ro.boot.verifiedbootstate u:object_r:bootloader_prop:s0 exact string
ro.boot.veritymode u:object_r:bootloader_prop:s0 exact string
Move ro.boot related properties to bootloader_prop These 5 properties are all set by property_service, and their values are same as ro.boot.X. Bug: 155844385 Test: m selinux_policy Change-Id: I98fdee73684dc670f61ecef83d6a749b4f24ff54 Merged-In: I98fdee73684dc670f61ecef83d6a749b4f24ff54
2020-07-24 09:53:56 +02:00
# These ro.X properties are set to values of ro.boot.X by property_service.
ro.baseband u:object_r:bootloader_prop:s0 exact string
ro.bootloader u:object_r:bootloader_prop:s0 exact string
ro.bootmode u:object_r:bootloader_prop:s0 exact string
ro.hardware u:object_r:bootloader_prop:s0 exact string
ro.revision u:object_r:bootloader_prop:s0 exact string
Merge public/property_contexts into private Originally public/property_contexts was introduced to create a whitelist of system properties which can be accessed from vendor, and to be used from VTS to ensure that the whitelist isn't modified. But it doesn't fit well on sepolicy public/private split as the split isn't for stability, but for letting vendor compile their sepolicy with public types. Also it doesn't make sense only to check the whitelist on VTS, because platform internal ones must also be unchanged. This commit merges public/property_contexts into private as before. This gives consistency with other context files such as file_contexts which are already containing entries for vendor but are only defined in private. This also simplifies property_contexts as there will be only one property_contexts file. Another benefit is that VTS will check all entries defined by system, not only exported ones. Bug: 150331497 Test: m && run VtsTrebleSysProp manually Change-Id: Ib9429e27b645ef21a36946fbaea069a718c3c6eb Merged-In: Ib9429e27b645ef21a36946fbaea069a718c3c6eb (cherry picked from commit 31391fa78e5da1ed29d5bccd4d46165b69adcbfb)
2020-03-09 11:48:37 +01:00
ro.boot.dynamic_partitions u:object_r:exported_default_prop:s0 exact string
ro.boot.dynamic_partitions_retrofit u:object_r:exported_default_prop:s0 exact string
Merge public/property_contexts into private Originally public/property_contexts was introduced to create a whitelist of system properties which can be accessed from vendor, and to be used from VTS to ensure that the whitelist isn't modified. But it doesn't fit well on sepolicy public/private split as the split isn't for stability, but for letting vendor compile their sepolicy with public types. Also it doesn't make sense only to check the whitelist on VTS, because platform internal ones must also be unchanged. This commit merges public/property_contexts into private as before. This gives consistency with other context files such as file_contexts which are already containing entries for vendor but are only defined in private. This also simplifies property_contexts as there will be only one property_contexts file. Another benefit is that VTS will check all entries defined by system, not only exported ones. Bug: 150331497 Test: m && run VtsTrebleSysProp manually Change-Id: Ib9429e27b645ef21a36946fbaea069a718c3c6eb Merged-In: Ib9429e27b645ef21a36946fbaea069a718c3c6eb (cherry picked from commit 31391fa78e5da1ed29d5bccd4d46165b69adcbfb)
2020-03-09 11:48:37 +01:00
ro.boottime.init.mount.data u:object_r:boottime_public_prop:s0 exact string
ro.boottime.init.fsck.data u:object_r:boottime_public_prop:s0 exact string
Add missing build.prop related properties ro.actionable_compatible_property.enabled and ro.treble.enabled are in system/build.prop, so they are assigned as build_prop. The other added properties are introduced by build/make/core/sysprop.mk. Bug: 170590987 Test: boot and see default_prop Change-Id: I2ec1df99985ca81d27e657750eb8895fe4b85b35 Merged-In: I2ec1df99985ca81d27e657750eb8895fe4b85b35
2020-11-03 09:08:35 +01:00
ro.build.characteristics u:object_r:build_prop:s0 exact string
ro.build.date u:object_r:build_prop:s0 exact string
ro.build.date.utc u:object_r:build_prop:s0 exact int
ro.build.description u:object_r:build_prop:s0 exact string
ro.build.display.id u:object_r:build_prop:s0 exact string
ro.build.flavor u:object_r:build_prop:s0 exact string
ro.build.host u:object_r:build_prop:s0 exact string
ro.build.id u:object_r:build_prop:s0 exact string
ro.build.product u:object_r:build_prop:s0 exact string
ro.build.system_root_image u:object_r:build_prop:s0 exact bool
ro.build.tags u:object_r:build_prop:s0 exact string
ro.build.type u:object_r:build_prop:s0 exact string
ro.build.user u:object_r:build_prop:s0 exact string
ro.build.version.all_codenames u:object_r:build_prop:s0 exact string
ro.build.version.base_os u:object_r:build_prop:s0 exact string
ro.build.version.codename u:object_r:build_prop:s0 exact string
ro.build.version.incremental u:object_r:build_prop:s0 exact string
ro.build.version.min_supported_target_sdk u:object_r:build_prop:s0 exact int
ro.build.version.preview_sdk u:object_r:build_prop:s0 exact int
ro.build.version.preview_sdk_fingerprint u:object_r:build_prop:s0 exact string
ro.build.version.release u:object_r:build_prop:s0 exact string
ro.build.version.release_or_codename u:object_r:build_prop:s0 exact string
ro.build.version.sdk u:object_r:build_prop:s0 exact int
ro.build.version.security_patch u:object_r:build_prop:s0 exact string
ro.actionable_compatible_property.enabled u:object_r:build_prop:s0 exact bool
Relabel ro.build. properties - exported_fingerprint_prop is deleted - other ro.build. properties become build_prop Bug: 155844385 Test: sepolicy_tests Change-Id: Ic1194e8e7c23394e5a7c6176f9f9598109bb5fb7 Merged-In: Ic1194e8e7c23394e5a7c6176f9f9598109bb5fb7 (cherry picked from commit 1d63d5d0756d0d47ef6ec816b3c35b3b96bd50d4)
2020-05-06 13:07:33 +02:00
ro.debuggable u:object_r:build_prop:s0 exact bool
Merge public/property_contexts into private Originally public/property_contexts was introduced to create a whitelist of system properties which can be accessed from vendor, and to be used from VTS to ensure that the whitelist isn't modified. But it doesn't fit well on sepolicy public/private split as the split isn't for stability, but for letting vendor compile their sepolicy with public types. Also it doesn't make sense only to check the whitelist on VTS, because platform internal ones must also be unchanged. This commit merges public/property_contexts into private as before. This gives consistency with other context files such as file_contexts which are already containing entries for vendor but are only defined in private. This also simplifies property_contexts as there will be only one property_contexts file. Another benefit is that VTS will check all entries defined by system, not only exported ones. Bug: 150331497 Test: m && run VtsTrebleSysProp manually Change-Id: Ib9429e27b645ef21a36946fbaea069a718c3c6eb Merged-In: Ib9429e27b645ef21a36946fbaea069a718c3c6eb (cherry picked from commit 31391fa78e5da1ed29d5bccd4d46165b69adcbfb)
2020-03-09 11:48:37 +01:00
Add missing build.prop related properties ro.actionable_compatible_property.enabled and ro.treble.enabled are in system/build.prop, so they are assigned as build_prop. The other added properties are introduced by build/make/core/sysprop.mk. Bug: 170590987 Test: boot and see default_prop Change-Id: I2ec1df99985ca81d27e657750eb8895fe4b85b35 Merged-In: I2ec1df99985ca81d27e657750eb8895fe4b85b35
2020-11-03 09:08:35 +01:00
ro.treble.enabled u:object_r:build_prop:s0 exact bool
Refine build.prop related properties 1) build_odm_prop and build_vendor_prop are added These contexts will contain world-readable properties from /odm/build.prop and /vendor/build.prop, respectively. 2) move more properties to build_prop Following properties are set by /system/build.prop and now assigned as build_prop: - ro.adb.secure - ro.build.type - ro.product.cpu.abi - ro.product.cpu.abilist - ro.product.cpu.abilist32 - ro.product.cpu.abilist64 - ro.secure Following properties are set by init/property_service.cpp and now assigned as build_prop: - ro.product.brand - ro.product.device - ro.product.manufacturer - ro.product.model - ro.product.name Bug: 71814576 Bug: 155844385 Test: boot device and see no denials Change-Id: Idd4f81de4d2d0fc4bdec2d7ecb08bb8e078dab58
2020-05-19 15:02:58 +02:00
ro.product.cpu.abi u:object_r:build_prop:s0 exact string
ro.product.cpu.abilist u:object_r:build_prop:s0 exact string
ro.product.cpu.abilist32 u:object_r:build_prop:s0 exact string
ro.product.cpu.abilist64 u:object_r:build_prop:s0 exact string
Add missing build.prop related properties ro.actionable_compatible_property.enabled and ro.treble.enabled are in system/build.prop, so they are assigned as build_prop. The other added properties are introduced by build/make/core/sysprop.mk. Bug: 170590987 Test: boot and see default_prop Change-Id: I2ec1df99985ca81d27e657750eb8895fe4b85b35 Merged-In: I2ec1df99985ca81d27e657750eb8895fe4b85b35
2020-11-03 09:08:35 +01:00
ro.product.system.brand u:object_r:build_prop:s0 exact string
ro.product.system.device u:object_r:build_prop:s0 exact string
ro.product.system.manufacturer u:object_r:build_prop:s0 exact string
ro.product.system.model u:object_r:build_prop:s0 exact string
ro.product.system.name u:object_r:build_prop:s0 exact string
ro.system.build.date u:object_r:build_prop:s0 exact string
ro.system.build.date.utc u:object_r:build_prop:s0 exact int
ro.system.build.fingerprint u:object_r:build_prop:s0 exact string
ro.system.build.id u:object_r:build_prop:s0 exact string
ro.system.build.tags u:object_r:build_prop:s0 exact string
ro.system.build.type u:object_r:build_prop:s0 exact string
ro.system.build.version.incremental u:object_r:build_prop:s0 exact string
ro.system.build.version.release u:object_r:build_prop:s0 exact string
ro.system.build.version.release_or_codename u:object_r:build_prop:s0 exact string
ro.system.build.version.sdk u:object_r:build_prop:s0 exact int
Refine build.prop related properties 1) build_odm_prop and build_vendor_prop are added These contexts will contain world-readable properties from /odm/build.prop and /vendor/build.prop, respectively. 2) move more properties to build_prop Following properties are set by /system/build.prop and now assigned as build_prop: - ro.adb.secure - ro.build.type - ro.product.cpu.abi - ro.product.cpu.abilist - ro.product.cpu.abilist32 - ro.product.cpu.abilist64 - ro.secure Following properties are set by init/property_service.cpp and now assigned as build_prop: - ro.product.brand - ro.product.device - ro.product.manufacturer - ro.product.model - ro.product.name Bug: 71814576 Bug: 155844385 Test: boot device and see no denials Change-Id: Idd4f81de4d2d0fc4bdec2d7ecb08bb8e078dab58
2020-05-19 15:02:58 +02:00
ro.adb.secure u:object_r:build_prop:s0 exact bool
ro.secure u:object_r:build_prop:s0 exact int
Add missing build.prop related properties ro.actionable_compatible_property.enabled and ro.treble.enabled are in system/build.prop, so they are assigned as build_prop. The other added properties are introduced by build/make/core/sysprop.mk. Bug: 170590987 Test: boot and see default_prop Change-Id: I2ec1df99985ca81d27e657750eb8895fe4b85b35 Merged-In: I2ec1df99985ca81d27e657750eb8895fe4b85b35
2020-11-03 09:08:35 +01:00
ro.product.system_ext.brand u:object_r:build_prop:s0 exact string
ro.product.system_ext.device u:object_r:build_prop:s0 exact string
ro.product.system_ext.manufacturer u:object_r:build_prop:s0 exact string
ro.product.system_ext.model u:object_r:build_prop:s0 exact string
ro.product.system_ext.name u:object_r:build_prop:s0 exact string
ro.system_ext.build.date u:object_r:build_prop:s0 exact string
ro.system_ext.build.date.utc u:object_r:build_prop:s0 exact int
