tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
platform_system_sepolicy/private/service_contexts

382 lines
30 KiB
Text
Raw Normal View History

Add sepolicy for authsecret AIDL HAL Bug: 176107318 Change-Id: I49bc68fb5a92bcbc2f1d2c78f0741f8eff97fc06
2020-12-24 14:00:43 +01:00
android.hardware.authsecret.IAuthSecret/default u:object_r:hal_authsecret_service:s0
Revert^2 "Updates sepolicy for EVS HAL" 418f41ad13eced0ad509e7315af1b26cfa3eca8c Bug: 216727303 Test: m -j selinux_policy on failed targets reported in b/218802298 Change-Id: Iec8fd2a1e9073bf3dc679e308407572a8fcf44d9
2022-02-10 15:09:02 +01:00
android.hardware.automotive.evs.IEvsEnumerator/hw/0 u:object_r:hal_evs_service:s0
android.hardware.automotive.evs.IEvsEnumerator/hw/1 u:object_r:hal_evs_service:s0
Add hal_vehicle_service for AIDL VHAL service. Add selinux policy for AIDL Vehicel HAL service. This CL mostly follows https://android-review.googlesource.com/c/platform/system/sepolicy/+/1541205/. Test: Manually test on emulator, verify AIDL VHAL service is up and accessible by client. Bug: 209718034 Change-Id: Icad92e357dacea681b8539f6ebe6110a8ca8b357
2021-12-08 07:16:21 +01:00
android.hardware.automotive.vehicle.IVehicle/default u:object_r:hal_vehicle_service:s0
Adding support for AIDL AudioControl HAL Bug: 170335834 Test: built and ran without sepolicy issues Change-Id: Ia25b82aaf676fd2bd37e60bc0d2960f398fa3c90
2020-10-23 22:30:14 +02:00
android.hardware.automotive.audiocontrol.IAudioControl/default u:object_r:hal_audiocontrol_service:s0
Add sepolicy for IFace Bug: 168730443 Test: run on cuttlefish Change-Id: Ie3cf791e7aac090788c7213d23487ae9f50b0690
2020-09-25 20:38:42 +02:00
android.hardware.biometrics.face.IFace/default u:object_r:hal_face_service:s0
Add sepolicy for IFingerprint Bug: 152416783 Test: run on cuttlefish Change-Id: I58d7c3bc9c81612b03bab3b9da938c091c02e3c1
2020-09-02 22:32:05 +02:00
android.hardware.biometrics.fingerprint.IFingerprint/default u:object_r:hal_fingerprint_service:s0
Add Bluetooth Audio HAL rules Test: manual Bug: 203490261 Change-Id: Ic9994cdb8ed690996d83b46cfefbc228e35d34c3
2021-12-27 16:36:01 +01:00
android.hardware.bluetooth.audio.IBluetoothAudioProviderFactory/default u:object_r:hal_audio_service:s0
System wide sepolicy changes for aidl camera hals. Bug: 196432585 Test: Camera CTS Change-Id: I0ec0158c9cf82937d6c00841448e6e42f6ff4bb0 Signed-off-by: Jayant Chowdhary <jchowdhary@google.com>
2022-01-20 09:47:54 +01:00
# The instance here is internal/0 following naming convention for ICameraProvider.
# It advertises internal camera devices.
android.hardware.camera.provider.ICameraProvider/internal/0 u:object_r:hal_camera_service:s0
Context Hub stable AIDL sepolicy Bug: 194285834 Test: TreeHugger Change-Id: I88675f7f61821619abbff87fa5ee321836745324
2021-08-11 00:06:43 +02:00
android.hardware.contexthub.IContextHub/default u:object_r:hal_contexthub_service:s0
Add sepolicy for DRM AIDL HAL Bug: 208486736 Test: atest VtsAidlHalDrmTargetTest Change-Id: Ia2b1488a564d94384d183d30291fbf5a6d2df4ab
2022-01-20 08:34:37 +01:00
android.hardware.drm.IDrmFactory/clearkey u:object_r:hal_drm_service:s0
android.hardware.drm.ICryptoFactory/clearkey u:object_r:hal_drm_service:s0
Update sepolicy to add dumpstate device service for AIDL HAL - Add hal_dumpstate_service AIDL service to hal_dumpstate.te, service.te - Add default example hal_dumpstate service to file_contexts, service_contexts - Adde hal_dumpstate_service to API level 31 compatibility ignore list (31.0.ignore.cil) Bug: 205760700 Test: VtsHalDumpstateTargetTest, dumpstate, dumpstate_test, dumpsys Change-Id: If49fa16ac5ab1d3a1930bb800d530cbd32c5dec1
2021-11-16 10:06:00 +01:00
android.hardware.dumpstate.IDumpstateDevice/default u:object_r:hal_dumpstate_service:s0
Add GNSS AIDL interfaces (system/sepolicy) Bug: 159467682 Test: built and run on cuttlefish Change-Id: I071e8427ea0251139661aa8123376c56e0839390
2020-09-15 20:35:29 +02:00
android.hardware.gnss.IGnss/default u:object_r:hal_gnss_service:s0
Add IAllocator stable-aidl Test: Builds & boots; no sepolicy errors logged Bug: 193558894 Change-Id: I11e162310548b67addc032ccc0d499cbf391e7f9
2022-01-18 22:58:19 +01:00
android.hardware.graphics.allocator.IAllocator/default u:object_r:hal_graphics_allocator_service:s0
Composer stable AIDL HAL sepolicy Test: build + presubmit Bug: 198690444 Change-Id: I6a26823c4ad363d137526c96580b05363d0ac894
2021-10-20 02:09:30 +02:00
android.hardware.graphics.composer3.IComposer/default u:object_r:hal_graphics_composer_service:s0
Add health storage AIDL service. Test: adb shell sm idle-maint run Bug: 177470478 Change-Id: Id7ee5af64e8d21eafd041c9e8fa1382f65a3958b
2021-01-16 01:33:41 +01:00
android.hardware.health.storage.IStorage/default u:object_r:hal_health_storage_service:s0
Add health AIDL HAL. Test: pass Bug: 177269435 Change-Id: I755d5158715b38a89a28af753ad4c27cdfa93546
2021-10-20 22:43:45 +02:00
android.hardware.health.IHealth/default u:object_r:hal_health_service:s0
Add SELinux policy for credstore and update for IC HAL port from HIDL to AIDL. The credstore service is a system service which backs the android.security.identity.* Framework APIs. It essentially calls into the Identity Credential HAL while providing persistent storage for credentials. Bug: 111446262 Test: atest android.security.identity.cts Test: VtsHalIdentityTargetTest Test: android.hardware.identity-support-lib-test Change-Id: I5cd9a6ae810e764326355c0842e88c490f214c60
2020-01-17 22:47:53 +01:00
android.hardware.identity.IIdentityCredentialStore/default u:object_r:hal_identity_service:s0
Add sepolicy for IInputProcessor HAL This sepolicy is needed so that the vendor can launch a new HAL process, and then this HAL process could join the servicemanager as an impl for IInputProcessor. This HAL will be used to contain the previous impl of InputClassifier and also new features that we are going to add. Bug: 210158587 Test: use together with a HAL implementation, make sure HAL runs Change-Id: I476c215ad622ea18b4ce5cba9c07ae3257a65817
2022-01-12 00:06:14 +01:00
android.hardware.input.processor.IInputProcessor/default u:object_r:hal_input_processor_service:s0
Add policy for new AIDL IR hal IR interface is converted to AIDL and this contains the necessary permissions for the default service to serve the interface. Test: atest VtsHalIrTargetTest hal_implementation_test Test: check for permission issues after tests Bug: 205000342 Change-Id: I8d9d81d957bf6ef3c6d815ce089549f8f5337555
2021-11-09 22:01:09 +01:00
android.hardware.ir.IConsumerIr/default u:object_r:hal_ir_service:s0
Add rules for Lights AIDL HAL Test: manual; yukawa and cuttlefish; adb logcat | grep -i avc Bug: 142230898 Change-Id: I9f576511d1fc77c5f0ad3cf1b96b038b301773d7
2020-01-21 16:37:44 +01:00
android.hardware.light.ILights/default u:object_r:hal_light_service:s0
Reland: Memtrack HAL stable aidl sepolicy Bug: 175021432 Test: Check logcat for denials Change-Id: Id92fc543791072d8682e3a89cbf08370007108bf
2020-12-07 02:51:08 +01:00
android.hardware.memtrack.IMemtrack/default u:object_r:hal_memtrack_service:s0
SEPolicy for Netlink Interceptor Make Netlink Interceptor work when SELinux is enforcing Test: Netlink Interceptor HAL comes up and works Bug: 194683902 Change-Id: I3afc7ae04eba82f2f6385b66ddd5f4a8310dff88
2021-10-06 01:53:52 +02:00
android.hardware.net.nlinterceptor.IInterceptor/default u:object_r:hal_nlinterceptor_service:s0
Add hal_nfc_service Bug: 204868826 Test: atest VtsAidlHalNfcTargetTest Change-Id: If01d1d0a74f5c787805d3744772d40a7aa7db9cb
2021-10-29 09:51:15 +02:00
android.hardware.nfc.INfc/default u:object_r:hal_nfc_service:s0
Add sepolicy for oemlock aidl HAL Bug: 176107318 Change-Id: I26f8926401b15136f0aca79b3d5964ab3b59fbdd
2020-12-25 10:30:11 +01:00
android.hardware.oemlock.IOemLock/default u:object_r:hal_oemlock_service:s0
stable aidl Power HAL policy Test: boot and dumpsys -l Change-Id: I58022c9e0c24ba4e2d695acf63375c9f74c51b22
2020-01-10 20:42:33 +01:00
android.hardware.power.IPower/default u:object_r:hal_power_service:s0
Stats: new sepolicy for the AIDL service Allows the AIDL IStats service to be exposed via ServiceManager Defines IStats service client domain to be used by pixelstats_vendor Bug: 178859845 Test: Build, flash, and aidl_stats_client Change-Id: If41e50d0182993d0b7f8501e9147e0becf526689
2021-02-02 19:23:00 +01:00
android.hardware.power.stats.IPowerStats/default u:object_r:hal_power_stats_service:s0
Combining hal_radio_*_service into hal_radio_service Test: build and flash Bug: 198331673 Change-Id: Id5d699ffc77f708e2144ffea6d2a6805822e7f50
2022-01-24 20:42:38 +01:00
android.hardware.radio.config.IRadioConfig/default u:object_r:hal_radio_service:s0
android.hardware.radio.data.IRadioData/slot1 u:object_r:hal_radio_service:s0
android.hardware.radio.data.IRadioData/slot2 u:object_r:hal_radio_service:s0
android.hardware.radio.data.IRadioData/slot3 u:object_r:hal_radio_service:s0
android.hardware.radio.messaging.IRadioMessaging/slot1 u:object_r:hal_radio_service:s0
android.hardware.radio.messaging.IRadioMessaging/slot2 u:object_r:hal_radio_service:s0
android.hardware.radio.messaging.IRadioMessaging/slot3 u:object_r:hal_radio_service:s0
android.hardware.radio.modem.IRadioModem/slot1 u:object_r:hal_radio_service:s0
android.hardware.radio.modem.IRadioModem/slot2 u:object_r:hal_radio_service:s0
android.hardware.radio.modem.IRadioModem/slot3 u:object_r:hal_radio_service:s0
android.hardware.radio.network.IRadioNetwork/slot1 u:object_r:hal_radio_service:s0
android.hardware.radio.network.IRadioNetwork/slot2 u:object_r:hal_radio_service:s0
android.hardware.radio.network.IRadioNetwork/slot3 u:object_r:hal_radio_service:s0
android.hardware.radio.sim.IRadioSim/slot1 u:object_r:hal_radio_service:s0
android.hardware.radio.sim.IRadioSim/slot2 u:object_r:hal_radio_service:s0
android.hardware.radio.sim.IRadioSim/slot3 u:object_r:hal_radio_service:s0
android.hardware.radio.voice.IRadioVoice/slot1 u:object_r:hal_radio_service:s0
android.hardware.radio.voice.IRadioVoice/slot2 u:object_r:hal_radio_service:s0
android.hardware.radio.voice.IRadioVoice/slot3 u:object_r:hal_radio_service:s0
stable aidl Power HAL policy Test: boot and dumpsys -l Change-Id: I58022c9e0c24ba4e2d695acf63375c9f74c51b22
2020-01-10 20:42:33 +01:00
android.hardware.rebootescrow.IRebootEscrow/default u:object_r:hal_rebootescrow_service:s0
Dice HAL: Add policy for dice HAL. And allow diced to talk to the dice HAL. Bug: 198197213 Test: N/A Change-Id: I74797b13656b38b50d7cd28a4c4c6ec4c8d1d1aa
2021-11-10 23:52:05 +01:00
android.hardware.security.dice.IDiceDevice/default u:object_r:hal_dice_service:s0
Clean up keymint service policy. Test: VtsAidlKeyMintTargetTest Change-Id: Id6e83d63ffb1de7c48dbdf435fd9988e9174cfe2
2020-12-11 02:48:31 +01:00
android.hardware.security.keymint.IKeyMintDevice/default u:object_r:hal_keymint_service:s0
Adding SEPolicy for IRemotelyProvisionedComponent This SEPolicy change allows the hal_keymint domain to add hal_remotelyprovisionedcomponent_service to hwservice_manager. Test: The Keymint HAL can successfully start an instance of IRemotelyProvisionedComponent Change-Id: I15f34daf319e8de5b656bfacb8d050950bf8f250
2021-02-02 08:40:24 +01:00
android.hardware.security.keymint.IRemotelyProvisionedComponent/default u:object_r:hal_remotelyprovisionedcomponent_service:s0
The SE Policies to incorporate ISecureClock and ISharedSecret services along with IKeyMintDevice service into default keymint HAL Server. Test: Rebuild, execute and run atest VtsAidlSharedSecretTargetTest and atest VtsAidlSecureClockTargetTest. Bug: b/171844725, b/168673523. Change-Id: I8b81ec12c45566d31edcd117e41fd559df32c37d
