tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
platform_system_sepolicy/private/service_contexts

247 lines
18 KiB
Text
Raw Normal View History

Add rules for Lights AIDL HAL Test: manual; yukawa and cuttlefish; adb logcat | grep -i avc Bug: 142230898 Change-Id: I9f576511d1fc77c5f0ad3cf1b96b038b301773d7
2020-01-21 16:37:44 +01:00
android.hardware.light.ILights/default u:object_r:hal_light_service:s0
stable aidl Power HAL policy Test: boot and dumpsys -l Change-Id: I58022c9e0c24ba4e2d695acf63375c9f74c51b22
2020-01-10 20:42:33 +01:00
android.hardware.power.IPower/default u:object_r:hal_power_service:s0
android.hardware.rebootescrow.IRebootEscrow/default u:object_r:hal_rebootescrow_service:s0
android.hardware.vibrator.IVibrator/default u:object_r:hal_vibrator_service:s0
stable aidl vibrator policy Bug: 141828236 Test: boot, dumpsys -l Change-Id: Id3fc8724238883116e840794309efbf6c91226c9
2019-10-26 00:04:45 +02:00
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
accessibility u:object_r:accessibility_service:s0
account u:object_r:account_service:s0
activity u:object_r:activity_service:s0
Added sepolicy for activity_task service Bug: 80414790 Test: boots Change-Id: I3d6bb4e7da9d697ec8ff7502880543be89aee349
2018-05-31 00:26:41 +02:00
activity_task u:object_r:activity_task_service:s0
Add ADB system service ADB is being separated from USB service since it's not tied to the USB transport. This duplicates the usb_service's settings to adb_service for this purpose. Bug: 63820489 Test: make Change-Id: Idbcfbe470d7568f9cba51f0c8d4a8ee9503db93d
2018-01-25 08:12:39 +01:00
adb u:object_r:adb_service:s0
Add aidl_lazy_test_server This is a test service for testing dynamic start/stop of AIDL services. In order to test realistic use cases with SELinux enabled, it requires the same permissions as a regular service. Bug: 147153962 Test: aidl_lazy_test aidl_lazy_test_1 aidl_lazy_test_2 Change-Id: Ifc3b2eaefba9c06c94f9cf24b4474107d4e26563
2020-01-04 01:32:07 +01:00
aidl_lazy_test_1 u:object_r:aidl_lazy_test_service:s0
aidl_lazy_test_2 u:object_r:aidl_lazy_test_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
alarm u:object_r:alarm_service:s0
update_engine: Allow to access bootctrl_block_device. update_engine needs to access bootctrl_block_device to get and set the slot to boot. avc: denied { write } for name="mmcblk0boot1" dev="tmpfs" ino=1266 scontext=u:r:update_engine:s0 tcontext=u:object_r:bootctrl_block_device:s0 tclass=blk_file avc: denied { open } for path="/dev/block/mmcblk0boot1" dev="tmpfs" ino=1266 scontext=u:r:update_engine:s0 tcontext=u:object_r:bootctrl_block_device:s0 tclass=blk_file Also track the name change of the native binder service. avc: denied { add } for service=android.os.UpdateEngineService pid=210 uid=0 scontext=u:r:update_engine:s0 tcontext=u:object_r:default_android_service:s0 tclass=service_manager Bug: 27106053 Change-Id: Idbfef18578489db33fead0721e8f26d63db5ce09 (cherry picked from commit 3ec34ceb43b15c30e9c7bf1720ebea24f868d07a)
2016-02-09 23:12:58 +01:00
android.os.UpdateEngineService u:object_r:update_engine_service:s0
Add SELinux rules for service_manager. Add a service_mananger class with the verb add. Add a type that groups the services for each of the processes that is allowed to start services in service.te and an attribute for all services controlled by the service manager. Add the service_contexts file which maps service name to target label. Bug: 12909011 Change-Id: I017032a50bc90c57b536e80b972118016d340c7d
2014-06-06 00:52:02 +02:00
android.security.keystore u:object_r:keystore_service:s0
SELinux permissions for gatekeeper TEE proxy sets up: - execute permissions - binder permission (system_server->gatekeeper->keystore) - prevents dumpstate and shell from finding GK binder service - neverallow rules for prohibited clients Change-Id: I1817933a91de625db469a20c7a4c8e2ca46efa1e
2015-04-04 01:46:33 +02:00
android.service.gatekeeper.IGateKeeperService u:object_r:gatekeeper_service:s0
Add app_binding system service Bug: 109809543 Test: Build and boot with the new service in the internal branch. Change-Id: Iaee365771c3e8e5b8f5f3b6112bbf902c6bb02bd
2018-09-05 02:13:16 +02:00
app_binding u:object_r:app_binding_service:s0
Add sepolicy for AppIntegrityService. CL that adds the service: http://ag/9554748 BUG:145674997 Test: Manually flash the device. Without this change, the devices goes into a bootloop (http://gpaste/5033431010377728) if I uncommit the guard in http://ag/c/platform/frameworks/base/+/9652133/21/services/core/java/com/android/server/integrity/AppIntegrityManagerService.java Change-Id: Ib2daf9191900d94abeae207e18a77a5914d14783
2019-12-05 12:24:54 +01:00
app_integrity u:object_r:app_integrity_service:s0
New system service: app_prediction_service - Update policy for new system service, used for SystemUI/Apps to present predicted apps in their UI. Bug: 111701043 Test: manual verification Change-Id: Ia3b5db987097d2d71bf774ca550041e03214471d
2018-11-19 22:58:19 +01:00
app_prediction u:object_r:app_prediction_service:s0
Add a new system service for app search management. This change app-search-service to sepolicy system service. Bug: 142567528 Test: Manual Change-Id: Ife7b09365d667da0ad370e586af828f8f4423660
2019-11-05 23:27:44 +01:00
app_search u:object_r:app_search_service:s0
Add policy for apexd. apexd is a new daemon for managing APEX packages installed on the device. It hosts a single binder service, "apexservice". Bug: 112455435 Test: builds, binder service can be registered, apexes can be accessed, verified and mounted Change-Id: I634ad100f10b2edcd9a9c0df0d33896fa5d4ed97
2018-08-17 09:35:42 +02:00
apexservice u:object_r:apex_service:s0
Add a new system service "blob_store". Bug: 143559646 Test: manual Change-Id: Id13566e9efc815f4a6ebb7228a1145aa91d6d526
2019-10-29 23:28:20 +01:00
blob_store u:object_r:blob_store_service:s0
sepolicy for gsid Bug: 122556707 Test: gsid starts Change-Id: Ib05ddb79051436f51cd236de04027a3b12ee87a9 Signed-off-by: Sandeep Patil <sspatil@google.com>
2019-01-14 23:38:17 +01:00
gsiservice u:object_r:gsi_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
appops u:object_r:appops_service:s0
appwidget u:object_r:appwidget_service:s0
assetatlas u:object_r:assetatlas_service:s0
Add selinux setting for attention Bug: 126472144 Test: adb shell dumpsys attention Change-Id: Ie421b719c8fc0414ee664055aa5d007c081edf17
2019-03-12 02:40:44 +01:00
attention u:object_r:attention_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
audio u:object_r:audio_service:s0
Add AuthService to sepolicy AuthService is introduced in ag/9700446. Bug: 141025588 Test: can successfully publish AuthService with publishBinderService(...) Change-Id: I0f9fceac0c555d05a29467e4ab1380f389b60af4
2019-11-15 00:32:24 +01:00
auth u:object_r:auth_service:s0
Creates an autofill system service. BUG: 31001899 Test: manual Change-Id: I8d462b40d931310eab26bafa09645ac88f13fc97
2016-10-18 01:25:36 +02:00
