Alex Deymo
1f3294659d
Move boot_control_hal attribute to hal_boot domain
...
Grant boot_control_hal permissions to the hal_boot service;
update_engine and update_verifier can call that service rather
than using those permissions themselves.
Bug: 31864052
Test: `bootctl set-active-boot-slot 1`
Change-Id: I5188bc32e7933d4a0f5135b3246df119d3523d69
2016-11-15 15:12:41 -08:00
Nick Kralevich
bbf21a4ffe
Merge "exclude su from app auditallow"
...
am: 747c69f43c
2016-11-15 22:50:03 +00:00
Nick Kralevich
506cae4729
isolated_app: allow access to pre-opened sdcard FDs
...
am: c121735f42
2016-11-15 22:49:51 +00:00
Treehugger Robot
747c69f43c
Merge "exclude su from app auditallow"
2016-11-15 22:40:49 +00:00
Nick Kralevich
e0d5c5323d
exclude su from app auditallow
...
su is an appdomain, and as such, any auditallow statements applicable to
appdomain also apply to su. However, su is never enforced, so generating
SELinux denials for such domains is pointless. Exclude su from
ion_device auditallow rules.
Addresses the following auditallow spam:
avc: granted { ioctl } for comm="screencap" path="/dev/ion" dev="tmpfs"
ino=10230 ioctlcmd=4906 scontext=u:r:su:s0
tcontext=u:object_r:ion_device:s0 tclass=chr_file
Test: policy compiles
Change-Id: I2e783624b9e53ad365669bd6f2d4db40da475a16
2016-11-15 13:17:42 -08:00
Nick Kralevich
c121735f42
isolated_app: allow access to pre-opened sdcard FDs
...
Allow isolated apps to read/write/append/lock already open sdcard
file descriptors passed to it by normal app processes. isolated_apps are
used by processes like Google drive when handling untrusted content.
Addresses the following denial:
audit(0.0:1508): avc: denied { read } for
path="/storage/emulated/0/Download/02-corejava.pdf" dev="fuse" ino=310
scontext=u:r:isolated_app:s0:c512,c768 tcontext=u:object_r:fuse:s0
tclass=file permissive=0
This partially reverts the tightening added in
ce4b5eeaee
2016-11-15 12:58:06 -08:00
Daichi Hirono
00020b8edf
Allow apps to search appfuse mount point and open a file on appfuse mount point.
...
am: 4c7044e0b1
2016-11-15 03:11:57 +00:00
Daichi Hirono
4c7044e0b1
Allow apps to search appfuse mount point and open a file on appfuse mount point.
...
Bug: 29970149
Test: None
Change-Id: I59f49f3bf20d93effde5e1a9a3c1ed64fbecb7a8
2016-11-15 10:22:19 +09:00
Chia-I Wu
32436ba2a3
resolve merge conflicts of 837a6f2 to master
...
Test: make
Change-Id: Icf77940472c7b7776b731c0ce0c1f53ac8bd198c
2016-11-15 06:43:35 +08:00
Chad Brubaker
5fa5ffe1c8
Merge "Allow ephemeral apps network connections"
...
am: 41301ab74b
2016-11-14 22:02:49 +00:00
Connor O'Brien
57a25f9c25
Merge "Allow update_verifier to use boot HIDL HAL"
...
am: 353244451f
2016-11-14 22:02:38 +00:00
Treehugger Robot
41301ab74b
Merge "Allow ephemeral apps network connections"
2016-11-14 21:53:15 +00:00
Connor O'Brien
353244451f
Merge "Allow update_verifier to use boot HIDL HAL"
2016-11-14 21:53:07 +00:00
Chad Brubaker
4abf491a9e
Allow ephemeral apps network connections
...
Test: Verify that HTTP and HTTPS connections from ephemeral apps do not
cause denials.
Change-Id: I0ce25602906e63ec55d5b5869445f2aec10900cb
2016-11-14 12:24:51 -08:00
Chia-I Wu
cc15b4ce63
Add sepolicy for hwcomposer HAL
...
am: fb08872a40
2016-11-14 01:54:33 +00:00
Chia-I Wu
aeb6d5bfcb
Add sepolicy for gralloc-alloc HAL
...
am: dd958e5a21
2016-11-14 01:54:31 +00:00
Chia-I Wu
fb08872a40
Add sepolicy for hwcomposer HAL
...
Allow SurfaceFlinger to call into IComposer, and vice versa for
IComposerCallback.
Specifically,
hwbinder_use(...) for
avc: denied { call } for scontext=u:r:hal_graphics_composer:s0 tcontext=u:r:hwservicemanager:s0 tclass=binder permissive=1
avc: denied { transfer } for scontext=u:r:hal_graphics_composer:s0 tcontext=u:r:hwservicemanager:s0 tclass=binder permissive=1
binder_call(..., surfaceflinger) for
avc: denied { call } for scontext=u:r:hal_graphics_composer:s0 tcontext=u:r:surfaceflinger:s0 tclass=binder permissive=1
allow ... gpu_device:chr_file rw_file_perms for
avc: denied { read write } for name="kgsl-3d0" dev="tmpfs" ino=14956 scontext=u:r:hal_graphics_composer:s0 tcontext=u:object_r:gpu_device:s0 tclass=chr_file permissive=1
avc: denied { open } for path="/dev/kgsl-3d0" dev="tmpfs" ino=14956 scontext=u:r:hal_graphics_composer:s0 tcontext=u:object_r:gpu_device:s0 tclass=chr_file permissive=1
avc: denied { ioctl } for path="/dev/kgsl-3d0" dev="tmpfs" ino=14956 ioctlcmd=940 scontext=u:r:hal_graphics_composer:s0 tcontext=u:object_r:gpu_device:s0 tclass=chr_file permissive=1
allow ... ion_device:chr_file r_file_perms for
avc: denied { ioctl } for path="/dev/ion" dev="tmpfs" ino=15014 ioctlcmd=4900 scontext=u:r:hal_graphics_composer:s0 tcontext=u:object_r:ion_device:s0 tclass=chr_file permissive=1
allow ... graphics_device ... for
avc: denied { ioctl } for path="/dev/graphics/fb0" dev="tmpfs" ino=15121 ioctlcmd=5380 scontext=u:r:hal_graphics_composer:s0 tcontext=u:object_r:graphics_device:s0 tclass=chr_file permissive=1
allow ... ...:fd use for
avc: denied { use } for path="anon_inode:dmabuf" dev="anon_inodefs" ino=12794 scontext=u:r:hal_graphics_composer:s0 tcontext=u:r:hal_graphics_allocator_service:s0 tclass=fd permissive=1
avc: denied { use } for path="anon_inode:sync_fence" dev="anon_inodefs" ino=12794 scontext=u:r:hal_graphics_composer:s0 tcontext=u:r:bootanim:s0 tclass=fd permissive=1
avc: denied { use } for path="anon_inode:sync_fence" dev="anon_inodefs" ino=12794 scontext=u:r:hal_graphics_composer:s0 tcontext=u:r:surfaceflinger:s0 tclass=fd permissive=1
avc: denied { use } for path="anon_inode:sync_fence" dev="anon_inodefs" ino=12794 scontext=u:r:hal_graphics_composer:s0 tcontext=u:r:platform_app:s0:c512,c768 tclass=fd permissive=1
binder_call(surfaceflinger, ...) for
avc: denied { call } for scontext=u:r:surfaceflinger:s0 tcontext=u:r:hal_graphics_composer:s0 tclass=binder permissive=1
avc: denied { transfer } for scontext=u:r:surfaceflinger:s0 tcontext=u:r:hal_graphics_composer:s0 tclass=binder permissive=1
avc: denied { use } for path="anon_inode:sync_fence" dev="anon_inodefs" ino=12794 ioctlcmd=3e02 scontext=u:r:surfaceflinger:s0 tcontext=u:r:hal_graphics_composer:s0 tclass=fd permissive=1
avc: denied { use } for path="anon_inode:sync_fence" dev="anon_inodefs" ino=12794 scontext=u:r:surfaceflinger:s0 tcontext=u:r:hal_graphics_composer:s0 tclass=fd permissive=1
allow bootanim ...:fd use for
avc: denied { use } for path="anon_inode:sync_fence" dev="anon_inodefs" ino=11947 scontext=u:r:bootanim:s0 tcontext=u:r:hal_graphics_composer:s0 tclass=fd permissive=1
Bug: 32021609
Test: make bootimage
Change-Id: I036cdbebf0c619fef7559f294f1865f381b17588
2016-11-14 01:10:02 +00:00
Chia-I Wu
dd958e5a21
Add sepolicy for gralloc-alloc HAL
...
