tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
platform_system_sepolicy/private/service_contexts

161 lines
12 KiB
Text
Raw Normal View History

Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
accessibility u:object_r:accessibility_service:s0
account u:object_r:account_service:s0
activity u:object_r:activity_service:s0
alarm u:object_r:alarm_service:s0
update_engine: Allow to access bootctrl_block_device. update_engine needs to access bootctrl_block_device to get and set the slot to boot. avc: denied { write } for name="mmcblk0boot1" dev="tmpfs" ino=1266 scontext=u:r:update_engine:s0 tcontext=u:object_r:bootctrl_block_device:s0 tclass=blk_file avc: denied { open } for path="/dev/block/mmcblk0boot1" dev="tmpfs" ino=1266 scontext=u:r:update_engine:s0 tcontext=u:object_r:bootctrl_block_device:s0 tclass=blk_file Also track the name change of the native binder service. avc: denied { add } for service=android.os.UpdateEngineService pid=210 uid=0 scontext=u:r:update_engine:s0 tcontext=u:object_r:default_android_service:s0 tclass=service_manager Bug: 27106053 Change-Id: Idbfef18578489db33fead0721e8f26d63db5ce09 (cherry picked from commit 3ec34ceb43b15c30e9c7bf1720ebea24f868d07a)
2016-02-09 23:12:58 +01:00
android.os.UpdateEngineService u:object_r:update_engine_service:s0
Add SELinux rules for service_manager. Add a service_mananger class with the verb add. Add a type that groups the services for each of the processes that is allowed to start services in service.te and an attribute for all services controlled by the service manager. Add the service_contexts file which maps service name to target label. Bug: 12909011 Change-Id: I017032a50bc90c57b536e80b972118016d340c7d
2014-06-06 00:52:02 +02:00
android.security.keystore u:object_r:keystore_service:s0
SELinux permissions for gatekeeper TEE proxy sets up: - execute permissions - binder permission (system_server->gatekeeper->keystore) - prevents dumpstate and shell from finding GK binder service - neverallow rules for prohibited clients Change-Id: I1817933a91de625db469a20c7a4c8e2ca46efa1e
2015-04-04 01:46:33 +02:00
android.service.gatekeeper.IGateKeeperService u:object_r:gatekeeper_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
appops u:object_r:appops_service:s0
appwidget u:object_r:appwidget_service:s0
assetatlas u:object_r:assetatlas_service:s0
audio u:object_r:audio_service:s0
Creates an autofill system service. BUG: 31001899 Test: manual Change-Id: I8d462b40d931310eab26bafa09645ac88f13fc97
2016-10-18 01:25:36 +02:00
autofill u:object_r:autofill_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
backup u:object_r:backup_service:s0
Mark batteryproperties service as app_api_service. Applications do not explicitly request handles to the batteryproperties service, but the BatteryManager obtains a reference to it and uses it for its underlying property queries. Mark it as an app_api_service so that all applications may use this API. Also remove the batterypropreg service label, as this does not appear to be used and may have been a duplication of batteryproperties. As a result, remove the healthd_service type and replace it with a more specific batteryproperties_service type. (cherry-picked from commit: 9ed71eff4bed91653cba393ea6cb42f041d4e257) Bug: 27442760 Change-Id: I537c17c09145b302728377bf856c1147e4cc37e9
2016-03-14 20:21:18 +01:00
batteryproperties u:object_r:batteryproperties_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
batterystats u:object_r:batterystats_service:s0
battery u:object_r:battery_service:s0
bluetooth_manager u:object_r:bluetooth_manager_service:s0
Add missing services to service_contexts. Add missing services related to battery, bluetooth, time, and radio to service_contexts. Change-Id: I8bf05feb173d49637048c779757013806837fede
