tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
platform_system_sepolicy/private/service_contexts

206 lines
15 KiB
Text
Raw Normal View History

Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
accessibility u:object_r:accessibility_service:s0
account u:object_r:account_service:s0
activity u:object_r:activity_service:s0
Added sepolicy for activity_task service Bug: 80414790 Test: boots Change-Id: I3d6bb4e7da9d697ec8ff7502880543be89aee349
2018-05-31 00:26:41 +02:00
activity_task u:object_r:activity_task_service:s0
Add ADB system service ADB is being separated from USB service since it's not tied to the USB transport. This duplicates the usb_service's settings to adb_service for this purpose. Bug: 63820489 Test: make Change-Id: Idbcfbe470d7568f9cba51f0c8d4a8ee9503db93d
2018-01-25 08:12:39 +01:00
adb u:object_r:adb_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
alarm u:object_r:alarm_service:s0
update_engine: Allow to access bootctrl_block_device. update_engine needs to access bootctrl_block_device to get and set the slot to boot. avc: denied { write } for name="mmcblk0boot1" dev="tmpfs" ino=1266 scontext=u:r:update_engine:s0 tcontext=u:object_r:bootctrl_block_device:s0 tclass=blk_file avc: denied { open } for path="/dev/block/mmcblk0boot1" dev="tmpfs" ino=1266 scontext=u:r:update_engine:s0 tcontext=u:object_r:bootctrl_block_device:s0 tclass=blk_file Also track the name change of the native binder service. avc: denied { add } for service=android.os.UpdateEngineService pid=210 uid=0 scontext=u:r:update_engine:s0 tcontext=u:object_r:default_android_service:s0 tclass=service_manager Bug: 27106053 Change-Id: Idbfef18578489db33fead0721e8f26d63db5ce09 (cherry picked from commit 3ec34ceb43b15c30e9c7bf1720ebea24f868d07a)
2016-02-09 23:12:58 +01:00
android.os.UpdateEngineService u:object_r:update_engine_service:s0
Add SELinux rules for service_manager. Add a service_mananger class with the verb add. Add a type that groups the services for each of the processes that is allowed to start services in service.te and an attribute for all services controlled by the service manager. Add the service_contexts file which maps service name to target label. Bug: 12909011 Change-Id: I017032a50bc90c57b536e80b972118016d340c7d
2014-06-06 00:52:02 +02:00
android.security.keystore u:object_r:keystore_service:s0
SELinux permissions for gatekeeper TEE proxy sets up: - execute permissions - binder permission (system_server->gatekeeper->keystore) - prevents dumpstate and shell from finding GK binder service - neverallow rules for prohibited clients Change-Id: I1817933a91de625db469a20c7a4c8e2ca46efa1e
2015-04-04 01:46:33 +02:00
android.service.gatekeeper.IGateKeeperService u:object_r:gatekeeper_service:s0
Add app_binding system service Bug: 109809543 Test: Build and boot with the new service in the internal branch. Change-Id: Iaee365771c3e8e5b8f5f3b6112bbf902c6bb02bd
2018-09-05 02:13:16 +02:00
app_binding u:object_r:app_binding_service:s0
Add policy for apexd. apexd is a new daemon for managing APEX packages installed on the device. It hosts a single binder service, "apexservice". Bug: 112455435 Test: builds, binder service can be registered, apexes can be accessed, verified and mounted Change-Id: I634ad100f10b2edcd9a9c0df0d33896fa5d4ed97
2018-08-17 09:35:42 +02:00
apexservice u:object_r:apex_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
appops u:object_r:appops_service:s0
appwidget u:object_r:appwidget_service:s0
assetatlas u:object_r:assetatlas_service:s0
audio u:object_r:audio_service:s0
Creates an autofill system service. BUG: 31001899 Test: manual Change-Id: I8d462b40d931310eab26bafa09645ac88f13fc97
2016-10-18 01:25:36 +02:00
autofill u:object_r:autofill_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
backup u:object_r:backup_service:s0
Mark batteryproperties service as app_api_service. Applications do not explicitly request handles to the batteryproperties service, but the BatteryManager obtains a reference to it and uses it for its underlying property queries. Mark it as an app_api_service so that all applications may use this API. Also remove the batterypropreg service label, as this does not appear to be used and may have been a duplication of batteryproperties. As a result, remove the healthd_service type and replace it with a more specific batteryproperties_service type. (cherry-picked from commit: 9ed71eff4bed91653cba393ea6cb42f041d4e257) Bug: 27442760 Change-Id: I537c17c09145b302728377bf856c1147e4cc37e9
2016-03-14 20:21:18 +01:00
batteryproperties u:object_r:batteryproperties_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
batterystats u:object_r:batterystats_service:s0
battery u:object_r:battery_service:s0
Added SELinux policy for BinderCallsStatsService Test: manual Bug: 75318418 Change-Id: I700c1b8b613dba1c99f4fbffdd905c0052c1b2e7
2018-01-11 03:11:22 +01:00
binder_calls_stats u:object_r:binder_calls_stats_service:s0
Rename biometric_prompt_service to biometric_service Bug: 111461540 Bug: 112570477 Test: builds Change-Id: Icc68720ebe931c2d917703b2d34aa0f4eec3f549 Merged-In: Icc68720ebe931c2d917703b2d34aa0f4eec3f549
2018-09-21 05:32:32 +02:00
biometric u:object_r:biometric_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
bluetooth_manager u:object_r:bluetooth_manager_service:s0
Add missing services to service_contexts. Add missing services related to battery, bluetooth, time, and radio to service_contexts. Change-Id: I8bf05feb173d49637048c779757013806837fede
2014-06-26 21:36:43 +02:00
bluetooth u:object_r:bluetooth_service:s0
