Move wifi services out of system_server into a separate APK/process.
Changes:
a) Created sepolicy for the new wifi apk.
b) The new APK will run with network_stack uid (eventually will be moved
to the same process).
Used 'audit2allow' tool to gather list of permissions required.
Note: The existing wifi related permissions in system_server is left
behind to allow the module to be loaded into system_server or
network_stack process depending on device configuration.
Bug: 113174748
Test: Device boots up and able to make wifi connection.
Test: Tested hotspot functionality.
Test: Ran WifiManagerTest & WifiSoftApTest ACTS tests locally.
Test: Will send for wifi regression tests.
Change-Id: Id19643a235bf0c28238f2729926b893ac2025b97
(cherry-picked from c7aa90091e6bec70a31a643cc4519a9a86fb0b38)
Since ipmemorystore service has been moved to network stack from
system service, also should revert the relevant sepolicy which is
corresponding to the previous configuration.
Bug: 128392280
Test: atest FrameworksNetTests NetworkStackTests
Change-Id: I1ae09696e620b246f817db71e7b71c32aae9be05
- lpdump is a binary on the device that talks to lpdumpd
via binder.
- lpdumpd is a daemon on the device that actually reads
dynamic partition metadata. Only lpdump can talk to it.
Bug: 126233777
Test: boots (sanity)
Test: lpdump
Change-Id: I0e21f35ac136bcbb0603940364e8117f2d6ac438
This is required for accessing package_native_service
in libneuralnetworks.so for NNAPI Vendor Extension checks.
package_service is (ephemeral_)?app_api_service, native
one is a subset of it.
Bug: 120483623
Test: NeuralNetworksTest_FibonacciExtension
Change-Id: I9fa2c9aa263724d2256bbf26de19d6b357c82f9b
The testharness service will manage Test Harness Mode and provide a
command-line interface for users to enable Test Harness Mode; however it
does not directly provide a public API.
Bug: 80137798
Test: make
Test: flash crosshatch
Change-Id: Ie396e40fcea8914b4dd2247f2314e029b66ad84e
This cherry-pick exists to update stage-aosp-master sepolicy
files to look like the ones in master and aosp. It looks like
it was an overlook this patch was merged with DO NOT MERGE
instead of only Merged-In.
Bug: 111276913
Test: manual verification
Merged-In: If76dc7bfdad87789a58fc94e0fd280deae1a41ab
Change-Id: If76dc7bfdad87789a58fc94e0fd280deae1a41ab
(cherry picked from commit 73e7fa884b)
This reverts commit 9eb3b8ffdf.
Reason for revert: We are deciding for now not to make StagingManager a fully-fledged binder service, as it will only be accessed by PackageInstaller. We might re-evaluate this decision later if needed.
Bug: 122072686
Change-Id: Ic2a53fc92ddd7d7eeccc6a4a0117f28724346ec7
Adding a new high-level service which will handle staged installs, i.e.
installs that require a reboot.
Bug: 118865310
Test: An initial implementation of StagingManager can be reached
successfully by PackageManagerService and PackageInstallerService.
Change-Id: I8859b463575f8ee85caae43570958347b82f967e
The policies allow the system server to register a network_stack_service
used to communicate with the network stack process.
Test: atest FrameworksNetTests
Bug: b/112869080
Change-Id: Ib9b7d9150fe4afcce03c8b3dbb36b81c67e39366
There are many permission related APIs currently handled by the
package manager service. These are simply pass throughs from the
package manager service to an internal API defined by the
permission manager service. Instead of this multi-hop, we want
to open the permission manager service directly to apps. For
legacy, we won't be able to remove the APIs from PackageManager,
but, the implementation should go directly to the Permission
Manager Service.
Test: System boots w/o selinux denials
Change-Id: I1d953077b3da18ccf44deb85b9084be68a2179bd
Add a neverallow rule asserting that services registered or queried
through servicemanager must have the attribute service_manager_type
or vndservice_manager_type. Attempting to add or query a service which
does not have one of those attributes is malformed policy.
See
https://android-review.googlesource.com/c/platform/system/sepolicy/+/826500/7/private/system_server.te#696
as an example where this occurred.
Test: compiles
Change-Id: I339bde04b80819b07832d96797fd7f477a4b676a
Bug: None
Test: I solemnly swear I tested this conflict resolution.
Change-Id: I360ce12f33e333766f6f30614c87811d05e663a4
Merged-In: Ic0b3f85fad24ccedc0a8e9935c198bc8503bb415
We're creating a new PermissionManagerService that will handle
all of the permission related APIs. These are currently being
routed through PackageManagerService.
Test: Device boots
Change-Id: I7d08561dd33b692209c30d413cdca0ff567358f1
- Update policy for new system service, used for SystemUI/Apps to
present predicted apps in their UI.
Bug: 111701043
Test: manual verification
Change-Id: Ia3b5db987097d2d71bf774ca550041e03214471d
Thermal API has been added to PowerManager and this CL is to grant
IThermal access to app.
Bug: 119613338
Test: PowerManager CTS test
Change-Id: I977530a9a5490bdc53af1548788b885e7c649f01
Bug: 118510237
Test: Boot and test callback on ThermalHAL 1.1 and ThermalHAL 2.0
(cherry picked from commit 75cc6bf2d5)
Change-Id: Iafb376e61dc579c3bfd173ac34a4d525b83d8e5c
Add a DeviceConfig service in system_server to edit configuration flags.
This is intended to be a command line tool for local overrides and/or
tool for tests that adopt shell permissions.
Test: None
Bug:109919982
Bug:113101834
Change-Id: Ib7bed752849b1ed102747e3202dd7aed48d2c6d5
Add an InputFlinger service in system_server and allow SurfaceFlinger to
exchange sockets with it.
Test: None
Bug: 80101428
Bug: 113136004
Bug: 111440400
Change-Id: I1533ab7a1da0ca61d8a28037fffbc189d796f737
Test: ensure no build failures;
add RoleManagerService as a boot phase
ensure no SecurityException in logcat on boot
Change-Id: Ia0803c0fb084fe2b12f5c20f5e46354d0dd1aedf
Mark the ADB service as a system_api_service so that SystemUI can tell
it that the device is accepted. Refactoring split the AdbService out of
the UsbService. UsbService is marked as an app_api_service which SystemUI
is allowed to connect to; AdbService must be marked similarly as either
system_api_service or app_api_service. However, only system apps should
talk to AdbService currently.
SELinux : avc: denied { find } for service=adb pid=1737 uid=10041 scontext=u:r:platform_app:s0:c512,c768 tcontext=u:object_r:adb_service:s0 tclass=service_manager permissive=0
Introduced in Change-Id Ibf23964665a115a5bc835820dcff98aaf7ba610f
Test: Flash userdebug, accept ADB key, and replug USB
Bug: 118999282
Change-Id: I47b5090908ed84d0ba7a9fca100b299011bf8796