ro.system_ext.build.fingerprint u:object_r:build_prop:s0 exact string
ro.system_ext.build.id u:object_r:build_prop:s0 exact string
ro.system_ext.build.tags u:object_r:build_prop:s0 exact string
ro.system_ext.build.type u:object_r:build_prop:s0 exact string
ro.system_ext.build.version.incremental u:object_r:build_prop:s0 exact string
ro.system_ext.build.version.release u:object_r:build_prop:s0 exact string
ro.system_ext.build.version.release_or_codename u:object_r:build_prop:s0 exact string
ro.system_ext.build.version.sdk u:object_r:build_prop:s0 exact int
# These ro.product.product.* and ro.product.build.* are set by /product/etc/build.prop
ro.product.product.brand u:object_r:build_prop:s0 exact string
ro.product.product.device u:object_r:build_prop:s0 exact string
ro.product.product.manufacturer u:object_r:build_prop:s0 exact string
ro.product.product.model u:object_r:build_prop:s0 exact string
ro.product.product.name u:object_r:build_prop:s0 exact string
ro.product.build.date u:object_r:build_prop:s0 exact string
ro.product.build.date.utc u:object_r:build_prop:s0 exact int
ro.product.build.fingerprint u:object_r:build_prop:s0 exact string
ro.product.build.id u:object_r:build_prop:s0 exact string
ro.product.build.tags u:object_r:build_prop:s0 exact string
ro.product.build.type u:object_r:build_prop:s0 exact string
ro.product.build.version.incremental u:object_r:build_prop:s0 exact string
ro.product.build.version.release u:object_r:build_prop:s0 exact string
ro.product.build.version.release_or_codename u:object_r:build_prop:s0 exact string
ro.product.build.version.sdk u:object_r:build_prop:s0 exact int
Refine build.prop related properties 1) build_odm_prop and build_vendor_prop are added These contexts will contain world-readable properties from /odm/build.prop and /vendor/build.prop, respectively. 2) move more properties to build_prop Following properties are set by /system/build.prop and now assigned as build_prop: - ro.adb.secure - ro.build.type - ro.product.cpu.abi - ro.product.cpu.abilist - ro.product.cpu.abilist32 - ro.product.cpu.abilist64 - ro.secure Following properties are set by init/property_service.cpp and now assigned as build_prop: - ro.product.brand - ro.product.device - ro.product.manufacturer - ro.product.model - ro.product.name Bug: 71814576 Bug: 155844385 Test: boot device and see no denials Change-Id: Idd4f81de4d2d0fc4bdec2d7ecb08bb8e078dab58
2020-05-19 15:02:58 +02:00
# These 5 properties are set by property_service
ro.product.brand u:object_r:build_prop:s0 exact string
ro.product.device u:object_r:build_prop:s0 exact string
ro.product.manufacturer u:object_r:build_prop:s0 exact string
ro.product.model u:object_r:build_prop:s0 exact string
ro.product.name u:object_r:build_prop:s0 exact string
Property contexts for ro.sanitize.* Bug: 142430632 Test: adb shell getprop ro.sanitize.hwaddress in hwasan build Change-Id: I106ed955c7c0c73234e55d1b896b446b75a251cc
2019-10-10 02:20:59 +02:00
# Sanitizer properties
ro.sanitize.address u:object_r:build_prop:s0 exact bool
ro.sanitize.cfi u:object_r:build_prop:s0 exact bool
ro.sanitize.default-ub u:object_r:build_prop:s0 exact bool
ro.sanitize.fuzzer u:object_r:build_prop:s0 exact bool
ro.sanitize.hwaddress u:object_r:build_prop:s0 exact bool
ro.sanitize.integer_overflow u:object_r:build_prop:s0 exact bool
ro.sanitize.safe-stack u:object_r:build_prop:s0 exact bool
ro.sanitize.scudo u:object_r:build_prop:s0 exact bool
ro.sanitize.thread u:object_r:build_prop:s0 exact bool
ro.sanitize.undefined u:object_r:build_prop:s0 exact bool
Refine build.prop related properties 1) build_odm_prop and build_vendor_prop are added These contexts will contain world-readable properties from /odm/build.prop and /vendor/build.prop, respectively. 2) move more properties to build_prop Following properties are set by /system/build.prop and now assigned as build_prop: - ro.adb.secure - ro.build.type - ro.product.cpu.abi - ro.product.cpu.abilist - ro.product.cpu.abilist32 - ro.product.cpu.abilist64 - ro.secure Following properties are set by init/property_service.cpp and now assigned as build_prop: - ro.product.brand - ro.product.device - ro.product.manufacturer - ro.product.model - ro.product.name Bug: 71814576 Bug: 155844385 Test: boot device and see no denials Change-Id: Idd4f81de4d2d0fc4bdec2d7ecb08bb8e078dab58
2020-05-19 15:02:58 +02:00
# All odm build props are set by /odm/build.prop
ro.odm.build.date u:object_r:build_odm_prop:s0 exact string
ro.odm.build.date.utc u:object_r:build_odm_prop:s0 exact int
ro.odm.build.fingerprint u:object_r:build_odm_prop:s0 exact string
ro.odm.build.version.incremental u:object_r:build_odm_prop:s0 exact string
Add media performance class property to sepolicy Bug: 175813535 Change-Id: Ic47e6b2871e8085808462070d8bd28b16c07839d
2021-02-24 01:29:22 +01:00
ro.odm.build.media_performance_class u:object_r:build_odm_prop:s0 exact int
Refine build.prop related properties 1) build_odm_prop and build_vendor_prop are added These contexts will contain world-readable properties from /odm/build.prop and /vendor/build.prop, respectively. 2) move more properties to build_prop Following properties are set by /system/build.prop and now assigned as build_prop: - ro.adb.secure - ro.build.type - ro.product.cpu.abi - ro.product.cpu.abilist - ro.product.cpu.abilist32 - ro.product.cpu.abilist64 - ro.secure Following properties are set by init/property_service.cpp and now assigned as build_prop: - ro.product.brand - ro.product.device - ro.product.manufacturer - ro.product.model - ro.product.name Bug: 71814576 Bug: 155844385 Test: boot device and see no denials Change-Id: Idd4f81de4d2d0fc4bdec2d7ecb08bb8e078dab58
2020-05-19 15:02:58 +02:00
ro.product.odm.brand u:object_r:build_odm_prop:s0 exact string
ro.product.odm.device u:object_r:build_odm_prop:s0 exact string
ro.product.odm.manufacturer u:object_r:build_odm_prop:s0 exact string
ro.product.odm.model u:object_r:build_odm_prop:s0 exact string
ro.product.odm.name u:object_r:build_odm_prop:s0 exact string
Fix path for vendor_dlkm build prop. vendor_dlkm build props are loaded from /vendor_dlkm/etc/build.prop. Test: none Bug: 154633114 Change-Id: Ic96ebba2486c891fb05431265e477184353bd7d0
2020-07-16 02:12:15 +02:00
# All vendor_dlkm build props are set by /vendor_dlkm/etc/build.prop
Add missing build.prop related properties ro.actionable_compatible_property.enabled and ro.treble.enabled are in system/build.prop, so they are assigned as build_prop. The other added properties are introduced by build/make/core/sysprop.mk. Bug: 170590987 Test: boot and see default_prop Change-Id: I2ec1df99985ca81d27e657750eb8895fe4b85b35 Merged-In: I2ec1df99985ca81d27e657750eb8895fe4b85b35
2020-11-03 09:08:35 +01:00
ro.vendor_dlkm.build.date u:object_r:build_vendor_prop:s0 exact string
ro.vendor_dlkm.build.date.utc u:object_r:build_vendor_prop:s0 exact int
ro.vendor_dlkm.build.fingerprint u:object_r:build_vendor_prop:s0 exact string
ro.vendor_dlkm.build.id u:object_r:build_vendor_prop:s0 exact string
ro.vendor_dlkm.build.tags u:object_r:build_vendor_prop:s0 exact string
ro.vendor_dlkm.build.type u:object_r:build_vendor_prop:s0 exact string
ro.vendor_dlkm.build.version.incremental u:object_r:build_vendor_prop:s0 exact string
ro.vendor_dlkm.build.version.release u:object_r:build_vendor_prop:s0 exact string
ro.vendor_dlkm.build.version.release_or_codename u:object_r:build_vendor_prop:s0 exact string
ro.vendor_dlkm.build.version.sdk u:object_r:build_vendor_prop:s0 exact int
Correct labels on files / props in vendor_dlkm. All files under vendor_dlkm are tagged vendor_file. All build props for vendor_dlkm are mapped as build_vendor_prop. Test: build and `ls /vendor_dlkm -lZ` `adb shell getprop -Z | grep vendor_dlkm` Bug: 154633114 Change-Id: Ie9dc26d948357767fec09aca645606310ad3425c
2020-05-14 05:44:19 +02:00
Correct labels on files / props in odm_dlkm. All files under odm_dlkm are tagged vendor_file. All build props for odm_dlkm are mapped as build_vendor_prop. Test: build and `ls /odm_dlkm -lZ` `adb shell getprop -Z | grep odm_dlkm` Bug: 154633114 Change-Id: Ifca69d0b7a8da945910a9cb0fa907735cd866f12
2020-07-16 02:11:17 +02:00
# All odm_dlkm build props are set by /odm_dlkm/etc/build.prop
Label the odm_dlkm properties in "odm_dlkm/etc/build.prop" Test: make selinux_policy Bug: 185920634 Change-Id: I09eec15a8a2e2b2f64075f148b414bf89f8ebcd6
2021-05-04 09:19:49 +02:00
ro.product.odm_dlkm.brand u:object_r:build_odm_prop:s0 exact string
ro.product.odm_dlkm.device u:object_r:build_odm_prop:s0 exact string
ro.product.odm_dlkm.manufacturer u:object_r:build_odm_prop:s0 exact string
ro.product.odm_dlkm.model u:object_r:build_odm_prop:s0 exact string
ro.product.odm_dlkm.name u:object_r:build_odm_prop:s0 exact string
ro.odm_dlkm.build.date u:object_r:build_odm_prop:s0 exact string
ro.odm_dlkm.build.date.utc u:object_r:build_odm_prop:s0 exact int
ro.odm_dlkm.build.fingerprint u:object_r:build_odm_prop:s0 exact string
ro.odm_dlkm.build.id u:object_r:build_odm_prop:s0 exact string
ro.odm_dlkm.build.tags u:object_r:build_odm_prop:s0 exact string
ro.odm_dlkm.build.type u:object_r:build_odm_prop:s0 exact string
ro.odm_dlkm.build.version.incremental u:object_r:build_odm_prop:s0 exact string
ro.odm_dlkm.build.version.release u:object_r:build_odm_prop:s0 exact string
ro.odm_dlkm.build.version.release_or_codename u:object_r:build_odm_prop:s0 exact string
ro.odm_dlkm.build.version.sdk u:object_r:build_odm_prop:s0 exact int
Correct labels on files / props in odm_dlkm. All files under odm_dlkm are tagged vendor_file. All build props for odm_dlkm are mapped as build_vendor_prop. Test: build and `ls /odm_dlkm -lZ` `adb shell getprop -Z | grep odm_dlkm` Bug: 154633114 Change-Id: Ifca69d0b7a8da945910a9cb0fa907735cd866f12
2020-07-16 02:11:17 +02:00
Add a property to enable runtime debugfs restrictions in non-user builds This patch adds ro.product.enforce_debugfs_restrictions to property_contexts. When the property is set to true in non-user builds, init mounts debugfs in early-init to enable boot-time debugfs initializations and unmounts it on boot complete. Similarly dumpstate will mount debugfs to collect information from debugfs during bugreport collection via the dumpstate HAL and unmount debugfs once done. Doing so will allow non-user builds to keep debugfs disabled during runtime. Test: make with/without PRODUCT_SET_DEBUGFS_RESTRICTIONS, adb shell am bugreport Bug: 184381659 Change-Id: Ib720523c7f94a4f9ce944d46977a3c01ed829414
2021-04-01 07:07:02 +02:00
# enforces debugfs restrictions in non-user builds, set by /vendor/build.prop
ro.product.debugfs_restrictions.enabled u:object_r:debugfs_restriction_prop:s0 exact bool
Refine build.prop related properties 1) build_odm_prop and build_vendor_prop are added These contexts will contain world-readable properties from /odm/build.prop and /vendor/build.prop, respectively. 2) move more properties to build_prop Following properties are set by /system/build.prop and now assigned as build_prop: - ro.adb.secure - ro.build.type - ro.product.cpu.abi - ro.product.cpu.abilist - ro.product.cpu.abilist32 - ro.product.cpu.abilist64 - ro.secure Following properties are set by init/property_service.cpp and now assigned as build_prop: - ro.product.brand - ro.product.device - ro.product.manufacturer - ro.product.model - ro.product.name Bug: 71814576 Bug: 155844385 Test: boot device and see no denials Change-Id: Idd4f81de4d2d0fc4bdec2d7ecb08bb8e078dab58
2020-05-19 15:02:58 +02:00
