tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
8256 commits 1 branch 0 tags 50 MiB
Commit graph

140 commits

Author SHA1 Message Date
Jason Monk
16d5ce62a0 Add persist.vendor.overlay. to properties am: 0e1cbf568a am: 829672f098 am: e6a26a2a01 
am: cd6265f01d

Change-Id: Iff2d7b0933c2f97f4b01d0e551c9089b2a2f11a8
 2016-11-11 00:25:10 +00:00
Jason Monk
829672f098 Add persist.vendor.overlay. to properties 
am: 0e1cbf568a

Change-Id: Ic60dfc5a0caf4cd43c2fdc25c44f58eaacf4fd66
 2016-11-11 00:07:08 +00:00
Jason Monk
0e1cbf568a Add persist.vendor.overlay. to properties 
Allow the system_server to change. Allow the zygote to read it as well.

Test: Have system_server set a property
Change-Id: Ie90eec8b733fa7193861026a3a6e0fb0ba5d5318
 2016-11-10 17:35:39 -05:00
Nick Kralevich
b2245d6420 Revert "Restore system_server ioctl socket access." 
am: 58305da980

Change-Id: I9379e8a7d52d6daccfadae4c0e2b19ee43f1932b
 2016-11-09 01:33:12 +00:00
Sandeep Patil
a03dc5da5b Merge "healthd: create SEPolicy for 'charger' and reduce healthd's scope" 2016-11-08 23:45:16 +00:00
Nick Kralevich
58305da980 Revert "Restore system_server ioctl socket access." 
The underlying ioctl denial was fixed in device-specific policy.
It's not needed in core policy.

A search of SELinux denials shows no reported denials, other than the
ones showing up on marlin.

This reverts commit ec3285cde0.

(cherrypicked from commit 863ce3e7c7)

Test: AndroiTS GPS Test app shows GPS data, no SELinux denials.
Bug: 32290392
Change-Id: I1ba7bad43a2cdd7cdebbe1c8543a71eee765621d
 2016-11-08 12:40:44 -08:00
Nick Kralevich
16b4b92707 profman/debuggerd: allow libart_file:file r_file_perms am: 364fd19782 am: d62abbeea3 am: ff6715f3d2 
am: c9d0e1e9b9

Change-Id: I1dcb7093b6a770cf2ff1f124d9092b79a8d34d58
 2016-11-08 20:25:09 +00:00
Nick Kralevich
d62abbeea3 profman/debuggerd: allow libart_file:file r_file_perms 
am: 364fd19782

Change-Id: I4022ab4a4f92a197c48db96a9847cc8166ed2dab
 2016-11-08 20:08:38 +00:00
Nick Kralevich
364fd19782 profman/debuggerd: allow libart_file:file r_file_perms 
Addresses the following auditallow spam:

avc: granted { read open } for comm="profman"
path="/system/lib/libart.so" dev="dm-0" ino=1368 scontext=u:r:profman:s0
tcontext=u:object_r:libart_file:s0 tclass=file

avc: granted { read open } for comm="debuggerd64"
path="/system/lib64/libart.so" dev="dm-0" ino=1897
scontext=u:r:debuggerd:s0 tcontext=u:object_r:libart_file:s0 tclass=file

avc: granted { getattr } for comm="debuggerd64"
path="/system/lib64/libart.so" dev="dm-0" ino=1837
scontext=u:r:debuggerd:s0 tcontext=u:object_r:libart_file:s0 tclass=file

Test: Policy compiles. Not a tightening of rules.
Change-Id: I501b0a6a343c61b3ca6283647a18a9a15deddf2a
 2016-11-08 09:28:28 -08:00
Polina Bondarenko
d15db77471 sepolicy: Add policy for thermal HIDL service am: 9785f2addd am: 458888a7d3 am: abbc718f19 
am: 1bda71f5e3

