Commit graph

341 commits

Author SHA1 Message Date
Automerger Merge Worker
4d7f45f968 Merge "Define sepolicy for redirect-socket-calls feature" am: 622e4f761b am: 4f799574bd am: 9c7e277700
Change-Id: I364408ff8119300cf87cf85fa07b8b179697396c
2020-02-20 05:59:04 +00:00
Ken Chen
622e4f761b Merge "Define sepolicy for redirect-socket-calls feature" 2020-02-20 05:18:55 +00:00
Mark Salyzyn
3b576b46f1 bootstat: enhance last reboot reason property with file backing am: 79f9ca6789 am: d5c3a11681 am: c3eb896930
Change-Id: Id032de31811ce737868f8c3da5dc49ef2e11e824
2020-02-17 10:12:25 +00:00
Mark Salyzyn
79f9ca6789 bootstat: enhance last reboot reason property with file backing
Helps with support of recovery and rollback boot reason history, by
also using /metadata/bootstat/persist.sys.boot.reason to file the
reboot reason.  For now, label this file metadata_bootstat_file.

Test: manual
Bug: 129007837
Change-Id: Id1d21c404067414847bef14a0c43f70cafe1a3e2
2020-02-14 13:30:21 -08:00
Ken Chen
64f0be204b Define sepolicy for redirect-socket-calls feature
Define two property_context.

1. vendor_socket_hook_prop - for ro.vendor.redirect_socket_calls. The
property set once in vendor_init context. It's evaluated at process
start time and is cannot change at runtime on a given device. The set
permission is restricted to vendor_init. The read permission is
unrestricted.

2. socket_hook_prop - for net.redirect_socket_calls.hooked. The
property can be changed by System Server at runtime. It's evaluated when
shimmed socket functions is called. The set permission is restricted to
System Server. The read permission is unrestricted.

Bug: Bug: 141611769
Test: System Server can set net.redirect_socket_calls.hooked
      libnetd_client can read both properties
      libnetd_client can't set both properties

Change-Id: Ic42269539923e6930cc0ee3df8ba032797212395
2020-02-11 20:55:02 +08:00
Automerger Merge Worker
041cbfd39c Revert "Revert "Define sepolicy for ro.product.vndk.version"" am: ed0a8ebe50 am: 176dc81e69 am: 93a8b34cf2
Change-Id: If56c38e51d4f07fe4a8a1069d0f7d9cc25150446
2020-01-06 08:25:37 +00:00
Justin Yun
ed0a8ebe50 Revert "Revert "Define sepolicy for ro.product.vndk.version""
This reverts commit f536a60407.

Reason for revert: Resubmit the CL with the fix in vendor_init.te

Bug: 144534640
Test: lunch sdk-userdebug; m sepolicy_tests
Change-Id: I47c589c071324d8f031a0f7ebdfa8188869681e9
2020-01-06 15:12:14 +09:00
Automerger Merge Worker
4d6b8cc6d8 Revert "Define sepolicy for ro.product.vndk.version" am: f536a60407 am: f71a38667e am: 5ce7c8cb01
Change-Id: I34649f637a64611cc634e78a472bbf33b0973d50
2020-01-06 06:05:13 +00:00
Justin Yun
f536a60407 Revert "Define sepolicy for ro.product.vndk.version"
This reverts commit 59e3983d1f.

Reason for revert: postsubmit fails in aosp/master

Change-Id: Icb10402ccdb6cff942a91adef341fe8f867f308a
2020-01-06 05:28:37 +00:00
Automerger Merge Worker
de275dfccd Define sepolicy for ro.product.vndk.version am: 59e3983d1f am: 8018944364 am: 1791ec6e5d
Change-Id: I4a756a32bea0a5f97fee24432bc88bd18b4a2007
2020-01-06 05:24:46 +00:00
Justin Yun
59e3983d1f Define sepolicy for ro.product.vndk.version
Define a new property_context vndk_prop for ro.product.vndk.version.
It is set by init process but public to all modules.