Add SEPolicy for new Java-based Broadcast Radio service. Bug: b/36863239 Test: manual Change-Id: I7e929926efbb1570ea9723ef3810a511c71dc11a (cherry picked from commit 38f0928fb05793b91651ba9787e4da8c2cd5afd3)
2017-06-22 16:55:16 +02:00
broadcastradio u:object_r:broadcastradio_service:s0
Update SELinux Policy for bufferhubd Create a new service type buffer_hub_binder_service for BufferHubBinderService and allow bufferhubd to publish the service. Add the service to 26.0, 27.0 and 28.0 compat ignore files since the service is not available in past versions. Fixes: 116022258 Test: build passed Change-Id: I5a21f00329ed474433d96c8d1ce32377f20cada3
2018-09-18 02:06:19 +02:00
bufferhubd u:object_r:buffer_hub_service:s0
Whitelist new carrier config service. This service will be implemented in packages/services/Telephony. Bug: 19483786 Change-Id: Ia9a90bc859108d8657cae551d657e2fcdc261f88
2015-03-25 22:46:54 +01:00
carrier_config u:object_r:radio_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
clipboard u:object_r:clipboard_service:s0
com.android.net.IProxyService u:object_r:IProxyService_service:s0
Remove underscore from Companion service name Fixes: 37536706 Test: Ensure no boot-time error and companion functionality works Change-Id: I80ced92cb62aa10e1847980eb9a169af3bcd21f0
2017-04-20 20:19:16 +02:00
companiondevice u:object_r:companion_device_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
connectivity u:object_r:connectivity_service:s0
New service name for IpConnectivity metrics (cherry picked from commit f412cc623f26c95706e0966daa49207028487281) Bug: 31254800 Change-Id: If8708c8a4e0ea7655f31028881248a14cf2ba5f7
2016-09-09 08:57:24 +02:00
connmetrics u:object_r:connmetrics_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
consumer_ir u:object_r:consumer_ir_service:s0
content u:object_r:content_service:s0
Change the name advertised by the context hub service. Bring the context hub service advertised name into compliance with the other Android services. This changes the name from "contexthub_service" to "context". Test: GTS tests pass. Change-Id: I8490d60f89bdb97813e328b9ddf08270470fda76
2016-12-27 18:29:15 +01:00
contexthub u:object_r:contexthub_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
country_detector u:object_r:country_detector_service:s0
Add coverage service. Bug: 31077138 Test: Device boots, coverage service works when tested manually. Change-Id: Ia855cfefd5c25be5d1d8db48908c04b3616b5504
2016-12-01 03:27:03 +01:00
coverage u:object_r:coverage_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
cpuinfo u:object_r:cpuinfo_service:s0
Add selinux policy for CrossProfileAppsService CrossProfileAppsService allows apps to do limited cross profile operations, like checking the caller package is installed in the specified user. It is similar to LauncherAppsService in some sense. Merged-In: I26e383a57c32c4dc9b779752b20000b283a5bfdc Change-Id: I26e383a57c32c4dc9b779752b20000b283a5bfdc Fix: 67765768 Test: Built with ag/3063260. Can boot and verified those APIs are working. (cherry picked from commit 6536c9e0920fda975e9a1a240ea1c5e1ae9778a6)
2017-10-13 15:48:32 +02:00
crossprofileapps u:object_r:crossprofileapps_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
dbinfo u:object_r:dbinfo_service:s0
device_policy u:object_r:device_policy_service:s0
Move device serial behing a permission - selinux Build serial is non-user resettable freely available device identifier. It can be used by ad-netowrks to track the user across apps which violates the user's privacy. This change deprecates Build.SERIAL and adds a new Build.getSerial() API which requires holding the read_phone_state permission. The Build.SERIAL value is set to "undefined" for apps targeting high enough SDK and for legacy app the value is still available. bug:31402365 Change-Id: I6309aa58c8993b3db4fea7b55aae05592408b6e4
2016-09-12 20:58:08 +02:00
device_identifiers u:object_r:device_identifiers_service:s0
Add rule for new deviceidle service. Change-Id: I283663caea0ee1597645856fb31f13b26e902315
2015-03-19 02:33:47 +01:00
deviceidle u:object_r:deviceidle_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
devicestoragemonitor u:object_r:devicestoragemonitor_service:s0
diskstats u:object_r:diskstats_service:s0
display u:object_r:display_service:s0
Add color_service selinux policy Bug: 111215474 Test: boots Change-Id: I98955bcd02f643400c3eb97232467c09a2c5c1e5
2018-08-18 03:47:47 +02:00
color_display u:object_r:color_display_service:s0
Change name in the rules after renaming dns_listener -> netd_listener Change-Id: I4737a087f2d00e1028d1cb43d9eda814a008dbe8
2016-09-01 11:08:57 +02:00
netd_listener u:object_r:netd_listener_service:s0
Add network watchlist service SELinux policy rules Bug: 63908748 Test: built, flashed, able to boot Change-Id: I3cfead1d687112b5f8cd485c8f84083c566fbce2
2017-11-13 18:52:05 +01:00
network_watchlist u:object_r:network_watchlist_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
DockObserver u:object_r:DockObserver_service:s0
dreams u:object_r:dreams_service:s0
Add SELinux rules for service_manager. Add a service_mananger class with the verb add. Add a type that groups the services for each of the processes that is allowed to start services in service.te and an attribute for all services controlled by the service manager. Add the service_contexts file which maps service name to target label. Bug: 12909011 Change-Id: I017032a50bc90c57b536e80b972118016d340c7d
2014-06-06 00:52:02 +02:00
drm.drmManager u:object_r:drmserver_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