Change-Id: I54f8bdde9ef811a1e33abf03fc9ae290af0d750e
 2016-11-08 15:32:50 +00:00
Polina Bondarenko
458888a7d3 sepolicy: Add policy for thermal HIDL service 
am: 9785f2addd

Change-Id: I2543991deefb4ba16ef0476e92442cfadba25793
 2016-11-08 15:13:48 +00:00
TreeHugger Robot
b602b3b6b5 Merge "Revert "Restore system_server ioctl socket access."" 2016-11-08 14:35:16 +00:00
Polina Bondarenko
9785f2addd sepolicy: Add policy for thermal HIDL service 
Bug: 32022261
Test: manual
Change-Id: I664a3b5c37f6a3a36e4e5beb91b384a9599c83f8
 2016-11-08 13:34:31 +01:00
Nick Kralevich
cbefe07f1c installd: r_dir_file(installd, system_file) am: 68f233648e am: b8b0d3746f am: 24176ec819 
am: 5bfb4b3ce8

Change-Id: I4f4e568c4eb4bbe55577c20b157a79fa64f5ab65
 2016-11-08 03:42:09 +00:00
Nick Kralevich
b8b0d3746f installd: r_dir_file(installd, system_file) 
am: 68f233648e

Change-Id: I3dbbe8bc411dfb530e1363ad563db2dbdbfc1736
 2016-11-08 03:25:38 +00:00
Nick Kralevich
863ce3e7c7 Revert "Restore system_server ioctl socket access." 
The underlying ioctl denial was fixed in device-specific policy.
It's not needed in core policy.

A search of SELinux denials shows no reported denials, other than the
ones showing up on marlin.

This reverts commit ec3285cde0.

Test: AndroiTS GPS Test app shows GPS data, no SELinux denials.
Bug: 32290392
Change-Id: I1ba7bad43a2cdd7cdebbe1c8543a71eee765621d
 2016-11-07 17:01:08 -08:00
Nick Kralevich
68f233648e installd: r_dir_file(installd, system_file) 
Allow installd to read through files, directories, and symlinks
on /system. This is needed to support installd using files in
/system/app and /system/priv-app

Addresses the following auditallow spam:

avc: granted { getattr } for comm="installd"
path="/system/app/Bluetooth/lib/arm/libbluetooth_jni.so"
dev="mmcblk0p41" ino=19 scontext=u:r:installd:s0
tcontext=u:object_r:system_file:s0 tclass=lnk_file

avc: granted { getattr } for comm="installd"
path="/system/priv-app/MtpDocumentsProvider/lib/arm64/libappfuse_jni.so"
dev="dm-0" ino=2305 scontext=u:r:installd:s0
tcontext=u:object_r:system_file:s0 tclass=lnk_file

avc: granted { read open } for comm="installd"
path="/system/priv-app/TelephonyProvider" dev="mmcblk0p43" ino=1839
scontext=u:r:installd:s0 tcontext=u:object_r:system_file:s0 tclass=dir

avc: granted { read } for comm="installd" name="Velvet" dev="mmcblk0p43"
ino=1841 scontext=u:r:installd:s0 tcontext=u:object_r:system_file:s0
tclass=dir

avc: granted { read open } for comm="installd"
path="/system/priv-app/GoogleOneTimeInitializer" dev="mmcblk0p43"
ino=1778 scontext=u:r:installd:s0 tcontext=u:object_r:system_file:s0
tclass=dir

avc: granted { read open } for comm="installd"
path="/system/app/PlayAutoInstallConfig" dev="mmcblk0p43" ino=112
scontext=u:r:installd:s0 tcontext=u:object_r:system_file:s0 tclass=dir

Test: policy compiles
Change-Id: I5d14ea2cd7d281f949d0651b9723d5b7fae2e1f2
 2016-11-07 16:18:38 -08:00
Roshan Pius
92318b4637 Merge "wpa.te: Add binder permission back" am: b0c375d46d am: fd637d065f am: d4d7d190a3 
am: e659cf26f8

