tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
platform_system_sepolicy/public/property_contexts

440 lines
30 KiB
Text
Raw Normal View History

Whitelist exported platform properties This CL lists all the exported platform properties in private/exported_property_contexts. Additionally accessing core_property_type from vendor components is restricted. Instead public_readable_property_type is used to allow vendor components to read exported platform properties, and accessibility from vendor_init is also specified explicitly. Note that whitelisting would be applied only if PRODUCT_COMPATIBLE_PROPERTY is set on. Bug: 38146102 Test: tested on walleye with PRODUCT_COMPATIBLE_PROPERTY=true Change-Id: I304ba428cc4ca82668fec2ddeb17c971e7ec065e
2017-10-19 09:54:49 +02:00
# vendor-init-readable
persist.radio.airplane_mode_on u:object_r:exported2_radio_prop:s0 exact int
# vendor-init-settable
af.fast_track_multiplier u:object_r:exported3_default_prop:s0 exact int
Make system property audio.camerasound.force a vendor-writable property, This property is read by the audio service in system server to toggle camera shutter sound enforcement on a device-specific basis. Test: Camera shutter sound enforcement works when audio.camerasound.force is set Bug: 110126976 Change-Id: I2720d3c699c4712d1a328f59dde0b16bbf1016f3
2018-06-20 23:08:02 +02:00
audio.camerasound.force u:object_r:exported_audio_prop:s0 exact bool
sepolicy: create rules for system properties Add new sepolicy rules to support audio system properties Bug: 110564278 Change-Id: If774a40b50e56f9e83bcb4ab8a84581dc03058ad
2018-06-16 01:07:56 +02:00
audio.deep_buffer.media u:object_r:exported3_default_prop:s0 exact bool
audio.offload.video u:object_r:exported3_default_prop:s0 exact bool
sepolicy: add rule for offload minimum duration property Add sepolicy rule to support audio system property audio.offload.min.duration.secs Bug: 120123518 Change-Id: Ie027eb9ef102caca13adb1924db3be11d02b25c7
2018-11-27 23:45:10 +01:00
audio.offload.min.duration.secs u:object_r:exported3_default_prop:s0 exact int
Whitelist exported platform properties This CL lists all the exported platform properties in private/exported_property_contexts. Additionally accessing core_property_type from vendor components is restricted. Instead public_readable_property_type is used to allow vendor components to read exported platform properties, and accessibility from vendor_init is also specified explicitly. Note that whitelisting would be applied only if PRODUCT_COMPATIBLE_PROPERTY is set on. Bug: 38146102 Test: tested on walleye with PRODUCT_COMPATIBLE_PROPERTY=true Change-Id: I304ba428cc4ca82668fec2ddeb17c971e7ec065e
2017-10-19 09:54:49 +02:00
camera.disable_zsl_mode u:object_r:exported3_default_prop:s0 exact bool
camera.fifo.disable u:object_r:exported3_default_prop:s0 exact int
dalvik.vm.appimageformat u:object_r:exported_dalvik_prop:s0 exact string
dalvik.vm.backgroundgctype u:object_r:exported_dalvik_prop:s0 exact string
Add property contexts for dex2oat cpu-set properties New properties are: dalvik.vm.dex2oat-cpu-set [default compiler thread affinity] dalvik.vm.boot-dex2oat-cpu-set [compiler thread affinity for boot] dalvik.vm.image-dex2oat-cpu-set [thread affinity recompiling the boot image] Bug: 141446571 Test: Run installd tests with new properties defined in target mk file. Change-Id: Idcbb1332aa9c18f6082b827eae0334d063644a41
2019-11-14 20:27:33 +01:00
dalvik.vm.boot-dex2oat-cpu-set u:object_r:exported_dalvik_prop:s0 exact string
Make dalvik.vm.boot-dex2oat-threads vendor-init-settable. Bug: 115741899 Test: m selinux_policy Change-Id: I5d80a1d9bd5500a82ebf282fb02f0db3a0b0a4c1
2018-09-20 20:05:09 +02:00
dalvik.vm.boot-dex2oat-threads u:object_r:exported_dalvik_prop:s0 exact int
Allow init to set dalvik.vm.boot-image. Test: m Bug: 119800099 Change-Id: Idb4d4c6005e4ff271c1b5940bd39b655b674a0bb
2019-03-18 22:38:07 +01:00
dalvik.vm.boot-image u:object_r:exported_dalvik_prop:s0 exact string
Whitelist exported platform properties This CL lists all the exported platform properties in private/exported_property_contexts. Additionally accessing core_property_type from vendor components is restricted. Instead public_readable_property_type is used to allow vendor components to read exported platform properties, and accessibility from vendor_init is also specified explicitly. Note that whitelisting would be applied only if PRODUCT_COMPATIBLE_PROPERTY is set on. Bug: 38146102 Test: tested on walleye with PRODUCT_COMPATIBLE_PROPERTY=true Change-Id: I304ba428cc4ca82668fec2ddeb17c971e7ec065e
2017-10-19 09:54:49 +02:00
dalvik.vm.checkjni u:object_r:exported_dalvik_prop:s0 exact bool
dalvik.vm.dex2oat-Xms u:object_r:exported_dalvik_prop:s0 exact string
dalvik.vm.dex2oat-Xmx u:object_r:exported_dalvik_prop:s0 exact string
Add property contexts for dex2oat cpu-set properties New properties are: dalvik.vm.dex2oat-cpu-set [default compiler thread affinity] dalvik.vm.boot-dex2oat-cpu-set [compiler thread affinity for boot] dalvik.vm.image-dex2oat-cpu-set [thread affinity recompiling the boot image] Bug: 141446571 Test: Run installd tests with new properties defined in target mk file. Change-Id: Idcbb1332aa9c18f6082b827eae0334d063644a41
2019-11-14 20:27:33 +01:00
dalvik.vm.dex2oat-cpu-set u:object_r:exported_dalvik_prop:s0 exact string
Whitelist exported platform properties This CL lists all the exported platform properties in private/exported_property_contexts. Additionally accessing core_property_type from vendor components is restricted. Instead public_readable_property_type is used to allow vendor components to read exported platform properties, and accessibility from vendor_init is also specified explicitly. Note that whitelisting would be applied only if PRODUCT_COMPATIBLE_PROPERTY is set on. Bug: 38146102 Test: tested on walleye with PRODUCT_COMPATIBLE_PROPERTY=true Change-Id: I304ba428cc4ca82668fec2ddeb17c971e7ec065e
2017-10-19 09:54:49 +02:00
dalvik.vm.dex2oat-filter u:object_r:exported_dalvik_prop:s0 exact string
dalvik.vm.dex2oat-flags u:object_r:exported_dalvik_prop:s0 exact string
dalvik.vm.dex2oat-threads u:object_r:exported_dalvik_prop:s0 exact int
dalvik.vm.dexopt.secondary u:object_r:exported_dalvik_prop:s0 exact bool
dalvik.vm.execution-mode u:object_r:exported_dalvik_prop:s0 exact string
dalvik.vm.extra-opts u:object_r:exported_dalvik_prop:s0 exact string
Whitelist some more properties that go into /vendor/build.prop Whitelisting some more properties that are to be set by vendor-init but are not vendor specific. Test: After whitelisting, these properties are now correctly set on Go devices by vendor-init, in selinux "enforcing" mode. BUG: 111738816 Change-Id: I3fcc09719fc9e77919a1a9f99453037ca15f25a7
2018-08-13 17:17:18 +02:00
dalvik.vm.foreground-heap-growth-multiplier u:object_r:exported_dalvik_prop:s0 exact string
Whitelist exported platform properties This CL lists all the exported platform properties in private/exported_property_contexts. Additionally accessing core_property_type from vendor components is restricted. Instead public_readable_property_type is used to allow vendor components to read exported platform properties, and accessibility from vendor_init is also specified explicitly. Note that whitelisting would be applied only if PRODUCT_COMPATIBLE_PROPERTY is set on. Bug: 38146102 Test: tested on walleye with PRODUCT_COMPATIBLE_PROPERTY=true Change-Id: I304ba428cc4ca82668fec2ddeb17c971e7ec065e
2017-10-19 09:54:49 +02:00
dalvik.vm.gctype u:object_r:exported_dalvik_prop:s0 exact string
dalvik.vm.heapgrowthlimit u:object_r:exported_dalvik_prop:s0 exact string
dalvik.vm.heapmaxfree u:object_r:exported_dalvik_prop:s0 exact string
dalvik.vm.heapminfree u:object_r:exported_dalvik_prop:s0 exact string
dalvik.vm.heapsize u:object_r:exported_dalvik_prop:s0 exact string
dalvik.vm.heapstartsize u:object_r:exported_dalvik_prop:s0 exact string
dalvik.vm.heaptargetutilization u:object_r:exported_dalvik_prop:s0 exact string
dalvik.vm.hot-startup-method-samples u:object_r:exported_dalvik_prop:s0 exact int
dalvik.vm.image-dex2oat-Xms u:object_r:exported_dalvik_prop:s0 exact string
dalvik.vm.image-dex2oat-Xmx u:object_r:exported_dalvik_prop:s0 exact string
Add property contexts for dex2oat cpu-set properties New properties are: dalvik.vm.dex2oat-cpu-set [default compiler thread affinity] dalvik.vm.boot-dex2oat-cpu-set [compiler thread affinity for boot] dalvik.vm.image-dex2oat-cpu-set [thread affinity recompiling the boot image] Bug: 141446571 Test: Run installd tests with new properties defined in target mk file. Change-Id: Idcbb1332aa9c18f6082b827eae0334d063644a41
2019-11-14 20:27:33 +01:00
dalvik.vm.image-dex2oat-cpu-set u:object_r:exported_dalvik_prop:s0 exact string
Whitelist exported platform properties This CL lists all the exported platform properties in private/exported_property_contexts. Additionally accessing core_property_type from vendor components is restricted. Instead public_readable_property_type is used to allow vendor components to read exported platform properties, and accessibility from vendor_init is also specified explicitly. Note that whitelisting would be applied only if PRODUCT_COMPATIBLE_PROPERTY is set on. Bug: 38146102 Test: tested on walleye with PRODUCT_COMPATIBLE_PROPERTY=true Change-Id: I304ba428cc4ca82668fec2ddeb17c971e7ec065e
2017-10-19 09:54:49 +02:00
dalvik.vm.image-dex2oat-filter u:object_r:exported_dalvik_prop:s0 exact string
dalvik.vm.image-dex2oat-flags u:object_r:exported_dalvik_prop:s0 exact string
dalvik.vm.image-dex2oat-threads u:object_r:exported_dalvik_prop:s0 exact int
dalvik.vm.isa.arm.features u:object_r:exported_dalvik_prop:s0 exact string
dalvik.vm.isa.arm.variant u:object_r:exported_dalvik_prop:s0 exact string
dalvik.vm.isa.arm64.features u:object_r:exported_dalvik_prop:s0 exact string
dalvik.vm.isa.arm64.variant u:object_r:exported_dalvik_prop:s0 exact string
dalvik.vm.isa.mips.features u:object_r:exported_dalvik_prop:s0 exact string
dalvik.vm.isa.mips.variant u:object_r:exported_dalvik_prop:s0 exact string
dalvik.vm.isa.mips64.features u:object_r:exported_dalvik_prop:s0 exact string
dalvik.vm.isa.mips64.variant u:object_r:exported_dalvik_prop:s0 exact string
dalvik.vm.isa.unknown.features u:object_r:exported_dalvik_prop:s0 exact string
dalvik.vm.isa.unknown.variant u:object_r:exported_dalvik_prop:s0 exact string
dalvik.vm.isa.x86.features u:object_r:exported_dalvik_prop:s0 exact string
dalvik.vm.isa.x86.variant u:object_r:exported_dalvik_prop:s0 exact string
dalvik.vm.isa.x86_64.features u:object_r:exported_dalvik_prop:s0 exact string
dalvik.vm.isa.x86_64.variant u:object_r:exported_dalvik_prop:s0 exact string
dalvik.vm.jitinitialsize u:object_r:exported_dalvik_prop:s0 exact string
dalvik.vm.jitmaxsize u:object_r:exported_dalvik_prop:s0 exact string
dalvik.vm.jitprithreadweight u:object_r:exported_dalvik_prop:s0 exact int
dalvik.vm.jitthreshold u:object_r:exported_dalvik_prop:s0 exact int
dalvik.vm.jittransitionweight u:object_r:exported_dalvik_prop:s0 exact int
dalvik.vm.jniopts u:object_r:exported_dalvik_prop:s0 exact string
dalvik.vm.lockprof.threshold u:object_r:exported_dalvik_prop:s0 exact int
dalvik.vm.method-trace u:object_r:exported_dalvik_prop:s0 exact bool
dalvik.vm.method-trace-file u:object_r:exported_dalvik_prop:s0 exact string
dalvik.vm.method-trace-file-siz u:object_r:exported_dalvik_prop:s0 exact int
dalvik.vm.method-trace-stream u:object_r:exported_dalvik_prop:s0 exact bool
Revert "Remove ability to set profilebootimage and profilesystemserver" The ability to set these properties is required by the profilebootclasspath Android products. Also fixed renamed property. Bug: 139883463 Test: manually verified This reverts commit 3079462443d18f3c222c6ad2634b4ae70cd75776. Change-Id: I7e8fceb974f34ea584799dd3e458279adee53e11
2019-11-15 22:19:14 +01:00
dalvik.vm.profilesystemserver u:object_r:exported_dalvik_prop:s0 exact bool
dalvik.vm.profilebootclasspath u:object_r:exported_dalvik_prop:s0 exact bool
Whitelist exported platform properties This CL lists all the exported platform properties in private/exported_property_contexts. Additionally accessing core_property_type from vendor components is restricted. Instead public_readable_property_type is used to allow vendor components to read exported platform properties, and accessibility from vendor_init is also specified explicitly. Note that whitelisting would be applied only if PRODUCT_COMPATIBLE_PROPERTY is set on. Bug: 38146102 Test: tested on walleye with PRODUCT_COMPATIBLE_PROPERTY=true Change-Id: I304ba428cc4ca82668fec2ddeb17c971e7ec065e
2017-10-19 09:54:49 +02:00
dalvik.vm.usejit u:object_r:exported_dalvik_prop:s0 exact bool
dalvik.vm.usejitprofiles u:object_r:exported_dalvik_prop:s0 exact bool
dalvik.vm.zygote.max-boot-retry u:object_r:exported_dalvik_prop:s0 exact int
drm.service.enabled u:object_r:exported3_default_prop:s0 exact bool
keyguard.no_require_sim u:object_r:exported3_default_prop:s0 exact bool
media.recorder.show_manufacturer_and_model u:object_r:exported3_default_prop:s0 exact bool
Allow vendor-init-settable for properties used in Android TV The following properties will be whitelisted. - ro.hdmi.device_type, ro.hdmi.wake_on_hotplug and persist.sys.hdmi.keep_awake for hdmi - ro.sf.disable_triple_buffer for SurfaceFlinger - media.stagefright.cache-params and persist.sys.media.avsync for nuplayer Bug: 78205669 Bug: 78430613 Test: succeeded building Change-Id: I5ee1a1de72c265bca87aa041c6acd9554f5f8c07
2018-04-30 01:49:57 +02:00
media.stagefright.cache-params u:object_r:exported3_default_prop:s0 exact string
add a property to allow thumbnailer to use hw codecs bug: 113609172 Change-Id: Ifff91630c3622661139ff27f25932258802cb082
2018-09-07 03:24:08 +02:00
media.stagefright.thumbnail.prefer_hw_codecs u:object_r:exported3_default_prop:s0 exact bool
