Commit graph

81 commits

Author SHA1 Message Date
Inseob Kim
1dba2f058a Merge "Add comments on compat files" am: beee8849a6
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/2405373

Change-Id: I09be668bc0fe182d1a87c046c1002a865f7b9342
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
2023-01-31 07:32:10 +00:00
Inseob Kim
338f81baac Add comments on compat files
To prevent further confusion.

Bug: 258029505
Test: manual
Change-Id: Iaa145e4480833a224b1a07fc68adb7d3e8a36e4b
2023-01-31 09:57:26 +09:00
Bill Yi
15ee6d11bc Merge TQ1A.230105.002 to aosp-master - DO NOT MERGE
Merged-In: I9acac60411da6eee86246a9e375b35dfb61691d1
Merged-In: If343dba5dae2821fa345135abafb891e85be5574
Change-Id: Ia868a5a11f13d47bf11fbb21b3d5cee12d7c8c99
2023-01-06 07:13:50 -08:00
Chris Paulo
d22ef9a1ae system/sepolicy: Update prebuilts for adaptive haptics system prop am: 272f84ebb5
Original change: https://googleplex-android-review.googlesource.com/c/platform/system/sepolicy/+/20469962

Change-Id: I45394ed8306e8654034bbcb201bde437bab2744d
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
2022-11-16 20:52:17 +00:00
Chris Paulo
272f84ebb5 system/sepolicy: Update prebuilts for adaptive haptics system prop
Update prebuilts and api compat for the adaptive haptics restricted
system property.

Bug: 198239103
Test: Verified functionality
Ignore-AOSP-First: Prebuilts on top of aosp/2300027
Change-Id: I2e299053cc2ebdb5d69aa8d3551e602609daaeaf
Signed-off-by: Chris Paulo <chrispaulo@google.com>
2022-11-16 17:12:30 +00:00
Pete Bentley
1ce5ed5d46 Update sepolicy prebuilts for PRNG seeder changes.
Cherry-pick note: This contains the original AOSP change plus
an addition to private/compat/32.0/32.0.ignore.cil which
does not _appear_ to be required on AOSP and future releases
but is required for tm-dev.  If needed we can add this to
AOSP later.

Bug: 243933553
Test: m sepolicy_freeze_test
Change-Id: Idc011c66dfe71aa6c8dfdbc0b0377d2957571b83
Merged-In: Idc011c66dfe71aa6c8dfdbc0b0377d2957571b83
(cherry picked from commit 96268c6622)
(cherry picked from commit ff0cf6f2a8)
Merged-In: Idc011c66dfe71aa6c8dfdbc0b0377d2957571b83
2022-11-15 01:50:27 +00:00
Pete Bentley
ff0cf6f2a8 Update sepolicy prebuilts for PRNG seeder changes.
Cherry-pick note: This contains the original AOSP change plus
an addition to private/compat/32.0/32.0.ignore.cil which
does not _appear_ to be required on AOSP and future releases
but is required for tm-dev.  If needed we can add this to
AOSP later.

Bug: 243933553
Test: m sepolicy_freeze_test
Change-Id: Idc011c66dfe71aa6c8dfdbc0b0377d2957571b83
Merged-In: Idc011c66dfe71aa6c8dfdbc0b0377d2957571b83
(cherry picked from commit 96268c6622)
2022-10-04 15:02:53 +01:00
Suren Baghdasaryan
f08bc50f9d sepolicy: Move proc_watermark_scale_factor mapping from ignore list
New label proc_watermark_scale_factor was mistakenly added into ignore
list. Fix this by moving the mapping into correct .cil files.

Fixes: 6988677f22 ("Allow init to execute extra_free_kbytes.sh script")
Bug: 241761479
Signed-off-by: Suren Baghdasaryan <surenb@google.com>
Change-Id: If12cad2ed20504d374d77a68eaba1600d2768338
2022-08-29 18:17:37 +00:00
Richard Chang
f9d66684a6 sepolicy: allow vendor system native boot experiments property
Grant system_server and flags_health_check permission to set the
properties that correspond to vendor system native boot experiments.