dropbox u:object_r:dropbox_service:s0
Added permissions for the dumpstate service. - Allow dumpstate to create the dumpservice service. - Allow System Server and Shell to find that service. - Don't allow anyone else to create that service. - Don't allow anyone else to find that service. BUG: 31636879 Test: manual verification Change-Id: I642fe873560a2b123e6bafde645467d45a5f5711
2016-10-29 00:52:15 +02:00
dumpstate u:object_r:dumpstate_service:s0
Define selinux context for econtroller. Bug: 33075886 Test: N/A Change-Id: I1654ee20fa6125cf3ed5c0796e85f289db5a9745
2017-03-02 19:36:17 +01:00
econtroller u:object_r:radio_service:s0
Add EuiccCardManager and EuiccCardController. Bug: 38206971 Test: test on phone Change-Id: Id34ab2673c7a16744fba77eb5c176e2e8b474299 Merged-In: Id34ab2673c7a16744fba77eb5c176e2e8b474299
2017-12-22 03:42:24 +01:00
euicc_card_controller u:object_r:radio_service:s0
Sync internal master and AOSP sepolicy. Bug: 37916906 Test: Builds 'n' boots. Change-Id: Ia1d86264446ebecc1ca79f32f11354921bc77668 Merged-In: I208ec6a864127a059fb389417a9c6b259d7474cb
2017-09-26 21:58:29 +02:00
lowpan u:object_r:lowpan_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
ethernet u:object_r:ethernet_service:s0
Add placeholder sepolicy for iris and face See aosp/660242 and aosp/608396 Fixes: 116530289 Test: builds Change-Id: I220ece0d6751839fe764ff91fd7bd20c50104f8f
2018-09-01 03:14:16 +02:00
face u:object_r:face_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
fingerprint u:object_r:fingerprint_service:s0
Declare new Fonts service Merged-In: Id2b849d7fa22989225066ebe487fc98d319743ea Bug: 34190490 Test: CTS in internal master Change-Id: I27ab62469f3a405c59eda1a2a249899e845bed56
2017-01-23 12:10:24 +01:00
font u:object_r:font_service:s0
Add selinux policy for fingerprintd Change-Id: Ibcb714248c28abf21272986facaade376dcbd7ef
2015-05-13 00:16:06 +02:00
android.hardware.fingerprint.IFingerprintDaemon u:object_r:fingerprintd_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
gfxinfo u:object_r:gfxinfo_service:s0
Add graphicsstats service Change-Id: I156b139b57f46c695ece35b7b26a3087d87b25df
2015-03-23 15:56:37 +01:00
graphicsstats u:object_r:graphicsstats_service:s0
[SEPolicy] Name GPU service back to "gpu" Changed the GPU service name back to be compatible with external engines/tools' usage of vkjson cmd. Bug: 118347356 Test: adb shell cmd gpu vkjson Change-Id: Ie432fd8be63d33070ad037c509467c8367b42d39
2018-11-16 20:06:52 +01:00
gpu u:object_r:gpu_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
hardware u:object_r:hardware_service:s0
Renamed hardwareproperties to hardware_properties Bug: 27531271 Change-Id: I3c5eee86d09696373ab155f93ba6c85da224cb51
2016-03-09 18:13:11 +01:00
hardware_properties u:object_r:hardware_properties_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
hdmi_control u:object_r:hdmi_control_service:s0
Add ians service contexts Add ians service contexts Bug: 113106744 Test: verified from service list that ianas is registered Change-Id: Iea653416ffa45cba07a544826e0a2395d31cedca Merged-In: Iea653416ffa45cba07a544826e0a2395d31cedca
2018-08-29 05:47:54 +02:00
ians u:object_r:radio_service:s0
Add idmap2 and idmap2d Bug: 78815803 Test: builds, boots Test: manual: adb shell idmap2 create ... Test: manual: adb shell ps | grep -e idmap2d Change-Id: I60852e15d99329896ff9de6559d1e7cd1c67e33d
2018-06-15 08:08:19 +02:00
idmap u:object_r:idmap_service:s0
Add incident command and incidentd daemon se policy. Test: adb shell incident Bug: 31122534 Change-Id: I4ac9c9ab86867f09b63550707673149fe60f1906
2016-11-21 08:23:04 +01:00
incident u:object_r:incident_service:s0
Add SELinux rules for service_manager. Add a service_mananger class with the verb add. Add a type that groups the services for each of the processes that is allowed to start services in service.te and an attribute for all services controlled by the service manager. Add the service_contexts file which maps service name to target label. Bug: 12909011 Change-Id: I017032a50bc90c57b536e80b972118016d340c7d
2014-06-06 00:52:02 +02:00
inputflinger u:object_r:inputflinger_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
input_method u:object_r:input_method_service:s0
input u:object_r:input_service:s0
Rules for new installd Binder interface. Most of this CL mirrors what we've already done for the "netd" Binder interface, while sorting a few lists alphabetically. Migrating installd to Binder will allow us to get rid of one of the few lingering text-based command protocols, improving system maintainability and security. Test: builds, boots Bug: 13758960, 30944031 Change-Id: I59b89f916fd12e22f9813ace6673be38314c97b7
2016-12-05 19:19:11 +01:00
installd u:object_r:installd_service:s0
iorapd: Add new binder service iorapd. This daemon is very locked down. Only system_server can access it. Bug: 72170747 Change-Id: I7b72b9191cb192be96001d84d067c28292c9688f
2018-10-05 23:48:29 +02:00
iorapd u:object_r:iorapd_service:s0
Preemptively adding services for pending commits. Adding services to service_contexts for the pending commits Icf5997dd6a6ba5e1de675cf5f4334c78c2c037f1 and Ibe79be30b80c18ec45ff69db7527c7a4adf0ee08. Change-Id: Ie898866d1ab3abba6211943e87bcec77ba568567
2014-06-27 22:20:15 +02:00
iphonesubinfo_msim u:object_r:radio_service:s0
iphonesubinfo2 u:object_r:radio_service:s0