2021-01-28 07:55:21 +01:00
android.hardware.security.secureclock.ISecureClock/default u:object_r:hal_secureclock_service:s0
android.hardware.security.sharedsecret.ISharedSecret/default u:object_r:hal_sharedsecret_service:s0
Sensors stable AIDL HAL sepolicy Bug: 195593357 Test: TreeHugger Change-Id: I02b88a93d829654a1ce946681b59e648b2cd7550
2021-10-15 17:47:13 +02:00
android.hardware.sensors.ISensors/default u:object_r:hal_sensors_service:s0
Add soundtrigger3 HAL (AIDL) to sepolicy Test: Compile and boot. Don't yet have a HAL implementation to test with. Change-Id: I387abd0e8913eef865cba2aee0a4ef714232bb19
2021-03-22 21:00:38 +01:00
android.hardware.soundtrigger3.ISoundTriggerHw/default u:object_r:hal_audio_service:s0
Allow Tuner AIDL sample HAL. Bug: 191825295 Test: tuner HAL can run Change-Id: I069da68cb4fec535c6549a9a0f89202eb17ef003
2021-06-24 05:07:49 +02:00
android.hardware.tv.tuner.ITuner/default u:object_r:hal_tv_tuner_service:s0
Add selinux rules for android.hardware.usb.IUsb AIDL migration Covers the rules needed for the default AIDL implementation. Bug: 200993386 Signed-off-by: Badhri Jagan Sridharan <badhri@google.com> Change-Id: Ib152d12686e225e3c1074295a70c624a5115e9bd
2022-01-20 23:27:15 +01:00
android.hardware.usb.IUsb/default u:object_r:hal_usb_service:s0
sepolicy: Change UWB HAL from HIDL to versioned AIDL No new HIDL HAL's are allowed in Android T. UWB HAL converted to versioned AIDL interface to be compliant. Bug: 195308730 Test: Compiles Change-Id: I35cf8edd244baa02778ee8eff46840ae26424869
2021-08-25 21:41:09 +02:00
android.hardware.uwb.IUwb/default u:object_r:hal_uwb_service:s0
stable aidl Power HAL policy Test: boot and dumpsys -l Change-Id: I58022c9e0c24ba4e2d695acf63375c9f74c51b22
2020-01-10 20:42:33 +01:00
android.hardware.vibrator.IVibrator/default u:object_r:hal_vibrator_service:s0
Add IVibratorManager to sepolicy service_contexts Bug: 166586119 Change-Id: Ia9339d34bcc7a22d5785cf7c810282f7cb0b724f Test: N/A
2020-11-12 20:32:48 +01:00
android.hardware.vibrator.IVibratorManager/default u:object_r:hal_vibrator_service:s0
Add sepolicy for weaver aidl HAL service Bug: 176107318 Change-Id: I9ca1a68e45b462c9b6ac912debb196b3a3ca45ba
2021-01-05 10:14:21 +01:00
android.hardware.weaver.IWeaver/default u:object_r:hal_weaver_service:s0
Add SeLinux policy for hostapd AIDL service. Bug: 194806512 Test: Manual test wifi hotspot. Change-Id: I12b3e93650fcc6f2ea8794970fa8cf62c0a82475
2021-07-08 07:06:53 +02:00
android.hardware.wifi.hostapd.IHostapd/default u:object_r:hal_wifi_hostapd_service:s0
Add SeLinux policy for supplicant AIDL service. Bug: 196235436 Test: Manual - connect to WiFi Change-Id: I613a2e7eac620543872a1af7ed477b8d36713b45
2021-10-06 02:16:21 +02:00
android.hardware.wifi.supplicant.ISupplicant/default u:object_r:hal_wifi_supplicant_service:s0
Stats: new sepolicy for the AIDL service Allows the AIDL IStats service to be exposed via ServiceManager Defines IStats service client domain to be used by pixelstats_vendor Bug: 178859845 Test: Build, flash, and aidl_stats_client Change-Id: If41e50d0182993d0b7f8501e9147e0becf526689
2021-02-02 19:23:00 +01:00
android.frameworks.stats.IStats/default u:object_r:fwk_stats_service:s0
Support for OMAPI Vendor stable interface Label defined for OMAPI Vendor Stable Interface Bug: b/180639372 Test: Run OMAPI CTS and VTS tests Change-Id: Ifa67a22c85ffb38cb377a6e347b0e1f18af1d0f8
2021-09-14 19:14:02 +02:00
android.se.omapi.ISecureElementService/default u:object_r:secure_element_service:s0
Add IKeystoreService interface to keystore_service IKeystoreService is a VINTF stability interface, and keystore2 is now using this interface correctly from Rust. Test: m && adb shell start keystore2 Bug: 179907868 Change-Id: I3b583df2fac7e6bca7c1875efb7650f9ea0a548c
2021-03-11 02:50:01 +01:00
android.system.keystore2.IKeystoreService/default u:object_r:keystore_service:s0
sepolicy: Serve suspend AIDL hal from system_suspend Allow system_suspend to server the suspend AIDL hal service. Bug: 170260236 Test: Check logcat for supend avc denials Change-Id: Ie4c07e2e8d75fd4b12e55db15511060e09be59cf
2021-07-20 17:13:38 +02:00
android.system.suspend.ISystemSuspend/default u:object_r:hal_system_suspend_service:s0
stable aidl vibrator policy Bug: 141828236 Test: boot, dumpsys -l Change-Id: Id3fc8724238883116e840794309efbf6c91226c9
2019-10-26 00:04:45 +02:00
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
accessibility u:object_r:accessibility_service:s0
account u:object_r:account_service:s0
activity u:object_r:activity_service:s0
Added sepolicy for activity_task service Bug: 80414790 Test: boots Change-Id: I3d6bb4e7da9d697ec8ff7502880543be89aee349
2018-05-31 00:26:41 +02:00
activity_task u:object_r:activity_task_service:s0
Add ADB system service ADB is being separated from USB service since it's not tied to the USB transport. This duplicates the usb_service's settings to adb_service for this purpose. Bug: 63820489 Test: make Change-Id: Idbcfbe470d7568f9cba51f0c8d4a8ee9503db93d
2018-01-25 08:12:39 +01:00
adb u:object_r:adb_service:s0
Add aidl_lazy_test_server This is a test service for testing dynamic start/stop of AIDL services. In order to test realistic use cases with SELinux enabled, it requires the same permissions as a regular service. Bug: 147153962 Test: aidl_lazy_test aidl_lazy_test_1 aidl_lazy_test_2 Change-Id: Ifc3b2eaefba9c06c94f9cf24b4474107d4e26563
2020-01-04 01:32:07 +01:00
aidl_lazy_test_1 u:object_r:aidl_lazy_test_service:s0
aidl_lazy_test_2 u:object_r:aidl_lazy_test_service:s0
SELinux policy for lazy AIDL/HIDL testing services. These services are used for running tests on Cuttlefish. Bug: 191781736 Test: atest aidl_lazy_test Test: atest hidl_lazy_test Ignore-AOSP-First: already in AOSP, automerger issue workaround Change-Id: Iec43c3d19ba5072dbfa6573a6d74106672f94972
2021-07-02 23:25:17 +02:00
aidl_lazy_cb_test u:object_r:aidl_lazy_test_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
alarm u:object_r:alarm_service:s0
Revert^2 "Adds a sepolicy for EVS manager service" 0137c98b90d709c246d55c24eeea1204d6eca9a1 Bug: 216727303 Test: m -j selinux_policy on failed targets reported in b/218802298 Change-Id: I2ae2fc85a4055f2cb7d19ff70b120e7b7ff0957d
2022-02-10 15:09:02 +01:00
android.hardware.automotive.evs.IEvsEnumerator/default u:object_r:evsmanagerd_service:s0
update_engine: Allow to access bootctrl_block_device. update_engine needs to access bootctrl_block_device to get and set the slot to boot. avc: denied { write } for name="mmcblk0boot1" dev="tmpfs" ino=1266 scontext=u:r:update_engine:s0 tcontext=u:object_r:bootctrl_block_device:s0 tclass=blk_file avc: denied { open } for path="/dev/block/mmcblk0boot1" dev="tmpfs" ino=1266 scontext=u:r:update_engine:s0 tcontext=u:object_r:bootctrl_block_device:s0 tclass=blk_file Also track the name change of the native binder service. avc: denied { add } for service=android.os.UpdateEngineService pid=210 uid=0 scontext=u:r:update_engine:s0 tcontext=u:object_r:default_android_service:s0 tclass=service_manager Bug: 27106053 Change-Id: Idbfef18578489db33fead0721e8f26d63db5ce09 (cherry picked from commit 3ec34ceb43b15c30e9c7bf1720ebea24f868d07a)
2016-02-09 23:12:58 +01:00
android.os.UpdateEngineService u:object_r:update_engine_service:s0
Add update_engine_stable_service This is the stable AIDL binder interface that update_engine exposes in addition to update_engine_service. Test: run update_engine Bug: 160996544 Change-Id: I28ba11810844373d48c8c203f79e98150f932942
2020-07-23 04:57:15 +02:00
android.os.UpdateEngineStableService u:object_r:update_engine_stable_service:s0
Adds selinux rules for ICarDisplayProxy service Bug: 170401743 Test: m -j selinux_policy Change-Id: Idf3f09d0bcf24de18d6eddb05e51991b4c5edbe8
2022-01-31 18:23:32 +01:00
android.frameworks.automotive.display.ICarDisplayProxy/default u:object_r:fwk_automotive_display_service:s0
Add policy for the android protected confirmation service. This is the service offered by Keystore 2.0 to provide APC service to application. It was formerly part of the IKeystoreService interface. Not it is an interface in ints own right. Test: Keystore 2.0 can register the apc service interface. Apps can lookup and call this interface. Bug: 159341464 Change-Id: I058adf0021d9b89f4eac7534e366c29071f0f98b
2020-12-02 03:55:11 +01:00
android.security.apc u:object_r:apc_service:s0
Add policy for IKeystoreAuthorization AIDL service. The interaface now provided by IKeystoreAuthorization AIDL interface was previously provided by Keystore AIDL interface. This CL adds policy to allow Keystore2 to register IKeystoreAuthorization aidl service and to allow service manager to look up and connect to the service. Bug: 159475191 Test: Needs to be tested in runtime Change-Id: I56829a8764e0efe55efdc92b75d7a3d918a20dae
2020-12-17 02:36:21 +01:00
android.security.authorization u:object_r:authorization_service:s0
Add policy for the security compatibility hal service. This service manager is registered by Keystore 2.0 to lookup legacy wrapper services. Keystore 2.0 is now written in rust. We have AIDL binding for rust but no HIDL binding. Keystore 2.0 has to support legacy HIDL based interfaces. So we implement the AIDL KeyMint interface in terms of the legacy HIDL Keymaster <= V4.1 devices in C++. This wrapper is linked into the Keystore 2.0 process but it cannot be called directly but must be treated like a remote binder instead. However, we cannot register these wrappers directly, because a) we are not a vendor component, and b) it would conflict with genuine KeyMint devices on newer devices. So Instead we register Keystore 2.0 itself as a legacy service provider. Which it can query itself for the legacy wrappers if it does not find a genuine KeyMint implementation to connect to. Bug: 171351607 Test: Keystore 2.0 can register this Service and lookup legacy wrapper services. Change-Id: I935f23837721ce126531236f4920dba469a47be4
2020-12-02 18:52:42 +01:00
android.security.compat u:object_r:keystore_compat_hal_service:s0
Diced: Add policy for diced the DICE daemon. Bug: 198197213 Test: N/A Change-Id: I5d0b06e3cd0c594cff6120856ca3bb4f7c1dd98d
2021-11-10 02:49:02 +01:00
android.security.dice.IDiceMaintenance u:object_r:dice_maintenance_service:s0
android.security.dice.IDiceNode u:object_r:dice_node_service:s0
Add SELinux policy for credstore and update for IC HAL port from HIDL to AIDL. The credstore service is a system service which backs the android.security.identity.* Framework APIs. It essentially calls into the Identity Credential HAL while providing persistent storage for credentials. Bug: 111446262 Test: atest android.security.identity.cts Test: VtsHalIdentityTargetTest Test: android.hardware.identity-support-lib-test Change-Id: I5cd9a6ae810e764326355c0842e88c490f214c60
2020-01-17 22:47:53 +01:00
android.security.identity u:object_r:credstore_service:s0
Add SELinux rules for service_manager. Add a service_mananger class with the verb add. Add a type that groups the services for each of the processes that is allowed to start services in service.te and an attribute for all services controlled by the service manager. Add the service_contexts file which maps service name to target label. Bug: 12909011 Change-Id: I017032a50bc90c57b536e80b972118016d340c7d
2014-06-06 00:52:02 +02:00
android.security.keystore u:object_r:keystore_service:s0
