tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
47470 commits 1 branch 0 tags 50 MiB
Commit graph

462 commits

Author SHA1 Message Date
Inseob Kim
a9d412d373 Install cil_compat_map module's output 
... so it can be packaged as PackagingSpecs

Bug: 329208946
Test: m aosp_cf_system_x86_64
Change-Id: I6298a3e99e74c38befb3a3565e4c638e1558114d
 2024-04-05 23:45:23 +09:00
Treehugger Robot
210e8b5651 Merge "Adding on_device_intelligence selinux policy to allow system appliations to retrieve this service" into main 2024-03-11 15:21:42 +00:00
sandeepbandaru
600e395339 Adding on_device_intelligence selinux policy to allow system appliations to retrieve this service 
Bug: 316589195
Test: flashed on device and ran service with a demo app
Change-Id: I708d715525dd1c4f3985dfcc1560383d045f1a6f
 2024-03-11 11:33:18 +00:00
Alan Stokes
d02b052624 Merge "Add virtualization_maintenance_service" into main am: d2bc72b7eb 
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/2967637

Change-Id: Ib5539a82cb00a141c3c4d9877acb7195f853107d
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
 2024-02-22 10:33:00 +00:00
Alan Stokes
38131e7ba8 Add virtualization_maintenance_service 
This is an AIDL service exposed by Virtualization Service to system
server (VirtualizationSystemService).

The implementation is Rust so no fuzzer is required.

I've put this behind the flag on general principle.

Bug: 294177871
Test: atest MicrodroidTests
Change-Id: Ia867fe27fb2e76d9688e4ba650ebf7b3f51ee597
 2024-02-20 17:08:28 +00:00
Treehugger Robot
8dae0dd2db Merge "Support multiple se_flags modules" into main am: f9f826fb30 
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/2963582

Change-Id: Ie6758c95131388b40c8731151529672e271dc430
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
 2024-02-19 05:01:22 +00:00
Inseob Kim
bf7f4a4401 Support multiple se_flags modules 
Instead of centralized one se_flags module under system/sepolicy,
additional se_flags modules can be defined anywhere to support defining
downstream branches' own flagging.

Bug: 321875465
Test: TH
Test: soong test
Change-Id: I6e45c859b7f09e27ba1d60033b0db1424472cb63
 2024-02-16 16:14:40 +09:00
Yisroel Forta
f86fab0d6d Merge "SELinux permissions for ProfilingService" into main am: e510cb8696 
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/2955343

Change-Id: Id393a7cdbcbb82d767b2457c33daf2c96c5bead7
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
 2024-02-12 14:51:42 +00:00
Yisroel Forta
e510cb8696 Merge "SELinux permissions for ProfilingService" into main 2024-02-12 14:22:31 +00:00
Yisroel Forta
aa9d0bf24c SELinux permissions for ProfilingService 
Test: Presubmit, manually confirm service accessible
Bug: 293957254
Change-Id: I7103be95ff49eb87b4c7164a38a481034d72a9aa
 2024-02-09 19:25:32 +00:00
Jiakai Zhang
59bb9008fd Merge "Update sepolicy for service dexopt_chroot_setup and artd_pre_reboot." into main am: 95d371bcfd 
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/2939419

Change-Id: I75166873b4baa3d781ebb0b7055f9f42b8a5dd1e
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
 2024-02-09 03:29:50 +00:00
Jiakai Zhang
95d371bcfd Merge "Update sepolicy for service dexopt_chroot_setup and artd_pre_reboot." into main 2024-02-09 02:52:58 +00:00
mrulhania
faaec9dd3a Add SELinux policy for ContentProtectionManagerService am: 9a7700cd46 
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/2952703