2014-06-26 21:36:43 +02:00
bluetooth u:object_r:bluetooth_service:s0
Whitelist new carrier config service. This service will be implemented in packages/services/Telephony. Bug: 19483786 Change-Id: Ia9a90bc859108d8657cae551d657e2fcdc261f88
2015-03-25 22:46:54 +01:00
carrier_config u:object_r:radio_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
clipboard u:object_r:clipboard_service:s0
com.android.net.IProxyService u:object_r:IProxyService_service:s0
commontime_management u:object_r:commontime_management_service:s0
New service name for IpConnectivity metrics (cherry picked from commit f412cc623f26c95706e0966daa49207028487281) Bug: 31254800 Change-Id: If8708c8a4e0ea7655f31028881248a14cf2ba5f7
2016-09-09 08:57:24 +02:00
common_time.clock u:object_r:mediaserver_service:s0
common_time.config u:object_r:mediaserver_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
connectivity u:object_r:connectivity_service:s0
fix lax service context lookup (II) As fallout from the corresponding fix in libselinux, this patch adds the missing services without changing semantics. Test: bullhead builds and boots Bug: 31353148 Change-Id: I21026c9435ffef956a59d61c4903174ac7b1ef95
2016-09-08 14:15:19 +02:00
connectivity_metrics_logger u:object_r:connectivity_metrics_logger_service:s0
New service name for IpConnectivity metrics (cherry picked from commit f412cc623f26c95706e0966daa49207028487281) Bug: 31254800 Change-Id: If8708c8a4e0ea7655f31028881248a14cf2ba5f7
2016-09-09 08:57:24 +02:00
connmetrics u:object_r:connmetrics_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
consumer_ir u:object_r:consumer_ir_service:s0
content u:object_r:content_service:s0
Create SELinux label for contexhub_service SELinux label is created for contexthub_service system service. ContextHub service manages all available context hubs and serves fulfil communication between apps and underlying context hub hardware. Change-Id: I8470fedd9c79a00012e1cdb9b548a1b632ba7de6
2016-02-14 09:14:21 +01:00
contexthub_service u:object_r:contexthub_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
country_detector u:object_r:country_detector_service:s0
Add coverage service. Bug: 31077138 Test: Device boots, coverage service works when tested manually. Change-Id: Ia855cfefd5c25be5d1d8db48908c04b3616b5504
2016-12-01 03:27:03 +01:00
coverage u:object_r:coverage_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
cpuinfo u:object_r:cpuinfo_service:s0
dbinfo u:object_r:dbinfo_service:s0
device_policy u:object_r:device_policy_service:s0
Move device serial behing a permission - selinux Build serial is non-user resettable freely available device identifier. It can be used by ad-netowrks to track the user across apps which violates the user's privacy. This change deprecates Build.SERIAL and adds a new Build.getSerial() API which requires holding the read_phone_state permission. The Build.SERIAL value is set to "undefined" for apps targeting high enough SDK and for legacy app the value is still available. bug:31402365 Change-Id: I6309aa58c8993b3db4fea7b55aae05592408b6e4
2016-09-12 20:58:08 +02:00
device_identifiers u:object_r:device_identifiers_service:s0
Add rule for new deviceidle service. Change-Id: I283663caea0ee1597645856fb31f13b26e902315
2015-03-19 02:33:47 +01:00
deviceidle u:object_r:deviceidle_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
devicestoragemonitor u:object_r:devicestoragemonitor_service:s0
diskstats u:object_r:diskstats_service:s0
Add SELinux rules for service_manager. Add a service_mananger class with the verb add. Add a type that groups the services for each of the processes that is allowed to start services in service.te and an attribute for all services controlled by the service manager. Add the service_contexts file which maps service name to target label. Bug: 12909011 Change-Id: I017032a50bc90c57b536e80b972118016d340c7d