Ignore-AOSP-First: Will cherry-pick to aosp/2183135
Bug: 241730607
Test: Build
Change-Id: Idc2334534c2d42a625b451cfce488d7d7a651036
2022-08-12 03:21:26 +00:00
Richard Chang
74334efa4b sepolicy: allow vendor system native boot experiments property
Grant system_server and flags_health_check permission to set the
properties that correspond to vendor system native boot experiments.

Bug: 241730607
Test: Build
Merged-In: Idc2334534c2d42a625b451cfce488d7d7a651036
Change-Id: I3e98f1b05058245cad345061d801ecd8de623109
2022-08-11 08:03:42 +00:00
Steven Terrell
879f41c5f2 Add System Property Controlling Animators
Adding a new system property that will act as a toggle
enabling/disabling the framework changes that were submitted to prevent
leaked animators.

Bug: 233391022

Test: manual.

Merged-In: I57225feb50a3f3b4ac8c39998c47f263ae211b66
Change-Id: Ifc339efc1c3a5e19920b77d1f24bef19c39d5f44
2022-06-07 20:22:10 +00:00
Steven Terrell
bc844c5c2b Add System Property Controlling Animators
Adding a new system property that will act as a toggle
enabling/disabling the framework changes that were submitted to prevent
leaked animators.

Bug: 233391022

Test: manual.
Ignore-AOSP-First: planning to commit to tm-dev then cherry-pick over to
                   AOSP later.
Change-Id: I57225feb50a3f3b4ac8c39998c47f263ae211b66
2022-05-27 20:00:37 +00:00
Richard Chang
50dbf2c5ef Update sepolicy prebuilts to sync vendor_system_native prop changes
This CL partially cherry-picks ag/18350151 to
update prebuilts. Other parts are already included by
aosp/2083463.

Bug: 226456604
Bug: 223685902
Test: Build
Change-Id: I1ddb1db855a13671e7b76b48d84e4f1ab5a63374
2022-05-16 08:16:59 +00:00
Richard Chang
ee5fc96178 Allow vendor services to access vendor_system_native_prop
Bug: 226456604
Bug: 223685902
Test: Build
Ignore-AOSP-First: Already merged in aosp/2083463
Merged-In: Icc11b9bf06fd0fb8069388ca5a32e8aedf1743a8
Change-Id: Ie95ca796656d7727540db67feef31e28e2c602b0
2022-05-13 17:57:18 +00:00
Felipe Leme
b85242c00f Allow apps to read system_user_mode_emulation_prop.
As it's used by UserManager...

Test: sesearch --allow -s appdomain -t system_user_mode_emulation_prop $ANDROID_PRODUCT_OUT/vendor/etc/selinux/precompiled_sepolicy
Bug: 226643927

Change-Id: I1134a9e0b8ae758e3ebef054b96f9e3237a2401f
2022-04-21 18:49:12 -07:00
Mitch Phillips
800e948e61 Merge "[GWP-ASan] Add sysprop, allow shell and system apps to set it." 2022-04-21 18:12:43 +00:00
Jason Macnak
a93398051c Adds GPU sepolicy to support devices with DRM gralloc/rendering
... such as Cuttlefish (Cloud Android virtual device) which has a
DRM virtio-gpu based gralloc and (sometimes) DRM virtio-gpu based
rendering (when forwarding rendering commands to the host machine
with Mesa3D in the guest and virglrenderer on the host).

After this change is submitted, changes such as aosp/1997572 can
be submitted to removed sepolicy that is currently duplicated
across device/google/cuttlefish and device/linaro/dragonboard as
well.

Adds a sysfs_gpu type (existing replicated sysfs_gpu definitions
across several devices are removed in the attached topic). The
uses of `sysfs_gpu:file` comes from Mesa using libdrm's
`drmGetDevices2()` which calls into `drmParsePciDeviceInfo()` to
get vendor id, device id, version etc.