Rename vpnprofilestore to legacykeystore. Ignore-AOSP-First: No mergepath from AOSP. Bug: 191373871 Test: N/A Change-Id: I3f11827909bd37a2127069de82670776a8e192b3
2021-06-15 17:01:16 +02:00
android.security.legacykeystore u:object_r:legacykeystore_service:s0
Keystore 2.0: Rename KeystoreUserManager to KeystoreMaintenance Test: N/A Change-Id: I40c07e40cb0a852814058fe89d57c44ea85f1994
2021-03-08 18:19:38 +01:00
android.security.maintenance u:object_r:keystore_maintenance_service:s0
Add keystore permission for metrics re-routing. Keystore2 atoms need to be rounted to statsd via a proxy. The proxy needs to have this permission in order to pull metrics from keystore. Ignore-AOSP-First: No mergepath to AOSP. Bug: 188590587 Test: Statsd Testdrive script Change-Id: Ic94f4bb19a08b6300cfd2d3ed09b31d5b7081bfd
2021-06-10 17:05:49 +02:00
android.security.metrics u:object_r:keystore_metrics_service:s0
SEPolicy for RemoteProvisioning App This change adds the SEPolicy changes required to support the remote provisioning flow. The notable additions are specifically labeling the remote provisioning app and giving it access to find the remote provisioning service which is added in keystore. It also requires network access in order to communicate to the provisioning servers. This functionality is extremely narrow to the point that it seems worth it to define a separate domain for this app, rather than add this in to the priv_app or platform_app permission files. Since this app also communicates with the network, it also seems advantageous to limit its permissions only to what is absolutely necessary to perform its function. Test: No denials! Change-Id: I602c12365a575d914afc91f55e6a9b6aa2e14189
2020-12-24 06:53:08 +01:00
android.security.remoteprovisioning u:object_r:remoteprovisioning_service:s0
Add remotely provisioned key pool se policy Keystore now hosts a native binder for the remotely provisioned key pool, which is used to services such as credstore to lookup remotely provisioned keys. Add a new service context and include it in the keystore services. Add a dependency on this new service for credstore. Also include a credstore dependency on IRemotelyProvisionedComponent, as it's needed to make use of the key pool. Bug: 194696876 Test: CtsIdentityTestCases Change-Id: I0fa71c5be79922a279eb1056305bbd3e8078116e
2022-02-02 22:36:50 +01:00
android.security.remoteprovisioning.IRemotelyProvisionedKeyPool u:object_r:remotelyprovisionedkeypool_service:s0
SELinux permissions for gatekeeper TEE proxy sets up: - execute permissions - binder permission (system_server->gatekeeper->keystore) - prevents dumpstate and shell from finding GK binder service - neverallow rules for prohibited clients Change-Id: I1817933a91de625db469a20c7a4c8e2ca46efa1e
2015-04-04 01:46:33 +02:00
android.service.gatekeeper.IGateKeeperService u:object_r:gatekeeper_service:s0
Initial sepolicy for composd Add what we need to allow composd to run and expose an AIDL service. Also delete the policy for compsvc; we never access it in the host now, and the real policy is in microdroid. Retain the compos_exec type, since it is referenced in the APEX sepolicy. Bug: 186126194 Test: adb shell cmd -w android.system.composd; no denials. Change-Id: I5f06b2b01852cdebd2d67009b363ec08b17ce33a
2021-09-09 18:08:15 +02:00
android.system.composd u:object_r:compos_service:s0
android.system.virtualizationservice u:object_r:virtualization_service:s0
SELinux policy changes for AmbientContext system API. Context about this is on ag/16302285 Test: Ensure no build failures, ensure no SecurityException on boot Bug: 192476579 Change-Id: If5ba2fa41975acf91c0002a0f301da11eaebd6d2
2021-12-16 20:06:17 +01:00
ambient_context u:object_r:ambient_context_service:s0
Add app_binding system service Bug: 109809543 Test: Build and boot with the new service in the internal branch. Change-Id: Iaee365771c3e8e5b8f5f3b6112bbf902c6bb02bd
2018-09-05 02:13:16 +02:00
app_binding u:object_r:app_binding_service:s0
Add sepolicy for app hibernation system service Add selinux policy so the app hibernation system service can be accessed by other processes/apps. Bug: 175829330 Test: builds Change-Id: I96ea9dd977ec007bc11560601554547749b4df03
2021-01-21 21:37:40 +01:00
app_hibernation u:object_r:app_hibernation_service:s0
Add sepolicy for AppIntegrityService. CL that adds the service: http://ag/9554748 BUG:145674997 Test: Manually flash the device. Without this change, the devices goes into a bootloop (http://gpaste/5033431010377728) if I uncommit the guard in http://ag/c/platform/frameworks/base/+/9652133/21/services/core/java/com/android/server/integrity/AppIntegrityManagerService.java Change-Id: Ib2daf9191900d94abeae207e18a77a5914d14783
2019-12-05 12:24:54 +01:00
app_integrity u:object_r:app_integrity_service:s0
New system service: app_prediction_service - Update policy for new system service, used for SystemUI/Apps to present predicted apps in their UI. Bug: 111701043 Test: manual verification Change-Id: Ia3b5db987097d2d71bf774ca550041e03214471d
2018-11-19 22:58:19 +01:00
app_prediction u:object_r:app_prediction_service:s0
Add a new system service for app search management. This change app-search-service to sepolicy system service. Bug: 142567528 Test: Manual Change-Id: Ife7b09365d667da0ad370e586af828f8f4423660
2019-11-05 23:27:44 +01:00
app_search u:object_r:app_search_service:s0
Add policy for apexd. apexd is a new daemon for managing APEX packages installed on the device. It hosts a single binder service, "apexservice". Bug: 112455435 Test: builds, binder service can be registered, apexes can be accessed, verified and mounted Change-Id: I634ad100f10b2edcd9a9c0df0d33896fa5d4ed97
2018-08-17 09:35:42 +02:00
apexservice u:object_r:apex_service:s0
SEPolicy changes to support Attestation Verification Service Bug: 201696614 Change-Id: I4a7a830ba809ed59a030a87c4f479199685d8a42 Test: Verify device boots
2021-10-08 23:53:24 +02:00
attestation_verification u:object_r:attestation_verification_service:s0
Add a new system service "blob_store". Bug: 143559646 Test: manual Change-Id: Id13566e9efc815f4a6ebb7228a1145aa91d6d526
2019-10-29 23:28:20 +01:00
blob_store u:object_r:blob_store_service:s0
sepolicy for gsid Bug: 122556707 Test: gsid starts Change-Id: Ib05ddb79051436f51cd236de04027a3b12ee87a9 Signed-off-by: Sandeep Patil <sspatil@google.com>
2019-01-14 23:38:17 +01:00
gsiservice u:object_r:gsi_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
appops u:object_r:appops_service:s0
appwidget u:object_r:appwidget_service:s0
Add SELinux properties for artd Test: boot device and check for artd process Change-Id: I2a161701102ecbde3e293af0346d1db0b11d4aab
2021-03-03 21:30:28 +01:00
artd u:object_r:artd_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
assetatlas u:object_r:assetatlas_service:s0
Add selinux setting for attention Bug: 126472144 Test: adb shell dumpsys attention Change-Id: Ie421b719c8fc0414ee664055aa5d007c081edf17
2019-03-12 02:40:44 +01:00
attention u:object_r:attention_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
audio u:object_r:audio_service:s0
Add AuthService to sepolicy AuthService is introduced in ag/9700446. Bug: 141025588 Test: can successfully publish AuthService with publishBinderService(...) Change-Id: I0f9fceac0c555d05a29467e4ab1380f389b60af4
2019-11-15 00:32:24 +01:00
auth u:object_r:auth_service:s0
Creates an autofill system service. BUG: 31001899 Test: manual Change-Id: I8d462b40d931310eab26bafa09645ac88f13fc97
2016-10-18 01:25:36 +02:00
autofill u:object_r:autofill_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
backup u:object_r:backup_service:s0
Mark batteryproperties service as app_api_service. Applications do not explicitly request handles to the batteryproperties service, but the BatteryManager obtains a reference to it and uses it for its underlying property queries. Mark it as an app_api_service so that all applications may use this API. Also remove the batterypropreg service label, as this does not appear to be used and may have been a duplication of batteryproperties. As a result, remove the healthd_service type and replace it with a more specific batteryproperties_service type. (cherry-picked from commit: 9ed71eff4bed91653cba393ea6cb42f041d4e257) Bug: 27442760 Change-Id: I537c17c09145b302728377bf856c1147e4cc37e9
2016-03-14 20:21:18 +01:00
batteryproperties u:object_r:batteryproperties_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
batterystats u:object_r:batterystats_service:s0
battery u:object_r:battery_service:s0
Added SELinux policy for BinderCallsStatsService Test: manual Bug: 75318418 Change-Id: I700c1b8b613dba1c99f4fbffdd905c0052c1b2e7
2018-01-11 03:11:22 +01:00
binder_calls_stats u:object_r:binder_calls_stats_service:s0
Rename biometric_prompt_service to biometric_service Bug: 111461540 Bug: 112570477 Test: builds Change-Id: Icc68720ebe931c2d917703b2d34aa0f4eec3f549 Merged-In: Icc68720ebe931c2d917703b2d34aa0f4eec3f549
2018-09-21 05:32:32 +02:00
biometric u:object_r:biometric_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
bluetooth_manager u:object_r:bluetooth_manager_service:s0
Add missing services to service_contexts. Add missing services related to battery, bluetooth, time, and radio to service_contexts. Change-Id: I8bf05feb173d49637048c779757013806837fede
2014-06-26 21:36:43 +02:00
bluetooth u:object_r:bluetooth_service:s0
Add SEPolicy for new Java-based Broadcast Radio service. Bug: b/36863239 Test: manual Change-Id: I7e929926efbb1570ea9723ef3810a511c71dc11a (cherry picked from commit 38f0928fb05793b91651ba9787e4da8c2cd5afd3)
2017-06-22 16:55:16 +02:00
broadcastradio u:object_r:broadcastradio_service:s0
Add sepolicy for BugreportManagerService BUG:111441001 Test: boots Change-Id: I71a54e8335c5ce7f9d97af3dbbd62e663bb66d33
2019-01-11 18:26:10 +01:00
bugreport u:object_r:bugreport_service:s0
Allow ActivityManagerService to start cacheDump service. Configures SELinux to allow ActivityManagerService to start a cacheinfo service that is responsible for dumping per-process cache state. Bug: 153661880 Test: adb shell dumpsys cacheinfo Test: adb bugreport Change-Id: Id6a4bdf2a9cb6d7f076b08706e0f91d377f38603
2020-04-30 01:10:15 +02:00
cacheinfo u:object_r:cacheinfo_service:s0
Whitelist new carrier config service. This service will be implemented in packages/services/Telephony. Bug: 19483786 Change-Id: Ia9a90bc859108d8657cae551d657e2fcdc261f88
2015-03-25 22:46:54 +01:00
carrier_config u:object_r:radio_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
clipboard u:object_r:clipboard_service:s0
Changes in SELinux Policy for cloudsearch API naming Bug: 216507592 Test: Presubmit Tests Change-Id: I5aa647d146cfea0b44efb4c247d9856e0666ea86
2022-01-27 19:16:22 +01:00
cloudsearch u:object_r:cloudsearch_service:s0
Changes in SELinux Policy for cloudsearch API Bug: 210528288 Test: Presubmit Tests Change-Id: I344d28a95bf7d466620fced9cc85b50bbfcd1947
2021-12-16 19:41:17 +01:00
cloudsearch_service u:object_r:cloudsearch_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
com.android.net.IProxyService u:object_r:IProxyService_service:s0
Remove underscore from Companion service name Fixes: 37536706 Test: Ensure no boot-time error and companion functionality works Change-Id: I80ced92cb62aa10e1847980eb9a169af3bcd21f0
2017-04-20 20:19:16 +02:00
companiondevice u:object_r:companion_device_service:s0
Add rule for platform_compat service Bug: 137769727 Test: m Change-Id: Ib6160a82597198f4a120592293f90ffe1ffb123b
2019-07-12 13:12:30 +02:00
platform_compat u:object_r:platform_compat_service:s0