Add SELinux rules for service_manager. Add a service_mananger class with the verb add. Add a type that groups the services for each of the processes that is allowed to start services in service.te and an attribute for all services controlled by the service manager. Add the service_contexts file which maps service name to target label. Bug: 12909011 Change-Id: I017032a50bc90c57b536e80b972118016d340c7d
2014-06-06 00:52:02 +02:00
iphonesubinfo u:object_r:radio_service:s0
Add missing services to service_contexts. Add missing services to service_contexts that we did not include in earlier patch that added SELinux checks in service_manager. Change-Id: I889d999bf0b745bfcb75a3553b207777dc5700b7
2014-06-17 17:13:36 +02:00
ims u:object_r:radio_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
imms u:object_r:imms_service:s0
New service: intelligence_service Bug: 111276913 Test: manual verification Change-Id: Icb309bb07e4e4b39cdc912b1d3dc1ece9cb55f5f
2018-08-31 00:09:50 +02:00
intelligence u:object_r:intelligence_service:s0
Add IpSecService SEPolicy Add a new type and context for IpSec to system SEPolicy Bug: 35923241 Test: service starts + talks to NetD Change-Id: I69356c8525b426d344fcc4858fc499ab12405b20 (cherry picked from commit 641b1a7ae0fde04424d7725165e91d1cde62390a)
2017-03-02 21:25:58 +01:00
ipsec u:object_r:ipsec_service:s0
Add placeholder sepolicy for iris and face See aosp/660242 and aosp/608396 Fixes: 116530289 Test: builds Change-Id: I220ece0d6751839fe764ff91fd7bd20c50104f8f
2018-09-01 03:14:16 +02:00
iris u:object_r:iris_service:s0
Preemptively adding services for pending commits. Adding services to service_contexts for the pending commits Icf5997dd6a6ba5e1de675cf5f4334c78c2c037f1 and Ibe79be30b80c18ec45ff69db7527c7a4adf0ee08. Change-Id: Ie898866d1ab3abba6211943e87bcec77ba568567
2014-06-27 22:20:15 +02:00
isms_msim u:object_r:radio_service:s0
isms2 u:object_r:radio_service:s0
Add SELinux rules for service_manager. Add a service_mananger class with the verb add. Add a type that groups the services for each of the processes that is allowed to start services in service.te and an attribute for all services controlled by the service manager. Add the service_contexts file which maps service name to target label. Bug: 12909011 Change-Id: I017032a50bc90c57b536e80b972118016d340c7d
2014-06-06 00:52:02 +02:00
isms u:object_r:radio_service:s0
Add missing services to service_contexts. Add missing services to service_contexts that we did not include in earlier patch that added SELinux checks in service_manager. Change-Id: I889d999bf0b745bfcb75a3553b207777dc5700b7
2014-06-17 17:13:36 +02:00
isub u:object_r:radio_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
jobscheduler u:object_r:jobscheduler_service:s0
launcherapps u:object_r:launcherapps_service:s0
location u:object_r:location_service:s0
lock_settings u:object_r:lock_settings_service:s0
Add looper_stats_service to SE policy. Test: Built and flashed an image. Bug: 113651685 Change-Id: Ide239432ea8a5701d91c00edd06ad3e52560a3f7
2018-08-30 14:04:55 +02:00
looper_stats u:object_r:looper_stats_service:s0
service_contexts: add aaudio service Test: test_aaudio.cpp Bug: 33398120 Change-Id: I0712f60c898136154d729ceb1103ee021cc6ab82 Signed-off-by: Phil Burk <philburk@google.com> (cherry picked from commit 8b9d93f24505a2737f156f3b20a0fca3af8ac345)
2017-02-02 20:53:20 +01:00
media.aaudio u:object_r:audioserver_service:s0
Add rules for running audio services in audioserver audioserver has the same rules as mediaserver so there is no loss of rights or permissions. media.log moves to audioserver. TBD: Pare down permissions. Bug: 24511453 Change-Id: I0fff24c14b712bb3d498f75e8fd66c2eb795171d
2015-09-09 19:48:04 +02:00
media.audio_flinger u:object_r:audioserver_service:s0
media.audio_policy u:object_r:audioserver_service:s0
selinux: Update policies for cameraserver Update policies for cameraserver so it has the same permissions as mediaserver. Bug: 24511454 Change-Id: I1191e2ac36c00b942282f8dc3db9903551945adb
2015-12-04 01:10:05 +01:00
media.camera u:object_r:cameraserver_service:s0
camera: Add AIDL interface for CameraServiceProxy. - Update selinux policy for CameraServiceProxy. Bug: 21267484 Change-Id: Ib821582794ddd1e3574b5dc6c79f7cb197b57f10
2015-05-20 02:26:31 +02:00
media.camera.proxy u:object_r:cameraproxy_service:s0
Add rules for running audio services in audioserver audioserver has the same rules as mediaserver so there is no loss of rights or permissions. media.log moves to audioserver. TBD: Pare down permissions. Bug: 24511453 Change-Id: I0fff24c14b712bb3d498f75e8fd66c2eb795171d
2015-09-09 19:48:04 +02:00
media.log u:object_r:audioserver_service:s0
Add SELinux rules for service_manager. Add a service_mananger class with the verb add. Add a type that groups the services for each of the processes that is allowed to start services in service.te and an attribute for all services controlled by the service manager. Add the service_contexts file which maps service name to target label. Bug: 12909011 Change-Id: I017032a50bc90c57b536e80b972118016d340c7d
2014-06-06 00:52:02 +02:00
media.player u:object_r:mediaserver_service:s0
rename mediaanalytics->mediametrics, wider access reflect the change from "mediaanalytics" to "mediametrics" Also incorporates a broader access to the service -- e.g. anyone. This reflects that a number of metrics submissions come from application space and not only from our controlled, trusted media related processes. The metrics service (in another commit) checks on the source of any incoming metrics data and limits what is allowed from unprivileged clients. Bug: 34615027 Test: clean build, service running and accessible Change-Id: I657c343ea1faed536c3ee1940f1e7a178e813a42
