From 05477957eb15680eeb46ed7c931ea7a303089af7 Mon Sep 17 00:00:00 2001 From: Branden Archer Date: Tue, 27 Nov 2018 15:47:12 -0800 Subject: [PATCH 1/2] Allow init to set powerctl property NIAP certification requires that all cryptographic functions undergo a self-test during startup to demonstrate correct operation. init now performs this check during startup. The self-test is forked from init. For the child process to be able to request a reboot it needs permissions to set the sys.powerctl property. Bug: 119826244 Test: Built for walleye. When the BoringSSL self test was forced to fail the device rebooted into the bootloader, as expected. Change-Id: I2108bf6c345a5804ebd1e2206f9b8fde21a58e64 Merged-In: I4171b1dd0a5e393252ae5c002171ac51c9cbb3e6 --- prebuilts/api/28.0/private/init.te | 3 +++ private/init.te | 3 +++ 2 files changed, 6 insertions(+) diff --git a/prebuilts/api/28.0/private/init.te b/prebuilts/api/28.0/private/init.te index e9959d3d2..8ba050fa6 100644 --- a/prebuilts/api/28.0/private/init.te +++ b/prebuilts/api/28.0/private/init.te @@ -20,3 +20,6 @@ domain_trans(init, { rootfs toolbox_exec }, modprobe) userdebug_or_eng(` domain_auto_trans(init, logcat_exec, logpersist) ') + +# Allow the BoringSSL self test to request a reboot upon failure +set_prop(init, powerctl_prop) diff --git a/private/init.te b/private/init.te index e9959d3d2..8ba050fa6 100644 --- a/private/init.te +++ b/private/init.te @@ -20,3 +20,6 @@ domain_trans(init, { rootfs toolbox_exec }, modprobe) userdebug_or_eng(` domain_auto_trans(init, logcat_exec, logpersist) ') + +# Allow the BoringSSL self test to request a reboot upon failure +set_prop(init, powerctl_prop) From aadedb205127bfa019d1c1da9208aa41077258e9 Mon Sep 17 00:00:00 2001 From: Wei Wang Date: Wed, 21 Nov 2018 07:50:33 -0800 Subject: [PATCH 2/2] Allow lmkd to renice process before killing Bug: 118468011 Bug: 121439388 Test: mem-pressure test Change-Id: Icf387a02243af60a3bfffba912711f037669fa7f Merged-In: Icf387a02243af60a3bfffba912711f037669fa7f --- prebuilts/api/28.0/public/lmkd.te | 4 ++-- public/lmkd.te | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/prebuilts/api/28.0/public/lmkd.te b/prebuilts/api/28.0/public/lmkd.te index 472946ece..5b4a235a0 100644 --- a/prebuilts/api/28.0/public/lmkd.te +++ b/prebuilts/api/28.0/public/lmkd.te @@ -21,8 +21,8 @@ allow lmkd system_server:file write; r_dir_file(lmkd, sysfs_lowmemorykiller) allow lmkd sysfs_lowmemorykiller:file w_file_perms; -# Send kill signals -allow lmkd appdomain:process sigkill; +# setsched and send kill signals +allow lmkd appdomain:process { setsched sigkill }; # Clean up old cgroups allow lmkd cgroup:dir { remove_name rmdir }; diff --git a/public/lmkd.te b/public/lmkd.te index 472946ece..5b4a235a0 100644 --- a/public/lmkd.te +++ b/public/lmkd.te @@ -21,8 +21,8 @@ allow lmkd system_server:file write; r_dir_file(lmkd, sysfs_lowmemorykiller) allow lmkd sysfs_lowmemorykiller:file w_file_perms; -# Send kill signals -allow lmkd appdomain:process sigkill; +# setsched and send kill signals +allow lmkd appdomain:process { setsched sigkill }; # Clean up old cgroups allow lmkd cgroup:dir { remove_name rmdir };