Commit graph

682 commits

Author SHA1 Message Date
Yisroel Forta
e510cb8696 Merge "SELinux permissions for ProfilingService" into main 2024-02-12 14:22:31 +00:00
Yisroel Forta
aa9d0bf24c SELinux permissions for ProfilingService
Test: Presubmit, manually confirm service accessible
Bug: 293957254
Change-Id: I7103be95ff49eb87b4c7164a38a481034d72a9aa
2024-02-09 19:25:32 +00:00
Jiakai Zhang
95d371bcfd Merge "Update sepolicy for service dexopt_chroot_setup and artd_pre_reboot." into main 2024-02-09 02:52:58 +00:00
mrulhania
9a7700cd46 Add SELinux policy for ContentProtectionManagerService
Bug: 324348549
Test: build
Change-Id: Ieb319ed033d2fdb18cf76107c44cd6357221ecc4
2024-02-08 19:56:49 +00:00
Jiakai Zhang
817c49f74c Update sepolicy for service dexopt_chroot_setup and artd_pre_reboot.
Bug: 311377497
Test: manual - Call
  getDexoptChrootSetupServiceRegisterer().waitForService()
Test: manual - Set up a chroot environment and call
  getArtdPreRebootServiceRegisterer().waitForService()
Change-Id: I50b5f7f858dab37f05174cb9787f64303d50d083
2024-02-08 10:13:27 +08:00
Treehugger Robot
49a519234b Merge "Changes in SELinux Policy for CSS API" into main 2024-02-06 20:28:45 +00:00
Dan Shi
b230f4f10c Merge "Revert "audio: Provide a default implementation of IHalAdapterVe..."" into main 2024-02-01 21:57:51 +00:00
Dan Shi
0ad6f6bdd6 Revert "audio: Provide a default implementation of IHalAdapterVe..."
Revert submission 2929484-fix-b-321651892-ihaladapter

Reason for revert: possible cause of b/323385784

Reverted changes: /q/submissionid:2929484-fix-b-321651892-ihaladapter

Change-Id: I9664f8f9dd6eec159be7fbf3b148a12d44cef582
2024-02-01 19:32:34 +00:00
Mikhail Naganov
c301f8ef3d Merge "audio: Provide a default implementation of IHalAdapterVendorExtension" into main 2024-02-01 16:48:06 +00:00
Mikhail Naganov
00c2fedc5a audio: Provide a default implementation of IHalAdapterVendorExtension
This service is used by the audio server for translating
between legacy string KV pairs and AIDL vendor parameters.
It resides on the system_ext partition.

Since it has to be implemented by every SoC vendor, provide
an example implementation. This example service is added
to CF and GSI system_ext. Vendors can use their own names
and policy labels, the only thing that the audio server
depends on is the AIDL interface.

There is no fuzzer for this service because the example
implementation only contains trivial code (interface
methods are stubbed out).

Bug: 321651892
Test: atest audiorouting_tests
Change-Id: I8ab922660a30ffd44772987204ac4a28c1007c66
2024-01-26 15:35:51 -08:00
Haining Chen
982295a6af Add sepolicy for adaptive auth service
Bug: 285053096
Test: m -j
Change-Id: I549de0536071ff5622c54e86927b1f20dab9d007
2024-01-24 15:47:14 -08:00
Jay Thomas Sullivan
4e57c74f29 [ECM] Update SELinux policy for EnhancedConfirmationService
EnhancedConfirmationService is a new SystemService.

These changes are required before the service will boot.

Bug: 321053639
Change-Id: I15a4004ca57deb5c6f8757913c1894ba0ced399d
2024-01-23 23:15:16 +00:00
Franklin Abreu Bueno
a3bfb1485e Bluetooth LMP Events: Add Lmp Events Hal
Bug: 281503650
Change-Id: Ie9fa616d4142c554c30e5b45b625203387edb9a7
2023-12-13 12:02:33 -08:00
Chienyuan Huang
2e19c7632e Add bluetooth ranging hal
Bug: 310941161
Test: make
Change-Id: I9b2bc9d945b016361f44a5600c61ed2795c00622
2023-12-08 09:37:17 +00:00
David Drysdale
8d1876b4f6 Allow for ISecretkeeper/default
Test: VtsAidlAuthGraphSessionTest
Bug: 306364873
Change-Id: I788d6cd67c2b6dfa7b5f14bc66444d18e3fd35d3
2023-12-05 14:33:47 +00:00
Ted Wang
fb82802fc0 Merge "Add bluetooth finder hal" into main 2023-12-01 17:41:04 +00:00
Alice Wang
e79bbf9cf8 Revert^4 "[avf][rkp] Allow virtualizationservice to register RKP HAL"
Revert submission 2829351-revert-2812456-revert-2812435-revert-2778549-expose-avf-rkp-hal-GTFGLMUUKQ-PAWNEHUQBT-WYENGHRTXK