Add rule for platform_compat_native service. Bug: 138275545 Test: Call the service from dumpsys.cpp (http://aosp/1142055) Change-Id: I259ceb5092d2f1d3e2130ea678ee7fb59cf9e6be
2019-10-14 16:05:41 +02:00
platform_compat_native u:object_r:platform_compat_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
connectivity u:object_r:connectivity_service:s0
New service name for IpConnectivity metrics (cherry picked from commit f412cc623f26c95706e0966daa49207028487281) Bug: 31254800 Change-Id: If8708c8a4e0ea7655f31028881248a14cf2ba5f7
2016-09-09 08:57:24 +02:00
connmetrics u:object_r:connmetrics_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
consumer_ir u:object_r:consumer_ir_service:s0
content u:object_r:content_service:s0
Renamed "intelligence" to "content_capture" Bug: 111276913 Test: manual verification Change-Id: If76dc7bfdad87789a58fc94e0fd280deae1a41ab
2018-12-04 02:35:05 +01:00
content_capture u:object_r:content_capture_service:s0
Adding policy for content suggestions. Cherry-picked from aosp/852612 (commit Ic0b3f85fad24ccedc0a8e9935c198bc8503bb415), and is a manual merge for ag/5836696 (commit I360ce12f33e333766f6f30614c87811d05e663a4) Bug: 120865921 Test: Manual verification Change-Id: Ic0b3f85fad24ccedc0a8e9935c198bc8503bb415
2018-12-18 00:39:58 +01:00
content_suggestions u:object_r:content_suggestions_service:s0
Change the name advertised by the context hub service. Bring the context hub service advertised name into compliance with the other Android services. This changes the name from "contexthub_service" to "context". Test: GTS tests pass. Change-Id: I8490d60f89bdb97813e328b9ddf08270470fda76
2016-12-27 18:29:15 +01:00
contexthub u:object_r:contexthub_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
country_detector u:object_r:country_detector_service:s0
Add coverage service. Bug: 31077138 Test: Device boots, coverage service works when tested manually. Change-Id: Ia855cfefd5c25be5d1d8db48908c04b3616b5504
2016-12-01 03:27:03 +01:00
coverage u:object_r:coverage_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
cpuinfo u:object_r:cpuinfo_service:s0
Add selinux policy for CrossProfileAppsService CrossProfileAppsService allows apps to do limited cross profile operations, like checking the caller package is installed in the specified user. It is similar to LauncherAppsService in some sense. Merged-In: I26e383a57c32c4dc9b779752b20000b283a5bfdc Change-Id: I26e383a57c32c4dc9b779752b20000b283a5bfdc Fix: 67765768 Test: Built with ag/3063260. Can boot and verified those APIs are working. (cherry picked from commit 6536c9e0920fda975e9a1a240ea1c5e1ae9778a6)
2017-10-13 15:48:32 +02:00
crossprofileapps u:object_r:crossprofileapps_service:s0
selinux config for data loader manager service Test: boots Change-Id: If489054a51838d4215202b5768d46c6278ed1aa2
2019-12-10 22:27:08 +01:00
dataloader_manager u:object_r:dataloader_manager_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
dbinfo u:object_r:dbinfo_service:s0
SEPolicy updates for DeviceConfig Service. Add a DeviceConfig service in system_server to edit configuration flags. This is intended to be a command line tool for local overrides and/or tool for tests that adopt shell permissions. Test: None Bug:109919982 Bug:113101834 Change-Id: Ib7bed752849b1ed102747e3202dd7aed48d2c6d5
2018-12-07 17:27:29 +01:00
device_config u:object_r:device_config_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
device_policy u:object_r:device_policy_service:s0
Move device serial behing a permission - selinux Build serial is non-user resettable freely available device identifier. It can be used by ad-netowrks to track the user across apps which violates the user's privacy. This change deprecates Build.SERIAL and adds a new Build.getSerial() API which requires holding the read_phone_state permission. The Build.SERIAL value is set to "undefined" for apps targeting high enough SDK and for legacy app the value is still available. bug:31402365 Change-Id: I6309aa58c8993b3db4fea7b55aae05592408b6e4
2016-09-12 20:58:08 +02:00
device_identifiers u:object_r:device_identifiers_service:s0
Add rule for new deviceidle service. Change-Id: I283663caea0ee1597645856fb31f13b26e902315
2015-03-19 02:33:47 +01:00
deviceidle u:object_r:deviceidle_service:s0
Add device_state_service to SEPolicy. This is to support the addition of the device state manager service and its associated binder service. Test: Manual - Modify policy and verify binder service can be published. Fixes: 170034199 Change-Id: Id63cb1db3ee80ec699e98443457c113d6be809fe
2020-10-09 02:21:26 +02:00
device_state u:object_r:device_state_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
devicestoragemonitor u:object_r:devicestoragemonitor_service:s0
diskstats u:object_r:diskstats_service:s0
display u:object_r:display_service:s0
Add sepolicy for resolver service Bug: 126141549 Test: built, flashed, booted Change-Id: I34260e1e5cc238fbe92574f928252680c1e6b417
2019-02-25 13:12:15 +01:00
dnsresolver u:object_r:dnsresolver_service:s0
Add domain_verification_service For upcoming @SystemApi DomainVerificationManager. Test: manual, accessing new manager from test app works Change-Id: Ic73733dce3e9152af9c6f08fb7e460fa5a01ebdf
2020-12-07 19:23:19 +01:00
domain_verification u:object_r:domain_verification_service:s0
Add color_service selinux policy Bug: 111215474 Test: boots Change-Id: I98955bcd02f643400c3eb97232467c09a2c5c1e5
2018-08-18 03:47:47 +02:00
color_display u:object_r:color_display_service:s0
Change name in the rules after renaming dns_listener -> netd_listener Change-Id: I4737a087f2d00e1028d1cb43d9eda814a008dbe8
2016-09-01 11:08:57 +02:00
netd_listener u:object_r:netd_listener_service:s0
Add network watchlist service SELinux policy rules Bug: 63908748 Test: built, flashed, able to boot Change-Id: I3cfead1d687112b5f8cd485c8f84083c566fbce2
2017-11-13 18:52:05 +01:00
network_watchlist u:object_r:network_watchlist_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
DockObserver u:object_r:DockObserver_service:s0
dreams u:object_r:dreams_service:s0
Add SELinux rules for service_manager. Add a service_mananger class with the verb add. Add a type that groups the services for each of the processes that is allowed to start services in service.te and an attribute for all services controlled by the service manager. Add the service_contexts file which maps service name to target label. Bug: 12909011 Change-Id: I017032a50bc90c57b536e80b972118016d340c7d
2014-06-06 00:52:02 +02:00
drm.drmManager u:object_r:drmserver_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
dropbox u:object_r:dropbox_service:s0
Added permissions for the dumpstate service. - Allow dumpstate to create the dumpservice service. - Allow System Server and Shell to find that service. - Don't allow anyone else to create that service. - Don't allow anyone else to find that service. BUG: 31636879 Test: manual verification Change-Id: I642fe873560a2b123e6bafde645467d45a5f5711
2016-10-29 00:52:15 +02:00
dumpstate u:object_r:dumpstate_service:s0
Rename dynamic_android to dynamic_system Per API review, dynamic_android should be renamed to dynamic_system. Bug: 126613281 Test: run DynamicSystemInstallationService via adb Change-Id: Ia908cdd0c21b3a82f59b30e03a985dc260530230
2019-03-14 05:35:32 +01:00
dynamic_system u:object_r:dynamic_system_service:s0
Define selinux context for econtroller. Bug: 33075886 Test: N/A Change-Id: I1654ee20fa6125cf3ed5c0796e85f289db5a9745
2017-03-02 19:36:17 +01:00
econtroller u:object_r:radio_service:s0
Add policy to allow EmergencyAffordanceService to dump state Bug: 152506122 Test: adb shell dumpsys emergency_affordance Change-Id: I4dcc227ba949a02a0393999c8065f8bd8b981959
2020-04-08 19:59:45 +02:00
emergency_affordance u:object_r:emergency_affordance_service:s0
Add EuiccCardManager and EuiccCardController. Bug: 38206971 Test: test on phone Change-Id: Id34ab2673c7a16744fba77eb5c176e2e8b474299 Merged-In: Id34ab2673c7a16744fba77eb5c176e2e8b474299
2017-12-22 03:42:24 +01:00
euicc_card_controller u:object_r:radio_service:s0
Add new external vibrator service to system_server Bug: 111457573 Test: N/A Change-Id: I457fd9d13cc481f2687ab39d22240c6ea7231183
2019-01-22 21:55:08 +01:00
external_vibrator_service u:object_r:external_vibrator_service:s0
Sync internal master and AOSP sepolicy. Bug: 37916906 Test: Builds 'n' boots. Change-Id: Ia1d86264446ebecc1ca79f32f11354921bc77668 Merged-In: I208ec6a864127a059fb389417a9c6b259d7474cb
2017-09-26 21:58:29 +02:00
lowpan u:object_r:lowpan_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
ethernet u:object_r:ethernet_service:s0
Add placeholder sepolicy for iris and face See aosp/660242 and aosp/608396 Fixes: 116530289 Test: builds Change-Id: I220ece0d6751839fe764ff91fd7bd20c50104f8f
2018-09-01 03:14:16 +02:00
face u:object_r:face_service:s0
sepolicy: new file_integrity_service Test: didn't see denials in dmesg during boot or API calls. Bug: 142573505 Change-Id: Ifa271956bc51bf47d781cd9c9f95afb99c5f940f
2019-12-19 18:25:07 +01:00
file_integrity u:object_r:file_integrity_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
fingerprint u:object_r:fingerprint_service:s0
Declare new Fonts service Merged-In: Id2b849d7fa22989225066ebe487fc98d319743ea Bug: 34190490 Test: CTS in internal master Change-Id: I27ab62469f3a405c59eda1a2a249899e845bed56
2017-01-23 12:10:24 +01:00
font u:object_r:font_service:s0
Add selinux policy for fingerprintd Change-Id: Ibcb714248c28abf21272986facaade376dcbd7ef
2015-05-13 00:16:06 +02:00
android.hardware.fingerprint.IFingerprintDaemon u:object_r:fingerprintd_service:s0
Add SEPolicy rules for game service. Bug: b/174956354 Test: manual Change-Id: Ife1aac3435427f89f5701e4ead0763839f01d61b
2020-12-25 03:46:25 +01:00
game u:object_r:game_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
gfxinfo u:object_r:gfxinfo_service:s0
Add gnss_time_update_service selinux changes. GnssTimeUpdateService is a new service that is being added to System Server. It will periodically get and suggest GNSS time for time detection on Android. Ignore-AOSP-First: Service relies on location APIs that are only in internal right now. Bug: 157265008 Test: Build only Change-Id: Iedb2783b2f34ac71f665663b9db719e8ed4d35dc
2020-12-09 07:14:30 +01:00
gnss_time_update_service u:object_r:gnss_time_update_service:s0
Add graphicsstats service Change-Id: I156b139b57f46c695ece35b7b26a3087d87b25df
2015-03-23 15:56:37 +01:00
graphicsstats u:object_r:graphicsstats_service:s0
[SEPolicy] Name GPU service back to "gpu" Changed the GPU service name back to be compatible with external engines/tools' usage of vkjson cmd. Bug: 118347356 Test: adb shell cmd gpu vkjson Change-Id: Ie432fd8be63d33070ad037c509467c8367b42d39
2018-11-16 20:06:52 +01:00
gpu u:object_r:gpu_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
hardware u:object_r:hardware_service:s0
Renamed hardwareproperties to hardware_properties Bug: 27531271 Change-Id: I3c5eee86d09696373ab155f93ba6c85da224cb51
2016-03-09 18:13:11 +01:00
hardware_properties u:object_r:hardware_properties_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
hdmi_control u:object_r:hdmi_control_service:s0
Rename ANS to ONS Rename AlternativeNetworkService to OpportunisticNetworkService Bug: 118347827 Test: compile Change-Id: I23b0caadd1801c104806fa438fc9054d8a31962e
2019-01-08 19:51:00 +01:00
ions u:object_r:radio_service:s0
Add idmap2 and idmap2d Bug: 78815803 Test: builds, boots Test: manual: adb shell idmap2 create ... Test: manual: adb shell ps | grep -e idmap2d Change-Id: I60852e15d99329896ff9de6559d1e7cd1c67e33d
2018-06-15 08:08:19 +02:00
idmap u:object_r:idmap_service:s0
