tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
platform_system_sepolicy/vendor/file_contexts

109 lines
11 KiB
Text
Raw Normal View History

Move hals to vendor partition. Bug: 34135607 Test: hals work Merged-In: I6a1f87438bb5b540fce900e9ec5df07d3f4f6bd4 Change-Id: I6a1f87438bb5b540fce900e9ec5df07d3f4f6bd4
2017-02-13 18:09:56 +01:00
#############################
# Default HALs
#
Add atrace HAL 1.0 sepolicy Bug: 111098596 Test: atrace/systrace Change-Id: I06ca76750d640c98849c475c8a237d62c8e582b9
2018-09-20 01:06:28 +02:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.atrace@1\.0-service u:object_r:hal_atrace_default_exec:s0
Rename audio hal service The audio HAL service name previously contained the audio HAL version of the first audio HAL it supported. Nevertheless, the same service can and do host all audio HAL versions. Aka there is only one audio HAL service, and the version in its name is technical dept and should not be changed. This caused many confusions during vendor HAL upgrade as the service version number was erroneously updated leading to device boot loop. The new service name is: android.hardware.audio.service The old one was: android.hardware.audio@2.0-service Keeping both names valid as most phones will not rename the service immediately. Bug: 78516186 Test: boot & check the audio HAL is up with the old and new name Change-Id: I2ce0182fd919af6eb8325d49682b4374be00344e Signed-off-by: Kevin Rocard <krocard@google.com>
2019-07-04 01:31:20 +02:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.audio(@2\.0-|\.)service u:object_r:hal_audio_default_exec:s0
Add android.hardware.audio@7.0-service.example service This service will demonstrate a minimal audio HAL V7.0 Bug: 142480271 Test: atest VtsHalAudioV7_0TargetTest (HAL and test are not available in AOSP yet) Change-Id: I2e7f166a47f21eb6c8621d0ddb33cfea84aa20da
2020-09-25 01:35:34 +02:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.audio@7\.0-service\.example u:object_r:hal_audio_default_exec:s0
Adding support for AIDL AudioControl HAL Bug: 170335834 Test: built and ran without sepolicy issues Change-Id: Ia25b82aaf676fd2bd37e60bc0d2960f398fa3c90
2020-10-23 22:30:14 +02:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.automotive\.audiocontrol@1\.0-service u:object_r:hal_audiocontrol_default_exec:s0
/(vendor|system/vendor)/bin/hw/android\.hardware\.automotive\.audiocontrol@2\.0-service u:object_r:hal_audiocontrol_default_exec:s0
/(vendor|system/vendor)/bin/hw/android\.hardware\.automotive\.audiocontrol-service.example u:object_r:hal_audiocontrol_default_exec:s0
SEPolicy rules for CAN bus HAL Bug: 135918744 Test: VTS (separate new change) Change-Id: Idd3ca882e3bd36b95a5412bdfbf6fe9d6e911ba9
2019-07-24 02:38:51 +02:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.automotive\.can@1\.0-service u:object_r:hal_can_socketcan_exec:s0
Update sepolicy for EVS v1.x Modify vendor file context and hal_evs_server policy to enable EVS v1.1 service. Change-Id: I1e717b3209200300005c3fa7f91423589505a41c Signed-off-by: Changyeon Jo <changyeon@google.com>
2019-07-29 18:07:42 +02:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.automotive\.evs@1\.[0-9]-service u:object_r:hal_evs_default_exec:s0
Vehicle HAL: allow communication with CAN bus HAL and alternative service naming Bug: 143779011 Test: implemented a VHAL service prototype that communicates with VHAL Change-Id: I8f449510fc638e29a5cb23c0e32f3d87386ba9bc
2019-11-01 22:21:03 +01:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.automotive\.vehicle@2\.0-(service|protocan-service) u:object_r:hal_vehicle_default_exec:s0
Fix File Context Entry for Bluetooth Services. Test: Boot on HiKey960 and check dmesg errors. Change-Id: I9ac0968753c7cd9a23c63eac98b20a7778277716 Signed-off-by: Harpreet \"Eli\" Sangha <eliptus@google.com>
2019-11-26 08:49:47 +01:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.bluetooth@1\.[0-9]+-service u:object_r:hal_bluetooth_default_exec:s0
/(vendor|system/vendor)/bin/hw/android\.hardware\.bluetooth@1\.[0-9]+-service\.btlinux u:object_r:hal_bluetooth_btlinux_exec:s0
Add sepolicy for biometrics.face@1.[0-9] Bug: 151331855 Bug: 145027036 Test: build and run on cuttlefish Change-Id: Iae0f157d3a670b506d6cc82686318544db41d559
2020-03-23 22:04:58 +01:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.biometrics\.face@1\.[0-9]+-service\.example u:object_r:hal_face_default_exec:s0
Add sepolicy for IFace Bug: 168730443 Test: run on cuttlefish Change-Id: Ie3cf791e7aac090788c7213d23487ae9f50b0690
2020-09-25 20:38:42 +02:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.biometrics\.face-service\.example u:object_r:hal_face_default_exec:s0
Add sepolicy for IFingerprint Bug: 152416783 Test: run on cuttlefish Change-Id: I58d7c3bc9c81612b03bab3b9da938c091c02e3c1
2020-09-02 22:32:05 +02:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.biometrics\.fingerprint@2\.1-service u:object_r:hal_fingerprint_default_exec:s0
Add SEPolicy for fingerprint2.2 example HAL Bug: 172957689 Test: atest CtsBiometricsTestCases Change-Id: I0de92a880e4ca04765da3e3184e5ad0382dc958a
2020-12-03 03:45:34 +01:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.biometrics\.fingerprint@2\.2-service\.example u:object_r:hal_fingerprint_default_exec:s0