Bug: 144534640
Test: check if ro.product.vndk.version is set correctly.
Change-Id: If739d4e25de93d9ed2ee2520408e07a8c87d46fe
2020-01-06 11:08:23 +09:00
Automerger Merge Worker
e98f78a0ab Merge "Create new system property type for Factory OTA could write system property" am: a75fa8058c am: 150bdab002 am: c188e2deca
Change-Id: Ic3b959a1bae773101eb8c6ee072d88457e162772
2019-12-15 19:49:31 +00:00
Henry Tung
6d57b494c0 Create new system property type for Factory OTA could write system property
Due to Factory OTA client install in product partition but it also declare coredomian in
its sepolicy setting. That will let Factory OTA unable to find a property type could write system property.
But now Factory OTA have a restore NFC wake function need to write system property for communicate with bootloader.
So we need to create a new property type in system framework which could allow Factory OTA client to write system property.

Bug: 145178094
Test: Manual
Change-Id: Ic549cc939893ec67a46bf28a23ebeb9f9b81bd0b
2019-12-13 09:39:19 +00:00
Jeff Vander Stoep
2f1f222716 Merge "netlink_route_socket: add new nlmsg_readpriv perm" am: b49018d29c am: 8ec6fca5d2 am: ff1d7c535b
am: aa88b57cf5

Change-Id: Id4e80375e4c5b599b10a6f432d7278d618bd9d2d
2019-10-17 01:38:17 -07:00
Jeff Vander Stoep
fb69c8e64f netlink_route_socket: add new nlmsg_readpriv perm
Used when mapping RTM_GETLINK messages to this new permission.

Users of netlink_route_sockets that do not use the net_domain()
macro will need to grant this permission as needed. Compatibility
with older vendor images is preserved by granting all vendor domains
access to this new permission in *.compat.cil files.

Bug: 141455849
Test: build (this change is a no-op without kernel changes)
Change-Id: I18f1c9fc958120a26b7b3bea004920d848ffb26e
2019-10-16 16:14:16 +02:00
Pierre-Hugues Husson
f81a678922 Merge "Mark mediacodec_2{6,7,8} as hal_omx_server" am: cc3f943436 am: 0608b6cdfb am: 95dbe16e99
am: 03f2bb6792

Change-Id: I80da7dd1e53602019a7caf22158c16a4cde27f13
2019-10-01 19:28:00 -07:00
Pierre-Hugues Husson
1019870fba Mark mediacodec_2{6,7,8} as hal_omx_server
The commit 7baf725ea6 broke OMX on O/O-MR1(/P?) vendors.
Previous to this commit, all OMX codecs had to use "mediacodec" type,
after this commit, omx codecs just had to get hal_omx_server attribute.
This commit left to the vendor the charge of adding "hal_omx_server"
attribute to mediacodec.

However this can't work on non-Q vendors.

On P vendor, versioned_plat_pub contains the appdomain <=> mediacodec
allows, so OMX isn't technically broken on those devices.
But to ensure it won't break in the future, mark 28's mediacodec as
hal_omx_server as well

This fixes broken OMX decoding on O/O-MR1 vendors, failing with the
following denial:
avc: denied { call } for comm=4E444B204D65646961436F6465635F scontext=u:r:platform_app:s0:c512,c768 tcontext=u:r:mediacodec:s0 tclass=binder permissive=0

Bug: 141186440

Change-Id: I018f8d9aabc77e7ea86ca14734b1ab2edfdf8ed1
2019-10-01 20:48:01 +00:00
Tri Vo
a53cbc3e46 Merge "sepolicy: remove ashmemd" am: b398dbb9ea am: 5e7b366c16 am: 606fce3011
am: 78a5a2d4ad

Change-Id: I6220f15bc0f708a10bead4589e609bb020692f6f
2019-10-01 09:57:52 -07:00
Tri Vo
bfcddbe25e sepolicy: remove ashmemd
Bug: 139855428
Test: m selinux_policy
Change-Id: I8d7f66b16be025f7cb9c5269fae6fd7540c2fdc9
2019-09-27 17:43:53 +00:00
Martin Stjernholm
b0dc8b18a8 Merge "Rename the context for the ART APEX." am: 53f223346d am: d3455b0c7d am: e1ea1481ec am: 77c8abc7e7
am: fbc77ffdea