Allow SurfaceFlinger to call into IAllocator, and allow everyone to access
IAllocator's fd.
Specifically,
hwbinder_use(...) for
avc: denied { call } for scontext=u:r:hal_graphics_allocator:s0 tcontext=u:r:hwservicemanager:s0 tclass=binder permissive=1
avc: denied { transfer } for scontext=u:r:hal_graphics_allocator:s0 tcontext=u:r:hwservicemanager:s0 tclass=binder permissive=1
allow ... ion_device:chr_file r_file_perms for
avc: denied { read } for name="ion" dev="tmpfs" ino=15014 scontext=u:r:hal_graphics_allocator:s0 tcontext=u:object_r:ion_device:s0 tclass=chr_file permissive=1
avc: denied { open } for path="/dev/ion" dev="tmpfs" ino=15014 scontext=u:r:hal_graphics_allocator:s0 tcontext=u:object_r:ion_device:s0 tclass=chr_file permissive=1
avc: denied { ioctl } for path="/dev/ion" dev="tmpfs" ino=15014 ioctlcmd=4900 scontext=u:r:hal_graphics_allocator:s0 tcontext=u:object_r:ion_device:s0 tclass=chr_file permissive=1
allow ... gpu_device:chr_file rw_file_perms; for
avc: denied { read write } for name="kgsl-3d0" dev="tmpfs" ino=14956 scontext=u:r:hal_graphics_allocator:s0 tcontext=u:object_r:gpu_device:s0 tclass=chr_file permissive=1
avc: denied { open } for path="/dev/kgsl-3d0" dev="tmpfs" ino=14956 scontext=u:r:hal_graphics_allocator:s0 tcontext=u:object_r:gpu_device:s0 tclass=chr_file permissive=1
avc: denied { ioctl } for path="/dev/kgsl-3d0" dev="tmpfs" ino=14956 ioctlcmd=940 scontext=u:r:hal_graphics_allocator:s0 tcontext=u:object_r:gpu_device:s0 tclass=chr_file permissive=1
binder_call(surfaceflinger, ...) for
avc: denied { call } for scontext=u:r:surfaceflinger:s0 tcontext=u:r:hal_graphics_allocator:s0 tclass=binder permissive=1
allow ... ...:fd use for
avc: denied { use } for path="anon_inode:dmabuf" dev="anon_inodefs" ino=12794 scontext=u:r:surfaceflinger:s0 tcontext=u:r:hal_graphics_allocator:s0 tclass=fd permissive=1
Bug: 32021161
Test: make bootimage
Change-Id: Ie7700142313407ac438c43dd1a85544dc4c67f13
2016-11-14 01:09:51 +00:00
Chad Brubaker
057d754f9c
Label ephemeral APKs and handle their install/uninstall am: 6f090f6911 am: 7ece155217 am: fb1c1974c0
...
am: 4394f36d6b
2016-11-12 00:56:45 +00:00
Chad Brubaker
7ece155217
Label ephemeral APKs and handle their install/uninstall
...
am: 6f090f6911
2016-11-12 00:36:35 +00:00
Chad Brubaker
6f090f6911
Label ephemeral APKs and handle their install/uninstall
...
Fixes: 32061937
Test: install/uninstall and verified no denials
Change-Id: I487727b6b32b1a0fb06ce66ed6dd69db43c8d536
2016-11-12 00:27:28 +00:00
Nick Kralevich
a64a56453a
property.te: delete security_prop am: ee751c33c5 am: b1985a8498 am: 8e280c9ce3
...
am: f1801d72d3
2016-11-11 23:11:15 +00:00
Nick Kralevich
b1985a8498
property.te: delete security_prop
...
am: ee751c33c5
2016-11-11 22:44:33 +00:00
Nick Kralevich
ee751c33c5
property.te: delete security_prop
...
This property is never used.
Test: policy compiles
Change-Id: I43ace92950e1221754db28548031fbbfc0437d7a
2016-11-11 12:31:19 -08:00
TreeHugger Robot
ee9c88f939
Merge changes from topic 'health-hal'
...
* changes:
health: add sepolicy for health hal service
health: allow rules for passthrough health HAL
2016-11-11 18:57:51 +00:00
Nick Kralevich
9f89a1f4a1
Merge "property.te: sort entries" am: 7da34af860 am: 4778d65665 am: 527531883d
...
am: 5ed9cdeee7
2016-11-11 17:47:20 +00:00
Nick Kralevich
4778d65665
Merge "property.te: sort entries"
...
am: 7da34af860
2016-11-11 17:27:09 +00:00
Treehugger Robot
7da34af860
Merge "property.te: sort entries"
2016-11-11 17:20:33 +00:00
Robert Sesek
ce43274139
Add the "webview_zygote" domain. am: dc43f7cd84 am: d94ae33832 am: 1dfbcab386
...
am: b4830b23ab
2016-11-11 15:51:01 +00:00
Robert Sesek
d94ae33832
Add the "webview_zygote" domain.