Whitelist vendor-init-settable bluetooth_prop and wifi_prop Values of the following properties are set by SoC vendors on some devices including Pixels. - persist.bluetooth.a2dp_offload.cap - persist.bluetooth.a2dp_offload.enable - persist.vendor.bluetooth.a2dp_offload.enable - ro.bt.bdaddr_path - wlan.driver.status So they should be whitelisted for compatibility. Bug: 77633703 Test: succeeded building and tested with Pixels Change-Id: Ib2b81bcc1fd70ddd571dc7fb2b923b576d62b7d5
2018-04-09 05:07:32 +02:00
persist.bluetooth.a2dp_offload.cap u:object_r:bluetooth_a2dp_offload_prop:s0 exact string
A2DP offload: switch to new properties Bug: 63932139 Bug: 76201991 Test: Manual A2DP testing (A2DP offload enabled and disabled) Change-Id: Icebb4a84cf241b3b6bc52e4826fdedd5a73d796a
2018-04-18 07:13:27 +02:00
persist.bluetooth.a2dp_offload.disabled u:object_r:bluetooth_a2dp_offload_prop:s0 exact bool
Add rules for accessing the related bluetooth_audio_hal_prop This change allows those daemons of the audio and Bluetooth which include HALs to access the bluetooth_audio_hal_prop. This property is used to force disable the new BluetoothAudio HAL. - persist.bluetooth.bluetooth_audio_hal.disabled Bug: 128825244 Test: audio HAL can access the property Change-Id: I87a8ba57cfbcd7d3e4548aa96bc915d0cc6b2b74
2019-03-18 04:07:32 +01:00
persist.bluetooth.bluetooth_audio_hal.disabled u:object_r:bluetooth_audio_hal_prop:s0 exact bool
Combine vendor-init-actionable with vendor-init-readable Historically, vendor-init-actionable was created since the various property_contexts files were not yet available when init parses its scripts. Since then, the property_contexts files are now always available when init parses its scripts, so we can collapse these two categories. Specifically, this change ensures that all of the properties in the previous 'stable_properties.h' file in init, which contained the vendor-init-actionable properties, are able to be read by init according to SEPolicy. Bug: 71814576 Test: vendor_init fails to use non-readable properties as a trigger Test: vendor_init successfully uses readable properties as a trigger Change-Id: Ic6d9919b6047f3076a1a19fc26295c6a77aca627
2018-10-23 22:25:05 +02:00
persist.bluetooth.btsnoopenable u:object_r:exported_bluetooth_prop:s0 exact bool
Whitelist exported platform properties This CL lists all the exported platform properties in private/exported_property_contexts. Additionally accessing core_property_type from vendor components is restricted. Instead public_readable_property_type is used to allow vendor components to read exported platform properties, and accessibility from vendor_init is also specified explicitly. Note that whitelisting would be applied only if PRODUCT_COMPATIBLE_PROPERTY is set on. Bug: 38146102 Test: tested on walleye with PRODUCT_COMPATIBLE_PROPERTY=true Change-Id: I304ba428cc4ca82668fec2ddeb17c971e7ec065e
2017-10-19 09:54:49 +02:00
persist.config.calibration_fac u:object_r:exported3_default_prop:s0 exact string
persist.dbg.volte_avail_ovr u:object_r:exported3_default_prop:s0 exact int
persist.dbg.vt_avail_ovr u:object_r:exported3_default_prop:s0 exact int
persist.dbg.wfc_avail_ovr u:object_r:exported3_default_prop:s0 exact int
Allow vendor-init-settable to persist.radio.multisim.config A default value of persist.radio.multisim.config can be set by SoC vendors, and so vendor-init-settable should be allowed to it. Bug: 73871799 Test: succeeded building and tested with taimen Change-Id: Ie62b91e7e3d7e05425b742838417f1cab7b3fed4
2018-03-27 06:41:47 +02:00
persist.radio.multisim.config u:object_r:exported3_radio_prop:s0 exact string
Whitelist exported platform properties This CL lists all the exported platform properties in private/exported_property_contexts. Additionally accessing core_property_type from vendor components is restricted. Instead public_readable_property_type is used to allow vendor components to read exported platform properties, and accessibility from vendor_init is also specified explicitly. Note that whitelisting would be applied only if PRODUCT_COMPATIBLE_PROPERTY is set on. Bug: 38146102 Test: tested on walleye with PRODUCT_COMPATIBLE_PROPERTY=true Change-Id: I304ba428cc4ca82668fec2ddeb17c971e7ec065e
2017-10-19 09:54:49 +02:00
persist.sys.dalvik.vm.lib.2 u:object_r:exported2_system_prop:s0 exact string
Allow vendor-init-settable for properties used in Android TV The following properties will be whitelisted. - ro.hdmi.device_type, ro.hdmi.wake_on_hotplug and persist.sys.hdmi.keep_awake for hdmi - ro.sf.disable_triple_buffer for SurfaceFlinger - media.stagefright.cache-params and persist.sys.media.avsync for nuplayer Bug: 78205669 Bug: 78430613 Test: succeeded building Change-Id: I5ee1a1de72c265bca87aa041c6acd9554f5f8c07
2018-04-30 01:49:57 +02:00
persist.sys.media.avsync u:object_r:exported2_system_prop:s0 exact bool
persist.sys.hdmi.keep_awake u:object_r:exported2_system_prop:s0 exact bool
Add persistent property for SurfaceFlinger color mode. To enable devices to stay in a color mode all the time, add a persistent property as part of per device configuration. BUG: 124129486 Test: Build, flash and boot. Verify with internal patch Change-Id: I45ce25e4f1317911e70a4276df6adc39e7455fed
2019-02-10 22:54:23 +01:00
persist.sys.sf.color_mode u:object_r:exported2_system_prop:s0 exact int
Whitelist exported platform properties This CL lists all the exported platform properties in private/exported_property_contexts. Additionally accessing core_property_type from vendor components is restricted. Instead public_readable_property_type is used to allow vendor components to read exported platform properties, and accessibility from vendor_init is also specified explicitly. Note that whitelisting would be applied only if PRODUCT_COMPATIBLE_PROPERTY is set on. Bug: 38146102 Test: tested on walleye with PRODUCT_COMPATIBLE_PROPERTY=true Change-Id: I304ba428cc4ca82668fec2ddeb17c971e7ec065e
2017-10-19 09:54:49 +02:00
persist.sys.sf.color_saturation u:object_r:exported2_system_prop:s0 exact string
Make persist.sys.sf.native_mode an integer This allows for more native modes. Bug: 73824924 Test: adb shell setprop persist.sys.sf.native_mode 2 Change-Id: Iffdeadc8dc260de4b0c7f2b46aab08d64d25e3b1
2018-04-13 19:19:20 +02:00
persist.sys.sf.native_mode u:object_r:exported2_system_prop:s0 exact int
Whitelist exported platform properties This CL lists all the exported platform properties in private/exported_property_contexts. Additionally accessing core_property_type from vendor components is restricted. Instead public_readable_property_type is used to allow vendor components to read exported platform properties, and accessibility from vendor_init is also specified explicitly. Note that whitelisting would be applied only if PRODUCT_COMPATIBLE_PROPERTY is set on. Bug: 38146102 Test: tested on walleye with PRODUCT_COMPATIBLE_PROPERTY=true Change-Id: I304ba428cc4ca82668fec2ddeb17c971e7ec065e
2017-10-19 09:54:49 +02:00
pm.dexopt.ab-ota u:object_r:exported_pm_prop:s0 exact string
pm.dexopt.bg-dexopt u:object_r:exported_pm_prop:s0 exact string
pm.dexopt.boot u:object_r:exported_pm_prop:s0 exact string
Add missing pm.* properties in property_contexts Certain pm.* properties, which are especially needed for Go-targets, are not listed in property_contexts. Init will not be able to set these properties on bootup without the correct selinux contexts assigned to the properties. BUG: 111738816 Test: In selinux-enforcing mode, on bootup, these properties are now correctly set by init. Change-Id: I6ea0fb229c93725e2987b1e021d5804a132d093d
2018-07-23 16:23:14 +02:00
pm.dexopt.downgrade_after_inactive_days u:object_r:exported_pm_prop:s0 exact int
Whitelist exported platform properties This CL lists all the exported platform properties in private/exported_property_contexts. Additionally accessing core_property_type from vendor components is restricted. Instead public_readable_property_type is used to allow vendor components to read exported platform properties, and accessibility from vendor_init is also specified explicitly. Note that whitelisting would be applied only if PRODUCT_COMPATIBLE_PROPERTY is set on. Bug: 38146102 Test: tested on walleye with PRODUCT_COMPATIBLE_PROPERTY=true Change-Id: I304ba428cc4ca82668fec2ddeb17c971e7ec065e
2017-10-19 09:54:49 +02:00
pm.dexopt.first-boot u:object_r:exported_pm_prop:s0 exact string
Add missing pm.* properties in property_contexts Certain pm.* properties, which are especially needed for Go-targets, are not listed in property_contexts. Init will not be able to set these properties on bootup without the correct selinux contexts assigned to the properties. BUG: 111738816 Test: In selinux-enforcing mode, on bootup, these properties are now correctly set by init. Change-Id: I6ea0fb229c93725e2987b1e021d5804a132d093d
2018-07-23 16:23:14 +02:00
pm.dexopt.inactive u:object_r:exported_pm_prop:s0 exact string
Whitelist exported platform properties This CL lists all the exported platform properties in private/exported_property_contexts. Additionally accessing core_property_type from vendor components is restricted. Instead public_readable_property_type is used to allow vendor components to read exported platform properties, and accessibility from vendor_init is also specified explicitly. Note that whitelisting would be applied only if PRODUCT_COMPATIBLE_PROPERTY is set on. Bug: 38146102 Test: tested on walleye with PRODUCT_COMPATIBLE_PROPERTY=true Change-Id: I304ba428cc4ca82668fec2ddeb17c971e7ec065e
2017-10-19 09:54:49 +02:00
pm.dexopt.install u:object_r:exported_pm_prop:s0 exact string
Add missing pm.* properties in property_contexts Certain pm.* properties, which are especially needed for Go-targets, are not listed in property_contexts. Init will not be able to set these properties on bootup without the correct selinux contexts assigned to the properties. BUG: 111738816 Test: In selinux-enforcing mode, on bootup, these properties are now correctly set by init. Change-Id: I6ea0fb229c93725e2987b1e021d5804a132d093d
2018-07-23 16:23:14 +02:00
pm.dexopt.shared u:object_r:exported_pm_prop:s0 exact string
sepolicy: create rules for system properties Add new sepolicy rules to support audio system properties Bug: 110564278 Change-Id: If774a40b50e56f9e83bcb4ab8a84581dc03058ad
2018-06-16 01:07:56 +02:00
ro.af.client_heap_size_kbyte u:object_r:exported3_default_prop:s0 exact int
sepolicy: allow rules for apk verify system property ro.apk_verity.mode was introduced in P on crosshatch. This change changes the label from default_prop to a new property, apk_verity_prop. ro.apk_verity.mode is set by vendor_init per build.prop, in order to honor Treble split. It is also read by system_server and installd currently. Test: verify functioning without denials in dmesg Bug: 142494008 Bug: 144164497 Change-Id: I1f24513d79237091cf30025bb7ca63282e23c739
2019-11-27 19:06:03 +01:00
ro.apk_verity.mode u:object_r:apk_verity_prop:s0 exact int
Whitelist exported platform properties This CL lists all the exported platform properties in private/exported_property_contexts. Additionally accessing core_property_type from vendor components is restricted. Instead public_readable_property_type is used to allow vendor components to read exported platform properties, and accessibility from vendor_init is also specified explicitly. Note that whitelisting would be applied only if PRODUCT_COMPATIBLE_PROPERTY is set on. Bug: 38146102 Test: tested on walleye with PRODUCT_COMPATIBLE_PROPERTY=true Change-Id: I304ba428cc4ca82668fec2ddeb17c971e7ec065e
2017-10-19 09:54:49 +02:00
ro.audio.monitorRotation u:object_r:exported3_default_prop:s0 exact bool
A2DP offload: switch to new properties Bug: 63932139 Bug: 76201991 Test: Manual A2DP testing (A2DP offload enabled and disabled) Change-Id: Icebb4a84cf241b3b6bc52e4826fdedd5a73d796a
2018-04-18 07:13:27 +02:00
ro.bluetooth.a2dp_offload.supported u:object_r:bluetooth_a2dp_offload_prop:s0 exact bool
Whitelist exported platform properties This CL lists all the exported platform properties in private/exported_property_contexts. Additionally accessing core_property_type from vendor components is restricted. Instead public_readable_property_type is used to allow vendor components to read exported platform properties, and accessibility from vendor_init is also specified explicitly. Note that whitelisting would be applied only if PRODUCT_COMPATIBLE_PROPERTY is set on. Bug: 38146102 Test: tested on walleye with PRODUCT_COMPATIBLE_PROPERTY=true Change-Id: I304ba428cc4ca82668fec2ddeb17c971e7ec065e
2017-10-19 09:54:49 +02:00
ro.boot.vendor.overlay.theme u:object_r:exported_overlay_prop:s0 exact string
ro.boot.wificountrycode u:object_r:exported3_default_prop:s0 exact string
Whitelist vendor-init-settable bluetooth_prop and wifi_prop Values of the following properties are set by SoC vendors on some devices including Pixels. - persist.bluetooth.a2dp_offload.cap - persist.bluetooth.a2dp_offload.enable - persist.vendor.bluetooth.a2dp_offload.enable - ro.bt.bdaddr_path - wlan.driver.status So they should be whitelisted for compatibility. Bug: 77633703 Test: succeeded building and tested with Pixels Change-Id: Ib2b81bcc1fd70ddd571dc7fb2b923b576d62b7d5
2018-04-09 05:07:32 +02:00
ro.bt.bdaddr_path u:object_r:exported_bluetooth_prop:s0 exact string
Whitelist exported platform properties This CL lists all the exported platform properties in private/exported_property_contexts. Additionally accessing core_property_type from vendor components is restricted. Instead public_readable_property_type is used to allow vendor components to read exported platform properties, and accessibility from vendor_init is also specified explicitly. Note that whitelisting would be applied only if PRODUCT_COMPATIBLE_PROPERTY is set on. Bug: 38146102 Test: tested on walleye with PRODUCT_COMPATIBLE_PROPERTY=true Change-Id: I304ba428cc4ca82668fec2ddeb17c971e7ec065e
2017-10-19 09:54:49 +02:00
ro.camera.notify_nfc u:object_r:exported3_default_prop:s0 exact int
Add rules to allow default lazy camera HAL Test: Reboot and ensure lazy camera HAL can run Change-Id: I4cd9fe75537c6aca561830524e25fba631a12def
2018-11-30 20:11:50 +01:00
ro.camera.enableLazyHal u:object_r:exported3_default_prop:s0 exact bool
