It ferries SecretManagement messages to/from Sk. Reflect this is
sepolicies.
Test: With topic, check selinux denials
Bug: 291213394
Change-Id: Ia0d25e46232d56c59fb18f8642767bfa2d5ffab1
This reverts commit 5e1d7f1c85.
Reason for revert: retry with a fix to the failed tests
Test: atest art_standalone_oatdump_tests
Change-Id: I28872c643ba4ec07ef41b1f9be86036c592a6e4e
am skip reason: Merged-In I5559dfca1a29852b65481c95f37edc9977ee9d7d with SHA-1 094e8e81a2 is already in history
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/2875635
Change-Id: I48daef2abbfaff2790f13f759b9d2402a2e6ba68
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
It ferries SecretManagement messages to/from Sk. Reflect this is
sepolicies.
Test: With topic, check selinux denials
Bug: 291213394
Change-Id: I0acc06424eb834d66a85f9d4f6b8b632d95c4190
The changes include
- allow binder calls to ActivityManager and NativePackageManager
- allow binder calls from system server
- allow writes of statsd atoms
- allow init to start uprobestats
- permission for uprobestats config files and propery
- allow execution of oatdump so it can look up code offsets
- allow scanning /proc.
Test: m selinux_policy
Change-Id: Id1864b7dac3a2c5dcd8736c4932778e36b658ce3
"adb remount" runs the remount command, which needs to be able to update
bits in the super partition metadata. This change only affects
userdebug_or_eng policy.
Bug: 297923468
Test: adb-remount-test.sh
Change-Id: Ia78d4b0ea942a139c8a4070dc63a0eed218e3e18
It is effectively an oversight that bluetooth has this
but network stack does not.
This prevents the network stack process from (for example)
using timerfd_create with CLOCK_{REAL,BOOT}TIME_ALARM,
without trampolining through parts of the mainline module
which are shipped as part of the system server.
See:
https://man7.org/linux/man-pages/man2/timerfd_create.2.html
Bug: 316171727
Test: TreeHugger
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: Iba95c80f830784a587fa4df6867a99bcb96ace79
am skip reason: Merged-In I95aa6772a40599636d109d6960c2898e44648c9b with SHA-1 ffeb680417 is already in history
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/2869455
Change-Id: Ic3f9aa6bb7aa559e391448fa5198b8f73df9af28
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
am skip reason: Merged-In I95aa6772a40599636d109d6960c2898e44648c9b with SHA-1 ffeb680417 is already in history
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/2869455
Change-Id: Ia9cdc30aacb17db751fd42a957c8787270d1ae2f
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
The current sepolicy only allows V1 of AIDL CameraProvider
services. This CL updates the regex to allow for future
versions as well.
Bug: 314912354
Test: Verified by vendor
Change-Id: I80351a8bb7c2538c4ad1e0d418ea7a718d60be05
am skip reason: Merged-In Icc234bf604e3cafe6da81d21db744abfaa524dcf with SHA-1 b6211b88cf is already in history
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/2858826
Change-Id: I558dab015373373ce5abbb6f6297fdffba0e3736
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
am skip reason: Merged-In Icc234bf604e3cafe6da81d21db744abfaa524dcf with SHA-1 b6211b88cf is already in history
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/2858826
Change-Id: I2d1181c0f222583cf1b347386259d1290e87aa20
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
Relaxation of SELinux policies to allow users of libstagefright and
MediaCodec to be able to query server-side configurable flags.
Bug: 301372559
Bug: 301250938
Bug: 308043377
Fixes: 308043377
Test: run cts -m CtsSecurityHostTestCases
Change-Id: I72670ee42c268dd5747c2411d25959d366dd972c
Merged-In: I95aa6772a40599636d109d6960c2898e44648c9b
(cherry picked from commit 1b32bccc1a)
To allow Settings application to read game default
frame rate system properties, adding access to system_app
game_manager_config_prop includes
"persist.graphics.game_default_frame_rate.enabled" for
toggling the system UI toggle, which is updated in
GameManagerService. This will only be read in Settings to
determine if the toggle is on or off.
Bug: 286084594
Test: m; boot;
Change-Id: I3d5795a8a462c25eeae90aade6eaf08c06f540c3
This reverts commit 7ba4801b6e.
Reason for revert: b/315295188
Change-Id: Ib4a4d68763f68bc1cebe6528ce4b81188f35ba49
Test: build and run on Cuttlefish. Verify that isolated_app denials go away.
