Commit graph

268 commits

Author SHA1 Message Date
Kalesh Singh
24ada7dbee Reland: Memtrack HAL stable aidl sepolicy
Bug: 175021432
Test: Check logcat for denials
Change-Id: Id92fc543791072d8682e3a89cbf08370007108bf
2020-12-22 16:08:53 -05:00
Joel Galenson
1c7eb3c3bd Clean up keymint service policy.
Test: VtsAidlKeyMintTargetTest
Change-Id: Id6e83d63ffb1de7c48dbdf435fd9988e9174cfe2
2020-12-16 08:59:09 -08:00
Janis Danisevskis
de98dd9726 Merge changes Icb1f60b3,I935f2383
* changes:
  Allow keystore to talk to keymint
  Add policy for the security compatibility hal service.
2020-12-16 01:24:33 +00:00
Kalesh Singh
3619437561 Merge "Revert "Memtrack HAL stable aidl sepolicy"" 2020-12-16 00:48:06 +00:00
Kalesh Singh
5db6857fe1 Revert "Memtrack HAL stable aidl sepolicy"
Revert "Add android.hardware.memtrack-unstable-ndk_platform"

Revert submission 1518702-memtrack-aidl

Reason for revert: Broken tests and boot time regressions
Reverted Changes:
Ic4dd70e2c:Add android.hardware.memtrack-unstable-ndk_platfor...
Iaf99d0ca4:Add stable aidl memtrack HAL to product packages
Iac54ae2ba:Add stable aidl memtrack hal to vndk list
If310210a3:libmemtrack: Add support for AIDL memtrack HAL
Ib6c634def:Memtrack HAL: Add stable AIDL implementation
I5e1d0e006:Memtrack HAL stable aidl sepolicy

Change-Id: I0c55ee100c7fd8d09a5b188a39b17c95c8a43c39
2020-12-16 00:19:38 +00:00
Janis Danisevskis
191940036b Add policy for the security compatibility hal service.
This service manager is registered by Keystore 2.0 to lookup legacy
wrapper services.

Keystore 2.0 is now written in rust. We have AIDL binding for rust but
no HIDL binding. Keystore 2.0 has to support legacy HIDL based
interfaces. So we implement the AIDL KeyMint interface in terms of the
legacy HIDL Keymaster <=  V4.1 devices in C++. This wrapper is linked
into the Keystore 2.0 process but it cannot be called directly but must
be treated like a remote binder instead. However, we cannot register
these wrappers directly, because a) we are not a vendor component, and
b) it would conflict with genuine KeyMint devices on newer devices. So
Instead we register Keystore 2.0 itself as a legacy service provider.
Which it can query itself for the legacy wrappers if it does not find
a genuine KeyMint implementation to connect to.

Bug: 171351607
Test: Keystore 2.0 can register this Service and lookup legacy wrapper
      services.
Change-Id: I935f23837721ce126531236f4920dba469a47be4
2020-12-15 08:23:52 -08:00
Treehugger Robot
772d6b425a Merge "Add policy for the android protected confirmation service." 2020-12-15 05:26:17 +00:00
Treehugger Robot
6d560dee90 Merge "Memtrack HAL stable aidl sepolicy" 2020-12-14 18:36:10 +00:00
Hyunyoung Song
9f198f1c68 Merge "New system service: search_ui_service" 2020-12-14 16:36:02 +00:00
Shawn Willden
b41f4985a9 Revert^2 "Move keymint to android.hardware.security."
16d61d0383


Bug: 175345910
Bug: 171429297
Exempt-From-Owner-Approval: re-landing topic with no changes in this CL.
Change-Id: I1352c6b46b007dba3448b3c9cbdf454d7862a176
2020-12-11 20:36:53 +00:00
Orion Hodson
16d61d0383 Revert "Move keymint to android.hardware.security."
Revert submission 1522123-move_keymint

Reason for revert: Build breakage
Bug: 175345910
Bug: 171429297
Reverted Changes:
Ief0e9884a:Keystore 2.0: Move keymint spec to security namesp...
Idb54e8846:Keystore 2.0: Move keymint spec to security namesp...
I9f70db0e4:Remove references to keymint1
I2b4ce3349:Keystore 2.0 SPI: Move keymint spec to security na...
I2498073aa:Move keymint to android.hardware.security.
I098711e7d:Move keymint to android.hardware.security.
I3ec8d70fe:Configure CF to start KeyMint service by default.
Icbb373c50:Move keymint to android.hardware.security.
I86bccf40e:Move keymint to android.hardware.security.