...
am: dc43f7cd84
2016-11-11 15:30:00 +00:00
Robert Sesek
dc43f7cd84
Add the "webview_zygote" domain.
...
The webview_zygote is a new unprivileged zygote and has its own sockets for
listening to fork requests. However the webview_zygote does not run as root
(though it does require certain capabilities) and only allows dyntransition to
the isolated_app domain.
Test: m
Test: angler boots
Bug: 21643067
Change-Id: I89a72ffe6dcb983c4a44048518efd7efb7ed8e83
2016-11-11 10:13:17 -05:00
Nick Kralevich
26c6d726dd
property.te: sort entries
...
Sort the entries in property.te. This will make it slightly easier to
read, and avoids merge conflicts by discouraging the common practice of
adding entries to the bottom of this file.
Test: policy compiles.
Change-Id: I87ae96b33156dba73fb7eafc0f9a2a961b689853
2016-11-11 02:44:51 -08:00
Jason Monk
16d5ce62a0
Add persist.vendor.overlay. to properties am: 0e1cbf568a am: 829672f098 am: e6a26a2a01
...
am: cd6265f01d
2016-11-11 00:25:10 +00:00
Jason Monk
829672f098
Add persist.vendor.overlay. to properties
...
am: 0e1cbf568a
2016-11-11 00:07:08 +00:00
Sandeep Patil
ef62fd9159
health: add sepolicy for health hal service
...
Test: tested with default health HAL on angler running as service.
Bug: b/32754732
Change-Id: Ie0b70d43cb23cd0878e1b7b99b9bebdbd70d17c7
Signed-off-by: Sandeep Patil <sspatil@google.com>
2016-11-10 14:53:24 -08:00
Jason Monk
0e1cbf568a
Add persist.vendor.overlay. to properties
...
Allow the system_server to change. Allow the zygote to read it as well.
Test: Have system_server set a property
Change-Id: Ie90eec8b733fa7193861026a3a6e0fb0ba5d5318
2016-11-10 17:35:39 -05:00
Connor O'Brien
b24e69dca8
Allow update_verifier to use boot HIDL HAL
...
Test: Flashed device and verified no update_verifier permission denials
Change-Id: I5de063c202aefef399645b153f68ff7909989eba
Signed-off-by: Connor O'Brien <connoro@google.com>
2016-11-09 11:16:16 -08:00
Sandeep Patil
32cacb42b9
health: allow rules for passthrough health HAL
...
- allows binder calls to hwservicemanager
- allows healthd to read system_file for passthrough HAL
Test: Tested healthd with and without a board specific health HAL on
Angler.
Bug: b/32724915
Change-Id: Icf621859f715cb44bce5d8d3b60320ef495d1543
Signed-off-by: Sandeep Patil <sspatil@google.com>
2016-11-09 08:44:05 -08:00
Nick Kralevich
b2245d6420
Revert "Restore system_server ioctl socket access."
...
am: 58305da980
2016-11-09 01:33:12 +00:00
Sandeep Patil
a03dc5da5b
Merge "healthd: create SEPolicy for 'charger' and reduce healthd's scope"
2016-11-08 23:45:16 +00:00
Nick Kralevich
58305da980
Revert "Restore system_server ioctl socket access."
...
The underlying ioctl denial was fixed in device-specific policy.
It's not needed in core policy.
A search of SELinux denials shows no reported denials, other than the
ones showing up on marlin.
This reverts commit ec3285cde0863ce3e7c7
2016-11-08 12:40:44 -08:00
Nick Kralevich
16b4b92707
profman/debuggerd: allow libart_file:file r_file_perms am: 364fd19782 am: d62abbeea3 am: ff6715f3d2
...
am: c9d0e1e9b9
2016-11-08 20:25:09 +00:00
Nick Kralevich
d62abbeea3
profman/debuggerd: allow libart_file:file r_file_perms
...
am: 364fd19782
2016-11-08 20:08:38 +00:00
Nick Kralevich
364fd19782
profman/debuggerd: allow libart_file:file r_file_perms
...
Addresses the following auditallow spam:
avc: granted { read open } for comm="profman"
path="/system/lib/libart.so" dev="dm-0" ino=1368 scontext=u:r:profman:s0
tcontext=u:object_r:libart_file:s0 tclass=file
avc: granted { read open } for comm="debuggerd64"
path="/system/lib64/libart.so" dev="dm-0" ino=1897
scontext=u:r:debuggerd:s0 tcontext=u:object_r:libart_file:s0 tclass=file
avc: granted { getattr } for comm="debuggerd64"
path="/system/lib64/libart.so" dev="dm-0" ino=1837
scontext=u:r:debuggerd:s0 tcontext=u:object_r:libart_file:s0 tclass=file
Test: Policy compiles. Not a tightening of rules.
Change-Id: I501b0a6a343c61b3ca6283647a18a9a15deddf2a
2016-11-08 09:28:28 -08:00
Polina Bondarenko
d15db77471
sepolicy: Add policy for thermal HIDL service am: 9785f2addd am: 458888a7d3 am: abbc718f19
...
am: 1bda71f5e3
2016-11-08 15:32:50 +00:00
Polina Bondarenko
458888a7d3
sepolicy: Add policy for thermal HIDL service
...
am: 9785f2addd
2016-11-08 15:13:48 +00:00
TreeHugger Robot
b602b3b6b5
Merge "Revert "Restore system_server ioctl socket access.""
2016-11-08 14:35:16 +00:00
Polina Bondarenko
9785f2addd
sepolicy: Add policy for thermal HIDL service
...
Bug: 32022261
Test: manual
Change-Id: I664a3b5c37f6a3a36e4e5beb91b384a9599c83f8
2016-11-08 13:34:31 +01:00
Nick Kralevich
cbefe07f1c
installd: r_dir_file(installd, system_file) am: 68f233648e am: b8b0d3746f am: 24176ec819
...
am: 5bfb4b3ce8
2016-11-08 03:42:09 +00:00
Nick Kralevich
b8b0d3746f
installd: r_dir_file(installd, system_file)
...
am: 68f233648e
2016-11-08 03:25:38 +00:00
Nick Kralevich
863ce3e7c7
Revert "Restore system_server ioctl socket access."
...
The underlying ioctl denial was fixed in device-specific policy.
It's not needed in core policy.
A search of SELinux denials shows no reported denials, other than the
ones showing up on marlin.
This reverts commit ec3285cde0
2016-11-07 17:01:08 -08:00
Nick Kralevich
68f233648e
installd: r_dir_file(installd, system_file)
...