Restrict the policy for IFingerprint to example only Bug: 152416783 Test: run on cuttlefish Change-Id: I3df58ca37c4d7f183690ab4f6917515f9a3eb5be
2020-09-25 19:55:45 +02:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.biometrics\.fingerprint-service\.example u:object_r:hal_fingerprint_default_exec:s0
Add sepolicy for IBootControl 1.1 and the default HAL. Bug: 138861550 Test: manual test Change-Id: Ibc9a55266a2726cb8dc8550be0264db30b66109e
2019-08-30 22:55:50 +02:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.boot@1\.[0-9]+-service u:object_r:hal_bootctl_default_exec:s0
Add broadcast radio HAL 2.0 default implementation to the sepolicy. Test: VTS Bug: 69958777 Change-Id: I6db7dd9afc9c7f254a0233ff3144b02e48727038
2017-12-07 18:48:16 +01:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.broadcastradio@\d+\.\d+-service u:object_r:hal_broadcastradio_default_exec:s0
Camera HAL: Allow minor version changes to camera.provider Test: Adding a camera.provider@2.5 to a device works correctly Change-Id: I516698afedad1294c0af3f4efedb0aed0a141780
2018-12-13 00:31:56 +01:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.camera\.provider@2\.[0-9]+-service_64 u:object_r:hal_camera_default_exec:s0
/(vendor|system/vendor)/bin/hw/android\.hardware\.camera\.provider@2\.[0-9]+-service u:object_r:hal_camera_default_exec:s0
/(vendor|system/vendor)/bin/hw/android\.hardware\.camera\.provider@2\.[0-9]+-service-lazy_64 u:object_r:hal_camera_default_exec:s0
/(vendor|system/vendor)/bin/hw/android\.hardware\.camera\.provider@2\.[0-9]+-service-lazy u:object_r:hal_camera_default_exec:s0
/(vendor|system/vendor)/bin/hw/android\.hardware\.camera\.provider@2\.[0-9]+-external-service u:object_r:hal_camera_default_exec:s0
configstore: assign label to all minor versions of configstore service Added rule: /(vendor|system/vendor)/bin/hw/android\.hardware\.configstore@1\.[0-9]-service u:object_r:hal_configstore_default_exec:s0 Bug: 37727469 Test: Built and tested on Sailfish Change-Id: Icf167fad1c7e601c3662f527d1e3e844ff517b58
2017-05-02 07:54:19 +02:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.configstore@1\.[0-9]+-service u:object_r:hal_configstore_default_exec:s0
Added default policy for Confirmation UI HAL Bug: 63928580 Test: Manually tested. Change-Id: If6bb10cb7c009883d853e46dcdeb92cd33877d53
2018-01-09 23:42:53 +01:00
/(vendor|sustem/vendor)/bin/hw/android\.hardware\.confirmationui@1\.0-service u:object_r:hal_confirmationui_default_exec:s0
Update file_contexts for contexthub HAL 1.1 Bug: 135951924 Test: Verify this lets contexthub HAL 1.1 run on a device that supports it Change-Id: I049e77d476ac0d090e48895a19a454b764aac74c
2020-02-15 02:09:10 +01:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.contexthub@1\.[0-9]+-service u:object_r:hal_contexthub_default_exec:s0
Label /vendor/bin/hw on devices without vendor partition SELinux labeling of filesystem files ignores symlinks. Unfortunately, /vendor is a symlink on devices without vendor partition (e.g., hikey). Thus, policy in directories which are used both for devices with vendor partition and for devices without vendor partition must be adjusted to match both /vendor and /system/vendor. It is assumed that the /vendor symlink, if it exists at all, always points to /system/vendor. The alternative solution of adjusting vendor policy file labelling rules at vendor policy build time, when the actual on-device paths are known, was considered to make it harder to see how files are labelled by looking solely at the source tree. Test: Files under /vendor/bin/hw correctly labelled on sailfish, angler, and a device which uses the /vendor symlink. Bug: 35431549 Change-Id: If6ccb2c9cb85b0589db03ab86de8071e15d5366f
2017-02-16 21:59:44 +01:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.drm@1\.0-service u:object_r:hal_drm_default_exec:s0
Allow lazy drm services to run Change-Id: I13f7bb0d04b5388180683edd6d5dc75555ada644
2018-12-07 19:28:27 +01:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.drm@1\.0-service-lazy u:object_r:hal_drm_default_exec:s0
Update sepolicy to support cas@1.2 Test: Manual bug: 141783130 Change-Id: I973cb5d59d74c495eea18f4865baf0bd6f55e2fb
2019-10-15 02:37:17 +02:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.cas@1\.[0-2]-service u:object_r:hal_cas_default_exec:s0
/(vendor|system/vendor)/bin/hw/android\.hardware\.cas@1\.[0-2]-service-lazy u:object_r:hal_cas_default_exec:s0
Add android.hardware.dumpstate@1.1-service.example to file_contexts Bug: 152067221 Test: VtsHalDumpstateV1_1TargetTest Signed-off-by: Roman Kiryanov <rkir@google.com> Change-Id: I448e1e4bd94c16f0f8cbd07a7d8390c0201056fa
2020-03-23 19:24:38 +01:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.dumpstate@1\.[0-1]-service\.example u:object_r:hal_dumpstate_default_exec:s0