autofill u:object_r:autofill_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
backup u:object_r:backup_service:s0
Mark batteryproperties service as app_api_service. Applications do not explicitly request handles to the batteryproperties service, but the BatteryManager obtains a reference to it and uses it for its underlying property queries. Mark it as an app_api_service so that all applications may use this API. Also remove the batterypropreg service label, as this does not appear to be used and may have been a duplication of batteryproperties. As a result, remove the healthd_service type and replace it with a more specific batteryproperties_service type. (cherry-picked from commit: 9ed71eff4bed91653cba393ea6cb42f041d4e257) Bug: 27442760 Change-Id: I537c17c09145b302728377bf856c1147e4cc37e9
2016-03-14 20:21:18 +01:00
batteryproperties u:object_r:batteryproperties_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
batterystats u:object_r:batterystats_service:s0
battery u:object_r:battery_service:s0
Added SELinux policy for BinderCallsStatsService Test: manual Bug: 75318418 Change-Id: I700c1b8b613dba1c99f4fbffdd905c0052c1b2e7
2018-01-11 03:11:22 +01:00
binder_calls_stats u:object_r:binder_calls_stats_service:s0
Rename biometric_prompt_service to biometric_service Bug: 111461540 Bug: 112570477 Test: builds Change-Id: Icc68720ebe931c2d917703b2d34aa0f4eec3f549 Merged-In: Icc68720ebe931c2d917703b2d34aa0f4eec3f549
2018-09-21 05:32:32 +02:00
biometric u:object_r:biometric_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
bluetooth_manager u:object_r:bluetooth_manager_service:s0
Add missing services to service_contexts. Add missing services related to battery, bluetooth, time, and radio to service_contexts. Change-Id: I8bf05feb173d49637048c779757013806837fede
2014-06-26 21:36:43 +02:00
bluetooth u:object_r:bluetooth_service:s0
Add SEPolicy for new Java-based Broadcast Radio service. Bug: b/36863239 Test: manual Change-Id: I7e929926efbb1570ea9723ef3810a511c71dc11a (cherry picked from commit 38f0928fb05793b91651ba9787e4da8c2cd5afd3)
2017-06-22 16:55:16 +02:00
broadcastradio u:object_r:broadcastradio_service:s0
Add sepolicy for BugreportManagerService BUG:111441001 Test: boots Change-Id: I71a54e8335c5ce7f9d97af3dbbd62e663bb66d33
2019-01-11 18:26:10 +01:00
bugreport u:object_r:bugreport_service:s0
Whitelist new carrier config service. This service will be implemented in packages/services/Telephony. Bug: 19483786 Change-Id: Ia9a90bc859108d8657cae551d657e2fcdc261f88
2015-03-25 22:46:54 +01:00
carrier_config u:object_r:radio_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
clipboard u:object_r:clipboard_service:s0
com.android.net.IProxyService u:object_r:IProxyService_service:s0
Remove underscore from Companion service name Fixes: 37536706 Test: Ensure no boot-time error and companion functionality works Change-Id: I80ced92cb62aa10e1847980eb9a169af3bcd21f0
2017-04-20 20:19:16 +02:00
companiondevice u:object_r:companion_device_service:s0
Add rule for platform_compat service Bug: 137769727 Test: m Change-Id: Ib6160a82597198f4a120592293f90ffe1ffb123b
2019-07-12 13:12:30 +02:00
platform_compat u:object_r:platform_compat_service:s0
Add rule for platform_compat_native service. Bug: 138275545 Test: Call the service from dumpsys.cpp (http://aosp/1142055) Change-Id: I259ceb5092d2f1d3e2130ea678ee7fb59cf9e6be
2019-10-14 16:05:41 +02:00
platform_compat_native u:object_r:platform_compat_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
connectivity u:object_r:connectivity_service:s0
New service name for IpConnectivity metrics (cherry picked from commit f412cc623f26c95706e0966daa49207028487281) Bug: 31254800 Change-Id: If8708c8a4e0ea7655f31028881248a14cf2ba5f7
2016-09-09 08:57:24 +02:00
connmetrics u:object_r:connmetrics_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
consumer_ir u:object_r:consumer_ir_service:s0
content u:object_r:content_service:s0
Renamed "intelligence" to "content_capture" Bug: 111276913 Test: manual verification Change-Id: If76dc7bfdad87789a58fc94e0fd280deae1a41ab
2018-12-04 02:35:05 +01:00
content_capture u:object_r:content_capture_service:s0
Adding policy for content suggestions. Cherry-picked from aosp/852612 (commit Ic0b3f85fad24ccedc0a8e9935c198bc8503bb415), and is a manual merge for ag/5836696 (commit I360ce12f33e333766f6f30614c87811d05e663a4) Bug: 120865921 Test: Manual verification Change-Id: Ic0b3f85fad24ccedc0a8e9935c198bc8503bb415
2018-12-18 00:39:58 +01:00
content_suggestions u:object_r:content_suggestions_service:s0
Change the name advertised by the context hub service. Bring the context hub service advertised name into compliance with the other Android services. This changes the name from "contexthub_service" to "context". Test: GTS tests pass. Change-Id: I8490d60f89bdb97813e328b9ddf08270470fda76
2016-12-27 18:29:15 +01:00
contexthub u:object_r:contexthub_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
country_detector u:object_r:country_detector_service:s0
Add coverage service. Bug: 31077138 Test: Device boots, coverage service works when tested manually. Change-Id: Ia855cfefd5c25be5d1d8db48908c04b3616b5504
2016-12-01 03:27:03 +01:00
coverage u:object_r:coverage_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
cpuinfo u:object_r:cpuinfo_service:s0
Add selinux policy for CrossProfileAppsService CrossProfileAppsService allows apps to do limited cross profile operations, like checking the caller package is installed in the specified user. It is similar to LauncherAppsService in some sense. Merged-In: I26e383a57c32c4dc9b779752b20000b283a5bfdc Change-Id: I26e383a57c32c4dc9b779752b20000b283a5bfdc Fix: 67765768 Test: Built with ag/3063260. Can boot and verified those APIs are working. (cherry picked from commit 6536c9e0920fda975e9a1a240ea1c5e1ae9778a6)
2017-10-13 15:48:32 +02:00
crossprofileapps u:object_r:crossprofileapps_service:s0
selinux config for data loader manager service Test: boots Change-Id: If489054a51838d4215202b5768d46c6278ed1aa2
2019-12-10 22:27:08 +01:00
dataloader_manager u:object_r:dataloader_manager_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
dbinfo u:object_r:dbinfo_service:s0
SEPolicy updates for DeviceConfig Service. Add a DeviceConfig service in system_server to edit configuration flags. This is intended to be a command line tool for local overrides and/or tool for tests that adopt shell permissions. Test: None Bug:109919982 Bug:113101834 Change-Id: Ib7bed752849b1ed102747e3202dd7aed48d2c6d5
2018-12-07 17:27:29 +01:00
device_config u:object_r:device_config_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
device_policy u:object_r:device_policy_service:s0
Move device serial behing a permission - selinux Build serial is non-user resettable freely available device identifier. It can be used by ad-netowrks to track the user across apps which violates the user's privacy. This change deprecates Build.SERIAL and adds a new Build.getSerial() API which requires holding the read_phone_state permission. The Build.SERIAL value is set to "undefined" for apps targeting high enough SDK and for legacy app the value is still available. bug:31402365 Change-Id: I6309aa58c8993b3db4fea7b55aae05592408b6e4