Change-Id: If6105b3ff4bc9eec157ab835cabc52800c382909
 2016-11-07 23:57:16 +00:00
Roshan Pius
fd637d065f Merge "wpa.te: Add binder permission back" 
am: b0c375d46d

Change-Id: I592ed31123b505a1863b514ff6acb98b2771ee41
 2016-11-07 23:39:02 +00:00
Treehugger Robot
b0c375d46d Merge "wpa.te: Add binder permission back" 2016-11-07 23:28:35 +00:00
Roshan Pius
cec44a61ba wpa.te: Add binder permission back 
Adding back the binder permission to access keystore from
wpa_supplicant. This was removed by mistake in the previous patch
(commit#: 6caeac) to add hwbinder permissions.

Denials in logs:
11-03 14:37:54.831  9011  9011 I auditd  : type=1400 audit(0.0:1490):
avc: denied { call } for comm="wpa_supplicant" scontext=u:r:wpa:s0
tcontext=u:r:servicemanager:s0 tclass=binder permissive=0
11-03 14:37:54.831  9011  9011 W wpa_supplicant: type=1400
audit(0.0:1490): avc: denied { call } for scontext=u:r:wpa:s0
tcontext=u:r:servicemanager:s0 tclass=binder permissive=0
11-03 14:37:55.838  9011  9011 I ServiceManager: Waiting for service
android.security.keystore...
11-03 14:37:55.834  9011  9011 I auditd  : type=1400 audit(0.0:1491):
avc: denied { call } for comm="wpa_supplicant" scontext=u:r:wpa:s0
tcontext=u:r:servicemanager:s0 tclass=binder permissive=0
11-03 14:37:55.834  9011  9011 W wpa_supplicant: type=1400
audit(0.0:1491): avc: denied { call } for scontext=u:r:wpa:s0
tcontext=u:r:servicemanager:s0 tclass=binder permissive=0
11-03 14:37:56.838  9011  9011 I ServiceManager: Waiting for service
android.security.keystore...
11-03 14:37:56.834  9011  9011 I auditd  : type=1400 audit(0.0:1492):
avc: denied { call } for comm="wpa_supplicant" scontext=u:r:wpa:s0
tcontext=u:r:servicemanager:s0 tclass=binder permissive=0
11-03 14:37:56.834  9011  9011 W wpa_supplicant: type=1400
audit(0.0:1492): avc: denied { call } for scontext=u:r:wpa:s0
tcontext=u:r:servicemanager:s0 tclass=binder permissive=0
11-03 14:37:57.839  9011  9011 I ServiceManager: Waiting for service
android.security.keystore...
11-03 14:37:57.834  9011  9011 I auditd  : type=1400 audit(0.0:1493):
avc: denied { call } for comm="wpa_supplicant" scontext=u:r:wpa:s0
tcontext=u:r:servicemanager:s0 tclass=binder permissive=0
11-03 14:37:57.834  9011  9011 W wpa_supplicant: type=1400
audit(0.0:1493): avc: denied { call } for scontext=u:r:wpa:s0
tcontext=u:r:servicemanager:s0 tclass=binder permissive=0

Bug: 32655747
Test: Compiles. Will send for integration testing.
Change-Id: Ic57a5bf0e6ea15770efc0d09f68d04b2db9ec1b8
 2016-11-07 12:51:07 -08:00
Etan Cohen
47e25deb7a Merge "[NAN-AWARE] Remove NAN service" am: 0182a87dab am: 2143eab887 am: 178dcd8074 
am: abf4cdc369

Change-Id: Ie716646dd3792e0faa3f37c8ec72bd1c6050d945
 2016-11-06 22:15:23 +00:00
Etan Cohen
2143eab887 Merge "[NAN-AWARE] Remove NAN service" 
am: 0182a87dab