2017-01-24 21:53:45 +01:00
media.metrics u:object_r:mediametrics_service:s0
Update selinux policies for mediaextractor process Change-Id: If761e0370bf9731a2856d0de2c6a6af1671143bd
2015-09-22 19:56:03 +02:00
media.extractor u:object_r:mediaextractor_service:s0
Allow mediaextractor to load libraries from apk_data_file This is an experimental feature only on userdebug and eng build. Test: play MP4 file. install & uninstall media update apk. Bug: 67908547 Change-Id: I513cdbfda962f00079e886b7a42f9928e81f6474
2017-11-06 20:19:07 +01:00
media.extractor.update u:object_r:mediaextractor_update_service:s0
selinux rules for codec process Bug: 22775369 Change-Id: Ic6abe3d0e18ba6f7554d027e0ec05fd19011709b
2016-02-03 01:10:37 +01:00
media.codec u:object_r:mediacodec_service:s0
add media.codec.update service Add a service in mediaswcodec to load updated codecs, and restrict it to userdebug/eng. Reuse existing mediaextractor_update_service since the codec update service is identical, this avoids adding a new one for now as we may not need the service anymore after switching to APEX. Bug: 111407413 Bug: 117290290 Change-Id: Ia75256f47433bd13ed819c70c1fb34ecd5d507b4
2018-08-31 23:42:11 +02:00
media.codec.update u:object_r:mediaextractor_update_service:s0
media: allow media server to add resource manager service Bug: 19620911 Change-Id: I170b9d46bd49b1ad8bac6e37d0745893d79c14fe
2015-03-12 23:54:37 +01:00
media.resource_manager u:object_r:mediaserver_service:s0
Add rules for running audio services in audioserver audioserver has the same rules as mediaserver so there is no loss of rights or permissions. media.log moves to audioserver. TBD: Pare down permissions. Bug: 24511453 Change-Id: I0fff24c14b712bb3d498f75e8fd66c2eb795171d
2015-09-09 19:48:04 +02:00
media.sound_trigger_hw u:object_r:audioserver_service:s0
Add mediadrm service Part of media security hardening This is an intermediate step toward moving mediadrm to a new service separate from mediaserver. This first step allows mediadrmservice to run based on the system property media.mediadrmservice.enable so it can be selectively enabled on devices that support using native_handles for secure buffers. bug: 22990512 Change-Id: I2208c1e87a6bd8d5bfaed06b1fdcb0509c11cff2
2016-02-12 18:05:42 +01:00
media.drm u:object_r:mediadrmserver_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
media_projection u:object_r:media_projection_service:s0
Allow mediaserver to access media_resource_monitor Bug: 26175834 Change-Id: I49244f8e6165ea5a871955f07b3c4ea40cbd7c59
2015-12-15 06:19:21 +01:00
media_resource_monitor u:object_r:media_session_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
media_router u:object_r:media_router_service:s0
media_session u:object_r:media_session_service:s0
meminfo u:object_r:meminfo_service:s0
midi u:object_r:midi_service:s0
mount u:object_r:mount_service:s0
Rename the netd service from "android.net.INetd" to "netd". Bug: 27239233 Change-Id: Icc9d14008d2ff6334a8ec66805f7289aedd5d97d
2016-02-23 14:21:22 +01:00
netd u:object_r:netd_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
netpolicy u:object_r:netpolicy_service:s0
netstats u:object_r:netstats_service:s0
network_management u:object_r:network_management_service:s0
network_score u:object_r:network_score_service:s0
Add NetworkTimeUpdateService NetworkTimeUpdateService has been registered as a system service, so that its dump state can be included into bugreports. Bug: 23983739 Change-Id: I0d364009ba4630dcfd1d22c647195e33eedaa4e0
2016-02-27 02:21:47 +01:00
network_time_update_service u:object_r:network_time_update_service:s0
Add SELinux rules for service_manager. Add a service_mananger class with the verb add. Add a type that groups the services for each of the processes that is allowed to start services in service.te and an attribute for all services controlled by the service manager. Add the service_contexts file which maps service name to target label. Bug: 12909011 Change-Id: I017032a50bc90c57b536e80b972118016d340c7d
2014-06-06 00:52:02 +02:00
nfc u:object_r:nfc_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
notification u:object_r:notification_service:s0
SE Linux policies for OemLockService Bug: 34766843 Test: gts-tradefed run gts -m GtsBootloaderServiceTestCases -t \ com.google.android.bootloader.gts.BootloaderServiceTest Change-Id: I8b939e0dbe8351a54f20c303921f606c3462c17d
2017-02-17 14:51:32 +01:00
oem_lock u:object_r:oem_lock_service:s0
Selinux: introduce policy for OTA preopt Add permissions to dex2oat, introduce otapreopt binary and otadexopt service. Bug: 25612095 Change-Id: I80fcba2785e80b2931d7d82bb07474f6cd0099f7
2015-12-03 06:23:30 +01:00
otadexopt u:object_r:otadexopt_service:s0
Add service 'overlay' to service_contexts The 'overlay' service is the Overlay Manager Service, which tracks packages and their Runtime Resource Overlay overlay packages. Change-Id: I897dea6a32c653d31be88a7b3fc56ee4538cf178 Co-authored-by: Martin Wallgren <martin.wallgren@sonymobile.com> Signed-off-by: Zoran Jovanovic <zoran.jovanovic@sonymobile.com> Bug: 31052947 Test: boot the Android framework
2015-06-22 09:31:25 +02:00
overlay u:object_r:overlay_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
package u:object_r:package_service:s0
Sync internal master and AOSP sepolicy. Bug: 37916906 Test: Builds 'n' boots. Change-Id: Ia1d86264446ebecc1ca79f32f11354921bc77668 Merged-In: I208ec6a864127a059fb389417a9c6b259d7474cb
2017-09-26 21:58:29 +02:00
package_native u:object_r:package_native_service:s0