Whitelist exported platform properties This CL lists all the exported platform properties in private/exported_property_contexts. Additionally accessing core_property_type from vendor components is restricted. Instead public_readable_property_type is used to allow vendor components to read exported platform properties, and accessibility from vendor_init is also specified explicitly. Note that whitelisting would be applied only if PRODUCT_COMPATIBLE_PROPERTY is set on. Bug: 38146102 Test: tested on walleye with PRODUCT_COMPATIBLE_PROPERTY=true Change-Id: I304ba428cc4ca82668fec2ddeb17c971e7ec065e
2017-10-19 09:54:49 +02:00
ro.com.android.dataroaming u:object_r:exported3_default_prop:s0 exact bool
ro.com.android.prov_mobiledata u:object_r:exported3_default_prop:s0 exact bool
ro.config.alarm_alert u:object_r:exported2_config_prop:s0 exact string
ro.config.media_vol_steps u:object_r:exported2_config_prop:s0 exact int
ro.config.notification_sound u:object_r:exported2_config_prop:s0 exact string
Allow vendor to configure lmkd properties BUG: 138399045 Test: Boot cuttlefish. properties set Change-Id: I3138048e9d13f8c0aee1ad3eb4e761809bafcf1d
2019-07-25 23:48:22 +02:00
ro.config.per_app_memcg u:object_r:exported3_default_prop:s0 exact bool
Whitelist exported platform properties This CL lists all the exported platform properties in private/exported_property_contexts. Additionally accessing core_property_type from vendor components is restricted. Instead public_readable_property_type is used to allow vendor components to read exported platform properties, and accessibility from vendor_init is also specified explicitly. Note that whitelisting would be applied only if PRODUCT_COMPATIBLE_PROPERTY is set on. Bug: 38146102 Test: tested on walleye with PRODUCT_COMPATIBLE_PROPERTY=true Change-Id: I304ba428cc4ca82668fec2ddeb17c971e7ec065e
2017-10-19 09:54:49 +02:00
ro.config.ringtone u:object_r:exported2_config_prop:s0 exact string
ro.control_privapp_permissions u:object_r:exported3_default_prop:s0 exact string
ro.cp_system_other_odex u:object_r:exported3_default_prop:s0 exact int
ro.crypto.{allow_encrypt_override filenames_mode} vendor-init-settable. Bug: 114017832 Test: m selinux_policy Change-Id: I1dcb09c76b3e49888d278a154d79add6c6a6c977
2018-09-08 23:42:49 +02:00
ro.crypto.allow_encrypt_override u:object_r:exported2_vold_prop:s0 exact bool
Export vold FDE algorithm properties ro.crypto.fde_algorithm ro.crypto.fde_sector_size ro.crypto.volume.contents_mode These properties were not added to sepolicy export2vold. vold can't access crypto algorithm type when flashing a GSI image and when the properties are in /vendor/build.prop. This prevents FDE from working. Bug: 141518844 Change-Id: I234bda439f6be7a2211a194856baf75800396232 Signed-off-by: yuguoxu <yuguoxu@allwinnertech.corp-partner.google.com>
2019-09-24 08:52:30 +02:00
ro.crypto.fde_algorithm u:object_r:exported2_vold_prop:s0 exact string
ro.crypto.fde_sector_size u:object_r:exported2_vold_prop:s0 exact int
Whitelist exported platform properties This CL lists all the exported platform properties in private/exported_property_contexts. Additionally accessing core_property_type from vendor components is restricted. Instead public_readable_property_type is used to allow vendor components to read exported platform properties, and accessibility from vendor_init is also specified explicitly. Note that whitelisting would be applied only if PRODUCT_COMPATIBLE_PROPERTY is set on. Bug: 38146102 Test: tested on walleye with PRODUCT_COMPATIBLE_PROPERTY=true Change-Id: I304ba428cc4ca82668fec2ddeb17c971e7ec065e
2017-10-19 09:54:49 +02:00
ro.crypto.scrypt_params u:object_r:exported2_vold_prop:s0 exact string
Fix ext4/metadata/udc problem Test: Cannot currently test since no device supports this combo Bug: 137924328 Change-Id: Ie59e6c37e293c983e99618eacda9fd09c2ce01ed
2019-08-08 00:21:46 +02:00
ro.crypto.set_dun u:object_r:exported2_vold_prop:s0 exact bool
Export vold FDE algorithm properties ro.crypto.fde_algorithm ro.crypto.fde_sector_size ro.crypto.volume.contents_mode These properties were not added to sepolicy export2vold. vold can't access crypto algorithm type when flashing a GSI image and when the properties are in /vendor/build.prop. This prevents FDE from working. Bug: 141518844 Change-Id: I234bda439f6be7a2211a194856baf75800396232 Signed-off-by: yuguoxu <yuguoxu@allwinnertech.corp-partner.google.com>
2019-09-24 08:52:30 +02:00
ro.crypto.volume.contents_mode u:object_r:exported2_vold_prop:s0 exact string
ro.crypto.{allow_encrypt_override filenames_mode} vendor-init-settable. Bug: 114017832 Test: m selinux_policy Change-Id: I1dcb09c76b3e49888d278a154d79add6c6a6c977
2018-09-08 23:42:49 +02:00
ro.crypto.volume.filenames_mode u:object_r:exported2_vold_prop:s0 exact string
Replace "flags" property with "options" with same format as fstab Bug: 143307095 Test: Set override, check policy is as expected with sm set-virtual-disk Change-Id: I78b36295141db43ae3e910c654696d3e36a24734
2019-10-25 08:23:58 +02:00
ro.crypto.volume.options u:object_r:exported2_vold_prop:s0 exact string
Whitelist exported platform properties This CL lists all the exported platform properties in private/exported_property_contexts. Additionally accessing core_property_type from vendor components is restricted. Instead public_readable_property_type is used to allow vendor components to read exported platform properties, and accessibility from vendor_init is also specified explicitly. Note that whitelisting would be applied only if PRODUCT_COMPATIBLE_PROPERTY is set on. Bug: 38146102 Test: tested on walleye with PRODUCT_COMPATIBLE_PROPERTY=true Change-Id: I304ba428cc4ca82668fec2ddeb17c971e7ec065e
2017-10-19 09:54:49 +02:00
ro.dalvik.vm.native.bridge u:object_r:exported_dalvik_prop:s0 exact string
Allow vendor-init-settable to ro.enable_boot_charger_mode vendor-init-settable should be allowed to ro.enable_boot_charger_mode so that SoC vendors can set its default value. Bug: 74421250 Test: succeeded building and tested with taimen Change-Id: I2859aab29fefb7882989413a089b0de55142d2f1 Merged-In: I2859aab29fefb7882989413a089b0de55142d2f1 (cherry picked from commit 46bc518c6988ef030f730cfdc672ebde15dae732)
2018-03-12 00:18:01 +01:00
ro.enable_boot_charger_mode u:object_r:exported3_default_prop:s0 exact bool
Whitelist exported platform properties This CL lists all the exported platform properties in private/exported_property_contexts. Additionally accessing core_property_type from vendor components is restricted. Instead public_readable_property_type is used to allow vendor components to read exported platform properties, and accessibility from vendor_init is also specified explicitly. Note that whitelisting would be applied only if PRODUCT_COMPATIBLE_PROPERTY is set on. Bug: 38146102 Test: tested on walleye with PRODUCT_COMPATIBLE_PROPERTY=true Change-Id: I304ba428cc4ca82668fec2ddeb17c971e7ec065e
2017-10-19 09:54:49 +02:00
ro.gfx.driver.0 u:object_r:exported3_default_prop:s0 exact string
Create System Property to Indicate ANGLE Support Create the system property ro.gfx.angle.supported that indicates if the device supports ANGLE. The current planned use of this property is to allow CTS to validate ANGLE functionality if the device indicates ANGLE is supported. Bug: 80239516 Test: Flash the build and verify the property is 'false' for marlin. Test: Flash the build and verify the property is 'true' for walleye. Change-Id: I00387db9ade34152f79d75453ea17d5ea7b063cd
2019-01-10 19:35:58 +01:00
ro.gfx.angle.supported u:object_r:exported3_default_prop:s0 exact bool
Allow vendor-init-settable for properties used in Android TV The following properties will be whitelisted. - ro.hdmi.device_type, ro.hdmi.wake_on_hotplug and persist.sys.hdmi.keep_awake for hdmi - ro.sf.disable_triple_buffer for SurfaceFlinger - media.stagefright.cache-params and persist.sys.media.avsync for nuplayer Bug: 78205669 Bug: 78430613 Test: succeeded building Change-Id: I5ee1a1de72c265bca87aa041c6acd9554f5f8c07
2018-04-30 01:49:57 +02:00
ro.hdmi.device_type u:object_r:exported3_default_prop:s0 exact string
ro.hdmi.wake_on_hotplug u:object_r:exported3_default_prop:s0 exact bool
Allow vendor to configure lmkd properties BUG: 138399045 Test: Boot cuttlefish. properties set Change-Id: I3138048e9d13f8c0aee1ad3eb4e761809bafcf1d
2019-07-25 23:48:22 +02:00
ro.lmk.critical u:object_r:exported3_default_prop:s0 exact int
Whitelist some more properties that go into /vendor/build.prop Whitelisting some more properties that are to be set by vendor-init but are not vendor specific. Test: After whitelisting, these properties are now correctly set on Go devices by vendor-init, in selinux "enforcing" mode. BUG: 111738816 Change-Id: I3fcc09719fc9e77919a1a9f99453037ca15f25a7
2018-08-13 17:17:18 +02:00
ro.lmk.critical_upgrade u:object_r:exported3_default_prop:s0 exact bool
Allow vendor to configure lmkd properties BUG: 138399045 Test: Boot cuttlefish. properties set Change-Id: I3138048e9d13f8c0aee1ad3eb4e761809bafcf1d
2019-07-25 23:48:22 +02:00
ro.lmk.debug u:object_r:exported3_default_prop:s0 exact bool
Whitelist some more properties that go into /vendor/build.prop Whitelisting some more properties that are to be set by vendor-init but are not vendor specific. Test: After whitelisting, these properties are now correctly set on Go devices by vendor-init, in selinux "enforcing" mode. BUG: 111738816 Change-Id: I3fcc09719fc9e77919a1a9f99453037ca15f25a7
2018-08-13 17:17:18 +02:00
ro.lmk.downgrade_pressure u:object_r:exported3_default_prop:s0 exact int
ro.lmk.kill_heaviest_task u:object_r:exported3_default_prop:s0 exact bool
Allow vendor to configure lmkd properties BUG: 138399045 Test: Boot cuttlefish. properties set Change-Id: I3138048e9d13f8c0aee1ad3eb4e761809bafcf1d
2019-07-25 23:48:22 +02:00
ro.lmk.kill_timeout_ms u:object_r:exported3_default_prop:s0 exact int
ro.lmk.low u:object_r:exported3_default_prop:s0 exact int
ro.lmk.medium u:object_r:exported3_default_prop:s0 exact int
Allow vendor to configure new lmkd properties Newly added ro.lmk.psi_partial_stall_ms, ro.lmk.psi_complete_stall_ms, ro.lmk.thrashing_limit and ro.lmk.thrashing_limit_decay should be configurable by vendors. Bug: 132642304 Change-Id: Ifd3513c78e75d77be8d7c3594bef48ea27cc80b3 Signed-off-by: Suren Baghdasaryan <surenb@google.com>
2019-10-10 19:11:12 +02:00
ro.lmk.psi_partial_stall_ms u:object_r:exported3_default_prop:s0 exact int
ro.lmk.psi_complete_stall_ms u:object_r:exported3_default_prop:s0 exact int
Allow vendor to configure lmkd properties BUG: 138399045 Test: Boot cuttlefish. properties set Change-Id: I3138048e9d13f8c0aee1ad3eb4e761809bafcf1d
2019-07-25 23:48:22 +02:00
ro.lmk.swap_free_low_percentage u:object_r:exported3_default_prop:s0 exact int
Allow vendor to configure new lmkd properties Newly added ro.lmk.psi_partial_stall_ms, ro.lmk.psi_complete_stall_ms, ro.lmk.thrashing_limit and ro.lmk.thrashing_limit_decay should be configurable by vendors. Bug: 132642304 Change-Id: Ifd3513c78e75d77be8d7c3594bef48ea27cc80b3 Signed-off-by: Suren Baghdasaryan <surenb@google.com>
2019-10-10 19:11:12 +02:00
ro.lmk.thrashing_limit u:object_r:exported3_default_prop:s0 exact int
ro.lmk.thrashing_limit_decay u:object_r:exported3_default_prop:s0 exact int
Allow vendor to configure lmkd properties BUG: 138399045 Test: Boot cuttlefish. properties set Change-Id: I3138048e9d13f8c0aee1ad3eb4e761809bafcf1d
2019-07-25 23:48:22 +02:00
ro.lmk.use_minfree_levels u:object_r:exported3_default_prop:s0 exact bool
Whitelist some more properties that go into /vendor/build.prop Whitelisting some more properties that are to be set by vendor-init but are not vendor specific. Test: After whitelisting, these properties are now correctly set on Go devices by vendor-init, in selinux "enforcing" mode. BUG: 111738816 Change-Id: I3fcc09719fc9e77919a1a9f99453037ca15f25a7
2018-08-13 17:17:18 +02:00
ro.lmk.upgrade_pressure u:object_r:exported3_default_prop:s0 exact int
Whitelist minui properties to be overridden by /vendor/default.prop. These values will be read by platform module (/sbin/charger), and need to be configurable by vendor init. Bug: 113567255 Test: Build along with other CLs in the topic (for Makefile and libminui changes). Boot into charger mode. Test: Boot into recovery. Run graphics test. Change-Id: I5b272f345e2a5a255c2f660c59c1da3245aa1e03
2018-09-06 06:34:42 +02:00
ro.minui.default_rotation u:object_r:exported3_default_prop:s0 exact string
ro.minui.overscan_percent u:object_r:exported3_default_prop:s0 exact int
ro.minui.pixel_format u:object_r:exported3_default_prop:s0 exact string
Whitelist exported platform properties This CL lists all the exported platform properties in private/exported_property_contexts. Additionally accessing core_property_type from vendor components is restricted. Instead public_readable_property_type is used to allow vendor components to read exported platform properties, and accessibility from vendor_init is also specified explicitly. Note that whitelisting would be applied only if PRODUCT_COMPATIBLE_PROPERTY is set on. Bug: 38146102 Test: tested on walleye with PRODUCT_COMPATIBLE_PROPERTY=true Change-Id: I304ba428cc4ca82668fec2ddeb17c971e7ec065e
2017-10-19 09:54:49 +02:00
ro.oem_unlock_supported u:object_r:exported3_default_prop:s0 exact int
ro.opengles.version u:object_r:exported3_default_prop:s0 exact int
Allow vendor-init-settable for ro.radio.noril ro.radio.noril is used for modem-less products including emulator. Bug: 73871799 Test: succeeded building and tested with taimen Change-Id: I2270374a2523889aa4874840594d8267614f93ad
2018-02-26 08:19:53 +01:00
ro.radio.noril u:object_r:exported3_default_prop:s0 exact string
Add missing pm.* properties in property_contexts This is checked into AOSP master and was not merged to internal for some reason. Adding this will resolve the issue without a merge conflict from AOSP. Bug: 111738816 Test: manual Change-Id: I77ecbd2afce2b5ed9aa3e3d4f28af2a2df942644
2018-08-16 01:12:05 +02:00
ro.retaildemo.video_path u:object_r:exported3_default_prop:s0 exact string
