tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Merge "Enable ART properties modularization" am: c4efcbdc06

Browse source 
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/1710967

Change-Id: I40cb9f712f70a78e312e5cd8e0e9ee59088d849a
This commit is contained in:
Calin Juravle 2021-06-02 14:41:08 +00:00 committed by Automerger Merge Worker
commit e6bf8c1409
10 changed files with 43 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
private/app.te
View file

@ -14,6 +14,11 @@ get_prop(appdomain, userspace_reboot_config_prop)
get_prop(appdomain, vold_config_prop)
get_prop(appdomain, adbd_config_prop)
# Allow ART to be configurable via device_config properties
# (ART "runs" inside the app process)
get_prop(appdomain, device_config_runtime_native_prop)
get_prop(appdomain, device_config_runtime_native_boot_prop)
userdebug_or_eng(`perfetto_producer({ appdomain })')
# Prevent apps from causing presubmit failures.

4
private/app_zygote.te
View file

@ -75,6 +75,10 @@ allow app_zygote system_data_file:file { getattr read map };
# Send unsolicited message to system_server
unix_socket_send(app_zygote, system_unsolzygote, system_server)
# Allow the app_zygote to access the runtime feature flag properties.
get_prop(app_zygote, device_config_runtime_native_prop)
get_prop(app_zygote, device_config_runtime_native_boot_prop)
#####
##### Neverallow
#####

4
private/artd.te
View file

@ -10,3 +10,7 @@ allow artd dumpstate:fifo_file { getattr write };
typeattribute artd coredomain;
init_daemon_domain(artd)
# Allow query ART device config properties
get_prop(artd, device_config_runtime_native_prop)
get_prop(artd, device_config_runtime_native_boot_prop)

4
private/dexoptanalyzer.te
View file

@ -47,3 +47,7 @@ allow dexoptanalyzer { privapp_data_file app_data_file }:file { getattr read map
# Allow testing /data/user/0 which symlinks to /data/data
allow dexoptanalyzer system_data_file:lnk_file { getattr };
# Allow query ART device config properties
get_prop(dexoptanalyzer, device_config_runtime_native_prop)
get_prop(dexoptanalyzer, device_config_runtime_native_boot_prop)

4
private/odrefresh.te
View file

@ -48,3 +48,7 @@ neverallow { domain -init -odrefresh -system_server } odrefresh_data_file:file *
# Allow updating boot animation status.
set_prop(odrefresh, bootanim_system_prop)
# Allow query ART device config properties
get_prop(odrefresh, device_config_runtime_native_prop)
get_prop(odrefresh, device_config_runtime_native_boot_prop)

11
private/property_contexts
View file

@ -330,7 +330,13 @@ ro.camera.enableLazyHal u:object_r:camera_config_prop:s0 exact bool
ro.camerax.extensions.enabled u:object_r:camerax_extensions_prop:s0 exact bool
# Should always_debuggable be bool? It's checked against the string "1".
# ART properties
dalvik.vm. u:object_r:dalvik_config_prop:s0
ro.dalvik.vm. u:object_r:dalvik_config_prop:s0
ro.zygote u:object_r:dalvik_config_prop:s0 exact string
# A set of ART properties listed explicitly for compatibility purposes.
ro.dalvik.vm.native.bridge u:object_r:dalvik_config_prop:s0 exact string
dalvik.vm.always_debuggable u:object_r:dalvik_config_prop:s0 exact int
dalvik.vm.appimageformat u:object_r:dalvik_config_prop:s0 exact string
dalvik.vm.backgroundgctype u:object_r:dalvik_config_prop:s0 exact string
@ -406,7 +412,6 @@ dalvik.vm.restore-dex2oat-threads u:object_r:dalvik_config_prop:s0 e
dalvik.vm.usejit u:object_r:dalvik_config_prop:s0 exact bool
dalvik.vm.usejitprofiles u:object_r:dalvik_config_prop:s0 exact bool
dalvik.vm.zygote.max-boot-retry u:object_r:dalvik_config_prop:s0 exact int
ro.zygote u:object_r:dalvik_config_prop:s0 exact string
persist.sys.dalvik.vm.lib.2 u:object_r:dalvik_runtime_prop:s0 exact string
@ -494,8 +499,6 @@ ro.crypto.volume.metadata.encryption u:object_r:vold_config_prop:s0 e
ro.crypto.volume.metadata.method u:object_r:vold_config_prop:s0 exact string
ro.crypto.volume.options u:object_r:vold_config_prop:s0 exact string
ro.dalvik.vm.native.bridge u:object_r:dalvik_config_prop:s0 exact string
external_storage.projid.enabled u:object_r:storage_config_prop:s0 exact bool
external_storage.casefold.enabled u:object_r:storage_config_prop:s0 exact bool
external_storage.sdcardfs.enabled u:object_r:storage_config_prop:s0 exact bool

5
private/system_server.te
View file

@ -706,6 +706,11 @@ set_prop(system_server, device_config_window_manager_native_boot_prop)
set_prop(system_server, device_config_configuration_prop)
set_prop(system_server, device_config_connectivity_prop)
# Allow query ART device config properties
get_prop(system_server, device_config_runtime_native_boot_prop)
get_prop(system_server, device_config_runtime_native_prop)
# BootReceiver to read ro.boot.bootreason
get_prop(system_server, bootloader_boot_reason_prop)
# PowerManager to read sys.boot.reason

4
private/webview_zygote.te
View file

@ -83,6 +83,10 @@ allow webview_zygote system_data_file:lnk_file r_file_perms;
# Send unsolicited message to system_server
unix_socket_send(webview_zygote, system_unsolzygote, system_server)
# Allow the webview_zygote to access the runtime feature flag properties.
get_prop(webview_zygote, device_config_runtime_native_prop)
get_prop(webview_zygote, device_config_runtime_native_boot_prop)
#####
##### Neverallow
#####

4
public/profman.te
View file

@ -22,6 +22,10 @@ allow profman installd:fd use;
allow profman { privapp_data_file app_data_file }:file { getattr read write lock map };
allow profman { privapp_data_file app_data_file }:dir { getattr read search };
# Allow query ART device config properties
get_prop(profman, device_config_runtime_native_prop)
get_prop(profman, device_config_runtime_native_boot_prop)
###
### neverallow rules
###

4
public/property.te
View file

@ -11,8 +11,6 @@ system_internal_prop(device_config_input_native_boot_prop)
system_internal_prop(device_config_media_native_prop)
system_internal_prop(device_config_netd_native_prop)
system_internal_prop(device_config_reset_performed_prop)
system_internal_prop(device_config_runtime_native_boot_prop)
system_internal_prop(device_config_runtime_native_prop)
system_internal_prop(firstboot_prop)
compatible_property_only(`
@ -67,6 +65,8 @@ system_restricted_prop(bq_config_prop)
system_restricted_prop(build_bootimage_prop)
system_restricted_prop(build_prop)
system_restricted_prop(charger_status_prop)
system_restricted_prop(device_config_runtime_native_boot_prop)
system_restricted_prop(device_config_runtime_native_prop)
system_restricted_prop(fingerprint_prop)
system_restricted_prop(hal_instrumentation_prop)
system_restricted_prop(init_service_status_prop)