Sepolicy: Introduce perfprofd binder service Add policy for the perfprofd binder service. For now, only allow su to talk to it. Test: m Change-Id: I690f75460bf513cb326314cce633fa25453515d6
2017-12-22 22:05:28 +01:00
perfprofd u:object_r:perfprofd_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
permission u:object_r:permission_service:s0
persistent_data_block u:object_r:persistent_data_block_service:s0
Preemptively adding services for pending commits. Adding services to service_contexts for the pending commits Icf5997dd6a6ba5e1de675cf5f4334c78c2c037f1 and Ibe79be30b80c18ec45ff69db7527c7a4adf0ee08. Change-Id: Ie898866d1ab3abba6211943e87bcec77ba568567
2014-06-27 22:20:15 +02:00
phone_msim u:object_r:radio_service:s0
phone1 u:object_r:radio_service:s0
phone2 u:object_r:radio_service:s0
Add SELinux rules for service_manager. Add a service_mananger class with the verb add. Add a type that groups the services for each of the processes that is allowed to start services in service.te and an attribute for all services controlled by the service manager. Add the service_contexts file which maps service name to target label. Bug: 12909011 Change-Id: I017032a50bc90c57b536e80b972118016d340c7d
2014-06-06 00:52:02 +02:00
phone u:object_r:radio_service:s0
Add CAP_IPC_LOCK and pinner to system_server Add pinner service to system_service services. Add CAP_IPC_LOCK permissions to system_server in order to allow system_server to pin more memory than the lockedmem ulimit. bug 28251566 Change-Id: I990c73d25fce4f2cc9a2db0015aa238fa7b0e984
2016-05-02 20:04:39 +02:00
pinner u:object_r:pinner_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
power u:object_r:power_service:s0
print u:object_r:print_service:s0
Add security policy for ProcessInfoService. Bug: 19186859 Change-Id: Ic08858f346d6b66e7bfc9da6faa2c6e38d9b2e82
2015-01-29 03:15:01 +01:00
processinfo u:object_r:processinfo_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
procstats u:object_r:procstats_service:s0
Add missing services to service_contexts. Add missing services related to battery, bluetooth, time, and radio to service_contexts. Change-Id: I8bf05feb173d49637048c779757013806837fede
2014-06-26 21:36:43 +02:00
radio.phonesubinfo u:object_r:radio_service:s0
radio.phone u:object_r:radio_service:s0
radio.sms u:object_r:radio_service:s0
Add recovery service. RecoverySystemService is separated from PowerManagerService as a dedicated system service to handle recovery related requests (such as invoking uncrypt to uncrypt an OTA package on /data or to set up / clear the bootloader control block (i.e. /misc) and etc). The matching CL in frameworks/base is in: Change-Id: Ic606fcf5b31c54ce54f0ab12c1768fef0fa64560. Bug: 26830925 Change-Id: Iee0583c458f784bfa422d0f7af5d1f2681d9609e (cherry picked from commit 65b5fde912285ebeeefc9c7486f4453dd86d994f)
2016-02-03 21:43:58 +01:00
recovery u:object_r:recovery_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
restrictions u:object_r:restrictions_service:s0
Add SELinux service for RoleManagerService Test: ensure no build failures; add RoleManagerService as a boot phase ensure no SecurityException in logcat on boot Change-Id: Ia0803c0fb084fe2b12f5c20f5e46354d0dd1aedf
2018-11-09 02:37:45 +01:00
role u:object_r:role_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
rttmanager u:object_r:rttmanager_service:s0
samplingprofiler u:object_r:samplingprofiler_service:s0
scheduling_policy u:object_r:scheduling_policy_service:s0
search u:object_r:search_service:s0
SE Policy for Secure Element app and Secure Element HAL Test: App startup on boot Change-Id: I7740aafc088aadf676328e3f1bb8db5175d97102
2018-01-04 19:33:20 +01:00
secure_element u:object_r:secure_element_service:s0
fix lax service context lookup (II) As fallout from the corresponding fix in libselinux, this patch adds the missing services without changing semantics. Test: bullhead builds and boots Bug: 31353148 Change-Id: I21026c9435ffef956a59d61c4903174ac7b1ef95
2016-09-08 14:15:19 +02:00
sec_key_att_app_id_provider u:object_r:sec_key_att_app_id_provider_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
sensorservice u:object_r:sensorservice_service:s0
serial u:object_r:serial_service:s0
servicediscovery u:object_r:servicediscovery_service:s0
Allow new settings system service. Test: N/A Change-Id: Ib3c85118bf752152f5ca75ec13371073fc2873cc
2016-10-21 00:57:39 +02:00
settings u:object_r:settings_service:s0
Add new system service "shortcut". Bug 27325877 Change-Id: Idf2f9ae816e1f3d822a6286a4cf738c14e29a45e
2016-03-02 00:11:41 +01:00
shortcut u:object_r:shortcut_service:s0
Preemptively adding services for pending commits. Adding services to service_contexts for the pending commits Icf5997dd6a6ba5e1de675cf5f4334c78c2c037f1 and Ibe79be30b80c18ec45ff69db7527c7a4adf0ee08. Change-Id: Ie898866d1ab3abba6211943e87bcec77ba568567
2014-06-27 22:20:15 +02:00
simphonebook_msim u:object_r:radio_service:s0
simphonebook2 u:object_r:radio_service:s0
Add SELinux rules for service_manager. Add a service_mananger class with the verb add. Add a type that groups the services for each of the processes that is allowed to start services in service.te and an attribute for all services controlled by the service manager. Add the service_contexts file which maps service name to target label. Bug: 12909011 Change-Id: I017032a50bc90c57b536e80b972118016d340c7d
2014-06-06 00:52:02 +02:00
simphonebook u:object_r:radio_service:s0
sip u:object_r:radio_service:s0
Add selinux for slice service Test: make/sync Bug: 68751119 Change-Id: Ie3c60ff68b563cef07f20d15f298d6b62e9356bc
