Commit graph

10111 commits

Author SHA1 Message Date
Daniel Norman
27bb0c60f6 Merge "Allow system_server access to hidraw devices." into main 2023-12-01 18:12:02 +00:00
Ted Wang
fb82802fc0 Merge "Add bluetooth finder hal" into main 2023-12-01 17:41:04 +00:00
Andrea Zilio
1a3e09bdf1 Merge "Add pm.archiving.enabled system property" into main 2023-12-01 10:52:21 +00:00
Daniel Norman
4245d0413b Allow system_server access to hidraw devices.
This allows AccessibilityManagerService in system_server to
interact with a HID-supported Braille Display.

Bug: 303522222
Test: ls -z /dev/hidraw0
Test: plat_file_contexts_test
Test: Open FileInputStream and FileOutputStream on this device
      path from AccessibilityManagerService
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:67a63cc046769759aa43cf1653f11e57c55cd1db)
Merged-In: I2982e907bd2a70c1e4e8161647d6efd65110b99c
Change-Id: I2982e907bd2a70c1e4e8161647d6efd65110b99c
2023-11-30 23:33:55 +00:00
Andrea Zilio
32ab868eac Add pm.archiving.enabled system property
Test: Builds and starts up fine on acloud
Bug: 314160630
Change-Id: I1d90876979bcdb9416bb711f59678a0e640a3e89
2023-11-30 21:14:21 +00:00
Jan Sebechlebsky
de644175a9 Fix dumpstate denials related to virtual_camera
Bug: 313794601
Test: atest android.security.cts.SELinuxHostTest#testNoBugreportDenials
Change-Id: Ie5b7c89388190fa927f8c762b2e65557f9d9870b
2023-11-30 10:57:16 +01:00
Thiébaud Weksteen
084b293596 Prebuilt updates am: 448968a6d1
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/2848878

Change-Id: I991e63e36e9e680edfd21e4a20293ae779caffcb
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
2023-11-29 06:25:40 +00:00
Thiébaud Weksteen
448968a6d1 Prebuilt updates
Bug: 308058980
Test: m selinux_policy
Change-Id: I23b2265340002b4b9f8d15ad0a8e8324aa0f94e1
2023-11-29 06:01:56 +00:00
Treehugger Robot
e22500d7b9 Merge "Label wifi.interface." into main 2023-11-28 10:20:23 +00:00
Seungjae Yoo
ed25d9436d vendor_microdroid_file shouldn't be overwrited
If malicious process in the host overwrites microdroid vendor image,
unexpected behavior could be happened.

Bug: 285854379
Test: adb shell /apex/com.android.virt/bin/vm run-microdroid --vendor /vendor/etc/avf/microdroid/microdroid_vendor.img

Change-Id: I18ce5112b75b2793c85bb59c137715beb602a5f3
2023-11-28 11:20:18 +09:00
LuK1337
0372255af1 Label wifi.interface.
This lets us override AIDL WiFi HAL interfaces.

Bug: 313385486
Change-Id: I3bb0c274f5fb6f709d09b67deff2df7229e04369
2023-11-27 18:00:55 +00:00
Thiébaud Weksteen
8c225b0c73 Merge "Ignore access to /proc/pagetypeinfo for Settings" into main 2023-11-23 22:55:54 +00:00
Thiébaud Weksteen
bdc7214f85 Ignore access to /proc/pagetypeinfo for Settings
avc:  denied  { read } for  comm="pool-3-thread-6" name="pagetypeinfo"
dev="proc" ino=4026531857 scontext=u:r:system_app:s0
tcontext=u:object_r:proc_pagetypeinfo:s0 tclass=file permissive=0

Bug: 312375728
Test: m selinux_policy
Change-Id: Ic2946e181d3a0af65a6ebe093ef7f257c75a1c22
2023-11-23 10:40:07 +11:00
George Chan
09a7dd1714 Merge "Added system_api_service to bg_install_control_service" into main 2023-11-22 22:32:00 +00:00
George Chan
7d0df3459b Added system_api_service to bg_install_control_service
Bug: 296060433
Test: m
Change-Id: I7b0a20991a417aefae99b4c206ca8234d85ed615
2023-11-22 21:52:58 +00:00
Max Bires
f019332f6d Remove deprecated enable_rkpd property
The enable_rkpd property is no longer needed. This change removes the
vestigial property.

