tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Merge "Allow keystore to read and write keystore.crash_count system property." into sc-dev am: 2a5ab82215

Browse source 
Original change: https://googleplex-android-review.googlesource.com/c/platform/system/sepolicy/+/15191874

Change-Id: I3c105d2e05f7eb6a52642ccae156afd96063f735
This commit is contained in:
Hasini Gunasinghe 2021-07-09 00:26:37 +00:00 committed by Automerger Merge Worker
commit f6e8eea87b
6 changed files with 18 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
prebuilts/api/31.0/private/keystore.te
View file

@ -20,10 +20,6 @@ get_prop(keystore, device_logging_prop)
# Allow keystore to write to statsd.
unix_socket_send(keystore, statsdw, statsd)
# Allow keystore to register callbacks with statsd.
allow keystore stats_service:service_manager find;
binder_call(keystore, statsd);
# Keystore need access to the keystore_key context files to load the keystore key backend.
allow keystore keystore2_key_contexts_file:file r_file_perms;
@ -33,3 +29,8 @@ get_prop(keystore, keystore_listen_prop)
# can call keystore methods on those references.
allow keystore vold:binder transfer;
allow keystore wait_for_keymaster:binder transfer;
# Only keystore can set keystore.crash_count system property. Since init is allowed to set any
# system property, an exception is added for init as well.
set_prop(keystore, keystore_crash_prop)
neverallow { domain -keystore -init } keystore_crash_prop:property_service set;

1
prebuilts/api/31.0/private/property.te
View file

@ -15,6 +15,7 @@ system_internal_prop(gsid_prop)
system_internal_prop(init_perf_lsm_hooks_prop)
system_internal_prop(init_service_status_private_prop)
system_internal_prop(init_svc_debug_prop)
system_internal_prop(keystore_crash_prop)
system_internal_prop(keystore_listen_prop)
system_internal_prop(last_boot_reason_prop)
system_internal_prop(localization_prop)

3
prebuilts/api/31.0/private/property_contexts
View file

@ -1149,6 +1149,9 @@ ro.zygote.disable_gl_preload u:object_r:zygote_config_prop:s0 exact bool
# Broadcast boot stages, which keystore listens to
keystore.boot_level u:object_r:keystore_listen_prop:s0 exact int
# Property that tracks keystore crash counts during a boot cycle.
keystore.crash_count u:object_r:keystore_crash_prop:s0 exact int
partition.system.verified u:object_r:verity_status_prop:s0 exact string
partition.system_ext.verified u:object_r:verity_status_prop:s0 exact string
partition.product.verified u:object_r:verity_status_prop:s0 exact string

9
private/keystore.te
View file

@ -20,10 +20,6 @@ get_prop(keystore, device_logging_prop)
# Allow keystore to write to statsd.
unix_socket_send(keystore, statsdw, statsd)
# Allow keystore to register callbacks with statsd.
allow keystore stats_service:service_manager find;
binder_call(keystore, statsd);
# Keystore need access to the keystore_key context files to load the keystore key backend.
allow keystore keystore2_key_contexts_file:file r_file_perms;
@ -33,3 +29,8 @@ get_prop(keystore, keystore_listen_prop)
# can call keystore methods on those references.
allow keystore vold:binder transfer;
allow keystore wait_for_keymaster:binder transfer;
# Only keystore can set keystore.crash_count system property. Since init is allowed to set any
# system property, an exception is added for init as well.
set_prop(keystore, keystore_crash_prop)
neverallow { domain -keystore -init } keystore_crash_prop:property_service set;

1
private/property.te
View file

@ -15,6 +15,7 @@ system_internal_prop(gsid_prop)
system_internal_prop(init_perf_lsm_hooks_prop)
system_internal_prop(init_service_status_private_prop)
system_internal_prop(init_svc_debug_prop)
system_internal_prop(keystore_crash_prop)
system_internal_prop(keystore_listen_prop)
system_internal_prop(last_boot_reason_prop)
system_internal_prop(localization_prop)

3
private/property_contexts
View file

@ -1149,6 +1149,9 @@ ro.zygote.disable_gl_preload u:object_r:zygote_config_prop:s0 exact bool
# Broadcast boot stages, which keystore listens to
keystore.boot_level u:object_r:keystore_listen_prop:s0 exact int
# Property that tracks keystore crash counts during a boot cycle.
keystore.crash_count u:object_r:keystore_crash_prop:s0 exact int
partition.system.verified u:object_r:verity_status_prop:s0 exact string
partition.system_ext.verified u:object_r:verity_status_prop:s0 exact string
partition.product.verified u:object_r:verity_status_prop:s0 exact string