Add incident command and incidentd daemon se policy. Test: adb shell incident Bug: 31122534 Change-Id: I4ac9c9ab86867f09b63550707673149fe60f1906
2016-11-21 08:23:04 +01:00
incident u:object_r:incident_service:s0
Add incidentcompanion service. It is a side channel for dumpstate and incidentd to communicate status and get user authorization to share bugreports by calling system_server. Test: atest PermissionControllerTest / atest GooglePermissionControllerTest Change-Id: I995a43a25f375e5c97dba1deb92ebe893ca8585d
2018-12-08 02:20:14 +01:00
incidentcompanion u:object_r:incidentcompanion_service:s0
Add SELinux rules for service_manager. Add a service_mananger class with the verb add. Add a type that groups the services for each of the processes that is allowed to start services in service.te and an attribute for all services controlled by the service manager. Add the service_contexts file which maps service name to target label. Bug: 12909011 Change-Id: I017032a50bc90c57b536e80b972118016d340c7d
2014-06-06 00:52:02 +02:00
inputflinger u:object_r:inputflinger_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
input_method u:object_r:input_method_service:s0
input u:object_r:input_service:s0
Rules for new installd Binder interface. Most of this CL mirrors what we've already done for the "netd" Binder interface, while sorting a few lists alphabetically. Migrating installd to Binder will allow us to get rid of one of the few lingering text-based command protocols, improving system maintainability and security. Test: builds, boots Bug: 13758960, 30944031 Change-Id: I59b89f916fd12e22f9813ace6673be38314c97b7
2016-12-05 19:19:11 +01:00
installd u:object_r:installd_service:s0
iorapd: Add new binder service iorapd. This daemon is very locked down. Only system_server can access it. Bug: 72170747 Change-Id: I7b72b9191cb192be96001d84d067c28292c9688f
2018-10-05 23:48:29 +02:00
iorapd u:object_r:iorapd_service:s0
Preemptively adding services for pending commits. Adding services to service_contexts for the pending commits Icf5997dd6a6ba5e1de675cf5f4334c78c2c037f1 and Ibe79be30b80c18ec45ff69db7527c7a4adf0ee08. Change-Id: Ie898866d1ab3abba6211943e87bcec77ba568567
2014-06-27 22:20:15 +02:00
iphonesubinfo_msim u:object_r:radio_service:s0
iphonesubinfo2 u:object_r:radio_service:s0
Add SELinux rules for service_manager. Add a service_mananger class with the verb add. Add a type that groups the services for each of the processes that is allowed to start services in service.te and an attribute for all services controlled by the service manager. Add the service_contexts file which maps service name to target label. Bug: 12909011 Change-Id: I017032a50bc90c57b536e80b972118016d340c7d
2014-06-06 00:52:02 +02:00
iphonesubinfo u:object_r:radio_service:s0
Add missing services to service_contexts. Add missing services to service_contexts that we did not include in earlier patch that added SELinux checks in service_manager. Change-Id: I889d999bf0b745bfcb75a3553b207777dc5700b7
2014-06-17 17:13:36 +02:00
ims u:object_r:radio_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
imms u:object_r:imms_service:s0
selinux config for Incremental service BUG: 136132412 Test: boots Change-Id: I0bff222af54d617b7c849bbed6fa52b96d945e32
2019-12-11 00:41:18 +01:00
incremental u:object_r:incremental_service:s0
Add IpSecService SEPolicy Add a new type and context for IpSec to system SEPolicy Bug: 35923241 Test: service starts + talks to NetD Change-Id: I69356c8525b426d344fcc4858fc499ab12405b20 (cherry picked from commit 641b1a7ae0fde04424d7725165e91d1cde62390a)
2017-03-02 21:25:58 +01:00
ipsec u:object_r:ipsec_service:s0
Rename service from ircs to ircsmessage ircs is not specific enough. There will be multiple services in the future with ircsmessage used specificially for message store. Test: compile, tests Change-Id: Ia7d57e6900c733408be26d6520aa46c512229248
2019-07-11 22:02:07 +02:00
ircsmessage u:object_r:radio_service:s0
Add placeholder sepolicy for iris and face See aosp/660242 and aosp/608396 Fixes: 116530289 Test: builds Change-Id: I220ece0d6751839fe764ff91fd7bd20c50104f8f
2018-09-01 03:14:16 +02:00
iris u:object_r:iris_service:s0
Preemptively adding services for pending commits. Adding services to service_contexts for the pending commits Icf5997dd6a6ba5e1de675cf5f4334c78c2c037f1 and Ibe79be30b80c18ec45ff69db7527c7a4adf0ee08. Change-Id: Ie898866d1ab3abba6211943e87bcec77ba568567
2014-06-27 22:20:15 +02:00
isms_msim u:object_r:radio_service:s0
isms2 u:object_r:radio_service:s0
Add SELinux rules for service_manager. Add a service_mananger class with the verb add. Add a type that groups the services for each of the processes that is allowed to start services in service.te and an attribute for all services controlled by the service manager. Add the service_contexts file which maps service name to target label. Bug: 12909011 Change-Id: I017032a50bc90c57b536e80b972118016d340c7d
2014-06-06 00:52:02 +02:00
isms u:object_r:radio_service:s0
Add missing services to service_contexts. Add missing services to service_contexts that we did not include in earlier patch that added SELinux checks in service_manager. Change-Id: I889d999bf0b745bfcb75a3553b207777dc5700b7
2014-06-17 17:13:36 +02:00
isub u:object_r:radio_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
jobscheduler u:object_r:jobscheduler_service:s0
launcherapps u:object_r:launcherapps_service:s0
Add SELinux policy for legacy permission service. The updatable and non-updatable permission manager cannot share one AIDL, so we need to create a new system service for the non-updatable legacy one, and add the SELinux policy for it. Bug: 158736025 Test: presubmit Change-Id: Ief8da6335e5bfb17d915d707cf48f4a43332f6ae
2020-12-04 23:27:12 +01:00
legacy_permission u:object_r:legacy_permission_service:s0
Add rules for Lights AIDL HAL Test: manual; yukawa and cuttlefish; adb logcat | grep -i avc Bug: 142230898 Change-Id: I9f576511d1fc77c5f0ad3cf1b96b038b301773d7
2020-01-21 16:37:44 +01:00
lights u:object_r:light_service:s0
Add selinux changes for Locale Manager Service Test: build and booted device Bug: 194094788 Change-Id: Ic3c1f135985a5003ed07a8da9dbd7a3f8b61ae71
2021-08-10 15:42:43 +02:00
locale u:object_r:locale_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
location u:object_r:location_service:s0
Add location_time_zone_manager_service The LocationTimeZoneManagerService is being added as a "true" service so that it can be invoked by a shell command (i.e. adb shell cmd). This also means it will be dumped as part of dumpsys. Test: Build only Bug: 149014708 Change-Id: Ie60c4bea3af27a89b88ed753f9cf6e74aab04cd3
2020-09-08 12:41:43 +02:00
location_time_zone_manager u:object_r:location_time_zone_manager_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
lock_settings u:object_r:lock_settings_service:s0
Add sepolicy for logd and logcat services The logd binder service is on logd side. The logcat binder service is on system_server side. These two binder services facilitate the binder RPC between logd and system_server. Bug: 197901557 Test: manual Change-Id: I5f08bbb44a88dc72302331ab11c7d54f94db16ac
2022-01-12 00:16:12 +01:00
logcat u:object_r:logcat_service:s0
logd u:object_r:logd_service:s0
Add looper_stats_service to SE policy. Test: Built and flashed an image. Bug: 113651685 Change-Id: Ide239432ea8a5701d91c00edd06ad3e52560a3f7
2018-08-30 14:04:55 +02:00
looper_stats u:object_r:looper_stats_service:s0
Add rules for lpdump and lpdumpd - lpdump is a binary on the device that talks to lpdumpd via binder. - lpdumpd is a daemon on the device that actually reads dynamic partition metadata. Only lpdump can talk to it. Bug: 126233777 Test: boots (sanity) Test: lpdump Change-Id: I0e21f35ac136bcbb0603940364e8117f2d6ac438
2019-03-14 23:45:03 +01:00
lpdump_service u:object_r:lpdump_service:s0
Add sepolicy for mdns service mdns service is a subset of netd-provided services, so it gets the same treatment as netd_service or dnsresolver_service Bug: 209894875 Test: built, flashed, booted Change-Id: I33de769c4fff41e816792a34015a70f89e4b8a8c
2021-12-09 04:49:23 +01:00
mdns u:object_r:mdns_service:s0
service_contexts: add aaudio service Test: test_aaudio.cpp Bug: 33398120 Change-Id: I0712f60c898136154d729ceb1103ee021cc6ab82 Signed-off-by: Phil Burk <philburk@google.com> (cherry picked from commit 8b9d93f24505a2737f156f3b20a0fca3af8ac345)
2017-02-02 20:53:20 +01:00
media.aaudio u:object_r:audioserver_service:s0
Add rules for running audio services in audioserver audioserver has the same rules as mediaserver so there is no loss of rights or permissions. media.log moves to audioserver. TBD: Pare down permissions. Bug: 24511453 Change-Id: I0fff24c14b712bb3d498f75e8fd66c2eb795171d
2015-09-09 19:48:04 +02:00
media.audio_flinger u:object_r:audioserver_service:s0
media.audio_policy u:object_r:audioserver_service:s0
selinux: Update policies for cameraserver Update policies for cameraserver so it has the same permissions as mediaserver. Bug: 24511454 Change-Id: I1191e2ac36c00b942282f8dc3db9903551945adb
2015-12-04 01:10:05 +01:00
media.camera u:object_r:cameraserver_service:s0
camera: Add AIDL interface for CameraServiceProxy. - Update selinux policy for CameraServiceProxy. Bug: 21267484 Change-Id: Ib821582794ddd1e3574b5dc6c79f7cb197b57f10
2015-05-20 02:26:31 +02:00
media.camera.proxy u:object_r:cameraproxy_service:s0
Add rules for running audio services in audioserver audioserver has the same rules as mediaserver so there is no loss of rights or permissions. media.log moves to audioserver. TBD: Pare down permissions. Bug: 24511453 Change-Id: I0fff24c14b712bb3d498f75e8fd66c2eb795171d
2015-09-09 19:48:04 +02:00
media.log u:object_r:audioserver_service:s0
Add SELinux rules for service_manager. Add a service_mananger class with the verb add. Add a type that groups the services for each of the processes that is allowed to start services in service.te and an attribute for all services controlled by the service manager. Add the service_contexts file which maps service name to target label. Bug: 12909011 Change-Id: I017032a50bc90c57b536e80b972118016d340c7d
2014-06-06 00:52:02 +02:00
media.player u:object_r:mediaserver_service:s0
rename mediaanalytics->mediametrics, wider access reflect the change from "mediaanalytics" to "mediametrics" Also incorporates a broader access to the service -- e.g. anyone. This reflects that a number of metrics submissions come from application space and not only from our controlled, trusted media related processes. The metrics service (in another commit) checks on the source of any incoming metrics data and limits what is allowed from unprivileged clients. Bug: 34615027 Test: clean build, service running and accessible Change-Id: I657c343ea1faed536c3ee1940f1e7a178e813a42
2017-01-24 21:53:45 +01:00
media.metrics u:object_r:mediametrics_service:s0
Update selinux policies for mediaextractor process Change-Id: If761e0370bf9731a2856d0de2c6a6af1671143bd
2015-09-22 19:56:03 +02:00
media.extractor u:object_r:mediaextractor_service:s0
MediaTranscodingService: Add sepolicy for MediaTranscodingService. Bug:145233472 Test: Build and flash the phone. "adb shell dumpsys -l | grep media" shows media.transcoding service. Change-Id: I48a42e7b595754989c92a8469eb91360ab6db7c6
2019-11-28 03:10:01 +01:00
media.transcoding u:object_r:mediatranscoding_service:s0
media: allow media server to add resource manager service Bug: 19620911 Change-Id: I170b9d46bd49b1ad8bac6e37d0745893d79c14fe
2015-03-12 23:54:37 +01:00