2016-09-12 20:58:08 +02:00
device_identifiers u:object_r:device_identifiers_service:s0
Add rule for new deviceidle service. Change-Id: I283663caea0ee1597645856fb31f13b26e902315
2015-03-19 02:33:47 +01:00
deviceidle u:object_r:deviceidle_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
devicestoragemonitor u:object_r:devicestoragemonitor_service:s0
diskstats u:object_r:diskstats_service:s0
display u:object_r:display_service:s0
Add sepolicy for resolver service Bug: 126141549 Test: built, flashed, booted Change-Id: I34260e1e5cc238fbe92574f928252680c1e6b417
2019-02-25 13:12:15 +01:00
dnsresolver u:object_r:dnsresolver_service:s0
Add color_service selinux policy Bug: 111215474 Test: boots Change-Id: I98955bcd02f643400c3eb97232467c09a2c5c1e5
2018-08-18 03:47:47 +02:00
color_display u:object_r:color_display_service:s0
Change name in the rules after renaming dns_listener -> netd_listener Change-Id: I4737a087f2d00e1028d1cb43d9eda814a008dbe8
2016-09-01 11:08:57 +02:00
netd_listener u:object_r:netd_listener_service:s0
Add network watchlist service SELinux policy rules Bug: 63908748 Test: built, flashed, able to boot Change-Id: I3cfead1d687112b5f8cd485c8f84083c566fbce2
2017-11-13 18:52:05 +01:00
network_watchlist u:object_r:network_watchlist_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
DockObserver u:object_r:DockObserver_service:s0
dreams u:object_r:dreams_service:s0
Add SELinux rules for service_manager. Add a service_mananger class with the verb add. Add a type that groups the services for each of the processes that is allowed to start services in service.te and an attribute for all services controlled by the service manager. Add the service_contexts file which maps service name to target label. Bug: 12909011 Change-Id: I017032a50bc90c57b536e80b972118016d340c7d
2014-06-06 00:52:02 +02:00
drm.drmManager u:object_r:drmserver_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
dropbox u:object_r:dropbox_service:s0
Added permissions for the dumpstate service. - Allow dumpstate to create the dumpservice service. - Allow System Server and Shell to find that service. - Don't allow anyone else to create that service. - Don't allow anyone else to find that service. BUG: 31636879 Test: manual verification Change-Id: I642fe873560a2b123e6bafde645467d45a5f5711
2016-10-29 00:52:15 +02:00
dumpstate u:object_r:dumpstate_service:s0
Rename dynamic_android to dynamic_system Per API review, dynamic_android should be renamed to dynamic_system. Bug: 126613281 Test: run DynamicSystemInstallationService via adb Change-Id: Ia908cdd0c21b3a82f59b30e03a985dc260530230
2019-03-14 05:35:32 +01:00
dynamic_system u:object_r:dynamic_system_service:s0
Define selinux context for econtroller. Bug: 33075886 Test: N/A Change-Id: I1654ee20fa6125cf3ed5c0796e85f289db5a9745
2017-03-02 19:36:17 +01:00
econtroller u:object_r:radio_service:s0
Add EuiccCardManager and EuiccCardController. Bug: 38206971 Test: test on phone Change-Id: Id34ab2673c7a16744fba77eb5c176e2e8b474299 Merged-In: Id34ab2673c7a16744fba77eb5c176e2e8b474299
2017-12-22 03:42:24 +01:00
euicc_card_controller u:object_r:radio_service:s0
Add new external vibrator service to system_server Bug: 111457573 Test: N/A Change-Id: I457fd9d13cc481f2687ab39d22240c6ea7231183
2019-01-22 21:55:08 +01:00
external_vibrator_service u:object_r:external_vibrator_service:s0
Sync internal master and AOSP sepolicy. Bug: 37916906 Test: Builds 'n' boots. Change-Id: Ia1d86264446ebecc1ca79f32f11354921bc77668 Merged-In: I208ec6a864127a059fb389417a9c6b259d7474cb
2017-09-26 21:58:29 +02:00
lowpan u:object_r:lowpan_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
ethernet u:object_r:ethernet_service:s0
Add placeholder sepolicy for iris and face See aosp/660242 and aosp/608396 Fixes: 116530289 Test: builds Change-Id: I220ece0d6751839fe764ff91fd7bd20c50104f8f
2018-09-01 03:14:16 +02:00
face u:object_r:face_service:s0
sepolicy: new file_integrity_service Test: didn't see denials in dmesg during boot or API calls. Bug: 142573505 Change-Id: Ifa271956bc51bf47d781cd9c9f95afb99c5f940f
2019-12-19 18:25:07 +01:00
file_integrity u:object_r:file_integrity_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
fingerprint u:object_r:fingerprint_service:s0
Declare new Fonts service Merged-In: Id2b849d7fa22989225066ebe487fc98d319743ea Bug: 34190490 Test: CTS in internal master Change-Id: I27ab62469f3a405c59eda1a2a249899e845bed56
2017-01-23 12:10:24 +01:00
font u:object_r:font_service:s0
Add selinux policy for fingerprintd Change-Id: Ibcb714248c28abf21272986facaade376dcbd7ef
2015-05-13 00:16:06 +02:00
android.hardware.fingerprint.IFingerprintDaemon u:object_r:fingerprintd_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
gfxinfo u:object_r:gfxinfo_service:s0
Add graphicsstats service Change-Id: I156b139b57f46c695ece35b7b26a3087d87b25df
2015-03-23 15:56:37 +01:00
graphicsstats u:object_r:graphicsstats_service:s0
[SEPolicy] Name GPU service back to "gpu" Changed the GPU service name back to be compatible with external engines/tools' usage of vkjson cmd. Bug: 118347356 Test: adb shell cmd gpu vkjson Change-Id: Ie432fd8be63d33070ad037c509467c8367b42d39
2018-11-16 20:06:52 +01:00
gpu u:object_r:gpu_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
hardware u:object_r:hardware_service:s0
Renamed hardwareproperties to hardware_properties Bug: 27531271 Change-Id: I3c5eee86d09696373ab155f93ba6c85da224cb51
2016-03-09 18:13:11 +01:00
hardware_properties u:object_r:hardware_properties_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
hdmi_control u:object_r:hdmi_control_service:s0
Rename ANS to ONS Rename AlternativeNetworkService to OpportunisticNetworkService Bug: 118347827 Test: compile Change-Id: I23b0caadd1801c104806fa438fc9054d8a31962e
2019-01-08 19:51:00 +01:00
ions u:object_r:radio_service:s0
Add idmap2 and idmap2d Bug: 78815803 Test: builds, boots Test: manual: adb shell idmap2 create ... Test: manual: adb shell ps | grep -e idmap2d Change-Id: I60852e15d99329896ff9de6559d1e7cd1c67e33d
2018-06-15 08:08:19 +02:00
idmap u:object_r:idmap_service:s0
Add incident command and incidentd daemon se policy. Test: adb shell incident Bug: 31122534 Change-Id: I4ac9c9ab86867f09b63550707673149fe60f1906
2016-11-21 08:23:04 +01:00
incident u:object_r:incident_service:s0
Add incidentcompanion service. It is a side channel for dumpstate and incidentd to communicate status and get user authorization to share bugreports by calling system_server. Test: atest PermissionControllerTest / atest GooglePermissionControllerTest Change-Id: I995a43a25f375e5c97dba1deb92ebe893ca8585d
2018-12-08 02:20:14 +01:00
incidentcompanion u:object_r:incidentcompanion_service:s0