Bug: b/161819018
Test: launch_cvd
Test: launch_cvd --gpu_mode=gfxstream
Change-Id: I4f7d4b0fb90bfeef72f94396ff0c5fe44d53510c
Merged-In: I4f7d4b0fb90bfeef72f94396ff0c5fe44d53510c
2022-04-18 17:30:56 -07:00
Mitch Phillips
8cd32cd93e [GWP-ASan] Add sysprop, allow shell and system apps to set it.
Bug: 219651032
Test: atest bionic-unit-tests

Change-Id: Ic4804ce0e4f3b6ba8eb8d82aca11b400b45c03dc
2022-04-12 13:20:05 -07:00
Kalesh Singh
6ba41462d5 Merge changes from topic "mglru-exp"
* changes:
  Add sepolicy for Multi-Gen LRU sysfs control
  Add sepolicy for mglru_native flag namespace
2022-04-12 13:48:48 +00:00
Kalesh Singh
98f63495b2 Add sepolicy for Multi-Gen LRU sysfs control
init is allowed to enable/disable MG-LRU.

Bug: 227651406
Bug: 228525049
Test: setprop persist.device_config.mglru_native.lru_gen_config
Test: verify no avc denials in logcat
Change-Id: I20223f3628cb6909c3fd2eb2b821ff2d52202dd2
2022-04-08 13:37:50 -07:00
Lorenzo Colitti
bf8af42bf5 Merge "Connectivity Native AIDL interface Sepolicy" 2022-04-01 21:46:37 +00:00
Neha Pattan
dcb324bdb3 Merge "Sepolicy changes for adding new system service for AdServices." 2022-04-01 18:38:07 +00:00
Andy Yu
8337d04202 Add label and permission for game_mode_intervention.list
Bug: 219543620
Doc: go/game-dashboard-information-to-perfetto
Test: TBD
Change-Id: Ic6622aadef05e22c95d4ba739beed0e6fa1f3a38
2022-03-29 14:12:14 -07:00
Neha Pattan
64ef8be1de Sepolicy changes for adding new system service for AdServices.
Test: build
Bug: 216375107
Change-Id: I238ac3f8966ce05768aef17bd05217a9772cf2f3
2022-03-28 19:26:50 +00:00
Ocean Chen
63e6e1dc02 Add persist.device_config.storage_native_boot.smart_idle_maint_enabled property policies
Add policies to set persist.device_config.storage_native_boot.smart_idle_maint_enabled property.

Bug: 202283480
Bug: 181079477
Bug: 215443809
Change-Id: I998e6dca950a8ceebb5fbc39568e3e8d6b86e8ce
2022-03-22 08:33:40 +00:00
Ocean Chen
bcd0bd7976 Correct the definition sequences of sdk_sandbox_service
It fixs the auto merger conflict

Merged-In: I9fb98e0caee75bdaaa35d11d174004505f236799
Change-Id: I6afc59633ee4f729a86ab5f24c39ebd46d591549
2022-03-22 06:40:43 +00:00
Bram Bonne
b93f26fd89 Move sdk_sandbox sepolicy to AOSP.
Bug: 224796470
Bug: 203670791
Bug: 204989872
Bug: 211761016
Bug: 217543371
Bug: 217559719
Bug: 215105355
Bug: 220320098
Test: make, ensure device boots

Change-Id: Ia96ae5407f5a83390ce1b610da0d49264e90d7e2
Merged-In: Ib085c49f29dab47268e479fe5266490a66adaa87
Merged-In: I2215ffe74e0fa19ff936e90c08c4ebfd177e5258
Merged-In: I478c9a16032dc1f1286f5295fc080cbe574f09c9
Merged-In: Ibf478466e5d6ab0ee08fca4da3b4bae974a82db0
Merged-In: I5d519605d9fbe80c7b4c9fb6572bc72425f6e90a
Merged-In: I05d2071e023d0de8a93dcd111674f8d8102a21ce
Merged-In: I6572a7a5c46c52c9421d0e9c9fc653ddbd6de145
Merged-In: I1b6d1a778cb658bdfd930b684e4ba0640031b226
Merged-In: I9fb98e0caee75bdaaa35d11d174004505f236799
2022-03-17 10:22:33 +01:00
Jaegeuk Kim
be66c59171 SELinux policy for /dev/sys/block/by-name/rootdisk
Signed-off-by: Jaegeuk Kim <jaegeuk@google.com>
Change-Id: I550dfb5649ccb5ca61ea5abbf730bd84756f047e
2022-03-16 11:04:39 -07:00
Carlos Llamas
75821321c7 sepolicy: allow access to binderfs feature files
The binder driver now advertises the features it supports through
individual files under /dev/binderfs/features/*. Let all domains have
access to these files to determine how to interact with the driver.