Whitelist some more properties that go into /vendor/build.prop Whitelisting some more properties that are to be set by vendor-init but are not vendor specific. Test: After whitelisting, these properties are now correctly set on Go devices by vendor-init, in selinux "enforcing" mode. BUG: 111738816 Change-Id: I3fcc09719fc9e77919a1a9f99453037ca15f25a7
2018-08-13 17:17:18 +02:00
ro.statsd.enable u:object_r:exported3_default_prop:s0 exact bool
Allow vendor-init-settable for properties used in Android TV The following properties will be whitelisted. - ro.hdmi.device_type, ro.hdmi.wake_on_hotplug and persist.sys.hdmi.keep_awake for hdmi - ro.sf.disable_triple_buffer for SurfaceFlinger - media.stagefright.cache-params and persist.sys.media.avsync for nuplayer Bug: 78205669 Bug: 78430613 Test: succeeded building Change-Id: I5ee1a1de72c265bca87aa041c6acd9554f5f8c07
2018-04-30 01:49:57 +02:00
ro.sf.disable_triple_buffer u:object_r:exported3_default_prop:s0 exact bool
Whitelist exported platform properties This CL lists all the exported platform properties in private/exported_property_contexts. Additionally accessing core_property_type from vendor components is restricted. Instead public_readable_property_type is used to allow vendor components to read exported platform properties, and accessibility from vendor_init is also specified explicitly. Note that whitelisting would be applied only if PRODUCT_COMPATIBLE_PROPERTY is set on. Bug: 38146102 Test: tested on walleye with PRODUCT_COMPATIBLE_PROPERTY=true Change-Id: I304ba428cc4ca82668fec2ddeb17c971e7ec065e
2017-10-19 09:54:49 +02:00
ro.sf.lcd_density u:object_r:exported3_default_prop:s0 exact int
ro.storage_manager.enabled u:object_r:exported3_default_prop:s0 exact bool
ro.telephony.call_ring.multiple u:object_r:exported3_default_prop:s0 exact bool
ro.telephony.default_cdma_sub u:object_r:exported3_default_prop:s0 exact int
Fix issue that ro.telephony.default_network can't be read per slot "ro.telephony.default_network" can define as comma-separated Sting per slot for multi SIM device. However, it cannot be read correctly due to it defined as Int in property_contexts file. Bug: 110626665 Test: manual - Checked the ro.telephony.default_network can be read per slot for multi SIM device. Change-Id: I900620e46c819c14bf339751f00a1db1473fd45f
2018-06-07 13:26:18 +02:00
ro.telephony.default_network u:object_r:exported3_default_prop:s0 exact string
Allow vendor-init selecting Vehicle HAL instance to use. Bug: 143779011 Test: added PRODUCT_PROPERTY_OVERRIDES for ro.vehicle.hal Change-Id: I01ec302f3aedae0b021aa34952805e764d45f431
2019-11-06 22:14:58 +01:00
ro.vehicle.hal u:object_r:vehicle_hal_prop:s0 exact string
Adding labeling for vendor security patch prop This will allow adb shell getprop ro.vendor.build.security_patch to properly return the correct build property, whereas previously it was offlimits due to lack of label. Test: adb shell getprop ro.vendor.build.security_patch successfully returns whatever VENDOR_SECURITY_PATCH is defined to be in the Android .mk files Change-Id: Ie8427738125fc7f909ad8d51e4b76558f5544d49
2018-03-30 03:21:31 +02:00
ro.vendor.build.security_patch u:object_r:vendor_security_patch_level_prop:s0 exact string
Allow system server to access zram sysfs This patch allows - System server needs write access to zram sysfs directory to be able to trigger writeback to disk. - init should be able to change attrs on zram to make them writeable by system_server. - Vendor init scripts should be able to set zram properties. Bug: 117682284 Bug: 122674343 Test: Test writeback on go ref device Change-Id: I308e48210f34894204992043eced5f276d736baf
2019-01-09 20:24:26 +01:00
ro.zram.mark_idle_delay_mins u:object_r:exported3_default_prop:s0 exact int
ro.zram.first_wb_delay_mins u:object_r:exported3_default_prop:s0 exact int
ro.zram.periodic_wb_delay_hours u:object_r:exported3_default_prop:s0 exact int
Whitelist exported platform properties This CL lists all the exported platform properties in private/exported_property_contexts. Additionally accessing core_property_type from vendor components is restricted. Instead public_readable_property_type is used to allow vendor components to read exported platform properties, and accessibility from vendor_init is also specified explicitly. Note that whitelisting would be applied only if PRODUCT_COMPATIBLE_PROPERTY is set on. Bug: 38146102 Test: tested on walleye with PRODUCT_COMPATIBLE_PROPERTY=true Change-Id: I304ba428cc4ca82668fec2ddeb17c971e7ec065e
2017-10-19 09:54:49 +02:00
ro.zygote u:object_r:exported3_default_prop:s0 exact string
sendbug.preferred.domain u:object_r:exported3_default_prop:s0 exact string
sys.usb.controller u:object_r:exported2_system_prop:s0 exact string
sys.usb.ffs.max_read u:object_r:exported_ffs_prop:s0 exact int
sys.usb.ffs.max_write u:object_r:exported_ffs_prop:s0 exact int
Combine vendor-init-actionable with vendor-init-readable Historically, vendor-init-actionable was created since the various property_contexts files were not yet available when init parses its scripts. Since then, the property_contexts files are now always available when init parses its scripts, so we can collapse these two categories. Specifically, this change ensures that all of the properties in the previous 'stable_properties.h' file in init, which contained the vendor-init-actionable properties, are able to be read by init according to SEPolicy. Bug: 71814576 Test: vendor_init fails to use non-readable properties as a trigger Test: vendor_init successfully uses readable properties as a trigger Change-Id: Ic6d9919b6047f3076a1a19fc26295c6a77aca627
2018-10-23 22:25:05 +02:00
sys.usb.ffs.ready u:object_r:exported_ffs_prop:s0 exact bool
Whitelist exported platform properties This CL lists all the exported platform properties in private/exported_property_contexts. Additionally accessing core_property_type from vendor components is restricted. Instead public_readable_property_type is used to allow vendor components to read exported platform properties, and accessibility from vendor_init is also specified explicitly. Note that whitelisting would be applied only if PRODUCT_COMPATIBLE_PROPERTY is set on. Bug: 38146102 Test: tested on walleye with PRODUCT_COMPATIBLE_PROPERTY=true Change-Id: I304ba428cc4ca82668fec2ddeb17c971e7ec065e
2017-10-19 09:54:49 +02:00
sys.usb.mtp.device_type u:object_r:exported2_system_prop:s0 exact int
Combine vendor-init-actionable with vendor-init-readable Historically, vendor-init-actionable was created since the various property_contexts files were not yet available when init parses its scripts. Since then, the property_contexts files are now always available when init parses its scripts, so we can collapse these two categories. Specifically, this change ensures that all of the properties in the previous 'stable_properties.h' file in init, which contained the vendor-init-actionable properties, are able to be read by init according to SEPolicy. Bug: 71814576 Test: vendor_init fails to use non-readable properties as a trigger Test: vendor_init successfully uses readable properties as a trigger Change-Id: Ic6d9919b6047f3076a1a19fc26295c6a77aca627
2018-10-23 22:25:05 +02:00
sys.usb.ffs.mtp.ready u:object_r:exported_ffs_prop:s0 exact bool
Whitelist exported platform properties This CL lists all the exported platform properties in private/exported_property_contexts. Additionally accessing core_property_type from vendor components is restricted. Instead public_readable_property_type is used to allow vendor components to read exported platform properties, and accessibility from vendor_init is also specified explicitly. Note that whitelisting would be applied only if PRODUCT_COMPATIBLE_PROPERTY is set on. Bug: 38146102 Test: tested on walleye with PRODUCT_COMPATIBLE_PROPERTY=true Change-Id: I304ba428cc4ca82668fec2ddeb17c971e7ec065e
2017-10-19 09:54:49 +02:00
sys.usb.state u:object_r:exported2_system_prop:s0 exact string
telephony.lteOnCdmaDevice u:object_r:exported3_default_prop:s0 exact int
tombstoned.max_tombstone_count u:object_r:exported3_default_prop:s0 exact int
vold.post_fs_data_done u:object_r:exported2_vold_prop:s0 exact int
Combine vendor-init-actionable with vendor-init-readable Historically, vendor-init-actionable was created since the various property_contexts files were not yet available when init parses its scripts. Since then, the property_contexts files are now always available when init parses its scripts, so we can collapse these two categories. Specifically, this change ensures that all of the properties in the previous 'stable_properties.h' file in init, which contained the vendor-init-actionable properties, are able to be read by init according to SEPolicy. Bug: 71814576 Test: vendor_init fails to use non-readable properties as a trigger Test: vendor_init successfully uses readable properties as a trigger Change-Id: Ic6d9919b6047f3076a1a19fc26295c6a77aca627
2018-10-23 22:25:05 +02:00
vts.native_server.on u:object_r:exported3_default_prop:s0 exact bool
Whitelist vendor-init-settable bluetooth_prop and wifi_prop Values of the following properties are set by SoC vendors on some devices including Pixels. - persist.bluetooth.a2dp_offload.cap - persist.bluetooth.a2dp_offload.enable - persist.vendor.bluetooth.a2dp_offload.enable - ro.bt.bdaddr_path - wlan.driver.status So they should be whitelisted for compatibility. Bug: 77633703 Test: succeeded building and tested with Pixels Change-Id: Ib2b81bcc1fd70ddd571dc7fb2b923b576d62b7d5
2018-04-09 05:07:32 +02:00
wlan.driver.status u:object_r:exported_wifi_prop:s0 exact enum ok unloaded
Add property to skip idle for zram writeback Vendors should be able set this property Bug: 141756630 Test: Device boots up and zram writeback works Change-Id: I0618df43579b3b63510df84e88bbcfd5e00abb16
2019-10-22 19:51:47 +02:00
zram.force_writeback u:object_r:exported3_default_prop:s0 exact bool
Whitelist exported platform properties This CL lists all the exported platform properties in private/exported_property_contexts. Additionally accessing core_property_type from vendor components is restricted. Instead public_readable_property_type is used to allow vendor components to read exported platform properties, and accessibility from vendor_init is also specified explicitly. Note that whitelisting would be applied only if PRODUCT_COMPATIBLE_PROPERTY is set on. Bug: 38146102 Test: tested on walleye with PRODUCT_COMPATIBLE_PROPERTY=true Change-Id: I304ba428cc4ca82668fec2ddeb17c971e7ec065e
2017-10-19 09:54:49 +02:00
Combine vendor-init-actionable with vendor-init-readable Historically, vendor-init-actionable was created since the various property_contexts files were not yet available when init parses its scripts. Since then, the property_contexts files are now always available when init parses its scripts, so we can collapse these two categories. Specifically, this change ensures that all of the properties in the previous 'stable_properties.h' file in init, which contained the vendor-init-actionable properties, are able to be read by init according to SEPolicy. Bug: 71814576 Test: vendor_init fails to use non-readable properties as a trigger Test: vendor_init successfully uses readable properties as a trigger Change-Id: Ic6d9919b6047f3076a1a19fc26295c6a77aca627
2018-10-23 22:25:05 +02:00
# vendor-init-readable
apexd exports its status via sysprop A sysprop apexd.status is set by apexd, to that other components (i.e. init) can determine whether APEXs are all successfully mounted or no (i.e., being mounted). The sysprop is only writable by apexd. Bug: 117403679 Test: adb shell getprop apexd.status returns 'ready'. Change-Id: I81bcb96e6c5cb9d899f29ffa84f91eab3820be25
2018-11-01 12:05:20 +01:00
apexd.status u:object_r:apexd_prop:s0 exact enum starting ready
Allow vendor-init-readable for sys.boot_completed and dev.bootcomplete Bug: 75987246 Test: succeeded builing and tested with taimen Change-Id: I2d8bc91c305e665ed9c69459e51204117afb3eee
2018-04-12 01:12:25 +02:00
dev.bootcomplete u:object_r:exported3_system_prop:s0 exact bool
Set persist.sys.device_provisioned vendor-init-readable. `persist.sys.device_provisioned` is set (more precisely, "will be set", via internal change in ag/7567585) by system_server based on device privisioning state. This CL grants vendor_init to set up action triggers based on the property value. avc: denied { read } for property=persist.sys.device_provisioned pid=0 uid=0 gid=0 scontext=u:r:vendor_init:s0 tcontext=u:object_r:system_prop:s0 tclass=file permissive=0 Bug: 131702833 Bug: 132906936 Test: Set an init trigger that waits on `persist.sys.device_provisioned`. Check that there's no longer a denial. Change-Id: I64e50bd31c90db4b3bdd3bd014a90d7bef708b57
2019-05-17 22:46:06 +02:00
persist.sys.device_provisioned u:object_r:exported3_system_prop:s0 exact string
Add persist.sys.theme. This property will be set by system_server (to indicate the currently selected theme for device), and can be accessed by vendor init.rc. avc: denied { read } for property=persist.sys.theme pid=0 uid=0 gid=0 scontext=u:r:vendor_init:s0 tcontext=u:object_r:theme_prop:s0 tclass=file Bug: 113028175 Test: Set a vendor init trigger that waits on `persist.sys.theme`. Check that the trigger fires without denial. Change-Id: Ibb4e392d5059b76059f36f7d11ba82cd65cbe970
2019-06-15 02:00:16 +02:00
persist.sys.theme u:object_r:theme_prop:s0 exact string
Allow vendor_init_readable to persist.sys.usb.usbradio.config persist.sys.usb.usbradio.config can be read in vendor init scripts. Bug: 75202311 Bug: 74266614 Test: succeeded building and tested on pixels Change-Id: Ib07a436dd22b4b445fd114cc1d0df7c3e7a21527
2018-03-19 00:55:51 +01:00
persist.sys.usb.usbradio.config u:object_r:exported3_system_prop:s0 exact string
Allow vendor-init-readable for sys.boot_completed and dev.bootcomplete Bug: 75987246 Test: succeeded builing and tested with taimen Change-Id: I2d8bc91c305e665ed9c69459e51204117afb3eee
2018-04-12 01:12:25 +02:00
sys.boot_completed u:object_r:exported3_system_prop:s0 exact bool