Change-Id: If5b3a235c71efeb24d82a7ddfd55322edc31190b
2019-09-06 08:29:06 -07:00
Martin Stjernholm
d7951d2647 Rename the context for the ART APEX.
Test: Boot (with default flattened APEXes)
Bug: 135753770
Change-Id: I551e88a250d3bd891f63a6bccee0682d0d0de7cf
2019-09-05 19:49:05 +01:00
Elliott Hughes
1aec249176 Merge "Remove perfprofd references." am: c807b3fd8a am: 509135ac69 am: 397261ccdf am: 9a2b7f0ff2
am: 4fbb98cd10

Change-Id: I9d364e4a5a17b70a2defb7f0ee28e647689dec1a
2019-07-24 00:38:37 -07:00
Elliott Hughes
509135ac69 Merge "Remove perfprofd references."
am: c807b3fd8a

Change-Id: I90501f397c29847e2e497f10515571fa10f9d992
2019-07-23 17:10:33 -07:00
Elliott Hughes
132b081ee3 Remove perfprofd references.
perfprofd was never finished, and has been removed.

Test: treehugger
Change-Id: I4fc8aa9b737360a66d89c5be39651284ee2d6ffd
2019-07-19 11:15:12 -07:00
Tao Bao
c636b50dd6 Merge "Add persist.sys.theme." into qt-dev am: 890dba4999 am: 1520895967
am: f33998c41f

Change-Id: I69e1aa86bd483dddf6930680e4db44ded23ebf48
2019-06-18 22:46:23 -07:00
Tao Bao
1520895967 Merge "Add persist.sys.theme." into qt-dev
am: 890dba4999

Change-Id: Ia747bf55b5275a8b05a3dbb971c82747b4292807
2019-06-18 20:25:32 -07:00
Tao Bao
a999e39423 Add persist.sys.theme.
This property will be set by system_server (to indicate the currently
selected theme for device), and can be accessed by vendor init.rc.

avc:  denied  { read } for property=persist.sys.theme pid=0 uid=0 gid=0 scontext=u:r:vendor_init:s0 tcontext=u:object_r:theme_prop:s0 tclass=file

Bug: 113028175
Test: Set a vendor init trigger that waits on `persist.sys.theme`. Check
      that the trigger fires without denial.
Change-Id: Ia85b1a8dfc118efdbb9337ca017c8fb7958dc386
Merged-In: Ibb4e392d5059b76059f36f7d11ba82cd65cbe970
(cherry picked from commit 75182a1ea6)
2019-06-18 17:36:21 -07:00
Tao Bao
75182a1ea6 Add persist.sys.theme.
This property will be set by system_server (to indicate the currently
selected theme for device), and can be accessed by vendor init.rc.

avc:  denied  { read } for property=persist.sys.theme pid=0 uid=0 gid=0 scontext=u:r:vendor_init:s0 tcontext=u:object_r:theme_prop:s0 tclass=file

Bug: 113028175
Test: Set a vendor init trigger that waits on `persist.sys.theme`. Check
      that the trigger fires without denial.
Change-Id: Ibb4e392d5059b76059f36f7d11ba82cd65cbe970
2019-06-17 10:48:21 -07:00
Jiyong Park
3ec734ca4e Merge "Allow apexd to stop itself" am: 7436dba4c4 am: 6b9060cf15 am: fa9e9176f8
am: 04c92bb2c0

Change-Id: Ie4505768abc83889d34349cdd2102be45397b1e0
2019-06-14 00:07:23 -07:00
Jiyong Park
fa9e9176f8 Merge "Allow apexd to stop itself" am: 7436dba4c4
am: 6b9060cf15

Change-Id: Id9302af08aec77b69ca7a2c889c7c45e4428a439
2019-06-13 23:50:06 -07:00
Jiyong Park
6e823dd597 Allow apexd to stop itself
apexd stops itself when it finds that it is running on a device with
flattened APEXes (i.e. ro.apex.updatable = false).