Reason for revert: Relands the original topic:
https://r.android.com/q/topic:%22expose-avf-rkp-hal%22

Changes from the reverted cl aosp/2812455:
 - The AIDL service type has been renamed from avf_* to hal_* to be
   consistent with the others.

 - The new AIDL service type, hal_remotelyprovisionedcomponent_avf_service,
   for the IRPC/avf service, has been set up with the server/client model
   for AIDL Hal. The virtualizationservice is declared as server and
   RKPD is declared as client to access the service instead of raw
   service permission setup as in the reverted cl. This is aligned
   with the AIDL Hal configuration recommendation.

 - Since the existing type for IRPC hal_remotelyprovisionedcomponent is
   already associated with keymint server/client and has specific
   permission requirements, and some of the keymint clients might not
   need the AVF Hal. We decided to create a new AIDL service type
   instead of reusing the exisiting keymint service type.

Reverted changes: /q/submissionid:2829351-revert-2812456-revert-2812435-revert-2778549-expose-avf-rkp-hal-GTFGLMUUKQ-PAWNEHUQBT-WYENGHRTXK

Bug: 312427637
Bug: 310744536
Bug: 299257581
Test: atest MicrodroidHostTests librkp_support_test
Change-Id: Id37764b5f98e3c30c0c63601560697cf1c02c0ad
2023-11-22 08:21:27 +00:00
Inseob Kim
0932bb9ba9 Merge "Flag-guard vfio_handler policies" into main 2023-11-22 07:45:53 +00:00
Ján Sebechlebský
d97e6b1d70 Merge changes I0ca68d6c,Ie621f896 into main
* changes:
  Allow virtual camera service to access gpu.
  Revert^2 "Allow system_server to communicate with virtual_camera"
2023-11-22 06:58:18 +00:00
Inseob Kim
094e8e81a2 Flag-guard vfio_handler policies
vfio_handler will be active only if device assignment feature is turned
on.

Bug: 306563735
Test: microdroid tests with and without the flag
Change-Id: I5559dfca1a29852b65481c95f37edc9977ee9d7d
2023-11-22 05:28:20 +00:00
Ahmad Khalil
95ee9ea719 Add fwk_vibrator_control_service
Convert vibrator_control to a framework service (fwk_vibrator_control_service) in system_server.

Bug: 305961689
Test: N/A
Change-Id: I5f3aba2c58a3166593a11034a8d21dfd12311c2e
2023-11-21 20:59:48 +00:00
Shikha Panwar
2838e84381 Merge "Secretkeeper/Sepolicy: Create required domains" into main 2023-11-21 17:56:46 +00:00
Shikha Panwar
59c970703b Secretkeeper/Sepolicy: Create required domains
Add sepolicies rules for Secretkeeper HAL & nonsecure service
implementing the AIDL.

Test: atest VtsHalSkTargetTest & check for Selinux denials
Bug: 293429085
Change-Id: I907cf326e48e4dc180aa0d30e644416d4936ff78
2023-11-21 12:29:18 +00:00
Ján Sebechlebský
5d6b66c8ea Revert^2 "Allow system_server to communicate with virtual_camera"
This reverts commit 76a62dfb3e.

Reason for revert: Relanding with virtual_camera flag disabled to prevent test failures before rc entry is added for the service (which needs to be done after this cl is submitted to prevent boot test failing due to selinux denials).