Label /vendor/bin/hw on devices without vendor partition SELinux labeling of filesystem files ignores symlinks. Unfortunately, /vendor is a symlink on devices without vendor partition (e.g., hikey). Thus, policy in directories which are used both for devices with vendor partition and for devices without vendor partition must be adjusted to match both /vendor and /system/vendor. It is assumed that the /vendor symlink, if it exists at all, always points to /system/vendor. The alternative solution of adjusting vendor policy file labelling rules at vendor policy build time, when the actual on-device paths are known, was considered to make it harder to see how files are labelled by looking solely at the source tree. Test: Files under /vendor/bin/hw correctly labelled on sailfish, angler, and a device which uses the /vendor symlink. Bug: 35431549 Change-Id: If6ccb2c9cb85b0589db03ab86de8071e15d5366f
2017-02-16 21:59:44 +01:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.gatekeeper@1\.0-service u:object_r:hal_gatekeeper_default_exec:s0
Add GNSS AIDL interfaces (system/sepolicy) Bug: 159467682 Test: built and run on cuttlefish Change-Id: I071e8427ea0251139661aa8123376c56e0839390
2020-09-15 20:35:29 +02:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.gnss-service.example u:object_r:hal_gnss_default_exec:s0
Add sepolicy for GNSS HAL 2.0 and 1.1 Bug: 112260995 Bug: 120277977 Test: atest VtsHalGnssV2_0TargetTest Change-Id: I196d8506b2f7c2153e1f647ea5ba61b81bf3d881
2018-12-12 21:15:41 +01:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.gnss@[0-9]\.[0-9]-service u:object_r:hal_gnss_default_exec:s0
Label /vendor/bin/hw on devices without vendor partition SELinux labeling of filesystem files ignores symlinks. Unfortunately, /vendor is a symlink on devices without vendor partition (e.g., hikey). Thus, policy in directories which are used both for devices with vendor partition and for devices without vendor partition must be adjusted to match both /vendor and /system/vendor. It is assumed that the /vendor symlink, if it exists at all, always points to /system/vendor. The alternative solution of adjusting vendor policy file labelling rules at vendor policy build time, when the actual on-device paths are known, was considered to make it harder to see how files are labelled by looking solely at the source tree. Test: Files under /vendor/bin/hw correctly labelled on sailfish, angler, and a device which uses the /vendor symlink. Bug: 35431549 Change-Id: If6ccb2c9cb85b0589db03ab86de8071e15d5366f
2017-02-16 21:59:44 +01:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.graphics\.allocator@2\.0-service u:object_r:hal_graphics_allocator_default_exec:s0
gralloc3: add sepolicy for allocator/mapper 3.0 IAllocator and IMappaer are being rev'd to 3.0. Update sepolicy to allow them to be used. Test: compile with allocator/mapper patches add boot the device Bug: 120493579 Change-Id: Id241c6bd79c02ec93d8dd415539f90a18f733d03
2019-01-06 00:22:41 +01:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.graphics\.allocator@3\.0-service u:object_r:hal_graphics_allocator_default_exec:s0
gralloc: add IAllocator/IMapper 4.0 sepolicy Add support for gralloc 4.0 to sepolicy Bug: 136016160 Test: Compiles and boots Change-Id: I148cc19176275e8cbd19cc95aa95d4d450353b7a
2019-06-20 23:10:59 +02:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.graphics\.allocator@4\.0-service u:object_r:hal_graphics_allocator_default_exec:s0
[SEPolicy] Add composer 2.3 Use regular expression for all composer service versions. BUG: 115554640 Test: Build, flash and boot Change-Id: Ie84ebb0a43c9eaad66829b15deaa8b3046bd7fe4
2018-12-21 15:42:33 +01:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.graphics\.composer@[0-9]\.[0-9]-service u:object_r:hal_graphics_composer_default_exec:s0
Label /vendor/bin/hw on devices without vendor partition SELinux labeling of filesystem files ignores symlinks. Unfortunately, /vendor is a symlink on devices without vendor partition (e.g., hikey). Thus, policy in directories which are used both for devices with vendor partition and for devices without vendor partition must be adjusted to match both /vendor and /system/vendor. It is assumed that the /vendor symlink, if it exists at all, always points to /system/vendor. The alternative solution of adjusting vendor policy file labelling rules at vendor policy build time, when the actual on-device paths are known, was considered to make it harder to see how files are labelled by looking solely at the source tree. Test: Files under /vendor/bin/hw correctly labelled on sailfish, angler, and a device which uses the /vendor symlink. Bug: 35431549 Change-Id: If6ccb2c9cb85b0589db03ab86de8071e15d5366f
2017-02-16 21:59:44 +01:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.health@1\.0-service u:object_r:hal_health_default_exec:s0
selinux changes for android.hardware.health@2.0 health@2.0 is a service used by BatteryService in framework. Test: health hal works Change-Id: I6cccf3ab085686fd67b0e048aaf201e64ec311c4
2017-06-02 22:59:39 +02:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.health@2\.0-service u:object_r:hal_health_default_exec:s0
Add health 2.1 HAL Test: VTS health 2.1 HAL test Bug: 137670450 Change-Id: Iedc6972154c6e948eaf22b4650da39a9e73cb6f8
2019-10-07 23:24:41 +02:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.health@2\.1-service u:object_r:hal_health_default_exec:s0
health.filesystem HAL renamed to health.storage ...to reflect that the HAL operates on storage devices, not filesystem. Bug: 111655771 Test: compiles Change-Id: Ibb0572cb1878359e5944aa6711331f0c7993ba6e
