tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
platform_system_sepolicy/microdroid/system/private/property_contexts

156 lines
7.9 KiB
Text
Raw Normal View History

Move microdroid sepolicy to system/sepolicy Bug: 190511750 Test: boot microdroid Change-Id: I4aa4a56e9be5103d70469c3508110a973f3e4f12
2021-07-19 09:48:34 +02:00
# property contexts for microdroid
microdroid: Narrow property permissions microdroid's domains have been able to read/write any properties. That's just for convenience while bringing up microdroid. This cleans up such global permission and grants minimal access. Bug: 194447534 Test: atest MicrodroidHostTestCases ComposHostTestCases Test: run microdroid demo app Change-Id: I09ce1174d4af9c228b788a522a6ab845cafd4505
2021-09-17 12:31:45 +02:00
# microdroid only uses much fewer properties than normal Android, so every property is listed as
# an exact entry. The only wildcards are "debug.*", "init.svc_debug_pid.*", "ctl.*", and
# process-dependent properties like "arm64.memtag.*" and "log.tag.*".
Move microdroid sepolicy to system/sepolicy Bug: 190511750 Test: boot microdroid Change-Id: I4aa4a56e9be5103d70469c3508110a973f3e4f12
2021-07-19 09:48:34 +02:00
microdroid: Narrow property permissions microdroid's domains have been able to read/write any properties. That's just for convenience while bringing up microdroid. This cleans up such global permission and grants minimal access. Bug: 194447534 Test: atest MicrodroidHostTestCases ComposHostTestCases Test: run microdroid demo app Change-Id: I09ce1174d4af9c228b788a522a6ab845cafd4505
2021-09-17 12:31:45 +02:00
debug. u:object_r:debug_prop:s0 prefix
persist.debug. u:object_r:debug_prop:s0 prefix
Move microdroid sepolicy to system/sepolicy Bug: 190511750 Test: boot microdroid Change-Id: I4aa4a56e9be5103d70469c3508110a973f3e4f12
2021-07-19 09:48:34 +02:00
init.svc_debug_pid. u:object_r:init_svc_debug_prop:s0 prefix int
ctl.sigstop_on$ u:object_r:ctl_sigstop_prop:s0
ctl.sigstop_off$ u:object_r:ctl_sigstop_prop:s0
ctl.start$ u:object_r:ctl_start_prop:s0
ctl.stop$ u:object_r:ctl_stop_prop:s0
ctl.restart$ u:object_r:ctl_restart_prop:s0
ctl.interface_start$ u:object_r:ctl_interface_start_prop:s0
ctl.interface_stop$ u:object_r:ctl_interface_stop_prop:s0
ctl.interface_restart$ u:object_r:ctl_interface_restart_prop:s0
ctl.start$adbd u:object_r:ctl_adbd_prop:s0
ctl.stop$adbd u:object_r:ctl_adbd_prop:s0
ctl.restart$adbd u:object_r:ctl_adbd_prop:s0
ctl.stop$apexd u:object_r:ctl_apexd_prop:s0
microdroid: introduce logcat domain In Microdroid, logcat is started as a daemon process (whose service name is seriallogging) whose job is to read logs from logd and sends them to the host side via a virtual console. The daemon process is controlled by microdroid_manager, so the process is given write access to ctl.start$seriallogging and also to some sysprops originated from bootconfig so that it can know if the VM is configured as debuggable or not. Bug: 200914564 Test: start microdroid using the vm tool. logcat logs are shown in stdout. Change-Id: I79bc6486ae1f84515ad31a09e24d8368fb54bc6d
2021-10-18 20:02:45 +02:00
ctl.start$apexd-vm u:object_r:ctl_apexd_vm_prop:s0
ctl.start$apkdmverity u:object_r:ctl_apkdmverity_prop:s0
ctl.start$seriallogging u:object_r:ctl_seriallogging_prop:s0
ctl.start$zipfuse u:object_r:ctl_zipfuse_prop:s0
