tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
8281 commits 1 branch 0 tags 50 MiB
Commit graph

8281 commits

This branch
This branch
All branches
Author SHA1 Message Date
Chia-I Wu
32436ba2a3 resolve merge conflicts of 837a6f2 to master 
Test: make
Change-Id: Icf77940472c7b7776b731c0ce0c1f53ac8bd198c
 2016-11-15 06:43:35 +08:00
Chad Brubaker
057d754f9c Label ephemeral APKs and handle their install/uninstall am: 6f090f6911 am: 7ece155217 am: fb1c1974c0 
am: 4394f36d6b

Change-Id: Ie5bfd30fa52f8f9a6233df23b8489cb36fea7f65
 2016-11-12 00:56:45 +00:00
Chad Brubaker
4394f36d6b Label ephemeral APKs and handle their install/uninstall am: 6f090f6911 am: 7ece155217 
am: fb1c1974c0

Change-Id: I636aeeeefa7b16bd867fc618d9dfbd6fb7ef1368
 2016-11-12 00:49:37 +00:00
Chad Brubaker
fb1c1974c0 Label ephemeral APKs and handle their install/uninstall am: 6f090f6911 
am: 7ece155217

Change-Id: Id1b1fc8b0aac7113e3d7a0cf718e9e85d6a869bc
 2016-11-12 00:43:07 +00:00
Chad Brubaker
7ece155217 Label ephemeral APKs and handle their install/uninstall 
am: 6f090f6911

Change-Id: I97d83d29f28fb04500f30bd29c4a316f3bbb7ee0
 2016-11-12 00:36:35 +00:00
Chad Brubaker
6f090f6911 Label ephemeral APKs and handle their install/uninstall 
Fixes: 32061937
Test: install/uninstall and verified no denials
Change-Id: I487727b6b32b1a0fb06ce66ed6dd69db43c8d536
 2016-11-12 00:27:28 +00:00
Nick Kralevich
a64a56453a property.te: delete security_prop am: ee751c33c5 am: b1985a8498 am: 8e280c9ce3 
am: f1801d72d3

Change-Id: I59db39fc182c3dffbd780c08402d2c0ab437c16b
 2016-11-11 23:11:15 +00:00
Nick Kralevich
f1801d72d3 property.te: delete security_prop am: ee751c33c5 am: b1985a8498 
am: 8e280c9ce3

Change-Id: I277a1c53f9b08899c60048c3ae814599168d52e5
 2016-11-11 22:57:55 +00:00
Nick Kralevich
8e280c9ce3 property.te: delete security_prop am: ee751c33c5 
am: b1985a8498

Change-Id: I8b6aebdbc8e27a4ea39e0fce93694fd96ed00873
 2016-11-11 22:50:54 +00:00
Nick Kralevich
b1985a8498 property.te: delete security_prop 
am: ee751c33c5

Change-Id: I2acdab95a5d2302a10ed6cf57c0705edc480bc6c
 2016-11-11 22:44:33 +00:00
Nick Kralevich
ee751c33c5 property.te: delete security_prop 
This property is never used.

Test: policy compiles
Change-Id: I43ace92950e1221754db28548031fbbfc0437d7a
 2016-11-11 12:31:19 -08:00
TreeHugger Robot
ee9c88f939 Merge changes from topic 'health-hal' 
* changes:
  health: add sepolicy for health hal service
  health: allow rules for passthrough health HAL
 2016-11-11 18:57:51 +00:00
Nick Kralevich
9f89a1f4a1 Merge "property.te: sort entries" am: 7da34af860 am: 4778d65665 am: 527531883d 
am: 5ed9cdeee7

Change-Id: Ie15f2f3871a9c77345e7089c3c8d2c43df65172c
 2016-11-11 17:47:20 +00:00
Nick Kralevich
5ed9cdeee7 Merge "property.te: sort entries" am: 7da34af860 am: 4778d65665 
am: 527531883d