Whitelist exported platform properties This CL lists all the exported platform properties in private/exported_property_contexts. Additionally accessing core_property_type from vendor components is restricted. Instead public_readable_property_type is used to allow vendor components to read exported platform properties, and accessibility from vendor_init is also specified explicitly. Note that whitelisting would be applied only if PRODUCT_COMPATIBLE_PROPERTY is set on. Bug: 38146102 Test: tested on walleye with PRODUCT_COMPATIBLE_PROPERTY=true Change-Id: I304ba428cc4ca82668fec2ddeb17c971e7ec065e
2017-10-19 09:54:49 +02:00
sys.retaildemo.enabled u:object_r:exported3_system_prop:s0 exact int
Combine vendor-init-actionable with vendor-init-readable Historically, vendor-init-actionable was created since the various property_contexts files were not yet available when init parses its scripts. Since then, the property_contexts files are now always available when init parses its scripts, so we can collapse these two categories. Specifically, this change ensures that all of the properties in the previous 'stable_properties.h' file in init, which contained the vendor-init-actionable properties, are able to be read by init according to SEPolicy. Bug: 71814576 Test: vendor_init fails to use non-readable properties as a trigger Test: vendor_init successfully uses readable properties as a trigger Change-Id: Ic6d9919b6047f3076a1a19fc26295c6a77aca627
2018-10-23 22:25:05 +02:00
sys.user.0.ce_available u:object_r:exported3_system_prop:s0 exact bool
sys.vdso u:object_r:exported3_system_prop:s0 exact string
Whitelist exported platform properties This CL lists all the exported platform properties in private/exported_property_contexts. Additionally accessing core_property_type from vendor components is restricted. Instead public_readable_property_type is used to allow vendor components to read exported platform properties, and accessibility from vendor_init is also specified explicitly. Note that whitelisting would be applied only if PRODUCT_COMPATIBLE_PROPERTY is set on. Bug: 38146102 Test: tested on walleye with PRODUCT_COMPATIBLE_PROPERTY=true Change-Id: I304ba428cc4ca82668fec2ddeb17c971e7ec065e
2017-10-19 09:54:49 +02:00
Combine vendor-init-actionable with vendor-init-readable Historically, vendor-init-actionable was created since the various property_contexts files were not yet available when init parses its scripts. Since then, the property_contexts files are now always available when init parses its scripts, so we can collapse these two categories. Specifically, this change ensures that all of the properties in the previous 'stable_properties.h' file in init, which contained the vendor-init-actionable properties, are able to be read by init according to SEPolicy. Bug: 71814576 Test: vendor_init fails to use non-readable properties as a trigger Test: vendor_init successfully uses readable properties as a trigger Change-Id: Ic6d9919b6047f3076a1a19fc26295c6a77aca627
2018-10-23 22:25:05 +02:00
# vendor-init-settable
Allow vendor-init-settable to persist.sys.zram_enabled persist.sys.zram_enabled is set in vendor/build.prop in taimen and walleye, which was added after the initial whitelist. go/treble-sysprop-compatibility requires whitelisting such a property to allow it to be overridden by vendor/{default|build}.prop. Bug: 73905119 Test: succeeded building and test with taimen Change-Id: I931182aa05eb90c14df6e2c7cc26913f3874fa18
2018-02-27 03:14:48 +01:00
persist.sys.zram_enabled u:object_r:exported2_system_prop:s0 exact bool
Whitelist exported platform properties This CL lists all the exported platform properties in private/exported_property_contexts. Additionally accessing core_property_type from vendor components is restricted. Instead public_readable_property_type is used to allow vendor components to read exported platform properties, and accessibility from vendor_init is also specified explicitly. Note that whitelisting would be applied only if PRODUCT_COMPATIBLE_PROPERTY is set on. Bug: 38146102 Test: tested on walleye with PRODUCT_COMPATIBLE_PROPERTY=true Change-Id: I304ba428cc4ca82668fec2ddeb17c971e7ec065e
2017-10-19 09:54:49 +02:00
sys.usb.config u:object_r:exported_system_radio_prop:s0 exact string
sys.usb.configfs u:object_r:exported_system_radio_prop:s0 exact int
# public-readable
aac_drc_boost u:object_r:exported2_default_prop:s0 exact int
aac_drc_cut u:object_r:exported2_default_prop:s0 exact int
aac_drc_enc_target_level u:object_r:exported2_default_prop:s0 exact int
aac_drc_heavy u:object_r:exported2_default_prop:s0 exact int
aac_drc_reference_level u:object_r:exported2_default_prop:s0 exact int
Whitelist reading property ro.aac_drc_effect_type Bug: 71430241 Test: build/flash, grep for "avc: denied { read }" for mediacodec, should be empty on walleye Change-Id: I12e1b11a969d3f979ca0cfbe4ca7db2bc5e46165
2018-04-21 01:51:49 +02:00
ro.aac_drc_effect_type u:object_r:exported2_default_prop:s0 exact int
Whitelist exported platform properties This CL lists all the exported platform properties in private/exported_property_contexts. Additionally accessing core_property_type from vendor components is restricted. Instead public_readable_property_type is used to allow vendor components to read exported platform properties, and accessibility from vendor_init is also specified explicitly. Note that whitelisting would be applied only if PRODUCT_COMPATIBLE_PROPERTY is set on. Bug: 38146102 Test: tested on walleye with PRODUCT_COMPATIBLE_PROPERTY=true Change-Id: I304ba428cc4ca82668fec2ddeb17c971e7ec065e
2017-10-19 09:54:49 +02:00
drm.64bit.enabled u:object_r:exported2_default_prop:s0 exact bool
dumpstate.dry_run u:object_r:exported_dumpstate_prop:s0 exact bool
Added system property (dumpstate.unroot) to run dumpstate as shell. This is useful to test how it would behave on devices with user builds. Bug: 117980186 Test: adb shell setprop dumpstate.unroot true && \ adb shell cmd activity bug-report --progress Change-Id: If9094bbe0c29e8180f1b35d2b4ac95343a1bd0eb
2018-10-29 22:06:14 +01:00
dumpstate.unroot u:object_r:exported_dumpstate_prop:s0 exact bool
Whitelist exported platform properties This CL lists all the exported platform properties in private/exported_property_contexts. Additionally accessing core_property_type from vendor components is restricted. Instead public_readable_property_type is used to allow vendor components to read exported platform properties, and accessibility from vendor_init is also specified explicitly. Note that whitelisting would be applied only if PRODUCT_COMPATIBLE_PROPERTY is set on. Bug: 38146102 Test: tested on walleye with PRODUCT_COMPATIBLE_PROPERTY=true Change-Id: I304ba428cc4ca82668fec2ddeb17c971e7ec065e
2017-10-19 09:54:49 +02:00
hal.instrumentation.enable u:object_r:exported2_default_prop:s0 exact bool
export init.svc.bugreport Vendor need to hook bugreport propery as well as dumpstatez. This CL exports it. Test: Confirmed verndor can get property trigger hook manually Bug: 118718191 Change-Id: I64a0e38716fb863ccd8923c6c41a776ea341f2d1 Signed-off-by: Minchan Kim <minchan@google.com>
2018-10-31 04:10:13 +01:00
init.svc.bugreport u:object_r:exported2_default_prop:s0 exact string
Combine vendor-init-actionable with vendor-init-readable Historically, vendor-init-actionable was created since the various property_contexts files were not yet available when init parses its scripts. Since then, the property_contexts files are now always available when init parses its scripts, so we can collapse these two categories. Specifically, this change ensures that all of the properties in the previous 'stable_properties.h' file in init, which contained the vendor-init-actionable properties, are able to be read by init according to SEPolicy. Bug: 71814576 Test: vendor_init fails to use non-readable properties as a trigger Test: vendor_init successfully uses readable properties as a trigger Change-Id: Ic6d9919b6047f3076a1a19fc26295c6a77aca627
2018-10-23 22:25:05 +02:00
init.svc.console u:object_r:exported2_default_prop:s0 exact string
init.svc.dumpstatez u:object_r:exported2_default_prop:s0 exact string
init.svc.mediadrm u:object_r:exported2_default_prop:s0 exact string
init.svc.surfaceflinger u:object_r:exported2_default_prop:s0 exact string
Whitelist exported platform properties This CL lists all the exported platform properties in private/exported_property_contexts. Additionally accessing core_property_type from vendor components is restricted. Instead public_readable_property_type is used to allow vendor components to read exported platform properties, and accessibility from vendor_init is also specified explicitly. Note that whitelisting would be applied only if PRODUCT_COMPATIBLE_PROPERTY is set on. Bug: 38146102 Test: tested on walleye with PRODUCT_COMPATIBLE_PROPERTY=true Change-Id: I304ba428cc4ca82668fec2ddeb17c971e7ec065e
2017-10-19 09:54:49 +02:00
init.svc.tombstoned u:object_r:exported2_default_prop:s0 exact string
Combine vendor-init-actionable with vendor-init-readable Historically, vendor-init-actionable was created since the various property_contexts files were not yet available when init parses its scripts. Since then, the property_contexts files are now always available when init parses its scripts, so we can collapse these two categories. Specifically, this change ensures that all of the properties in the previous 'stable_properties.h' file in init, which contained the vendor-init-actionable properties, are able to be read by init according to SEPolicy. Bug: 71814576 Test: vendor_init fails to use non-readable properties as a trigger Test: vendor_init successfully uses readable properties as a trigger Change-Id: Ic6d9919b6047f3076a1a19fc26295c6a77aca627
2018-10-23 22:25:05 +02:00
init.svc.zygote u:object_r:exported2_default_prop:s0 exact string
Whitelist exported platform properties This CL lists all the exported platform properties in private/exported_property_contexts. Additionally accessing core_property_type from vendor components is restricted. Instead public_readable_property_type is used to allow vendor components to read exported platform properties, and accessibility from vendor_init is also specified explicitly. Note that whitelisting would be applied only if PRODUCT_COMPATIBLE_PROPERTY is set on. Bug: 38146102 Test: tested on walleye with PRODUCT_COMPATIBLE_PROPERTY=true Change-Id: I304ba428cc4ca82668fec2ddeb17c971e7ec065e
2017-10-19 09:54:49 +02:00
libc.debug.malloc.options u:object_r:exported2_default_prop:s0 exact string
libc.debug.malloc.program u:object_r:exported2_default_prop:s0 exact string
Allow read-only of new property for malloc hooks. Bug: 30561479 Test: Booted on walleye and verified that read denials of the property Test: do not generate warnings. Change-Id: I61a4a7d3a360a6d27d8986eb8f3f9662272233b1 (cherry picked from commit 2f35f5ca6cd08e7e9f86b6ea853f594f374819d5)
2018-02-12 23:47:04 +01:00
libc.debug.hooks.enable u:object_r:exported2_default_prop:s0 exact string
Make persist.sys.locale public-readable. Addresses this denial: avc: denied { read } for comm="rild" name="u:object_r:system_prop:s0" dev="tmpfs" ino=15811 scontext=u:r:rild:s0 tcontext=u:object_r:system_prop:s0 tclass=file permissive=0 Fixes: 77960261 Test: m selinux_policy Change-Id: I341675a4cfc0acbb7ea98e2ed4bdb7f69afe09f7
2018-10-07 22:24:09 +02:00
persist.sys.locale u:object_r:exported_system_prop:s0 exact string
Whitelist exported platform properties This CL lists all the exported platform properties in private/exported_property_contexts. Additionally accessing core_property_type from vendor components is restricted. Instead public_readable_property_type is used to allow vendor components to read exported platform properties, and accessibility from vendor_init is also specified explicitly. Note that whitelisting would be applied only if PRODUCT_COMPATIBLE_PROPERTY is set on. Bug: 38146102 Test: tested on walleye with PRODUCT_COMPATIBLE_PROPERTY=true Change-Id: I304ba428cc4ca82668fec2ddeb17c971e7ec065e
2017-10-19 09:54:49 +02:00
persist.sys.timezone u:object_r:exported_system_prop:s0 exact string
Add the testharness service to sepolicy rules The testharness service will manage Test Harness Mode and provide a command-line interface for users to enable Test Harness Mode; however it does not directly provide a public API. Bug: 80137798 Test: make Test: flash crosshatch Change-Id: Ie396e40fcea8914b4dd2247f2314e029b66ad84e
2019-01-15 22:39:30 +01:00
persist.sys.test_harness u:object_r:test_harness_prop:s0 exact bool
Allow only public-readable to ro.secure and ro.adb.secure Bug: 74866333 Test: succeeded building and tested with taimen Change-Id: Id19fec168ab266e386ea4c710a4c5cedfc4df33c Merged-In: Id19fec168ab266e386ea4c710a4c5cedfc4df33c (cherry picked from commit 62acbce4a2b7b95a58cbd3d7dddf94870405192b)
2018-03-16 00:10:37 +01:00
ro.adb.secure u:object_r:exported_secure_prop:s0 exact int
Whitelist exported platform properties This CL lists all the exported platform properties in private/exported_property_contexts. Additionally accessing core_property_type from vendor components is restricted. Instead public_readable_property_type is used to allow vendor components to read exported platform properties, and accessibility from vendor_init is also specified explicitly. Note that whitelisting would be applied only if PRODUCT_COMPATIBLE_PROPERTY is set on. Bug: 38146102 Test: tested on walleye with PRODUCT_COMPATIBLE_PROPERTY=true Change-Id: I304ba428cc4ca82668fec2ddeb17c971e7ec065e
2017-10-19 09:54:49 +02:00
ro.arch u:object_r:exported2_default_prop:s0 exact string
ro.audio.ignore_effects u:object_r:exported2_default_prop:s0 exact bool
ro.baseband u:object_r:exported2_default_prop:s0 exact string
ro.boot.avb_version u:object_r:exported2_default_prop:s0 exact string
ro.boot.baseband u:object_r:exported2_default_prop:s0 exact string
ro.boot.bootdevice u:object_r:exported2_default_prop:s0 exact string
ro.boot.bootloader u:object_r:exported2_default_prop:s0 exact string
ro.boot.boottime u:object_r:exported2_default_prop:s0 exact string