media.resource_manager u:object_r:mediaserver_service:s0
Add media.resource_observer to service contexts bug: 168307955 bug: 154733526 Change-Id: I0099688d1c5f151a715f4bdb7b1c2108492a8b72
2020-09-11 18:11:52 +02:00
media.resource_observer u:object_r:mediaserver_service:s0
Add rules for running audio services in audioserver audioserver has the same rules as mediaserver so there is no loss of rights or permissions. media.log moves to audioserver. TBD: Pare down permissions. Bug: 24511453 Change-Id: I0fff24c14b712bb3d498f75e8fd66c2eb795171d
2015-09-09 19:48:04 +02:00
media.sound_trigger_hw u:object_r:audioserver_service:s0
Add mediadrm service Part of media security hardening This is an intermediate step toward moving mediadrm to a new service separate from mediaserver. This first step allows mediadrmservice to run based on the system property media.mediadrmservice.enable so it can be selectively enabled on devices that support using native_handles for secure buffers. bug: 22990512 Change-Id: I2208c1e87a6bd8d5bfaed06b1fdcb0509c11cff2
2016-02-12 18:05:42 +01:00
media.drm u:object_r:mediadrmserver_service:s0
SE policy for tuner service. Test: make; acloud; tuner sample input Change-Id: I651632ec7f4ba79d94738c11c343f63510e59aa6
2020-09-12 02:50:45 +02:00
media.tuner u:object_r:mediatuner_service:s0
Add sepolicy for new system service: media_communication_service Bug: 175511943 Test: Manaully (in internal master) Change-Id: Ic2b6f2634c0e82348482b246cddae42da606591c
2021-01-08 08:50:13 +01:00
media_communication u:object_r:media_communication_service:s0
Add SE policy for media_metrics Test: CTS; Change-Id: Ib9382f2513d8fd0e6812d0157c710d0ad5817231
2021-02-09 02:49:46 +01:00
media_metrics u:object_r:media_metrics_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
media_projection u:object_r:media_projection_service:s0
Allow mediaserver to access media_resource_monitor Bug: 26175834 Change-Id: I49244f8e6165ea5a871955f07b3c4ea40cbd7c59
2015-12-15 06:19:21 +01:00
media_resource_monitor u:object_r:media_session_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
media_router u:object_r:media_router_service:s0
media_session u:object_r:media_session_service:s0
meminfo u:object_r:meminfo_service:s0
Memtrack Proxy Service Sepolicy Bug: 177664629 Test: Boot; No avc denials; Change-Id: Ieae6b1dc446a91aca26fdf1314690ca30b0ed5c5
2021-03-27 22:17:05 +01:00
memtrack.proxy u:object_r:memtrackproxy_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
midi u:object_r:midi_service:s0
mount u:object_r:mount_service:s0
Add sepolicy for music recognition service. Denial when not listed in priv_app.te: E SELinux : avc: denied { find } for pid=3213 uid=10170 name=music_recognition scontext=u:r:priv_app:s0:c512,c768 tcontext=u:object_r:music_recognition_service:s0 tclass=service_manager permissive=0 Bug: 158194857 Test: patched and tested on internal master Change-Id: I30e9ea79a57d9c353b732b629bd5a829c89bbcb0
2020-09-18 09:47:05 +02:00
music_recognition u:object_r:music_recognition_service:s0
Allow system app to find NearbyManager Bug: 189954300 Test: -build, flash, boot Change-Id: Ia21b10213311b0639f320b559e78963d562f30a3
2022-01-05 08:26:19 +01:00
nearby u:object_r:nearby_service:s0
Rename the netd service from "android.net.INetd" to "netd". Bug: 27239233 Change-Id: Icc9d14008d2ff6334a8ec66805f7289aedd5d97d
2016-02-23 14:21:22 +01:00
netd u:object_r:netd_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
netpolicy u:object_r:netpolicy_service:s0
netstats u:object_r:netstats_service:s0
Add selinux policies for network stack service The policies allow the system server to register a network_stack_service used to communicate with the network stack process. Test: atest FrameworksNetTests Bug: b/112869080 Change-Id: Ib9b7d9150fe4afcce03c8b3dbb36b81c67e39366
2018-12-14 06:13:52 +01:00
network_stack u:object_r:network_stack_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
network_management u:object_r:network_management_service:s0
network_score u:object_r:network_score_service:s0
Add NetworkTimeUpdateService NetworkTimeUpdateService has been registered as a system service, so that its dump state can be included into bugreports. Bug: 23983739 Change-Id: I0d364009ba4630dcfd1d22c647195e33eedaa4e0
2016-02-27 02:21:47 +01:00
network_time_update_service u:object_r:network_time_update_service:s0
Add SELinux rules for service_manager. Add a service_mananger class with the verb add. Add a type that groups the services for each of the processes that is allowed to start services in service.te and an attribute for all services controlled by the service manager. Add the service_contexts file which maps service name to target label. Bug: 12909011 Change-Id: I017032a50bc90c57b536e80b972118016d340c7d
2014-06-06 00:52:02 +02:00
nfc u:object_r:nfc_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
notification u:object_r:notification_service:s0
SE Linux policies for OemLockService Bug: 34766843 Test: gts-tradefed run gts -m GtsBootloaderServiceTestCases -t \ com.google.android.bootloader.gts.BootloaderServiceTest Change-Id: I8b939e0dbe8351a54f20c303921f606c3462c17d
2017-02-17 14:51:32 +01:00
oem_lock u:object_r:oem_lock_service:s0
Selinux: introduce policy for OTA preopt Add permissions to dex2oat, introduce otapreopt binary and otadexopt service. Bug: 25612095 Change-Id: I80fcba2785e80b2931d7d82bb07474f6cd0099f7
2015-12-03 06:23:30 +01:00
otadexopt u:object_r:otadexopt_service:s0
Add service 'overlay' to service_contexts The 'overlay' service is the Overlay Manager Service, which tracks packages and their Runtime Resource Overlay overlay packages. Change-Id: I897dea6a32c653d31be88a7b3fc56ee4538cf178 Co-authored-by: Martin Wallgren <martin.wallgren@sonymobile.com> Signed-off-by: Zoran Jovanovic <zoran.jovanovic@sonymobile.com> Bug: 31052947 Test: boot the Android framework
2015-06-22 09:31:25 +02:00
overlay u:object_r:overlay_service:s0
Add selinux policies for pac_proxy_service The policies allow system server to register a pac_proxy_service. Bug: 177035719 Test: FrameworksNetTests Change-Id: Idf64dc6e491f5bce66dcab2dbf15823c8d0c2403
2021-01-18 13:44:35 +01:00
pac_proxy u:object_r:pac_proxy_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
package u:object_r:package_service:s0
Sync internal master and AOSP sepolicy. Bug: 37916906 Test: Builds 'n' boots. Change-Id: Ia1d86264446ebecc1ca79f32f11354921bc77668 Merged-In: I208ec6a864127a059fb389417a9c6b259d7474cb
2017-09-26 21:58:29 +02:00
package_native u:object_r:package_native_service:s0
Add sepolicy for people service This is to allow people service to publish a binder service that expose system private APIs to retrive and manage the recent cached conversations. Test: build and run on a test device Bug: 162593584 Change-Id: I31b5d8bc851ea7225e215b3f86ed6d47b32b1ba4
2020-07-31 23:37:41 +02:00
people u:object_r:people_service:s0
Rename hint service into performance_hint service Bug: 158791282 Test: Compiles, boots Signed-off-by: Wei Wang <wvw@google.com> Change-Id: I1bd2757f90c040353a176f2dfd0142222753cf8f
2021-04-09 21:35:10 +02:00
performance_hint u:object_r:hint_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
permission u:object_r:permission_service:s0
Create new permissionmgr_service We're creating a new PermissionManagerService that will handle all of the permission related APIs. These are currently being routed through PackageManagerService. Test: Device boots Change-Id: I7d08561dd33b692209c30d413cdca0ff567358f1
2018-12-14 22:08:43 +01:00
permissionmgr u:object_r:permissionmgr_service:s0
Add permission checker service bug: 158792096 Test: atest CtsPermission5TestCases Change-Id: I9dbbf2fe84131ba38ac70e7171e3bd826c150640
2021-04-17 09:00:40 +02:00
permission_checker u:object_r:permission_checker_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
persistent_data_block u:object_r:persistent_data_block_service:s0
Preemptively adding services for pending commits. Adding services to service_contexts for the pending commits Icf5997dd6a6ba5e1de675cf5f4334c78c2c037f1 and Ibe79be30b80c18ec45ff69db7527c7a4adf0ee08. Change-Id: Ie898866d1ab3abba6211943e87bcec77ba568567
2014-06-27 22:20:15 +02:00
phone_msim u:object_r:radio_service:s0
phone1 u:object_r:radio_service:s0
phone2 u:object_r:radio_service:s0
Add SELinux rules for service_manager. Add a service_mananger class with the verb add. Add a type that groups the services for each of the processes that is allowed to start services in service.te and an attribute for all services controlled by the service manager. Add the service_contexts file which maps service name to target label. Bug: 12909011 Change-Id: I017032a50bc90c57b536e80b972118016d340c7d
2014-06-06 00:52:02 +02:00
phone u:object_r:radio_service:s0
Add CAP_IPC_LOCK and pinner to system_server Add pinner service to system_service services. Add CAP_IPC_LOCK permissions to system_server in order to allow system_server to pin more memory than the lockedmem ulimit. bug 28251566 Change-Id: I990c73d25fce4f2cc9a2db0015aa238fa7b0e984
2016-05-02 20:04:39 +02:00
pinner u:object_r:pinner_service:s0
rename power_stats service to powerstats Ignore-AOSP-First: powerstats service is new in Android S and not in AOSP Tests: adb shell incident -b > incident_report.proto Tests: dumpsys powerstats Tests: atest FrameworksServicesTests:PowerStatsServiceTest Bug: 159813106 Signed-off-by: Thierry Strudel <tstrudel@google.com> Change-Id: I25c9d5ea9af2e4768938342c977a6d888420de87
2021-03-16 00:56:27 +01:00
powerstats u:object_r:powerstats_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
power u:object_r:power_service:s0
print u:object_r:print_service:s0
Add security policy for ProcessInfoService. Bug: 19186859 Change-Id: Ic08858f346d6b66e7bfc9da6faa2c6e38d9b2e82
2015-01-29 03:15:01 +01:00
processinfo u:object_r:processinfo_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
procstats u:object_r:procstats_service:s0
Add sepolicy for profcollectd This does not yet list all the required capabilities for profcollectd, but it at least allows the service to start under permissive mode. Bug: 79161490 Test: start profcollectd Change-Id: I92c6192fa9b31840b2aba26f83a6dc9f9e835030
2020-06-18 06:43:23 +02:00
profcollectd u:object_r:profcollectd_service:s0
Add missing services to service_contexts. Add missing services related to battery, bluetooth, time, and radio to service_contexts. Change-Id: I8bf05feb173d49637048c779757013806837fede
2014-06-26 21:36:43 +02:00
radio.phonesubinfo u:object_r:radio_service:s0
radio.phone u:object_r:radio_service:s0
radio.sms u:object_r:radio_service:s0
Define rcs to be a radio_service RcsService will die continously without the setting. Bug: 123325711 Test: boot aosp_arm64_ab-userdebug on a blueline device Change-Id: Ic140cb3e6466428bf62f0065c78aaf16f957f4d5
2019-01-24 11:02:58 +01:00
rcs u:object_r:radio_service:s0
Add sepolicy for RebootReadinessDetector Test: Builds Bug: 161353402 Change-Id: I3778e00ee249f5ab1904737196b282de1d315846
2020-12-07 14:20:06 +01:00
reboot_readiness u:object_r:reboot_readiness_service:s0
Add recovery service. RecoverySystemService is separated from PowerManagerService as a dedicated system service to handle recovery related requests (such as invoking uncrypt to uncrypt an OTA package on /data or to set up / clear the bootloader control block (i.e. /misc) and etc). The matching CL in frameworks/base is in: Change-Id: Ic606fcf5b31c54ce54f0ab12c1768fef0fa64560. Bug: 26830925 Change-Id: Iee0583c458f784bfa422d0f7af5d1f2681d9609e (cherry picked from commit 65b5fde912285ebeeefc9c7486f4453dd86d994f)