2017-12-04 20:41:54 +01:00
slice u:object_r:slice_service:s0
Setting up SELinux policy for statsd and stats service Bug: 63757906 Test: manual testing conducted Change-Id: Id03413ce82b5646d4bceddc59e16c7d5ee5bc193
2017-12-19 00:14:33 +01:00
stats u:object_r:stats_service:s0
Adding statscompanion_service and a dontaudit for find/add Instead of removing the denial generating code, a dontaudit and a service label will be provided so that the team working on this new feature doesn't have to get slowed up with local revision patches. The dontaudit should be removed upon resolution of the linked bug. Bug: 67468181 Test: statscompanion denials aren't audited Change-Id: Ib4554a7b6c714e7409ea504f5d0b82d5e1283cf7
2017-10-24 01:25:11 +02:00
statscompanion u:object_r:statscompanion_service:s0
Allow "soundtrigger" system service to run. In the same process as voiceinteraction. Please see related CL ag/852049 Bug: 22860713 Change-Id: I43ebfdba2aafb151dd7db0814570027e1164508a
2016-01-26 03:22:07 +01:00
soundtrigger u:object_r:voiceinteraction_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
statusbar u:object_r:statusbar_service:s0
Storaged permissions for task I/O Allow storaged to read /proc/[pid]/io Grant binder access to storaged Add storaged service Grant storaged_exec access to dumpstate Grant storaged binder_call to dumpstate Bug: 32221677 Change-Id: Iecc9dba266c5566817a99ac6251eb943a0bac630
2016-07-01 21:18:54 +02:00
storaged u:object_r:storaged_service:s0
storaged: add storaged_pri service "storaged" service will be used by external clients, e.g. vold, dumpsys "storaged_pri" service will only be used by storaged cmdline. Bug: 63740245 Change-Id: I7a60eb4ce321aced9589bbb8474d2d9e75ab7042 (cherry picked from commit 37ab7c0917b26f8e1d7f4ff865838c5488b0b0af)
2017-10-16 22:57:06 +02:00
storaged_pri u:object_r:storaged_service:s0
Define policy for new StorageStatsManager API. Test: builds Bug: 32206268 Change-Id: I236105b029178f96da519c2295c66c686dcae7cb
2017-01-11 02:09:13 +01:00
storagestats u:object_r:storagestats_service:s0
Add SELinux rules for service_manager. Add a service_mananger class with the verb add. Add a type that groups the services for each of the processes that is allowed to start services in service.te and an attribute for all services controlled by the service manager. Add the service_contexts file which maps service name to target label. Bug: 12909011 Change-Id: I017032a50bc90c57b536e80b972118016d340c7d
2014-06-06 00:52:02 +02:00
SurfaceFlinger u:object_r:surfaceflinger_service:s0
Add rules for system_update service. system_update service manages system update information: system updater (priv_app) publishes the pending system update info through the service, while other apps can read the info accordingly (design doc in go/pi-ota-platform-api). This CL adds the service type, and grants priv_app to access the service. Bug: 67437079 Test: Build and flash marlin image. The system_update service works. Change-Id: I7a3eaee3ecd3e2e16b410413e917ec603566b375
2017-10-17 06:57:12 +02:00
system_update u:object_r:system_update_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
task u:object_r:task_service:s0
Add system_api_service and app_api_service attributes. System services differ in designed access level. Add attributes reflecting this distinction and label services appropriately. Begin moving access to the newly labeled services by removing them from tmp_system_server_service into the newly made system_server_service attribute. Reflect the move of system_server_service from a type to an attribute by removing access to system_server_service where appropriate. Change-Id: I7fd06823328daaea6d6f96e4d6bd00332382230b
2015-04-03 01:50:08 +02:00
telecom u:object_r:telecom_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
telephony.registry u:object_r:registry_service:s0
Declare new textclassification system service. Bug: 34781862 Test: none Change-Id: Ie628dca592a68ed67a68dda2f3d3e0516e995c80
2017-02-04 05:09:28 +01:00
textclassification u:object_r:textclassification_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
textservices u:object_r:textservices_service:s0
selinux changes to add time detector service This commit contains the changes needed to add the new time detector system server service. Bug: 78217059 Test: make / booted device Change-Id: I7cfaac6cac876e4aa73e8af1aa5f837117bb9ad7
2018-05-30 15:44:47 +02:00
time_detector u:object_r:timedetector_service:s0
Enable the TimeZoneManagerService Add policy changes to enable a new service. The service is currently switched off in config, but this change is needed before it could be enabled. Bug: 31008728 Test: make droid Merged-In: I29c4509304978afb2187fe2e7f401144c6c3b4c6 Change-Id: I29c4509304978afb2187fe2e7f401144c6c3b4c6
2017-01-11 17:27:02 +01:00
timezone u:object_r:timezone_service:s0
sepolicy entries for time zone detector service Add sepolicy entries for the new time zone detector service. The timezonedetector_service will be called from the telephony process. Bug: 78217059 Test: make / booted device Change-Id: Ib719a4bb444b2af7dd71910fb0bd12992df9d88c
2018-06-19 12:36:23 +02:00
time_zone_detector u:object_r:timezonedetector_service:s0
Sync internal master and AOSP sepolicy. Bug: 37916906 Test: Builds 'n' boots. Change-Id: Ia1d86264446ebecc1ca79f32f11354921bc77668 Merged-In: I208ec6a864127a059fb389417a9c6b259d7474cb
2017-09-26 21:58:29 +02:00
thermalservice u:object_r:thermal_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
trust u:object_r:trust_service:s0
