tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
platform_system_sepolicy/private/service.te

27 lines
2 KiB
Text
Raw Normal View History

SELinux policy changes for AmbientContext system API. Context about this is on ag/16302285 Test: Ensure no build failures, ensure no SecurityException on boot Bug: 192476579 Change-Id: If5ba2fa41975acf91c0002a0f301da11eaebd6d2
2021-12-16 20:06:17 +01:00
type ambient_context_service, app_api_service, system_server_service, service_manager_type;
Add selinux setting for attention Bug: 126472144 Test: adb shell dumpsys attention Change-Id: Ie421b719c8fc0414ee664055aa5d007c081edf17
2019-03-12 02:40:44 +01:00
type attention_service, system_server_service, service_manager_type;
Add sepolicy for background_install_control service The background_install_control service is going to detect background installed apps and provide the list of such apps. Bug: 244216300 Test: manual Change-Id: I6500f29ee063da4a3bc18e109260de419dd39218
2022-10-20 19:53:46 +02:00
type bg_install_control_service, system_server_service, service_manager_type;
Initial sepolicy for composd Add what we need to allow composd to run and expose an AIDL service. Also delete the policy for compsvc; we never access it in the host now, and the real policy is in microdroid. Retain the compos_exec type, since it is referenced in the APEX sepolicy. Bug: 186126194 Test: adb shell cmd -w android.system.composd; no denials. Change-Id: I5f06b2b01852cdebd2d67009b363ec08b17ce33a
2021-09-09 18:08:15 +02:00
type compos_service, service_manager_type;
Add sepolicy for background_install_control service The background_install_control service is going to detect background installed apps and provide the list of such apps. Bug: 244216300 Test: manual Change-Id: I6500f29ee063da4a3bc18e109260de419dd39218
2022-10-20 19:53:46 +02:00
type communal_service, app_api_service, system_server_service, service_manager_type;
Rename dynamic_android to dynamic_system Per API review, dynamic_android should be renamed to dynamic_system. Bug: 126613281 Test: run DynamicSystemInstallationService via adb Change-Id: Ia908cdd0c21b3a82f59b30e03a985dc260530230
2019-03-14 05:35:32 +01:00
type dynamic_system_service, system_api_service, system_server_service, service_manager_type;
SE Linux perimissions for Feature Flags Service Bug: 279054964 Test: build && flash (cherry picked from https://googleplex-android-review.googlesource.com/q/commit:a1f8ca3cd3c4861a06c5042148aab6623a563651) Merged-In: I5fffaccba61e218496ac82ccf9ba308cf9892868 Change-Id: I5fffaccba61e218496ac82ccf9ba308cf9892868
2023-06-26 15:42:45 +02:00
type feature_flags_service, app_api_service, system_server_service, service_manager_type;
Add incidentcompanion service. It is a side channel for dumpstate and incidentd to communicate status and get user authorization to share bugreports by calling system_server. Test: atest PermissionControllerTest / atest GooglePermissionControllerTest Change-Id: I995a43a25f375e5c97dba1deb92ebe893ca8585d
2018-12-08 02:20:14 +01:00
type gsi_service, service_manager_type;
Allow untrusted apps to access incidentcompanion Bug: 206548410 Test: m -j Change-Id: I93b9e983149ab5b303bc34e3de094c1481c35dc9
2021-12-07 21:20:11 +01:00
type incidentcompanion_service, app_api_service, system_api_service, system_server_service, service_manager_type;
Add sepolicy for logd and logcat services The logd binder service is on logd side. The logcat binder service is on system_server side. These two binder services facilitate the binder RPC between logd and system_server. Bug: 197901557 Test: manual Change-Id: I5f08bbb44a88dc72302331ab11c7d54f94db16ac
2022-01-12 00:16:12 +01:00
type logcat_service, system_server_service, service_manager_type;
type logd_service, service_manager_type;
SE policy for tuner service. Test: make; acloud; tuner sample input Change-Id: I651632ec7f4ba79d94738c11c343f63510e59aa6
2020-09-12 02:50:45 +02:00
type mediatuner_service, app_api_service, service_manager_type;
Add sepolicy for profcollectd This does not yet list all the required capabilities for profcollectd, but it at least allows the service to start under permissive mode. Bug: 79161490 Test: start profcollectd Change-Id: I92c6192fa9b31840b2aba26f83a6dc9f9e835030
2020-06-18 06:43:23 +02:00
type profcollectd_service, service_manager_type;
Add a new selinux policy for the resolver service Bug: 178151184 Test: manual Change-Id: Ia44c50d24b3b5403b02ccc1b7873c7024b10e023
2021-01-22 01:55:42 +01:00
type resolver_service, system_server_service, service_manager_type;