# All vendor build props are set by /vendor/build.prop
Add missing build.prop related properties ro.actionable_compatible_property.enabled and ro.treble.enabled are in system/build.prop, so they are assigned as build_prop. The other added properties are introduced by build/make/core/sysprop.mk. Bug: 170590987 Test: boot and see default_prop Change-Id: I2ec1df99985ca81d27e657750eb8895fe4b85b35 Merged-In: I2ec1df99985ca81d27e657750eb8895fe4b85b35
2020-11-03 09:08:35 +01:00
ro.vendor.build.date u:object_r:build_vendor_prop:s0 exact string
ro.vendor.build.date.utc u:object_r:build_vendor_prop:s0 exact int
ro.vendor.build.fingerprint u:object_r:build_vendor_prop:s0 exact string
ro.vendor.build.id u:object_r:build_vendor_prop:s0 exact string
ro.vendor.build.tags u:object_r:build_vendor_prop:s0 exact string
ro.vendor.build.type u:object_r:build_vendor_prop:s0 exact string
ro.vendor.build.version.incremental u:object_r:build_vendor_prop:s0 exact string
ro.vendor.build.version.release u:object_r:build_vendor_prop:s0 exact string
ro.vendor.build.version.release_or_codename u:object_r:build_vendor_prop:s0 exact string
ro.vendor.build.version.sdk u:object_r:build_vendor_prop:s0 exact int
Add ro.bootimage.* property contexts In addition, allow shell to read this property. Test: getprop -Z Test: cts-tradefed run cts -m CtsGestureTestCases and check /sdcard/device-info-files/PropertyDeviceInfo.deviceinfo.json Bug: 169169031 Change-Id: Ib71b01bac326354696e159129f9dea4c2e918c51
2020-10-07 02:52:17 +02:00
Export ro.vendor.product.cpu.abilist* Bug: 173452246 Test: Read these properties from system_server Change-Id: I26b8bbe153d55a2761ecc304a490a03a27156667
2020-11-26 10:13:27 +01:00
# All vendor CPU abilist props are set by /vendor/build.prop
ro.vendor.product.cpu.abilist u:object_r:build_vendor_prop:s0 exact string
ro.vendor.product.cpu.abilist32 u:object_r:build_vendor_prop:s0 exact string
ro.vendor.product.cpu.abilist64 u:object_r:build_vendor_prop:s0 exact string
sepolicy: add ro.product.vendor_dlkm coverage Bug: 186747827 Signed-off-by: Oleg Matcovschi <omatcovschi@google.com> Change-Id: I51801feeaf67537e6628cf34b4b7425b075f711b
2021-04-29 02:24:31 +02:00
ro.product.board u:object_r:build_vendor_prop:s0 exact string
ro.product.first_api_level u:object_r:build_vendor_prop:s0 exact int
ro.product.vendor.brand u:object_r:build_vendor_prop:s0 exact string
ro.product.vendor.device u:object_r:build_vendor_prop:s0 exact string
ro.product.vendor.manufacturer u:object_r:build_vendor_prop:s0 exact string
ro.product.vendor.model u:object_r:build_vendor_prop:s0 exact string
ro.product.vendor.name u:object_r:build_vendor_prop:s0 exact string
ro.product.vendor_dlkm.brand u:object_r:build_vendor_prop:s0 exact string
ro.product.vendor_dlkm.device u:object_r:build_vendor_prop:s0 exact string
ro.product.vendor_dlkm.manufacturer u:object_r:build_vendor_prop:s0 exact string
ro.product.vendor_dlkm.model u:object_r:build_vendor_prop:s0 exact string
ro.product.vendor_dlkm.name u:object_r:build_vendor_prop:s0 exact string
Refine build.prop related properties 1) build_odm_prop and build_vendor_prop are added These contexts will contain world-readable properties from /odm/build.prop and /vendor/build.prop, respectively. 2) move more properties to build_prop Following properties are set by /system/build.prop and now assigned as build_prop: - ro.adb.secure - ro.build.type - ro.product.cpu.abi - ro.product.cpu.abilist - ro.product.cpu.abilist32 - ro.product.cpu.abilist64 - ro.secure Following properties are set by init/property_service.cpp and now assigned as build_prop: - ro.product.brand - ro.product.device - ro.product.manufacturer - ro.product.model - ro.product.name Bug: 71814576 Bug: 155844385 Test: boot device and see no denials Change-Id: Idd4f81de4d2d0fc4bdec2d7ecb08bb8e078dab58
2020-05-19 15:02:58 +02:00
Define ro.board.first_api_level property When a device define BOARD_SHIPPING_API_LEVEL with an API level, it sets a vendor property ro.board.first_api_level in vendor/build.prop. This property is initiated by vendor_init and read-only. Bug: 176950752 Test: getprop ro.board.first_api_level Change-Id: Ia09d2e80f1ca4a79dbe4eb0dc11b189644819cad
2021-03-17 07:06:44 +01:00
# GRF property for the first api level of the vendor partition
ro.board.first_api_level u:object_r:build_vendor_prop:s0 exact int
Define ro.board.api_level property ro.board.api_level shows the current vendor api level under GRF. It can be manually defined by setting BOARD_API_LEVEL. Unless BOARD_API_LEVEL is defined, the ro.board.api_level property will be defined automatically based on BOARD_SHIPPING_API_LEVEL and PLATFORM_SDK_VERSION. Bug: 176950752 Test: getprop ro.board.api_level Change-Id: I03eeec8d8206abdd0565423d1b6a507d86d9b168
2021-04-07 02:02:44 +02:00
ro.board.api_level u:object_r:build_vendor_prop:s0 exact int
Define ro.board.first_api_level property When a device define BOARD_SHIPPING_API_LEVEL with an API level, it sets a vendor property ro.board.first_api_level in vendor/build.prop. This property is initiated by vendor_init and read-only. Bug: 176950752 Test: getprop ro.board.first_api_level Change-Id: Ia09d2e80f1ca4a79dbe4eb0dc11b189644819cad
2021-03-17 07:06:44 +01:00
Add missing build.prop related properties ro.actionable_compatible_property.enabled and ro.treble.enabled are in system/build.prop, so they are assigned as build_prop. The other added properties are introduced by build/make/core/sysprop.mk. Bug: 170590987 Test: boot and see default_prop Change-Id: I2ec1df99985ca81d27e657750eb8895fe4b85b35 Merged-In: I2ec1df99985ca81d27e657750eb8895fe4b85b35
2020-11-03 09:08:35 +01:00
# Boot image build props set by /{second_stage_resources/,}boot/etc/build.prop
ro.bootimage.build.date u:object_r:build_bootimage_prop:s0 exact string
ro.bootimage.build.date.utc u:object_r:build_bootimage_prop:s0 exact int
ro.bootimage.build.fingerprint u:object_r:build_bootimage_prop:s0 exact string
ro.bootimage.build.id u:object_r:build_bootimage_prop:s0 exact string
ro.bootimage.build.tags u:object_r:build_bootimage_prop:s0 exact string
ro.bootimage.build.type u:object_r:build_bootimage_prop:s0 exact string
ro.bootimage.build.version.incremental u:object_r:build_bootimage_prop:s0 exact string
ro.bootimage.build.version.release u:object_r:build_bootimage_prop:s0 exact string
ro.bootimage.build.version.release_or_codename u:object_r:build_bootimage_prop:s0 exact string
ro.bootimage.build.version.sdk u:object_r:build_bootimage_prop:s0 exact int
ro.product.bootimage.brand u:object_r:build_bootimage_prop:s0 exact string
ro.product.bootimage.device u:object_r:build_bootimage_prop:s0 exact string
ro.product.bootimage.manufacturer u:object_r:build_bootimage_prop:s0 exact string
ro.product.bootimage.model u:object_r:build_bootimage_prop:s0 exact string
ro.product.bootimage.name u:object_r:build_bootimage_prop:s0 exact string
Add context for ro.product.property_source_order Any partitions should be able to write this property with build.prop. This adds a new context for ro.product.property_source_order so it can be set from any build.prop, e.g. vendor/build.prop, product/build.prop, etc. Bug: 172459064 Test: PRODUCT_VENDOR_PROPERTIES can set this property Change-Id: Ibf85a4ad02d8454f621428b271e8e298067aa126
2020-11-12 14:21:51 +01:00
# ro.product.property_source_order is settable from any build.prop
ro.product.property_source_order u:object_r:build_config_prop:s0 exact string
Rename exported and exported2 vold prop This is a subtask to clean up bad context names "exported*_prop". Bug: 152469526 Test: m Change-Id: Ie2d4046732e9d6562294fa664dcd7f019aa7c229
2020-04-06 13:49:17 +02:00
ro.crypto.state u:object_r:vold_status_prop:s0 exact enum encrypted unencrypted unsupported
ro.crypto.type u:object_r:vold_status_prop:s0 exact enum block file none
Merge public/property_contexts into private Originally public/property_contexts was introduced to create a whitelist of system properties which can be accessed from vendor, and to be used from VTS to ensure that the whitelist isn't modified. But it doesn't fit well on sepolicy public/private split as the split isn't for stability, but for letting vendor compile their sepolicy with public types. Also it doesn't make sense only to check the whitelist on VTS, because platform internal ones must also be unchanged. This commit merges public/property_contexts into private as before. This gives consistency with other context files such as file_contexts which are already containing entries for vendor but are only defined in private. This also simplifies property_contexts as there will be only one property_contexts file. Another benefit is that VTS will check all entries defined by system, not only exported ones. Bug: 150331497 Test: m && run VtsTrebleSysProp manually Change-Id: Ib9429e27b645ef21a36946fbaea069a718c3c6eb Merged-In: Ib9429e27b645ef21a36946fbaea069a718c3c6eb (cherry picked from commit 31391fa78e5da1ed29d5bccd4d46165b69adcbfb)
2020-03-09 11:48:37 +01:00
Remove exported2_default_prop This cleans up remaining exported2_default_prop. Three properties are changed. - ro.arch It becomes build_prop. - hal.instrumentation.enable It becomes hal_instrumentation_prop. - ro.property_service.version It becomes property_service_version_prop. Bug: 155844385 Test: selinux denial test on Pixel devices Change-Id: I7ee0bd8c522cc09ee82ef89e6a13bbbf65291291
2020-07-24 17:34:56 +02:00
ro.property_service.version u:object_r:property_service_version_prop:s0 exact int
Merge public/property_contexts into private Originally public/property_contexts was introduced to create a whitelist of system properties which can be accessed from vendor, and to be used from VTS to ensure that the whitelist isn't modified. But it doesn't fit well on sepolicy public/private split as the split isn't for stability, but for letting vendor compile their sepolicy with public types. Also it doesn't make sense only to check the whitelist on VTS, because platform internal ones must also be unchanged. This commit merges public/property_contexts into private as before. This gives consistency with other context files such as file_contexts which are already containing entries for vendor but are only defined in private. This also simplifies property_contexts as there will be only one property_contexts file. Another benefit is that VTS will check all entries defined by system, not only exported ones. Bug: 150331497 Test: m && run VtsTrebleSysProp manually Change-Id: Ib9429e27b645ef21a36946fbaea069a718c3c6eb Merged-In: Ib9429e27b645ef21a36946fbaea069a718c3c6eb (cherry picked from commit 31391fa78e5da1ed29d5bccd4d46165b69adcbfb)
2020-03-09 11:48:37 +01:00
ro.vendor.redirect_socket_calls u:object_r:vendor_socket_hook_prop:s0 exact bool
Allow boot animation to update boot status. This CL was missed from the topic: https://android-review.googlesource.com/q/topic:bootanim-percent Test: update ART module, see animation go to 100% Bug: 184881321 Change-Id: I59706718af11751a7e1f4b5ab1ff2793f554fb19
2021-04-28 14:57:11 +02:00
service.bootanim.exit u:object_r:bootanim_system_prop:s0 exact int
service.bootanim.progress u:object_r:bootanim_system_prop:s0 exact int
Merge public/property_contexts into private Originally public/property_contexts was introduced to create a whitelist of system properties which can be accessed from vendor, and to be used from VTS to ensure that the whitelist isn't modified. But it doesn't fit well on sepolicy public/private split as the split isn't for stability, but for letting vendor compile their sepolicy with public types. Also it doesn't make sense only to check the whitelist on VTS, because platform internal ones must also be unchanged. This commit merges public/property_contexts into private as before. This gives consistency with other context files such as file_contexts which are already containing entries for vendor but are only defined in private. This also simplifies property_contexts as there will be only one property_contexts file. Another benefit is that VTS will check all entries defined by system, not only exported ones. Bug: 150331497 Test: m && run VtsTrebleSysProp manually Change-Id: Ib9429e27b645ef21a36946fbaea069a718c3c6eb Merged-In: Ib9429e27b645ef21a36946fbaea069a718c3c6eb (cherry picked from commit 31391fa78e5da1ed29d5bccd4d46165b69adcbfb)