2014-06-06 00:52:02 +02:00
display.qservice u:object_r:surfaceflinger_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
display u:object_r:display_service:s0
Change name in the rules after renaming dns_listener -> netd_listener Change-Id: I4737a087f2d00e1028d1cb43d9eda814a008dbe8
2016-09-01 11:08:57 +02:00
netd_listener u:object_r:netd_listener_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
DockObserver u:object_r:DockObserver_service:s0
dreams u:object_r:dreams_service:s0
Add SELinux rules for service_manager. Add a service_mananger class with the verb add. Add a type that groups the services for each of the processes that is allowed to start services in service.te and an attribute for all services controlled by the service manager. Add the service_contexts file which maps service name to target label. Bug: 12909011 Change-Id: I017032a50bc90c57b536e80b972118016d340c7d
2014-06-06 00:52:02 +02:00
drm.drmManager u:object_r:drmserver_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
dropbox u:object_r:dropbox_service:s0
Added permissions for the dumpstate service. - Allow dumpstate to create the dumpservice service. - Allow System Server and Shell to find that service. - Don't allow anyone else to create that service. - Don't allow anyone else to find that service. BUG: 31636879 Test: manual verification Change-Id: I642fe873560a2b123e6bafde645467d45a5f5711
2016-10-29 00:52:15 +02:00
dumpstate u:object_r:dumpstate_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
ethernet u:object_r:ethernet_service:s0
fingerprint u:object_r:fingerprint_service:s0
Add selinux policy for fingerprintd Change-Id: Ibcb714248c28abf21272986facaade376dcbd7ef
2015-05-13 00:16:06 +02:00
android.hardware.fingerprint.IFingerprintDaemon u:object_r:fingerprintd_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
gfxinfo u:object_r:gfxinfo_service:s0
Add graphicsstats service Change-Id: I156b139b57f46c695ece35b7b26a3087d87b25df
2015-03-23 15:56:37 +01:00
graphicsstats u:object_r:graphicsstats_service:s0
Define gpu_service and allow surfaceflinger to provide it Bug: 26620936 and 27352427 Change-Id: I3d6d2e479d95133693790a97827e45e9dd30bc4a
2016-03-27 07:56:27 +02:00
gpu u:object_r:gpu_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
hardware u:object_r:hardware_service:s0
Renamed hardwareproperties to hardware_properties Bug: 27531271 Change-Id: I3c5eee86d09696373ab155f93ba6c85da224cb51
2016-03-09 18:13:11 +01:00
hardware_properties u:object_r:hardware_properties_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
hdmi_control u:object_r:hdmi_control_service:s0
Add SELinux rules for service_manager. Add a service_mananger class with the verb add. Add a type that groups the services for each of the processes that is allowed to start services in service.te and an attribute for all services controlled by the service manager. Add the service_contexts file which maps service name to target label. Bug: 12909011 Change-Id: I017032a50bc90c57b536e80b972118016d340c7d
2014-06-06 00:52:02 +02:00
inputflinger u:object_r:inputflinger_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
input_method u:object_r:input_method_service:s0
input u:object_r:input_service:s0
Rules for new installd Binder interface. Most of this CL mirrors what we've already done for the "netd" Binder interface, while sorting a few lists alphabetically. Migrating installd to Binder will allow us to get rid of one of the few lingering text-based command protocols, improving system maintainability and security. Test: builds, boots Bug: 13758960, 30944031 Change-Id: I59b89f916fd12e22f9813ace6673be38314c97b7
2016-12-05 19:19:11 +01:00
installd u:object_r:installd_service:s0