Allow installd to read through files, directories, and symlinks
on /system. This is needed to support installd using files in
/system/app and /system/priv-app
Addresses the following auditallow spam:
avc: granted { getattr } for comm="installd"
path="/system/app/Bluetooth/lib/arm/libbluetooth_jni.so"
dev="mmcblk0p41" ino=19 scontext=u:r:installd:s0
tcontext=u:object_r:system_file:s0 tclass=lnk_file
avc: granted { getattr } for comm="installd"
path="/system/priv-app/MtpDocumentsProvider/lib/arm64/libappfuse_jni.so"
dev="dm-0" ino=2305 scontext=u:r:installd:s0
tcontext=u:object_r:system_file:s0 tclass=lnk_file
avc: granted { read open } for comm="installd"
path="/system/priv-app/TelephonyProvider" dev="mmcblk0p43" ino=1839
scontext=u:r:installd:s0 tcontext=u:object_r:system_file:s0 tclass=dir
avc: granted { read } for comm="installd" name="Velvet" dev="mmcblk0p43"
ino=1841 scontext=u:r:installd:s0 tcontext=u:object_r:system_file:s0
tclass=dir
avc: granted { read open } for comm="installd"
path="/system/priv-app/GoogleOneTimeInitializer" dev="mmcblk0p43"
ino=1778 scontext=u:r:installd:s0 tcontext=u:object_r:system_file:s0
tclass=dir
avc: granted { read open } for comm="installd"
path="/system/app/PlayAutoInstallConfig" dev="mmcblk0p43" ino=112
scontext=u:r:installd:s0 tcontext=u:object_r:system_file:s0 tclass=dir
Test: policy compiles
Change-Id: I5d14ea2cd7d281f949d0651b9723d5b7fae2e1f2
2016-11-07 16:18:38 -08:00
Roshan Pius
92318b4637
Merge "wpa.te: Add binder permission back" am: b0c375d46d am: fd637d065f am: d4d7d190a3
...
am: e659cf26f8
2016-11-07 23:57:16 +00:00
Roshan Pius
fd637d065f
Merge "wpa.te: Add binder permission back"
...
am: b0c375d46d
2016-11-07 23:39:02 +00:00
Treehugger Robot
b0c375d46d
Merge "wpa.te: Add binder permission back"
2016-11-07 23:28:35 +00:00
Roshan Pius
cec44a61ba
wpa.te: Add binder permission back
...
Adding back the binder permission to access keystore from
wpa_supplicant. This was removed by mistake in the previous patch
(commit#: 6caeac) to add hwbinder permissions.
Denials in logs:
11-03 14:37:54.831 9011 9011 I auditd : type=1400 audit(0.0:1490):
avc: denied { call } for comm="wpa_supplicant" scontext=u:r:wpa:s0
tcontext=u:r:servicemanager:s0 tclass=binder permissive=0
11-03 14:37:54.831 9011 9011 W wpa_supplicant: type=1400
audit(0.0:1490): avc: denied { call } for scontext=u:r:wpa:s0
tcontext=u:r:servicemanager:s0 tclass=binder permissive=0
11-03 14:37:55.838 9011 9011 I ServiceManager: Waiting for service
android.security.keystore...
11-03 14:37:55.834 9011 9011 I auditd : type=1400 audit(0.0:1491):
avc: denied { call } for comm="wpa_supplicant" scontext=u:r:wpa:s0
tcontext=u:r:servicemanager:s0 tclass=binder permissive=0
11-03 14:37:55.834 9011 9011 W wpa_supplicant: type=1400
audit(0.0:1491): avc: denied { call } for scontext=u:r:wpa:s0
tcontext=u:r:servicemanager:s0 tclass=binder permissive=0
11-03 14:37:56.838 9011 9011 I ServiceManager: Waiting for service
android.security.keystore...
11-03 14:37:56.834 9011 9011 I auditd : type=1400 audit(0.0:1492):
avc: denied { call } for comm="wpa_supplicant" scontext=u:r:wpa:s0
tcontext=u:r:servicemanager:s0 tclass=binder permissive=0
11-03 14:37:56.834 9011 9011 W wpa_supplicant: type=1400
audit(0.0:1492): avc: denied { call } for scontext=u:r:wpa:s0
tcontext=u:r:servicemanager:s0 tclass=binder permissive=0
11-03 14:37:57.839 9011 9011 I ServiceManager: Waiting for service
android.security.keystore...
11-03 14:37:57.834 9011 9011 I auditd : type=1400 audit(0.0:1493):
avc: denied { call } for comm="wpa_supplicant" scontext=u:r:wpa:s0
tcontext=u:r:servicemanager:s0 tclass=binder permissive=0
11-03 14:37:57.834 9011 9011 W wpa_supplicant: type=1400
audit(0.0:1493): avc: denied { call } for scontext=u:r:wpa:s0
tcontext=u:r:servicemanager:s0 tclass=binder permissive=0
Bug: 32655747
Test: Compiles. Will send for integration testing.
Change-Id: Ic57a5bf0e6ea15770efc0d09f68d04b2db9ec1b8
2016-11-07 12:51:07 -08:00
Etan Cohen
47e25deb7a
Merge "[NAN-AWARE] Remove NAN service" am: 0182a87dab am: 2143eab887 am: 178dcd8074
...
am: abf4cdc369
2016-11-06 22:15:23 +00:00
Etan Cohen
2143eab887
Merge "[NAN-AWARE] Remove NAN service"
...
am: 0182a87dab
2016-11-06 22:01:22 +00:00
Etan Cohen
0182a87dab
Merge "[NAN-AWARE] Remove NAN service"
2016-11-06 21:56:05 +00:00
Etan Cohen
8b0ef6c8d2
Merge "[NAN-AWARE] Add Aware service" am: 8da9cd640b am: 66502077a9 am: e8c7b7832f
...
am: f12798dbad
2016-11-05 04:18:38 +00:00
Etan Cohen
66502077a9
Merge "[NAN-AWARE] Add Aware service"
...
am: 8da9cd640b
2016-11-05 04:06:07 +00:00
Etan Cohen
8da9cd640b
Merge "[NAN-AWARE] Add Aware service"
2016-11-05 04:00:40 +00:00
Sandeep Patil
c73d0022ad
healthd: create SEPolicy for 'charger' and reduce healthd's scope
...
healthd is being split into 'charger' and 'healthd' processes, that
will never run together. 'charger' is to be run only in charge-only
and recovery, while healthd runs with Android.
While they both share much of battery monitoring code, they both now
have reduced scope. E.g. 'charger', doesn't need to use binder anymore
and healthd doesn't need to do charging ui animation. So, amend the
SEPolicy for healthd to reduce it's scope and add a new one for charger.
Test: Tested all modes {recovery, charger-only, android} with new policy
Change-Id: If7f81875c605f7f07da4d23a313f308b9dde9ce8
Signed-off-by: Sandeep Patil <sspatil@google.com>
2016-11-04 13:41:30 -07:00
Etan Cohen
43b96aaf12
[NAN-AWARE] Remove NAN service
...
Finish NAN -> Aware rename process. Removes old NAN service.