Change-Id: Ib5591c2379bbd2fd6dde0558ba0e68f39d27fbaf
2020-12-11 10:45:43 +00:00
Selene Huang
2c3bdb28de Move keymint to android.hardware.security.
Test: VtsAidlKeyMintTargetTest
Change-Id: I098711e7ddbcac0fc761801a1bf582a71a8f9baa
2020-12-10 19:12:29 +00:00
Janis Danisevskis
d5ad76b0c4 Add policy for the android protected confirmation service.
This is the service offered by Keystore 2.0 to provide APC service to
application. It was formerly part of the IKeystoreService interface.
Not it is an interface in ints own right.

Test: Keystore 2.0 can register the apc service interface.
      Apps can lookup and call this interface.
Bug: 159341464
Change-Id: I058adf0021d9b89f4eac7534e366c29071f0f98b
2020-12-10 10:58:11 -08:00
Hyunyoung Song
9b5f691ed1 New system service: search_ui_service
- Update policy for new system service, used for Launcher/Apps to
fetch and render search results in their UI.

Bug: 162234997
Test: manual verification ($ adb shell service list)


Reference CL: aosp/831251

Change-Id: If3ae22aa2ad1d13aeac3dfefc5244db4b1734d96
2020-12-08 15:55:01 -08:00
Kalesh Singh
545c5bfe47 Memtrack HAL stable aidl sepolicy
Bug: 175021432
Test: Check logcat for denials
Change-Id: I5e1d0e006d86a65552acb78c23b421155881555b
2020-12-08 14:09:09 -05:00
Hai Zhang
04db97a72d Add SELinux policy for legacy permission service.
The updatable and non-updatable permission manager cannot share one
AIDL, so we need to create a new system service for the non-updatable
legacy one, and add the SELinux policy for it.

Bug: 158736025
Test: presubmit
Change-Id: Ief8da6335e5bfb17d915d707cf48f4a43332f6ae
2020-12-04 14:43:33 -08:00
Lais Andrade
22b499eab5 Add IVibratorManager to sepolicy service_contexts
Bug: 166586119
Change-Id: Ia9339d34bcc7a22d5785cf7c810282f7cb0b724f
Test: N/A
2020-11-13 14:16:46 +00:00
Michael Sun
dd92be8271 Merge "Update to support splitted SystemSuspend AIDL interfaces" 2020-11-06 17:35:58 +00:00
Michael Sun
6445f190e8 Update to support splitted SystemSuspend AIDL interfaces
The suspend_control_aidl_interface is updated, renamed, and splitted
into android.system.suspend.control and
android.system.suspend.control.internal. This resulted in two suspend
services, update sepolicy to support this change.

Test: m
Bug: 171598743
Change-Id: I695bde405672af834fe662242347e62079f2e25f
2020-11-02 23:54:21 +00:00
Hayden Gomes
bf08517f2c Adding support for AIDL AudioControl HAL
Bug: 170335834
Test: built and ran without sepolicy issues
Change-Id: Ia25b82aaf676fd2bd37e60bc0d2960f398fa3c90
2020-10-29 10:56:23 -07:00
Treehugger Robot
cc9cfa92c1 Merge "Add SEpolicy for VcnManagementService" 2020-10-21 00:54:35 +00:00
Felipe Leme
e418956ae3 Added system_server_dumper service.
It will be used to dump system_server data that is not associated
with any service.

Test: adb shell dumpsys system_server
Bug: 163921395

Change-Id: I5719f7cd3a9022dc0ab12a3b3b22487e2b4866e0
2020-10-19 21:27:06 -07:00
Primiano Tucci
ce31e4ba0e Merge "Keep AOSP sepolicy up to date with internal master" 2020-10-14 08:33:09 +00:00
Primiano Tucci
5d026b3152 Keep AOSP sepolicy up to date with internal master
This re-alignes aosp and internal master to avoid
conflicts when uploading CLs upstream.

Bug: 170126760
Change-Id: I9c087e70998cd529b71dec7428641c4bfef10d31
2020-10-13 18:52:25 +00:00
Darryl L Johnson
d6cc359691 Add device_state_service to SEPolicy.
This is to support the addition of the device state manager service and
its associated binder service.

