tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
platform_system_sepolicy/private/compat/27.0/27.0.ignore.cil

133 lines
3.2 KiB
Text
Raw Normal View History

Add missing types to 27.0[.ignore].cil. Bug: 69390067 Test: build sepolicy Test: 27.0.ignore.cil is a subset 26.0.ignore.cil Change-Id: I6b9a1cfa8b38df4e97e5d63e2938ee9d5a4c83ec
2018-02-01 02:15:13 +01:00
;; new_objects - a collection of types that have been introduced that have no
;; analogue in older policy. Thus, we do not need to map these types to
;; previous ones. Add here to pass checkapi tests.
(typeattribute new_objects)
(typeattributeset new_objects
Add ADB system service ADB is being separated from USB service since it's not tied to the USB transport. This duplicates the usb_service's settings to adb_service for this purpose. Bug: 63820489 Test: make Change-Id: Idbcfbe470d7568f9cba51f0c8d4a8ee9503db93d
2018-01-25 08:12:39 +01:00
( adb_service
Fix selinux brekage on user for atrace Follow up to aosp/635599. It broke user builds again despite being tree hugged because of b/74344625. Adding missing ignore entries. Bug: b/73340039 Change-Id: Iba195d571aec9579195d79d4970f760e417608c6
2018-03-22 11:41:10 +01:00
atrace
Added SELinux policy for BinderCallsStatsService Test: manual Bug: 75318418 Change-Id: I700c1b8b613dba1c99f4fbffdd905c0052c1b2e7
2018-01-11 03:11:22 +01:00
binder_calls_stats_service
Add ADB system service ADB is being separated from USB service since it's not tied to the USB transport. This duplicates the usb_service's settings to adb_service for this purpose. Bug: 63820489 Test: make Change-Id: Idbcfbe470d7568f9cba51f0c8d4a8ee9503db93d
2018-01-25 08:12:39 +01:00
blank_screen
Add missing types to 27.0[.ignore].cil. Bug: 69390067 Test: build sepolicy Test: 27.0.ignore.cil is a subset 26.0.ignore.cil Change-Id: I6b9a1cfa8b38df4e97e5d63e2938ee9d5a4c83ec
2018-02-01 02:15:13 +01:00
blank_screen_exec
blank_screen_tmpfs
bootloader_boot_reason_prop
Whitelist vendor-init-settable bluetooth_prop and wifi_prop Values of the following properties are set by SoC vendors on some devices including Pixels. - persist.bluetooth.a2dp_offload.cap - persist.bluetooth.a2dp_offload.enable - persist.vendor.bluetooth.a2dp_offload.enable - ro.bt.bdaddr_path - wlan.driver.status So they should be whitelisted for compatibility. Bug: 77633703 Test: succeeded building and tested with Pixels Change-Id: Ib2b81bcc1fd70ddd571dc7fb2b923b576d62b7d5
2018-04-09 05:07:32 +02:00
bluetooth_a2dp_offload_prop
Add missing types to 27.0[.ignore].cil. Bug: 69390067 Test: build sepolicy Test: 27.0.ignore.cil is a subset 26.0.ignore.cil Change-Id: I6b9a1cfa8b38df4e97e5d63e2938ee9d5a4c83ec
2018-02-01 02:15:13 +01:00
bpfloader
bpfloader_exec
cgroup_bpf
crossprofileapps_service
Add exFAT support; unify behind "sdcard_type". We're adding support for OEMs to ship exFAT, which behaves identical to vfat. Some rules have been manually enumerating labels related to these "public" volumes, so unify them all behind "sdcard_type". Test: atest Bug: 67822822 Change-Id: I09157fd1fc666ec5d98082c6e2cefce7c8d3ae56
2018-03-30 20:22:54 +02:00
exfat
Add missing types to 27.0[.ignore].cil. Bug: 69390067 Test: build sepolicy Test: 27.0.ignore.cil is a subset 26.0.ignore.cil Change-Id: I6b9a1cfa8b38df4e97e5d63e2938ee9d5a4c83ec