ro.boot.console u:object_r:exported2_default_prop:s0 exact string
ro.boot.hardware u:object_r:exported2_default_prop:s0 exact string
ro.boot.hardware.color u:object_r:exported2_default_prop:s0 exact string
ro.boot.hardware.sku u:object_r:exported2_default_prop:s0 exact string
ro.boot.keymaster u:object_r:exported2_default_prop:s0 exact string
ro.boot.mode u:object_r:exported2_default_prop:s0 exact string
ro.boot.vbmeta.avb_version u:object_r:exported2_default_prop:s0 exact string
ro.boot.verifiedbootstate u:object_r:exported2_default_prop:s0 exact string
ro.boot.veritymode u:object_r:exported2_default_prop:s0 exact string
Move ro.boot.dynamic_partitions to vendor VTS tests are run after flashing a GSI image on the device. The properties ro.boot.dynamic_partitions and ro.boot.dynamic_partitions_retrofit are currently placed in product partition and will be overwritten by the GSI image. We need to move these properties to vendor partition so that they will be available even after the device is flashed with GSI. Bug: 132197773 Test: build and flash, adb getprop ro.boot.dynamic_partitions Change-Id: Ib04896ef744d8d2daa5cb3feee2cbf45aae2ba51
2019-05-08 01:14:09 +02:00
ro.boot.dynamic_partitions u:object_r:exported_default_prop:s0 exact string
ro.boot.dynamic_partitions_retrofit u:object_r:exported_default_prop:s0 exact string
Whitelist exported platform properties This CL lists all the exported platform properties in private/exported_property_contexts. Additionally accessing core_property_type from vendor components is restricted. Instead public_readable_property_type is used to allow vendor components to read exported platform properties, and accessibility from vendor_init is also specified explicitly. Note that whitelisting would be applied only if PRODUCT_COMPATIBLE_PROPERTY is set on. Bug: 38146102 Test: tested on walleye with PRODUCT_COMPATIBLE_PROPERTY=true Change-Id: I304ba428cc4ca82668fec2ddeb17c971e7ec065e
2017-10-19 09:54:49 +02:00
ro.bootloader u:object_r:exported2_default_prop:s0 exact string
ro.build.date u:object_r:exported2_default_prop:s0 exact string
ro.build.date.utc u:object_r:exported2_default_prop:s0 exact int
ro.build.description u:object_r:exported2_default_prop:s0 exact string
ro.build.display.id u:object_r:exported2_default_prop:s0 exact string
Fix TODOs of duplicate property names for prefix and exact matching Duplicate property names are supported now for prefix and exact matching. Bug: 38146102 Test: tested on walleye with PRODUCT_COMPATIBLE_PROPERTY=true Change-Id: Ifd9d32eaece7370d69f121e88d5541f7a2e34458
2018-01-12 02:19:48 +01:00
ro.build.fingerprint u:object_r:exported_fingerprint_prop:s0 exact string
Whitelist exported platform properties This CL lists all the exported platform properties in private/exported_property_contexts. Additionally accessing core_property_type from vendor components is restricted. Instead public_readable_property_type is used to allow vendor components to read exported platform properties, and accessibility from vendor_init is also specified explicitly. Note that whitelisting would be applied only if PRODUCT_COMPATIBLE_PROPERTY is set on. Bug: 38146102 Test: tested on walleye with PRODUCT_COMPATIBLE_PROPERTY=true Change-Id: I304ba428cc4ca82668fec2ddeb17c971e7ec065e
2017-10-19 09:54:49 +02:00
ro.build.host u:object_r:exported2_default_prop:s0 exact string
ro.build.id u:object_r:exported2_default_prop:s0 exact string
ro.build.product u:object_r:exported2_default_prop:s0 exact string
ro.build.system_root_image u:object_r:exported2_default_prop:s0 exact bool
ro.build.tags u:object_r:exported2_default_prop:s0 exact string
ro.build.user u:object_r:exported2_default_prop:s0 exact string
ro.build.version.base_os u:object_r:exported2_default_prop:s0 exact string
ro.build.version.codename u:object_r:exported2_default_prop:s0 exact string
ro.build.version.incremental u:object_r:exported2_default_prop:s0 exact string
ro.build.version.preview_sdk u:object_r:exported2_default_prop:s0 exact int
ro.build.version.release u:object_r:exported2_default_prop:s0 exact string
Add ro.build.version.extensions. policy Public-readable int sysprops for the extension versions will be in this bucket, e.g. ro.build.version.extensions.r Bug: 137191822 Bug: 143937447 Test: boot and getprop ro.build.version.extensions.r Change-Id: I200165d8903221b2d5b824e4eea77ef933919b74
2019-12-10 17:53:20 +01:00
ro.build.version.extensions. u:object_r:module_sdkext_prop:s0 prefix int
Whitelist exported platform properties This CL lists all the exported platform properties in private/exported_property_contexts. Additionally accessing core_property_type from vendor components is restricted. Instead public_readable_property_type is used to allow vendor components to read exported platform properties, and accessibility from vendor_init is also specified explicitly. Note that whitelisting would be applied only if PRODUCT_COMPATIBLE_PROPERTY is set on. Bug: 38146102 Test: tested on walleye with PRODUCT_COMPATIBLE_PROPERTY=true Change-Id: I304ba428cc4ca82668fec2ddeb17c971e7ec065e
2017-10-19 09:54:49 +02:00
ro.build.version.sdk u:object_r:exported2_default_prop:s0 exact int
ro.build.version.security_patch u:object_r:exported2_default_prop:s0 exact string
ro.crypto.state u:object_r:exported_vold_prop:s0 exact string
ro.crypto.type u:object_r:exported_vold_prop:s0 exact string
ro.debuggable u:object_r:exported2_default_prop:s0 exact int
ro.hardware u:object_r:exported2_default_prop:s0 exact string
ro.product.brand u:object_r:exported2_default_prop:s0 exact string
ro.product.cpu.abi u:object_r:exported2_default_prop:s0 exact string
ro.product.cpu.abilist u:object_r:exported2_default_prop:s0 exact string
ro.product.device u:object_r:exported2_default_prop:s0 exact string
ro.product.manufacturer u:object_r:exported2_default_prop:s0 exact string
ro.product.model u:object_r:exported2_default_prop:s0 exact string
ro.product.name u:object_r:exported2_default_prop:s0 exact string
ro.property_service.version u:object_r:exported2_default_prop:s0 exact int
ro.revision u:object_r:exported2_default_prop:s0 exact string
Allow only public-readable to ro.secure and ro.adb.secure Bug: 74866333 Test: succeeded building and tested with taimen Change-Id: Id19fec168ab266e386ea4c710a4c5cedfc4df33c Merged-In: Id19fec168ab266e386ea4c710a4c5cedfc4df33c (cherry picked from commit 62acbce4a2b7b95a58cbd3d7dddf94870405192b)
2018-03-16 00:10:37 +01:00
ro.secure u:object_r:exported_secure_prop:s0 exact int
Whitelist exported platform properties This CL lists all the exported platform properties in private/exported_property_contexts. Additionally accessing core_property_type from vendor components is restricted. Instead public_readable_property_type is used to allow vendor components to read exported platform properties, and accessibility from vendor_init is also specified explicitly. Note that whitelisting would be applied only if PRODUCT_COMPATIBLE_PROPERTY is set on. Bug: 38146102 Test: tested on walleye with PRODUCT_COMPATIBLE_PROPERTY=true Change-Id: I304ba428cc4ca82668fec2ddeb17c971e7ec065e
2017-10-19 09:54:49 +02:00
service.bootanim.exit u:object_r:exported_system_prop:s0 exact int
sys.boot_from_charger_mode u:object_r:exported_system_prop:s0 exact int
Add selinux rules for userspace reboot related properties By default sys.init.userspace_reboot.* properties are internal to /system partition. Only exception is sys.init.userspace_reboot.in_progress which signals to all native services (including vendor ones) that userspace reboot is happening, hence it should be a system_public_prop. Only init should be allowed to set userspace reboot related properties. Bug: 135984674 Test: builds Test: adb reboot userspace Change-Id: Ibb04965be2d5bf6e81b34569aaaa1014ff61e0d3
2019-11-14 13:59:15 +01:00
sys.init.userspace_reboot.in_progress u:object_r:userspace_reboot_exported_prop:s0 exact bool
Add permissions for sys.use_memfd property Will be used to forcefully turn on memfd if device supports it. Currently used only for debugging. Change-Id: I46a1b7169677ea552d4b092e7501da587c42ba1a Signed-off-by: Joel Fernandes <joelaf@google.com>
2019-01-31 23:43:57 +01:00
sys.use_memfd u:object_r:use_memfd_prop:s0 exact bool
Whitelist exported platform properties This CL lists all the exported platform properties in private/exported_property_contexts. Additionally accessing core_property_type from vendor components is restricted. Instead public_readable_property_type is used to allow vendor components to read exported platform properties, and accessibility from vendor_init is also specified explicitly. Note that whitelisting would be applied only if PRODUCT_COMPATIBLE_PROPERTY is set on. Bug: 38146102 Test: tested on walleye with PRODUCT_COMPATIBLE_PROPERTY=true Change-Id: I304ba428cc4ca82668fec2ddeb17c971e7ec065e
2017-10-19 09:54:49 +02:00
vold.decrypt u:object_r:exported_vold_prop:s0 exact string
Property contexts for ro.sanitize.* Bug: 142430632 Test: adb shell getprop ro.sanitize.hwaddress in hwasan build Change-Id: I8e0fa0e6c865d18b94ffbdb6a0dddb1817adb364
2019-10-10 02:20:59 +02:00
# r/o sanitizer properties, public-readable
ro.sanitize.address u:object_r:exported2_default_prop:s0 exact bool
ro.sanitize.cfi u:object_r:exported2_default_prop:s0 exact bool
ro.sanitize.default-ub u:object_r:exported2_default_prop:s0 exact bool
ro.sanitize.fuzzer u:object_r:exported2_default_prop:s0 exact bool
ro.sanitize.hwaddress u:object_r:exported2_default_prop:s0 exact bool
ro.sanitize.integer_overflow u:object_r:exported2_default_prop:s0 exact bool
ro.sanitize.safe-stack u:object_r:exported2_default_prop:s0 exact bool
ro.sanitize.scudo u:object_r:exported2_default_prop:s0 exact bool
ro.sanitize.thread u:object_r:exported2_default_prop:s0 exact bool
ro.sanitize.undefined u:object_r:exported2_default_prop:s0 exact bool
Whitelist exported platform properties This CL lists all the exported platform properties in private/exported_property_contexts. Additionally accessing core_property_type from vendor components is restricted. Instead public_readable_property_type is used to allow vendor components to read exported platform properties, and accessibility from vendor_init is also specified explicitly. Note that whitelisting would be applied only if PRODUCT_COMPATIBLE_PROPERTY is set on. Bug: 38146102 Test: tested on walleye with PRODUCT_COMPATIBLE_PROPERTY=true Change-Id: I304ba428cc4ca82668fec2ddeb17c971e7ec065e
2017-10-19 09:54:49 +02:00
# vendor-init-settable|public-readable
aaudio.hw_burst_min_usec u:object_r:exported_default_prop:s0 exact int
aaudio.minimum_sleep_usec u:object_r:exported_default_prop:s0 exact int
aaudio.mixer_bursts u:object_r:exported_default_prop:s0 exact int
aaudio.mmap_exclusive_policy u:object_r:exported_default_prop:s0 exact int
aaudio.mmap_policy u:object_r:exported_default_prop:s0 exact int
aaudio.wakeup_delay_usec u:object_r:exported_default_prop:s0 exact int
gsm.sim.operator.numeric u:object_r:exported_radio_prop:s0 exact string
media.mediadrmservice.enable u:object_r:exported_default_prop:s0 exact bool
Allow public-readable to persist.rcs.supported For now, persist.rcs.supported has only vendor-init-settable, but it turned out that the property should be read by vendor components in some devices including 2018 Pixels. Bug: 74266614 Test: succeeded building and tested on a blueline device with PRODUCT_COMPATIBLE_PROPERTY_OVERRIDE=true Change-Id: I926eb4316c178a39693300fe983176acfb9cabec
2018-03-08 16:34:48 +01:00
persist.rcs.supported u:object_r:exported_default_prop:s0 exact int
Add rcs.publish.status to the whitelist Bug: 72154054 Test: tested with walleye Change-Id: I35271c6044946c4ec639409c914d54247cfb9f79
2018-01-18 23:30:48 +01:00
rcs.publish.status u:object_r:exported_radio_prop:s0 exact string
Add new cpu variant related rules to SELinux I added ro.bionic.(2nd_)?_(arch|cpu_variant) to vendor system properties. And have init to write them to files under dev/. This change set SELinux rules for these properties and files. For the system properties: vendor/default.prop will set them. init will read them. For the files /dev/cpu_variant:.*: init will write them. bionic libc will read them. (Basically world readable). This is to allow libc select the right optimized routine at runtime. Like memcpy / strcmp etc. Test: getprop to make sure the properties are set. Test: ls -laZ to make sure /dev/cpu_variant:.* are correctly labeled. Change-Id: I41662493dce30eae6d41bf0985709045c44247d3
2018-11-06 00:03:16 +01:00
ro.bionic.2nd_arch u:object_r:cpu_variant_prop:s0 exact string
ro.bionic.2nd_cpu_variant u:object_r:cpu_variant_prop:s0 exact string
ro.bionic.arch u:object_r:cpu_variant_prop:s0 exact string
ro.bionic.cpu_variant u:object_r:cpu_variant_prop:s0 exact string
Whitelist exported platform properties This CL lists all the exported platform properties in private/exported_property_contexts. Additionally accessing core_property_type from vendor components is restricted. Instead public_readable_property_type is used to allow vendor components to read exported platform properties, and accessibility from vendor_init is also specified explicitly. Note that whitelisting would be applied only if PRODUCT_COMPATIBLE_PROPERTY is set on. Bug: 38146102 Test: tested on walleye with PRODUCT_COMPATIBLE_PROPERTY=true Change-Id: I304ba428cc4ca82668fec2ddeb17c971e7ec065e
2017-10-19 09:54:49 +02:00
ro.board.platform u:object_r:exported_default_prop:s0 exact string
ro.boot.fake_battery u:object_r:exported_default_prop:s0 exact int
ro.boot.hardware.revision u:object_r:exported_default_prop:s0 exact string
Add context for ro.boot.product.hardware.sku. This was defined, but it had no users in the Android tree. Because of this, ODM manifests required extra sepolicy to be applied in vendor. Before this, there was no policy split, so that was okay, but now it is impossible. Bug: 91735839 Test: add an odm manifest for SE conditional on a system property (ro.boot.product.hardware.sku) and make sure it is read into the manifest (using the vintf tool) and also that a client can get the $ lshal | grep secure Y android.hardware.secure_element@1.0::ISecureElement/SIM1 0/2 881 2262 567 Change-Id: I94a2928943be6a17416b8bbd78106809c0c21198
