tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
platform_system_sepolicy/private/bug_map

37 lines
1.5 KiB
Text
Raw Normal View History

Update bug_map to explicitly have the b/ prefix This is part of a series of updates to bug_map across all of android tree. Bug: 141014771 Test: Generated a denial, verified that the bug id in the dmesg logs remains unchanged. Change-Id: I852e8ac38a162cc074232f15d919212548d485bf
2019-09-18 23:15:30 +02:00
dnsmasq netd fifo_file b/77868789
dnsmasq netd unix_stream_socket b/77868789
gmscore_app: suppress denials for system_data_file This denial is generally a sign that apps are attempting to access encrypted storage before the ACTION_USER_UNLOCKED intent is delivered. Suppress this denial to prevent logspam. While gmscore_app is running in permissive mode, there might be other denials for related actions (that won't show up in enforcing mode after the first action is denied). This change adds a bug_map entry to track those denials and prevent presubmit flakes. Bug: 142672293 Test: Happy builds Change-Id: Id2f8f8ff5cde40e74be24daa0b1100b91a7a4dbb
2019-12-12 23:05:49 +01:00
gmscore_app system_data_file dir b/146166941
Update bug_map to explicitly have the b/ prefix This is part of a series of updates to bug_map across all of android tree. Bug: 141014771 Test: Generated a denial, verified that the bug id in the dmesg logs remains unchanged. Change-Id: I852e8ac38a162cc074232f15d919212548d485bf
2019-09-18 23:15:30 +02:00
init app_data_file file b/77873135
init cache_file blk_file b/77873135
init logpersist file b/77873135
init nativetest_data_file dir b/77873135
init pstorefs dir b/77873135
init shell_data_file dir b/77873135
init shell_data_file file b/77873135
init shell_data_file lnk_file b/77873135
init shell_data_file sock_file b/77873135
init system_data_file chr_file b/77873135
isolated_app privapp_data_file dir b/119596573
isolated_app app_data_file dir b/120394782
mediaextractor app_data_file file b/77923736
mediaextractor radio_data_file file b/77923736
mediaprovider cache_file blk_file b/77925342
mediaprovider mnt_media_rw_file dir b/77925342
mediaprovider shell_data_file dir b/77925342
bug_map: track mediaswcodec ashmem denial Bug: 142679232 Test: n/a Change-Id: Ie6a8e65ad175e2c2ab444381d3b05d0191cc0302
2019-10-15 18:57:51 +02:00
mediaswcodec ashmem_device chr_file b/142679232
Update bug_map to explicitly have the b/ prefix This is part of a series of updates to bug_map across all of android tree. Bug: 141014771 Test: Generated a denial, verified that the bug id in the dmesg logs remains unchanged. Change-Id: I852e8ac38a162cc074232f15d919212548d485bf
2019-09-18 23:15:30 +02:00
netd priv_app unix_stream_socket b/77870037
netd untrusted_app unix_stream_socket b/77870037
netd untrusted_app_25 unix_stream_socket b/77870037
netd untrusted_app_27 unix_stream_socket b/77870037
Track another instance of b/77870037 Bug: 77870037 Test: build Change-Id: I77f5888aaf0fedd07635e301dbc642e3f8749688
2020-04-02 10:17:22 +02:00
netd untrusted_app_29 unix_stream_socket b/77870037
Update bug_map to explicitly have the b/ prefix This is part of a series of updates to bug_map across all of android tree. Bug: 141014771 Test: Generated a denial, verified that the bug id in the dmesg logs remains unchanged. Change-Id: I852e8ac38a162cc074232f15d919212548d485bf
2019-09-18 23:15:30 +02:00
platform_app nfc_data_file dir b/74331887
Track system_server->apex_art_data_file denial. The denial occurs when system_server dynamically loads AOT artifacts at runtime. Sample message: type=1400 audit(0.0:4): avc: denied { execute } for comm="system_server" path="/data/misc/apexdata/com.android.art/dalvik-cache/arm64/system@framework@com.android.location.provider.jar@classes.odex" dev="dm-37" ino=296 scontext=u:r:system_server:s0 tcontext=u:object_r:apex_art_data_file:s0 tclass=file permissive=0 Currently, system_server is only allowed to load AOT artifacts at startup. odrefresh compiles jars in SYSTEMSERVERCLASSPATH, which are supposed to be loaded by system_server at startup. However, com.android.location.provider is a special case that is not only loaded at startup, but also loaded dynamically as a shared library, causing the denial. Therefore, this denial is currently expected. We need to compile com.android.location.provider so that its AOT artifacts can be picked up at system_server startup, but we cannot allow the artifacts to be loaded dynamically for now because further discussion about its security implications is needed. We will find a long term solution to this, tracked by b/194054685. Test: Presubmits Bug: 194054685 Change-Id: I3850ae022840bfe18633ed43fb666f5d88e383f6
2021-07-20 07:04:14 +02:00
system_server apex_art_data_file file b/194054685
Update bug_map to explicitly have the b/ prefix This is part of a series of updates to bug_map across all of android tree. Bug: 141014771 Test: Generated a denial, verified that the bug id in the dmesg logs remains unchanged. Change-Id: I852e8ac38a162cc074232f15d919212548d485bf
2019-09-18 23:15:30 +02:00
system_server crash_dump process b/73128755
overlayfs: deflake presubmit tests Bug: 142390309 Test: build Change-Id: Ibf12d5acba39436cf79b7eb3a1fbadb2296b68c4
2019-10-14 11:20:50 +02:00
system_server overlayfs_file file b/142390309
Update bug_map to explicitly have the b/ prefix This is part of a series of updates to bug_map across all of android tree. Bug: 141014771 Test: Generated a denial, verified that the bug id in the dmesg logs remains unchanged. Change-Id: I852e8ac38a162cc074232f15d919212548d485bf
2019-09-18 23:15:30 +02:00
system_server sdcardfs file b/77856826
system_server zygote process b/77856826
Gboard: Whitelist test failure This is intended to be temporary workaround until the Gboard developers fix their app. Addresses avc: denied { bind } for comm="ThreadPoolForeg" scontext=u:r:untrusted_app:s0:c166,c256,c512,c768 tcontext=u:r:untrusted_app:s0:c166,c256,c512,c768 tclass=netlink_route_socket permissive= app=com.google.android.inputmethod.latin Bug: 155595000 Test: build Change-Id: I432ac1462329efb4bc118c3967a099833e6eb813
2020-05-04 10:21:40 +02:00
untrusted_app untrusted_app netlink_route_socket b/155595000
Update bug_map to explicitly have the b/ prefix This is part of a series of updates to bug_map across all of android tree. Bug: 141014771 Test: Generated a denial, verified that the bug id in the dmesg logs remains unchanged. Change-Id: I852e8ac38a162cc074232f15d919212548d485bf
2019-09-18 23:15:30 +02:00
vold system_data_file file b/124108085
zygote untrusted_app_25 process b/77925912
Track zygote denials on labeledfs Bug: 170748799 Test: build policy Change-Id: I7f244f1e17060251cb1d0896716fee711ec10693
2021-01-15 13:54:11 +01:00
zygote labeledfs filesystem b/170748799
Reference in a new issue Copy permalink