Test: Manual - Modify policy and verify binder service can be published.
Fixes: 170034199
Change-Id: Id63cb1db3ee80ec699e98443457c113d6be809fe
2020-10-13 07:48:56 -07:00
Benedict Wong
93069c0373 Add SEpolicy for VcnManagementService
This patch adds the requisite permissions for the VcnManagementService.

Bug: 163431877
Test: Compiles, boots, FrameworksNetTests passes
Change-Id: I6e03ee798027b28f67d60c6e4280fb3410ec94c4
2020-10-12 18:50:18 -07:00
Benjamin Schwartz
92bb74c851 Rename PowerStats HAL service
Bug: 169864180
Test: m
Merged-In: I79ddf26acf398e80c6ff4a96c26b04aef73feac3
Change-Id: Ic458514285f819f44e50e2bee26a08fc6cf54261
2020-10-07 21:56:53 +00:00
Lais Andrade
ac2da76606 Add sepolicy for vibrator manager
This will allow SystemServer to add the new vibrator manager service.

Bug: 166586119
Test: manually build and install on test device
Change-Id: I496f46e2f5482aaa7bfba31d6c6b2967486941cc
2020-10-07 13:17:58 +00:00
Janis Danisevskis
381c8421ae Rename service android.security.keystore2 to android.system.keystore2.
Keystore2 to is now a system/hardware/interfaces service.

Test: N/A
Change-Id: I97f356a94a9da710354c6c282a4f1dbf66b5a3b5
2020-10-05 08:56:08 -07:00
Ilya Matyukhin
d2acfb0f9c Merge "Add sepolicy for IFace" 2020-09-29 20:20:00 +00:00
Ilya Matyukhin
9bd164241e Add sepolicy for IFace
Bug: 168730443
Test: run on cuttlefish
Change-Id: Ie3cf791e7aac090788c7213d23487ae9f50b0690
2020-09-28 15:57:59 -07:00
Yu-Han Yang
bbd0ecedbb Add GNSS AIDL interfaces (system/sepolicy)
Bug: 159467682
Test: built and run on cuttlefish
Change-Id: I071e8427ea0251139661aa8123376c56e0839390
2020-09-24 12:03:30 -07:00
Nick Moukhine
affe2399b5 Add sepolicy for music recognition service.
Denial when not listed in priv_app.te:
E SELinux : avc:  denied  { find } for pid=3213 uid=10170 name=music_recognition scontext=u:r:priv_app:s0:c512,c768 tcontext=u:object_r:music_recognition_service:s0 tclass=service_manager permissive=0


Bug: 158194857
Test: patched and tested on internal master
Change-Id: I30e9ea79a57d9c353b732b629bd5a829c89bbcb0
2020-09-23 10:57:19 +00:00
Treehugger Robot
e0e91016e9 Merge "Add media.resource_observer to service contexts" 2020-09-17 12:41:04 +00:00
Chong Zhang
cc09dc79c5 Add media.resource_observer to service contexts
bug: 168307955
bug: 154733526
Change-Id: I0099688d1c5f151a715f4bdb7b1c2108492a8b72
2020-09-16 16:47:10 -07:00
Benjamin Schwartz
dc505c51ea Merge "Create Power Stats AIDL interface" 2020-09-15 16:39:36 +00:00
Neil Fuller
dbc1ccac14 Add location_time_zone_manager_service
The LocationTimeZoneManagerService is being added as a "true" service so
that it can be invoked by a shell command (i.e. adb shell cmd). This
also means it will be dumped as part of dumpsys.