2018-09-19 19:24:45 +02:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.health\.storage@1\.0-service u:object_r:hal_health_storage_default_exec:s0
Add SELinux policy for credstore and update for IC HAL port from HIDL to AIDL. The credstore service is a system service which backs the android.security.identity.* Framework APIs. It essentially calls into the Identity Credential HAL while providing persistent storage for credentials. Bug: 111446262 Test: atest android.security.identity.cts Test: VtsHalIdentityTargetTest Test: android.hardware.identity-support-lib-test Change-Id: I5cd9a6ae810e764326355c0842e88c490f214c60
2020-01-17 22:47:53 +01:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.identity-service.example u:object_r:hal_identity_default_exec:s0
Permissions for InputClassifier HAL Add the required permissions for the InputClassifier HAL. Bug: 62940136 Test: no selinux denials in logcat when HAL is used inside input flinger. Change-Id: Ibc9b115a83719421d56ecb4bca2fd196ec71fd76
2018-01-17 21:27:06 +01:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.input\.classifier@1\.0-service u:object_r:hal_input_classifier_default_exec:s0
Label /vendor/bin/hw on devices without vendor partition SELinux labeling of filesystem files ignores symlinks. Unfortunately, /vendor is a symlink on devices without vendor partition (e.g., hikey). Thus, policy in directories which are used both for devices with vendor partition and for devices without vendor partition must be adjusted to match both /vendor and /system/vendor. It is assumed that the /vendor symlink, if it exists at all, always points to /system/vendor. The alternative solution of adjusting vendor policy file labelling rules at vendor policy build time, when the actual on-device paths are known, was considered to make it harder to see how files are labelled by looking solely at the source tree. Test: Files under /vendor/bin/hw correctly labelled on sailfish, angler, and a device which uses the /vendor symlink. Bug: 35431549 Change-Id: If6ccb2c9cb85b0589db03ab86de8071e15d5366f
2017-02-16 21:59:44 +01:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.ir@1\.0-service u:object_r:hal_ir_default_exec:s0
/(vendor|system/vendor)/bin/hw/android\.hardware\.keymaster@3\.0-service u:object_r:hal_keymaster_default_exec:s0
Add file context for keymaster 4.0 service. Test: Boot the device Change-Id: Ia468941e78803edebe311c73f424a41ac1faeaee
2018-01-03 18:55:13 +01:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.keymaster@4\.0-service u:object_r:hal_keymaster_default_exec:s0
Add Keymaster 4.1 Bug: 140193672 Bug: 140192237 Bug: 140824829 Test: Manual boot test Change-Id: Iccc8cc5e8fc7c9301478faa50d0e18fa917283fb
2019-11-13 01:50:44 +01:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.keymaster@4\.1-service u:object_r:hal_keymaster_default_exec:s0
Revert^2 "Move keymint to android.hardware.security." 16d61d038340c129b5d206ac3d41f1bdf3313b8a Bug: 175345910 Bug: 171429297 Exempt-From-Owner-Approval: re-landing topic with no changes in this CL. Change-Id: I1352c6b46b007dba3448b3c9cbdf454d7862a176
2020-12-11 14:05:27 +01:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.security\.keymint-service u:object_r:hal_keymint_default_exec:s0
Label /vendor/bin/hw on devices without vendor partition SELinux labeling of filesystem files ignores symlinks. Unfortunately, /vendor is a symlink on devices without vendor partition (e.g., hikey). Thus, policy in directories which are used both for devices with vendor partition and for devices without vendor partition must be adjusted to match both /vendor and /system/vendor. It is assumed that the /vendor symlink, if it exists at all, always points to /system/vendor. The alternative solution of adjusting vendor policy file labelling rules at vendor policy build time, when the actual on-device paths are known, was considered to make it harder to see how files are labelled by looking solely at the source tree. Test: Files under /vendor/bin/hw correctly labelled on sailfish, angler, and a device which uses the /vendor symlink. Bug: 35431549 Change-Id: If6ccb2c9cb85b0589db03ab86de8071e15d5366f
2017-02-16 21:59:44 +01:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.light@2\.0-service u:object_r:hal_light_default_exec:s0
Allow lazy HAL to run Test: Manual Change-Id: Ic4c3fd5b2d8d709573f8cc6332a6340d28d3ba26
2019-01-17 00:37:39 +01:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.light@2\.0-service-lazy u:object_r:hal_light_default_exec:s0
Label android.hardware.lights-service.example as hal_light_default_exec Bug: 152544844 Test: ls -Z /vendor/bin/hw/android.hardware.lights-service.example Signed-off-by: Roman Kiryanov <rkir@google.com> Change-Id: I32a6a443c57986b37fdcca788bfe01bf0cdd3e07
2020-03-26 22:30:51 +01:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.lights-service\.example u:object_r:hal_light_default_exec:s0
lowpan: Added support for LoWPAN Service and android.hardware.lowpan Bug: b/64090883 Bug: b/33073713 Test: Manual Change-Id: I7aa23c31b1fccae56c1a0e0bd4cfe370aeb911dd
2017-04-21 23:25:53 +02:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.lowpan@1\.0-service u:object_r:hal_lowpan_default_exec:s0