Change-Id: Ic859d99d26467c7435adce38c139c9fe8002b599
 2016-11-11 17:40:19 +00:00
Nick Kralevich
527531883d Merge "property.te: sort entries" am: 7da34af860 
am: 4778d65665

Change-Id: Id76201a3f96b03dcbc9f83dd8588e81e4f54d1c2
 2016-11-11 17:33:48 +00:00
Nick Kralevich
4778d65665 Merge "property.te: sort entries" 
am: 7da34af860

Change-Id: Ifee77468b2596cc3570abfa276e3ba23dcf2c2e4
 2016-11-11 17:27:09 +00:00
Treehugger Robot
7da34af860 Merge "property.te: sort entries" 2016-11-11 17:20:33 +00:00
Robert Sesek
ce43274139 Add the "webview_zygote" domain. am: dc43f7cd84 am: d94ae33832 am: 1dfbcab386 
am: b4830b23ab

Change-Id: Ia44c279c95f33fd824c7fda7bad393eda8555ab5
 2016-11-11 15:51:01 +00:00
Robert Sesek
b4830b23ab Add the "webview_zygote" domain. am: dc43f7cd84 am: d94ae33832 
am: 1dfbcab386

Change-Id: Ib66fe19363f61d26ef92b18f90929e24ea914fe6
 2016-11-11 15:44:00 +00:00
Robert Sesek
1dfbcab386 Add the "webview_zygote" domain. am: dc43f7cd84 
am: d94ae33832

Change-Id: I4aee6186c988989ae80227d5a1db586ab9e1f56e
 2016-11-11 15:37:00 +00:00
Robert Sesek
d94ae33832 Add the "webview_zygote" domain. 
am: dc43f7cd84

Change-Id: I5f2e21e9ea3a85c8f0cb4b8e15ae54a54eb9e1ab
 2016-11-11 15:30:00 +00:00
Robert Sesek
dc43f7cd84 Add the "webview_zygote" domain. 
The webview_zygote is a new unprivileged zygote and has its own sockets for
listening to fork requests. However the webview_zygote does not run as root
(though it does require certain capabilities) and only allows dyntransition to
the isolated_app domain.

Test: m
Test: angler boots

Bug: 21643067
Change-Id: I89a72ffe6dcb983c4a44048518efd7efb7ed8e83
 2016-11-11 10:13:17 -05:00
Nick Kralevich
26c6d726dd property.te: sort entries 
Sort the entries in property.te. This will make it slightly easier to
read, and avoids merge conflicts by discouraging the common practice of
adding entries to the bottom of this file.

Test: policy compiles.
Change-Id: I87ae96b33156dba73fb7eafc0f9a2a961b689853
 2016-11-11 02:44:51 -08:00
Jason Monk
16d5ce62a0 Add persist.vendor.overlay. to properties am: 0e1cbf568a am: 829672f098 am: e6a26a2a01 
am: cd6265f01d

Change-Id: Iff2d7b0933c2f97f4b01d0e551c9089b2a2f11a8
 2016-11-11 00:25:10 +00:00
Jason Monk
cd6265f01d Add persist.vendor.overlay. to properties am: 0e1cbf568a am: 829672f098 
am: e6a26a2a01

Change-Id: I14f46ab9847bc4334115633a815781d4c36da4fd
 2016-11-11 00:19:09 +00:00
Jason Monk
e6a26a2a01 Add persist.vendor.overlay. to properties am: 0e1cbf568a 
am: 829672f098

Change-Id: I17df5f5a7d9eb0ef50d5667714952bbce2c0771e
 2016-11-11 00:13:38 +00:00
Jason Monk
829672f098 Add persist.vendor.overlay. to properties 
am: 0e1cbf568a

Change-Id: Ic60dfc5a0caf4cd43c2fdc25c44f58eaacf4fd66
 2016-11-11 00:07:08 +00:00
Sandeep Patil
ef62fd9159 health: add sepolicy for health hal service 
Test: tested with default health HAL on angler running as service.
Bug: b/32754732

Change-Id: Ie0b70d43cb23cd0878e1b7b99b9bebdbd70d17c7
Signed-off-by: Sandeep Patil <sspatil@google.com>
 2016-11-10 14:53:24 -08:00
Jason Monk
0e1cbf568a Add persist.vendor.overlay. to properties 
Allow the system_server to change. Allow the zygote to read it as well.