Microdroid boot process is controlled by microdroid_manager Previously, the boot process of microdroid was mostly implemented in the init.rc file. microdroid_manager was started first in the background, then apexd, apkdmverity, and zipfuse were executed in sequence. However, in order to correctly implement the app payload verification scheme, most of the early boot process has to be controlled by microdroid_manager. Specifically, apkdmverity should be started "after" the apk roothash is read from the instance disk by microdroid_manager. As an alternative, we could let apkdmverity the read instance disk by itself. However, this is undesirable because doing so requires multiple processes - microdroid_manager and apkdmverity - have access to the instance disk and more seriously the secret key to decrypt it. Another alternative is to let microdroid_manager do the dm-verity configuration which apkdmverity does. This also is considered undesirable because then we would give the permissions for configuring dm-verity devices to microdroid_manager which is a long-running daemon process. Note that apkdmverity is not a daemon process. This CL introduces a few number of changes which are required to let microdroid_manager directly control the early boot process: 1) microdroid_manager is allowed to start the services apkdmverity and zipfuse by using the `ctl.start` sysprop. 2) apkdmverity is allowed to use bootstrap bionic libraries as it is now executed before APEXd activates the APEXes. 3) A new sysprop `microdroid_manager.apk_roothash` is added. It is written by microdroid_manager and read by apkdmverity. It contains the roothash read from the instance disk. This value is not a secret. 4) Another new sysprop `apex_config.done` is added. It is set by init just after `perform_apex_config` and read by microdroid_manager. Microdroid_manager uses this to wait until linker configuration is ready so that it can execute app payloads with the config. Bug: 193504400 Test: atest MicrodroidHostTestCases Change-Id: If29ce17d7a6cb4859e8ceeffb321724e7f11bf82
2021-09-06 08:39:31 +02:00
microdroid: Narrow property permissions microdroid's domains have been able to read/write any properties. That's just for convenience while bringing up microdroid. This cleans up such global permission and grants minimal access. Bug: 194447534 Test: atest MicrodroidHostTestCases ComposHostTestCases Test: run microdroid demo app Change-Id: I09ce1174d4af9c228b788a522a6ab845cafd4505
2021-09-17 12:31:45 +02:00
ctl.console u:object_r:ctl_console_prop:s0
ctl.fuse_ u:object_r:ctl_fuse_prop:s0
ctl. u:object_r:ctl_default_prop:s0
Move microdroid sepolicy to system/sepolicy Bug: 190511750 Test: boot microdroid Change-Id: I4aa4a56e9be5103d70469c3508110a973f3e4f12
2021-07-19 09:48:34 +02:00
sys.init.perf_lsm_hooks u:object_r:init_perf_lsm_hooks_prop:s0 exact bool
microdroid: add sys.powerctl property And microdroid_manager can set it to shut down when verification fails. Bug: 204073443 Test: MicrodroidHostTestCases Change-Id: I12ec7c8b832f5d1e382961ce7866502c2cc8a9b8
2021-10-28 03:17:51 +02:00
sys.powerctl u:object_r:powerctl_prop:s0
Move microdroid sepolicy to system/sepolicy Bug: 190511750 Test: boot microdroid Change-Id: I4aa4a56e9be5103d70469c3508110a973f3e4f12
2021-07-19 09:48:34 +02:00
service.adb.root u:object_r:shell_prop:s0 exact bool
ro.logd.kernel u:object_r:logd_prop:s0 exact bool
Add logd.ready logd.ready is a system property that logd sets when it is ready to serve incoming socket requests for reading and writing logs. Clients of logd (e.g. logcat) can use this to synchronize with logd, otherwise they may experience a crash due to the refused socket connection to logd when they are started before logd is ready. Bug: 206826522 Test: run microdroid. see logcat logs are shown immediately Change-Id: Iee13485b0f4c2beda9bc8434f514c4e32e119492