Bug: 191910201
Tested: clients are able to read feature files via libbinder
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Change-Id: Ice5de9efee74e571ef0a23ce093af162fc3b276e
2022-03-09 08:55:10 -08:00
Evan Rosky
5cfdf2bd6e Add a persist.wm.debug property type and associated permissions
This is intended for wm properties related to wmshell/sysui.
Using this context allows sysui to manipulate these properties
in debug builds.

Bug: 219067621
Test: manual
Change-Id: I5808bf92dbba37e9e6da5559f8e0a5fdac016bf3
2022-03-07 19:44:59 +00:00
Tyler Wear
691def4fd5 Connectivity Native AIDL interface Sepolicy
Sepolicy files for new ConnectivityNative service.
This is a new service implemented in java accessible from
native code. Stable aidl is used to avoid having to manually write
the unparcling code in two different languages. A new service is
required because there is no connectivity service in the system
server that exposes a stable aidl interface.

Bug: 179733303
Change-Id: If2372712a4a8ac7b0631a2195aabc910d1a829cc
2022-02-24 08:53:13 -08:00
Ramji Jiyani
ba8615a186 Merge "system_dlkm: sepolicy: add system_dlkm_file_type" 2022-02-11 18:36:04 +00:00
Ramji Jiyani
4a556890f9 system_dlkm: sepolicy: add system_dlkm_file_type
Add new attribute system_dlkm_file_type for
/system_dlkm partition files.

Bug: 218392646
Bug: 200082547
Test: TH
Signed-off-by: Ramji Jiyani <ramjiyani@google.com>
Change-Id: I193c3f1270f7a1b1259bc241def3fe51d77396f3
2022-02-11 04:19:33 +00:00
Changyeon Jo
eacb1095a8 Revert^2 "Updates sepolicy for EVS HAL"
418f41ad13

Bug: 216727303
Test: m -j selinux_policy on failed targets reported
      in b/218802298
Change-Id: Iec8fd2a1e9073bf3dc679e308407572a8fcf44d9
2022-02-10 17:21:54 +00:00
Changyeon Jo
8c12609bce Revert^2 "Adds a sepolicy for EVS manager service"
0137c98b90

Bug: 216727303
Test: m -j selinux_policy on failed targets reported
      in b/218802298
Change-Id: I2ae2fc85a4055f2cb7d19ff70b120e7b7ff0957d
2022-02-10 17:21:14 +00:00
Mohammed Rashidy
0137c98b90 Revert "Adds a sepolicy for EVS manager service"
Revert submission 1967140-EVS_sepolicy_updates_T

Reason for revert: triggered revert due to breakage https://android-build.googleplex.com/builds/quarterdeck?branch=git_master&target=cf_x86_64_auto-userdebug&lkgb=8168894&lkbb=8168958&fkbb=8168947, bug b/218802298
Reverted Changes:
I730d56ab1:Allows hal_evs_default to read directories
I2df8e10f5:Updates sepolicy for EVS HAL
Ie6cb3e269:Adds a sepolicy for EVS manager service

Change-Id: I207c261bcf2c8498d937ab02c499bf709a5f1b15
2022-02-10 10:07:44 +00:00
Mohammed Rashidy
418f41ad13 Revert "Updates sepolicy for EVS HAL"
Revert submission 1967140-EVS_sepolicy_updates_T

Reason for revert: triggered revert due to breakage https://android-build.googleplex.com/builds/quarterdeck?branch=git_master&target=cf_x86_64_auto-userdebug&lkgb=8168894&lkbb=8168958&fkbb=8168947, bug b/218802298
Reverted Changes:
I730d56ab1:Allows hal_evs_default to read directories
I2df8e10f5:Updates sepolicy for EVS HAL
Ie6cb3e269:Adds a sepolicy for EVS manager service