2020-03-09 11:48:37 +01:00
sys.init.userspace_reboot.in_progress u:object_r:userspace_reboot_exported_prop:s0 exact bool
sys.use_memfd u:object_r:use_memfd_prop:s0 exact bool
Rename exported and exported2 vold prop This is a subtask to clean up bad context names "exported*_prop". Bug: 152469526 Test: m Change-Id: Ie2d4046732e9d6562294fa664dcd7f019aa7c229
2020-04-06 13:49:17 +02:00
vold.decrypt u:object_r:vold_status_prop:s0 exact string
Merge public/property_contexts into private Originally public/property_contexts was introduced to create a whitelist of system properties which can be accessed from vendor, and to be used from VTS to ensure that the whitelist isn't modified. But it doesn't fit well on sepolicy public/private split as the split isn't for stability, but for letting vendor compile their sepolicy with public types. Also it doesn't make sense only to check the whitelist on VTS, because platform internal ones must also be unchanged. This commit merges public/property_contexts into private as before. This gives consistency with other context files such as file_contexts which are already containing entries for vendor but are only defined in private. This also simplifies property_contexts as there will be only one property_contexts file. Another benefit is that VTS will check all entries defined by system, not only exported ones. Bug: 150331497 Test: m && run VtsTrebleSysProp manually Change-Id: Ib9429e27b645ef21a36946fbaea069a718c3c6eb Merged-In: Ib9429e27b645ef21a36946fbaea069a718c3c6eb (cherry picked from commit 31391fa78e5da1ed29d5bccd4d46165b69adcbfb)
2020-03-09 11:48:37 +01:00
Add aaudio_config_prop and move aaudio properties To remove ambiguous context name exported_default_prop Bug: 71814576 Test: boot and see no denials Change-Id: I40eb92653fabc509419e07bb4bfa7301a8762352
2020-06-23 15:01:45 +02:00
aaudio.hw_burst_min_usec u:object_r:aaudio_config_prop:s0 exact int
aaudio.minimum_sleep_usec u:object_r:aaudio_config_prop:s0 exact int
aaudio.mixer_bursts u:object_r:aaudio_config_prop:s0 exact int
aaudio.mmap_exclusive_policy u:object_r:aaudio_config_prop:s0 exact int
aaudio.mmap_policy u:object_r:aaudio_config_prop:s0 exact int
aaudio.wakeup_delay_usec u:object_r:aaudio_config_prop:s0 exact int
Merge public/property_contexts into private Originally public/property_contexts was introduced to create a whitelist of system properties which can be accessed from vendor, and to be used from VTS to ensure that the whitelist isn't modified. But it doesn't fit well on sepolicy public/private split as the split isn't for stability, but for letting vendor compile their sepolicy with public types. Also it doesn't make sense only to check the whitelist on VTS, because platform internal ones must also be unchanged. This commit merges public/property_contexts into private as before. This gives consistency with other context files such as file_contexts which are already containing entries for vendor but are only defined in private. This also simplifies property_contexts as there will be only one property_contexts file. Another benefit is that VTS will check all entries defined by system, not only exported ones. Bug: 150331497 Test: m && run VtsTrebleSysProp manually Change-Id: Ib9429e27b645ef21a36946fbaea069a718c3c6eb Merged-In: Ib9429e27b645ef21a36946fbaea069a718c3c6eb (cherry picked from commit 31391fa78e5da1ed29d5bccd4d46165b69adcbfb)
2020-03-09 11:48:37 +01:00
persist.rcs.supported u:object_r:exported_default_prop:s0 exact int
ro.bionic.2nd_arch u:object_r:cpu_variant_prop:s0 exact string
ro.bionic.2nd_cpu_variant u:object_r:cpu_variant_prop:s0 exact string
ro.bionic.arch u:object_r:cpu_variant_prop:s0 exact string
ro.bionic.cpu_variant u:object_r:cpu_variant_prop:s0 exact string
ro.board.platform u:object_r:exported_default_prop:s0 exact string
ro.boot.fake_battery u:object_r:exported_default_prop:s0 exact int
Add sepolicy for ro.boot.fstab_suffix The fstab_suffix can be passed as 'androidboot.fstab_suffix=' on the kernel command line, or as an Android DT node. It specifies an override suffix for the fsmgr fstab search: /odm/etc/fstab.${fstab_suffix} /vendor/etc/fstab.${fstab_suffix} /fstab.${fstab_suffix} Bug: 142424832 Change-Id: I9c0acf7a5ae3cdba505460247decf2de9997cac1
2020-05-21 18:15:57 +02:00
ro.boot.fstab_suffix u:object_r:exported_default_prop:s0 exact string
Merge public/property_contexts into private Originally public/property_contexts was introduced to create a whitelist of system properties which can be accessed from vendor, and to be used from VTS to ensure that the whitelist isn't modified. But it doesn't fit well on sepolicy public/private split as the split isn't for stability, but for letting vendor compile their sepolicy with public types. Also it doesn't make sense only to check the whitelist on VTS, because platform internal ones must also be unchanged. This commit merges public/property_contexts into private as before. This gives consistency with other context files such as file_contexts which are already containing entries for vendor but are only defined in private. This also simplifies property_contexts as there will be only one property_contexts file. Another benefit is that VTS will check all entries defined by system, not only exported ones. Bug: 150331497 Test: m && run VtsTrebleSysProp manually Change-Id: Ib9429e27b645ef21a36946fbaea069a718c3c6eb Merged-In: Ib9429e27b645ef21a36946fbaea069a718c3c6eb (cherry picked from commit 31391fa78e5da1ed29d5bccd4d46165b69adcbfb)
2020-03-09 11:48:37 +01:00
ro.boot.hardware.revision u:object_r:exported_default_prop:s0 exact string
ro.boot.product.hardware.sku u:object_r:exported_default_prop:s0 exact string
ro.boot.product.vendor.sku u:object_r:exported_default_prop:s0 exact string
ro.boot.slot_suffix u:object_r:exported_default_prop:s0 exact string
ro.boringcrypto.hwrand u:object_r:exported_default_prop:s0 exact bool
Add gki.prevent_downgrade_* Add ro.build.ab_update.gki.prevent_downgrade_{version,spl} for update_engine to determine whether downgrade in kernel version or SPL is considered an error or not. Bug: 162623577 Test: update_engine_unittest Test: apply OTA Change-Id: If602924d50a2d5cfb3c256b82491c413a9d39f9d
2020-09-22 05:04:00 +02:00
# Update related props
ro.build.ab_update u:object_r:exported_default_prop:s0 exact string
ro.build.ab_update.gki.prevent_downgrade_version u:object_r:ab_update_gki_prop:s0 exact bool
ro.build.ab_update.gki.prevent_downgrade_spl u:object_r:ab_update_gki_prop:s0 exact bool
Merge public/property_contexts into private Originally public/property_contexts was introduced to create a whitelist of system properties which can be accessed from vendor, and to be used from VTS to ensure that the whitelist isn't modified. But it doesn't fit well on sepolicy public/private split as the split isn't for stability, but for letting vendor compile their sepolicy with public types. Also it doesn't make sense only to check the whitelist on VTS, because platform internal ones must also be unchanged. This commit merges public/property_contexts into private as before. This gives consistency with other context files such as file_contexts which are already containing entries for vendor but are only defined in private. This also simplifies property_contexts as there will be only one property_contexts file. Another benefit is that VTS will check all entries defined by system, not only exported ones. Bug: 150331497 Test: m && run VtsTrebleSysProp manually Change-Id: Ib9429e27b645ef21a36946fbaea069a718c3c6eb Merged-In: Ib9429e27b645ef21a36946fbaea069a718c3c6eb (cherry picked from commit 31391fa78e5da1ed29d5bccd4d46165b69adcbfb)
2020-03-09 11:48:37 +01:00
ro.build.expect.baseband u:object_r:exported_default_prop:s0 exact string
ro.build.expect.bootloader u:object_r:exported_default_prop:s0 exact string
ro.carrier u:object_r:exported_default_prop:s0 exact string
ro.config.low_ram u:object_r:exported_config_prop:s0 exact bool
ro.config.vc_call_vol_steps u:object_r:exported_config_prop:s0 exact int
ro.frp.pst u:object_r:exported_default_prop:s0 exact string
ro.hardware.activity_recognition u:object_r:exported_default_prop:s0 exact string
ro.hardware.audio u:object_r:exported_default_prop:s0 exact string
ro.hardware.audio.a2dp u:object_r:exported_default_prop:s0 exact string
ro.hardware.audio.hearing_aid u:object_r:exported_default_prop:s0 exact string
ro.hardware.audio.primary u:object_r:exported_default_prop:s0 exact string
ro.hardware.audio.usb u:object_r:exported_default_prop:s0 exact string
ro.hardware.audio_policy u:object_r:exported_default_prop:s0 exact string
ro.hardware.bootctrl u:object_r:exported_default_prop:s0 exact string
ro.hardware.camera u:object_r:exported_default_prop:s0 exact string
ro.hardware.consumerir u:object_r:exported_default_prop:s0 exact string
ro.hardware.context_hub u:object_r:exported_default_prop:s0 exact string
ro.hardware.egl u:object_r:exported_default_prop:s0 exact string
ro.hardware.fingerprint u:object_r:exported_default_prop:s0 exact string
ro.hardware.flp u:object_r:exported_default_prop:s0 exact string
ro.hardware.gatekeeper u:object_r:exported_default_prop:s0 exact string
ro.hardware.gps u:object_r:exported_default_prop:s0 exact string
ro.hardware.gralloc u:object_r:exported_default_prop:s0 exact string
ro.hardware.hdmi_cec u:object_r:exported_default_prop:s0 exact string
ro.hardware.hwcomposer u:object_r:exported_default_prop:s0 exact string
ro.hardware.input u:object_r:exported_default_prop:s0 exact string
ro.hardware.keystore u:object_r:exported_default_prop:s0 exact string
ro.hardware.keystore_desede u:object_r:exported_default_prop:s0 exact string
ro.hardware.lights u:object_r:exported_default_prop:s0 exact string
ro.hardware.local_time u:object_r:exported_default_prop:s0 exact string
ro.hardware.memtrack u:object_r:exported_default_prop:s0 exact string
ro.hardware.nfc u:object_r:exported_default_prop:s0 exact string
ro.hardware.nfc_nci u:object_r:exported_default_prop:s0 exact string
ro.hardware.nfc_tag u:object_r:exported_default_prop:s0 exact string
ro.hardware.nvram u:object_r:exported_default_prop:s0 exact string
ro.hardware.power u:object_r:exported_default_prop:s0 exact string
ro.hardware.radio u:object_r:exported_default_prop:s0 exact string
ro.hardware.sensors u:object_r:exported_default_prop:s0 exact string
ro.hardware.sound_trigger u:object_r:exported_default_prop:s0 exact string
ro.hardware.thermal u:object_r:exported_default_prop:s0 exact string
ro.hardware.tv_input u:object_r:exported_default_prop:s0 exact string
ro.hardware.type u:object_r:exported_default_prop:s0 exact string
ro.hardware.vehicle u:object_r:exported_default_prop:s0 exact string
ro.hardware.vibrator u:object_r:exported_default_prop:s0 exact string
ro.hardware.virtual_device u:object_r:exported_default_prop:s0 exact string
ro.hardware.vulkan u:object_r:exported_default_prop:s0 exact string
Add support for a hw_timeout_multiplier system property. In order to test the platform in emulators that are orders of magnitude slower than real hardware we need to be able to avoid hitting timeouts that prevent it from coming up properly. For this purpose introduce a system property, ro.hw_timeout_multiplier, which may be set to an integer value that acts as a multiplier for various timeouts on the system. Bug: 178231152 Change-Id: I6d7710beed0c4c5b1720e74e7abe3a586778c678 Merged-In: I6d7710beed0c4c5b1720e74e7abe3a586778c678