Bug: 32263750
Test: device boots and all Wi-Fi unit-tests pass
Change-Id: I2f0d9595efea2494b56074752194e7a6e66070f2
2016-11-04 13:38:14 -07:00
Etan Cohen
44527cb970
[NAN-AWARE] Add Aware service
...
Add Aware service - new name for NAN. But do not remove NAN
yet. Enables smooth transition.
Bug: 32263750
Test: device boots and all Wi-Fi unit-tests pass
Change-Id: Ieb9f1ebf1d2f31ee27f228562b4601023da5282d
2016-11-04 13:37:17 -07:00
dcashman
c086c03a11
Restore system_server ioctl socket access. am: ec3285cde0 am: 84992ead69 am: b91eadd767
...
am: 017b56d52e
2016-11-04 05:27:47 +00:00
dcashman
84992ead69
Restore system_server ioctl socket access.
...
am: ec3285cde0
2016-11-04 05:16:16 +00:00
dcashman
ec3285cde0
Restore system_server ioctl socket access.
...
Bug: 32290392
Test: Builds.
Change-Id: I46e8af202b41131cfc9bb280f04a214859c9b0de
2016-11-03 19:36:11 -07:00
Ruchi Kandoi
bcc90259d9
hal_memtrack: Add sepolicy for memtrack service. am: 0a924a6e1a am: bd85244dbc am: 3aca62504d
...
am: 3fafd14feb
2016-11-04 00:26:16 +00:00
Ruchi Kandoi
35e96a3c28
hal_power: Add sepolicy for power service. am: 3c30c4e2db am: 77a862665c am: 76fcb45d9c
...
am: 37a372f21c
2016-11-04 00:26:12 +00:00
Ruchi Kandoi
bd85244dbc
hal_memtrack: Add sepolicy for memtrack service.
...
am: 0a924a6e1a
2016-11-04 00:16:28 +00:00
Ruchi Kandoi
77a862665c
hal_power: Add sepolicy for power service.
...
am: 3c30c4e2db
2016-11-04 00:16:26 +00:00
Ruchi Kandoi
0a924a6e1a
hal_memtrack: Add sepolicy for memtrack service.
...
Bug: 31180823
Test: reduced sepolicy errors
Change-Id: Ibfba2efa903adec340e37abec2afb3b94a262678
Signed-off-by: Ruchi Kandoi <kandoiruchi@google.com>
2016-11-03 13:05:48 -07:00
Ruchi Kandoi
3c30c4e2db
hal_power: Add sepolicy for power service.
...
Bug: 31177288
Test: reduced sepolicy errors
Change-Id: I29556276ee14c341ac8f472875e6b69f903851ff
Signed-off-by: Ruchi Kandoi <kandoiruchi@google.com>
2016-11-03 13:01:48 -07:00
Steven Moreland
b8ae7eeb11
Sepolicy for light hal. am: 1ec710c8ff am: cdd1bd76fa am: 5c482cc9ca
...
am: dec31abceb
2016-11-01 23:47:48 +00:00
Steven Moreland
cdd1bd76fa
Sepolicy for light hal.
...
am: 1ec710c8ff
2016-11-01 23:40:27 +00:00
Dianne Hackborn
5717813e0d
Allow new settings system service. am: 11877133ba am: 33619e31de am: 29bebdb91c
...
am: f8bef9c80e
2016-11-01 21:37:55 +00:00
Steven Moreland
1ec710c8ff
Sepolicy for light hal.
...
Bug: 32022100
Test: end to end
Change-Id: I5dd9b64c98a5c549fdaf9e47d5a92fa6963370c7
2016-11-01 21:30:51 +00:00
Dianne Hackborn
33619e31de
Allow new settings system service.
...
am: 11877133ba
2016-11-01 21:30:34 +00:00
Felipe Leme
fa97fed498
Merge "Added permissions for the dumpstate service." am: ae9d3c0c31 am: 517a9ed1e3 am: 9446ec97a9
...
am: e00a0f0d23
2016-11-01 21:25:50 +00:00
Felipe Leme
517a9ed1e3
Merge "Added permissions for the dumpstate service."
...
am: ae9d3c0c31
2016-11-01 21:18:49 +00:00
Dianne Hackborn
11877133ba
Allow new settings system service.
...
Test: N/A
Change-Id: Ib3c85118bf752152f5ca75ec13371073fc2873cc
2016-11-01 21:16:56 +00:00
Treehugger Robot
ae9d3c0c31
Merge "Added permissions for the dumpstate service."
2016-11-01 21:13:31 +00:00
Jorge Lucangeli Obes
c7232fb387
Merge "init: Allow SETPCAP for dropping bounding set." am: 02c8383521 am: 52dd15a0c1 am: 5296552bc4
...
am: 368519e10e
2016-11-01 20:35:16 +00:00
Jorge Lucangeli Obes
52dd15a0c1
Merge "init: Allow SETPCAP for dropping bounding set."
...
am: 02c8383521
2016-11-01 20:28:16 +00:00
Treehugger Robot
02c8383521
Merge "init: Allow SETPCAP for dropping bounding set."
2016-11-01 20:23:14 +00:00
Jorge Lucangeli Obes
847bfa4ab2
init: Allow SETPCAP for dropping bounding set.
...
This is required for https://android-review.googlesource.com/#/c/295748
so that init can drop the capability bounding set for services.
Bug: 32438163
Test: With 295748 and a test service using ambient capabilities.
Change-Id: I57788517cfe2ef0e7a2f1dfab94d0cb967ede065
2016-11-01 14:32:13 -04:00
Felipe Leme
b5f5931e8c
Added permissions for the dumpstate service.
...
- Allow dumpstate to create the dumpservice service.
- Allow System Server and Shell to find that service.
- Don't allow anyone else to create that service.
- Don't allow anyone else to find that service.
BUG: 31636879
Test: manual verification
Change-Id: I642fe873560a2b123e6bafde645467d45a5f5711
2016-11-01 10:43:25 -07:00
Nick Kralevich
5093b92719
Merge "system_server: allow appendable file descriptors" am: 184851a212 am: a9aac6a9bf am: e3f33e9824
...
am: 2c758812e0
2016-10-31 16:15:05 +00:00
Nick Kralevich
69103378b1
Merge "Get rid of more auditallow spam" am: 82b9182ef3 am: fa418650d2 am: ce35d13319
...
am: 324efbce57
2016-10-31 16:14:53 +00:00
Nick Kralevich
a9aac6a9bf
Merge "system_server: allow appendable file descriptors"
...
am: 184851a212
2016-10-31 15:55:34 +00:00
Nick Kralevich
fa418650d2
Merge "Get rid of more auditallow spam"
...
am: 82b9182ef3
2016-10-31 15:55:22 +00:00
Treehugger Robot
184851a212
Merge "system_server: allow appendable file descriptors"
2016-10-31 15:45:38 +00:00
Treehugger Robot
82b9182ef3
Merge "Get rid of more auditallow spam"
2016-10-31 15:43:42 +00:00
Nick Kralevich
77f64cc4c2
kernel.te: tighten entrypoint / execute_no_trans neverallow am: 02cfce49ae am: 74b8425929 am: 02e44d0e7e
...
am: b6c9f6ddd8
2016-10-31 15:42:21 +00:00
Nick Kralevich
74b8425929
kernel.te: tighten entrypoint / execute_no_trans neverallow
...
am: 02cfce49ae
2016-10-31 15:22:50 +00:00
Nick Kralevich
02cfce49ae
kernel.te: tighten entrypoint / execute_no_trans neverallow
...