Add SELinux rules for service_manager. Add a service_mananger class with the verb add. Add a type that groups the services for each of the processes that is allowed to start services in service.te and an attribute for all services controlled by the service manager. Add the service_contexts file which maps service name to target label. Bug: 12909011 Change-Id: I017032a50bc90c57b536e80b972118016d340c7d
2014-06-06 00:52:02 +02:00
inputflinger u:object_r:inputflinger_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
input_method u:object_r:input_method_service:s0
input u:object_r:input_service:s0
Rules for new installd Binder interface. Most of this CL mirrors what we've already done for the "netd" Binder interface, while sorting a few lists alphabetically. Migrating installd to Binder will allow us to get rid of one of the few lingering text-based command protocols, improving system maintainability and security. Test: builds, boots Bug: 13758960, 30944031 Change-Id: I59b89f916fd12e22f9813ace6673be38314c97b7
2016-12-05 19:19:11 +01:00
installd u:object_r:installd_service:s0
iorapd: Add new binder service iorapd. This daemon is very locked down. Only system_server can access it. Bug: 72170747 Change-Id: I7b72b9191cb192be96001d84d067c28292c9688f
2018-10-05 23:48:29 +02:00
iorapd u:object_r:iorapd_service:s0
Preemptively adding services for pending commits. Adding services to service_contexts for the pending commits Icf5997dd6a6ba5e1de675cf5f4334c78c2c037f1 and Ibe79be30b80c18ec45ff69db7527c7a4adf0ee08. Change-Id: Ie898866d1ab3abba6211943e87bcec77ba568567
2014-06-27 22:20:15 +02:00
iphonesubinfo_msim u:object_r:radio_service:s0
iphonesubinfo2 u:object_r:radio_service:s0
Add SELinux rules for service_manager. Add a service_mananger class with the verb add. Add a type that groups the services for each of the processes that is allowed to start services in service.te and an attribute for all services controlled by the service manager. Add the service_contexts file which maps service name to target label. Bug: 12909011 Change-Id: I017032a50bc90c57b536e80b972118016d340c7d
2014-06-06 00:52:02 +02:00
iphonesubinfo u:object_r:radio_service:s0
Add missing services to service_contexts. Add missing services to service_contexts that we did not include in earlier patch that added SELinux checks in service_manager. Change-Id: I889d999bf0b745bfcb75a3553b207777dc5700b7
2014-06-17 17:13:36 +02:00
ims u:object_r:radio_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
imms u:object_r:imms_service:s0
selinux config for Incremental service BUG: 136132412 Test: boots Change-Id: I0bff222af54d617b7c849bbed6fa52b96d945e32
2019-12-11 00:41:18 +01:00
incremental u:object_r:incremental_service:s0
[incremental] allow system server to read /proc/filesystems Also allow binder service "incremental_service" to be found by service manager. Test: boots BUG: 136132412 Change-Id: I3584a9b69a7e1909f096e3c4579c1834bdfba22e
2019-12-17 18:45:43 +01:00
incremental_service u:object_r:incremental_service:s0
Add IpSecService SEPolicy Add a new type and context for IpSec to system SEPolicy Bug: 35923241 Test: service starts + talks to NetD Change-Id: I69356c8525b426d344fcc4858fc499ab12405b20 (cherry picked from commit 641b1a7ae0fde04424d7725165e91d1cde62390a)
2017-03-02 21:25:58 +01:00
ipsec u:object_r:ipsec_service:s0
Rename service from ircs to ircsmessage ircs is not specific enough. There will be multiple services in the future with ircsmessage used specificially for message store. Test: compile, tests Change-Id: Ia7d57e6900c733408be26d6520aa46c512229248
2019-07-11 22:02:07 +02:00
ircsmessage u:object_r:radio_service:s0
Add placeholder sepolicy for iris and face See aosp/660242 and aosp/608396 Fixes: 116530289 Test: builds Change-Id: I220ece0d6751839fe764ff91fd7bd20c50104f8f
2018-09-01 03:14:16 +02:00
iris u:object_r:iris_service:s0
Preemptively adding services for pending commits. Adding services to service_contexts for the pending commits Icf5997dd6a6ba5e1de675cf5f4334c78c2c037f1 and Ibe79be30b80c18ec45ff69db7527c7a4adf0ee08. Change-Id: Ie898866d1ab3abba6211943e87bcec77ba568567
2014-06-27 22:20:15 +02:00
isms_msim u:object_r:radio_service:s0
isms2 u:object_r:radio_service:s0
Add SELinux rules for service_manager. Add a service_mananger class with the verb add. Add a type that groups the services for each of the processes that is allowed to start services in service.te and an attribute for all services controlled by the service manager. Add the service_contexts file which maps service name to target label. Bug: 12909011 Change-Id: I017032a50bc90c57b536e80b972118016d340c7d
2014-06-06 00:52:02 +02:00
isms u:object_r:radio_service:s0
Add missing services to service_contexts. Add missing services to service_contexts that we did not include in earlier patch that added SELinux checks in service_manager. Change-Id: I889d999bf0b745bfcb75a3553b207777dc5700b7
2014-06-17 17:13:36 +02:00
isub u:object_r:radio_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
jobscheduler u:object_r:jobscheduler_service:s0
launcherapps u:object_r:launcherapps_service:s0
Add rules for Lights AIDL HAL Test: manual; yukawa and cuttlefish; adb logcat | grep -i avc Bug: 142230898 Change-Id: I9f576511d1fc77c5f0ad3cf1b96b038b301773d7
2020-01-21 16:37:44 +01:00
lights u:object_r:light_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
location u:object_r:location_service:s0
lock_settings u:object_r:lock_settings_service:s0
Add looper_stats_service to SE policy. Test: Built and flashed an image. Bug: 113651685 Change-Id: Ide239432ea8a5701d91c00edd06ad3e52560a3f7
2018-08-30 14:04:55 +02:00
looper_stats u:object_r:looper_stats_service:s0
Add rules for lpdump and lpdumpd - lpdump is a binary on the device that talks to lpdumpd via binder. - lpdumpd is a daemon on the device that actually reads dynamic partition metadata. Only lpdump can talk to it. Bug: 126233777 Test: boots (sanity) Test: lpdump Change-Id: I0e21f35ac136bcbb0603940364e8117f2d6ac438
2019-03-14 23:45:03 +01:00
lpdump_service u:object_r:lpdump_service:s0
service_contexts: add aaudio service Test: test_aaudio.cpp Bug: 33398120 Change-Id: I0712f60c898136154d729ceb1103ee021cc6ab82 Signed-off-by: Phil Burk <philburk@google.com> (cherry picked from commit 8b9d93f24505a2737f156f3b20a0fca3af8ac345)
2017-02-02 20:53:20 +01:00
media.aaudio u:object_r:audioserver_service:s0
Add rules for running audio services in audioserver audioserver has the same rules as mediaserver so there is no loss of rights or permissions. media.log moves to audioserver. TBD: Pare down permissions. Bug: 24511453 Change-Id: I0fff24c14b712bb3d498f75e8fd66c2eb795171d
2015-09-09 19:48:04 +02:00
media.audio_flinger u:object_r:audioserver_service:s0
media.audio_policy u:object_r:audioserver_service:s0
selinux: Update policies for cameraserver Update policies for cameraserver so it has the same permissions as mediaserver. Bug: 24511454 Change-Id: I1191e2ac36c00b942282f8dc3db9903551945adb
2015-12-04 01:10:05 +01:00