Label /vendor/bin/hw on devices without vendor partition SELinux labeling of filesystem files ignores symlinks. Unfortunately, /vendor is a symlink on devices without vendor partition (e.g., hikey). Thus, policy in directories which are used both for devices with vendor partition and for devices without vendor partition must be adjusted to match both /vendor and /system/vendor. It is assumed that the /vendor symlink, if it exists at all, always points to /system/vendor. The alternative solution of adjusting vendor policy file labelling rules at vendor policy build time, when the actual on-device paths are known, was considered to make it harder to see how files are labelled by looking solely at the source tree. Test: Files under /vendor/bin/hw correctly labelled on sailfish, angler, and a device which uses the /vendor symlink. Bug: 35431549 Change-Id: If6ccb2c9cb85b0589db03ab86de8071e15d5366f
2017-02-16 21:59:44 +01:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.memtrack@1\.0-service u:object_r:hal_memtrack_default_exec:s0
/(vendor|system/vendor)/bin/hw/android\.hardware\.nfc@1\.0-service u:object_r:hal_nfc_default_exec:s0
Add sepolicy for NFC 1.1 HAL service Bug: 72746517 Test: Boot a device and check NFC 1.1 service loads Change-Id: Ia281af8add0371525971f076bf513c694e7ea912
2018-01-31 20:10:23 +01:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.nfc@1\.1-service u:object_r:hal_nfc_default_exec:s0
Add sepolicy for nfc hal v1.2 Bug: 130509605 Test: No avc denial log and NFC works with hal v1.2 Change-Id: If54884f76a32705d11f2085f66fe83b9e0354f79
2019-04-22 13:52:55 +02:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.nfc@1\.2-service u:object_r:hal_nfc_default_exec:s0
Move mediacodec to vendor partition. Test: Camera, Photos, YouTube and Play Movies apps. Bug: 35328855 Change-Id: I3643b668817a7336f7ccda781734920fbbcc2c63
2017-02-28 05:35:43 +01:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.media\.omx@1\.0-service u:object_r:mediacodec_exec:s0
Label /vendor/bin/hw on devices without vendor partition SELinux labeling of filesystem files ignores symlinks. Unfortunately, /vendor is a symlink on devices without vendor partition (e.g., hikey). Thus, policy in directories which are used both for devices with vendor partition and for devices without vendor partition must be adjusted to match both /vendor and /system/vendor. It is assumed that the /vendor symlink, if it exists at all, always points to /system/vendor. The alternative solution of adjusting vendor policy file labelling rules at vendor policy build time, when the actual on-device paths are known, was considered to make it harder to see how files are labelled by looking solely at the source tree. Test: Files under /vendor/bin/hw correctly labelled on sailfish, angler, and a device which uses the /vendor symlink. Bug: 35431549 Change-Id: If6ccb2c9cb85b0589db03ab86de8071e15d5366f
2017-02-16 21:59:44 +01:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.power@1\.0-service u:object_r:hal_power_default_exec:s0
Create Power Stats AIDL interface Bug: 162472196 Test: m Merged-In: I948ef2959b25d776d3b01985fea5eb695fd4fc1e Change-Id: I12dc33ce055c7275559cce33142cfb2aacc5471f
2020-08-03 23:31:43 +02:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.power-service\.example u:object_r:hal_power_default_exec:s0
Rename PowerStats HAL service Bug: 169864180 Test: m Merged-In: I79ddf26acf398e80c6ff4a96c26b04aef73feac3 Change-Id: Ic458514285f819f44e50e2bee26a08fc6cf54261
2020-10-06 00:48:37 +02:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.power.stats-service\.example u:object_r:hal_power_stats_default_exec:s0
Add power.stats HAL 1.0 sepolicy BUG: 117424656 BUG: 111185513 Test: run vts -m VtsHalPowerStatsV1_0Target Change-Id: Icb0790219df4189c0dabbe41221e69e56d000755
2018-10-19 22:19:36 +02:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.power\.stats@1\.0-service u:object_r:hal_power_stats_default_exec:s0
Add sepolicy for radio.config Bug: 64131518 Test: Compile and flash the device, check whether service vendor.radio-config-hal-1-0 starts Change-Id: Id728658b4acdda87748259b74e6b7438f6283ea5
2018-01-24 00:05:57 +01:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.radio\.config@1\.0-service u:object_r:hal_radio_config_default_exec:s0
Add sepolicy for radio sap 1.2 Bug: 74114758 Test: Checked radio-service and sap-service is on the lshal after running the service Change-Id: I1b18711286e000a7d17664e7d3a2045aeeb8c285
2018-03-29 22:59:00 +02:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.radio@1\.2-radio-service u:object_r:hal_radio_default_exec:s0
/(vendor|system/vendor)/bin/hw/android\.hardware\.radio@1\.2-sap-service u:object_r:hal_radio_default_exec:s0
Add rebootescrow default HAL rules Bug: 63928581 Test: build and check HAL label Change-Id: I057b26eb20c5a6b022c7f391a6c8535f2953051c
2020-01-15 22:14:35 +01:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.rebootescrow-service\.default u:object_r:hal_rebootescrow_default_exec:s0
Add sensors multihal support in file_contexts regex Bug: 144722764 Test: N/A Change-Id: Ic595d9c21639bdf2874dc6734344ff1a41767399