The kernel domain exists solely on boot, and is used by kernel threads.
Because of the way the system starts, there is never an entrypoint for
that domain, not even a file on rootfs. So tighten up the neverallow
restriction.
Remove an obsolete comment. The *.rc files no longer have a setcon
statement, and the transition from the kernel domain to init occurs
because init re-execs itself. The statement no longer applies.
Test: bullhead policy compiles.
Change-Id: Ibe75f3d25804453507dbb05c7a07bba1d37a1c7b
2016-10-30 18:46:44 -07:00
Nick Kralevich
8044129f42
system_server: allow appendable file descriptors
...
system_server is currently allowed write (but not open) access to
various app file descriptor types, to allow it to perform write
operations on file descriptors passed to it from Android processes.
However, system_server was not allowed to handle file descriptors
open only for append operations.
Write operations are a superset of that allowed by appendable
operations, so it makes no sense to deny system_server the use of
appendable file descriptors. Allow it for app data types, as well as a
few other types (for robustness).
Addresses the following denial generated when adb bugreport is run:
type=1400 audit(0.0:12): avc: denied { append } for
path="/data/user_de/0/com.android.shell/files/bugreports/bugreport-MASTER-2016-10-29-08-13-50-dumpstate_log-6214.txt"
dev="dm-2" ino=384984 scontext=u:r:system_server:s0
tcontext=u:object_r:shell_data_file:s0 tclass=file permissive=0
Bug: 32246161
Test: policy compiles
Test: No more append denials when running adb shell am bug-report --progress
Change-Id: Ia4e81cb0b3c3580fa9130952eedaed9cab3e8487
2016-10-29 08:20:56 -07:00
Nick Kralevich
2c8ea36ad8
Get rid of more auditallow spam
...
Addresses the following audit messages:
[ 7.984957] type=1400 audit(33873666.610:40): avc: granted { getattr
} for pid=1 comm="init" name="system@framework@boot-ext.art" dev="dm-2"
ino=106324 scontext=u:r:init:s0
tcontext=u:object_r:dalvikcache_data_file:s0 tclass=file
[ 65.528068] type=1400 audit(1477751916.508:96): avc: granted { search
} for pid=6330 comm="main" name="/" dev="cgroup" ino=12428
scontext=u:r:dumpstate:s0 tcontext=u:object_r:cgroup:s0 tclass=dir
[ 65.530425] type=1400 audit(1477751916.508:97): avc: granted { search
} for pid=6330 comm="main" name="/" dev="cgroup" ino=12428
scontext=u:r:dumpstate:s0 tcontext=u:object_r:cgroup:s0 tclass=dir
[ 65.530487] type=1400 audit(1477751916.508:98): avc: granted { open }
for pid=6330 comm="main" path="/dev/cpuctl/tasks" dev="cgroup" ino=12429
scontext=u:r:dumpstate:s0 tcontext=u:object_r:cgroup:s0 tclass=file
[ 65.530800] type=1400 audit(1477751916.508:98): avc: granted { open }
for pid=6330 comm="main" path="/dev/cpuctl/tasks" dev="cgroup" ino=12429
scontext=u:r:dumpstate:s0 tcontext=u:object_r:cgroup:s0 tclass=file
[ 65.530842] type=1400 audit(1477751916.508:99): avc: granted { search
} for pid=6330 comm="main" name="/" dev="cgroup" ino=12428
scontext=u:r:dumpstate:s0 tcontext=u:object_r:cgroup:s0 tclass=dir
[ 65.531138] type=1400 audit(1477751916.508:99): avc: granted { search
} for pid=6330 comm="main" name="/" dev="cgroup" ino=12428
scontext=u:r:dumpstate:s0 tcontext=u:object_r:cgroup:s0 tclass=dir
[ 65.531176] type=1400 audit(1477751916.508:100): avc: granted {
search } for pid=6330 comm="main" name="bg_non_interactive" dev="cgroup"
ino=12444 scontext=u:r:dumpstate:s0 tcontext=u:object_r:cgroup:s0
tclass=dir
[ 65.531465] type=1400 audit(1477751916.508:100): avc: granted {
search } for pid=6330 comm="main" name="bg_non_interactive" dev="cgroup"
ino=12444 scontext=u:r:dumpstate:s0 tcontext=u:object_r:cgroup:s0
tclass=dir
[ 65.531502] type=1400 audit(1477751916.508:101): avc: granted { open
} for pid=6330 comm="main" path="/dev/cpuctl/bg_non_interactive/tasks"
dev="cgroup" ino=12445 scontext=u:r:dumpstate:s0
tcontext=u:object_r:cgroup:s0 tclass=file
[ 65.531789] type=1400 audit(1477751916.508:101): avc: granted { open
} for pid=6330 comm="main" path="/dev/cpuctl/bg_non_interactive/tasks"
dev="cgroup" ino=12445 scontext=u:r:dumpstate:s0
tcontext=u:object_r:cgroup:s0 tclass=file
[ 65.531827] type=1400 audit(1477751916.508:102): avc: granted {
search } for pid=6330 comm="main" name="/" dev="cgroup" ino=12459
scontext=u:r:dumpstate:s0 tcontext=u:object_r:cgroup:s0 tclass=dir
[ 65.713056] type=1400 audit(1477751916.508:102): avc: granted {
search } for pid=6330 comm="main" name="/" dev="cgroup" ino=12459
scontext=u:r:dumpstate:s0 tcontext=u:object_r:cgroup:s0 tclass=dir
Bug: 32246161
Test: policy compiles
Test: dumpstate no longer generates the audit messages above.