media.camera u:object_r:cameraserver_service:s0
camera: Add AIDL interface for CameraServiceProxy. - Update selinux policy for CameraServiceProxy. Bug: 21267484 Change-Id: Ib821582794ddd1e3574b5dc6c79f7cb197b57f10
2015-05-20 02:26:31 +02:00
media.camera.proxy u:object_r:cameraproxy_service:s0
Add rules for running audio services in audioserver audioserver has the same rules as mediaserver so there is no loss of rights or permissions. media.log moves to audioserver. TBD: Pare down permissions. Bug: 24511453 Change-Id: I0fff24c14b712bb3d498f75e8fd66c2eb795171d
2015-09-09 19:48:04 +02:00
media.log u:object_r:audioserver_service:s0
Add SELinux rules for service_manager. Add a service_mananger class with the verb add. Add a type that groups the services for each of the processes that is allowed to start services in service.te and an attribute for all services controlled by the service manager. Add the service_contexts file which maps service name to target label. Bug: 12909011 Change-Id: I017032a50bc90c57b536e80b972118016d340c7d
2014-06-06 00:52:02 +02:00
media.player u:object_r:mediaserver_service:s0
rename mediaanalytics->mediametrics, wider access reflect the change from "mediaanalytics" to "mediametrics" Also incorporates a broader access to the service -- e.g. anyone. This reflects that a number of metrics submissions come from application space and not only from our controlled, trusted media related processes. The metrics service (in another commit) checks on the source of any incoming metrics data and limits what is allowed from unprivileged clients. Bug: 34615027 Test: clean build, service running and accessible Change-Id: I657c343ea1faed536c3ee1940f1e7a178e813a42
2017-01-24 21:53:45 +01:00
media.metrics u:object_r:mediametrics_service:s0
Update selinux policies for mediaextractor process Change-Id: If761e0370bf9731a2856d0de2c6a6af1671143bd
2015-09-22 19:56:03 +02:00
media.extractor u:object_r:mediaextractor_service:s0
MediaTranscodingService: Add sepolicy for MediaTranscodingService. Bug:145233472 Test: Build and flash the phone. "adb shell dumpsys -l | grep media" shows media.transcoding service. Change-Id: I48a42e7b595754989c92a8469eb91360ab6db7c6
2019-11-28 03:10:01 +01:00
media.transcoding u:object_r:mediatranscoding_service:s0
media: allow media server to add resource manager service Bug: 19620911 Change-Id: I170b9d46bd49b1ad8bac6e37d0745893d79c14fe
2015-03-12 23:54:37 +01:00
media.resource_manager u:object_r:mediaserver_service:s0
Add rules for running audio services in audioserver audioserver has the same rules as mediaserver so there is no loss of rights or permissions. media.log moves to audioserver. TBD: Pare down permissions. Bug: 24511453 Change-Id: I0fff24c14b712bb3d498f75e8fd66c2eb795171d
2015-09-09 19:48:04 +02:00
media.sound_trigger_hw u:object_r:audioserver_service:s0
Add mediadrm service Part of media security hardening This is an intermediate step toward moving mediadrm to a new service separate from mediaserver. This first step allows mediadrmservice to run based on the system property media.mediadrmservice.enable so it can be selectively enabled on devices that support using native_handles for secure buffers. bug: 22990512 Change-Id: I2208c1e87a6bd8d5bfaed06b1fdcb0509c11cff2
2016-02-12 18:05:42 +01:00
media.drm u:object_r:mediadrmserver_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
media_projection u:object_r:media_projection_service:s0
Allow mediaserver to access media_resource_monitor Bug: 26175834 Change-Id: I49244f8e6165ea5a871955f07b3c4ea40cbd7c59
2015-12-15 06:19:21 +01:00
media_resource_monitor u:object_r:media_session_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
media_router u:object_r:media_router_service:s0
media_session u:object_r:media_session_service:s0
meminfo u:object_r:meminfo_service:s0
midi u:object_r:midi_service:s0
mount u:object_r:mount_service:s0
Rename the netd service from "android.net.INetd" to "netd". Bug: 27239233 Change-Id: Icc9d14008d2ff6334a8ec66805f7289aedd5d97d
2016-02-23 14:21:22 +01:00
netd u:object_r:netd_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
netpolicy u:object_r:netpolicy_service:s0
netstats u:object_r:netstats_service:s0
Add selinux policies for network stack service The policies allow the system server to register a network_stack_service used to communicate with the network stack process. Test: atest FrameworksNetTests Bug: b/112869080 Change-Id: Ib9b7d9150fe4afcce03c8b3dbb36b81c67e39366
2018-12-14 06:13:52 +01:00
network_stack u:object_r:network_stack_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
network_management u:object_r:network_management_service:s0
network_score u:object_r:network_score_service:s0
Add NetworkTimeUpdateService NetworkTimeUpdateService has been registered as a system service, so that its dump state can be included into bugreports. Bug: 23983739 Change-Id: I0d364009ba4630dcfd1d22c647195e33eedaa4e0
2016-02-27 02:21:47 +01:00
network_time_update_service u:object_r:network_time_update_service:s0
Add SELinux rules for service_manager. Add a service_mananger class with the verb add. Add a type that groups the services for each of the processes that is allowed to start services in service.te and an attribute for all services controlled by the service manager. Add the service_contexts file which maps service name to target label. Bug: 12909011 Change-Id: I017032a50bc90c57b536e80b972118016d340c7d
2014-06-06 00:52:02 +02:00
nfc u:object_r:nfc_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
notification u:object_r:notification_service:s0
SE Linux policies for OemLockService Bug: 34766843 Test: gts-tradefed run gts -m GtsBootloaderServiceTestCases -t \ com.google.android.bootloader.gts.BootloaderServiceTest Change-Id: I8b939e0dbe8351a54f20c303921f606c3462c17d
2017-02-17 14:51:32 +01:00
oem_lock u:object_r:oem_lock_service:s0
Selinux: introduce policy for OTA preopt Add permissions to dex2oat, introduce otapreopt binary and otadexopt service. Bug: 25612095 Change-Id: I80fcba2785e80b2931d7d82bb07474f6cd0099f7
2015-12-03 06:23:30 +01:00
otadexopt u:object_r:otadexopt_service:s0
Add service 'overlay' to service_contexts The 'overlay' service is the Overlay Manager Service, which tracks packages and their Runtime Resource Overlay overlay packages. Change-Id: I897dea6a32c653d31be88a7b3fc56ee4538cf178 Co-authored-by: Martin Wallgren <martin.wallgren@sonymobile.com> Signed-off-by: Zoran Jovanovic <zoran.jovanovic@sonymobile.com> Bug: 31052947 Test: boot the Android framework
2015-06-22 09:31:25 +02:00
overlay u:object_r:overlay_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
package u:object_r:package_service:s0
Sync internal master and AOSP sepolicy. Bug: 37916906 Test: Builds 'n' boots. Change-Id: Ia1d86264446ebecc1ca79f32f11354921bc77668 Merged-In: I208ec6a864127a059fb389417a9c6b259d7474cb
2017-09-26 21:58:29 +02:00
package_native u:object_r:package_native_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