Test: Successful build
Change-Id: I810d5a21cbe01b43a37244959e21febd0880be59
2023-11-22 17:24:07 +00:00
Alice Wang
e79bbf9cf8 Revert^4 "[avf][rkp] Allow virtualizationservice to register RKP HAL"
Revert submission 2829351-revert-2812456-revert-2812435-revert-2778549-expose-avf-rkp-hal-GTFGLMUUKQ-PAWNEHUQBT-WYENGHRTXK

Reason for revert: Relands the original topic:
https://r.android.com/q/topic:%22expose-avf-rkp-hal%22

Changes from the reverted cl aosp/2812455:
 - The AIDL service type has been renamed from avf_* to hal_* to be
   consistent with the others.

 - The new AIDL service type, hal_remotelyprovisionedcomponent_avf_service,
   for the IRPC/avf service, has been set up with the server/client model
   for AIDL Hal. The virtualizationservice is declared as server and
   RKPD is declared as client to access the service instead of raw
   service permission setup as in the reverted cl. This is aligned
   with the AIDL Hal configuration recommendation.

 - Since the existing type for IRPC hal_remotelyprovisionedcomponent is
   already associated with keymint server/client and has specific
   permission requirements, and some of the keymint clients might not
   need the AVF Hal. We decided to create a new AIDL service type
   instead of reusing the exisiting keymint service type.

Reverted changes: /q/submissionid:2829351-revert-2812456-revert-2812435-revert-2778549-expose-avf-rkp-hal-GTFGLMUUKQ-PAWNEHUQBT-WYENGHRTXK

Bug: 312427637
Bug: 310744536
Bug: 299257581
Test: atest MicrodroidHostTests librkp_support_test
Change-Id: Id37764b5f98e3c30c0c63601560697cf1c02c0ad
2023-11-22 08:21:27 +00:00
Inseob Kim
0932bb9ba9 Merge "Flag-guard vfio_handler policies" into main 2023-11-22 07:45:53 +00:00
Ján Sebechlebský
d97e6b1d70 Merge changes I0ca68d6c,Ie621f896 into main
* changes:
  Allow virtual camera service to access gpu.
  Revert^2 "Allow system_server to communicate with virtual_camera"
2023-11-22 06:58:18 +00:00
Inseob Kim
094e8e81a2 Flag-guard vfio_handler policies
vfio_handler will be active only if device assignment feature is turned
on.

Bug: 306563735
Test: microdroid tests with and without the flag
Change-Id: I5559dfca1a29852b65481c95f37edc9977ee9d7d
2023-11-22 05:28:20 +00:00
Ahmad Khalil
95ee9ea719 Add fwk_vibrator_control_service
Convert vibrator_control to a framework service (fwk_vibrator_control_service) in system_server.

Bug: 305961689
Test: N/A
Change-Id: I5f3aba2c58a3166593a11034a8d21dfd12311c2e
2023-11-21 20:59:48 +00:00
Eric Laurent
2fc53fec54 Merge "Bluetooth: add system property for HID transport selection" into main 2023-11-21 18:32:07 +00:00
Shikha Panwar
2838e84381 Merge "Secretkeeper/Sepolicy: Create required domains" into main 2023-11-21 17:56:46 +00:00
Shikha Panwar
59c970703b Secretkeeper/Sepolicy: Create required domains
Add sepolicies rules for Secretkeeper HAL & nonsecure service
implementing the AIDL.