Change-Id: Ib8beac88752e6c4576bc177553c33c82df5b1026
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
 2024-02-09 00:41:43 +00:00
mrulhania
9a7700cd46 Add SELinux policy for ContentProtectionManagerService 
Bug: 324348549
Test: build
Change-Id: Ieb319ed033d2fdb18cf76107c44cd6357221ecc4
 2024-02-08 19:56:49 +00:00
Jiakai Zhang
817c49f74c Update sepolicy for service dexopt_chroot_setup and artd_pre_reboot. 
Bug: 311377497
Test: manual - Call
  getDexoptChrootSetupServiceRegisterer().waitForService()
Test: manual - Set up a chroot environment and call
  getArtdPreRebootServiceRegisterer().waitForService()
Change-Id: I50b5f7f858dab37f05174cb9787f64303d50d083
 2024-02-08 10:13:27 +08:00
Treehugger Robot
ef4bd550ee Merge "Changes in SELinux Policy for CSS API" into main am: 49a519234b 
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/2819838

Change-Id: I4cfa495bdeae5c048a6f5bf6b308de21c2e40ca7
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
 2024-02-06 21:05:13 +00:00
Treehugger Robot
49a519234b Merge "Changes in SELinux Policy for CSS API" into main 2024-02-06 20:28:45 +00:00
Dan Shi
f6477f4f03 Merge "Revert "audio: Provide a default implementation of IHalAdapterVe..."" into main am: b230f4f10c 
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/2944648

Change-Id: I0ebc9160853d628eb184c53ffff580717fca2137
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
 2024-02-01 22:25:09 +00:00
Dan Shi
b230f4f10c Merge "Revert "audio: Provide a default implementation of IHalAdapterVe..."" into main 2024-02-01 21:57:51 +00:00
Mikhail Naganov
1460db3c7c Merge "audio: Provide a default implementation of IHalAdapterVendorExtension" into main am: c301f8ef3d 
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/2930452

Change-Id: I78f36755805b4cfc220a92b4b779aa7e8c3a7f44
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
 2024-02-01 21:44:09 +00:00
Dan Shi
0ad6f6bdd6 Revert "audio: Provide a default implementation of IHalAdapterVe..." 
Revert submission 2929484-fix-b-321651892-ihaladapter

Reason for revert: possible cause of b/323385784

Reverted changes: /q/submissionid:2929484-fix-b-321651892-ihaladapter

Change-Id: I9664f8f9dd6eec159be7fbf3b148a12d44cef582
 2024-02-01 19:32:34 +00:00
Mikhail Naganov
c301f8ef3d Merge "audio: Provide a default implementation of IHalAdapterVendorExtension" into main 2024-02-01 16:48:06 +00:00
Haining Chen
c269e3acee Merge "Add sepolicy for adaptive auth service" into main am: 2b8ddb7d7c 
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/2926551

Change-Id: Ib7efb0b61d4a558fc80c7f716988966446cb4ef0
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
 2024-01-31 20:36:46 +00:00
Xin Li
b96adcf722 Merge Android 24Q1 Release (ab/11220357) 
Bug: 319669529
Merged-In: Ia3c8bcddaed44d4dd03df6d504fecb61d999cbec
Change-Id: Iefabaeb2456a31cd008f6ccb6b4e924c87dc2f65
 2024-01-29 13:06:50 -08:00
Mikhail Naganov
00c2fedc5a audio: Provide a default implementation of IHalAdapterVendorExtension 
This service is used by the audio server for translating
between legacy string KV pairs and AIDL vendor parameters.
It resides on the system_ext partition.

Since it has to be implemented by every SoC vendor, provide
an example implementation. This example service is added
to CF and GSI system_ext. Vendors can use their own names
and policy labels, the only thing that the audio server
depends on is the AIDL interface.

There is no fuzzer for this service because the example
implementation only contains trivial code (interface
methods are stubbed out).

Bug: 321651892
Test: atest audiorouting_tests
Change-Id: I8ab922660a30ffd44772987204ac4a28c1007c66
 2024-01-26 15:35:51 -08:00
Haining Chen
982295a6af Add sepolicy for adaptive auth service 
Bug: 285053096
Test: m -j
Change-Id: I549de0536071ff5622c54e86927b1f20dab9d007
 2024-01-24 15:47:14 -08:00
Jay Thomas Sullivan
4e57c74f29 [ECM] Update SELinux policy for EnhancedConfirmationService 
EnhancedConfirmationService is a new SystemService.

These changes are required before the service will boot.