Preemptively adding services for pending commits. Adding services to service_contexts for the pending commits Icf5997dd6a6ba5e1de675cf5f4334c78c2c037f1 and Ibe79be30b80c18ec45ff69db7527c7a4adf0ee08. Change-Id: Ie898866d1ab3abba6211943e87bcec77ba568567
2014-06-27 22:20:15 +02:00
iphonesubinfo_msim u:object_r:radio_service:s0
iphonesubinfo2 u:object_r:radio_service:s0
Add SELinux rules for service_manager. Add a service_mananger class with the verb add. Add a type that groups the services for each of the processes that is allowed to start services in service.te and an attribute for all services controlled by the service manager. Add the service_contexts file which maps service name to target label. Bug: 12909011 Change-Id: I017032a50bc90c57b536e80b972118016d340c7d
2014-06-06 00:52:02 +02:00
iphonesubinfo u:object_r:radio_service:s0
Add missing services to service_contexts. Add missing services to service_contexts that we did not include in earlier patch that added SELinux checks in service_manager. Change-Id: I889d999bf0b745bfcb75a3553b207777dc5700b7
2014-06-17 17:13:36 +02:00
ims u:object_r:radio_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
imms u:object_r:imms_service:s0
Preemptively adding services for pending commits. Adding services to service_contexts for the pending commits Icf5997dd6a6ba5e1de675cf5f4334c78c2c037f1 and Ibe79be30b80c18ec45ff69db7527c7a4adf0ee08. Change-Id: Ie898866d1ab3abba6211943e87bcec77ba568567
2014-06-27 22:20:15 +02:00
isms_msim u:object_r:radio_service:s0
isms2 u:object_r:radio_service:s0
Add SELinux rules for service_manager. Add a service_mananger class with the verb add. Add a type that groups the services for each of the processes that is allowed to start services in service.te and an attribute for all services controlled by the service manager. Add the service_contexts file which maps service name to target label. Bug: 12909011 Change-Id: I017032a50bc90c57b536e80b972118016d340c7d
2014-06-06 00:52:02 +02:00
isms u:object_r:radio_service:s0
Add missing services to service_contexts. Add missing services to service_contexts that we did not include in earlier patch that added SELinux checks in service_manager. Change-Id: I889d999bf0b745bfcb75a3553b207777dc5700b7
2014-06-17 17:13:36 +02:00
isub u:object_r:radio_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
jobscheduler u:object_r:jobscheduler_service:s0
launcherapps u:object_r:launcherapps_service:s0
location u:object_r:location_service:s0
lock_settings u:object_r:lock_settings_service:s0
Add rules for running audio services in audioserver audioserver has the same rules as mediaserver so there is no loss of rights or permissions. media.log moves to audioserver. TBD: Pare down permissions. Bug: 24511453 Change-Id: I0fff24c14b712bb3d498f75e8fd66c2eb795171d
2015-09-09 19:48:04 +02:00
media.audio_flinger u:object_r:audioserver_service:s0
media.audio_policy u:object_r:audioserver_service:s0
selinux: Update policies for cameraserver Update policies for cameraserver so it has the same permissions as mediaserver. Bug: 24511454 Change-Id: I1191e2ac36c00b942282f8dc3db9903551945adb
2015-12-04 01:10:05 +01:00
media.camera u:object_r:cameraserver_service:s0
camera: Add AIDL interface for CameraServiceProxy. - Update selinux policy for CameraServiceProxy. Bug: 21267484 Change-Id: Ib821582794ddd1e3574b5dc6c79f7cb197b57f10
2015-05-20 02:26:31 +02:00
media.camera.proxy u:object_r:cameraproxy_service:s0
Add rules for running audio services in audioserver audioserver has the same rules as mediaserver so there is no loss of rights or permissions. media.log moves to audioserver. TBD: Pare down permissions. Bug: 24511453 Change-Id: I0fff24c14b712bb3d498f75e8fd66c2eb795171d
2015-09-09 19:48:04 +02:00
media.log u:object_r:audioserver_service:s0