2018-02-01 02:15:13 +01:00
exported2_config_prop
exported2_default_prop
exported2_radio_prop
exported2_system_prop
exported2_vold_prop
exported3_default_prop
Allow vendor-init-settable to persist.radio.multisim.config A default value of persist.radio.multisim.config can be set by SoC vendors, and so vendor-init-settable should be allowed to it. Bug: 73871799 Test: succeeded building and tested with taimen Change-Id: Ie62b91e7e3d7e05425b742838417f1cab7b3fed4
2018-03-27 06:41:47 +02:00
exported3_radio_prop
Add missing types to 27.0[.ignore].cil. Bug: 69390067 Test: build sepolicy Test: 27.0.ignore.cil is a subset 26.0.ignore.cil Change-Id: I6b9a1cfa8b38df4e97e5d63e2938ee9d5a4c83ec
2018-02-01 02:15:13 +01:00
exported3_system_prop
Whitelist vendor-init-settable bluetooth_prop and wifi_prop Values of the following properties are set by SoC vendors on some devices including Pixels. - persist.bluetooth.a2dp_offload.cap - persist.bluetooth.a2dp_offload.enable - persist.vendor.bluetooth.a2dp_offload.enable - ro.bt.bdaddr_path - wlan.driver.status So they should be whitelisted for compatibility. Bug: 77633703 Test: succeeded building and tested with Pixels Change-Id: Ib2b81bcc1fd70ddd571dc7fb2b923b576d62b7d5
2018-04-09 05:07:32 +02:00
exported_bluetooth_prop
Add missing types to 27.0[.ignore].cil. Bug: 69390067 Test: build sepolicy Test: 27.0.ignore.cil is a subset 26.0.ignore.cil Change-Id: I6b9a1cfa8b38df4e97e5d63e2938ee9d5a4c83ec
2018-02-01 02:15:13 +01:00
exported_config_prop
exported_dalvik_prop
exported_default_prop
exported_dumpstate_prop
exported_ffs_prop
exported_fingerprint_prop
exported_overlay_prop
exported_pm_prop
exported_radio_prop
Allow only public-readable to ro.secure and ro.adb.secure Bug: 74866333 Test: succeeded building and tested with taimen Change-Id: Id19fec168ab266e386ea4c710a4c5cedfc4df33c
2018-03-16 00:10:37 +01:00
exported_secure_prop
Add missing types to 27.0[.ignore].cil. Bug: 69390067 Test: build sepolicy Test: 27.0.ignore.cil is a subset 26.0.ignore.cil Change-Id: I6b9a1cfa8b38df4e97e5d63e2938ee9d5a4c83ec
2018-02-01 02:15:13 +01:00
exported_system_prop
exported_system_radio_prop
exported_vold_prop
Whitelist vendor-init-settable bluetooth_prop and wifi_prop Values of the following properties are set by SoC vendors on some devices including Pixels. - persist.bluetooth.a2dp_offload.cap - persist.bluetooth.a2dp_offload.enable - persist.vendor.bluetooth.a2dp_offload.enable - ro.bt.bdaddr_path - wlan.driver.status So they should be whitelisted for compatibility. Bug: 77633703 Test: succeeded building and tested with Pixels Change-Id: Ib2b81bcc1fd70ddd571dc7fb2b923b576d62b7d5
2018-04-09 05:07:32 +02:00
exported_wifi_prop
Add internal types to 27.0[.ignore].cil. Bug: 69390067 Test: manual run of treble_sepolicy_tests Change-Id: I1b772a3f7c96875765c75bfc1031f249411c3338 Merged-In: I1b772a3f7c96875765c75bfc1031f249411c3338 (cherry picked from commit 9fbd65200d5da704e8eff1fdd5a4e7ab46eb3a45)
2018-02-07 18:45:39 +01:00
fingerprint_vendor_data_file
Add missing types to 27.0[.ignore].cil. Bug: 69390067 Test: build sepolicy Test: 27.0.ignore.cil is a subset 26.0.ignore.cil Change-Id: I6b9a1cfa8b38df4e97e5d63e2938ee9d5a4c83ec
2018-02-01 02:15:13 +01:00
