tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
platform_system_sepolicy/private/compat/30.0/30.0.ignore.cil

36 lines
1,016 B
Text
Raw Normal View History

Add 30.0 mapping files Steps taken to produce the mapping files: 1. Add prebuilts/api/30.0/plat_pub_versioned.cil from the /vendor/etc/selinux/plat_pub_versioned.cil file built on rvc-dev with lunch target aosp_arm64-eng. Add prebuilts/api/30.0/vendor_sepolicy.cil as an empty file. 2. Add new file private/compat/30.0/30.0.cil by doing the following: - copy /system/etc/selinux/mapping/30.0.cil from rvc-dev aosp_arm64-eng device to private/compat/30.0/30.0.cil - remove all attribute declaration statement (typeattribute ...) and sort lines alphabetically - some selinux types were added/renamed/deleted w.r.t 30 sepolicy. Find all such types using treble_sepolicy_tests_30.0 test. - for all these types figure out where to map them by looking at 29.0.[ignore.]cil files and add approprite entries to 30.0.[ignore.]cil. This change also enables treble_sepolicy_tests_30.0 and installs 30.0.cil mapping file onto the device. Bug: 153661471 Test: m treble_sepolicy_tests_30.0 Test: m 30.0_compat_test Test: m selinux_policy Change-Id: I6dfae41fbd5f245119ede540d2c321688d6e7929
2020-05-07 13:19:05 +02:00
;; new_objects - a collection of types that have been introduced that have no
;; analogue in older policy. Thus, we do not need to map these types to
;; previous ones. Add here to pass checkapi tests.
(type new_objects)
(typeattribute new_objects)
(typeattributeset new_objects
( new_objects
Add gki.prevent_downgrade_* Add ro.build.ab_update.gki.prevent_downgrade_{version,spl} for update_engine to determine whether downgrade in kernel version or SPL is considered an error or not. Bug: 162623577 Test: update_engine_unittest Test: apply OTA Change-Id: If602924d50a2d5cfb3c256b82491c413a9d39f9d
2020-09-22 05:04:00 +02:00
ab_update_gki_prop
Allow vendor_init to set service.adb.tcp.port adbd and apps (SystemUI and CTS test apps) need to read it. BUG: 162205386 Test: Connect to device which sets service.adb.tcp.port in vendor partition through TCP adb. Change-Id: Ia37dd0dd3239381feb2a4484179a0c7847166b29
2020-07-28 00:15:53 +02:00
adbd_config_prop
Introduce apex_info_file type /apex/apex-info-file.xml is labeled as apex_info_file. It is created/written by apexd once by apexd, and can be read by zygote and system_server. The content of the file is essentially the same as the return value of getAllPackages() call to apexd. Bug: 154823184 Test: m Merged-In: Ic6af79ddebf465b389d9dcb5fd569d3a786423b2 (cherry picked from commit f1de4c02cc3da98d052ca81e48e7d4682eea6088) Change-Id: Ic6af79ddebf465b389d9dcb5fd569d3a786423b2
2020-05-11 13:49:07 +02:00
apex_info_file
Reorder 30.0.ignore.cil Test: pass Change-Id: Ib6e55348641db3eeb26eaa74423ccd62724ec7ed
2020-09-09 01:35:24 +02:00
cgroup_v2
Label kprobes and restrict access Bug: 149659981 Test: build Change-Id: I6abcd1bb9af15e7ba0f1f5e711ea9ac661bffc25
2020-06-10 12:27:12 +02:00
debugfs_kprobes
Define a new selinux label for DMABUF system heap Define the label dmabuf_system_heap_device for /dev/dma_heap/system. This the default DMA-BUF heap that Codec2 will use one ION is deprecated. Test: video playback without denials with DMA-BUF heaps enabled Bug: 168333162 Change-Id: Ief48165cd804bde00e1881a693b5eb44a45b633b
2020-09-11 00:43:07 +02:00
dmabuf_system_heap_device
Support GKI updates Adds proper file_contexts and domains for pre/postinstall hooks. Allow the pre/postinstall hooks to communicate with update_engine stable service. Bug: 161563386 Test: apply a GKI update Change-Id: I4437aab8e87ccbe55858150b95f67ec6e445ac1f
2020-06-02 00:07:50 +02:00
gki_apex_prepostinstall
gki_apex_prepostinstall_exec
Add sepolicy for IFingerprint Bug: 152416783 Test: run on cuttlefish Change-Id: I58d7c3bc9c81612b03bab3b9da938c091c02e3c1
2020-09-02 22:32:05 +02:00
hal_fingerprint_service
transcoding: allow transcoding service to use media services Also allow it to use fd from shell for unit tests. bug: 154734285 Change-Id: I2c5f3feca11f7ee4ee3ad927050b31f425370a84
2020-06-10 21:10:16 +02:00
gnss_device
Reland "Add persist.dumpstate.verbose_logging.enabled to system/..." This reverts commit 409c038d3c356c5a9eb418b966d08375c0b65f37. Reason for revert: fixed breakage Bug: 163759751 Test: lunch sdk; m selinux_policy Change-Id: I59d170cd3a764209d353d77372387fdc8719ea7f
2020-08-18 04:25:32 +02:00
hal_dumpstate_config_prop
Create Power Stats AIDL interface Bug: 162472196 Test: m Merged-In: I948ef2959b25d776d3b01985fea5eb695fd4fc1e Change-Id: I12dc33ce055c7275559cce33142cfb2aacc5471f
2020-08-03 23:31:43 +02:00
hal_power_stats_service