2021-03-11 21:51:25 +01:00
ro.hw_timeout_multiplier u:object_r:hw_timeout_multiplier_prop:s0 exact int
Merge public/property_contexts into private Originally public/property_contexts was introduced to create a whitelist of system properties which can be accessed from vendor, and to be used from VTS to ensure that the whitelist isn't modified. But it doesn't fit well on sepolicy public/private split as the split isn't for stability, but for letting vendor compile their sepolicy with public types. Also it doesn't make sense only to check the whitelist on VTS, because platform internal ones must also be unchanged. This commit merges public/property_contexts into private as before. This gives consistency with other context files such as file_contexts which are already containing entries for vendor but are only defined in private. This also simplifies property_contexts as there will be only one property_contexts file. Another benefit is that VTS will check all entries defined by system, not only exported ones. Bug: 150331497 Test: m && run VtsTrebleSysProp manually Change-Id: Ib9429e27b645ef21a36946fbaea069a718c3c6eb Merged-In: Ib9429e27b645ef21a36946fbaea069a718c3c6eb (cherry picked from commit 31391fa78e5da1ed29d5bccd4d46165b69adcbfb)
2020-03-09 11:48:37 +01:00
ro.hwui.use_vulkan u:object_r:exported_default_prop:s0 exact bool
Mark `ro.kernel` properties as deprecated emulator migrated to `ro.boot` Bug: 182291166 Test: presubmit Signed-off-by: Roman Kiryanov <rkir@google.com> Change-Id: I9cd443801ff7120ebb628acdc811f0eb339a02c9
2021-04-15 08:45:58 +02:00
# ro.kernel.* properties are emulator specific and deprecated. Do not use.
# Should be retired once presubmit allows.
Merge public/property_contexts into private Originally public/property_contexts was introduced to create a whitelist of system properties which can be accessed from vendor, and to be used from VTS to ensure that the whitelist isn't modified. But it doesn't fit well on sepolicy public/private split as the split isn't for stability, but for letting vendor compile their sepolicy with public types. Also it doesn't make sense only to check the whitelist on VTS, because platform internal ones must also be unchanged. This commit merges public/property_contexts into private as before. This gives consistency with other context files such as file_contexts which are already containing entries for vendor but are only defined in private. This also simplifies property_contexts as there will be only one property_contexts file. Another benefit is that VTS will check all entries defined by system, not only exported ones. Bug: 150331497 Test: m && run VtsTrebleSysProp manually Change-Id: Ib9429e27b645ef21a36946fbaea069a718c3c6eb Merged-In: Ib9429e27b645ef21a36946fbaea069a718c3c6eb (cherry picked from commit 31391fa78e5da1ed29d5bccd4d46165b69adcbfb)
2020-03-09 11:48:37 +01:00
ro.kernel.qemu u:object_r:exported_default_prop:s0 exact bool
ro.kernel.qemu. u:object_r:exported_default_prop:s0
ro.kernel.android.bootanim u:object_r:exported_default_prop:s0 exact int
ro.oem.key1 u:object_r:exported_default_prop:s0 exact string
Refine build.prop related properties 1) build_odm_prop and build_vendor_prop are added These contexts will contain world-readable properties from /odm/build.prop and /vendor/build.prop, respectively. 2) move more properties to build_prop Following properties are set by /system/build.prop and now assigned as build_prop: - ro.adb.secure - ro.build.type - ro.product.cpu.abi - ro.product.cpu.abilist - ro.product.cpu.abilist32 - ro.product.cpu.abilist64 - ro.secure Following properties are set by init/property_service.cpp and now assigned as build_prop: - ro.product.brand - ro.product.device - ro.product.manufacturer - ro.product.model - ro.product.name Bug: 71814576 Bug: 155844385 Test: boot device and see no denials Change-Id: Idd4f81de4d2d0fc4bdec2d7ecb08bb8e078dab58
2020-05-19 15:02:58 +02:00
ro.product.vndk.version u:object_r:vndk_prop:s0 exact string
Merge public/property_contexts into private Originally public/property_contexts was introduced to create a whitelist of system properties which can be accessed from vendor, and to be used from VTS to ensure that the whitelist isn't modified. But it doesn't fit well on sepolicy public/private split as the split isn't for stability, but for letting vendor compile their sepolicy with public types. Also it doesn't make sense only to check the whitelist on VTS, because platform internal ones must also be unchanged. This commit merges public/property_contexts into private as before. This gives consistency with other context files such as file_contexts which are already containing entries for vendor but are only defined in private. This also simplifies property_contexts as there will be only one property_contexts file. Another benefit is that VTS will check all entries defined by system, not only exported ones. Bug: 150331497 Test: m && run VtsTrebleSysProp manually Change-Id: Ib9429e27b645ef21a36946fbaea069a718c3c6eb Merged-In: Ib9429e27b645ef21a36946fbaea069a718c3c6eb (cherry picked from commit 31391fa78e5da1ed29d5bccd4d46165b69adcbfb)
2020-03-09 11:48:37 +01:00
ro.vndk.lite u:object_r:vndk_prop:s0 exact bool
ro.vndk.version u:object_r:vndk_prop:s0 exact string
Add property contexts for vts props vts_config_prop and vts_status_prop are added to remove exported*_prop. ro.vts.coverage becomes vts_config_prop, and vts.native_server.on becomes vts_status_prop. Bug: 155844385 Test: Run some vts and then getprop, e.g. atest \ VtsHalAudioEffectV4_0TargetTest && adb shell getprop Test: ro.vts.coverage is read without denials Change-Id: Ic3532ef0ae7083db8d619d80e2b73249f87981ce
2020-07-13 19:10:37 +02:00
ro.vts.coverage u:object_r:vts_config_prop:s0 exact int
vts.native_server.on u:object_r:vts_status_prop:s0 exact bool
Merge public/property_contexts into private Originally public/property_contexts was introduced to create a whitelist of system properties which can be accessed from vendor, and to be used from VTS to ensure that the whitelist isn't modified. But it doesn't fit well on sepolicy public/private split as the split isn't for stability, but for letting vendor compile their sepolicy with public types. Also it doesn't make sense only to check the whitelist on VTS, because platform internal ones must also be unchanged. This commit merges public/property_contexts into private as before. This gives consistency with other context files such as file_contexts which are already containing entries for vendor but are only defined in private. This also simplifies property_contexts as there will be only one property_contexts file. Another benefit is that VTS will check all entries defined by system, not only exported ones. Bug: 150331497 Test: m && run VtsTrebleSysProp manually Change-Id: Ib9429e27b645ef21a36946fbaea069a718c3c6eb Merged-In: Ib9429e27b645ef21a36946fbaea069a718c3c6eb (cherry picked from commit 31391fa78e5da1ed29d5bccd4d46165b69adcbfb)
2020-03-09 11:48:37 +01:00
Add wifi_hal_prop and remove exported_wifi_prop To remove bad context names "exported*_prop" Bug: 155844385 Test: boot and see no denials Change-Id: Icd30be64355699618735d4012461835eca8cd651 Merged-In: Icd30be64355699618735d4012461835eca8cd651 (cherry picked from commit 37c2d4d0c9669f3c7590f3dfccfac3c9725d1b5a) (cherry picked from commit 3b66e9b9f855ad0694efed405a30d64265854784)
2020-06-25 14:20:42 +02:00
wifi.active.interface u:object_r:wifi_hal_prop:s0 exact string
wifi.aware.interface u:object_r:wifi_hal_prop:s0 exact string
wifi.concurrent.interface u:object_r:wifi_hal_prop:s0 exact string
wifi.direct.interface u:object_r:wifi_hal_prop:s0 exact string
wifi.interface u:object_r:wifi_hal_prop:s0 exact string
wlan.driver.status u:object_r:wifi_hal_prop:s0 exact enum ok unloaded
Merge public/property_contexts into private Originally public/property_contexts was introduced to create a whitelist of system properties which can be accessed from vendor, and to be used from VTS to ensure that the whitelist isn't modified. But it doesn't fit well on sepolicy public/private split as the split isn't for stability, but for letting vendor compile their sepolicy with public types. Also it doesn't make sense only to check the whitelist on VTS, because platform internal ones must also be unchanged. This commit merges public/property_contexts into private as before. This gives consistency with other context files such as file_contexts which are already containing entries for vendor but are only defined in private. This also simplifies property_contexts as there will be only one property_contexts file. Another benefit is that VTS will check all entries defined by system, not only exported ones. Bug: 150331497 Test: m && run VtsTrebleSysProp manually Change-Id: Ib9429e27b645ef21a36946fbaea069a718c3c6eb Merged-In: Ib9429e27b645ef21a36946fbaea069a718c3c6eb (cherry picked from commit 31391fa78e5da1ed29d5bccd4d46165b69adcbfb)
2020-03-09 11:48:37 +01:00
Move more properties out of exported3_default_prop This is to remove exported3_default_prop. Contexts of these properties are changed. - ro.boot.wificountrycode This becomes wifi_config_prop - ro.opengles.version This becomes graphics_config_prop. Also it's read by various domains, so graphics_config_prop is now readable from coredomain. - persist.config.calibration_fac This becomes camera_calibration_prop. It's only readable by appdomain. Bug: 155844385 Test: no denials on Pixel devices Test: connect wifi Change-Id: If2b6c10fa124e29d1612a8f94ae18b223849e2a9
2020-07-20 13:26:07 +02:00
ro.boot.wificountrycode u:object_r:wifi_config_prop:s0 exact string
Merge public/property_contexts into private Originally public/property_contexts was introduced to create a whitelist of system properties which can be accessed from vendor, and to be used from VTS to ensure that the whitelist isn't modified. But it doesn't fit well on sepolicy public/private split as the split isn't for stability, but for letting vendor compile their sepolicy with public types. Also it doesn't make sense only to check the whitelist on VTS, because platform internal ones must also be unchanged. This commit merges public/property_contexts into private as before. This gives consistency with other context files such as file_contexts which are already containing entries for vendor but are only defined in private. This also simplifies property_contexts as there will be only one property_contexts file. Another benefit is that VTS will check all entries defined by system, not only exported ones. Bug: 150331497 Test: m && run VtsTrebleSysProp manually Change-Id: Ib9429e27b645ef21a36946fbaea069a718c3c6eb Merged-In: Ib9429e27b645ef21a36946fbaea069a718c3c6eb (cherry picked from commit 31391fa78e5da1ed29d5bccd4d46165b69adcbfb)
2020-03-09 11:48:37 +01:00
ro.apex.updatable u:object_r:exported_default_prop:s0 exact bool
Define vendor-specific property ro.incremental.enable [cherry-picking] Make ro.incremental.enable a vendor-specific property. Allow system_server and vold to read this property. Test: manual BUG: 155212902 Change-Id: I8ff8837af635fa8e7b5bb02e5f6de5ac15b5023b Merged-In: I8ff8837af635fa8e7b5bb02e5f6de5ac15b5023b
2020-04-28 22:24:54 +02:00
# Property to enable incremental feature
ro.incremental.enable u:object_r:incremental_prop:s0
Use properties for various userspace reboot timeouts Test: adb reboot userspace Bug: 146560409 Change-Id: I62408f0e59622c2dab1245897c3057d02c5716a9