Add SELinux rules for service_manager. Add a service_mananger class with the verb add. Add a type that groups the services for each of the processes that is allowed to start services in service.te and an attribute for all services controlled by the service manager. Add the service_contexts file which maps service name to target label. Bug: 12909011 Change-Id: I017032a50bc90c57b536e80b972118016d340c7d
2014-06-06 00:52:02 +02:00
media.player u:object_r:mediaserver_service:s0
Allow access to mediaanalytics service media framework analytics are gathered in a separate service. define a context for this new service, allow various media-related services and libraries to access this new service. Bug: 30267133 Test: ran media CTS, watched for selinux denials. Change-Id: I5aa5aaa5aa9e82465b8024f87ed32d6ba4db35ca
2016-12-02 20:26:54 +01:00
media.analytics u:object_r:mediaanalytics_service:s0
Update selinux policies for mediaextractor process Change-Id: If761e0370bf9731a2856d0de2c6a6af1671143bd
2015-09-22 19:56:03 +02:00
media.extractor u:object_r:mediaextractor_service:s0
selinux rules for codec process Bug: 22775369 Change-Id: Ic6abe3d0e18ba6f7554d027e0ec05fd19011709b
2016-02-03 01:10:37 +01:00
media.codec u:object_r:mediacodec_service:s0
media: allow media server to add resource manager service Bug: 19620911 Change-Id: I170b9d46bd49b1ad8bac6e37d0745893d79c14fe
2015-03-12 23:54:37 +01:00
media.resource_manager u:object_r:mediaserver_service:s0
Add rules for running audio services in audioserver audioserver has the same rules as mediaserver so there is no loss of rights or permissions. media.log moves to audioserver. TBD: Pare down permissions. Bug: 24511453 Change-Id: I0fff24c14b712bb3d498f75e8fd66c2eb795171d
2015-09-09 19:48:04 +02:00
media.radio u:object_r:audioserver_service:s0
media.sound_trigger_hw u:object_r:audioserver_service:s0
Add mediadrm service Part of media security hardening This is an intermediate step toward moving mediadrm to a new service separate from mediaserver. This first step allows mediadrmservice to run based on the system property media.mediadrmservice.enable so it can be selectively enabled on devices that support using native_handles for secure buffers. bug: 22990512 Change-Id: I2208c1e87a6bd8d5bfaed06b1fdcb0509c11cff2
2016-02-12 18:05:42 +01:00
media.drm u:object_r:mediadrmserver_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
media_projection u:object_r:media_projection_service:s0
Allow mediaserver to access media_resource_monitor Bug: 26175834 Change-Id: I49244f8e6165ea5a871955f07b3c4ea40cbd7c59
2015-12-15 06:19:21 +01:00
media_resource_monitor u:object_r:media_session_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
media_router u:object_r:media_router_service:s0
media_session u:object_r:media_session_service:s0
meminfo u:object_r:meminfo_service:s0
midi u:object_r:midi_service:s0
mount u:object_r:mount_service:s0
Rename the netd service from "android.net.INetd" to "netd". Bug: 27239233 Change-Id: Icc9d14008d2ff6334a8ec66805f7289aedd5d97d
2016-02-23 14:21:22 +01:00
netd u:object_r:netd_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
netpolicy u:object_r:netpolicy_service:s0
netstats u:object_r:netstats_service:s0
network_management u:object_r:network_management_service:s0
network_score u:object_r:network_score_service:s0
Add NetworkTimeUpdateService NetworkTimeUpdateService has been registered as a system service, so that its dump state can be included into bugreports. Bug: 23983739 Change-Id: I0d364009ba4630dcfd1d22c647195e33eedaa4e0
2016-02-27 02:21:47 +01:00
network_time_update_service u:object_r:network_time_update_service:s0