Change-Id: Iae511c7d37b80cb142ed2bafa8232920acc7c6ca
 2016-11-06 22:01:22 +00:00
Etan Cohen
0182a87dab Merge "[NAN-AWARE] Remove NAN service" 2016-11-06 21:56:05 +00:00
Etan Cohen
8b0ef6c8d2 Merge "[NAN-AWARE] Add Aware service" am: 8da9cd640b am: 66502077a9 am: e8c7b7832f 
am: f12798dbad

Change-Id: I49038d24b3d26dc007509fb7ff3b3b6941329062
 2016-11-05 04:18:38 +00:00
Etan Cohen
66502077a9 Merge "[NAN-AWARE] Add Aware service" 
am: 8da9cd640b

Change-Id: I3b249385f40083bc598784e0b27b91d42fdec16b
 2016-11-05 04:06:07 +00:00
Etan Cohen
8da9cd640b Merge "[NAN-AWARE] Add Aware service" 2016-11-05 04:00:40 +00:00
Sandeep Patil
c73d0022ad healthd: create SEPolicy for 'charger' and reduce healthd's scope 
healthd is being split into 'charger' and 'healthd' processes, that
will never run together. 'charger' is to be run only in charge-only
and recovery, while healthd runs with Android.

While they both share much of battery monitoring code, they both now
have reduced scope. E.g. 'charger', doesn't need to use binder anymore
and healthd doesn't need to do charging ui animation. So, amend the
SEPolicy for healthd to reduce it's scope and add a new one for charger.

Test: Tested all modes {recovery, charger-only, android} with new policy

Change-Id: If7f81875c605f7f07da4d23a313f308b9dde9ce8
Signed-off-by: Sandeep Patil <sspatil@google.com>
 2016-11-04 13:41:30 -07:00
Etan Cohen
43b96aaf12 [NAN-AWARE] Remove NAN service 
Finish NAN -> Aware rename process. Removes old NAN service.

Bug: 32263750
Test: device boots and all Wi-Fi unit-tests pass
Change-Id: I2f0d9595efea2494b56074752194e7a6e66070f2
 2016-11-04 13:38:14 -07:00
Etan Cohen
44527cb970 [NAN-AWARE] Add Aware service 
Add Aware service - new name for NAN. But do not remove NAN
yet. Enables smooth transition.

Bug: 32263750
Test: device boots and all Wi-Fi unit-tests pass
Change-Id: Ieb9f1ebf1d2f31ee27f228562b4601023da5282d
 2016-11-04 13:37:17 -07:00
dcashman
c086c03a11 Restore system_server ioctl socket access. am: ec3285cde0 am: 84992ead69 am: b91eadd767 
am: 017b56d52e

Change-Id: I0c999d74e29e6de71bcc7572036ac14b55dc42fa
 2016-11-04 05:27:47 +00:00
dcashman
84992ead69 Restore system_server ioctl socket access. 
am: ec3285cde0

Change-Id: Id926897e8a5d72771dddbda3fbe06cbe6302be7d
 2016-11-04 05:16:16 +00:00
dcashman
ec3285cde0 Restore system_server ioctl socket access. 
Bug: 32290392
Test: Builds.
Change-Id: I46e8af202b41131cfc9bb280f04a214859c9b0de
 2016-11-03 19:36:11 -07:00
Ruchi Kandoi
bcc90259d9 hal_memtrack: Add sepolicy for memtrack service. am: 0a924a6e1a am: bd85244dbc am: 3aca62504d 
am: 3fafd14feb

Change-Id: I517c8b2b0a8f3e2fe167223e51128d0dedddf554
 2016-11-04 00:26:16 +00:00
Ruchi Kandoi
35e96a3c28 hal_power: Add sepolicy for power service. am: 3c30c4e2db am: 77a862665c am: 76fcb45d9c 
am: 37a372f21c

Change-Id: Ib65e1c402022bdb069570f572546352ecdd0c8c1
 2016-11-04 00:26:12 +00:00
Ruchi Kandoi
bd85244dbc hal_memtrack: Add sepolicy for memtrack service. 
am: 0a924a6e1a