Change-Id: Id5afe2ebeb24f8a7407aac1a0a09806b1521b0e4
2016-10-29 08:15:08 -07:00
Roshan Pius
8b6e9561f8
wifi_hal: Rename to 'hal_wifi' am: 8224596a32 am: e1d1b3dc07 am: 4522d48285
...
am: fc9d7cdf10
2016-10-28 23:59:20 +00:00
Roshan Pius
abed124f05
wpa: Add permissions for hwbinder am: 6caeac7b47 am: 35ac63bab2 am: 97ad8ac9c2
...
am: fb4b4f9c82
2016-10-28 23:59:16 +00:00
Roshan Pius
e1d1b3dc07
wifi_hal: Rename to 'hal_wifi'
...
am: 8224596a32
2016-10-28 23:43:17 +00:00
Roshan Pius
35ac63bab2
wpa: Add permissions for hwbinder
...
am: 6caeac7b47
2016-10-28 23:43:15 +00:00
Treehugger Robot
ece327292c
Merge changes I5bbbcad3,Ifa4630ed
...
* changes:
wifi_hal: Rename to 'hal_wifi'
wpa: Add permissions for hwbinder
2016-10-28 23:36:21 +00:00
Nick Kralevich
2db17a4064
Get rid of auditallow spam. am: 79a08e13bd am: 6f2f72c2b1 am: 4a5db591dc
...
am: 3509802774
2016-10-28 21:06:09 +00:00
Nick Kralevich
6f2f72c2b1
Get rid of auditallow spam.
...
am: 79a08e13bd
2016-10-28 20:50:31 +00:00
Nick Kralevich
79a08e13bd
Get rid of auditallow spam.
...
Fixes the following SELinux messages when running adb bugreport:
avc: granted { read } for name="libart.so" dev="dm-0" ino=1886
scontext=u:r:dumpstate:s0 tcontext=u:object_r:libart_file:s0 tclass=file
avc: granted { read open } for path="/system/lib64/libart.so" dev="dm-0"
ino=1886 scontext=u:r:dumpstate:s0 tcontext=u:object_r:libart_file:s0
tclass=file
avc: granted { getattr } for path="/system/lib64/libart.so" dev="dm-0"
ino=1886 scontext=u:r:dumpstate:s0 tcontext=u:object_r:libart_file:s0
tclass=file
avc: granted { read } for path="/system/lib64/libart.so" dev="dm-0"
ino=1886 scontext=u:r:dumpstate:s0 tcontext=u:object_r:libart_file:s0
tclass=file
avc: granted { read } for path="/system/lib64/libart.so" dev="dm-0"
ino=1886 scontext=u:r:dumpstate:s0 tcontext=u:object_r:libart_file:s0
tclass=file
avc: granted { read } for path="/system/lib64/libart.so" dev="dm-0"
ino=1886 scontext=u:r:dumpstate:s0 tcontext=u:object_r:libart_file:s0
tclass=file
avc: granted { read } for path="/system/lib64/libart.so" dev="dm-0"
ino=1886 scontext=u:r:dumpstate:s0 tcontext=u:object_r:libart_file:s0
tclass=file
avc: granted { read execute } for path="/system/lib64/libart.so"
dev="dm-0" ino=1886 scontext=u:r:dumpstate:s0
tcontext=u:object_r:libart_file:s0 tclass=file
avc: granted { read } for path="/system/lib64/libart.so" dev="dm-0"
ino=1886 scontext=u:r:dumpstate:s0 tcontext=u:object_r:libart_file:s0
tclass=file
avc: granted { read } for path="/system/lib64/libart.so" dev="dm-0"
ino=1886 scontext=u:r:dumpstate:s0 tcontext=u:object_r:libart_file:s0
tclass=file
avc: granted { search } for name="dalvik-cache" dev="dm-2" ino=106289
scontext=u:r:dumpstate:s0 tcontext=u:object_r:dalvikcache_data_file:s0
tclass=dir
avc: granted { getattr } for path="/data/dalvik-cache/arm64" dev="dm-2"
ino=106290 scontext=u:r:dumpstate:s0
tcontext=u:object_r:dalvikcache_data_file:s0 tclass=dir
avc: granted { search } for name="dalvik-cache" dev="dm-2" ino=106289
scontext=u:r:dumpstate:s0 tcontext=u:object_r:dalvikcache_data_file:s0
tclass=dir
avc: granted { search } for name="arm64" dev="dm-2" ino=106290
scontext=u:r:dumpstate:s0 tcontext=u:object_r:dalvikcache_data_file:s0
tclass=dir
avc: granted { getattr } for
path="/data/dalvik-cache/arm64/system@framework@boot.art" dev="dm-2"
ino=106318 scontext=u:r:dumpstate:s0
tcontext=u:object_r:dalvikcache_data_file:s0 tclass=file
avc: granted { search } for name="dalvik-cache" dev="dm-2" ino=106289
scontext=u:r:dumpstate:s0 tcontext=u:object_r:dalvikcache_data_file:s0
tclass=dir
avc: granted { search } for name="arm64" dev="dm-2" ino=106290
scontext=u:r:dumpstate:s0 tcontext=u:object_r:dalvikcache_data_file:s0
tclass=dir
avc: granted { read } for name="system@framework@boot.art" dev="dm-2"
ino=106318 scontext=u:r:dumpstate:s0
tcontext=u:object_r:dalvikcache_data_file:s0 tclass=file
avc: granted { read open } for
path="/data/dalvik-cache/arm64/system@framework@boot.art" dev="dm-2"
ino=106318 scontext=u:r:dumpstate:s0
tcontext=u:object_r:dalvikcache_data_file:s0 tclass=file
avc: granted { search } for name="dalvik-cache" dev="dm-2" ino=106289
scontext=u:r:dumpstate:s0 tcontext=u:object_r:dalvikcache_data_file:s0
tclass=dir
[ 169.349480] type=1400 audit(1477679159.734:129): avc: granted { read
} for pid=6413 comm="main" name="ipv6_route" dev="proc" ino=4026535947
scontext=u:r:dumpstate:s0 tcontext=u:object_r:proc_net:s0 tclass=file
[ 169.350030] type=1400 audit(1477679159.734:130): avc: granted { read
open } for pid=6413 comm="main" path="/proc/6413/net/ipv6_route"
dev="proc" ino=4026535947 scontext=u:r:dumpstate:s0
tcontext=u:object_r:proc_net:s0 tclass=file
[ 169.350361] type=1400 audit(1477679159.734:130): avc: granted { read
open } for pid=6413 comm="main" path="/proc/6413/net/ipv6_route"
dev="proc" ino=4026535947 scontext=u:r:dumpstate:s0
tcontext=u:object_r:proc_net:s0 tclass=file
[ 169.350399] type=1400 audit(1477679159.734:131): avc: granted {
getattr } for pid=6413 comm="main" path="/proc/6413/net/ipv6_route"
dev="proc" ino=4026535947 scontext=u:r:dumpstate:s0
tcontext=u:object_r:proc_net:s0 tclass=file
[ 169.350963] type=1400 audit(1477679159.734:131): avc: granted {
getattr } for pid=6413 comm="main" path="/proc/6413/net/ipv6_route"