Add SELinux rules for service_manager. Add a service_mananger class with the verb add. Add a type that groups the services for each of the processes that is allowed to start services in service.te and an attribute for all services controlled by the service manager. Add the service_contexts file which maps service name to target label. Bug: 12909011 Change-Id: I017032a50bc90c57b536e80b972118016d340c7d
2014-06-06 00:52:02 +02:00
nfc u:object_r:nfc_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
notification u:object_r:notification_service:s0
Selinux: introduce policy for OTA preopt Add permissions to dex2oat, introduce otapreopt binary and otadexopt service. Bug: 25612095 Change-Id: I80fcba2785e80b2931d7d82bb07474f6cd0099f7
2015-12-03 06:23:30 +01:00
otadexopt u:object_r:otadexopt_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
package u:object_r:package_service:s0
permission u:object_r:permission_service:s0
persistent_data_block u:object_r:persistent_data_block_service:s0
Preemptively adding services for pending commits. Adding services to service_contexts for the pending commits Icf5997dd6a6ba5e1de675cf5f4334c78c2c037f1 and Ibe79be30b80c18ec45ff69db7527c7a4adf0ee08. Change-Id: Ie898866d1ab3abba6211943e87bcec77ba568567
2014-06-27 22:20:15 +02:00
phone_msim u:object_r:radio_service:s0
phone1 u:object_r:radio_service:s0
phone2 u:object_r:radio_service:s0
Add SELinux rules for service_manager. Add a service_mananger class with the verb add. Add a type that groups the services for each of the processes that is allowed to start services in service.te and an attribute for all services controlled by the service manager. Add the service_contexts file which maps service name to target label. Bug: 12909011 Change-Id: I017032a50bc90c57b536e80b972118016d340c7d
2014-06-06 00:52:02 +02:00
phone u:object_r:radio_service:s0
Add CAP_IPC_LOCK and pinner to system_server Add pinner service to system_service services. Add CAP_IPC_LOCK permissions to system_server in order to allow system_server to pin more memory than the lockedmem ulimit. bug 28251566 Change-Id: I990c73d25fce4f2cc9a2db0015aa238fa7b0e984
2016-05-02 20:04:39 +02:00
pinner u:object_r:pinner_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
power u:object_r:power_service:s0
print u:object_r:print_service:s0
Add security policy for ProcessInfoService. Bug: 19186859 Change-Id: Ic08858f346d6b66e7bfc9da6faa2c6e38d9b2e82
2015-01-29 03:15:01 +01:00
processinfo u:object_r:processinfo_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
procstats u:object_r:procstats_service:s0
Add missing services to service_contexts. Add missing services related to battery, bluetooth, time, and radio to service_contexts. Change-Id: I8bf05feb173d49637048c779757013806837fede
2014-06-26 21:36:43 +02:00
radio.phonesubinfo u:object_r:radio_service:s0
radio.phone u:object_r:radio_service:s0
radio.sms u:object_r:radio_service:s0
Add recovery service. RecoverySystemService is separated from PowerManagerService as a dedicated system service to handle recovery related requests (such as invoking uncrypt to uncrypt an OTA package on /data or to set up / clear the bootloader control block (i.e. /misc) and etc). The matching CL in frameworks/base is in: Change-Id: Ic606fcf5b31c54ce54f0ab12c1768fef0fa64560. Bug: 26830925 Change-Id: Iee0583c458f784bfa422d0f7af5d1f2681d9609e (cherry picked from commit 65b5fde912285ebeeefc9c7486f4453dd86d994f)
2016-02-03 21:43:58 +01:00
recovery u:object_r:recovery_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
restrictions u:object_r:restrictions_service:s0
rttmanager u:object_r:rttmanager_service:s0
samplingprofiler u:object_r:samplingprofiler_service:s0
scheduling_policy u:object_r:scheduling_policy_service:s0
search u:object_r:search_service:s0
fix lax service context lookup (II) As fallout from the corresponding fix in libselinux, this patch adds the missing services without changing semantics. Test: bullhead builds and boots Bug: 31353148 Change-Id: I21026c9435ffef956a59d61c4903174ac7b1ef95