2020-03-25 01:13:13 +01:00
# Properties to configure userspace reboot.
init.userspace_reboot.is_supported u:object_r:userspace_reboot_config_prop:s0 exact bool
init.userspace_reboot.sigkill.timeoutmillis u:object_r:userspace_reboot_config_prop:s0 exact int
init.userspace_reboot.sigterm.timeoutmillis u:object_r:userspace_reboot_config_prop:s0 exact int
Add init.userspace_reboot.started.timeoutmillis property This property controls how much userspace reboot watchdog will wait for userspace reboot to start before falling back to hard reboot. Test: builds Bug: 152803929 Change-Id: I6955e8c94708e7e4161e4f334b03c052d42c0f9f
2020-04-11 03:00:01 +02:00
init.userspace_reboot.started.timeoutmillis u:object_r:userspace_reboot_config_prop:s0 exact int
Use properties for various userspace reboot timeouts Test: adb reboot userspace Bug: 146560409 Change-Id: I62408f0e59622c2dab1245897c3057d02c5716a9
2020-03-25 01:13:13 +01:00
init.userspace_reboot.userdata_remount.timeoutmillis u:object_r:userspace_reboot_config_prop:s0 exact int
init.userspace_reboot.watchdog.timeoutmillis u:object_r:userspace_reboot_config_prop:s0 exact int
Merge public/property_contexts into private Originally public/property_contexts was introduced to create a whitelist of system properties which can be accessed from vendor, and to be used from VTS to ensure that the whitelist isn't modified. But it doesn't fit well on sepolicy public/private split as the split isn't for stability, but for letting vendor compile their sepolicy with public types. Also it doesn't make sense only to check the whitelist on VTS, because platform internal ones must also be unchanged. This commit merges public/property_contexts into private as before. This gives consistency with other context files such as file_contexts which are already containing entries for vendor but are only defined in private. This also simplifies property_contexts as there will be only one property_contexts file. Another benefit is that VTS will check all entries defined by system, not only exported ones. Bug: 150331497 Test: m && run VtsTrebleSysProp manually Change-Id: Ib9429e27b645ef21a36946fbaea069a718c3c6eb Merged-In: Ib9429e27b645ef21a36946fbaea069a718c3c6eb (cherry picked from commit 31391fa78e5da1ed29d5bccd4d46165b69adcbfb)
2020-03-09 11:48:37 +01:00
sys.shutdown.requested u:object_r:exported_system_prop:s0 exact string
Rename surfaceflinger properties' contexts Cleaning up exported*_system_prop and moving surfaceflinger properties to new property contexts. Bug: 152468529 Bug: 154885206 Test: boot cf_x86 and crosshatch Change-Id: I7f8a684e9cbabce2f55a5292d7b2283ac0716cd9
2020-04-24 14:25:17 +02:00
# surfaceflinger properties
Create surfaceflinger_prop and migrate props This is a subtask of removing exported*_prop. Bug: 152468529 Test: m && boot crosshatch Change-Id: I9d6ec7ade96a3a53288f23d155cc829c2107bb6f
2020-04-02 08:55:07 +02:00
ro.surface_flinger.default_composition_dataspace u:object_r:surfaceflinger_prop:s0 exact int
ro.surface_flinger.default_composition_pixel_format u:object_r:surfaceflinger_prop:s0 exact int
ro.surface_flinger.force_hwc_copy_for_virtual_displays u:object_r:surfaceflinger_prop:s0 exact bool
ro.surface_flinger.has_HDR_display u:object_r:surfaceflinger_prop:s0 exact bool
ro.surface_flinger.has_wide_color_display u:object_r:surfaceflinger_prop:s0 exact bool
ro.surface_flinger.max_frame_buffer_acquired_buffers u:object_r:surfaceflinger_prop:s0 exact int
ro.surface_flinger.max_graphics_height u:object_r:surfaceflinger_prop:s0 exact int
ro.surface_flinger.max_graphics_width u:object_r:surfaceflinger_prop:s0 exact int
ro.surface_flinger.max_virtual_display_dimension u:object_r:surfaceflinger_prop:s0 exact int
ro.surface_flinger.primary_display_orientation u:object_r:surfaceflinger_prop:s0 exact enum ORIENTATION_0 ORIENTATION_180 ORIENTATION_270 ORIENTATION_90
ro.surface_flinger.present_time_offset_from_vsync_ns u:object_r:surfaceflinger_prop:s0 exact int
ro.surface_flinger.running_without_sync_framework u:object_r:surfaceflinger_prop:s0 exact bool
ro.surface_flinger.start_graphics_allocator_service u:object_r:surfaceflinger_prop:s0 exact bool
ro.surface_flinger.use_color_management u:object_r:surfaceflinger_prop:s0 exact bool
ro.surface_flinger.use_context_priority u:object_r:surfaceflinger_prop:s0 exact bool
ro.surface_flinger.use_vr_flinger u:object_r:surfaceflinger_prop:s0 exact bool
ro.surface_flinger.vsync_event_phase_offset_ns u:object_r:surfaceflinger_prop:s0 exact int
ro.surface_flinger.vsync_sf_event_phase_offset_ns u:object_r:surfaceflinger_prop:s0 exact int
ro.surface_flinger.wcg_composition_dataspace u:object_r:surfaceflinger_prop:s0 exact int
ro.surface_flinger.wcg_composition_pixel_format u:object_r:surfaceflinger_prop:s0 exact int
ro.surface_flinger.display_primary_red u:object_r:surfaceflinger_prop:s0 exact string
ro.surface_flinger.display_primary_green u:object_r:surfaceflinger_prop:s0 exact string
ro.surface_flinger.display_primary_blue u:object_r:surfaceflinger_prop:s0 exact string
ro.surface_flinger.display_primary_white u:object_r:surfaceflinger_prop:s0 exact string
ro.surface_flinger.protected_contents u:object_r:surfaceflinger_prop:s0 exact bool
ro.surface_flinger.set_idle_timer_ms u:object_r:surfaceflinger_prop:s0 exact int
ro.surface_flinger.set_touch_timer_ms u:object_r:surfaceflinger_prop:s0 exact int
ro.surface_flinger.set_display_power_timer_ms u:object_r:surfaceflinger_prop:s0 exact int
ro.surface_flinger.support_kernel_idle_timer u:object_r:surfaceflinger_prop:s0 exact bool
Add blur sysprop to sepolicy Bug: 170378891 Test: m Change-Id: I6876e3bfe9dfdf066bfa54334555fdab5b3598d5
2021-02-11 18:24:27 +01:00
ro.surface_flinger.supports_background_blur u:object_r:surfaceflinger_prop:s0 exact bool
Create surfaceflinger_prop and migrate props This is a subtask of removing exported*_prop. Bug: 152468529 Test: m && boot crosshatch Change-Id: I9d6ec7ade96a3a53288f23d155cc829c2107bb6f
2020-04-02 08:55:07 +02:00
ro.surface_flinger.use_smart_90_for_video u:object_r:surfaceflinger_prop:s0 exact bool
ro.surface_flinger.use_content_detection_for_refresh_rate u:object_r:surfaceflinger_prop:s0 exact bool
ro.surface_flinger.color_space_agnostic_dataspace u:object_r:surfaceflinger_prop:s0 exact int
ro.surface_flinger.refresh_rate_switching u:object_r:surfaceflinger_prop:s0 exact bool
Rename the sysprop for updating device product info Test: read the prop from SurfaceFlinger; test on device Change-Id: Id80954d6ea426b90b6cea5f74aae4d6cc905fcc5
2020-10-06 15:14:17 +02:00
ro.surface_flinger.update_device_product_info_on_hotplug_reconnect u:object_r:surfaceflinger_prop:s0 exact bool
Add a sysprop to control frame rate override Adding 'ro.surface_flinger.enable_frame_rate_override' to control whether frame rate override feature should be enabled or not. Bug: 170502573 Bug: 176940141 Change-Id: Ida0e13f9a7c420f5f363d1feeacf882d8b76a8fa Test: atest FrameRateOverrideHostTest
2021-01-09 03:33:45 +01:00
ro.surface_flinger.enable_frame_rate_override u:object_r:surfaceflinger_prop:s0 exact bool
Add a sysprop to control layer caching Adding 'ro.surface_flinger.enable_layer_caching' to control whether layer caching feature should be enabled or not. Bug: 158790260 Change-Id: I3ceb84d2a9209b2c422ba93057e9323ca6816ca5
2021-02-18 20:20:20 +01:00
ro.surface_flinger.enable_layer_caching u:object_r:surfaceflinger_prop:s0 exact bool
Add a sysprop to set display update imminent timeout Adding 'ro.surface_flinger.display_update_imminent_timeout_ms' to set timeout for rate limit display update imminent notifications. Bug: 164411401 Change-Id: I90a00fe7f8df3aa505f08081d096fd83b3342f59
2021-04-27 14:45:29 +02:00
ro.surface_flinger.display_update_imminent_timeout_ms u:object_r:surfaceflinger_prop:s0 exact int
Merge public/property_contexts into private Originally public/property_contexts was introduced to create a whitelist of system properties which can be accessed from vendor, and to be used from VTS to ensure that the whitelist isn't modified. But it doesn't fit well on sepolicy public/private split as the split isn't for stability, but for letting vendor compile their sepolicy with public types. Also it doesn't make sense only to check the whitelist on VTS, because platform internal ones must also be unchanged. This commit merges public/property_contexts into private as before. This gives consistency with other context files such as file_contexts which are already containing entries for vendor but are only defined in private. This also simplifies property_contexts as there will be only one property_contexts file. Another benefit is that VTS will check all entries defined by system, not only exported ones. Bug: 150331497 Test: m && run VtsTrebleSysProp manually Change-Id: Ib9429e27b645ef21a36946fbaea069a718c3c6eb Merged-In: Ib9429e27b645ef21a36946fbaea069a718c3c6eb (cherry picked from commit 31391fa78e5da1ed29d5bccd4d46165b69adcbfb)
2020-03-09 11:48:37 +01:00
Rename surfaceflinger properties' contexts Cleaning up exported*_system_prop and moving surfaceflinger properties to new property contexts. Bug: 152468529 Bug: 154885206 Test: boot cf_x86 and crosshatch Change-Id: I7f8a684e9cbabce2f55a5292d7b2283ac0716cd9
2020-04-24 14:25:17 +02:00
ro.sf.disable_triple_buffer u:object_r:surfaceflinger_prop:s0 exact bool
ro.sf.lcd_density u:object_r:surfaceflinger_prop:s0 exact int
persist.sys.sf.color_mode u:object_r:surfaceflinger_color_prop:s0 exact int
persist.sys.sf.color_saturation u:object_r:surfaceflinger_color_prop:s0 exact string
persist.sys.sf.native_mode u:object_r:surfaceflinger_color_prop:s0 exact int
Merge public/property_contexts into private Originally public/property_contexts was introduced to create a whitelist of system properties which can be accessed from vendor, and to be used from VTS to ensure that the whitelist isn't modified. But it doesn't fit well on sepolicy public/private split as the split isn't for stability, but for letting vendor compile their sepolicy with public types. Also it doesn't make sense only to check the whitelist on VTS, because platform internal ones must also be unchanged. This commit merges public/property_contexts into private as before. This gives consistency with other context files such as file_contexts which are already containing entries for vendor but are only defined in private. This also simplifies property_contexts as there will be only one property_contexts file. Another benefit is that VTS will check all entries defined by system, not only exported ones. Bug: 150331497 Test: m && run VtsTrebleSysProp manually Change-Id: Ib9429e27b645ef21a36946fbaea069a718c3c6eb Merged-In: Ib9429e27b645ef21a36946fbaea069a718c3c6eb (cherry picked from commit 31391fa78e5da1ed29d5bccd4d46165b69adcbfb)