2019-11-19 00:14:54 +01:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.sensors@[0-9]\.[0-9]-service(\.multihal)? u:object_r:hal_sensors_default_exec:s0
SE Policy for Secure Element app and Secure Element HAL Test: App startup on boot Change-Id: I7740aafc088aadf676328e3f1bb8db5175d97102
2018-01-04 19:33:20 +01:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.secure_element@1\.0-service u:object_r:hal_secure_element_default_exec:s0
Move rild to vendor partition. Test: Basic telephony sanity Bug: 35672432 Change-Id: I7d17cc7efda9902013c21d508cefc77baccc06a8
2017-02-24 00:18:44 +01:00
/(vendor|system/vendor)/bin/hw/rild u:object_r:rild_exec:s0
thermal: sepolicy for thermalservice and Thermal HAL revision 1.1 Add sepolicy for thermalserviced daemon, IThermalService binder service, IThermalCallback hwservice, and Thermal HAL revision 1.1. Test: manual: marlin with modified thermal-engine.conf Bug: 30982366 Change-Id: I207fa0f922a4e658338af91dea28c497781e8fe9 (cherry picked from commit ec3b6b7e25f709fcc9c177beebafae885d641f6d)
2017-06-09 20:27:08 +02:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.thermal@1\.[01]-service u:object_r:hal_thermal_default_exec:s0
Add sepolicy for tv.cec Bug: 36562029 Test: m -j40 and CEC functionality works well Change-Id: I5a693e65abdd5139a848d939149a475056cc41e8
2017-04-05 04:20:48 +02:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.tv\.cec@1\.0-service u:object_r:hal_tv_cec_default_exec:s0
Add sepolicy for tv.input Test: build, flash; adb shell lshal Bug: 36562029 Change-Id: If8f6d8dbd99d31e6627fa4b7c1fd4faea3b75cf2
2017-03-30 00:03:59 +02:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.tv\.input@1\.0-service u:object_r:hal_tv_input_default_exec:s0
Add Tuner HAL 1.1 service into the default tuner domain Test: cuttlefish, atest VtsHalTvTunerV1_1TargetTest Bug: b/159058358 Change-Id: I67fbfb29c3097953e6d30d17a8d40d586162088f
2020-07-16 03:25:11 +02:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.tv\.tuner@1\.[01]-service u:object_r:hal_tv_tuner_default_exec:s0
Label /vendor/bin/hw on devices without vendor partition SELinux labeling of filesystem files ignores symlinks. Unfortunately, /vendor is a symlink on devices without vendor partition (e.g., hikey). Thus, policy in directories which are used both for devices with vendor partition and for devices without vendor partition must be adjusted to match both /vendor and /system/vendor. It is assumed that the /vendor symlink, if it exists at all, always points to /system/vendor. The alternative solution of adjusting vendor policy file labelling rules at vendor policy build time, when the actual on-device paths are known, was considered to make it harder to see how files are labelled by looking solely at the source tree. Test: Files under /vendor/bin/hw correctly labelled on sailfish, angler, and a device which uses the /vendor symlink. Bug: 35431549 Change-Id: If6ccb2c9cb85b0589db03ab86de8071e15d5366f
2017-02-16 21:59:44 +01:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.usb@1\.0-service u:object_r:hal_usb_default_exec:s0
Add sepolicy for usb gadget hal v1.1 Bug: 147645728 Test: build pass and service running correctly Change-Id: I52b6bcae2c05998e3f22c39998597e2ecef55036
2019-11-28 08:02:26 +01:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.usb\.gadget@1\.1-service u:object_r:hal_usb_gadget_default_exec:s0
Label /vendor/bin/hw on devices without vendor partition SELinux labeling of filesystem files ignores symlinks. Unfortunately, /vendor is a symlink on devices without vendor partition (e.g., hikey). Thus, policy in directories which are used both for devices with vendor partition and for devices without vendor partition must be adjusted to match both /vendor and /system/vendor. It is assumed that the /vendor symlink, if it exists at all, always points to /system/vendor. The alternative solution of adjusting vendor policy file labelling rules at vendor policy build time, when the actual on-device paths are known, was considered to make it harder to see how files are labelled by looking solely at the source tree. Test: Files under /vendor/bin/hw correctly labelled on sailfish, angler, and a device which uses the /vendor symlink. Bug: 35431549 Change-Id: If6ccb2c9cb85b0589db03ab86de8071e15d5366f
2017-02-16 21:59:44 +01:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.vibrator@1\.0-service u:object_r:hal_vibrator_default_exec:s0
stable aidl vibrator policy Bug: 141828236 Test: boot, dumpsys -l Change-Id: Id3fc8724238883116e840794309efbf6c91226c9
2019-10-26 00:04:45 +02:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.vibrator-service.example u:object_r:hal_vibrator_default_exec:s0
Label /vendor/bin/hw on devices without vendor partition SELinux labeling of filesystem files ignores symlinks. Unfortunately, /vendor is a symlink on devices without vendor partition (e.g., hikey). Thus, policy in directories which are used both for devices with vendor partition and for devices without vendor partition must be adjusted to match both /vendor and /system/vendor. It is assumed that the /vendor symlink, if it exists at all, always points to /system/vendor. The alternative solution of adjusting vendor policy file labelling rules at vendor policy build time, when the actual on-device paths are known, was considered to make it harder to see how files are labelled by looking solely at the source tree. Test: Files under /vendor/bin/hw correctly labelled on sailfish, angler, and a device which uses the /vendor symlink. Bug: 35431549 Change-Id: If6ccb2c9cb85b0589db03ab86de8071e15d5366f