fs_bpf
Move automotive HALs sepolicy to system/ Bug: 70637118 Test: build, flash and boot automotive builds Change-Id: I6db23258de30174d6db09d241e91b08aa5afedef Merged-In: I6db23258de30174d6db09d241e91b08aa5afedef (cherry picked from commit 394dbe34a0dc7519acb9948175ba63ee18bedbed)
2018-04-10 23:07:14 +02:00
hal_audiocontrol_hwservice
Add missing types to 27.0[.ignore].cil. Bug: 69390067 Test: build sepolicy Test: 27.0.ignore.cil is a subset 26.0.ignore.cil Change-Id: I6b9a1cfa8b38df4e97e5d63e2938ee9d5a4c83ec
2018-02-01 02:15:13 +01:00
hal_authsecret_hwservice
Put in sepolicies for Codec2.0 services Test: Builds Bug: 64121714 Bug: 31973802 Change-Id: Id37be8726a8bb297e35bca494964fdbcc48c6a73 (cherry picked from commit 4be28894772bccf5604fd36a75d07bb64e826c88)
2018-03-29 06:09:23 +02:00
hal_codec2_hwservice
Add missing types to 27.0[.ignore].cil. Bug: 69390067 Test: build sepolicy Test: 27.0.ignore.cil is a subset 26.0.ignore.cil Change-Id: I6b9a1cfa8b38df4e97e5d63e2938ee9d5a4c83ec
2018-02-01 02:15:13 +01:00
hal_confirmationui_hwservice
Move automotive HALs sepolicy to system/ Bug: 70637118 Test: build, flash and boot automotive builds Change-Id: I6db23258de30174d6db09d241e91b08aa5afedef Merged-In: I6db23258de30174d6db09d241e91b08aa5afedef (cherry picked from commit 394dbe34a0dc7519acb9948175ba63ee18bedbed)
2018-04-10 23:07:14 +02:00
hal_evs_hwservice
Add missing types to 27.0[.ignore].cil. Bug: 69390067 Test: build sepolicy Test: 27.0.ignore.cil is a subset 26.0.ignore.cil Change-Id: I6b9a1cfa8b38df4e97e5d63e2938ee9d5a4c83ec
2018-02-01 02:15:13 +01:00
hal_lowpan_hwservice
hal_secure_element_hwservice
hal_usb_gadget_hwservice
Move automotive HALs sepolicy to system/ Bug: 70637118 Test: build, flash and boot automotive builds Change-Id: I6db23258de30174d6db09d241e91b08aa5afedef Merged-In: I6db23258de30174d6db09d241e91b08aa5afedef (cherry picked from commit 394dbe34a0dc7519acb9948175ba63ee18bedbed)
2018-04-10 23:07:14 +02:00
hal_vehicle_hwservice
Add internal types to 27.0[.ignore].cil. Bug: 69390067 Test: manual run of treble_sepolicy_tests Change-Id: I1b772a3f7c96875765c75bfc1031f249411c3338 Merged-In: I1b772a3f7c96875765c75bfc1031f249411c3338 (cherry picked from commit 9fbd65200d5da704e8eff1fdd5a4e7ab46eb3a45)
2018-02-07 18:45:39 +01:00
hal_wifi_hostapd_hwservice
Add missing types to 27.0[.ignore].cil. Bug: 69390067 Test: build sepolicy Test: 27.0.ignore.cil is a subset 26.0.ignore.cil Change-Id: I6b9a1cfa8b38df4e97e5d63e2938ee9d5a4c83ec
2018-02-01 02:15:13 +01:00
incident_helper
incident_helper_exec
last_boot_reason_prop
llkd: add live-lock daemon Introduce a standalone live-lock daemon (llkd), to catch kernel or native user space deadlocks and take mitigating actions. Test: llkd_unit_test Bug: 33808187 Bug: 72838192 Change-Id: If869ecd06e5ce7b04bba1dafd0a77971b71aa517
2018-02-20 20:02:39 +01:00
llkd
llkd_exec
llkd_tmpfs
Add missing types to 27.0[.ignore].cil. Bug: 69390067 Test: build sepolicy Test: 27.0.ignore.cil is a subset 26.0.ignore.cil Change-Id: I6b9a1cfa8b38df4e97e5d63e2938ee9d5a4c83ec
2018-02-01 02:15:13 +01:00
lowpan_device
lowpan_prop
lowpan_service
mediaextractor_update_service
Add metadata_file class for root of metadata folder. Bug: 77335096 Test: booted device with metadata encryption and without Change-Id: I5bc5d46deb4e91912725c4887fde0c3a41c9fc91