2021-11-22 06:18:03 +01:00
logd.ready u:object_r:logd_prop:s0 exact bool
Move microdroid sepolicy to system/sepolicy Bug: 190511750 Test: boot microdroid Change-Id: I4aa4a56e9be5103d70469c3508110a973f3e4f12
2021-07-19 09:48:34 +02:00
microdroid: Remove default_prop access This adds properties necessary to run microdroid to property_contexts, and then removes default_prop access to all domains except for init, as init should be able to write all properties. Bug: 194447534 Test: atest MicrodroidHostTestCases ComposHostTestCases Change-Id: I2f80c71ce257613b3c3b019a3e988a5a0653d879
2021-09-14 04:30:18 +02:00
ro.config.low_ram u:object_r:build_prop:s0 exact bool
Move microdroid sepolicy to system/sepolicy Bug: 190511750 Test: boot microdroid Change-Id: I4aa4a56e9be5103d70469c3508110a973f3e4f12
2021-07-19 09:48:34 +02:00
ro.boottime.adbd u:object_r:boottime_prop:s0 exact int
microdroid: Remove default_prop access This adds properties necessary to run microdroid to property_contexts, and then removes default_prop access to all domains except for init, as init should be able to write all properties. Bug: 194447534 Test: atest MicrodroidHostTestCases ComposHostTestCases Change-Id: I2f80c71ce257613b3c3b019a3e988a5a0653d879
2021-09-14 04:30:18 +02:00
ro.boottime.apexd-vm u:object_r:boottime_prop:s0 exact int
ro.boottime.apkdmverity u:object_r:boottime_prop:s0 exact int
SELinux policy for authfs_service and authfs authfs_service is a binder service on microdroid. Upon a request by the client, the service will create the mount directory, execute authfs to mount the FUSE, and finally unmount and delete the mount directory. authfs currently requires more privileges than it should, but it's ok because the client owns the VM, and all input will be verified by signatures. But there is plan to keep the privileges isoated in the service (b/195554831). Bug: 194717985 Bug: 195554831 Test: Start the service from init, use a test executable to call the service API. Only observed denial from the test executable. Change-Id: Ie53aa9e2796433fc3182357039d0b7ba1c0848ef
2021-08-04 02:26:38 +02:00
ro.boottime.authfs_service u:object_r:boottime_prop:s0 exact int
Move microdroid sepolicy to system/sepolicy Bug: 190511750 Test: boot microdroid Change-Id: I4aa4a56e9be5103d70469c3508110a973f3e4f12
2021-07-19 09:48:34 +02:00
ro.boottime.init u:object_r:boottime_prop:s0 exact int
ro.boottime.init.cold_boot_wait u:object_r:boottime_prop:s0 exact int
ro.boottime.init.first_stage u:object_r:boottime_prop:s0 exact int
ro.boottime.init.modules u:object_r:boottime_prop:s0 exact int
ro.boottime.init.selinux u:object_r:boottime_prop:s0 exact int
ro.boottime.logd u:object_r:boottime_prop:s0 exact int
ro.boottime.logd-reinit u:object_r:boottime_prop:s0 exact int
ro.boottime.microdroid_manager u:object_r:boottime_prop:s0 exact int
ro.boottime.servicemanager u:object_r:boottime_prop:s0 exact int
ro.boottime.tombstoned u:object_r:boottime_prop:s0 exact int
ro.boottime.ueventd u:object_r:boottime_prop:s0 exact int
ro.boottime.zipfuse u:object_r:boottime_prop:s0 exact int
ro.build.fingerprint u:object_r:fingerprint_prop:s0 exact string
microdroid: Remove default_prop access This adds properties necessary to run microdroid to property_contexts, and then removes default_prop access to all domains except for init, as init should be able to write all properties. Bug: 194447534 Test: atest MicrodroidHostTestCases ComposHostTestCases Change-Id: I2f80c71ce257613b3c3b019a3e988a5a0653d879