Bug: 321053639
Change-Id: I15a4004ca57deb5c6f8757913c1894ba0ced399d
 2024-01-23 23:15:16 +00:00
Pawan Wagh
d4205898ec Add statsd service fuzzer to bindings 
Test: m
Bug: 232439428
Change-Id: I7f6a2b8f4f00f38863d7d0d9d12370f23d9d556b
 2024-01-12 22:10:28 +00:00
Treehugger Robot
24d52ac42a Merge "Change sepolicy version format for vFRC" into main 2023-12-22 02:25:15 +00:00
David Drysdale
7e09f9ceef Add the fuzzer for ISecretkeeper/nonsecure 
Test: N/A
Bug: 291228655
Change-Id: Ie67905f0703762198339ff80e9ae8d10b06eba3f
 2023-12-19 09:49:26 +00:00
Inseob Kim
3e34b72f9c Change sepolicy version format for vFRC 
sepolicy versioning is for system <-> vendor compatibility. This changes
sepolicy version format from sdk version (e.g. 34.0) to vendor api
version (e.g. 202404.0).

Bug: 314010177
Test: build and boot
Change-Id: I2422c416b7fb85af64c8c835497bbecd2e10e2ab
 2023-12-19 13:35:38 +09:00
Franklin Abreu Bueno
a3bfb1485e Bluetooth LMP Events: Add Lmp Events Hal 
Bug: 281503650
Change-Id: Ie9fa616d4142c554c30e5b45b625203387edb9a7
 2023-12-13 12:02:33 -08:00
Chienyuan Huang
992ee5d4f1 Merge "Add bluetooth ranging hal" into main am: 6217aedfdb am: 198beb4785 am: 29c7c5e380 
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/2854391

Change-Id: Ie68a60c7544fc01f912b49b8eea17a573e755c36
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
 2023-12-11 23:13:44 +00:00
Chienyuan Huang
2e19c7632e Add bluetooth ranging hal 
Bug: 310941161
Test: make
Change-Id: I9b2bc9d945b016361f44a5600c61ed2795c00622
 2023-12-08 09:37:17 +00:00
David Drysdale
71babc2b44 Merge "Allow for ISecretkeeper/default" into main am: 3f63eead74 am: 98c169553f am: 42207db4cf 
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/2829790

Change-Id: I27acef348359e3d2fe1aadcd339dfd27db2d2355
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
 2023-12-06 12:44:04 +00:00
David Drysdale
8d1876b4f6 Allow for ISecretkeeper/default 
Test: VtsAidlAuthGraphSessionTest
Bug: 306364873
Change-Id: I788d6cd67c2b6dfa7b5f14bc66444d18e3fd35d3
 2023-12-05 14:33:47 +00:00
Ted Wang
4792dd12ce Merge "Add bluetooth finder hal" into main am: fb82802fc0 am: 2ca6c9a46a am: 8fe9f4da45 
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/2836616

Change-Id: I383c9a5ccb2b5ec204224054b8e6d8cbb40c0e01
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
 2023-12-01 19:23:10 +00:00
Ted Wang
fb82802fc0 Merge "Add bluetooth finder hal" into main 2023-12-01 17:41:04 +00:00
Ján Sebechlebský
7820573474 Merge "Revert^2 "Add fuzzer for "virtual_camera" service"" into main 2023-11-22 10:29:10 +00:00
Alice Wang
7652b9104f Revert^4 "[avf][rkp] Allow virtualizationservice to register RKP HAL" am: e79bbf9cf8 am: d6a81a15f1 am: b76b119dfc 
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/2828234

Change-Id: I3253cb79cd16f11534640e18ff5ad3bbea354944
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
 2023-11-22 10:17:41 +00:00
Ján Sebechlebský
5a01f3d5b7 Revert^2 "Add fuzzer for "virtual_camera" service" 
This reverts commit b701c8d098.

