Commit graph

20645 commits

Author SHA1 Message Date
Maciej Żenczykowski
88497c1622 Merge "selinux - allow dnsmasq to getattr on fifos" am: 21417a7965
am: 117661666a

Change-Id: I02d494d4149ab4eeef9b7cee24b91b83adb13bde
2019-05-02 11:03:21 -07:00
Maciej Żenczykowski
117661666a Merge "selinux - allow dnsmasq to getattr on fifos"
am: 21417a7965

Change-Id: Ic4096b9476e0d6e80e016fdee6732dff2df38a2b
2019-05-02 10:56:15 -07:00
Treehugger Robot
21417a7965 Merge "selinux - allow dnsmasq to getattr on fifos" 2019-05-02 17:37:20 +00:00
Nick Kralevich
44b0efb332 Add TODOs
Bug: 131761776
Test: compiles
Change-Id: Iba3ad475ce25a1ece96717ceecb7c4df8e358d48
2019-05-02 08:29:21 -07:00
Wei Wang
d2aa8da5de Merge "Allow psi monitor users to setched kernel threads" am: 1415c2da7d
am: b8aa92f212

Change-Id: Ifd4f3a350c275da0f26b120cdee287f104e51f6a
2019-05-02 08:12:00 -07:00
Wei Wang
b8aa92f212 Merge "Allow psi monitor users to setched kernel threads"
am: 1415c2da7d

Change-Id: Ifa5014c0dc324db5efaf950237e1d70c13053043
2019-05-02 08:06:55 -07:00
TreeHugger Robot
6f1800f6df Merge "Allow psi monitor users to setched kernel threads" into qt-dev 2019-05-02 14:48:56 +00:00
Treehugger Robot
1415c2da7d Merge "Allow psi monitor users to setched kernel threads" 2019-05-02 14:48:41 +00:00
Anton Hansson
5f5f32271a Merge "Make new vendor properties settable by vendor_init" into qt-dev 2019-05-02 08:24:48 +00:00
Luke Huang
26f84c68a6 Clean sepolicy of unused netd_socket
Bug: 65862741
Test: built, flashed, booted
Change-Id: Ie6a5e7d8bb501fb6144c9fe00756301b90ab5210
2019-05-02 08:08:20 +00:00
Maciej Żenczykowski
afa10f7223 selinux - allow dnsmasq to getattr on fifos
This is presumably libc isatty detection on stdin/out/err.
Either way - allowing it is harmless.

This fixes:
  type=1400 audit(): avc: denied { getattr } for comm="dnsmasq" path="pipe:[38315]" dev="pipefs" ino=38315 scontext=u:r:dnsmasq:s0 tcontext=u:r:netd:s0 tclass=fifo_file permissive=0

Test: built and observed no more avc denials on crosshatch

Bug: 77868789
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: Ieab51aeb67ebb85b6c778410ba96963612277ae4
2019-05-01 18:04:22 -07:00
Anton Hansson
cfbd1463df Make new vendor properties settable by vendor_init am: c165185e05
am: 36a5420f10

Change-Id: I1fe9913bec25252135b855833849e42649579721
2019-05-01 14:30:37 -07:00
Anton Hansson
36a5420f10 Make new vendor properties settable by vendor_init
am: c165185e05

Change-Id: I99096b90bdfa9d55b7e511d3c537053baf405e67
2019-05-01 13:47:56 -07:00
Wei Wang
e95d8e9550 Allow psi monitor users to setched kernel threads
psi monitor sched_setscheduler(kworker->task, SCHED_FIFO, &param) was added into pa/1282597

Bug: 131252752
Bug: 129476847
Test: build
Change-Id: I69fdd90e4a39da8d33b417efc7ea7a0da9d9290b
2019-05-01 10:23:02 -07:00
Wei Wang
a3d6302c57 Allow psi monitor users to setched kernel threads
psi monitor sched_setscheduler(kworker->task, SCHED_FIFO, &param) was added into pa/1282597