2021-09-14 04:30:18 +02:00
apexd.status u:object_r:apexd_prop:s0 exact enum starting activated ready
ro.apex.updatable u:object_r:apexd_prop:s0 exact bool
Move microdroid sepolicy to system/sepolicy Bug: 190511750 Test: boot microdroid Change-Id: I4aa4a56e9be5103d70469c3508110a973f3e4f12
2021-07-19 09:48:34 +02:00
ro.cold_boot_done u:object_r:cold_boot_done_prop:s0 exact bool
microdroid: Remove default_prop access This adds properties necessary to run microdroid to property_contexts, and then removes default_prop access to all domains except for init, as init should be able to write all properties. Bug: 194447534 Test: atest MicrodroidHostTestCases ComposHostTestCases Change-Id: I2f80c71ce257613b3c3b019a3e988a5a0653d879
2021-09-14 04:30:18 +02:00
sys.usb.controller u:object_r:usb_control_prop:s0 exact string
persist.sys.usb.config u:object_r:usb_control_prop:s0 exact string
init.svc.apexd-vm u:object_r:init_service_status_private_prop:s0 exact string
init.svc.apkdmverity u:object_r:init_service_status_private_prop:s0 exact string
init.svc.authfs_service u:object_r:init_service_status_private_prop:s0 exact string
init.svc.logd u:object_r:init_service_status_private_prop:s0 exact string
init.svc.logd-reinit u:object_r:init_service_status_private_prop:s0 exact string
init.svc.microdroid_manager u:object_r:init_service_status_private_prop:s0 exact string
init.svc.servicemanager u:object_r:init_service_status_private_prop:s0 exact string
init.svc.ueventd u:object_r:init_service_status_private_prop:s0 exact string
init.svc.zipfuse u:object_r:init_service_status_private_prop:s0 exact string
Move microdroid sepolicy to system/sepolicy Bug: 190511750 Test: boot microdroid Change-Id: I4aa4a56e9be5103d70469c3508110a973f3e4f12
2021-07-19 09:48:34 +02:00
init.svc.adbd u:object_r:init_service_status_prop:s0 exact string
init.svc.tombstoned u:object_r:init_service_status_prop:s0 exact string
microdroid: introduce logcat domain In Microdroid, logcat is started as a daemon process (whose service name is seriallogging) whose job is to read logs from logd and sends them to the host side via a virtual console. The daemon process is controlled by microdroid_manager, so the process is given write access to ctl.start$seriallogging and also to some sysprops originated from bootconfig so that it can know if the VM is configured as debuggable or not. Bug: 200914564 Test: start microdroid using the vm tool. logcat logs are shown in stdout. Change-Id: I79bc6486ae1f84515ad31a09e24d8368fb54bc6d
2021-10-18 20:02:45 +02:00
ro.boot.adb.enabled u:object_r:bootloader_prop:s0 exact bool
microdroid: Remove default_prop access This adds properties necessary to run microdroid to property_contexts, and then removes default_prop access to all domains except for init, as init should be able to write all properties. Bug: 194447534 Test: atest MicrodroidHostTestCases ComposHostTestCases Change-Id: I2f80c71ce257613b3c3b019a3e988a5a0653d879
2021-09-14 04:30:18 +02:00
ro.boot.avb_version u:object_r:bootloader_prop:s0 exact string
ro.boot.boot_devices u:object_r:bootloader_prop:s0 exact string
ro.boot.first_stage_console u:object_r:bootloader_prop:s0 exact string
ro.boot.force_normal_boot u:object_r:bootloader_prop:s0 exact string
microdroid: introduce logcat domain In Microdroid, logcat is started as a daemon process (whose service name is seriallogging) whose job is to read logs from logd and sends them to the host side via a virtual console. The daemon process is controlled by microdroid_manager, so the process is given write access to ctl.start$seriallogging and also to some sysprops originated from bootconfig so that it can know if the VM is configured as debuggable or not. Bug: 200914564 Test: start microdroid using the vm tool. logcat logs are shown in stdout. Change-Id: I79bc6486ae1f84515ad31a09e24d8368fb54bc6d