tv_input u:object_r:tv_input_service:s0
uimode u:object_r:uimode_service:s0
updatelock u:object_r:updatelock_service:s0
Added sepolicy for uri_grants service Bug: 80414790 Test: boots Change-Id: I15233721fa138e0fdf1a30f66d52b64cbab18b81
2018-07-22 08:21:08 +02:00
uri_grants u:object_r:uri_grants_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
usagestats u:object_r:usagestats_service:s0
usb u:object_r:usb_service:s0
user u:object_r:user_service:s0
vibrator u:object_r:vibrator_service:s0
Add policies for new services. Bug: 30989383 Bug: 34731101 Test: manual Change-Id: Icf9d48568b505c6b788f2f5f456f2d709969fbeb
2017-02-10 00:15:11 +01:00
virtual_touchpad u:object_r:virtual_touchpad_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
voiceinteraction u:object_r:voiceinteraction_service:s0
Sync internal master and AOSP sepolicy. Bug: 37916906 Test: Builds 'n' boots. Change-Id: Ia1d86264446ebecc1ca79f32f11354921bc77668 Merged-In: I208ec6a864127a059fb389417a9c6b259d7474cb
2017-09-26 21:58:29 +02:00
vold u:object_r:vold_service:s0
VR: Add sepolicy for VR HWC service VR HWC is being split out of VR Window Manager. It creates a HW binder interface used by SurfaceFlinger which implements the HWComposer HAL and a regular binder interface which will be used by a system app to receive the SurfaceFlinger output. Bug: b/36051907 Test: Ran in permissive mode and ensured no permission errors show in logcat. Change-Id: If1360bc8fa339a80100124c4e89e69c64b29d2ae
2017-03-14 21:26:17 +01:00
vr_hwc u:object_r:vr_hwc_service:s0
Selinux changes for vr flinger vsync service Add selinux policy for the new Binder-based vr flinger vsync service. Bug: 72890037 Test: - Manually confirmed that I can't bind to the new vsync service from a normal Android application, and system processes (other than vr_hwc) are prevented from connecting by selinux. - Confirmed the CTS test android.security.cts.SELinuxHostTest#testAospServiceContexts, when built from the local source tree with this CL applied, passes. - Confirmed the CTS test android.cts.security.SELinuxNeverallowRulesTest#testNeverallowRules521, when built from the local source tree with this CL applied, passes. Change-Id: Ib7a6bfcb1c2ebe1051f3accc18b481be1b188b06
2018-07-14 02:17:01 +02:00
vrflinger_vsync u:object_r:vrflinger_vsync_service:s0
Update selinux policy for VrManager AIDL. Bug: 27884853 Change-Id: I097306a324bdc25c5d22868f0342e175ce0dbb9a
2016-04-06 03:12:21 +02:00
vrmanager u:object_r:vr_manager_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
wallpaper u:object_r:wallpaper_service:s0
webviewupdate u:object_r:webviewupdate_service:s0
wifip2p u:object_r:wifip2p_service:s0
wifiscanner u:object_r:wifiscanner_service:s0
wifi u:object_r:wifi_service:s0
sepolicy: add sepolicy binder support for wificond This allows wificond to publish binder interface using service manager. Denial warnings: wificond: type=1400 audit(0.0:8): avc: denied { call } for scontext=u:r:wificond:s0 tcontext=u:r:servicemanager:s0 tclass=binder permissive=1 wificond: type=1400 audit(0.0:9): avc: denied { transfer } for scontext=u:r:wificond:s0 tcontext=u:r:servicemanager:s0 tclass=binder permissive=1 servicemanager: type=1400 audit(0.0:10): avc: denied { search } for name="6085" dev="proc" ino=40626 scontext=u:r:servicemanager:s0 tcontext=u:r:wificond:s0 tclass=dir permissive=1 servicemanager: type=1400 audit(0.0:11): avc: denied { read } for name="current" dev="proc" ino=40641 scontext=u:r:servicemanager:s0 tcontext=u:r:wificond:s0 tclass=file permissive=1 servicemanager: type=1400 audit(0.0:12): avc: denied { open } for path="/proc/6085/attr/current" dev="proc" ino=40641 scontext=u:r:servicemanager:s0 tcontext=u:r:wificond:s0 tclass=file permissive=1 servicemanager: type=1400 audit(0.0:13): avc: denied { getattr } for scontext=u:r:servicemanager:s0 tcontext=u:r:wificond:s0 tclass=process permissive=1 SELinux : avc: denied { add } for service=wificond pid=6085 uid=0 scontext=u:r:wificond:s0 tcontext=u:object_r:wifi_service:s0 tclass=service_manager permissive=1 BUG=28867093 TEST=compile TEST=use a client to call wificond service through binder Change-Id: I9312892caff171f17b04c30a415c07036b39ea7f (cherry picked from commit d56bcb1c5452c8dcdda7e4ef5d0f44b91b6bb08b)
2016-06-03 19:08:56 +02:00
wificond u:object_r:wificond_service:s0
[NAN-AWARE] Add Aware service Add Aware service - new name for NAN. But do not remove NAN yet. Enables smooth transition. Bug: 32263750 Test: device boots and all Wi-Fi unit-tests pass Change-Id: Ieb9f1ebf1d2f31ee27f228562b4601023da5282d
2016-11-04 21:37:17 +01:00
wifiaware u:object_r:wifiaware_service:s0
[RTT] Update Wi-Fi RTT service name Finalize Wi-Fi RTT service name per API review. Note: CL 1 of 2 - adding new entry here, will remove old entry in next CL. Bug: 65108607 Test: integration tests Change-Id: I065ce9d570510180fa8c8f09e1025ac795706405
2018-01-05 03:10:36 +01:00
wifirtt u:object_r:rttmanager_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
window u:object_r:window_service:s0
Add SELinux rules for service_manager. Add a service_mananger class with the verb add. Add a type that groups the services for each of the processes that is allowed to start services in service.te and an attribute for all services controlled by the service manager. Add the service_contexts file which maps service name to target label. Bug: 12909011 Change-Id: I017032a50bc90c57b536e80b972118016d340c7d
2014-06-06 00:52:02 +02:00
* u:object_r:default_android_service:s0
Reference in a new issue Copy permalink