2020-03-09 11:48:37 +01:00
# Binder cache properties. These are world-readable
cache_key.app_inactive u:object_r:binder_cache_system_server_prop:s0
cache_key.is_compat_change_enabled u:object_r:binder_cache_system_server_prop:s0
cache_key.get_packages_for_uid u:object_r:binder_cache_system_server_prop:s0
cache_key.has_system_feature u:object_r:binder_cache_system_server_prop:s0
cache_key.is_interactive u:object_r:binder_cache_system_server_prop:s0
cache_key.is_power_save_mode u:object_r:binder_cache_system_server_prop:s0
cache_key.is_user_unlocked u:object_r:binder_cache_system_server_prop:s0
cache_key.volume_list u:object_r:binder_cache_system_server_prop:s0
cache_key.display_info u:object_r:binder_cache_system_server_prop:s0
cache_key.location_enabled u:object_r:binder_cache_system_server_prop:s0
cache_key.package_info u:object_r:binder_cache_system_server_prop:s0
cache_key.bluetooth. u:object_r:binder_cache_bluetooth_server_prop:s0 prefix string
cache_key.system_server. u:object_r:binder_cache_system_server_prop:s0 prefix string
cache_key.telephony. u:object_r:binder_cache_telephony_server_prop:s0 prefix string
Add contexts for exported telephony props To remove bad context names, two contexts are added. - telephony_config_prop - telephony_status_prop exported_radio_prop, exported2_radio_prop are removed. Cleaning up exported3_radio_prop will be a follow-up task. Exempt-From-Owner-Approval: cherry-pick Bug: 152471138 Bug: 155844385 Test: boot and see no denials Test: usim works on blueline Change-Id: Iff9a4635c709f3ebe266cd811df3a1b4d3a242c2 Merged-In: Iff9a4635c709f3ebe266cd811df3a1b4d3a242c2 (cherry picked from commit 4d36eae8affaffce00063d37fe7f1d570cca1f1f)
2020-05-14 14:47:43 +02:00
Add framework_watchdog_config_prop The framework_watchdog_config_prop properties control framework watchdog configurations to handle watchdog timeout loop. The properties are written only by vendor_init. More details and background: go/break-sys-watchdog-loop Bug: 141948707 Change-Id: I6c0da5fdafba8165e79d0f04e0a82874f605a06d
2020-05-25 10:33:17 +02:00
# Framework watchdog configuration properties.
framework_watchdog.fatal_count u:object_r:framework_watchdog_config_prop:s0 exact int
framework_watchdog.fatal_window.second u:object_r:framework_watchdog_config_prop:s0 exact int
Add contexts for exported telephony props To remove bad context names, two contexts are added. - telephony_config_prop - telephony_status_prop exported_radio_prop, exported2_radio_prop are removed. Cleaning up exported3_radio_prop will be a follow-up task. Exempt-From-Owner-Approval: cherry-pick Bug: 152471138 Bug: 155844385 Test: boot and see no denials Test: usim works on blueline Change-Id: Iff9a4635c709f3ebe266cd811df3a1b4d3a242c2 Merged-In: Iff9a4635c709f3ebe266cd811df3a1b4d3a242c2 (cherry picked from commit 4d36eae8affaffce00063d37fe7f1d570cca1f1f)
2020-05-14 14:47:43 +02:00
gsm.sim.operator.numeric u:object_r:telephony_status_prop:s0 exact string
persist.radio.airplane_mode_on u:object_r:telephony_status_prop:s0 exact bool
Add ro.cdma.home.operator. properties vendor_init writes ro.cdma.home.operator. properties, and framework codes reads the properties. This adds them to telephony_config_prop to explicitly allow it. Bug: 157958356 Test: boot Change-Id: I3bd515bd7adcc01ec268e4d2b5a6a2f1fbca7deb
2020-09-21 05:59:11 +02:00
ro.cdma.home.operator.alpha u:object_r:telephony_config_prop:s0 exact string
ro.cdma.home.operator.numeric u:object_r:telephony_config_prop:s0 exact string
Add contexts for exported telephony props To remove bad context names, two contexts are added. - telephony_config_prop - telephony_status_prop exported_radio_prop, exported2_radio_prop are removed. Cleaning up exported3_radio_prop will be a follow-up task. Exempt-From-Owner-Approval: cherry-pick Bug: 152471138 Bug: 155844385 Test: boot and see no denials Test: usim works on blueline Change-Id: Iff9a4635c709f3ebe266cd811df3a1b4d3a242c2 Merged-In: Iff9a4635c709f3ebe266cd811df3a1b4d3a242c2 (cherry picked from commit 4d36eae8affaffce00063d37fe7f1d570cca1f1f)
2020-05-14 14:47:43 +02:00
ro.com.android.dataroaming u:object_r:telephony_config_prop:s0 exact bool
ro.com.android.prov_mobiledata u:object_r:telephony_config_prop:s0 exact bool
ro.radio.noril u:object_r:telephony_config_prop:s0 exact string
ro.telephony.call_ring.multiple u:object_r:telephony_config_prop:s0 exact bool
ro.telephony.default_cdma_sub u:object_r:telephony_config_prop:s0 exact int
ro.telephony.default_network u:object_r:telephony_config_prop:s0 exact string
ro.telephony.iwlan_operation_mode u:object_r:telephony_config_prop:s0 exact enum default legacy AP-assisted
telephony.active_modems.max_count u:object_r:telephony_config_prop:s0 exact int
telephony.lteOnCdmaDevice u:object_r:telephony_config_prop:s0 exact int
persist.dbg.volte_avail_ovr u:object_r:telephony_config_prop:s0 exact int
persist.dbg.vt_avail_ovr u:object_r:telephony_config_prop:s0 exact int
persist.dbg.wfc_avail_ovr u:object_r:telephony_config_prop:s0 exact int
Update sepolicy for GPU profiling properties. A device must indicate whether GPU profiling is supported or not through setting these two properties properly. CTS needs to read these two properties in order to run corresponding compliance tests. Hence need to update sepolicy for these two properties. Bug: b/157832445 Test: Test on Pixel 4 Change-Id: I6f400ecbbd5e78b645bb620fa24747e9367c2ff3 Merged-In: I6f400ecbbd5e78b645bb620fa24747e9367c2ff3
2020-06-03 21:20:41 +02:00
Define sepolicy for locale filter property Bug: 154133013 Test: Manual Change-Id: I28ae279e4fd47553fcf4ab9421944f552490b49f
2020-07-08 23:11:03 +02:00
# System locale list filter configuration
ro.localization.locale_filter u:object_r:localization_prop:s0 exact string
Update sepolicy for GPU profiling properties. A device must indicate whether GPU profiling is supported or not through setting these two properties properly. CTS needs to read these two properties in order to run corresponding compliance tests. Hence need to update sepolicy for these two properties. Bug: b/157832445 Test: Test on Pixel 4 Change-Id: I6f400ecbbd5e78b645bb620fa24747e9367c2ff3 Merged-In: I6f400ecbbd5e78b645bb620fa24747e9367c2ff3
2020-06-03 21:20:41 +02:00
# Graphics related properties
Move more properties out of exported3_default_prop This is to remove exported3_default_prop. Contexts of these properties are changed. - ro.boot.wificountrycode This becomes wifi_config_prop - ro.opengles.version This becomes graphics_config_prop. Also it's read by various domains, so graphics_config_prop is now readable from coredomain. - persist.config.calibration_fac This becomes camera_calibration_prop. It's only readable by appdomain. Bug: 155844385 Test: no denials on Pixel devices Test: connect wifi Change-Id: If2b6c10fa124e29d1612a8f94ae18b223849e2a9
2020-07-20 13:26:07 +02:00
ro.opengles.version u:object_r:graphics_config_prop:s0 exact int
Add entries for some properties in default_prop Currently default_prop is readable by coredomain and appdomain. That's too broad, and we are going to restrict the access so every property should be added to property_contexts. This adds some missing properties to property_contexts. Newly added property contexts are: - wrap.*: used by zygote to give arguments. It's assigned as zygote_wrap_prop, and will be readable from coredomain. - partition.{mount_name}.verified: used by dm-verity. It's assigned as vertiy_status_prop, and will only be accessible from init. - (ro.)?setupwizard.*: used by setup wizard. It's assigned as setupwizard_prop, and will be readable from coredomain. Other properties, such as ro.gfx.*, media.stagefright.*, ro.storage_manager.* are also added to existing contexts. Bug: 170590987 Test: boot crosshatch and see no denials Change-Id: Ife9d69a62ee8bd7395a70cd104271898c8a72540
2020-11-05 14:17:26 +01:00
ro.gfx.driver.0 u:object_r:graphics_config_prop:s0 exact string
ro.gfx.driver.1 u:object_r:graphics_config_prop:s0 exact string
ro.gfx.angle.supported u:object_r:graphics_config_prop:s0 exact bool
ro.gfx.driver_build_time u:object_r:graphics_config_prop:s0 exact int
Move ro.gfx.* properties to graphics_config_prop To clean up bad context names exported*_prop. Bug: 155844385 Test: boot and see no denials Change-Id: Ie92e4293b8271bc137222a4c21637c740b06e156
2020-06-22 15:22:55 +02:00
Update sepolicy for GPU profiling properties. A device must indicate whether GPU profiling is supported or not through setting these two properties properly. CTS needs to read these two properties in order to run corresponding compliance tests. Hence need to update sepolicy for these two properties. Bug: b/157832445 Test: Test on Pixel 4 Change-Id: I6f400ecbbd5e78b645bb620fa24747e9367c2ff3 Merged-In: I6f400ecbbd5e78b645bb620fa24747e9367c2ff3
2020-06-03 21:20:41 +02:00
graphics.gpu.profiler.support u:object_r:graphics_config_prop:s0 exact bool
graphics.gpu.profiler.vulkan_layer_apk u:object_r:graphics_config_prop:s0 exact string
resolve merge conflicts of 98412ab60466c148370dd4ee4b83d3bb1e0a069c to rvc-dev-plus-aosp Test: I solemnly swear I tested this conflict resolution. Bug: None Change-Id: I831c2feb3b86bfa2008ef6e5b74e81399d8145d8
2020-06-15 11:04:12 +02:00
Add ro.cpuvulkan.version to property_contexts Bug: 173683489 Test: vts_treble_sys_prop_test Test: VulkanTest Change-Id: I4d78ed5de6640c4342c4f6c2362976577007a681
2020-11-20 08:23:00 +01:00
ro.cpuvulkan.version u:object_r:graphics_config_prop:s0 exact int
sepolicy: allow surfaceflinger to set surfaceflinger_display_prop W//system/bin/init: type=1107 audit(0.0:51): uid=0 auid=4294967295 ses=4294967295 subj=u:r:init:s0 msg='avc: denied { set } for property=graphics.display.kernel_idle_timer.enabled pid=643 uid=1000 gid=1003 scontext=u:r:surfaceflinger:s0 tcontext=u:object_r:surfaceflinger_display_prop:s0 tclass=property_service permissive=0 Bug: 157513573 Test: surfaceflinger can set graphics.display.kernel_idle_timer.enabled Test: vendor_init can get graphics.display.kernel_idle_timer.enabled Change-Id: I78023a7857c8aa81a8863010b875bcb885bae614