Change-Id: I1cc37b0e56646db61bdb34cb209aefe7376c5a50
2022-02-10 10:07:44 +00:00
Changyeon Jo
a083d7a8d8 Updates sepolicy for EVS HAL
This CL updates hal_evs_default to be sufficient for the defautl EVS HAL
implementation and modifies other services' policies to be able to
communicate with EVS HAL implementations

Bug: 217271351
Test: m -j selinux_policy and Treehugger
Change-Id: I2df8e10f574d62f8b84e0ff0381656ab1b18b52f
2022-02-10 01:42:59 +00:00
Changyeon Jo
5c3bc58163 Adds a sepolicy for EVS manager service
Bug: 170401743
Bug: 216727303
Test: m -j selinux_policy and TreeHugger
Change-Id: Ie6cb3e269fc46a61b56ca93efd69fbc447da0e3d
2022-02-10 01:42:21 +00:00
Steven Moreland
2536bf9dac Merge "Allow BPF programs from vendor." 2022-02-09 17:28:16 +00:00
Steven Moreland
c27d24c37c Allow BPF programs from vendor.
Who needs all those context switches?

bpfloader controls which types of vendor programs can be used.

Bug: 140330870
Bug: 162057235
Test: successfully load bpf programs from vendor
Change-Id: I36e4f6550da33fea5bad509470dfd39f301f13c8
2022-02-08 22:46:54 +00:00
Jayant Chowdhary
e3019be3db System wide sepolicy changes for aidl camera hals.
Bug: 196432585

Test: Camera CTS

Change-Id: I0ec0158c9cf82937d6c00841448e6e42f6ff4bb0
Signed-off-by: Jayant Chowdhary <jchowdhary@google.com>
2022-02-08 09:37:17 +00:00
Seth Moore
a75cad0d0a Add remotely provisioned key pool se policy
Keystore now hosts a native binder for the remotely provisioned key
pool, which is used to services such as credstore to lookup remotely
provisioned keys.

Add a new service context and include it in the keystore services.

Add a dependency on this new service for credstore. Also include a
credstore dependency on IRemotelyProvisionedComponent, as it's needed
to make use of the key pool.

Bug: 194696876
Test: CtsIdentityTestCases
Change-Id: I0fa71c5be79922a279eb1056305bbd3e8078116e
2022-02-02 15:07:26 -08:00
Treehugger Robot
108fdbc5f7 Merge "Adds selinux rules for ICarDisplayProxy service" 2022-01-31 21:52:46 +00:00
Changyeon Jo
66eba13833 Adds selinux rules for ICarDisplayProxy service
Bug: 170401743
Test: m -j selinux_policy
Change-Id: Idf3f09d0bcf24de18d6eddb05e51991b4c5edbe8
2022-01-31 19:40:20 +00:00
Robert Shih
d70f0af2bf Merge "Add sepolicy for DRM AIDL HAL" 2022-01-28 18:40:53 +00:00
Hui Wu
42d24fd59d Changes in SELinux Policy for cloudsearch API naming
Bug: 216507592
Test: Presubmit Tests
Change-Id: I5aa647d146cfea0b44efb4c247d9856e0666ea86
2022-01-27 13:42:17 -08:00
Robert Shih
4968374205 Add sepolicy for DRM AIDL HAL
Bug: 208486736
Test: atest VtsAidlHalDrmTargetTest
Change-Id: Ia2b1488a564d94384d183d30291fbf5a6d2df4ab
2022-01-27 01:51:05 -08:00
Treehugger Robot
6003019fa8 Merge "Move mtectrl to private" 2022-01-26 09:30:59 +00:00
Inseob Kim
3bd63cc206 Move mtectrl to private
Because mtectrl is a system internal domain, and we don't need to expose
the type to vendor.

Test: build and boot
Change-Id: Idb5c4a4c6f175e338722971944bf08ba99835476
2022-01-26 08:59:55 +09:00