Test: https://android-build.corp.google.com/builds/abtd/run/L11500030000350228
Change-Id: Ie621f89610b173918bb4c0b6eb1f35547f56f6b7
2023-11-20 10:42:11 +01:00
Ted Wang
1193a9c1d6 Add bluetooth finder hal
Bug: 307897939
Test: make
Change-Id: I5ebc1afc33532639fccffc0cf86e2680ab7c910f
2023-11-20 06:01:13 +00:00
Shubang Lu
98dddde9f0 Add SE policy for tv_ad_service
Bug: 303506816
Bug: 311074646
Test: cuttlefish;
Change-Id: I5dea6d65cf374392bb9b079dda9aa90fb63a4bbd
2023-11-16 23:10:15 +00:00
Matt Stokes
76a62dfb3e Revert "Allow system_server to communicate with virtual_camera"
This reverts commit 45f1ecee7a.

Reason for revert: <Droid TestMonitor b/311401010>

Change-Id: I82716e9d52a66018c5e7d7d13c8292d7d19f253c
2023-11-16 17:42:25 +00:00
Vadim Caen
45f1ecee7a Allow system_server to communicate with virtual_camera
and consitently name service and process as "virtual_camera" (with
underscore)

Test: Cts VirtalCameraTest
Bug: 270352264
Change-Id: I2c6c0c03aab47aa1795cbda19af25e6661a0bf4a
2023-11-14 15:27:57 +01:00
Treehugger Robot
3f92c1beb3 Merge "Revert "Revert^2 "[avf][rkp] Allow virtualizationservice to regi..."" into main 2023-11-14 02:41:56 +00:00
Alan Stokes
18bcf12fbb Revert "Revert^2 "[avf][rkp] Allow virtualizationservice to regi..."
Revert submission 2812456-revert-2812435-revert-2778549-expose-avf-rkp-hal-GTFGLMUUKQ-PAWNEHUQBT

Reason for revert: SELinux denials: b/310744536

Reverted changes: /q/submissionid:2812456-revert-2812435-revert-2778549-expose-avf-rkp-hal-GTFGLMUUKQ-PAWNEHUQBT

Change-Id: I88b5f03dccb1b4ab906afde7d66853e816cce7f1
2023-11-14 01:40:53 +00:00
Alice Wang
dd034824b1 Merge "Revert^2 "[avf][rkp] Allow virtualizationservice to register RKP HAL"" into main 2023-11-13 21:33:49 +00:00
Shashwat Razdan
218266ac57 Changes in SELinux Policy for CSS API
Bug: 309657924
Change-Id: If8717cdf4483c3b116053c952b9da1ad4670244a
Test: manual verification ($ adb shell service list)
2023-11-07 20:08:46 +00:00
Keith Mok
df794b4590 SEPolicy for AIDL MACSEC HAL
Bug: 254108688
Test: AIDL MACSEC HAL VTS
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:fba6480fa08001a36faf524d0a6952f29d916a6b)
Change-Id: I5ccaa24c6b9600713bbc0e4c523822567b64c662
2023-11-03 21:29:48 +00:00
Ahmad Khalil
7c22e8b3cd Add new vibrator control service to system_server
Bug: 305961689
Test: N/A
Change-Id: Ia4f061d6ae7656fce4c01f5acc2a1314f8ba4ac4
2023-11-03 12:09:04 +00:00
Hasini Gunasinghe
daa1cec849 Merge "Add sepolicy for non-secure AuthGraph impl" into main 2023-11-01 16:27:51 +00:00
Alice Wang
0407c993d8 Revert^2 "[avf][rkp] Allow virtualizationservice to register RKP HAL"
Revert submission 2812435-revert-2778549-expose-avf-rkp-hal-GTFGLMUUKQ

Reason for revert: This change relands the topic
https://r.android.com/q/topic:%22expose-avf-rkp-hal%22
The SELinux denial has been fixed in system/sepolicy

Reverted changes: /q/submissionid:2812435-revert-2778549-expose-avf-rkp-hal-GTFGLMUUKQ

Bug: 308596709
Bug: 274881098
Change-Id: Ib23ac4680b0f37b760bff043e1f42ce61a58c3e2
2023-10-31 20:06:23 +00:00
Alice Wang
072d8fc0db Merge "Revert "[avf][rkp] Allow virtualizationservice to register RKP H..."" into main 2023-10-31 15:13:01 +00:00
Alice Wang
ece557dc7a Revert "[avf][rkp] Allow virtualizationservice to register RKP H..."
Revert submission 2778549-expose-avf-rkp-hal