2017-02-16 21:59:44 +01:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.vr@1\.0-service u:object_r:hal_vr_default_exec:s0
/(vendor|system/vendor)/bin/hw/android\.hardware\.wifi@1\.0-service u:object_r:hal_wifi_default_exec:s0
Allow lazy wifi HAL to run Test: Manually check that lazy wifi HAL runs Bug: 123307146 Change-Id: I22f9bc7a097056215d249b692b6f39a71b6b9811
2019-01-15 19:06:20 +01:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.wifi@1\.0-service-lazy u:object_r:hal_wifi_default_exec:s0
sepolicy(hostapd): Add a HIDL interface for hostapd Change sepolicy permissions to now classify hostapd as a HAL exposing HIDL interface. Sepolicy denial for accessing /data/vendor/misc/wifi/hostapd: 12-27 23:40:55.913 4952 4952 W hostapd : type=1400 audit(0.0:19): avc: denied { write } for name="hostapd" dev="sda13" ino=4587601 scontext=u:r:hal_wifi_hostapd_default:s0 tcontext=u:object_r:system_data_file:s0 tclass=dir permissive=0 01-02 19:07:16.938 5791 5791 W hostapd : type=1400 audit(0.0:31): avc: denied { search } for name="net" dev="sysfs" ino=30521 scontext=u:r:hal_wifi_hostapd_default:s0 tcontext=u:object_r:sysfs_net:s0 tclass=dir permissive=0 Bug: 36646171 Test: Device boots up and able to turn on SoftAp. Change-Id: Ibacfcc938deab40096b54b8d0e608d53ca91b947
2017-12-23 00:03:15 +01:00
/(vendor|system/vendor)/bin/hw/hostapd u:object_r:hal_wifi_hostapd_default_exec:s0
sepolicy: Move hostapd to vendor Move hostapd to vendor/bin/ because it's only used by WIFI HAL. This commit is for sepolicy corresponding changes. Bug: 34236942 Bug: 34237659 Test: Hotspot works fine. Integration test. Change-Id: I2ee165970a20f4015d5d62fc590d448e9acb92c1
2017-02-11 18:51:10 +01:00
/(vendor|system/vendor)/bin/hw/wpa_supplicant u:object_r:hal_wifi_supplicant_default_exec:s0
Initial sepolicy for vndservicemanager. vndservicemanager is the context manager for binder services that are solely registered and accessed from vendor processes. Bug: 36052864 Test: vendorservicemanager runs Change-Id: Ifbf536932678d0ff13d019635fe6347e185ef387
2017-03-22 00:01:52 +01:00
/(vendor|system/vendor)/bin/vndservicemanager u:object_r:vndservicemanager_exec:s0
sepolicy: relabel /vendor The CL splits /vendor labeling from /system. Which was allowing all processes read, execute access to /vendor. Following directories will remain world readable /vendor/etc /vendor/lib(64)/hw/ Following are currently world readable but their scope will be minimized to platform processes that require access /vendor/app /vendor/framework/ /vendor/overlay Files labelled with 'same_process_hal_file' are allowed to be read + executed from by the world. This is for Same process HALs and their dependencies. Bug: 36527360 Bug: 36832490 Bug: 36681210 Bug: 36680116 Bug: 36690845 Bug: 36697328 Bug: 36696623 Bug: 36806861 Bug: 36656392 Bug: 36696623 Bug: 36792803 All of the tests were done on sailfish, angler, bullhead, dragon Test: Boot and connect to wifi Test: Run chrome and load websites, play video in youtube, load maps w/ current location, take pictures and record video in camera, playback recorded video. Test: Connect to BT headset and ensure BT audio playback works. Test: OTA sideload using recovery Test: CTS SELinuxHostTest pass Change-Id: I278435b72f7551a28f3c229f720ca608b77a7029 Signed-off-by: Sandeep Patil <sspatil@google.com>
2017-04-02 02:17:12 +02:00
#############################
# Same process HALs installed by platform into /vendor
#
/(vendor|system/vendor)/lib(64)?/hw/android\.hardware\.graphics\.mapper@2\.0-impl\.so u:object_r:same_process_hal_file:s0
Add IMapper2.1 same process hal permissions Bug: 135166668 Test: build, boot, VtsHalGraphicsComposerV2_2TargetTest Change-Id: Iedc11b73d3e3ba54dcd622b128cb513adec11d69
2019-06-14 21:28:58 +02:00
/(vendor|system/vendor)/lib(64)?/hw/android\.hardware\.graphics\.mapper@2\.0-impl-2\.1\.so u:object_r:same_process_hal_file:s0
gralloc3: add sepolicy for allocator/mapper 3.0 IAllocator and IMappaer are being rev'd to 3.0. Update sepolicy to allow them to be used. Test: compile with allocator/mapper patches add boot the device Bug: 120493579 Change-Id: Id241c6bd79c02ec93d8dd415539f90a18f733d03
2019-01-06 00:22:41 +01:00
/(vendor|system/vendor)/lib(64)?/hw/android\.hardware\.graphics\.mapper@3\.0-impl\.so u:object_r:same_process_hal_file:s0
gralloc: add IAllocator/IMapper 4.0 sepolicy Add support for gralloc 4.0 to sepolicy Bug: 136016160 Test: Compiles and boots Change-Id: I148cc19176275e8cbd19cc95aa95d4d450353b7a
2019-06-20 23:10:59 +02:00
/(vendor|system/vendor)/lib(64)?/hw/android\.hardware\.graphics\.mapper@4\.0-impl\.so u:object_r:same_process_hal_file:s0