2016-02-03 21:43:58 +01:00
recovery u:object_r:recovery_service:s0
Add a new selinux policy for the resolver service Bug: 178151184 Test: manual Change-Id: Ia44c50d24b3b5403b02ccc1b7873c7024b10e023
2021-01-22 01:55:42 +01:00
resolver u:object_r:resolver_service:s0
Add resources_manager_service Test: manual, calling the service with `adb shell cmd` works Bug: 206615535 Change-Id: I8d3b945f6abff352991446e5d88e5a535a7f9ccf
2022-01-11 00:03:42 +01:00
resources u:object_r:resources_manager_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
restrictions u:object_r:restrictions_service:s0
Add SELinux service for RoleManagerService Test: ensure no build failures; add RoleManagerService as a boot phase ensure no SecurityException in logcat on boot Change-Id: Ia0803c0fb084fe2b12f5c20f5e46354d0dd1aedf
2018-11-09 02:37:45 +01:00
role u:object_r:role_service:s0
Add sepolicy for RollbackManagerService. Bug: 112431924 Test: atest RollbackTest Change-Id: I30453a8d5352a31e3e6af6c37a20b5473904d356
2018-10-02 12:20:32 +02:00
rollback u:object_r:rollback_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
rttmanager u:object_r:rttmanager_service:s0
Track add of RuntimeService in system server Adds the necessary incantations for the new service. Bug: 118242715 Bug: 119026403 Test: build / boot / adb shell dumpsys Change-Id: Ibb1a356067863316d70586a61ede9f5973c1ae15
2018-11-20 20:41:15 +01:00
runtime u:object_r:runtime_service:s0
SELinux policy changes for SafetyCenter APIs. Context about this is on ag/16182563. Test: Ensure no build failures, ensure no SecurityException on boot when SafetyCenterService is added as boot phase Bug: 203098016 Change-Id: I4c20980301a3d0f53e6d8cba0b56ae0992833c30
2021-11-19 14:39:49 +01:00
safety_center u:object_r:safety_center_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
samplingprofiler u:object_r:samplingprofiler_service:s0
scheduling_policy u:object_r:scheduling_policy_service:s0
search u:object_r:search_service:s0
New system service: search_ui_service - Update policy for new system service, used for Launcher/Apps to fetch and render search results in their UI. Bug: 162234997 Test: manual verification ($ adb shell service list) Reference CL: aosp/831251 Change-Id: If3ae22aa2ad1d13aeac3dfefc5244db4b1734d96
2020-12-09 00:53:36 +01:00
search_ui u:object_r:search_ui_service:s0
SE Policy for Secure Element app and Secure Element HAL Test: App startup on boot Change-Id: I7740aafc088aadf676328e3f1bb8db5175d97102
2018-01-04 19:33:20 +01:00
secure_element u:object_r:secure_element_service:s0
fix lax service context lookup (II) As fallout from the corresponding fix in libselinux, this patch adds the missing services without changing semantics. Test: bullhead builds and boots Bug: 31353148 Change-Id: I21026c9435ffef956a59d61c4903174ac7b1ef95
2016-09-08 14:15:19 +02:00
sec_key_att_app_id_provider u:object_r:sec_key_att_app_id_provider_service:s0
Add rule for new system service Update policy for new system service, used for Apps to present the toolbar UI. Bug: 190030331 Bug: 205822301 Test: manual. Can boot to home and get manager successfully. Change-Id: Iee88681a93ae272a90896ccd2a6b64c26c809e82
2021-11-15 13:47:59 +01:00
selection_toolbar u:object_r:selection_toolbar_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
sensorservice u:object_r:sensorservice_service:s0
Add selinux policy for new SensorPrivacyService Test: manually verified SensorPrivacyService is accessible Bug: 110842805 Change-Id: Idd215f338f2da0dab4898ea06fa08d9b4a1bcb5f
2018-12-05 07:38:01 +01:00
sensor_privacy u:object_r:sensor_privacy_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
serial u:object_r:serial_service:s0
servicediscovery u:object_r:servicediscovery_service:s0
Service context for servicemanager. Create a service context for manager itself and allow servicemanager to register itself. This is so that tools like dumpsys can reference servicemanager the same way they would reference other services. That things can still get ahold of the servicemanager directly via libbinder APIs since it is a context manager. Bug: 136027762 Test: dumpsys -l Change-Id: If3d7aa5d5284c82840ed1877b969572ce0561d2e
2019-10-17 01:30:26 +02:00
manager u:object_r:service_manager_service:s0
Allow new settings system service. Test: N/A Change-Id: Ib3c85118bf752152f5ca75ec13371073fc2873cc
2016-10-21 00:57:39 +02:00
settings u:object_r:settings_service:s0
Add new system service "shortcut". Bug 27325877 Change-Id: Idf2f9ae816e1f3d822a6286a4cf738c14e29a45e
2016-03-02 00:11:41 +01:00
shortcut u:object_r:shortcut_service:s0
Preemptively adding services for pending commits. Adding services to service_contexts for the pending commits Icf5997dd6a6ba5e1de675cf5f4334c78c2c037f1 and Ibe79be30b80c18ec45ff69db7527c7a4adf0ee08. Change-Id: Ie898866d1ab3abba6211943e87bcec77ba568567
2014-06-27 22:20:15 +02:00
simphonebook_msim u:object_r:radio_service:s0
simphonebook2 u:object_r:radio_service:s0
Add SELinux rules for service_manager. Add a service_mananger class with the verb add. Add a type that groups the services for each of the processes that is allowed to start services in service.te and an attribute for all services controlled by the service manager. Add the service_contexts file which maps service name to target label. Bug: 12909011 Change-Id: I017032a50bc90c57b536e80b972118016d340c7d
2014-06-06 00:52:02 +02:00
simphonebook u:object_r:radio_service:s0
sip u:object_r:radio_service:s0
Add selinux for slice service Test: make/sync Bug: 68751119 Change-Id: Ie3c60ff68b563cef07f20d15f298d6b62e9356bc
2017-12-04 20:41:54 +01:00
slice u:object_r:slice_service:s0
Changes in SELinux Policy for smartspace API Bug: 176851064 Test: manual verification ($ adb shell service list) Change-Id: I2bfa765a7b04f46b22836d295613e629348afbc6
2021-01-14 21:54:03 +01:00
smartspace u:object_r:smartspace_service:s0
Change SELinux policy for speech recognizer. Bug: 176578753 Test: manual verification ($ adb shell service list) Change-Id: I3ebf6f5d45d65578b2eaf7efac073731afd10a58
2021-01-18 19:07:45 +01:00
speech_recognition u:object_r:speech_recognition_service:s0
Setting up SELinux policy for statsd and stats service Bug: 63757906 Test: manual testing conducted Change-Id: Id03413ce82b5646d4bceddc59e16c7d5ee5bc193
2017-12-19 00:14:33 +01:00
stats u:object_r:stats_service:s0
Sepolicy for StatsBootstrapAtomService This is the selinux changes required to create StatsBootstrapAtomService, a lightweight proxy service in system server to allow processes in the bootstrap namespace to log atoms to statsd. Test: statsbootstrap is successfully published Bug: 204889815 Change-Id: I5e44f7a65b98b8eebd8da6d35ae6094ce5e177f2
2021-11-09 08:28:21 +01:00
statsbootstrap u:object_r:statsbootstrap_service:s0
Adding statscompanion_service and a dontaudit for find/add Instead of removing the denial generating code, a dontaudit and a service label will be provided so that the team working on this new feature doesn't have to get slowed up with local revision patches. The dontaudit should be removed upon resolution of the linked bug. Bug: 67468181 Test: statscompanion denials aren't audited Change-Id: Ib4554a7b6c714e7409ea504f5d0b82d5e1283cf7
2017-10-24 01:25:11 +02:00
statscompanion u:object_r:statscompanion_service:s0
system_server: create StatsManagerService Refactor to split the logic within statscompanion_service The goal of the refactor is to simplify the binder calls to statsd This service will talk to statsd. At the end of the refactor, this service should be the only service that talks to statsd. Bug: 146074223 Test: Manual by creating the service with empty implementation Change-Id: Ib9c2e10ec195d41062f1001e5a82b374696de939
2019-12-12 19:17:58 +01:00
statsmanager u:object_r:statsmanager_service:s0
Allow "soundtrigger" system service to run. In the same process as voiceinteraction. Please see related CL ag/852049 Bug: 22860713 Change-Id: I43ebfdba2aafb151dd7db0814570027e1164508a
2016-01-26 03:22:07 +01:00
soundtrigger u:object_r:voiceinteraction_service:s0
Allow soundtrigger_middleware system service New system service, intended to replace all of the soundtrigger middleware. Change-Id: Ia7cb4f8436719ca3bf71ea4c2bc32995568ff01d Bug: 142070343
2019-09-24 19:11:33 +02:00
soundtrigger_middleware u:object_r:soundtrigger_middleware_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
statusbar u:object_r:statusbar_service:s0
Storaged permissions for task I/O Allow storaged to read /proc/[pid]/io Grant binder access to storaged Add storaged service Grant storaged_exec access to dumpstate Grant storaged binder_call to dumpstate Bug: 32221677 Change-Id: Iecc9dba266c5566817a99ac6251eb943a0bac630
2016-07-01 21:18:54 +02:00
storaged u:object_r:storaged_service:s0
storaged: add storaged_pri service "storaged" service will be used by external clients, e.g. vold, dumpsys "storaged_pri" service will only be used by storaged cmdline. Bug: 63740245 Change-Id: I7a60eb4ce321aced9589bbb8474d2d9e75ab7042 (cherry picked from commit 37ab7c0917b26f8e1d7f4ff865838c5488b0b0af)
2017-10-16 22:57:06 +02:00
storaged_pri u:object_r:storaged_service:s0
Define policy for new StorageStatsManager API. Test: builds Bug: 32206268 Change-Id: I236105b029178f96da519c2295c66c686dcae7cb
2017-01-11 02:09:13 +01:00
storagestats u:object_r:storagestats_service:s0
Add SELinux rules for service_manager. Add a service_mananger class with the verb add. Add a type that groups the services for each of the processes that is allowed to start services in service.te and an attribute for all services controlled by the service manager. Add the service_contexts file which maps service name to target label. Bug: 12909011 Change-Id: I017032a50bc90c57b536e80b972118016d340c7d
2014-06-06 00:52:02 +02:00
SurfaceFlinger u:object_r:surfaceflinger_service:s0
Migrate screenshot methods to AIDL A new service, SurfaceFlingerAIDL, is added to surfaceflinger during the process of mirgrating ISurfaceComposer interface to AIDL. Once migration is complete, this service will be deleted. Bug: 211037638 Test: screencap Change-Id: I0e41700b1af1f482cda6a6d6c67b057553485cfd
2022-01-19 19:21:19 +01:00
SurfaceFlingerAIDL u:object_r:surfaceflinger_service:s0
SEPolicy for Suspend Control interface. Bug: 121210355 Test: manual Change-Id: I9c46c72f0219309140ed2fb008ef57b4bca6ff2b
2019-01-21 14:45:47 +01:00
suspend_control u:object_r:system_suspend_control_service:s0
Update to support splitted SystemSuspend AIDL interfaces The suspend_control_aidl_interface is updated, renamed, and splitted into android.system.suspend.control and android.system.suspend.control.internal. This resulted in two suspend services, update sepolicy to support this change. Test: m Bug: 171598743 Change-Id: I695bde405672af834fe662242347e62079f2e25f
2020-11-03 00:54:21 +01:00
suspend_control_internal u:object_r:system_suspend_control_internal_service:s0
Add selinux contexts for system_config_service Add selinux contexts for the new system config service. Test: atest -it -w SystemConfigTest Bug: 143112379 Change-Id: Ibe67acb404b6951e1fda9ce28bd50a0efdd44c5f
2019-12-24 03:14:28 +01:00
system_config u:object_r:system_config_service:s0
Added system_server_dumper service. It will be used to dump system_server data that is not associated with any service. Test: adb shell dumpsys system_server Bug: 163921395 Change-Id: I5719f7cd3a9022dc0ab12a3b3b22487e2b4866e0
2020-10-20 03:21:17 +02:00
system_server_dumper u:object_r:system_server_dumper_service:s0