Bug: 133907211
Test: launch sdk_phone_x86_64
adb logcat -d | grep apexd | wc -l
returns 3

Change-Id: I7fa161b069aa34adb028194b55f367fe740a0cfc
2019-06-13 09:45:05 +09:00
Luke Huang
848075e330 Merge "Clean sepolicy of unused netd_socket" 2019-06-03 06:39:15 +00:00
Luke Huang
3a97f5ae8c Clean sepolicy of unused netd_socket
Bug: 65862741
Test: built, flashed, booted
Change-Id: I25578e54f8c222d381c8f8ea0ec143b5b503b6a6
Merged-In: I726aadd54b04df68cff992b70443c0335ca50972
2019-05-30 17:41:16 +08:00
Kalesh Singh
be95f9728f Merge "Sepolicy for IAshmem HIDL interface" am: b374835ffb am: 99a5e65385 am: 533363bb54
am: 2c45c52bad

Change-Id: I8808520448c0091211ba492a9fec9810917dd833
2019-05-30 01:07:25 -07:00
Kalesh Singh
533363bb54 Merge "Sepolicy for IAshmem HIDL interface" am: b374835ffb
am: 99a5e65385

Change-Id: I15778c78f997acdc3422ea941301f0ea61dabff4
2019-05-30 00:52:03 -07:00
Treehugger Robot
b374835ffb Merge "Sepolicy for IAshmem HIDL interface" 2019-05-30 07:36:41 +00:00
Kalesh Singh
46303aa1f7 Sepolicy for IAshmem HIDL interface
Change-Id: Id78f995661120f136d671ea0084db358e7662122
Bug: 133443879
Test: Manually check logcat for sepolicy denials (logcat | grep IAshmem)
2019-05-29 14:44:47 -07:00
Jiyong Park
6ece872622 Merge "Don't use apexd when TARGET_FLATTEN_APEX == true" am: 825b11ef6f
am: f902b4eb7d

Change-Id: I122aba3ce61085e123b40eda4a02361dd7c50138
2019-05-29 09:33:37 -07:00
Jiyong Park
04d2392c35 Don't use apexd when TARGET_FLATTEN_APEX == true
/system/apex/com.android.runtime is labeled as runtime_apex_dir
and init is allowed to mount on it.

When TARGET_FLATTEN_APEX is true (= ro.apex.updatable is unset or set to
false), apexd is not used to activate the built-in flattened APEXes.
Init simply bind-mounts /system/apex to /apex.

However, there is a special case here. The runtime APEX is installed as
either /system/apex/com.android.runtime.debug or
/system/apex/com.android.runtime.release, whereas it should be activated
on /apex/com.android.runtime - without the .debug or .release suffix.
To handle that case, the build system creates an empty directory
/system/apex/com.android.runtime and the .debug or .release directory
is bind-mounted to the empty directory by init at runtime.

Bug: 132413565
Test: marlin is bootable
Merged-In: I3fde5ff831429723fecd1fa5c10e44f636a63f09
Change-Id: I3fde5ff831429723fecd1fa5c10e44f636a63f09
(cherry picked from commit 99902a175b)
2019-05-29 07:06:28 +09:00
Jiyong Park
99902a175b Don't use apexd when TARGET_FLATTEN_APEX == true
/system/apex/com.android.runtime is labeled as runtime_apex_dir
and init is allowed to mount on it.

When TARGET_FLATTEN_APEX is true (= ro.apex.updatable is unset or set to
false), apexd is not used to activate the built-in flattened APEXes.
Init simply bind-mounts /system/apex to /apex.

However, there is a special case here. The runtime APEX is installed as
either /system/apex/com.android.runtime.debug or
/system/apex/com.android.runtime.release, whereas it should be activated
on /apex/com.android.runtime - without the .debug or .release suffix.
To handle that case, the build system creates an empty directory
/system/apex/com.android.runtime and the .debug or .release directory
is bind-mounted to the empty directory by init at runtime.