2016-09-08 14:15:19 +02:00
sec_key_att_app_id_provider u:object_r:sec_key_att_app_id_provider_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
sensorservice u:object_r:sensorservice_service:s0
serial u:object_r:serial_service:s0
servicediscovery u:object_r:servicediscovery_service:s0
Allow new settings system service. Test: N/A Change-Id: Ib3c85118bf752152f5ca75ec13371073fc2873cc
2016-10-21 00:57:39 +02:00
settings u:object_r:settings_service:s0
Add new system service "shortcut". Bug 27325877 Change-Id: Idf2f9ae816e1f3d822a6286a4cf738c14e29a45e
2016-03-02 00:11:41 +01:00
shortcut u:object_r:shortcut_service:s0
Preemptively adding services for pending commits. Adding services to service_contexts for the pending commits Icf5997dd6a6ba5e1de675cf5f4334c78c2c037f1 and Ibe79be30b80c18ec45ff69db7527c7a4adf0ee08. Change-Id: Ie898866d1ab3abba6211943e87bcec77ba568567
2014-06-27 22:20:15 +02:00
simphonebook_msim u:object_r:radio_service:s0
simphonebook2 u:object_r:radio_service:s0
Add SELinux rules for service_manager. Add a service_mananger class with the verb add. Add a type that groups the services for each of the processes that is allowed to start services in service.te and an attribute for all services controlled by the service manager. Add the service_contexts file which maps service name to target label. Bug: 12909011 Change-Id: I017032a50bc90c57b536e80b972118016d340c7d
2014-06-06 00:52:02 +02:00
simphonebook u:object_r:radio_service:s0
sip u:object_r:radio_service:s0
Allow "soundtrigger" system service to run. In the same process as voiceinteraction. Please see related CL ag/852049 Bug: 22860713 Change-Id: I43ebfdba2aafb151dd7db0814570027e1164508a
2016-01-26 03:22:07 +01:00
soundtrigger u:object_r:voiceinteraction_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
statusbar u:object_r:statusbar_service:s0
Add SELinux rules for service_manager. Add a service_mananger class with the verb add. Add a type that groups the services for each of the processes that is allowed to start services in service.te and an attribute for all services controlled by the service manager. Add the service_contexts file which maps service name to target label. Bug: 12909011 Change-Id: I017032a50bc90c57b536e80b972118016d340c7d
2014-06-06 00:52:02 +02:00
SurfaceFlinger u:object_r:surfaceflinger_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
task u:object_r:task_service:s0
Add system_api_service and app_api_service attributes. System services differ in designed access level. Add attributes reflecting this distinction and label services appropriately. Begin moving access to the newly labeled services by removing them from tmp_system_server_service into the newly made system_server_service attribute. Reflect the move of system_server_service from a type to an attribute by removing access to system_server_service where appropriate. Change-Id: I7fd06823328daaea6d6f96e4d6bd00332382230b
2015-04-03 01:50:08 +02:00
telecom u:object_r:telecom_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
telephony.registry u:object_r:registry_service:s0
textservices u:object_r:textservices_service:s0
trust u:object_r:trust_service:s0
tv_input u:object_r:tv_input_service:s0
uimode u:object_r:uimode_service:s0
updatelock u:object_r:updatelock_service:s0
usagestats u:object_r:usagestats_service:s0
usb u:object_r:usb_service:s0
user u:object_r:user_service:s0
vibrator u:object_r:vibrator_service:s0
voiceinteraction u:object_r:voiceinteraction_service:s0
Update selinux policy for VrManager AIDL. Bug: 27884853 Change-Id: I097306a324bdc25c5d22868f0342e175ce0dbb9a
2016-04-06 03:12:21 +02:00
vrmanager u:object_r:vr_manager_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