sepolicy: relabel /vendor The CL splits /vendor labeling from /system. Which was allowing all processes read, execute access to /vendor. Following directories will remain world readable /vendor/etc /vendor/lib(64)/hw/ Following are currently world readable but their scope will be minimized to platform processes that require access /vendor/app /vendor/framework/ /vendor/overlay Files labelled with 'same_process_hal_file' are allowed to be read + executed from by the world. This is for Same process HALs and their dependencies. Bug: 36527360 Bug: 36832490 Bug: 36681210 Bug: 36680116 Bug: 36690845 Bug: 36697328 Bug: 36696623 Bug: 36806861 Bug: 36656392 Bug: 36696623 Bug: 36792803 All of the tests were done on sailfish, angler, bullhead, dragon Test: Boot and connect to wifi Test: Run chrome and load websites, play video in youtube, load maps w/ current location, take pictures and record video in camera, playback recorded video. Test: Connect to BT headset and ensure BT audio playback works. Test: OTA sideload using recovery Test: CTS SELinuxHostTest pass Change-Id: I278435b72f7551a28f3c229f720ca608b77a7029 Signed-off-by: Sandeep Patil <sspatil@google.com>
2017-04-02 02:17:12 +02:00
/(vendor|system/vendor)/lib(64)?/hw/android\.hardware\.renderscript@1\.0-impl\.so u:object_r:same_process_hal_file:s0
sepolicy: add missing labels for same process HALs. Some of the same process HAL labeling was missing from Marlin. These are identified by tracking library dependencies. Bug: 37084733 Test: Build and boot sailfish. The change allows the labelled libraries to be opened by any domain. So, the boot test is sufficient. Change-Id: Id55e834d6863ca644f912efdd690fccb71d3eaf3 Signed-off-by: Sandeep Patil <sspatil@google.com>
2017-04-06 22:50:23 +02:00
/(vendor|system/vendor)/lib(64)?/hw/gralloc\.default\.so u:object_r:same_process_hal_file:s0
sepolicy: relabel /vendor The CL splits /vendor labeling from /system. Which was allowing all processes read, execute access to /vendor. Following directories will remain world readable /vendor/etc /vendor/lib(64)/hw/ Following are currently world readable but their scope will be minimized to platform processes that require access /vendor/app /vendor/framework/ /vendor/overlay Files labelled with 'same_process_hal_file' are allowed to be read + executed from by the world. This is for Same process HALs and their dependencies. Bug: 36527360 Bug: 36832490 Bug: 36681210 Bug: 36680116 Bug: 36690845 Bug: 36697328 Bug: 36696623 Bug: 36806861 Bug: 36656392 Bug: 36696623 Bug: 36792803 All of the tests were done on sailfish, angler, bullhead, dragon Test: Boot and connect to wifi Test: Run chrome and load websites, play video in youtube, load maps w/ current location, take pictures and record video in camera, playback recorded video. Test: Connect to BT headset and ensure BT audio playback works. Test: OTA sideload using recovery Test: CTS SELinuxHostTest pass Change-Id: I278435b72f7551a28f3c229f720ca608b77a7029 Signed-off-by: Sandeep Patil <sspatil@google.com>
2017-04-02 02:17:12 +02:00
Deprecate libhwbinder/libhidltransport from VNDK. Since these libraries were vndk-sp, previously, passthrough HALs were able to load them. However, now that they have been removed from the vndk-sp set (these libraries are empty), marking them as same_process_hal_file so that vendor passthrough implementations that still link against these empty libraries can still use them. Bug: 135686713 Test: boot device using these libraries from an sphal (otherwise, bootloops) Change-Id: Ic5170eb0fcbb87c82bbea840dcfcb17899eaa899
2019-09-27 00:46:34 +02:00
#############################
# Libraries removed from vndk-sp (must still be accessible by passthrough HALs using them)
#
/(vendor|system/vendor)/lib(64)?/libhwbinder.so u:object_r:same_process_hal_file:s0
/(vendor|system/vendor)/lib(64)?/libhidltransport.so u:object_r:same_process_hal_file:s0
sepolicy: Move hostapd to vendor Move hostapd to vendor/bin/ because it's only used by WIFI HAL. This commit is for sepolicy corresponding changes. Bug: 34236942 Bug: 34237659 Test: Hotspot works fine. Integration test. Change-Id: I2ee165970a20f4015d5d62fc590d448e9acb92c1
2017-02-11 18:51:10 +01:00
#############################
# Data files
#
sepolicy(hostapd): Add a HIDL interface for hostapd Change sepolicy permissions to now classify hostapd as a HAL exposing HIDL interface. Sepolicy denial for accessing /data/vendor/misc/wifi/hostapd: 12-27 23:40:55.913 4952 4952 W hostapd : type=1400 audit(0.0:19): avc: denied { write } for name="hostapd" dev="sda13" ino=4587601 scontext=u:r:hal_wifi_hostapd_default:s0 tcontext=u:object_r:system_data_file:s0 tclass=dir permissive=0 01-02 19:07:16.938 5791 5791 W hostapd : type=1400 audit(0.0:31): avc: denied { search } for name="net" dev="sysfs" ino=30521 scontext=u:r:hal_wifi_hostapd_default:s0 tcontext=u:object_r:sysfs_net:s0 tclass=dir permissive=0 Bug: 36646171 Test: Device boots up and able to turn on SoftAp. Change-Id: Ibacfcc938deab40096b54b8d0e608d53ca91b947
2017-12-23 00:03:15 +01:00
/data/vendor/wifi/hostapd(/.*)? u:object_r:hostapd_data_file:s0
wpa_supplicant: move control sockets to /data/vendor Treble compliance. Bug: 70228425 Bug: 70393317 Test: complete wifi test in b/70393317 Test: Test wifi on Taimen and Sailfish Test: verify sockets exist in /data/vendor/wifi/wpa/sockets Change-Id: I217c0eda0e5af50bb603cfcc35d60bf0d9cad72e
2018-01-24 17:49:16 +01:00
/data/vendor/wifi/wpa(/.*)? u:object_r:wpa_data_file:s0
Reference in a new issue Copy permalink