2021-10-18 20:02:45 +02:00
ro.boot.hardware u:object_r:bootloader_prop:s0 exact string
ro.boot.logd.enabled u:object_r:bootloader_prop:s0 exact bool
Add context for ro.boot.microdroid.debuggable property This property is read by microdroid_manager to check whether the VM is in debug mode. Give it a context to satisfy the sepolicy. Bug: 214231981 Test: atest MicrodroidTestApp Change-Id: I9d4bda5e487324c95229c7978e8fe0a53fa9f616
2022-01-25 17:07:21 +01:00
ro.boot.microdroid.debuggable u:object_r:bootloader_prop:s0 exact bool
microdroid: Remove default_prop access This adds properties necessary to run microdroid to property_contexts, and then removes default_prop access to all domains except for init, as init should be able to write all properties. Bug: 194447534 Test: atest MicrodroidHostTestCases ComposHostTestCases Change-Id: I2f80c71ce257613b3c3b019a3e988a5a0653d879
2021-09-14 04:30:18 +02:00
ro.boot.slot_suffix u:object_r:bootloader_prop:s0 exact string
ro.boot.vbmeta.avb_version u:object_r:bootloader_prop:s0 exact string
ro.boot.vbmeta.device_state u:object_r:bootloader_prop:s0 exact string
ro.boot.vbmeta.digest u:object_r:bootloader_prop:s0 exact string
ro.boot.vbmeta.hash_alg u:object_r:bootloader_prop:s0 exact string
ro.boot.vbmeta.invalidate_on_error u:object_r:bootloader_prop:s0 exact string
ro.boot.vbmeta.size u:object_r:bootloader_prop:s0 exact string
ro.boot.verifiedbootstate u:object_r:bootloader_prop:s0 exact string
ro.boot.veritymode u:object_r:bootloader_prop:s0 exact string
ro.baseband u:object_r:bootloader_prop:s0 exact string
ro.bootloader u:object_r:bootloader_prop:s0 exact string
ro.bootmode u:object_r:bootloader_prop:s0 exact string
ro.hardware u:object_r:bootloader_prop:s0 exact string
ro.revision u:object_r:bootloader_prop:s0 exact string
Move microdroid sepolicy to system/sepolicy Bug: 190511750 Test: boot microdroid Change-Id: I4aa4a56e9be5103d70469c3508110a973f3e4f12
2021-07-19 09:48:34 +02:00
ro.build.id u:object_r:build_prop:s0 exact string
Define ro.build.version.{codename,sdk} in microdroid The `__builtin_available` macro is used in used in several libraries in microdroid, including liblog. The macro internally uses ro.build.version.{codename,sdk}[1]. This change defines the context for these properties. [1] https://reviews.llvm.org/rG516a01b5f36d4188778a34202cd11856d70ac808 Bug: 210030607 Test: No longer seeing denied access of default_prop from odrefresh Change-Id: I51bc52f679a174daccc05a1e2d6c9fda9e6b12cb
2021-12-14 19:34:48 +01:00
ro.build.version.codename u:object_r:build_prop:s0 exact string
Move microdroid sepolicy to system/sepolicy Bug: 190511750 Test: boot microdroid Change-Id: I4aa4a56e9be5103d70469c3508110a973f3e4f12
2021-07-19 09:48:34 +02:00
ro.build.version.release u:object_r:build_prop:s0 exact string
Define ro.build.version.{codename,sdk} in microdroid The `__builtin_available` macro is used in used in several libraries in microdroid, including liblog. The macro internally uses ro.build.version.{codename,sdk}[1]. This change defines the context for these properties. [1] https://reviews.llvm.org/rG516a01b5f36d4188778a34202cd11856d70ac808 Bug: 210030607 Test: No longer seeing denied access of default_prop from odrefresh Change-Id: I51bc52f679a174daccc05a1e2d6c9fda9e6b12cb
2021-12-14 19:34:48 +01:00