Add libselinux keystore_key backend. We add a new back end for SELinux based keystore2_key namespaces. This patch adds the rump policy and build system infrastructure for installing keystore2_key context files on the target devices. Bug: 158500146 Bug: 159466840 Test: None Change-Id: I423c9e68ad259926e4a315d052dfda97fa502106 Merged-In: I423c9e68ad259926e4a315d052dfda97fa502106
2020-07-25 22:02:29 +02:00
keystore2_key_contexts_file
Add location_time_zone_manager_service The LocationTimeZoneManagerService is being added as a "true" service so that it can be invoked by a shell command (i.e. adb shell cmd). This also means it will be dumped as part of dumpsys. Test: Build only Bug: 149014708 Change-Id: Ie60c4bea3af27a89b88ed753f9cf6e74aab04cd3
2020-09-08 12:41:43 +02:00
location_time_zone_manager_service
Add sepolicy for profcollectd This does not yet list all the required capabilities for profcollectd, but it at least allows the service to start under permissive mode. Bug: 79161490 Test: start profcollectd Change-Id: I92c6192fa9b31840b2aba26f83a6dc9f9e835030
2020-06-18 06:43:23 +02:00
mediatranscoding_tmpfs
Add sepolicy for music recognition service. Denial when not listed in priv_app.te: E SELinux : avc: denied { find } for pid=3213 uid=10170 name=music_recognition scontext=u:r:priv_app:s0:c512,c768 tcontext=u:object_r:music_recognition_service:s0 tclass=service_manager permissive=0 Bug: 158194857 Test: patched and tested on internal master Change-Id: I30e9ea79a57d9c353b732b629bd5a829c89bbcb0
2020-09-18 09:47:05 +02:00
music_recognition_service
Add sepolicy to allow read/write nfc snoop log data Bug: 153704838 Test: nfc snoop log could be accessed Change-Id: I694426ddb776114e5028b9e33455dd98fb502f0a
2020-07-08 11:09:49 +02:00
nfc_logs_data_file
Add sepolicy for people service This is to allow people service to publish a binder service that expose system private APIs to retrive and manage the recent cached conversations. Test: build and run on a test device Bug: 162593584 Change-Id: I31b5d8bc851ea7225e215b3f86ed6d47b32b1ba4
2020-07-31 23:37:41 +02:00
people_service
Create Power Stats AIDL interface Bug: 162472196 Test: m Merged-In: I948ef2959b25d776d3b01985fea5eb695fd4fc1e Change-Id: I12dc33ce055c7275559cce33142cfb2aacc5471f
2020-08-03 23:31:43 +02:00
power_stats_service
Define power.battery_input.suspended property Bug: 167636754 Test: on a device that has triggers configured for this property Test: adb shell setprop power.battery_input.suspended true to disable charging Test: adb shell setprop power.battery_input.suspended false to reenable charging Merged-In: I79209530d5355a59a1cb7a61c629339cd62f8eb1 Merged-In: I4692d84d5c137d11c6f648d15083614e707fdd07 Change-Id: I4692d84d5c137d11c6f648d15083614e707fdd07
2020-09-11 03:51:58 +02:00
power_debug_prop
Add sepolicy for profcollectd This does not yet list all the required capabilities for profcollectd, but it at least allows the service to start under permissive mode. Bug: 79161490 Test: start profcollectd Change-Id: I92c6192fa9b31840b2aba26f83a6dc9f9e835030
2020-06-18 06:43:23 +02:00
profcollectd
profcollectd_data_file
profcollectd_exec
Add update_engine_stable_service This is the stable AIDL binder interface that update_engine exposes in addition to update_engine_service. Test: run update_engine Bug: 160996544 Change-Id: I28ba11810844373d48c8c203f79e98150f932942
2020-07-23 04:57:15 +02:00
profcollectd_service
Add shell_test_data_file for /data/local/tests Add a domain for /data/local/tests which will be used by atest to execute tests on devices as shell or root. Bug: 138450837 Test: atest binderVendorDoubleLoadTest memunreachable_unit_test memunreachable_binder_test Change-Id: Ia34314bd9430e21c8b3304ac079e3d9b5705e19c
2020-09-01 01:11:11 +02:00
shell_test_data_file
Add file context type for /sys/devices/cs_etm This is the cs_etm (Coresight ETM) sysfs directory. Bug: 79161490 Test: build Change-Id: I9a66bb4b2684ef8637106a36f7d490d8f805cabf
2020-08-31 09:24:40 +02:00
sysfs_devices_cs_etm
sepolicy support for cgroup v2 cgroup v2 is going to be used for freezer v2 support. The cgroup v2 hiearchy will be mounted by init under /sys/fs/cgroup hence proper access rights are necessary for sysfs. After mounting, the cgroup v2 kernfs will use the label cgroup_v2 and system_manager will handle the freezer Bug: 154548692 Test: verified that files undes sysfs and cgroup v2 kernfs are accessed as required to allow proper functioning for the freezer. Change-Id: Idfb3f6e77b60dad032d1e306d2f9b58cd5775960
2020-05-27 23:10:39 +02:00
update_engine_stable_service
Selinux policy for new userspace reboot logging dir Add userspace_reboot_metadata_file, which is written to by init, and read by system server. System server will also handle the deletion policy and organization of files within this directory, so it needs additional permissions. Test: Builds Bug: 151820675 Change-Id: Ifbd70a6564e2705e3edf7da6b05486517413b211
2020-06-02 11:47:16 +02:00
userspace_reboot_metadata_file))
Reference in a new issue Copy permalink