2018-04-20 20:14:49 +02:00
metadata_file
Sepolicy for rw mount point for vendors. Bug: 64905218 Test: device boots with /mnt/vendor present and selinux label mnt_vendor_file applied correctly. Change-Id: Ib34e2859948019d237cf2fe8f71845ef2533ae27 Merged-In: Ib34e2859948019d237cf2fe8f71845ef2533ae27 (cherry picked from commit 210a805b46782a2a49bf5338732cf8c6abaf95de)
2018-04-11 05:49:45 +02:00
mnt_vendor_file
Add missing types to 27.0[.ignore].cil. Bug: 69390067 Test: build sepolicy Test: 27.0.ignore.cil is a subset 26.0.ignore.cil Change-Id: I6b9a1cfa8b38df4e97e5d63e2938ee9d5a4c83ec
2018-02-01 02:15:13 +01:00
network_watchlist_data_file
network_watchlist_service
perfetto
perfetto_exec
perfetto_tmpfs
perfetto_traces_data_file
perfprofd_service
property_info
secure_element
Add secure_element_device Test: eSE initializes at boot Bug: 64881253 Change-Id: Ib2388b7368c790c402c000adddf1488bee492cce
2018-03-06 23:26:34 +01:00
secure_element_device
Add missing types to 27.0[.ignore].cil. Bug: 69390067 Test: build sepolicy Test: 27.0.ignore.cil is a subset 26.0.ignore.cil Change-Id: I6b9a1cfa8b38df4e97e5d63e2938ee9d5a4c83ec
2018-02-01 02:15:13 +01:00
secure_element_service
secure_element_tmpfs
slice_service
stats
stats_data_file
stats_exec
stats_service
statscompanion_service
statsd
statsd_exec
statsd_tmpfs
Setting up sepolicies for statsd planB of listening to its own socket Test: manual Bug: 78318738 Change-Id: I45c3511860fbe6a1de45c6930052a8865b38986a
2018-04-20 20:07:22 +02:00
statsdw
statsdw_socket
Add missing types to 27.0[.ignore].cil. Bug: 69390067 Test: build sepolicy Test: 27.0.ignore.cil is a subset 26.0.ignore.cil Change-Id: I6b9a1cfa8b38df4e97e5d63e2938ee9d5a4c83ec
2018-02-01 02:15:13 +01:00
storaged_data_file
system_boot_reason_prop
system_update_service
FrameworksServicesTests: allow access to test.sys.boot.reason property com.android.server.power.PowerManagerServiceTest#testGetLastShutdownReasonInternal due to "RuntimeException: failed to set system property" W/roidJUnitRunner: type=1400 audit(0.0:6): avc: denied { write } for name="property_service" dev="tmpfs" ino=13178 scontext=u:r:platform_app:s0:c512,c768 tcontext=u:object_r:property_socket:s0 tclass=sock_file permissive=0 W/libc : Unable to set property "test.sys.boot.reason" to "shutdown,thermal": connection failed; errno=13 (Permission denied) Had to use precise property definition as com.android.phone accesses test properties as well. Test: compile Bug: 78245377 Change-Id: I2cc810846f8615f2a2fae8e0d4f41de585b7abd7
2015-10-25 01:20:18 +02:00
test_boot_reason_prop
Add missing types to 27.0[.ignore].cil. Bug: 69390067 Test: build sepolicy Test: 27.0.ignore.cil is a subset 26.0.ignore.cil Change-Id: I6b9a1cfa8b38df4e97e5d63e2938ee9d5a4c83ec
2018-02-01 02:15:13 +01:00
tombstone_wifi_data_file
trace_data_file
traced
traced_consumer_socket
sepolicy: allow shell to read/write traced prop This is to fix the CTS failures given by the bugs below where devices where traced is not enabled by default causes test failures. Bug: 78215159 Bug: 78347829 Change-Id: Ib0f6a1cdb770528dbbeb857368534ff5040e464e
2018-04-20 20:09:45 +02:00
traced_enabled_prop