permission u:object_r:permission_service:s0
Create new permissionmgr_service We're creating a new PermissionManagerService that will handle all of the permission related APIs. These are currently being routed through PackageManagerService. Test: Device boots Change-Id: I7d08561dd33b692209c30d413cdca0ff567358f1
2018-12-14 22:08:43 +01:00
permissionmgr u:object_r:permissionmgr_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
persistent_data_block u:object_r:persistent_data_block_service:s0
Preemptively adding services for pending commits. Adding services to service_contexts for the pending commits Icf5997dd6a6ba5e1de675cf5f4334c78c2c037f1 and Ibe79be30b80c18ec45ff69db7527c7a4adf0ee08. Change-Id: Ie898866d1ab3abba6211943e87bcec77ba568567
2014-06-27 22:20:15 +02:00
phone_msim u:object_r:radio_service:s0
phone1 u:object_r:radio_service:s0
phone2 u:object_r:radio_service:s0
Add SELinux rules for service_manager. Add a service_mananger class with the verb add. Add a type that groups the services for each of the processes that is allowed to start services in service.te and an attribute for all services controlled by the service manager. Add the service_contexts file which maps service name to target label. Bug: 12909011 Change-Id: I017032a50bc90c57b536e80b972118016d340c7d
2014-06-06 00:52:02 +02:00
phone u:object_r:radio_service:s0
Add CAP_IPC_LOCK and pinner to system_server Add pinner service to system_service services. Add CAP_IPC_LOCK permissions to system_server in order to allow system_server to pin more memory than the lockedmem ulimit. bug 28251566 Change-Id: I990c73d25fce4f2cc9a2db0015aa238fa7b0e984
2016-05-02 20:04:39 +02:00
pinner u:object_r:pinner_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
power u:object_r:power_service:s0
print u:object_r:print_service:s0
Add security policy for ProcessInfoService. Bug: 19186859 Change-Id: Ic08858f346d6b66e7bfc9da6faa2c6e38d9b2e82
2015-01-29 03:15:01 +01:00
processinfo u:object_r:processinfo_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
procstats u:object_r:procstats_service:s0
Add missing services to service_contexts. Add missing services related to battery, bluetooth, time, and radio to service_contexts. Change-Id: I8bf05feb173d49637048c779757013806837fede
2014-06-26 21:36:43 +02:00
radio.phonesubinfo u:object_r:radio_service:s0
radio.phone u:object_r:radio_service:s0
radio.sms u:object_r:radio_service:s0
Define rcs to be a radio_service RcsService will die continously without the setting. Bug: 123325711 Test: boot aosp_arm64_ab-userdebug on a blueline device Change-Id: Ic140cb3e6466428bf62f0065c78aaf16f957f4d5
2019-01-24 11:02:58 +01:00
rcs u:object_r:radio_service:s0
Add recovery service. RecoverySystemService is separated from PowerManagerService as a dedicated system service to handle recovery related requests (such as invoking uncrypt to uncrypt an OTA package on /data or to set up / clear the bootloader control block (i.e. /misc) and etc). The matching CL in frameworks/base is in: Change-Id: Ic606fcf5b31c54ce54f0ab12c1768fef0fa64560. Bug: 26830925 Change-Id: Iee0583c458f784bfa422d0f7af5d1f2681d9609e (cherry picked from commit 65b5fde912285ebeeefc9c7486f4453dd86d994f)
2016-02-03 21:43:58 +01:00
recovery u:object_r:recovery_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
restrictions u:object_r:restrictions_service:s0
Add SELinux service for RoleManagerService Test: ensure no build failures; add RoleManagerService as a boot phase ensure no SecurityException in logcat on boot Change-Id: Ia0803c0fb084fe2b12f5c20f5e46354d0dd1aedf
2018-11-09 02:37:45 +01:00
role u:object_r:role_service:s0
Add sepolicy for RollbackManagerService. Bug: 112431924 Test: atest RollbackTest Change-Id: I30453a8d5352a31e3e6af6c37a20b5473904d356
2018-10-02 12:20:32 +02:00
rollback u:object_r:rollback_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
rttmanager u:object_r:rttmanager_service:s0
Track add of RuntimeService in system server Adds the necessary incantations for the new service. Bug: 118242715 Bug: 119026403 Test: build / boot / adb shell dumpsys Change-Id: Ibb1a356067863316d70586a61ede9f5973c1ae15
2018-11-20 20:41:15 +01:00
runtime u:object_r:runtime_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
samplingprofiler u:object_r:samplingprofiler_service:s0
scheduling_policy u:object_r:scheduling_policy_service:s0
search u:object_r:search_service:s0
SE Policy for Secure Element app and Secure Element HAL Test: App startup on boot Change-Id: I7740aafc088aadf676328e3f1bb8db5175d97102
2018-01-04 19:33:20 +01:00
secure_element u:object_r:secure_element_service:s0
fix lax service context lookup (II) As fallout from the corresponding fix in libselinux, this patch adds the missing services without changing semantics. Test: bullhead builds and boots Bug: 31353148 Change-Id: I21026c9435ffef956a59d61c4903174ac7b1ef95
2016-09-08 14:15:19 +02:00
sec_key_att_app_id_provider u:object_r:sec_key_att_app_id_provider_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
sensorservice u:object_r:sensorservice_service:s0
Add selinux policy for new SensorPrivacyService Test: manually verified SensorPrivacyService is accessible Bug: 110842805 Change-Id: Idd215f338f2da0dab4898ea06fa08d9b4a1bcb5f
2018-12-05 07:38:01 +01:00
sensor_privacy u:object_r:sensor_privacy_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
serial u:object_r:serial_service:s0
servicediscovery u:object_r:servicediscovery_service:s0
Service context for servicemanager. Create a service context for manager itself and allow servicemanager to register itself. This is so that tools like dumpsys can reference servicemanager the same way they would reference other services. That things can still get ahold of the servicemanager directly via libbinder APIs since it is a context manager. Bug: 136027762 Test: dumpsys -l Change-Id: If3d7aa5d5284c82840ed1877b969572ce0561d2e
2019-10-17 01:30:26 +02:00
manager u:object_r:service_manager_service:s0
Allow new settings system service. Test: N/A Change-Id: Ib3c85118bf752152f5ca75ec13371073fc2873cc
2016-10-21 00:57:39 +02:00
settings u:object_r:settings_service:s0
Add new system service "shortcut". Bug 27325877 Change-Id: Idf2f9ae816e1f3d822a6286a4cf738c14e29a45e
2016-03-02 00:11:41 +01:00
shortcut u:object_r:shortcut_service:s0
Preemptively adding services for pending commits. Adding services to service_contexts for the pending commits Icf5997dd6a6ba5e1de675cf5f4334c78c2c037f1 and Ibe79be30b80c18ec45ff69db7527c7a4adf0ee08. Change-Id: Ie898866d1ab3abba6211943e87bcec77ba568567
2014-06-27 22:20:15 +02:00
simphonebook_msim u:object_r:radio_service:s0
simphonebook2 u:object_r:radio_service:s0
Add SELinux rules for service_manager. Add a service_mananger class with the verb add. Add a type that groups the services for each of the processes that is allowed to start services in service.te and an attribute for all services controlled by the service manager. Add the service_contexts file which maps service name to target label. Bug: 12909011 Change-Id: I017032a50bc90c57b536e80b972118016d340c7d