ro.build.version.sdk u:object_r:build_prop:s0 exact int
Move microdroid sepolicy to system/sepolicy Bug: 190511750 Test: boot microdroid Change-Id: I4aa4a56e9be5103d70469c3508110a973f3e4f12
2021-07-19 09:48:34 +02:00
ro.build.version.security_patch u:object_r:build_prop:s0 exact string
ro.debuggable u:object_r:build_prop:s0 exact bool
ro.product.cpu.abilist u:object_r:build_prop:s0 exact string
ro.adb.secure u:object_r:build_prop:s0 exact bool
ro.property_service.version u:object_r:property_service_version_prop:s0 exact int
Microdroid boot process is controlled by microdroid_manager Previously, the boot process of microdroid was mostly implemented in the init.rc file. microdroid_manager was started first in the background, then apexd, apkdmverity, and zipfuse were executed in sequence. However, in order to correctly implement the app payload verification scheme, most of the early boot process has to be controlled by microdroid_manager. Specifically, apkdmverity should be started "after" the apk roothash is read from the instance disk by microdroid_manager. As an alternative, we could let apkdmverity the read instance disk by itself. However, this is undesirable because doing so requires multiple processes - microdroid_manager and apkdmverity - have access to the instance disk and more seriously the secret key to decrypt it. Another alternative is to let microdroid_manager do the dm-verity configuration which apkdmverity does. This also is considered undesirable because then we would give the permissions for configuring dm-verity devices to microdroid_manager which is a long-running daemon process. Note that apkdmverity is not a daemon process. This CL introduces a few number of changes which are required to let microdroid_manager directly control the early boot process: 1) microdroid_manager is allowed to start the services apkdmverity and zipfuse by using the `ctl.start` sysprop. 2) apkdmverity is allowed to use bootstrap bionic libraries as it is now executed before APEXd activates the APEXes. 3) A new sysprop `microdroid_manager.apk_roothash` is added. It is written by microdroid_manager and read by apkdmverity. It contains the roothash read from the instance disk. This value is not a secret. 4) Another new sysprop `apex_config.done` is added. It is set by init just after `perform_apex_config` and read by microdroid_manager. Microdroid_manager uses this to wait until linker configuration is ready so that it can execute app payloads with the config. Bug: 193504400 Test: atest MicrodroidHostTestCases Change-Id: If29ce17d7a6cb4859e8ceeffb321724e7f11bf82
2021-09-06 08:39:31 +02:00
apex_config.done u:object_r:apex_config_prop:s0 exact bool
microdroid: rename property to "apk_root_hash" Bug: 193504400 Test: atest MicrodroidHostTestCases Change-Id: I3bd0fd337d85b29e5dfdfba49ee5328e48f5be89
2021-09-08 09:05:29 +02:00
microdroid_manager.apk_root_hash u:object_r:microdroid_manager_roothash_prop:s0 exact string
microdroid: Remove default_prop access This adds properties necessary to run microdroid to property_contexts, and then removes default_prop access to all domains except for init, as init should be able to write all properties. Bug: 194447534 Test: atest MicrodroidHostTestCases ComposHostTestCases Change-Id: I2f80c71ce257613b3c3b019a3e988a5a0653d879
2021-09-14 04:30:18 +02:00
dev.mnt.blk.root u:object_r:dev_mnt_prop:s0 exact string
dev.mnt.blk.vendor u:object_r:dev_mnt_prop:s0 exact string
dev.mnt.dev.root u:object_r:dev_mnt_prop:s0 exact string
dev.mnt.dev.vendor u:object_r:dev_mnt_prop:s0 exact string