Change-Id: I7038ee63b1c662f226a3a1fdc5fc1ea905b667df
 2016-11-04 00:16:28 +00:00
Ruchi Kandoi
77a862665c hal_power: Add sepolicy for power service. 
am: 3c30c4e2db

Change-Id: I9393144a4aa777dcf71571f0f4b659d2ea495524
 2016-11-04 00:16:26 +00:00
Ruchi Kandoi
0a924a6e1a hal_memtrack: Add sepolicy for memtrack service. 
Bug: 31180823
Test: reduced sepolicy errors
Change-Id: Ibfba2efa903adec340e37abec2afb3b94a262678
Signed-off-by: Ruchi Kandoi <kandoiruchi@google.com>
 2016-11-03 13:05:48 -07:00
Ruchi Kandoi
3c30c4e2db hal_power: Add sepolicy for power service. 
Bug: 31177288
Test: reduced sepolicy errors
Change-Id: I29556276ee14c341ac8f472875e6b69f903851ff
Signed-off-by: Ruchi Kandoi <kandoiruchi@google.com>
 2016-11-03 13:01:48 -07:00
Steven Moreland
b8ae7eeb11 Sepolicy for light hal. am: 1ec710c8ff am: cdd1bd76fa am: 5c482cc9ca 
am: dec31abceb

Change-Id: I78e1c62f6863447bddf8f2fd111519538fb3f70d
 2016-11-01 23:47:48 +00:00
Steven Moreland
cdd1bd76fa Sepolicy for light hal. 
am: 1ec710c8ff

Change-Id: Idec0f4922dac7b12a909e83ce963806de78653b7
 2016-11-01 23:40:27 +00:00
Dianne Hackborn
5717813e0d Allow new settings system service. am: 11877133ba am: 33619e31de am: 29bebdb91c 
am: f8bef9c80e

Change-Id: Iabf4fd7c8c3acb31f7518df6cc623a95144f2732
 2016-11-01 21:37:55 +00:00
Steven Moreland
1ec710c8ff Sepolicy for light hal. 
Bug: 32022100
Test: end to end
Change-Id: I5dd9b64c98a5c549fdaf9e47d5a92fa6963370c7
 2016-11-01 21:30:51 +00:00
Dianne Hackborn
33619e31de Allow new settings system service. 
am: 11877133ba

Change-Id: I379cb009d5a47f3c52a69cca1a80321a9e9859b5
 2016-11-01 21:30:34 +00:00
Felipe Leme
fa97fed498 Merge "Added permissions for the dumpstate service." am: ae9d3c0c31 am: 517a9ed1e3 am: 9446ec97a9 
am: e00a0f0d23

Change-Id: I12d01c105abdfdb5e6f76678c9f160ddeacbbffc
 2016-11-01 21:25:50 +00:00
Felipe Leme
517a9ed1e3 Merge "Added permissions for the dumpstate service." 
am: ae9d3c0c31

Change-Id: Ic15a4bfac6fd0bad7325eaae311150b057e4da0d
 2016-11-01 21:18:49 +00:00
Dianne Hackborn
11877133ba Allow new settings system service. 
Test: N/A
Change-Id: Ib3c85118bf752152f5ca75ec13371073fc2873cc
 2016-11-01 21:16:56 +00:00
Treehugger Robot
ae9d3c0c31 Merge "Added permissions for the dumpstate service." 2016-11-01 21:13:31 +00:00
Jorge Lucangeli Obes
c7232fb387 Merge "init: Allow SETPCAP for dropping bounding set." am: 02c8383521 am: 52dd15a0c1 am: 5296552bc4 
am: 368519e10e

Change-Id: I14254470b10781c42921f154303dcd93f271451c
 2016-11-01 20:35:16 +00:00
Jorge Lucangeli Obes
52dd15a0c1 Merge "init: Allow SETPCAP for dropping bounding set." 
am: 02c8383521

Change-Id: Ia923906119e34aa64c8a81fa53b8b53b4dc4af46
 2016-11-01 20:28:16 +00:00