2018-06-02 01:09:11 +02:00
ro.boot.product.hardware.sku u:object_r:exported_default_prop:s0 exact string
Whitelist exported platform properties This CL lists all the exported platform properties in private/exported_property_contexts. Additionally accessing core_property_type from vendor components is restricted. Instead public_readable_property_type is used to allow vendor components to read exported platform properties, and accessibility from vendor_init is also specified explicitly. Note that whitelisting would be applied only if PRODUCT_COMPATIBLE_PROPERTY is set on. Bug: 38146102 Test: tested on walleye with PRODUCT_COMPATIBLE_PROPERTY=true Change-Id: I304ba428cc4ca82668fec2ddeb17c971e7ec065e
2017-10-19 09:54:49 +02:00
ro.boot.slot_suffix u:object_r:exported_default_prop:s0 exact string
Make new vendor properties settable by vendor_init These properties were moved to /vendor as part of b/130025216. Allow them to be set by vendor_init, too. Bug: 130025216 Bug: 131066061 Test: no SELinux warnings for said props at boot Change-Id: I5293831bedb89e9c8d3ddf13cf7babde26872f28
2019-04-29 16:30:43 +02:00
ro.bootimage.build.date u:object_r:exported_default_prop:s0 exact string
ro.bootimage.build.date.utc u:object_r:exported_default_prop:s0 exact int
ro.bootimage.build.fingerprint u:object_r:exported_default_prop:s0 exact string
Make ro.boringcrypto.hwrand public readable, vendor init settable. https://boringssl-review.googlesource.com/c/boringssl/+/38024 will introduce a feature allowing vendors finer grained control over BoringSSL's random source by setting a system property. The property needs to be settable from vendor init and readable by all processes on the device. As BoringSSL will be in a mainline module, we need to provide a non-source code way of allowing vendor customisations. Bug: 142129238 Test: Observe property is settable from /vendor/default.prop and readable by non-root, non-vendor processes. Change-Id: I4c20349f1b2ab2f51ac11ec552b99b1e15b14dd8
2019-10-08 12:46:35 +02:00
ro.boringcrypto.hwrand u:object_r:exported_default_prop:s0 exact bool
Move ro.build.ab_update to vendor property. `ro.build.ab_update` is being moved from /system/build.prop to /vendor/build.prop. This CL allows init to keep exposing the value as a system property. init: Do not have permissions to set 'ro.build.ab_update' to 'true' in property file '/vendor/build.prop': SELinux permission check failed Bug: 130516531 Test: Build and flash crosshatch-userdebug. Check /system/build.prop, /vendor/build.prop and the runtime property. Change-Id: I56803030a6bc0603f977ebc5fedbfc224a69d19e
2019-04-19 18:54:15 +02:00
ro.build.ab_update u:object_r:exported_default_prop:s0 exact string
Make new vendor properties settable by vendor_init These properties were moved to /vendor as part of b/130025216. Allow them to be set by vendor_init, too. Bug: 130025216 Bug: 131066061 Test: no SELinux warnings for said props at boot Change-Id: I5293831bedb89e9c8d3ddf13cf7babde26872f28
2019-04-29 16:30:43 +02:00
ro.build.expect.baseband u:object_r:exported_default_prop:s0 exact string
ro.build.expect.bootloader u:object_r:exported_default_prop:s0 exact string
Whitelist exported platform properties This CL lists all the exported platform properties in private/exported_property_contexts. Additionally accessing core_property_type from vendor components is restricted. Instead public_readable_property_type is used to allow vendor components to read exported platform properties, and accessibility from vendor_init is also specified explicitly. Note that whitelisting would be applied only if PRODUCT_COMPATIBLE_PROPERTY is set on. Bug: 38146102 Test: tested on walleye with PRODUCT_COMPATIBLE_PROPERTY=true Change-Id: I304ba428cc4ca82668fec2ddeb17c971e7ec065e
2017-10-19 09:54:49 +02:00
ro.carrier u:object_r:exported_default_prop:s0 exact string
Allow vendor-init-settable and public-readable to ro.config.low_ram ro.config.low_ram should be set on Android Go devices by SoC vendors, and the value can be read by vendor components. Bug: 76132948 Bug: 75987246 Test: succeeded building and tested with taimen Change-Id: I6ac98fa58cf641da4565d6277898fc5e5e6ceca1
2018-03-23 01:06:34 +01:00
ro.config.low_ram u:object_r:exported_config_prop:s0 exact bool
Whitelist exported platform properties This CL lists all the exported platform properties in private/exported_property_contexts. Additionally accessing core_property_type from vendor components is restricted. Instead public_readable_property_type is used to allow vendor components to read exported platform properties, and accessibility from vendor_init is also specified explicitly. Note that whitelisting would be applied only if PRODUCT_COMPATIBLE_PROPERTY is set on. Bug: 38146102 Test: tested on walleye with PRODUCT_COMPATIBLE_PROPERTY=true Change-Id: I304ba428cc4ca82668fec2ddeb17c971e7ec065e
2017-10-19 09:54:49 +02:00
ro.config.vc_call_vol_steps u:object_r:exported_config_prop:s0 exact int
ro.frp.pst u:object_r:exported_default_prop:s0 exact string
ro.hardware.activity_recognition u:object_r:exported_default_prop:s0 exact string
ro.hardware.audio u:object_r:exported_default_prop:s0 exact string
ro.hardware.audio.a2dp u:object_r:exported_default_prop:s0 exact string
Add ro.hardware.audio.hearing_aid Bug: 69623109 Change-Id: I7d194a3489fc5ff278cef7bebe9bfe6c39d3b2b8 (cherry-picked from 4a40c592404bdc2032067f4a3fac2f33b9246aa0)
2018-03-12 20:06:15 +01:00
ro.hardware.audio.hearing_aid u:object_r:exported_default_prop:s0 exact string
Whitelist exported platform properties This CL lists all the exported platform properties in private/exported_property_contexts. Additionally accessing core_property_type from vendor components is restricted. Instead public_readable_property_type is used to allow vendor components to read exported platform properties, and accessibility from vendor_init is also specified explicitly. Note that whitelisting would be applied only if PRODUCT_COMPATIBLE_PROPERTY is set on. Bug: 38146102 Test: tested on walleye with PRODUCT_COMPATIBLE_PROPERTY=true Change-Id: I304ba428cc4ca82668fec2ddeb17c971e7ec065e
2017-10-19 09:54:49 +02:00
ro.hardware.audio.primary u:object_r:exported_default_prop:s0 exact string
ro.hardware.audio.usb u:object_r:exported_default_prop:s0 exact string
ro.hardware.audio_policy u:object_r:exported_default_prop:s0 exact string
ro.hardware.bootctrl u:object_r:exported_default_prop:s0 exact string
ro.hardware.camera u:object_r:exported_default_prop:s0 exact string
ro.hardware.consumerir u:object_r:exported_default_prop:s0 exact string
ro.hardware.context_hub u:object_r:exported_default_prop:s0 exact string
ro.hardware.egl u:object_r:exported_default_prop:s0 exact string
ro.hardware.fingerprint u:object_r:exported_default_prop:s0 exact string
ro.hardware.flp u:object_r:exported_default_prop:s0 exact string
ro.hardware.gatekeeper u:object_r:exported_default_prop:s0 exact string
ro.hardware.gps u:object_r:exported_default_prop:s0 exact string
ro.hardware.gralloc u:object_r:exported_default_prop:s0 exact string
ro.hardware.hdmi_cec u:object_r:exported_default_prop:s0 exact string
ro.hardware.hwcomposer u:object_r:exported_default_prop:s0 exact string
ro.hardware.input u:object_r:exported_default_prop:s0 exact string
ro.hardware.keystore u:object_r:exported_default_prop:s0 exact string
Add ro.hardware.keystore_desede This allows Android Keystore to statically register support for 3DES during zygote initialization based on the device's support for hardware backed 3DES keys. Bug: b/79986680 Test: keystore CTS Change-Id: Ic9a6653cdd623a3ab10e0efbcdb37c437e6c59b9
2018-04-20 11:30:41 +02:00
ro.hardware.keystore_desede u:object_r:exported_default_prop:s0 exact string
Whitelist exported platform properties This CL lists all the exported platform properties in private/exported_property_contexts. Additionally accessing core_property_type from vendor components is restricted. Instead public_readable_property_type is used to allow vendor components to read exported platform properties, and accessibility from vendor_init is also specified explicitly. Note that whitelisting would be applied only if PRODUCT_COMPATIBLE_PROPERTY is set on. Bug: 38146102 Test: tested on walleye with PRODUCT_COMPATIBLE_PROPERTY=true Change-Id: I304ba428cc4ca82668fec2ddeb17c971e7ec065e
2017-10-19 09:54:49 +02:00
ro.hardware.lights u:object_r:exported_default_prop:s0 exact string
ro.hardware.local_time u:object_r:exported_default_prop:s0 exact string
ro.hardware.memtrack u:object_r:exported_default_prop:s0 exact string
ro.hardware.nfc u:object_r:exported_default_prop:s0 exact string
ro.hardware.nfc_nci u:object_r:exported_default_prop:s0 exact string
ro.hardware.nfc_tag u:object_r:exported_default_prop:s0 exact string
ro.hardware.nvram u:object_r:exported_default_prop:s0 exact string
ro.hardware.power u:object_r:exported_default_prop:s0 exact string
ro.hardware.radio u:object_r:exported_default_prop:s0 exact string
ro.hardware.sensors u:object_r:exported_default_prop:s0 exact string
ro.hardware.sound_trigger u:object_r:exported_default_prop:s0 exact string
ro.hardware.thermal u:object_r:exported_default_prop:s0 exact string
ro.hardware.tv_input u:object_r:exported_default_prop:s0 exact string
ro.hardware.type u:object_r:exported_default_prop:s0 exact string
ro.hardware.vehicle u:object_r:exported_default_prop:s0 exact string
ro.hardware.vibrator u:object_r:exported_default_prop:s0 exact string
ro.hardware.virtual_device u:object_r:exported_default_prop:s0 exact string
ro.hardware.vulkan u:object_r:exported_default_prop:s0 exact string
Add a property used to enable Vulkan as default render pipeline Test: Booted with Vulkan rendering Change-Id: I00485c16e5a878321a699f35d28fb85834991255
2018-12-17 17:30:48 +01:00
ro.hwui.use_vulkan u:object_r:exported_default_prop:s0 exact bool
Fix type of ro.kernel.qemu: int -> bool Bug: N/A Test: boot Change-Id: I67e3554383977c3fb5e89f236838a9cb39fb257e
2018-06-20 22:28:05 +02:00
ro.kernel.qemu u:object_r:exported_default_prop:s0 exact bool
emulator: Whitelist ro.kernel.qemu. parameters And ro.kernel.android.bootanim (used to en/disable boot-anim) Bug: 79941736 Test: Manual Change-Id: Ib486903dec92df88b4d33bad6262cbcfc2aa1c4c
2018-05-25 21:20:11 +02:00
ro.kernel.qemu. u:object_r:exported_default_prop:s0
ro.kernel.android.bootanim u:object_r:exported_default_prop:s0 exact int
Mark some odm properties as vendor-init-settable Bug: 64195575 Test: boot a device Change-Id: I7f7deb5e2c5c6e0a75cf22eb610a7973b5be0d7e Merged-In: I7f7deb5e2c5c6e0a75cf22eb610a7973b5be0d7e (cherry picked from commit a47a1c25af8d9646754b1af334da7478d1faa3f1)
2018-03-15 09:13:24 +01:00
ro.odm.build.date u:object_r:exported_default_prop:s0 exact string
ro.odm.build.date.utc u:object_r:exported_default_prop:s0 exact int
ro.odm.build.fingerprint u:object_r:exported_default_prop:s0 exact string
Set odm and vendor build.version.incremental to be publicly readable VTS and CTS-on-GSI report the device's ro.odm.build.version.incremental or ro.vendor.build.version.incremental. The properties need to be readable without root privilege. Test: adb shell getprop ro.odm.build.version.incremental Bug: 145255132 Change-Id: Ibb71185888cce022cb3a9be3e6fb2199d5f438d9
2019-11-28 07:37:47 +01:00
ro.odm.build.version.incremental u:object_r:exported_default_prop:s0 exact string
Add ro.oem.key1 to SELinux policy. vendor-init-settable|public-readable Change-Id: I8262cc03150931080c0982350cd990ee8f5422bc Fixes: 78636965 Test: adb shell getprop ro.oem.key1
2018-05-02 01:33:28 +02:00
ro.oem.key1 u:object_r:exported_default_prop:s0 exact string
Whitelist exported platform properties This CL lists all the exported platform properties in private/exported_property_contexts. Additionally accessing core_property_type from vendor components is restricted. Instead public_readable_property_type is used to allow vendor components to read exported platform properties, and accessibility from vendor_init is also specified explicitly. Note that whitelisting would be applied only if PRODUCT_COMPATIBLE_PROPERTY is set on. Bug: 38146102 Test: tested on walleye with PRODUCT_COMPATIBLE_PROPERTY=true Change-Id: I304ba428cc4ca82668fec2ddeb17c971e7ec065e
2017-10-19 09:54:49 +02:00
ro.product.board u:object_r:exported_default_prop:s0 exact string
ro.product.cpu.abilist32 u:object_r:exported_default_prop:s0 exact string
ro.product.cpu.abilist64 u:object_r:exported_default_prop:s0 exact string
ro.product.first_api_level u:object_r:exported_default_prop:s0 exact int
Mark some odm properties as vendor-init-settable Bug: 64195575 Test: boot a device Change-Id: I7f7deb5e2c5c6e0a75cf22eb610a7973b5be0d7e Merged-In: I7f7deb5e2c5c6e0a75cf22eb610a7973b5be0d7e (cherry picked from commit a47a1c25af8d9646754b1af334da7478d1faa3f1)
2018-03-15 09:13:24 +01:00
ro.product.odm.brand u:object_r:exported_default_prop:s0 exact string
ro.product.odm.device u:object_r:exported_default_prop:s0 exact string
ro.product.odm.manufacturer u:object_r:exported_default_prop:s0 exact string
ro.product.odm.model u:object_r:exported_default_prop:s0 exact string
ro.product.odm.name u:object_r:exported_default_prop:s0 exact string
Whitelist exported platform properties This CL lists all the exported platform properties in private/exported_property_contexts. Additionally accessing core_property_type from vendor components is restricted. Instead public_readable_property_type is used to allow vendor components to read exported platform properties, and accessibility from vendor_init is also specified explicitly. Note that whitelisting would be applied only if PRODUCT_COMPATIBLE_PROPERTY is set on. Bug: 38146102 Test: tested on walleye with PRODUCT_COMPATIBLE_PROPERTY=true Change-Id: I304ba428cc4ca82668fec2ddeb17c971e7ec065e
2017-10-19 09:54:49 +02:00
ro.product.vendor.brand u:object_r:exported_default_prop:s0 exact string