Add SELinux policy changes for rkpd This is a part of changes to bring up Remote Key Provisioning Daemon module. See packages/modules/RemoteKeyProvisioning for more info. Change-Id: Iae4e98176491637acb03e2e09b9d8dbc269be616 Test: atest rkpd_client_test
2022-08-31 02:08:16 +02:00
type rkpd_registrar_service, service_manager_type;
type rkpd_refresh_service, service_manager_type;
Mark safety_center_service as app_api_service in SELinux Policy. This is to make the SafetyCenterManager usable in CTS tests. Test: SafetyCenterManager CTS test in ag/16284943 Bug: 203098016 Change-Id: I28a42da32f1f7f93c45294c7e984e6d1fd2cdd8d
2021-11-20 01:14:50 +01:00
type safety_center_service, app_api_service, system_api_service, system_server_service, service_manager_type;
Add incidentcompanion service. It is a side channel for dumpstate and incidentd to communicate status and get user authorization to share bugreports by calling system_server. Test: atest PermissionControllerTest / atest GooglePermissionControllerTest Change-Id: I995a43a25f375e5c97dba1deb92ebe893ca8585d
2018-12-08 02:20:14 +01:00
type stats_service, service_manager_type;
Sepolicy for StatsBootstrapAtomService This is the selinux changes required to create StatsBootstrapAtomService, a lightweight proxy service in system server to allow processes in the bootstrap namespace to log atoms to statsd. Test: statsbootstrap is successfully published Bug: 204889815 Change-Id: I5e44f7a65b98b8eebd8da6d35ae6094ce5e177f2
2021-11-09 08:28:21 +01:00
type statsbootstrap_service, system_server_service, service_manager_type;
Add incidentcompanion service. It is a side channel for dumpstate and incidentd to communicate status and get user authorization to share bugreports by calling system_server. Test: atest PermissionControllerTest / atest GooglePermissionControllerTest Change-Id: I995a43a25f375e5c97dba1deb92ebe893ca8585d
2018-12-08 02:20:14 +01:00
type statscompanion_service, system_server_service, service_manager_type;
system_server: create StatsManagerService Refactor to split the logic within statscompanion_service The goal of the refactor is to simplify the binder calls to statsd This service will talk to statsd. At the end of the refactor, this service should be the only service that talks to statsd. Bug: 146074223 Test: Manual by creating the service with empty implementation Change-Id: Ib9c2e10ec195d41062f1001e5a82b374696de939
2019-12-12 19:17:58 +01:00
type statsmanager_service, system_api_service, system_server_service, service_manager_type;
Configure sepolicy for TracingServiceProxy Configures sepolicy to allow for the new TracingServiceProxy system services, and to allow Perfetto to access the service. Bug: 175591887 Test: Validated the service started successfullyy, and invoked via CLI Change-Id: Idb6438948a9d96063f8455544b97ef66267cde23
2020-12-11 23:51:32 +01:00
type tracingproxy_service, system_server_service, service_manager_type;
Add selinux policy for new BinaryTransparencyService Bug: 197684182 Test: Manually verified that BinaryTransparencyService is correctly started and running. Change-Id: I4eaf5698dd2edb428205afcd57c22502d56d2ec2
2022-01-19 22:44:25 +01:00
type transparency_service, system_server_service, service_manager_type;
Add permission for VFIO device binding vfio_handler will bind platform devices to VFIO driver, and then return a file descriptor containing DTBO. This change adds permissions needed for that. Bug: 278008182 Test: adb shell /apex/com.android.virt/bin/vm run-microdroid \ --devices /sys/bus/platform/devices/16d00000.eh --protected Change-Id: Ie947adff00d138426d4703cbb8e7a8cd429c2272
2023-08-01 04:00:49 +02:00
type vfio_handler_service, service_manager_type;
Add uce service to core policy. This service is requested by AOSP framework, but there is no context for it defined. Bug: 136023468 Test: N/A Change-Id: Ibc5b048aaa1c9eda7b9180caca92cb876c3f6b28 Merged-In: Ibc5b048aaa1c9eda7b9180caca92cb876c3f6b28 (cherry picked from commit 67cb30fabf50e3ce2f08e9edd4e14214c11571a4)
2019-08-01 23:05:05 +02:00
type uce_service, service_manager_type;
SELinux policy changes for Wearable Sensing APIs. API changes are in ag/20407841. Please note we're still going through security reviews here: b/249996246 and will incorporate feedback as we go through the process. These selinux policies will enable the WearableSensingService to run and unblock upstream development work. Test: Ensure no build failures, ensure no SecurityException on boot Bug: 249135378, 244181656 Ignore-AOSP-First: to prevent new feature leak. Change-Id: I597827766cc3ed68ae65fb177f518eaf874f1eda
2022-11-15 01:16:41 +01:00
type wearable_sensing_service, system_api_service, system_server_service, service_manager_type;
Reference in a new issue Copy permalink