Bug: 131252752
Bug: 129476847
Test: build
Change-Id: I69fdd90e4a39da8d33b417efc7ea7a0da9d9290b
2019-05-01 10:18:48 -07:00
Hung-ying Tyan
de72643633 [automerger skipped] Merge "Sepolicy: add dynamic_system_prop" am: 4eb1a20c77
am: 4b184ce52b -s ours
am skip reason: change_id I24a5382649c64d36fd05a59bc87faca87e6f0eb8 with SHA1 dea144c1e5 is in history

Change-Id: Ibf8dd7e9fa754bdba9cbeba36296598851f2fa9e
2019-05-01 05:39:23 -07:00
Anton Hansson
c165185e05 Make new vendor properties settable by vendor_init
These properties were moved to /vendor as part of b/130025216.
Allow them to be set by vendor_init, too.

Bug: 130025216
Bug: 131066061
Test: no SELinux warnings for said props at boot
Change-Id: I5293831bedb89e9c8d3ddf13cf7babde26872f28
2019-05-01 13:21:17 +01:00
Anton Hansson
0e2d985d50 resolve merge conflicts of b5b796adcd to qt-dev-plus-aosp
Test: presubmit
Bug: None
Merged-In: I24a5382649c64d36fd05a59bc87faca87e6f0eb8
Change-Id: I8c40cfba7b06cf3b431528eb94957022278edbbe
2019-05-01 13:15:22 +01:00
Hung-ying Tyan
4b184ce52b Merge "Sepolicy: add dynamic_system_prop"
am: 4eb1a20c77

Change-Id: Icf64a866949494cc7017debcf1659d8cacdad6ab
2019-05-01 03:52:39 -07:00
Treehugger Robot
4eb1a20c77 Merge "Sepolicy: add dynamic_system_prop" 2019-05-01 10:33:29 +00:00
TreeHugger Robot
b5b796adcd Merge "Sepolicy: add dynamic_system_prop" into qt-dev 2019-05-01 10:32:28 +00:00
Jack Yu
b62d8a9b99 [automerger skipped] Merge "Add sepolicy for nfc hal v1.2" into qt-dev
am: e1757623ee -s ours
am skip reason: change_id If54884f76a32705d11f2085f66fe83b9e0354f79 with SHA1 58329f6536 is in history

Change-Id: Ica971505a9a9f491c629afe698c68e0787afe08a
2019-04-30 16:44:41 -07:00
Steven Moreland
4584574f06 Merge "Use explicit whitelist for HIDL app neverallows." am: 6acaea456f
am: 3bd7f13c54

Change-Id: I68c3adcadad9d24fec9cf7341cfb21da1cb21b86
2019-04-30 15:34:26 -07:00
Steven Moreland
3bd7f13c54 Merge "Use explicit whitelist for HIDL app neverallows."
am: 6acaea456f

Change-Id: I0500b302e676cf20387917925ddb63838ec73a8a
2019-04-30 15:29:22 -07:00
Steven Moreland
6acaea456f Merge "Use explicit whitelist for HIDL app neverallows." 2019-04-30 22:16:12 +00:00
Jack Yu
73d44f2f5d [automerger skipped] Add sepolicy for nfc hal v1.2
am: 58329f6536 -s ours
am skip reason: change_id If54884f76a32705d11f2085f66fe83b9e0354f79 with SHA1 a5dde796b5 is in history

Change-Id: I4762f0ac9a58d9cc54b303ce81b0331b059584b2
2019-04-30 14:17:11 -07:00
TreeHugger Robot
e1757623ee Merge "Add sepolicy for nfc hal v1.2" into qt-dev 2019-04-30 20:33:35 +00:00
Hung-ying Tyan
565384db61 Sepolicy: add dynamic_system_prop
and allow shell and system_app (Settings) to set it to enable Dynamic System Update.
Also allow priv_app (user of the API) to read it.