Test: Have system_server set a property
Change-Id: Ie90eec8b733fa7193861026a3a6e0fb0ba5d5318
 2016-11-10 17:35:39 -05:00
Sandeep Patil
32cacb42b9 health: allow rules for passthrough health HAL 
- allows binder calls to hwservicemanager
- allows healthd to read system_file for passthrough HAL

Test: Tested healthd with and without a board specific health HAL on
Angler.

Bug: b/32724915

Change-Id: Icf621859f715cb44bce5d8d3b60320ef495d1543
Signed-off-by: Sandeep Patil <sspatil@google.com>
 2016-11-09 08:44:05 -08:00
Nick Kralevich
ced59af355 Revert "Restore system_server ioctl socket access." am: 58305da980 am: b2245d6420 am: f4c76c5fd5 
am: 74d3b416f7

Change-Id: I8df18e2c0c805b2af3d1143a828f1d6a133c9a52
 2016-11-09 01:50:22 +00:00
Nick Kralevich
74d3b416f7 Revert "Restore system_server ioctl socket access." am: 58305da980 am: b2245d6420 
am: f4c76c5fd5

Change-Id: I97bbdad7f08fcaaf4f779bad39275125c496c927
 2016-11-09 01:43:48 +00:00
Nick Kralevich
f4c76c5fd5 Revert "Restore system_server ioctl socket access." am: 58305da980 
am: b2245d6420

Change-Id: Ib8ab9ee9051d405801857d30df0a37c43a24928e
 2016-11-09 01:38:51 +00:00
Nick Kralevich
b2245d6420 Revert "Restore system_server ioctl socket access." 
am: 58305da980

Change-Id: I9379e8a7d52d6daccfadae4c0e2b19ee43f1932b
 2016-11-09 01:33:12 +00:00
Sandeep Patil
a03dc5da5b Merge "healthd: create SEPolicy for 'charger' and reduce healthd's scope" 2016-11-08 23:45:16 +00:00
Nick Kralevich
58305da980 Revert "Restore system_server ioctl socket access." 
The underlying ioctl denial was fixed in device-specific policy.
It's not needed in core policy.

A search of SELinux denials shows no reported denials, other than the
ones showing up on marlin.

This reverts commit ec3285cde0.

(cherrypicked from commit 863ce3e7c7)

Test: AndroiTS GPS Test app shows GPS data, no SELinux denials.
Bug: 32290392
Change-Id: I1ba7bad43a2cdd7cdebbe1c8543a71eee765621d
 2016-11-08 12:40:44 -08:00
Nick Kralevich
16b4b92707 profman/debuggerd: allow libart_file:file r_file_perms am: 364fd19782 am: d62abbeea3 am: ff6715f3d2 
am: c9d0e1e9b9

Change-Id: I1dcb7093b6a770cf2ff1f124d9092b79a8d34d58
 2016-11-08 20:25:09 +00:00
Nick Kralevich
c9d0e1e9b9 profman/debuggerd: allow libart_file:file r_file_perms am: 364fd19782 am: d62abbeea3 
am: ff6715f3d2

Change-Id: Ibf6da5e4bf8dedb5797958d5c00ac675303d47f0
 2016-11-08 20:19:40 +00:00
Nick Kralevich
ff6715f3d2 profman/debuggerd: allow libart_file:file r_file_perms am: 364fd19782 
am: d62abbeea3