Add rules for system_update service. system_update service manages system update information: system updater (priv_app) publishes the pending system update info through the service, while other apps can read the info accordingly (design doc in go/pi-ota-platform-api). This CL adds the service type, and grants priv_app to access the service. Bug: 67437079 Test: Build and flash marlin image. The system_update service works. Change-Id: I7a3eaee3ecd3e2e16b410413e917ec603566b375
2017-10-17 06:57:12 +02:00
system_update u:object_r:system_update_service:s0
Add TARE service to SE policy. Bug: 158300259 Test: adb shell dumpsys tare Change-Id: I30c11631110d6bc4f291357dda639449aa9c39d3
2021-07-14 19:25:14 +02:00
tare u:object_r:tare_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
task u:object_r:task_service:s0
Add system_api_service and app_api_service attributes. System services differ in designed access level. Add attributes reflecting this distinction and label services appropriately. Begin moving access to the newly labeled services by removing them from tmp_system_server_service into the newly made system_server_service attribute. Reflect the move of system_server_service from a type to an attribute by removing access to system_server_service where appropriate. Change-Id: I7fd06823328daaea6d6f96e4d6bd00332382230b
2015-04-03 01:50:08 +02:00
telecom u:object_r:telecom_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
telephony.registry u:object_r:registry_service:s0
[RCS] Add service context of sepolicy of Context.TELEPHONY_IMS_SERVICE Bug: 139260938 Test: Manual Change-Id: I335a955ee7cc2b8e82acd2987c93076fc50dc20a
2019-11-06 14:17:23 +01:00
telephony_ims u:object_r:radio_service:s0
Add the testharness service to sepolicy rules The testharness service will manage Test Harness Mode and provide a command-line interface for users to enable Test Harness Mode; however it does not directly provide a public API. Bug: 80137798 Test: make Test: flash crosshatch Change-Id: Ie396e40fcea8914b4dd2247f2314e029b66ad84e
2019-01-15 22:39:30 +01:00
testharness u:object_r:testharness_service:s0
[Tether15] Allow system app to find TetheringManager Bug: 144320246 Test: -build, flash, boot -OFF/ON hotspot Change-Id: I8ce7ac5eb8198f0df4a2da426e3c56e8915e746a
2019-11-11 13:30:23 +01:00
tethering u:object_r:tethering_service:s0
Declare new textclassification system service. Bug: 34781862 Test: none Change-Id: Ie628dca592a68ed67a68dda2f3d3e0516e995c80
2017-02-04 05:09:28 +01:00
textclassification u:object_r:textclassification_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
textservices u:object_r:textservices_service:s0
Change SELinux policy for texttospeech manager service. Bug: 178112052 Test: Manual verification ($ adb shell service list) Change-Id: Ibaf5d3f3c0565d9c61d03ffec62d8e222c9f5975
2021-01-24 15:16:33 +01:00
texttospeech u:object_r:texttospeech_service:s0
selinux changes to add time detector service This commit contains the changes needed to add the new time detector system server service. Bug: 78217059 Test: make / booted device Change-Id: I7cfaac6cac876e4aa73e8af1aa5f837117bb9ad7
2018-05-30 15:44:47 +02:00
time_detector u:object_r:timedetector_service:s0
Add new time zone detection service Add entries necessary for the new time zone detection service. Bug:140712361 Test: See related frameworks/base change Change-Id: Ide4244104e2add843c1d699d528328dd71a6b525
2019-11-07 17:01:55 +01:00
time_zone_detector u:object_r:timezonedetector_service:s0
Enable the TimeZoneManagerService Add policy changes to enable a new service. The service is currently switched off in config, but this change is needed before it could be enabled. Bug: 31008728 Test: make droid Merged-In: I29c4509304978afb2187fe2e7f401144c6c3b4c6 Change-Id: I29c4509304978afb2187fe2e7f401144c6c3b4c6
2017-01-11 17:27:02 +01:00
timezone u:object_r:timezone_service:s0
Sync internal master and AOSP sepolicy. Bug: 37916906 Test: Builds 'n' boots. Change-Id: Ia1d86264446ebecc1ca79f32f11354921bc77668 Merged-In: I208ec6a864127a059fb389417a9c6b259d7474cb
2017-09-26 21:58:29 +02:00
thermalservice u:object_r:thermal_service:s0
Configure sepolicy for TracingServiceProxy Configures sepolicy to allow for the new TracingServiceProxy system services, and to allow Perfetto to access the service. Bug: 175591887 Test: Validated the service started successfullyy, and invoked via CLI Change-Id: Idb6438948a9d96063f8455544b97ef66267cde23
2020-12-11 23:51:32 +01:00
tracing.proxy u:object_r:tracingproxy_service:s0
SELinux policy changes for AmbientContext system API. Context about this is on ag/16302285 Test: Ensure no build failures, ensure no SecurityException on boot Bug: 192476579 Change-Id: If5ba2fa41975acf91c0002a0f301da11eaebd6d2
2021-12-16 20:06:17 +01:00
translation u:object_r:translation_service:s0
Add selinux policy for new BinaryTransparencyService Bug: 197684182 Test: Manually verified that BinaryTransparencyService is correctly started and running. Change-Id: I4eaf5698dd2edb428205afcd57c22502d56d2ec2
2022-01-19 22:44:25 +01:00
transparency u:object_r:transparency_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
trust u:object_r:trust_service:s0
SE policy: rename iapp -> interactive_app Bug: 205738783 Test: cuttlefish Change-Id: I15fd60a2dba79dd5e2a3cf57ed542e5a930680f1 Merged-In: I15fd60a2dba79dd5e2a3cf57ed542e5a930680f1
2022-01-20 19:28:58 +01:00
tv_interactive_app u:object_r:tv_iapp_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
tv_input u:object_r:tv_input_service:s0
Adding sepolicy of tuner resource manager service This is to allow adding the Tuner Resource Manager as a system service Test: cuttlefish Bug: 147380513 Change-Id: I3f61f2542c7fd934bb69dde08079f830196e2344
2019-11-08 00:32:40 +01:00
tv_tuner_resource_mgr u:object_r:tv_tuner_resource_mgr_service:s0
Add uce service to core policy. This service is requested by AOSP framework, but there is no context for it defined. Bug: 136023468 Test: N/A Change-Id: Ibc5b048aaa1c9eda7b9180caca92cb876c3f6b28 Merged-In: Ibc5b048aaa1c9eda7b9180caca92cb876c3f6b28 (cherry picked from commit 67cb30fabf50e3ce2f08e9edd4e14214c11571a4)
2019-08-01 23:05:05 +02:00
uce u:object_r:uce_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
uimode u:object_r:uimode_service:s0
updatelock u:object_r:updatelock_service:s0
Added sepolicy for uri_grants service Bug: 80414790 Test: boots Change-Id: I15233721fa138e0fdf1a30f66d52b64cbab18b81
2018-07-22 08:21:08 +02:00
uri_grants u:object_r:uri_grants_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
usagestats u:object_r:usagestats_service:s0
usb u:object_r:usb_service:s0
user u:object_r:user_service:s0
Uwb: Create a new Uwb system service This service will intercept all UwbManager API calls and then perform necessary permission checks before forwarding the call to the vendor UWB service. Adding sepolicy permissions for exposing the service that handles all public API's. Bug: 183904955 Test: atest android.uwb.cts.UwbManagerTest Change-Id: Icce4d2f586926421c06e8902a91533002c380b8d
2021-03-31 23:57:39 +02:00
uwb u:object_r:uwb_service:s0
Add SEpolicy for VcnManagementService This patch adds the requisite permissions for the VcnManagementService. Bug: 163431877 Test: Compiles, boots, FrameworksNetTests passes Change-Id: I6e03ee798027b28f67d60c6e4280fb3410ec94c4
2020-07-28 23:06:47 +02:00
vcn_management u:object_r:vcn_management_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
vibrator u:object_r:vibrator_service:s0
Add sepolicy for vibrator manager This will allow SystemServer to add the new vibrator manager service. Bug: 166586119 Test: manually build and install on test device Change-Id: I496f46e2f5482aaa7bfba31d6c6b2967486941cc
2020-09-15 18:22:06 +02:00
vibrator_manager u:object_r:vibrator_manager_service:s0
SELinux rules for virtual device Bug: 194949534 Test: Manual Change-Id: I5fcc83e313ce464e4a855b24d32fc2d82ee0b07e
2021-07-28 21:01:21 +02:00
virtualdevice u:object_r:virtual_device_service:s0
Add policies for new services. Bug: 30989383 Bug: 34731101 Test: manual Change-Id: Icf9d48568b505c6b788f2f5f456f2d709969fbeb
2017-02-10 00:15:11 +01:00
virtual_touchpad u:object_r:virtual_touchpad_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
voiceinteraction u:object_r:voiceinteraction_service:s0
Sync internal master and AOSP sepolicy. Bug: 37916906 Test: Builds 'n' boots. Change-Id: Ia1d86264446ebecc1ca79f32f11354921bc77668 Merged-In: I208ec6a864127a059fb389417a9c6b259d7474cb
2017-09-26 21:58:29 +02:00
vold u:object_r:vold_service:s0
Fix service name for VPN_MANAGEMENT_SERVICE. aosp/1574082 added sepolicy for a "vpnmanager" system service which is being introduced to move code from ConnectivityService to a new VpnManagerService. Unfortunately that CL missed the fact that "vpn_management" is already a service name and present in the public API since R. Instead of adding another service name, use the existing service name to lessen confusion. It is difficult to avoid confusion entirely because there was already a public class called VpnService when the VpnManager class was added to the public API surface. Bug: 173331190 Test: builds, boots, "dumpsys vpn_management" throws no errors Change-Id: I4ab188ef62592aac167ba1f7b586accc882815e8
2021-02-07 09:51:13 +01:00
vpn_management u:object_r:vpn_management_service:s0
Update selinux policy for VrManager AIDL. Bug: 27884853 Change-Id: I097306a324bdc25c5d22868f0342e175ce0dbb9a
2016-04-06 03:12:21 +02:00
vrmanager u:object_r:vr_manager_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
wallpaper u:object_r:wallpaper_service:s0
Change in SELinux Policy for wallpaper effects generation API. Test: presubmit tests Change-Id: I02f9545376534d1570cfa270dfe15c9df6f81d47
2022-01-20 02:33:43 +01:00
wallpaper_effects_generation u:object_r:wallpaper_effects_generation_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
webviewupdate u:object_r:webviewupdate_service:s0
wifip2p u:object_r:wifip2p_service:s0
wifiscanner u:object_r:wifiscanner_service:s0
wifi u:object_r:wifi_service:s0
[WIFICOND] Rename service to nl80211 Per API council feedback. Bug: 149105833 Bug: 148680192 Test: atest android.net.wifi Test: atest com.android.server.wifi Test: manual - flash/boot - verify Wi-Fi scan/associate Change-Id: Idaf7603d4ab79ddde5c223097ed9fe8734299eea
2020-02-12 19:55:12 +01:00
wifinl80211 u:object_r:wifinl80211_service:s0
[NAN-AWARE] Add Aware service Add Aware service - new name for NAN. But do not remove NAN yet. Enables smooth transition. Bug: 32263750 Test: device boots and all Wi-Fi unit-tests pass Change-Id: Ieb9f1ebf1d2f31ee27f228562b4601023da5282d
2016-11-04 21:37:17 +01:00
wifiaware u:object_r:wifiaware_service:s0
[RTT] Update Wi-Fi RTT service name Finalize Wi-Fi RTT service name per API review. Note: CL 1 of 2 - adding new entry here, will remove old entry in next CL. Bug: 65108607 Test: integration tests Change-Id: I065ce9d570510180fa8c8f09e1025ac795706405
2018-01-05 03:10:36 +01:00
wifirtt u:object_r:rttmanager_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
window u:object_r:window_service:s0
Add SELinux rules for service_manager. Add a service_mananger class with the verb add. Add a type that groups the services for each of the processes that is allowed to start services in service.te and an attribute for all services controlled by the service manager. Add the service_contexts file which maps service name to target label. Bug: 12909011 Change-Id: I017032a50bc90c57b536e80b972118016d340c7d
2014-06-06 00:52:02 +02:00
* u:object_r:default_android_service:s0
Reference in a new issue Copy permalink