Merge "Move props out of exported3_system_prop" am: b8b4a62ded am: 29f43e920f

Change-Id: I568b79c3900ab34731a695e0a37ef908f27177f7

private/compat/27.0/27.0.ignore.cil

@@ -18,8 +18,9 @@
     apexd_prop
     apexd_tmpfs
     app_zygote
-    audio_config_prop
+    art_apex_dir
     atrace
+    audio_config_prop
     binder_calls_stats_service
     biometric_service
     blank_screen
@@ -134,10 +135,11 @@
     perfetto_tmpfs
     perfetto_traces_data_file
     property_info
+    provisioned_prop
     recovery_socket
+    retaildemo_prop
     role_service
     runas_app
-    art_apex_dir
     runtime_service
     secure_element
     secure_element_device

private/compat/30.0/30.0.cil

@@ -1361,7 +1361,11 @@
     media_config_prop
     zram_config_prop))
 (typeattributeset exported3_radio_prop_30_0 (exported3_radio_prop))
-(typeattributeset exported3_system_prop_30_0 (exported3_system_prop boot_status_prop))
+(typeattributeset exported3_system_prop_30_0
+  ( exported3_system_prop
+    boot_status_prop
+    provisioned_prop
+    retaildemo_prop))
 (typeattributeset exported_audio_prop_30_0 (exported_audio_prop audio_config_prop))
 (typeattributeset exported_bluetooth_prop_30_0 (exported_bluetooth_prop))
 (typeattributeset exported_camera_prop_30_0 (exported_camera_prop))

private/property.te

@@ -369,3 +369,19 @@ neverallow {
   usb_config_prop
   usb_control_prop
 }:property_service set;
+
+neverallow {
+  -init
+  -system_server
+} {
+  provisioned_prop
+  retaildemo_prop
+}:property_service set;
+
+neverallow {
+  -coredomain
+  -vendor_init
+} {
+  provisioned_prop
+  retaildemo_prop
+}:file no_rw_file_perms;

private/property_contexts

@@ -517,10 +517,12 @@ apexd.status u:object_r:apexd_prop:s0 exact enum starting activated ready
 dev.bootcomplete   u:object_r:boot_status_prop:s0 exact bool
 sys.boot_completed u:object_r:boot_status_prop:s0 exact bool
 
-persist.sys.device_provisioned  u:object_r:exported3_system_prop:s0 exact string
+persist.sys.device_provisioned u:object_r:provisioned_prop:s0 exact string
+
 persist.sys.theme               u:object_r:theme_prop:s0 exact string
 
-sys.retaildemo.enabled  u:object_r:exported3_system_prop:s0 exact int
+sys.retaildemo.enabled u:object_r:retaildemo_prop:s0 exact int
+
 sys.user.0.ce_available u:object_r:exported3_system_prop:s0 exact bool
 
 aac_drc_boost            u:object_r:aac_drc_prop:s0 exact int

private/system_server.te

@@ -620,6 +620,8 @@ set_prop(system_server, socket_hook_prop)
 set_prop(system_server, audio_prop)
 set_prop(system_server, boot_status_prop)
 set_prop(system_server, surfaceflinger_color_prop)
+set_prop(system_server, provisioned_prop)
+set_prop(system_server, retaildemo_prop)
 userdebug_or_eng(`set_prop(system_server, wifi_log_prop)')
 
 # ctl interface

public/property.te

@@ -66,7 +66,9 @@ system_restricted_prop(fingerprint_prop)
 system_restricted_prop(libc_debug_prop)
 system_restricted_prop(module_sdkextensions_prop)
 system_restricted_prop(nnapi_ext_deny_product_prop)
+system_restricted_prop(provisioned_prop)
 system_restricted_prop(restorecon_prop)
+system_restricted_prop(retaildemo_prop)
 system_restricted_prop(socket_hook_prop)
 system_restricted_prop(system_boot_reason_prop)
 system_restricted_prop(system_jvmti_agent_prop)

public/vendor_init.te

@@ -245,9 +245,11 @@ set_prop(vendor_init, zram_control_prop)
 get_prop(vendor_init, boot_status_prop)
 get_prop(vendor_init, exported2_radio_prop)
 get_prop(vendor_init, exported3_system_prop)
+get_prop(vendor_init, ota_prop)
+get_prop(vendor_init, provisioned_prop)
+get_prop(vendor_init, retaildemo_prop)
 get_prop(vendor_init, theme_prop)
 
-get_prop(vendor_init, ota_prop)
 
 ###
 ### neverallow rules