Bug: 132413565
Test: marlin is bootable
Change-Id: I3fde5ff831429723fecd1fa5c10e44f636a63f09
2019-05-25 01:21:18 +09:00
Tao Bao
a5243f01a9 Merge "Add vendor_misc_writer." am: ccf8af80b0 am: 986d2b296a am: 848861d8a3
am: c576c2c835

Change-Id: I71e4f4544616bf9be3d80b1c4f964bd0b9cb4dad
2019-05-21 07:53:20 -07:00
Tao Bao
8f39cce73a Add vendor_misc_writer.
The space between 2K and 16K in /misc is currently reserved for vendor's
use (as claimed in bootloader_message.h), but we don't allow vendor
module to access misc_block_device other than vendor_init.

The change in the topic adds a `misc_writer` tool as a vendor module,
which allows writing data to the vendor space to bridge the gap in the
short term. This CL adds matching labels to grant access.

Long term goal is to move /misc as vendor owned, then to provide HAL
access from core domain (b/132906936).

Bug: 132906936
Test: Build crosshatch that includes misc_writer module. Invoke
      /vendor/bin/misc_writer to write data to /misc.
Change-Id: I4c18d78171a839ae5497b3a61800193ef9e51b3b
Merged-In: I4c18d78171a839ae5497b3a61800193ef9e51b3b
(cherry picked from commit 42c05cfcc1)
2019-05-21 07:06:31 -07:00
Tao Bao
848861d8a3 Merge "Add vendor_misc_writer." am: ccf8af80b0
am: 986d2b296a

Change-Id: I89d5eb83fc0caacf8a883321c14d5c26925fe6da
2019-05-21 06:56:51 -07:00
Tao Bao
ccf8af80b0 Merge "Add vendor_misc_writer." 2019-05-21 13:41:07 +00:00
Florian Mayer
ca8ae2b41d Merge "Relabel /proc/kpageflags and grant access to heapprofd." am: 5a3d30eadf am: dbfa941a66 am: fb5faebcb0
am: 320bcbd2f6

Change-Id: Ie78bb7c1d8d9ba3c21d1484c79bac213eff82b30
2019-05-21 02:48:49 -07:00
Florian Mayer
fb5faebcb0 Merge "Relabel /proc/kpageflags and grant access to heapprofd." am: 5a3d30eadf
am: dbfa941a66

Change-Id: Ib3c336d1545a7103bc2e909b126f0860b218e88c
2019-05-20 21:09:23 -07:00
Tao Bao
42c05cfcc1 Add vendor_misc_writer.
The space between 2K and 16K in /misc is currently reserved for vendor's
use (as claimed in bootloader_message.h), but we don't allow vendor
module to access misc_block_device other than vendor_init.

The change in the topic adds a `misc_writer` tool as a vendor module,
which allows writing data to the vendor space to bridge the gap in the
short term. This CL adds matching labels to grant access.

Long term goal is to move /misc as vendor owned, then to provide HAL
access from core domain (b/132906936).

Bug: 132906936
Test: Build crosshatch that includes misc_writer module. Invoke
      /vendor/bin/misc_writer to write data to /misc.
Change-Id: I4c18d78171a839ae5497b3a61800193ef9e51b3b
2019-05-20 14:40:15 -07:00
Florian Mayer
87b5e75042 Relabel /proc/kpageflags and grant access to heapprofd.
Bug: 132952543

Change-Id: I3d956ba7279af37d783515c0bf649e6fb94c3082
2019-05-20 20:18:10 +01:00
Luke Huang
d30b5c8a42 Merge "Clean sepolicy of unused netd_socket" into qt-dev am: dc4dc55784
am: 3b52b0f17a

Change-Id: I726aadd54b04df68cff992b70443c0335ca50972
2019-05-10 01:10:27 -07:00
Marco Nelissen
d0fd7dfa56 Merge "Remove unneeded permissions" into qt-dev am: 2b34e6ad9f
am: 52bcfdf5a0

Change-Id: I6c0f886a99b9ba59e9fb790847125c30dbcd3289
2019-05-10 01:09:57 -07:00