Test: Build only
Bug: 149014708
Change-Id: Ie60c4bea3af27a89b88ed753f9cf6e74aab04cd3
2020-09-14 15:19:02 +01:00
Benjamin Schwartz
af8b21a6d2 Create Power Stats AIDL interface
Bug: 162472196
Test: m
Merged-In: I948ef2959b25d776d3b01985fea5eb695fd4fc1e
Change-Id: I12dc33ce055c7275559cce33142cfb2aacc5471f
2020-09-10 22:34:49 -07:00
Ilya Matyukhin
c71c2993e9 Add sepolicy for IFingerprint
Bug: 152416783
Test: run on cuttlefish
Change-Id: I58d7c3bc9c81612b03bab3b9da938c091c02e3c1
2020-09-10 16:50:19 -07:00
Xin Li
11da9e6792 Merge Android R (rvc-dev-plus-aosp-without-vendor@6692709)
Bug: 166295507
Merged-In: I6d0b1be1a46288fff42c3689dbef2f7443efebcc
Change-Id: I133180d20457b9f805f3da0915e2cf6e48229132
2020-08-29 01:45:24 -07:00
Benjamin Schwartz
6b5deb1e3f Revert "Create Power Stats AIDL interface"
Revert "Fix sepolicy for con_monitor"

Revert submission 1404976-bs_ps_aidl

Reason for revert: Caused build breakages b/165908363
Reverted Changes:
I17883a16f:Fix sepolicy for con_monitor
Icd029f58a:Create Power Stats AIDL interface

Change-Id: Iab2a7ef6fcef40c59275db37b6fca090b304e9da
2020-08-21 15:35:25 +00:00
Benjamin Schwartz
ba876ef1b3 Create Power Stats AIDL interface
Bug: 162472196
Test: m
Merged-In: I948ef2959b25d776d3b01985fea5eb695fd4fc1e
(cherry picked from commit 550e376769)
Change-Id: Icd029f58a7babee0ad8249087b76683d104736d5
2020-08-20 23:25:55 +00:00
Janis Danisevskis
ff98459989 Prepare sepolicy for launching Keystore 2.0 service
This patch labels /system/bin/keystore2 as a keystore executable and
allows keystore to register "system.security.keystore2" with the service
manager.

Bug: 160623310
Test: None
Change-Id: I1812e565438c2b8ae55c8d10bcc8450d27717697
2020-08-10 14:40:20 -07:00
Yifan Hong
537ec551c8 Merge "Add update_engine_stable_service" 2020-08-04 19:06:08 +00:00
Yifan Hong
42351f9aab Add update_engine_stable_service
This is the stable AIDL binder interface that update_engine exposes in
addition to update_engine_service.

Test: run update_engine
Bug: 160996544

Change-Id: I28ba11810844373d48c8c203f79e98150f932942
2020-07-31 15:49:10 -07:00
Danning Chen
134ac19776 Add sepolicy for people service
This is to allow people service to publish a binder service that expose
system private APIs to retrive and manage the recent cached
conversations.

Test: build and run on a test device
Bug: 162593584
Change-Id: I31b5d8bc851ea7225e215b3f86ed6d47b32b1ba4
2020-07-31 14:37:47 -07:00
Yi Kong
8448e2b5bf Merge "Add sepolicy for profcollectd" am: 5e8c92003f am: 368a6430cd
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/1349682

Change-Id: I208a32a07ca1837d4b280a923cf1f2718ab72a36
2020-07-02 02:15:17 +00:00
Yi Kong
239c85dd0d Add sepolicy for profcollectd
This does not yet list all the required capabilities for profcollectd,
but it at least allows the service to start under permissive mode.

Bug: 79161490
Test: start profcollectd
Change-Id: I92c6192fa9b31840b2aba26f83a6dc9f9e835030
2020-07-01 23:44:37 +08:00
Collin Fijalkovich
77efb419f3 Allow ActivityManagerService to start cacheDump service.
Configures SELinux to allow ActivityManagerService to start a cacheinfo
service that is responsible for dumping per-process cache state.

Bug: 153661880
Test: adb shell dumpsys cacheinfo
Test: adb bugreport
Change-Id: Id6a4bdf2a9cb6d7f076b08706e0f91d377f38603
2020-05-13 11:20:10 -07:00
Inseob Kim
5131ff6544 DO NOT MERGE Add fake 30.0 prebuilts
This prebuilt is based on the AOSP policy, but slightly manipulated so
that the set of types and attributes are identical with R policy.

Following types are removed.

boot_status_prop
dalvik_config_prop
gnss_device
surfaceflinger_color_prop
surfaceflinger_prop
systemsound_config_prop
vold_config_prop
vold_status_prop

Following type is renamed.

wificond_service -> wifinl80211_service

Bug: 153661471
Test: N/A
Change-Id: I018d5e43f53c2bf721db1d13f5f4be42b9782b29
2020-05-11 13:18:52 +09:00