Bug: 119647479
Bug: 129060539
Test: run the following command on crosshatch-user:
      adb shell setprop persist.sys.fflag.override.settings_dynamic_system 1

Change-Id: I24a5382649c64d36fd05a59bc87faca87e6f0eb8
Merged-In: I24a5382649c64d36fd05a59bc87faca87e6f0eb8
2019-04-30 18:29:56 +08:00
Jim Blackler
e2d75a50f0 lmkd: grant access to /proc/lowmemorykiller am: 3cfad10c04
am: f560f0b63f

Change-Id: I3fe640306bfd57bdd57618ae260997115bfffb8d
2019-04-30 03:28:29 -07:00
Jim Blackler
f560f0b63f lmkd: grant access to /proc/lowmemorykiller
am: 3cfad10c04

Change-Id: Ib4ea7224ded802edf0ac693c6570985e62132ef5
2019-04-30 03:24:18 -07:00
Carmen Jackson
c67677af46 Merge "Add selinux rule to allow Traceur to enable the traced daemon." into qt-dev
am: f546fd8ee5

Change-Id: I4bd45ddc4c0884d2b239e891c141daa0fbe8eb08
2019-04-29 23:06:24 -07:00
Luke Huang
e239131a34 [automerger skipped] Sepolicy for netutils_wrapper to use binder call
am: 2cdbd3a38c -s ours
am skip reason: change_id I346520c47b74fde5137ad7c777f0a9eca50a06d7 with SHA1 554b334d7b is in history

Change-Id: Ie92fd4b8934e39fec75c54741abc49c5cb65fc9d
2019-04-29 22:52:46 -07:00
Hung-ying Tyan
dea144c1e5 Sepolicy: add dynamic_system_prop
and allow shell and system_app (Settings) to set it to enable Dynamic System Update.
Also allow priv_app (user of the API) to read it.

Bug: 119647479
Bug: 129060539
Test: run the following command on crosshatch-user:
      adb shell setprop persist.sys.fflag.override.settings_dynamic_system 1

Change-Id: I24a5382649c64d36fd05a59bc87faca87e6f0eb8
Merged-In: I24a5382649c64d36fd05a59bc87faca87e6f0eb8
2019-04-30 05:36:19 +00:00
Paul Crowley
744a2c5ce8 Add /data/vendor_ce/0/facedata alongside its vendor_de relation
am: 1739bceaab

Change-Id: Id64f3dbe6272ad89e317895b0ee3fb6899002093
2019-04-29 22:28:44 -07:00
Mikhail Naganov
6e09e481a3 [automerger skipped] Merge "Allow mediaserver to find "audio" service" into qt-dev
am: 4ac9186958 -s ours
am skip reason: change_id Iaa3651c692fd550f72e7ce6eafbf3386ee07a0c0 with SHA1 afcdbefb43 is in history

Change-Id: I780a18a10b9bedc6f46e05b1fcacea3595d3db5d
2019-04-29 22:28:05 -07:00
Mikhail Naganov
8ae5f5edc5 [automerger skipped] Allow mediaserver to find "audio" service
am: afcdbefb43 -s ours
am skip reason: change_id Iaa3651c692fd550f72e7ce6eafbf3386ee07a0c0 with SHA1 dc38720cfb is in history

Change-Id: I6b7f9ae2b3d1790c16c982e6e24540bab8b335ed
2019-04-29 14:01:28 -07:00
Steven Moreland
68b6f805c9 Use explicit whitelist for HIDL app neverallows.
There were three separate neverallows here. Simplifying it to one
with only a small number of exceptions.

Bug: 131177459
Bug: 37226359
Test: m sepolicy (checks neverallows)

Change-Id: I93045c9f698f28675c634643a827a1cd513f215e
2019-04-29 13:11:38 -07:00
Anton Hansson
63c402acec Make new vendor properties settable by vendor_init
These properties were moved to /vendor as part of b/130025216.
Allow them to be set by vendor_init, too.