Test: atest VtsHalSkTargetTest & check for Selinux denials
Bug: 293429085
Change-Id: I907cf326e48e4dc180aa0d30e644416d4936ff78
2023-11-21 12:29:18 +00:00
Treehugger Robot
40552f0902 Merge "Allow shell to set persist.logd.audit.rate" into main 2023-11-21 08:56:43 +00:00
Thiébaud Weksteen
1f621afeeb Merge "Revert^2 "Add permission for VFIO device binding"" into android14-tests-dev 2023-11-21 04:37:46 +00:00
Thiébaud Weksteen
fa2999a627 Revert^2 "Add permission for VFIO device binding"
This reverts commit c6227550f7.

Reason for revert: Faulty merging paths have been removed

Change-Id: Icf56c2e977c5517af63e206a0090159e43dd71eb
Merged-In: Ie947adff00d138426d4703cbb8e7a8cd429c2272
2023-11-21 02:18:30 +00:00
Justin Yun
90bee0995e Define ro.llndk.api_level
ro.llndk.api_level shows the maxium vendor api level that the llndk
in the platform supports.

Bug: 312098788
Test: getprop ro.llndk.api_level
Change-Id: I139524724e458300a3c1430c94595e9fa25a85dd
2023-11-21 11:13:09 +09:00
Shubang Lu
0d65502e9e Merge "Add SE policy for tv_ad_service" into main 2023-11-20 19:08:50 +00:00
Eric Laurent
255890ef0e Bluetooth: add system property for HID transport selection
Add property bluetooth.core.le.dsa_transport_preference containing a
list of supported HID transport protocols for IMU data over LE Audio by
order of preference:

Bug: 307588546
Test: make
Change-Id: I7aef404a2c6c8cc872efb994e328a175d5b4efd4
2023-11-20 16:38:56 +01:00
Jan Sebechlebsky
267b6a9cf1 Allow virtual camera service to access gpu.
Bug: 301023410
Test: adb shell cmd virtual_camera enable_test_camera & OpenCamera

Change-Id: I0ca68d6c4831d624a0aa9ad87f7b44cbb02ac96a
2023-11-20 10:42:47 +01:00
Ján Sebechlebský
5d6b66c8ea Revert^2 "Allow system_server to communicate with virtual_camera"
This reverts commit 76a62dfb3e.

Reason for revert: Relanding with virtual_camera flag disabled to prevent test failures before rc entry is added for the service (which needs to be done after this cl is submitted to prevent boot test failing due to selinux denials).

Test: https://android-build.corp.google.com/builds/abtd/run/L11500030000350228
Change-Id: Ie621f89610b173918bb4c0b6eb1f35547f56f6b7
2023-11-20 10:42:11 +01:00
Ted Wang
1193a9c1d6 Add bluetooth finder hal
Bug: 307897939
Test: make
Change-Id: I5ebc1afc33532639fccffc0cf86e2680ab7c910f
2023-11-20 06:01:13 +00:00
Kelvin Zhang
db2d9a23ad Merge "Add sepolicy for ro.virtual_ab.merge_delay_seconds" into main 2023-11-20 02:57:46 +00:00
Jeongik Cha
bfb5615f52 Merge "declare setupwizard_mode_prop as system_vendor_config_prop" into main 2023-11-20 01:22:22 +00:00
Thiébaud Weksteen
1deccbb3f4 Merge "Revert^2 "Introduce sdk_sandbox_audit SELinux domain"" into android14-tests-dev am: 2f98237c4d
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/2836555

Change-Id: Iffd388a421177b61186f4a7b6e6076313206fd36
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
2023-11-19 23:51:03 +00:00
Kelvin Zhang
f34d7d238d Add sepolicy for ro.virtual_ab.merge_delay_seconds
Bug: 311515963
Test: set ro.virtual_ab.merge_delay_seconds by PRODUCT_PROPERTY_OVERRIDES in mk files and run OTA
Change-Id: Ia9bac57879670e0dbd858705bffbb8dea7d58fba
2023-11-17 12:02:54 +00:00
Sandro Montanari
1e9eb36ad2 Revert^2 "Introduce sdk_sandbox_audit SELinux domain"
This reverts commit a41bfab758.