2014-06-06 00:52:02 +02:00
simphonebook u:object_r:radio_service:s0
sip u:object_r:radio_service:s0
Add selinux for slice service Test: make/sync Bug: 68751119 Change-Id: Ie3c60ff68b563cef07f20d15f298d6b62e9356bc
2017-12-04 20:41:54 +01:00
slice u:object_r:slice_service:s0
Setting up SELinux policy for statsd and stats service Bug: 63757906 Test: manual testing conducted Change-Id: Id03413ce82b5646d4bceddc59e16c7d5ee5bc193
2017-12-19 00:14:33 +01:00
stats u:object_r:stats_service:s0
Adding statscompanion_service and a dontaudit for find/add Instead of removing the denial generating code, a dontaudit and a service label will be provided so that the team working on this new feature doesn't have to get slowed up with local revision patches. The dontaudit should be removed upon resolution of the linked bug. Bug: 67468181 Test: statscompanion denials aren't audited Change-Id: Ib4554a7b6c714e7409ea504f5d0b82d5e1283cf7
2017-10-24 01:25:11 +02:00
statscompanion u:object_r:statscompanion_service:s0
system_server: create StatsManagerService Refactor to split the logic within statscompanion_service The goal of the refactor is to simplify the binder calls to statsd This service will talk to statsd. At the end of the refactor, this service should be the only service that talks to statsd. Bug: 146074223 Test: Manual by creating the service with empty implementation Change-Id: Ib9c2e10ec195d41062f1001e5a82b374696de939
2019-12-12 19:17:58 +01:00
statsmanager u:object_r:statsmanager_service:s0
Allow "soundtrigger" system service to run. In the same process as voiceinteraction. Please see related CL ag/852049 Bug: 22860713 Change-Id: I43ebfdba2aafb151dd7db0814570027e1164508a
2016-01-26 03:22:07 +01:00
soundtrigger u:object_r:voiceinteraction_service:s0
Allow soundtrigger_middleware system service New system service, intended to replace all of the soundtrigger middleware. Change-Id: Ia7cb4f8436719ca3bf71ea4c2bc32995568ff01d Bug: 142070343
2019-09-24 19:11:33 +02:00
soundtrigger_middleware u:object_r:soundtrigger_middleware_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
statusbar u:object_r:statusbar_service:s0
Storaged permissions for task I/O Allow storaged to read /proc/[pid]/io Grant binder access to storaged Add storaged service Grant storaged_exec access to dumpstate Grant storaged binder_call to dumpstate Bug: 32221677 Change-Id: Iecc9dba266c5566817a99ac6251eb943a0bac630
2016-07-01 21:18:54 +02:00
storaged u:object_r:storaged_service:s0
storaged: add storaged_pri service "storaged" service will be used by external clients, e.g. vold, dumpsys "storaged_pri" service will only be used by storaged cmdline. Bug: 63740245 Change-Id: I7a60eb4ce321aced9589bbb8474d2d9e75ab7042 (cherry picked from commit 37ab7c0917b26f8e1d7f4ff865838c5488b0b0af)
2017-10-16 22:57:06 +02:00
storaged_pri u:object_r:storaged_service:s0
Define policy for new StorageStatsManager API. Test: builds Bug: 32206268 Change-Id: I236105b029178f96da519c2295c66c686dcae7cb
2017-01-11 02:09:13 +01:00
storagestats u:object_r:storagestats_service:s0
Add SELinux rules for service_manager. Add a service_mananger class with the verb add. Add a type that groups the services for each of the processes that is allowed to start services in service.te and an attribute for all services controlled by the service manager. Add the service_contexts file which maps service name to target label. Bug: 12909011 Change-Id: I017032a50bc90c57b536e80b972118016d340c7d
2014-06-06 00:52:02 +02:00
SurfaceFlinger u:object_r:surfaceflinger_service:s0
SEPolicy for Suspend Control interface. Bug: 121210355 Test: manual Change-Id: I9c46c72f0219309140ed2fb008ef57b4bca6ff2b
2019-01-21 14:45:47 +01:00
suspend_control u:object_r:system_suspend_control_service:s0
Add selinux contexts for system_config_service Add selinux contexts for the new system config service. Test: atest -it -w SystemConfigTest Bug: 143112379 Change-Id: Ibe67acb404b6951e1fda9ce28bd50a0efdd44c5f
2019-12-24 03:14:28 +01:00
system_config u:object_r:system_config_service:s0
Add rules for system_update service. system_update service manages system update information: system updater (priv_app) publishes the pending system update info through the service, while other apps can read the info accordingly (design doc in go/pi-ota-platform-api). This CL adds the service type, and grants priv_app to access the service. Bug: 67437079 Test: Build and flash marlin image. The system_update service works. Change-Id: I7a3eaee3ecd3e2e16b410413e917ec603566b375
2017-10-17 06:57:12 +02:00
system_update u:object_r:system_update_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
task u:object_r:task_service:s0
Add system_api_service and app_api_service attributes. System services differ in designed access level. Add attributes reflecting this distinction and label services appropriately. Begin moving access to the newly labeled services by removing them from tmp_system_server_service into the newly made system_server_service attribute. Reflect the move of system_server_service from a type to an attribute by removing access to system_server_service where appropriate. Change-Id: I7fd06823328daaea6d6f96e4d6bd00332382230b
2015-04-03 01:50:08 +02:00
telecom u:object_r:telecom_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
telephony.registry u:object_r:registry_service:s0
[RCS] Add service context of sepolicy of Context.TELEPHONY_IMS_SERVICE Bug: 139260938 Test: Manual Change-Id: I335a955ee7cc2b8e82acd2987c93076fc50dc20a
2019-11-06 14:17:23 +01:00
telephony_ims u:object_r:radio_service:s0
Add the testharness service to sepolicy rules The testharness service will manage Test Harness Mode and provide a command-line interface for users to enable Test Harness Mode; however it does not directly provide a public API. Bug: 80137798 Test: make Test: flash crosshatch Change-Id: Ie396e40fcea8914b4dd2247f2314e029b66ad84e
2019-01-15 22:39:30 +01:00
testharness u:object_r:testharness_service:s0
[Tether15] Allow system app to find TetheringManager Bug: 144320246 Test: -build, flash, boot -OFF/ON hotspot Change-Id: I8ce7ac5eb8198f0df4a2da426e3c56e8915e746a
2019-11-11 13:30:23 +01:00
tethering u:object_r:tethering_service:s0
Declare new textclassification system service. Bug: 34781862 Test: none Change-Id: Ie628dca592a68ed67a68dda2f3d3e0516e995c80
2017-02-04 05:09:28 +01:00
textclassification u:object_r:textclassification_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
textservices u:object_r:textservices_service:s0
selinux changes to add time detector service This commit contains the changes needed to add the new time detector system server service. Bug: 78217059 Test: make / booted device Change-Id: I7cfaac6cac876e4aa73e8af1aa5f837117bb9ad7
2018-05-30 15:44:47 +02:00
time_detector u:object_r:timedetector_service:s0
