tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Merge "Revert system app/process profileability on user builds"

Browse source
This commit is contained in:
Treehugger Robot 2022-07-04 15:41:08 +00:00 committed by Gerrit Code Review
commit 829acbee3a
10 changed files with 2 additions and 46 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
prebuilts/api/33.0/private/gmscore_app.te
View file

@ -5,11 +5,6 @@ typeattribute gmscore_app coredomain;
app_domain(gmscore_app)
# TODO(b/217368496): remove this.
perfetto_producer(gmscore_app)
can_profile_heap(gmscore_app)
can_profile_perf(gmscore_app)
allow gmscore_app sysfs_type:dir search;
# Read access to /sys/block/zram*/mm_stat
r_dir_file(gmscore_app, sysfs_zram)

4
prebuilts/api/33.0/private/platform_app.te
View file

@ -113,10 +113,6 @@ dontaudit platform_app debugfs_tracing:file rw_file_perms;
# Allow platform apps to act as Perfetto producers.
perfetto_producer(platform_app)
# TODO(b/217368496): remove this.
can_profile_heap(platform_app)
can_profile_perf(platform_app)
# Allow platform apps to create VMs
virtualizationservice_use(platform_app)

6
prebuilts/api/33.0/private/surfaceflinger.te
View file

@ -74,13 +74,9 @@ userdebug_or_eng(`
allow surfaceflinger wm_trace_data_file:file { getattr setattr create w_file_perms };
')
# Allow userspace tracing via perfetto.
# Needed to register as a Perfetto producer.
perfetto_producer(surfaceflinger)
# Allow to be profiled by performance tools.
can_profile_heap(surfaceflinger)
can_profile_perf(surfaceflinger)
# Use socket supplied by adbd, for cmd gpu vkjson etc.
allow surfaceflinger adbd:unix_stream_socket { read write getattr };

4
prebuilts/api/33.0/private/system_app.te
View file

@ -176,10 +176,6 @@ get_prop(system_app, oem_unlock_prop)
# Allow system apps to act as Perfetto producers.
perfetto_producer(system_app)
# TODO(b/217368496): remove this.
can_profile_heap(system_app)
can_profile_perf(system_app)
###
### Neverallow rules
###

5
prebuilts/api/33.0/private/system_server.te
View file

@ -15,11 +15,6 @@ tmpfs_domain(system_server)
userfaultfd_use(system_server)
# TODO(b/217368496): remove this.
perfetto_producer(system_server)
can_profile_heap(system_server)
can_profile_perf(system_server)
# Create a socket for connections from crash_dump.
type_transition system_server system_data_file:sock_file system_ndebug_socket "ndebugsocket";

5
private/gmscore_app.te
View file

@ -5,11 +5,6 @@ typeattribute gmscore_app coredomain;
app_domain(gmscore_app)
# TODO(b/217368496): remove this.
perfetto_producer(gmscore_app)
can_profile_heap(gmscore_app)
can_profile_perf(gmscore_app)
allow gmscore_app sysfs_type:dir search;
# Read access to /sys/class/net/wlan*/address
r_dir_file(gmscore_app, sysfs_net)

4
private/platform_app.te
View file

@ -112,10 +112,6 @@ dontaudit platform_app debugfs_tracing:file rw_file_perms;
# Allow platform apps to act as Perfetto producers.
perfetto_producer(platform_app)
# TODO(b/217368496): remove this.
can_profile_heap(platform_app)
can_profile_perf(platform_app)
# Allow platform apps to create VMs
virtualizationservice_use(platform_app)

6
private/surfaceflinger.te
View file

@ -74,13 +74,9 @@ userdebug_or_eng(`
allow surfaceflinger wm_trace_data_file:file { getattr setattr create w_file_perms };
')
# Allow userspace tracing via perfetto.
# Needed to register as a Perfetto producer.
perfetto_producer(surfaceflinger)
# Allow to be profiled by performance tools.
can_profile_heap(surfaceflinger)
can_profile_perf(surfaceflinger)
# Use socket supplied by adbd, for cmd gpu vkjson etc.
allow surfaceflinger adbd:unix_stream_socket { read write getattr };

4
private/system_app.te
View file

@ -177,10 +177,6 @@ get_prop(system_app, oem_unlock_prop)
# Allow system apps to act as Perfetto producers.
perfetto_producer(system_app)
# TODO(b/217368496): remove this.
can_profile_heap(system_app)
can_profile_perf(system_app)
###
### Neverallow rules
###

5
private/system_server.te
View file

@ -15,11 +15,6 @@ tmpfs_domain(system_server)
userfaultfd_use(system_server)
# TODO(b/217368496): remove this.
perfetto_producer(system_server)
can_profile_heap(system_server)
can_profile_perf(system_server)
# Create a socket for connections from crash_dump.
type_transition system_server system_data_file:sock_file system_ndebug_socket "ndebugsocket";