wallpaper u:object_r:wallpaper_service:s0
webviewupdate u:object_r:webviewupdate_service:s0
wifip2p u:object_r:wifip2p_service:s0
wifiscanner u:object_r:wifiscanner_service:s0
wifi u:object_r:wifi_service:s0
sepolicy: add sepolicy binder support for wificond This allows wificond to publish binder interface using service manager. Denial warnings: wificond: type=1400 audit(0.0:8): avc: denied { call } for scontext=u:r:wificond:s0 tcontext=u:r:servicemanager:s0 tclass=binder permissive=1 wificond: type=1400 audit(0.0:9): avc: denied { transfer } for scontext=u:r:wificond:s0 tcontext=u:r:servicemanager:s0 tclass=binder permissive=1 servicemanager: type=1400 audit(0.0:10): avc: denied { search } for name="6085" dev="proc" ino=40626 scontext=u:r:servicemanager:s0 tcontext=u:r:wificond:s0 tclass=dir permissive=1 servicemanager: type=1400 audit(0.0:11): avc: denied { read } for name="current" dev="proc" ino=40641 scontext=u:r:servicemanager:s0 tcontext=u:r:wificond:s0 tclass=file permissive=1 servicemanager: type=1400 audit(0.0:12): avc: denied { open } for path="/proc/6085/attr/current" dev="proc" ino=40641 scontext=u:r:servicemanager:s0 tcontext=u:r:wificond:s0 tclass=file permissive=1 servicemanager: type=1400 audit(0.0:13): avc: denied { getattr } for scontext=u:r:servicemanager:s0 tcontext=u:r:wificond:s0 tclass=process permissive=1 SELinux : avc: denied { add } for service=wificond pid=6085 uid=0 scontext=u:r:wificond:s0 tcontext=u:object_r:wifi_service:s0 tclass=service_manager permissive=1 BUG=28867093 TEST=compile TEST=use a client to call wificond service through binder Change-Id: I9312892caff171f17b04c30a415c07036b39ea7f (cherry picked from commit d56bcb1c5452c8dcdda7e4ef5d0f44b91b6bb08b)
2016-06-03 19:08:56 +02:00
wificond u:object_r:wificond_service:s0
[NAN-AWARE] Add Aware service Add Aware service - new name for NAN. But do not remove NAN yet. Enables smooth transition. Bug: 32263750 Test: device boots and all Wi-Fi unit-tests pass Change-Id: Ieb9f1ebf1d2f31ee27f228562b4601023da5282d
2016-11-04 21:37:17 +01:00
wifiaware u:object_r:wifiaware_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
window u:object_r:window_service:s0
sepolicy: Add permissions for wpa_supplicant binder Add the necessary permissions for |wpa_supplicant| to expose a binder interface. This binder interface will be used by the newly added |wificond| service (and potentially system_server). |wpa_supplicant| also needs to invoke binder callbacks on |wificond|. Changes in the CL: 1. Allow |wpa_supplicant| to register binder service. 2. Allow |wpa_supplicant| to invoke binder calls on |wificond|. 3. Allow |wificond| to invoke binder calls on |wpa_supplicant| Denials: 06-30 08:14:42.788 400 400 E SELinux : avc: denied { add } for service=wpa_supplicant pid=20756 uid=1010 scontext=u:r:wpa:s0 tcontext=u:object_r:default_android_service:s0 tclass=service_manager permissive=1 BUG:29877467 TEST: Compiled and ensured that the selinux denials are no longer present in logs. TEST: Ran integration test to find the service. Change-Id: Ib78d8e820fc81b2c3d9260e1c877c5faa9f1f662 (cherry picked from commit 18883a93b795da6409beeddf2c6ce34ce8234cb0)
2016-06-30 17:20:29 +02:00
wpa u:object_r:wpa_supplicant_service:s0
Add SELinux rules for service_manager. Add a service_mananger class with the verb add. Add a type that groups the services for each of the processes that is allowed to start services in service.te and an attribute for all services controlled by the service manager. Add the service_contexts file which maps service name to target label. Bug: 12909011 Change-Id: I017032a50bc90c57b536e80b972118016d340c7d
2014-06-06 00:52:02 +02:00
* u:object_r:default_android_service:s0
Reference in a new issue Copy permalink