Bug: 130025216
Bug: 131066061
Test: no SELinux warnings for said props at boot
Change-Id: I5293831bedb89e9c8d3ddf13cf7babde26872f28
Merged-In: I5293831bedb89e9c8d3ddf13cf7babde26872f28
2019-04-29 15:35:09 +01:00
Jim Blackler
3cfad10c04 lmkd: grant access to /proc/lowmemorykiller
lmkd needs to read /proc/lowmemorykiller to send statslog events in response to
applications being killed.

Bug: 130017100
Change-Id: I929d5a372e1b2f63b7b5ed421f1898ebddaec01c
2019-04-29 10:49:58 +00:00
Carmen Jackson
9b7d527efb Add selinux rule to allow Traceur to enable the traced daemon. am: 2798b5fc93
am: deeac71a51

Change-Id: I4ef66fab73929dad5ef1f29c2d52a350027e8937
2019-04-28 17:37:40 -07:00
Carmen Jackson
deeac71a51 Add selinux rule to allow Traceur to enable the traced daemon.
am: 2798b5fc93

Change-Id: Ibeaccc1a98209301645e2ca4bcc1277e60358d36
2019-04-28 17:32:34 -07:00
Carmen Jackson
2798b5fc93 Add selinux rule to allow Traceur to enable the traced daemon.
Bug: 130784724
Test: manual
Change-Id: Ic1903e273f5a136b3e0b14a901a60d8d0a81b211
Merged-In: Ic1903e273f5a136b3e0b14a901a60d8d0a81b211
2019-04-26 16:18:56 -07:00
Winson Chiu
6a8b5a0fe5 Merge "DO NOT MERGE: Allow idmap1 to read vmdl*.tmp APK install files" into qt-dev
am: 019037a810

Change-Id: I0cb1e2f2edde71381851dadc576da55339136bb2
2019-04-26 14:58:58 -07:00
Miao Wang
b21a10db4c Allow NNAPI HAL services access model files provided by privapp.
am: aa568e1c79

Change-Id: I67c12cd4275ff8a974af67d22dfa565c86a61e06
2019-04-26 14:58:29 -07:00
Wei Wang
a0442115f0 Merge "Allow signals to power/thermal HAL from dumpstate" into qt-dev
am: 5f30c238ec

Change-Id: Iab8bc504e4fdf88bd61ca05f29123dcb7c4ad58a
2019-04-26 14:38:23 -07:00
TreeHugger Robot
f546fd8ee5 Merge "Add selinux rule to allow Traceur to enable the traced daemon." into qt-dev 2019-04-26 19:18:20 +00:00
Carmen Jackson
ac55fe955f Add selinux rule to allow Traceur to enable the traced daemon.
Bug: 130784724
Test: manual
Change-Id: Ic1903e273f5a136b3e0b14a901a60d8d0a81b211
2019-04-25 23:59:06 -07:00
Luke Huang
2cdbd3a38c Sepolicy for netutils_wrapper to use binder call
Bug: 65862741
Test: built, flashed, booted

Merged-In: I346520c47b74fde5137ad7c777f0a9eca50a06d7
(cherry picked from commit 554b334d7b)

Change-Id: I0a03b88369bd2eca6593d252c4dff3ce7745b6cc
2019-04-26 02:46:39 +00:00
Paul Crowley
1739bceaab Add /data/vendor_ce/0/facedata alongside its vendor_de relation
Bug: 131084614
Test: Modify vold_prepare_subdirs to match and test on Crosshatch.
Change-Id: Id5402e6b5da3f1e5549f49f8273dd9f052c348d7
2019-04-25 19:26:32 +00:00
TreeHugger Robot
4ac9186958 Merge "Allow mediaserver to find "audio" service" into qt-dev 2019-04-25 18:01:02 +00:00