Reason for revert: SELinux denial
avc:  denied  { find } for pid=3400 uid=10085 name=android.hardware.security.keymint.IRemotelyProvisionedComponent/avf scontext=u:r:rkpdapp:s0:c85,c256,c512,c768 tcontext=u:object_r:avf_remotelyprovisionedcomponent_service:s0 tclass=service_manager permissive=0


Reverted changes: /q/submissionid:2778549-expose-avf-rkp-hal

Bug: 308596709
Change-Id: If8e448e745f2701cf00e7757d0a079d8700d43c0
2023-10-31 15:01:18 +00:00
Alice Wang
7109a31496 Merge "[avf][rkp] Allow virtualizationservice to register RKP HAL service" into main 2023-10-31 12:21:41 +00:00
Alice Wang
104626ca99 [avf][rkp] Allow virtualizationservice to register RKP HAL service
Bug: 274881098
Test: atest MicrodroidHostTests
Change-Id: Ib0953fa49f27719be63bb244071b132bc385dca3
2023-10-27 09:26:42 +00:00
Alex Xu
902a010aaa Add sepolicy for security_state service.
security_state service manages security state (e.g. SPL) information across partitions, modules, etc.

Bug: 307819014
Test: Manual
Change-Id: I4ebcd8431c11b41f7e210947b32cf64c2adf3901
2023-10-26 06:11:58 +00:00
David Drysdale
c4ab01baad Add sepolicy for non-secure AuthGraph impl
Bug: 284470121
Bug: 291228560
Test: hal_implementation_test
Test: VtsAidlAuthGraphSessionTest
Change-Id: I85bf9e0656bab3c96765cc15a5a983aefb6af66d
2023-10-26 02:00:43 +00:00
Vladimir Komsiyski
6e07de8088 Merge "Policy for virtualdevice_native service." into main 2023-10-06 14:20:09 +00:00
Vladimir Komsiyski
31facf0677 Policy for virtualdevice_native service.
A parallel implementation of certain VDM APIs that need to
be exposed to native framework code.

Similar to package_native_service.

Not meant to be used directly by apps but should still be
available in the client process via the corresponding native
manager (e.g. SensorManager).

Starting the service: ag/24955732
Testing the service: ag/24955733

Bug: 303535376
Change-Id: I90bb4837438de5cb964d0b560585b085cc8eabef
Test: manual
2023-10-06 12:52:42 +00:00
Treehugger Robot
d065d025ed Merge "C2 AIDL sepolicy update" into main am: 8342def00a
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/2721424

Change-Id: I096e99c403f513a203040cf97e199392dc794177
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
2023-09-07 19:52:25 +00:00
Wonsik Kim
a981983e70 C2 AIDL sepolicy update
Bug: 251850069
Test: presubmit
Change-Id: Ica39920472de154aa01b8e270297553aedda6782
2023-09-06 14:30:26 -07:00
Xin Li
80690d5086 Merge "Merge Android U (ab/10368041)" into aosp-main-future 2023-08-28 22:13:48 +00:00
Xin Li
e07dbe0a63 Merge Android U (ab/10368041)
Bug: 291102124
Merged-In: Id2cc5dbbafffb4633706e5cc728cb44abd417340
Change-Id: I77e68f17a1273958bcdc32b5a4b6a0ff3ffdfd2a
2023-08-23 17:20:59 -07:00
Kangping Dong
45efca84e5 [Thread] add sepolicy rules for Thread system service
Add SEPolicy for the ThreadNetworkService
Add Fuzzer exception, thread_network service is java only

FR: b/235016403

Test: build and start thread_network service
bug: 262683651
Change-Id: Ifa2e9500dd535b0b4f2ad9af006b8dddaea900db
2023-08-23 17:08:58 +08:00
Jeff Pu
fb5d221b27 Add biometric face virtual hal service
Bug: 228638448
Test: Manually following face virtual hal provisioning procedure
Change-Id: I1f61b687be4abe53c62c21769fb57dc9cf9daf45
2023-08-16 17:00:08 -04:00