Reason for revert: aosp/2824498 merged

Change-Id: Ie885405d6998c0997f3fba9f3968195ec3022a37
 2023-11-22 09:12:55 +00:00
Alice Wang
e79bbf9cf8 Revert^4 "[avf][rkp] Allow virtualizationservice to register RKP HAL" 
Revert submission 2829351-revert-2812456-revert-2812435-revert-2778549-expose-avf-rkp-hal-GTFGLMUUKQ-PAWNEHUQBT-WYENGHRTXK

Reason for revert: Relands the original topic:
https://r.android.com/q/topic:%22expose-avf-rkp-hal%22

Changes from the reverted cl aosp/2812455:
 - The AIDL service type has been renamed from avf_* to hal_* to be
   consistent with the others.

 - The new AIDL service type, hal_remotelyprovisionedcomponent_avf_service,
   for the IRPC/avf service, has been set up with the server/client model
   for AIDL Hal. The virtualizationservice is declared as server and
   RKPD is declared as client to access the service instead of raw
   service permission setup as in the reverted cl. This is aligned
   with the AIDL Hal configuration recommendation.

 - Since the existing type for IRPC hal_remotelyprovisionedcomponent is
   already associated with keymint server/client and has specific
   permission requirements, and some of the keymint clients might not
   need the AVF Hal. We decided to create a new AIDL service type
   instead of reusing the exisiting keymint service type.

Reverted changes: /q/submissionid:2829351-revert-2812456-revert-2812435-revert-2778549-expose-avf-rkp-hal-GTFGLMUUKQ-PAWNEHUQBT-WYENGHRTXK

Bug: 312427637
Bug: 310744536
Bug: 299257581
Test: atest MicrodroidHostTests librkp_support_test
Change-Id: Id37764b5f98e3c30c0c63601560697cf1c02c0ad
 2023-11-22 08:21:27 +00:00
Ján Sebechlebský
e5c69d1279 Merge changes I0ca68d6c,Ie621f896 into main am: d97e6b1d70 am: 5c1d248fd0 am: 98c2d64a81 
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/2837616

Change-Id: Ia4804c51a283b680c0d605abde24d43023ed5ce2
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
 2023-11-22 07:39:27 +00:00
Ján Sebechlebský
d97e6b1d70 Merge changes I0ca68d6c,Ie621f896 into main 
* changes:
  Allow virtual camera service to access gpu.
  Revert^2 "Allow system_server to communicate with virtual_camera"
 2023-11-22 06:58:18 +00:00
Ahmad Khalil
8e6cfcf0dd Add fwk_vibrator_control_service am: 95ee9ea719 am: a6c6bf0889 am: 4db36172c5 
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/2824730

Change-Id: I6c5769d0e78df261058ca8b8cc351772135157ca
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
 2023-11-22 00:22:01 +00:00
Ahmad Khalil
95ee9ea719 Add fwk_vibrator_control_service 
Convert vibrator_control to a framework service (fwk_vibrator_control_service) in system_server.

Bug: 305961689
Test: N/A
Change-Id: I5f3aba2c58a3166593a11034a8d21dfd12311c2e
 2023-11-21 20:59:48 +00:00
Shikha Panwar
8c206de95d Merge "Secretkeeper/Sepolicy: Create required domains" into main am: 2838e84381 am: 67d30d0d61 am: d75c66dea0 
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/2719356

Change-Id: I8e1043698e68ac5d665e45bb0e7d2ee0ed6a61ca
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
 2023-11-21 18:56:09 +00:00
Shikha Panwar
2838e84381 Merge "Secretkeeper/Sepolicy: Create required domains" into main 2023-11-21 17:56:46 +00:00
Shikha Panwar
59c970703b Secretkeeper/Sepolicy: Create required domains 
Add sepolicies rules for Secretkeeper HAL & nonsecure service
implementing the AIDL.

Test: atest VtsHalSkTargetTest & check for Selinux denials
Bug: 293429085
Change-Id: I907cf326e48e4dc180aa0d30e644416d4936ff78
 2023-11-21 12:29:18 +00:00
Shubang Lu
38d2af2a17 Merge "Add SE policy for tv_ad_service" into main am: 0d65502e9e am: 26e47c1bd9 am: a5f292312b 
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/2831310

Change-Id: I6aaec8a72e4a3f6806a2e05cea74d019ae7eae49
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
 2023-11-20 21:13:30 +00:00