Now it can only load selinux mapping ignore file in system/sepolicy/private,
But for google's partners, we want to add selinux mapping ignore file in BOARD_PLAT_PRIVATE_SEPOLICY_DIR.
Test: it can load load selinux mapping ignore file in BOARD_PLAT_PRIVATE_SEPOLICY_DIR
Change-Id: I983422c21fe027fcb17c175357a26845eb977669
The system property is for system to be able to identify vendor
implementation that is ready to support updatable APEXes. When this
sysprop is set to true, the init creates separate mount namespaces for
processes launched before apexd. When unset, default is false.
Bug: 122428178
Test: device boots to the UI
Test: atest android.appsecurity.cts.ExternalStorageHostTest
Change-Id: I4ae1eac5eec5f5085d8d32ff58300dfa9967c29a
Running this script sometimes completely hangs all of our computers.
This change seems to work better for me.
Test: Use script to compile many Androids.
Change-Id: I95539034b35a4ff6dbc39cd67856b0bd7e20d587
This is needed in cases SELinux labels are restored under /data/apex by
an external process calling restorecon. In normal condition files under
/data/apex/active retain the label staging_data_file used at their
original creation by StagingManager. However, we observed that the label
might be changed to apex_data_file, which we were able to reproduce by
running restorecon.
Explicitly mark files under /data/apex/active and /data/apex/backup as
staging_data_file.
This CL also remove some stale rules being addressed since.
Test: ran restorecon on files in /data/apex/active, attempted installing
a new apex which triggered the violation when files are linked to
/data/apex/backup. With this CL, the operation succeeds.
Bug: 112669193
Change-Id: Ib4136e9b9f4993a5b7e02aade8f5c5e300a7793c
The sysfs path for controlling dma fence events changed yet again in
Linux 4.10, see kernel commit f54d1867005c3.
Test: adb shell atrace --list_categories | grep sync
Change-Id: Id6332f794ee4e350c936e1e777e9d94fc7cd6d11
Vendors should be able to specify additional cgroups and task profiles
without changing system files. Add access rules for /vendor/etc/cgroups.json
and /vendor/etc/task_profiles.json files which will augment cgroups and
task profiles specified in /etc/cgroups.json and /etc/task_profiles.json
system files. As with system files /vendor/etc/cgroups.json is readable
only by init process. task_profiles.json is readable by any process that
uses cgroups.
Bug: 124960615
Change-Id: I12fcff0159b4e7935ce15cc19ae36230da0524fc
Signed-off-by: Suren Baghdasaryan <surenb@google.com>
The underlying issue has been fixed, so this
SELinux denial shouldn't occur anymore.
Bug: 118185801
Test: manual
Change-Id: I5656e341bcb7b554bcd29e00315648eb75ec0a3d
We are only interested in removing "open" access from apps, so leave
apps with (rw_file_perms - open) permissions to /dev/ashmem
Bug: 126627315
Test: emulator boots without denials to /dev/ashmem
Change-Id: I7f03fad5e4e82aebd1b6272e4956b16f86043637
Add art_apex_postinstall domain that is allowed to move
precreated AoT artifacts from /data/ota.
Bug: 125474642
Test: m
Change-Id: Id674e202737155a4ee31187f096d1dd655001fdd
gsid is started lazily to reduce memory pressure. It can be started
either via gsi_tool (invoked by adb shell), or by DynamicAndroidService
via system_server.
Bug: 126622385
Test: no denials running "gsi_tool status"
Change-Id: I90a5f3f28fe4f294fb60e7c87a62e76716fbd5c0
Add art_apex_preinstall domain that is allowed to create AoT
artifacts in /data/ota.
Bug: 125474642
Test: m
Change-Id: Ia091d8df34c4be4f84c2052d3c333a0e36bcb036
Fixes: 126604492
Test: Build userdebug and user.
Test: Test
android.cts.security.SELinuxNeverallowRulesTest#testNeverallowRules129
on userdebug.
Change-Id: I0716e566570114878842644339401331513bae22
This can not be done from the system server as there are native API that
do not go through it (aaudio, opensles).
Test: adb shell dumpsys media.audio_policy | grep -i 'Package manager'
Bug: 111453086
Signed-off-by: Kevin Rocard <krocard@google.com>
Change-Id: I0a4021f76b5937c6191859892fefaaf47b77967f
Apps are no longer allowed open access to /dev/ashmem, unless they
target API level < Q.
Bug: 113362644
Test: device boots, Chrome, instant apps work
Change-Id: I1cff08f26159fbf48a42afa7cfa08eafa1936f42
So it can dexopt these JARs.
Bug: 119800099
Test: DeviceBootTest.DeviceBootTest#SELinuxUncheckedDenialBootTest
Change-Id: I40b25319381654c607e17d6fc61e1a1c6fb0c1f1
System suspend service is not a HAL, so avoid using HAL-specific macros
and attributes.
Use system_suspend_server attribute for ISystemSuspend.hal permissions.
Use system_suspend type directly for internal .aidl interface
permissions.
Bug: 126259100
Test: m selinux_policy
Test: blueline boots; wakelocks can still be acquired; device suspends
if left alone.
Change-Id: Ie811e7da46023705c93ff4d76d15709a56706714
In preparation for additions that should be private-only, move the
types to private. Both have to be moved as they are dependent.
Bug: 125474642
Test: m
Change-Id: I6a76eba41b036bc6fb83588adbe9d63767d3e159