Change-Id: Ib9b65a933da450b4baf70a4e26c15e177ba04d16
 2016-11-08 20:14:08 +00:00
Nick Kralevich
d62abbeea3 profman/debuggerd: allow libart_file:file r_file_perms 
am: 364fd19782

Change-Id: I4022ab4a4f92a197c48db96a9847cc8166ed2dab
 2016-11-08 20:08:38 +00:00
Nick Kralevich
364fd19782 profman/debuggerd: allow libart_file:file r_file_perms 
Addresses the following auditallow spam:

avc: granted { read open } for comm="profman"
path="/system/lib/libart.so" dev="dm-0" ino=1368 scontext=u:r:profman:s0
tcontext=u:object_r:libart_file:s0 tclass=file

avc: granted { read open } for comm="debuggerd64"
path="/system/lib64/libart.so" dev="dm-0" ino=1897
scontext=u:r:debuggerd:s0 tcontext=u:object_r:libart_file:s0 tclass=file

avc: granted { getattr } for comm="debuggerd64"
path="/system/lib64/libart.so" dev="dm-0" ino=1837
scontext=u:r:debuggerd:s0 tcontext=u:object_r:libart_file:s0 tclass=file

Test: Policy compiles. Not a tightening of rules.
Change-Id: I501b0a6a343c61b3ca6283647a18a9a15deddf2a
 2016-11-08 09:28:28 -08:00
Polina Bondarenko
d15db77471 sepolicy: Add policy for thermal HIDL service am: 9785f2addd am: 458888a7d3 am: abbc718f19 
am: 1bda71f5e3

Change-Id: I54f8bdde9ef811a1e33abf03fc9ae290af0d750e
 2016-11-08 15:32:50 +00:00
Polina Bondarenko
1bda71f5e3 sepolicy: Add policy for thermal HIDL service am: 9785f2addd am: 458888a7d3 
am: abbc718f19

Change-Id: Idc25b53e2e5cc1ac4ab9a93814773d69548a3db0
 2016-11-08 15:26:19 +00:00
Polina Bondarenko
abbc718f19 sepolicy: Add policy for thermal HIDL service am: 9785f2addd 
am: 458888a7d3

Change-Id: I46f9e803ee3f19fe690c8d0b5b21a6d65cd91750
 2016-11-08 15:19:49 +00:00
Polina Bondarenko
458888a7d3 sepolicy: Add policy for thermal HIDL service 
am: 9785f2addd

Change-Id: I2543991deefb4ba16ef0476e92442cfadba25793
 2016-11-08 15:13:48 +00:00
TreeHugger Robot
b602b3b6b5 Merge "Revert "Restore system_server ioctl socket access."" 2016-11-08 14:35:16 +00:00
Polina Bondarenko
9785f2addd sepolicy: Add policy for thermal HIDL service 
Bug: 32022261
Test: manual
Change-Id: I664a3b5c37f6a3a36e4e5beb91b384a9599c83f8
 2016-11-08 13:34:31 +01:00
Nick Kralevich
cbefe07f1c installd: r_dir_file(installd, system_file) am: 68f233648e am: b8b0d3746f am: 24176ec819 
am: 5bfb4b3ce8

Change-Id: I4f4e568c4eb4bbe55577c20b157a79fa64f5ab65
 2016-11-08 03:42:09 +00:00
Nick Kralevich
5bfb4b3ce8 installd: r_dir_file(installd, system_file) am: 68f233648e am: b8b0d3746f 
am: 24176ec819

Change-Id: I615992cc6753127008bee40223f52f4464e4e1af
 2016-11-08 03:36:39 +00:00
Nick Kralevich
24176ec819 installd: r_dir_file(installd, system_file) am: 68f233648e 
am: b8b0d3746f

Change-Id: I8b0849da568d8963fcd39306c1adc49096ffb04d
 2016-11-08 03:31:08 +00:00