ro.product.vendor.device u:object_r:exported_default_prop:s0 exact string
ro.product.vendor.manufacturer u:object_r:exported_default_prop:s0 exact string
ro.product.vendor.model u:object_r:exported_default_prop:s0 exact string
ro.product.vendor.name u:object_r:exported_default_prop:s0 exact string
Changed IWLAN operation mode system properties to enum Changed the system properties to enum. The valid modes are "default", "legacy", and "AP-assisted". Test: Manual Bug: 126218288 Change-Id: Ib70ed8606e845ca29453013a400b377647e15490
2019-03-12 02:02:47 +01:00
ro.telephony.iwlan_operation_mode u:object_r:exported_radio_prop:s0 exact enum default legacy AP-assisted
Whitelist exported platform properties This CL lists all the exported platform properties in private/exported_property_contexts. Additionally accessing core_property_type from vendor components is restricted. Instead public_readable_property_type is used to allow vendor components to read exported platform properties, and accessibility from vendor_init is also specified explicitly. Note that whitelisting would be applied only if PRODUCT_COMPATIBLE_PROPERTY is set on. Bug: 38146102 Test: tested on walleye with PRODUCT_COMPATIBLE_PROPERTY=true Change-Id: I304ba428cc4ca82668fec2ddeb17c971e7ec065e
2017-10-19 09:54:49 +02:00
ro.vendor.build.date u:object_r:exported_default_prop:s0 exact string
ro.vendor.build.date.utc u:object_r:exported_default_prop:s0 exact int
ro.vendor.build.fingerprint u:object_r:exported_default_prop:s0 exact string
Set odm and vendor build.version.incremental to be publicly readable VTS and CTS-on-GSI report the device's ro.odm.build.version.incremental or ro.vendor.build.version.incremental. The properties need to be readable without root privilege. Test: adb shell getprop ro.odm.build.version.incremental Bug: 145255132 Change-Id: Ibb71185888cce022cb3a9be3e6fb2199d5f438d9
2019-11-28 07:37:47 +01:00
ro.vendor.build.version.incremental u:object_r:exported_default_prop:s0 exact string
Add ro.vndk.lite to property_contexts Bug: 78605339 Test: aosp_walleye-userdebug builds Change-Id: I37c84e20f2284d50cbe29bfa1b7597dd2c01fb4b
2018-05-14 08:46:47 +02:00
ro.vndk.lite u:object_r:exported_default_prop:s0 exact bool
Whitelist exported platform properties This CL lists all the exported platform properties in private/exported_property_contexts. Additionally accessing core_property_type from vendor components is restricted. Instead public_readable_property_type is used to allow vendor components to read exported platform properties, and accessibility from vendor_init is also specified explicitly. Note that whitelisting would be applied only if PRODUCT_COMPATIBLE_PROPERTY is set on. Bug: 38146102 Test: tested on walleye with PRODUCT_COMPATIBLE_PROPERTY=true Change-Id: I304ba428cc4ca82668fec2ddeb17c971e7ec065e
2017-10-19 09:54:49 +02:00
ro.vndk.version u:object_r:exported_default_prop:s0 exact string
ro.vts.coverage u:object_r:exported_default_prop:s0 exact int
wifi: Add a new property to indicate active wifi iface Denial: libc : Unable to set property "wifi.active_interface" to "wlan0": error code: 0x18 Bug: 129506593 Test: Verified that the denial is no longer seen in the logs Change-Id: Ia345f5df1446e7ba3a44d6e8299bdc1f5f6ad9c8
2019-04-02 18:37:50 +02:00
wifi.active.interface u:object_r:exported_wifi_prop:s0 exact string
Add sepolicy labeling of wifi.concurrent.interface property. 1. "Add sepolicy labeling of wifi.concurrent.interface" in property_contexts. wlan1 interface is added first in Pie OS. And wlan1 interface has getIfaceName by property_get in wifi_chip.cpp. (/hardware/interface/wifi/1.2/default/wifi_chip.cpp) But, there is no sepolicy about this interface. wlan0 and p2p0 is definitely specified. So, if we try to use wlan1, native sepolicy violation occurs. This is why this labeling is necessary. 2. wlan1: Property labeling same with wlan0 or p2p0. wifi.interface u:object_r:exported_default_prop:s0 exact string Test: Basic Sanity - Verified tethering by using wlan1 Bug: 117302656 Change-Id: I24194bca7176e1927164228e6571870531a9bc56 Signed-off-by: Jinhee Jo <jinhee0207.jo@lge.com>
2018-10-05 10:25:20 +02:00
wifi.concurrent.interface u:object_r:exported_default_prop:s0 exact string
Whitelist exported platform properties This CL lists all the exported platform properties in private/exported_property_contexts. Additionally accessing core_property_type from vendor components is restricted. Instead public_readable_property_type is used to allow vendor components to read exported platform properties, and accessibility from vendor_init is also specified explicitly. Note that whitelisting would be applied only if PRODUCT_COMPATIBLE_PROPERTY is set on. Bug: 38146102 Test: tested on walleye with PRODUCT_COMPATIBLE_PROPERTY=true Change-Id: I304ba428cc4ca82668fec2ddeb17c971e7ec065e
2017-10-19 09:54:49 +02:00
wifi.direct.interface u:object_r:exported_default_prop:s0 exact string
wifi.interface u:object_r:exported_default_prop:s0 exact string
Add a new system-to-vendor sysprop ro.apex.updatable The system property is for system to be able to identify vendor implementation that is ready to support updatable APEXes. When this sysprop is set to true, the init creates separate mount namespaces for processes launched before apexd. When unset, default is false. Bug: 122428178 Test: device boots to the UI Test: atest android.appsecurity.cts.ExternalStorageHostTest Change-Id: I4ae1eac5eec5f5085d8d32ff58300dfa9967c29a
2019-01-11 08:10:32 +01:00
ro.apex.updatable u:object_r:exported_default_prop:s0 exact bool
Revert "Add userspace_reboot_config_prop property type" This reverts commit 8b570f0c6074115e96355573808b4d0f54319722. Reason for revert: b/146792618 multiple build breaks Change-Id: Ieab05ce56826d2fc84d46940935705abd2e1a55f
2019-12-23 20:01:13 +01:00
ro.init.userspace_reboot.is_supported u:object_r:userspace_reboot_prop:s0 exact bool
Whitelist exported platform properties This CL lists all the exported platform properties in private/exported_property_contexts. Additionally accessing core_property_type from vendor components is restricted. Instead public_readable_property_type is used to allow vendor components to read exported platform properties, and accessibility from vendor_init is also specified explicitly. Note that whitelisting would be applied only if PRODUCT_COMPATIBLE_PROPERTY is set on. Bug: 38146102 Test: tested on walleye with PRODUCT_COMPATIBLE_PROPERTY=true Change-Id: I304ba428cc4ca82668fec2ddeb17c971e7ec065e
2017-10-19 09:54:49 +02:00
Combine vendor-init-actionable with vendor-init-readable Historically, vendor-init-actionable was created since the various property_contexts files were not yet available when init parses its scripts. Since then, the property_contexts files are now always available when init parses its scripts, so we can collapse these two categories. Specifically, this change ensures that all of the properties in the previous 'stable_properties.h' file in init, which contained the vendor-init-actionable properties, are able to be read by init according to SEPolicy. Bug: 71814576 Test: vendor_init fails to use non-readable properties as a trigger Test: vendor_init successfully uses readable properties as a trigger Change-Id: Ic6d9919b6047f3076a1a19fc26295c6a77aca627
2018-10-23 22:25:05 +02:00
# public-readable
Whitelist exported platform properties This CL lists all the exported platform properties in private/exported_property_contexts. Additionally accessing core_property_type from vendor components is restricted. Instead public_readable_property_type is used to allow vendor components to read exported platform properties, and accessibility from vendor_init is also specified explicitly. Note that whitelisting would be applied only if PRODUCT_COMPATIBLE_PROPERTY is set on. Bug: 38146102 Test: tested on walleye with PRODUCT_COMPATIBLE_PROPERTY=true Change-Id: I304ba428cc4ca82668fec2ddeb17c971e7ec065e
2017-10-19 09:54:49 +02:00
ro.boot.revision u:object_r:exported2_default_prop:s0 exact string
ro.bootmode u:object_r:exported2_default_prop:s0 exact string
ro.build.type u:object_r:exported2_default_prop:s0 exact string
sys.shutdown.requested u:object_r:exported_system_prop:s0 exact string
Add ro.surface_flinger.* to property_contexts The ro.surface_flinger.* properties are added to property_contexts. Because these properties are located in vendor partition, but surfaceflinger service which use these properties is in the system partition. Bug: 112386364 Test: m -j & boot test Change-Id: I98d71d4c03297a2a3fe92ba17bfdcb428f763753
2019-01-14 08:04:00 +01:00
# Using Sysprop as API. So the ro.surface_flinger.* are guaranteed to be API-stable
Fix surface flinger property types Third parameter of a property_context entry should be "exact" if the entry is for a single property, not a prefix. And the type of each entry should be the fourth parameter. Bug: 112386364 Test: m -j Change-Id: I2ed31c9fd7c7424e3a6a51d44b4e85413ae316b7
2019-03-12 20:21:37 +01:00
ro.surface_flinger.default_composition_dataspace u:object_r:exported_default_prop:s0 exact int
ro.surface_flinger.default_composition_pixel_format u:object_r:exported_default_prop:s0 exact int
ro.surface_flinger.force_hwc_copy_for_virtual_displays u:object_r:exported_default_prop:s0 exact bool
ro.surface_flinger.has_HDR_display u:object_r:exported_default_prop:s0 exact bool
ro.surface_flinger.has_wide_color_display u:object_r:exported_default_prop:s0 exact bool
ro.surface_flinger.max_frame_buffer_acquired_buffers u:object_r:exported_default_prop:s0 exact int
ro.surface_flinger.max_virtual_display_dimension u:object_r:exported_default_prop:s0 exact int
ro.surface_flinger.primary_display_orientation u:object_r:exported_default_prop:s0 exact string
ro.surface_flinger.present_time_offset_from_vsync_ns u:object_r:exported_default_prop:s0 exact int
ro.surface_flinger.running_without_sync_framework u:object_r:exported_default_prop:s0 exact bool
ro.surface_flinger.start_graphics_allocator_service u:object_r:exported_default_prop:s0 exact bool
ro.surface_flinger.use_color_management u:object_r:exported_default_prop:s0 exact bool
ro.surface_flinger.use_context_priority u:object_r:exported_default_prop:s0 exact bool
ro.surface_flinger.use_vr_flinger u:object_r:exported_default_prop:s0 exact bool
ro.surface_flinger.vsync_event_phase_offset_ns u:object_r:exported_default_prop:s0 exact int
ro.surface_flinger.vsync_sf_event_phase_offset_ns u:object_r:exported_default_prop:s0 exact int
ro.surface_flinger.wcg_composition_dataspace u:object_r:exported_default_prop:s0 exact int
ro.surface_flinger.wcg_composition_pixel_format u:object_r:exported_default_prop:s0 exact int
ro.surface_flinger.display_primary_red u:object_r:exported_default_prop:s0 exact string
ro.surface_flinger.display_primary_green u:object_r:exported_default_prop:s0 exact string
ro.surface_flinger.display_primary_blue u:object_r:exported_default_prop:s0 exact string
ro.surface_flinger.display_primary_white u:object_r:exported_default_prop:s0 exact string
[sepolicy] Add sysprop for SurfaceFlinger GPU protected contents. Not every device can support GPU protected contents, add a sysprop to allow configuration. BUG: 35315015 Test: N/A Change-Id: I59f1b3ea81db742bc4d0b5a22e82de7385a726b7
2019-03-29 22:10:50 +01:00
ro.surface_flinger.protected_contents u:object_r:exported_default_prop:s0 exact bool
Add new surfaceflinger ro props add the new ro properties added to surfaceflinger: ro.surface_flinger.set_idle_timer_ms ro.surface_flinger.use_smart_90_for_video Bug: 131054357 Test: Boot with SELinux enforcing Change-Id: I887b318a95db200280344a11fcf7deaadafdeca9
2019-04-23 23:17:32 +02:00
ro.surface_flinger.set_idle_timer_ms u:object_r:exported_default_prop:s0 exact int
Add ro.surface_flinger.set_touch_timer_ms to sepolicy Test: set ro.surface_flinger.set_touch_timer_ms from init Bug: 131906818 Change-Id: If489ae4ac993984305f764fb172014f42c41df67
2019-05-16 21:51:10 +02:00
ro.surface_flinger.set_touch_timer_ms u:object_r:exported_default_prop:s0 exact int
Add ro.surface_flinger.set_display_power_timer_ms to sepolicy Bug: 135550670 Test: Boot with SELinux enforcing Change-Id: I61c30abc39909a263a2c402a5c0eb1de570748bb
2019-07-12 21:43:25 +02:00
ro.surface_flinger.set_display_power_timer_ms u:object_r:exported_default_prop:s0 exact int
Add support_kernel_idle_timer to sepolicy Bug: 130684082 Test: boots Change-Id: I7ee84a5ff1024162037634d6f5efe7b09557e18a
2019-05-16 22:29:43 +02:00
ro.surface_flinger.support_kernel_idle_timer u:object_r:exported_default_prop:s0 exact bool
Add new surfaceflinger ro props add the new ro properties added to surfaceflinger: ro.surface_flinger.set_idle_timer_ms ro.surface_flinger.use_smart_90_for_video Bug: 131054357 Test: Boot with SELinux enforcing Change-Id: I887b318a95db200280344a11fcf7deaadafdeca9
2019-04-23 23:17:32 +02:00
ro.surface_flinger.use_smart_90_for_video u:object_r:exported_default_prop:s0 exact bool
SF: enable device-specific dataspace for color space agnostic surfaces To reduce the DPU loading in color conversion, we enable device-specific dataspace for color space agnostic surfaces. Since the type of surfaces usually provide gray-level surfaces to users, it can be acceptable to ignore the color conversion on them. Bug: 134783740 Bug: 135140940 Test: Check ScreenDecorOverlays in expected dataspace Test: Play HDR video on C2 and check dataspace Change-Id: Ief32f0ff3867b2e154fecd6c9ebd6610b0e6ed11
2019-06-28 14:16:51 +02:00
ro.surface_flinger.color_space_agnostic_dataspace u:object_r:exported_default_prop:s0 exact int
Allow access to the "refresh_rate_switching" system property Bug: 136592946 Bug: 138261472 Test: Ran with the patch applied, confirmed surface flinger can access the system property. Change-Id: I259a488399c5e698de384322852ea81ea1a96e7d Merged-In: I259a488399c5e698de384322852ea81ea1a96e7d Exempt-From-Owner-Approval: Approved internally
2019-08-29 02:03:21 +02:00
ro.surface_flinger.refresh_rate_switching u:object_r:exported_default_prop:s0 exact bool
Reference in a new issue Copy permalink