gsid.image_installed u:object_r:gsid_prop:s0 exact bool
ro.gsid.image_running u:object_r:gsid_prop:s0 exact bool
service.adb.listen_addrs u:object_r:adbd_prop:s0 exact string
persist.adb.wifi.guid u:object_r:adbd_prop:s0 exact string
microdroid: Narrow property permissions microdroid's domains have been able to read/write any properties. That's just for convenience while bringing up microdroid. This cleans up such global permission and grants minimal access. Bug: 194447534 Test: atest MicrodroidHostTestCases ComposHostTestCases Test: run microdroid demo app Change-Id: I09ce1174d4af9c228b788a522a6ab845cafd4505
2021-09-17 12:31:45 +02:00
Include log.tag and persist.log.tag in log_tag_prop The two properties are not just prefixes. See __android_log_level in system/logging/liblog/properties.cpp. Bug: 210030607 Test: no longer seeing denials with default_prop in odrefresh Change-Id: If2c9cba7aa65802e81c79c7d3d9735cbf14a6efa
2021-12-14 19:42:47 +01:00
log.tag u:object_r:log_tag_prop:s0 prefix
persist.log.tag u:object_r:log_tag_prop:s0 prefix
microdroid: Narrow property permissions microdroid's domains have been able to read/write any properties. That's just for convenience while bringing up microdroid. This cleans up such global permission and grants minimal access. Bug: 194447534 Test: atest MicrodroidHostTestCases ComposHostTestCases Test: run microdroid demo app Change-Id: I09ce1174d4af9c228b788a522a6ab845cafd4505
2021-09-17 12:31:45 +02:00
libc.debug.malloc.options u:object_r:libc_debug_prop:s0 exact string
libc.debug.malloc.program u:object_r:libc_debug_prop:s0 exact string
libc.debug.hooks.enable u:object_r:libc_debug_prop:s0 exact string
arm64.memtag. u:object_r:arm64_memtag_prop:s0 prefix string
persist.sys.timezone u:object_r:timezone_prop:s0 exact string
ro.vndk.version u:object_r:build_prop:s0 exact string
heapprofd.enable u:object_r:heapprofd_prop:s0 exact bool
Declare dalvik.vm. property and dontaudit explicitly dex2oat currently uses some properties as flags (see art/libartbase/base/flags.cc). For CompOS, we don't really need such properties, and actually should avoid global state. So dontaudit explicitly. Bug: 210030607 Test: no more default_prop denials for dex2oat Change-Id: I10852f2a7df4dac7a9389eab3f53f91328104f96
2021-12-14 20:06:23 +01:00
# ART properties for CompOS
Revert "use dalvik.vm.boot-dex2oat-threads inside microdroid" This reverts commit eee72d6cb3d9f5c6001192247861b28cb0787827. REASON: not needed. See the other CL in the same topic. Bug: 197358423 Test: m Change-Id: Ice0813ed9e349e37c83b163e2c21f17bb1105013
2022-01-18 17:34:32 +01:00
dalvik.vm. u:object_r:dalvik_config_prop:s0 prefix
Declare dalvik.vm. property and dontaudit explicitly dex2oat currently uses some properties as flags (see art/libartbase/base/flags.cc). For CompOS, we don't really need such properties, and actually should avoid global state. So dontaudit explicitly. Bug: 210030607 Test: no more default_prop denials for dex2oat Change-Id: I10852f2a7df4dac7a9389eab3f53f91328104f96
2021-12-14 20:06:23 +01:00
persist.device_config.runtime_native. u:object_r:device_config_runtime_native_prop:s0 prefix
Add apexd_payload_metadata_prop This should be read-only and corresponds to apexd.payload_metadata.path Bug: 191097666 Test: android-sh -c 'setprop apexd.payload_metadata.path' See permission denied atest MicrodroidHostTestCases Change-Id: Ifcb7da1266769895974d4fef86139bad5891a4ec
2021-11-08 21:09:54 +01:00
apexd.payload_metadata.path u:object_r:apexd_payload_metadata_prop:s0 exact string
Reference in a new issue Copy permalink