2020-06-17 16:13:21 +02:00
# surfaceflinger-settable
sepolicy: change vendor property to system property 1. Add surfaceflinger_display_prop property context 2. Set context for graphics.display.kernel_idle_timer.enabled 3. Context for system property that is get by surfaceflinger and set by vendor_init and system_app. W /system/bin/init: type=1107 audit(0.0:5): uid=0 auid=4294967295 ses=4294967295 subj=u:r:init:s0 msg='avc: denied { set } for property=vendor.display.enable_kernel_idle_timer pid=2396 uid=1000 gid=1000 scontext=u:r:system_app:s0 tcontext=u:object_r:vendor_display_prop:s0 tclass=property_service permissive=0' Bug:137064289 Test: $ make selinux_policy. Check kernel idle timer works correct. Change-Id: I77a82b5abfe5a771418dab5d40b404a1cdca4deb
2020-05-05 07:20:30 +02:00
graphics.display.kernel_idle_timer.enabled u:object_r:surfaceflinger_display_prop:s0 exact bool
resolve merge conflicts of 98412ab60466c148370dd4ee4b83d3bb1e0a069c to rvc-dev-plus-aosp Test: I solemnly swear I tested this conflict resolution. Bug: None Change-Id: I831c2feb3b86bfa2008ef6e5b74e81399d8145d8
2020-06-15 11:04:12 +02:00
Define power.battery_input.suspended property Bug: 167636754 Test: on a device that has triggers configured for this property Test: adb shell setprop power.battery_input.suspended true to disable charging Test: adb shell setprop power.battery_input.suspended false to reenable charging Merged-In: I79209530d5355a59a1cb7a61c629339cd62f8eb1 Merged-In: I4692d84d5c137d11c6f648d15083614e707fdd07 Change-Id: I4692d84d5c137d11c6f648d15083614e707fdd07
2020-09-11 03:51:58 +02:00
# Disable/enable charger input
power.battery_input.suspended u:object_r:power_debug_prop:s0 exact bool
Add zygote.critical_window.minute property This property controls the minimal timing window that triggers init process fatal abort, when the zygote service crashes repeatedly in it. Bug: 146818493 Change-Id: Ibd371be0daf6510df8b4d1a1f12f0aab8d6392c7
2020-05-12 18:50:50 +02:00
# zygote config property
zygote.critical_window.minute u:object_r:zygote_config_prop:s0 exact int
Add policy for property ro.android.security.keystore2.enable Bug: 171563717 Bug: 171305684 Test: N/A Change-Id: I323081fd2ce2fee80951c3d1e19b9935e4596705
2020-10-23 20:16:34 +02:00
Add ro.zygote.disable_gl_preload to policy It's used by ZygoteInit, and vendor_init should be able to set it. Bug: 176210699 Test: boot Change-Id: I27bb59c145f3257281fb8d6007be60eb2bcc93ca
2021-01-18 03:03:49 +01:00
ro.zygote.disable_gl_preload u:object_r:zygote_config_prop:s0 exact bool
init sets keystore.boot_level, keystore reads Bug: 176450483 Test: init can set, and keystore2 read, keystore.boot_level Test: `adb shell getprop -Z | grep boot_level` returns [keystore.boot_level]: [u:object_r:keystore_listen_prop:s0] Change-Id: Iedb37db19e9153995800fc97de6ee8c536179caa
2021-02-23 17:40:05 +01:00
# Broadcast boot stages, which keystore listens to
keystore.boot_level u:object_r:keystore_listen_prop:s0 exact int
Add entries for some properties in default_prop Currently default_prop is readable by coredomain and appdomain. That's too broad, and we are going to restrict the access so every property should be added to property_contexts. This adds some missing properties to property_contexts. Newly added property contexts are: - wrap.*: used by zygote to give arguments. It's assigned as zygote_wrap_prop, and will be readable from coredomain. - partition.{mount_name}.verified: used by dm-verity. It's assigned as vertiy_status_prop, and will only be accessible from init. - (ro.)?setupwizard.*: used by setup wizard. It's assigned as setupwizard_prop, and will be readable from coredomain. Other properties, such as ro.gfx.*, media.stagefright.*, ro.storage_manager.* are also added to existing contexts. Bug: 170590987 Test: boot crosshatch and see no denials Change-Id: Ife9d69a62ee8bd7395a70cd104271898c8a72540
2020-11-05 14:17:26 +01:00
partition.system.verified u:object_r:verity_status_prop:s0 exact string
partition.system_ext.verified u:object_r:verity_status_prop:s0 exact string
partition.product.verified u:object_r:verity_status_prop:s0 exact string
partition.vendor.verified u:object_r:verity_status_prop:s0 exact string
Set context for hash algorithm properties. Also move verity_status_prop to system_restricted_prop since we need to query it in cts tests Bug: 175236047 Test: atest CtsNativeVerifiedBootTestCases Change-Id: I82b26edaf5c5ad233bd83dff77eaafb9174646ef
2021-01-20 08:02:51 +01:00
partition.system.verified.hash_alg u:object_r:verity_status_prop:s0 exact string
partition.system_ext.verified.hash_alg u:object_r:verity_status_prop:s0 exact string
partition.product.verified.hash_alg u:object_r:verity_status_prop:s0 exact string
partition.vendor.verified.hash_alg u:object_r:verity_status_prop:s0 exact string
Add entries for some properties in default_prop Currently default_prop is readable by coredomain and appdomain. That's too broad, and we are going to restrict the access so every property should be added to property_contexts. This adds some missing properties to property_contexts. Newly added property contexts are: - wrap.*: used by zygote to give arguments. It's assigned as zygote_wrap_prop, and will be readable from coredomain. - partition.{mount_name}.verified: used by dm-verity. It's assigned as vertiy_status_prop, and will only be accessible from init. - (ro.)?setupwizard.*: used by setup wizard. It's assigned as setupwizard_prop, and will be readable from coredomain. Other properties, such as ro.gfx.*, media.stagefright.*, ro.storage_manager.* are also added to existing contexts. Bug: 170590987 Test: boot crosshatch and see no denials Change-Id: Ife9d69a62ee8bd7395a70cd104271898c8a72540
2020-11-05 14:17:26 +01:00
ro.setupwizard.enterprise_mode u:object_r:setupwizard_prop:s0 exact bool
ro.setupwizard.esim_cid_ignore u:object_r:setupwizard_prop:s0 exact string
ro.setupwizard.rotation_locked u:object_r:setupwizard_prop:s0 exact bool
ro.setupwizard.wifi_on_exit u:object_r:setupwizard_prop:s0 exact bool
setupwizard.enable_assist_gesture_training u:object_r:setupwizard_prop:s0 exact bool
setupwizard.feature.avoid_duplicate_tos u:object_r:setupwizard_prop:s0 exact bool
setupwizard.feature.baseline_setupwizard_enabled u:object_r:setupwizard_prop:s0 exact bool
setupwizard.feature.day_night_mode_enabled u:object_r:setupwizard_prop:s0 exact bool
setupwizard.feature.deferred_setup_low_ram_filter u:object_r:setupwizard_prop:s0 exact bool
setupwizard.feature.deferred_setup_notification u:object_r:setupwizard_prop:s0 exact bool
setupwizard.feature.deferred_setup_suggestion u:object_r:setupwizard_prop:s0 exact bool
setupwizard.feature.device_default_dark_mode u:object_r:setupwizard_prop:s0 exact bool
setupwizard.feature.esim_enabled u:object_r:setupwizard_prop:s0 exact bool
setupwizard.feature.google_services_deferred_setup_pretend_not_suw u:object_r:setupwizard_prop:s0 exact bool
setupwizard.feature.lock_mobile_data u:object_r:setupwizard_prop:s0 exact bool
setupwizard.feature.lock_mobile_data.carrier-1 u:object_r:setupwizard_prop:s0 exact bool
setupwizard.feature.portal_notification u:object_r:setupwizard_prop:s0 exact bool
setupwizard.feature.predeferred_enabled u:object_r:setupwizard_prop:s0 exact bool
setupwizard.feature.return_partner_customization_bundle u:object_r:setupwizard_prop:s0 exact bool
setupwizard.feature.show_pixel_tos u:object_r:setupwizard_prop:s0 exact bool
setupwizard.feature.use_biometric_lock u:object_r:setupwizard_prop:s0 exact bool
setupwizard.feature.wallpaper_suggestion_after_restore u:object_r:setupwizard_prop:s0 exact bool
setupwizard.logging u:object_r:setupwizard_prop:s0 exact bool
setupwizard.metrics_debug_mode u:object_r:setupwizard_prop:s0 exact bool
setupwizard.theme u:object_r:setupwizard_prop:s0 exact string
Add contexts for sqlite debug properties These are read by some apps, but don't have any corresponding property contexts. This adds a new context as we're going to remove default_prop access. Bug: 173360450 Test: no sepolicy denials Change-Id: I9be28d8e641eb6380d080150bee785a3cc304ef4
2020-11-17 05:54:52 +01:00
Fix malformed property_contexts entry Prefix entries should not have the suffix '*'. Test: set property and invoke getprop -Z Change-Id: I33dc7c6ac1bc05ecc1e3a7b331bc827717afa252
2020-12-14 14:22:55 +01:00
db.log.detailed u:object_r:sqlite_log_prop:s0 exact bool
db.log.slow_query_threshold u:object_r:sqlite_log_prop:s0 exact int
db.log.slow_query_threshold. u:object_r:sqlite_log_prop:s0 prefix int
Define SOC sysprop policy BUG: 158284209 Test: atest android.os.cts.BuildTest Change-Id: I7df7e575072c37ca379b97f60cc6c0850a02bcd1
2021-01-26 11:25:38 +01:00
# SOC related props
ro.soc.manufacturer u:object_r:soc_prop:s0 exact string
ro.soc.model u:object_r:soc_prop:s0 exact string
Add persist.rollback.is_test (6/n) This property is set to true in rollback tests to prevent fallback-to-copy when enabling rollbacks by hard linking. This gives us insights into how hard linking fails where it shouldn't. Bug: 168562373 Test: m Change-Id: Iab22954e9b9da21f0c3c26487cda60b8a1293b47
2021-02-24 07:29:06 +01:00
# set to true when running rollback tests to disable fallback-to-copy when enabling rollbacks
# to detect failures where hard linking should work otherwise
persist.rollback.is_test u:object_r:rollback_test_prop:s0 exact bool
Add bootanim property context, ro.bootanim.quiescent.enabled property Add property & property context to configure whether the bootanimation should be played in a quiescent boot. Bug: 185118020 Test: Set property through PRODUCT_PRODUCT_PROPERTIES Test: Read property from bootanimation process Change-Id: Ib9e88444da7f5e8000d7367199f5230f1e4d26d9
2021-04-15 16:55:37 +02:00
# bootanimation properties
Add a sysprop to set display update imminent timeout Adding 'ro.surface_flinger.display_update_imminent_timeout_ms' to set timeout for rate limit display update imminent notifications. Bug: 164411401 Change-Id: I90a00fe7f8df3aa505f08081d096fd83b3342f59
2021-04-27 14:45:29 +02:00
ro.bootanim.quiescent.enabled u:object_r:bootanim_config_prop:s0 exact bool
Reference in a new issue Copy permalink