Reason for revert: Automerger path causing the regression is no more

Change-Id: I4c9ab6f2e18c9d8157f5667bc98fcce00e78f93d
2023-11-17 09:54:33 +00:00
Seungjae Yoo
e95f3f5bd3 Merge "Introduce vendor_microdroid_file for microdroid vendor image" into main 2023-11-17 02:23:30 +00:00
Shubang Lu
98dddde9f0 Add SE policy for tv_ad_service
Bug: 303506816
Bug: 311074646
Test: cuttlefish;
Change-Id: I5dea6d65cf374392bb9b079dda9aa90fb63a4bbd
2023-11-16 23:10:15 +00:00
Matt Stokes
61ba09b9a8 Merge "Revert "Allow system_server to communicate with virtual_camera"" into main 2023-11-16 18:58:19 +00:00
Matt Stokes
76a62dfb3e Revert "Allow system_server to communicate with virtual_camera"
This reverts commit 45f1ecee7a.

Reason for revert: <Droid TestMonitor b/311401010>

Change-Id: I82716e9d52a66018c5e7d7d13c8292d7d19f253c
2023-11-16 17:42:25 +00:00
Jeongik Cha
6cb91a086e declare setupwizard_mode_prop as system_vendor_config_prop
1. declare setupwizard_mode_prop for ro.setupwizard.mode
2. that prop could be set during vendor_init, so changed prop type

Bug: 310208141
Test: boot and check if there is no sepolicy issue
Change-Id: I89246ab2c686db139cad48550b860d69a41106ff
2023-11-17 01:22:37 +09:00
Ján Sebechlebský
4b16e566e1 Merge "Allow system_server to communicate with virtual_camera" into main 2023-11-16 11:20:43 +00:00
Seungjae Yoo
d2a0892121 Introduce vendor_microdroid_file for microdroid vendor image
In AVF, virtualizationmanager checks the selinux label of given disk
image for proving whether the given image is edited maliciously.
Existing one(vendor_configs_file, /vendor/etc/*) was too wide to use for this purpose.

Bug: 285854379
Test: m
Change-Id: I6c966c92b238a2262d2eb7f41041ed4c359e9e0a
2023-11-16 16:44:15 +09:00
Jooyung Han
f8c18cb0f2 Add properties for vulkan apex
ro.vulkan.apex property is added to tell which APEX provides vulkan
driver.

Bug: 205618237
Test: CtsGraphicsTestCases
Change-Id: Icdf6ee5ede16c08405f48d736ed38ad4117d8e2d
2023-11-15 13:45:38 +09:00
Vadim Caen
45f1ecee7a Allow system_server to communicate with virtual_camera
and consitently name service and process as "virtual_camera" (with
underscore)

Test: Cts VirtalCameraTest
Bug: 270352264
Change-Id: I2c6c0c03aab47aa1795cbda19af25e6661a0bf4a
2023-11-14 15:27:57 +01:00
Sandro Montanari
a41bfab758 Revert "Introduce sdk_sandbox_audit SELinux domain"
This reverts commit 5eb6189fc0.

Reason for revert: breaks build in git_udc-qpr-dev-throttled

Change-Id: I97b5fe5e1db668a33d00b15bd3cb5e663050eba2
2023-11-14 12:27:39 +00:00
Sandro Montanari
5eb6189fc0 Introduce sdk_sandbox_audit SELinux domain
Bug: 295861450
Test: atest CtsSdkSandboxInprocessTests and adb shell ps -Z
Change-Id: I9c5873181c925c6b8ebb411328d30aa519053acf
Merged-In: I9c5873181c925c6b8ebb411328d30aa519053acf
2023-11-14 09:14:03 +00:00
Inseob Kim
c6227550f7 Revert "Add permission for VFIO device binding"
This reverts commit 901385f711.

Reason for revert: breaking build

Change-Id: Ib936ca7c347b657b94bb44692cd0e9ceee5db55a
Merged-In: Ie947adff00d138426d4703cbb8e7a8cd429c2272
2023-11-14 08:41:48 +00:00