Add missing types to 27.0[.ignore].cil. Bug: 69390067 Test: build sepolicy Test: 27.0.ignore.cil is a subset 26.0.ignore.cil Change-Id: I6b9a1cfa8b38df4e97e5d63e2938ee9d5a4c83ec
2018-02-01 02:15:13 +01:00
traced_exec
traced_probes
traced_probes_exec
traced_probes_tmpfs
traced_producer_socket
traced_tmpfs
traceur_app
traceur_app_tmpfs
Add untrusted_app_27 This is a partial cherry pick of commit 6231b4d9 'Enforce per-app data protections for targetSdk 28+'. Untrusted_app_27 remains unreachable, but it's existence prevents future merge conflicts. Bug: 63897054 Test: build/boot aosp_walleye-userdebug Change-Id: I64b013874fe87b55f47e817a1279e76ecf86b7c0 Merged-In: I64b013874fe87b55f47e817a1279e76ecf86b7c0 (cherry picked from commit 6231b4d9fc98bb42956198e9f54cabde69464339)
2018-04-03 20:22:38 +02:00
untrusted_app_all_devpts
Add missing types to 27.0[.ignore].cil. Bug: 69390067 Test: build sepolicy Test: 27.0.ignore.cil is a subset 26.0.ignore.cil Change-Id: I6b9a1cfa8b38df4e97e5d63e2938ee9d5a4c83ec
2018-02-01 02:15:13 +01:00
update_engine_log_data_file
usbd
usbd_exec
usbd_tmpfs
vendor_default_prop
vendor_init
Adding labeling for vendor security patch prop This will allow adb shell getprop ro.vendor.build.security_patch to properly return the correct build property, whereas previously it was offlimits due to lack of label. Test: adb shell getprop ro.vendor.build.security_patch successfully returns whatever VENDOR_SECURITY_PATCH is defined to be in the Android .mk files Change-Id: Ie8427738125fc7f909ad8d51e4b76558f5544d49
2018-03-30 03:21:31 +02:00
vendor_security_patch_level_prop
Add missing types to 27.0[.ignore].cil. Bug: 69390067 Test: build sepolicy Test: 27.0.ignore.cil is a subset 26.0.ignore.cil Change-Id: I6b9a1cfa8b38df4e97e5d63e2938ee9d5a4c83ec
2018-02-01 02:15:13 +01:00
vendor_shell
vold_metadata_file
vold_prepare_subdirs
vold_prepare_subdirs_exec
vold_service
Add wait_for_keymaster Bug: 79228237 Test: audit2allow finds no relevant denials on boot Merged-In: Ia80b77ba9a1ec2354127cd0ef68d50ebcf593fb0 Change-Id: Ia80b77ba9a1ec2354127cd0ef68d50ebcf593fb0
2018-05-09 00:45:38 +02:00
wait_for_keymaster
wait_for_keymaster_exec
wait_for_keymaster_tmpfs
Add missing types to 27.0[.ignore].cil. Bug: 69390067 Test: build sepolicy Test: 27.0.ignore.cil is a subset 26.0.ignore.cil Change-Id: I6b9a1cfa8b38df4e97e5d63e2938ee9d5a4c83ec
2018-02-01 02:15:13 +01:00
wm_trace_data_file
wpantund
wpantund_exec
wpantund_service
wpantund_tmpfs))
Add untrusted_app_27 This is a partial cherry pick of commit 6231b4d9 'Enforce per-app data protections for targetSdk 28+'. Untrusted_app_27 remains unreachable, but it's existence prevents future merge conflicts. Bug: 63897054 Test: build/boot aosp_walleye-userdebug Change-Id: I64b013874fe87b55f47e817a1279e76ecf86b7c0 Merged-In: I64b013874fe87b55f47e817a1279e76ecf86b7c0 (cherry picked from commit 6231b4d9fc98bb42956198e9f54cabde69464339)
2018-04-03 20:22:38 +02:00
;; private_objects - a collection of types that were labeled differently in
;; older policy, but that should not remain accessible to vendor policy.
;; Thus, these types are also not mapped, but recorded for checkapi tests
(typeattribute priv_objects)
(typeattributeset priv_objects (untrusted_app_27_tmpfs))
Reference in a new issue Copy permalink