Add new time zone detection service Add entries necessary for the new time zone detection service. Bug:140712361 Test: See related frameworks/base change Change-Id: Ide4244104e2add843c1d699d528328dd71a6b525
2019-11-07 17:01:55 +01:00
time_zone_detector u:object_r:timezonedetector_service:s0
Enable the TimeZoneManagerService Add policy changes to enable a new service. The service is currently switched off in config, but this change is needed before it could be enabled. Bug: 31008728 Test: make droid Merged-In: I29c4509304978afb2187fe2e7f401144c6c3b4c6 Change-Id: I29c4509304978afb2187fe2e7f401144c6c3b4c6
2017-01-11 17:27:02 +01:00
timezone u:object_r:timezone_service:s0
Sync internal master and AOSP sepolicy. Bug: 37916906 Test: Builds 'n' boots. Change-Id: Ia1d86264446ebecc1ca79f32f11354921bc77668 Merged-In: I208ec6a864127a059fb389417a9c6b259d7474cb
2017-09-26 21:58:29 +02:00
thermalservice u:object_r:thermal_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
trust u:object_r:trust_service:s0
tv_input u:object_r:tv_input_service:s0
Add uce service to core policy. This service is requested by AOSP framework, but there is no context for it defined. Bug: 136023468 Test: N/A Change-Id: Ibc5b048aaa1c9eda7b9180caca92cb876c3f6b28 Merged-In: Ibc5b048aaa1c9eda7b9180caca92cb876c3f6b28 (cherry picked from commit 67cb30fabf50e3ce2f08e9edd4e14214c11571a4)
2019-08-01 23:05:05 +02:00
uce u:object_r:uce_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
uimode u:object_r:uimode_service:s0
updatelock u:object_r:updatelock_service:s0
Added sepolicy for uri_grants service Bug: 80414790 Test: boots Change-Id: I15233721fa138e0fdf1a30f66d52b64cbab18b81
2018-07-22 08:21:08 +02:00
uri_grants u:object_r:uri_grants_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
usagestats u:object_r:usagestats_service:s0
usb u:object_r:usb_service:s0
user u:object_r:user_service:s0
vibrator u:object_r:vibrator_service:s0
Add policies for new services. Bug: 30989383 Bug: 34731101 Test: manual Change-Id: Icf9d48568b505c6b788f2f5f456f2d709969fbeb
2017-02-10 00:15:11 +01:00
virtual_touchpad u:object_r:virtual_touchpad_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
voiceinteraction u:object_r:voiceinteraction_service:s0
Sync internal master and AOSP sepolicy. Bug: 37916906 Test: Builds 'n' boots. Change-Id: Ia1d86264446ebecc1ca79f32f11354921bc77668 Merged-In: I208ec6a864127a059fb389417a9c6b259d7474cb
2017-09-26 21:58:29 +02:00
vold u:object_r:vold_service:s0
VR: Add sepolicy for VR HWC service VR HWC is being split out of VR Window Manager. It creates a HW binder interface used by SurfaceFlinger which implements the HWComposer HAL and a regular binder interface which will be used by a system app to receive the SurfaceFlinger output. Bug: b/36051907 Test: Ran in permissive mode and ensured no permission errors show in logcat. Change-Id: If1360bc8fa339a80100124c4e89e69c64b29d2ae
2017-03-14 21:26:17 +01:00
vr_hwc u:object_r:vr_hwc_service:s0
Selinux changes for vr flinger vsync service Add selinux policy for the new Binder-based vr flinger vsync service. Bug: 72890037 Test: - Manually confirmed that I can't bind to the new vsync service from a normal Android application, and system processes (other than vr_hwc) are prevented from connecting by selinux. - Confirmed the CTS test android.security.cts.SELinuxHostTest#testAospServiceContexts, when built from the local source tree with this CL applied, passes. - Confirmed the CTS test android.cts.security.SELinuxNeverallowRulesTest#testNeverallowRules521, when built from the local source tree with this CL applied, passes. Change-Id: Ib7a6bfcb1c2ebe1051f3accc18b481be1b188b06
2018-07-14 02:17:01 +02:00
vrflinger_vsync u:object_r:vrflinger_vsync_service:s0
Update selinux policy for VrManager AIDL. Bug: 27884853 Change-Id: I097306a324bdc25c5d22868f0342e175ce0dbb9a
2016-04-06 03:12:21 +02:00
vrmanager u:object_r:vr_manager_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
wallpaper u:object_r:wallpaper_service:s0
webviewupdate u:object_r:webviewupdate_service:s0
wifip2p u:object_r:wifip2p_service:s0
wifiscanner u:object_r:wifiscanner_service:s0
wifi u:object_r:wifi_service:s0
sepolicy: add sepolicy binder support for wificond This allows wificond to publish binder interface using service manager. Denial warnings: wificond: type=1400 audit(0.0:8): avc: denied { call } for scontext=u:r:wificond:s0 tcontext=u:r:servicemanager:s0 tclass=binder permissive=1 wificond: type=1400 audit(0.0:9): avc: denied { transfer } for scontext=u:r:wificond:s0 tcontext=u:r:servicemanager:s0 tclass=binder permissive=1 servicemanager: type=1400 audit(0.0:10): avc: denied { search } for name="6085" dev="proc" ino=40626 scontext=u:r:servicemanager:s0 tcontext=u:r:wificond:s0 tclass=dir permissive=1 servicemanager: type=1400 audit(0.0:11): avc: denied { read } for name="current" dev="proc" ino=40641 scontext=u:r:servicemanager:s0 tcontext=u:r:wificond:s0 tclass=file permissive=1 servicemanager: type=1400 audit(0.0:12): avc: denied { open } for path="/proc/6085/attr/current" dev="proc" ino=40641 scontext=u:r:servicemanager:s0 tcontext=u:r:wificond:s0 tclass=file permissive=1 servicemanager: type=1400 audit(0.0:13): avc: denied { getattr } for scontext=u:r:servicemanager:s0 tcontext=u:r:wificond:s0 tclass=process permissive=1 SELinux : avc: denied { add } for service=wificond pid=6085 uid=0 scontext=u:r:wificond:s0 tcontext=u:object_r:wifi_service:s0 tclass=service_manager permissive=1 BUG=28867093 TEST=compile TEST=use a client to call wificond service through binder Change-Id: I9312892caff171f17b04c30a415c07036b39ea7f (cherry picked from commit d56bcb1c5452c8dcdda7e4ef5d0f44b91b6bb08b)
2016-06-03 19:08:56 +02:00
wificond u:object_r:wificond_service:s0
[NAN-AWARE] Add Aware service Add Aware service - new name for NAN. But do not remove NAN yet. Enables smooth transition. Bug: 32263750 Test: device boots and all Wi-Fi unit-tests pass Change-Id: Ieb9f1ebf1d2f31ee27f228562b4601023da5282d
2016-11-04 21:37:17 +01:00
wifiaware u:object_r:wifiaware_service:s0
[RTT] Update Wi-Fi RTT service name Finalize Wi-Fi RTT service name per API review. Note: CL 1 of 2 - adding new entry here, will remove old entry in next CL. Bug: 65108607 Test: integration tests Change-Id: I065ce9d570510180fa8c8f09e1025ac795706405
2018-01-05 03:10:36 +01:00
wifirtt u:object_r:rttmanager_service:s0
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
2014-12-17 00:45:26 +01:00
window u:object_r:window_service:s0
Add SELinux rules for service_manager. Add a service_mananger class with the verb add. Add a type that groups the services for each of the processes that is allowed to start services in service.te and an attribute for all services controlled by the service manager. Add the service_contexts file which maps service name to target label. Bug: 12909011 Change-Id: I017032a50bc90c57b536e80b972118016d340c7d
2014-06-06 00:52:02 +02:00
* u:object_r:default_android_service:s0
Reference in a new issue Copy permalink