dev="proc" ino=4026535947 scontext=u:r:dumpstate:s0
tcontext=u:object_r:proc_net:s0 tclass=file
[ 169.351002] type=1400 audit(1477679159.734:132): avc: granted { read
} for pid=6413 comm="main" name="if_inet6" dev="proc" ino=4026535946
scontext=u:r:dumpstate:s0 tcontext=u:object_r:proc_net:s0 tclass=file
[ 169.351330] type=1400 audit(1477679159.734:132): avc: granted { read
} for pid=6413 comm="main" name="if_inet6" dev="proc" ino=4026535946
scontext=u:r:dumpstate:s0 tcontext=u:object_r:proc_net:s0 tclass=file
[ 169.351366] type=1400 audit(1477679159.734:133): avc: granted { read
open } for pid=6413 comm="main" path="/proc/6413/net/if_inet6"
dev="proc" ino=4026535946 scontext=u:r:dumpstate:s0
tcontext=u:object_r:proc_net:s0 tclass=file
[ 169.351861] type=1400 audit(1477679159.734:133): avc: granted { read
open } for pid=6413 comm="main" path="/proc/6413/net/if_inet6"
dev="proc" ino=4026535946 scontext=u:r:dumpstate:s0
tcontext=u:object_r:proc_net:s0 tclass=file
[ 169.351910] type=1400 audit(1477679159.734:134): avc: granted {
getattr } for pid=6413 comm="main" path="/proc/6413/net/if_inet6"
dev="proc" ino=4026535946 scontext=u:r:dumpstate:s0
tcontext=u:object_r:proc_net:s0 tclass=file
[ 169.353105] type=1400 audit(1477679159.734:134): avc: granted {
getattr } for pid=6413 comm="main" path="/proc/6413/net/if_inet6"
dev="proc" ino=4026535946 scontext=u:r:dumpstate:s0
tcontext=u:object_r:proc_net:s0 tclass=file
[ 169.353186] type=1400 audit(1477679159.734:135): avc: granted { read
} for pid=6413 comm="main" name="if_inet6" dev="proc" ino=4026535946
scontext=u:r:dumpstate:s0 tcontext=u:object_r:proc_net:s0 tclass=file
[ 169.353594] type=1400 audit(1477679159.734:135): avc: granted { read
} for pid=6413 comm="main" name="if_inet6" dev="proc" ino=4026535946
scontext=u:r:dumpstate:s0 tcontext=u:object_r:proc_net:s0 tclass=file
[ 169.353636] type=1400 audit(1477679159.734:136): avc: granted { read
open } for pid=6413 comm="main" path="/proc/6413/net/if_inet6"
dev="proc" ino=4026535946 scontext=u:r:dumpstate:s0
tcontext=u:object_r:proc_net:s0 tclass=file
[ 169.354230] type=1400 audit(1477679159.734:136): avc: granted { read
open } for pid=6413 comm="main" path="/proc/6413/net/if_inet6"
dev="proc" ino=4026535946 scontext=u:r:dumpstate:s0
tcontext=u:object_r:proc_net:s0 tclass=file
[ 169.354437] type=1400 audit(1477679159.734:137): avc: granted {
getattr } for pid=6413 comm="main" path="/proc/6413/net/if_inet6"
dev="proc" ino=4026535946 scontext=u:r:dumpstate:s0
tcontext=u:object_r:proc_net:s0 tclass=file
[ 169.395359] type=1400 audit(1477679159.734:137): avc: granted {
getattr } for pid=6413 comm="main" path="/proc/6413/net/if_inet6"
dev="proc" ino=4026535946 scontext=u:r:dumpstate:s0
tcontext=u:object_r:proc_net:s0 tclass=file
Test: policy compiles
Test: adb bugreport runs without auditallow messages above.
Bug: 32246161
Change-Id: Ie0ab2ed3c6babc1f93d3b8ae47c92dd905ebc93a
2016-10-28 11:46:00 -07:00
Roshan Pius
8224596a32
wifi_hal: Rename to 'hal_wifi'
...
Renaming the wifi HIDL implementation to 'hal_wifi' from 'wifi_hal_legacy'
to conform with HIDL style guide.
Denials:
01-01 21:55:23.896 2865 2865 I android.hardware.wifi@1.0-service:
wifi_hal_legacy is starting up...
01-01 21:55:23.898 2865 2865 W android.hardware.wifi@1.0-service:
/odm/lib64/hw/ does not exit.
01-01 21:55:23.899 2865 2865 F android.hardware.wifi@1.0-service:
service.cpp:59] Check failed: service->registerAsService("wifi") ==
android::NO_ERROR (service->registerAsService("wifi")=-2147483646,
android::NO_ERROR=0) Failed to register wifi HAL
01-01 21:55:23.899 2865 2865 F libc : Fatal signal 6 (SIGABRT),
code -6 in tid 2865 (android.hardwar)
01-01 21:55:23.901 377 377 W : debuggerd: handling request:
pid=2865 uid=2000 gid=2000 tid=2865
01-01 21:55:23.907 2867 2867 E : debuggerd: Unable to connect
to activity manager (connect failed: Connection refused)
01-01 21:55:23.908 2867 2867 F DEBUG : *** *** *** *** *** *** ***
*** *** *** *** *** *** *** *** ***
01-01 21:55:23.908 2867 2867 F DEBUG : Build fingerprint:
'Android/aosp_angler/angler:7.0/NYC/rpius10031052:userdebug/test-keys'
01-01 21:55:23.908 2867 2867 F DEBUG : Revision: '0'
01-01 21:55:23.908 2867 2867 F DEBUG : ABI: 'arm64'
01-01 21:55:23.908 2867 2867 F DEBUG : pid: 2865, tid: 2865, name:
android.hardwar >>> /system/bin/hw/android.hardware.wifi@1.0-service
<<<
01-01 21:55:23.909 2867 2867 F DEBUG : signal 6 (SIGABRT), code -6
(SI_TKILL), fault addr --------
01-01 21:55:23.910 2867 2867 F DEBUG : Abort message:
'service.cpp:59] Check failed: service->registerAsService("wifi") ==
android::NO_ERROR (service->registerAsService("wifi")=-2147483646,
android::NO_ERROR=0) Failed to register wifi HAL'
Bug: 31821133
Test: Compiled and ensured that the selinux denials are no longer
present in logs.
Change-Id: I5bbbcad307e9bb9e59fff87e2926751b3aecc813
2016-10-28 09:00:31 -07:00
William Roberts
05ce9f96a6
Merge "domain: neverallow on setfcap" am: e112faeaa8 am: 14742b0f92 am: eecdbb830a
...
am: 4603f469d7
2016-10-28 00:15:53 +00:00
William Roberts
14742b0f92
Merge "domain: neverallow on setfcap"
...
am: e112faeaa8
2016-10-28 00:03:22 +00:00
Treehugger Robot
e112faeaa8
Merge "domain: neverallow on setfcap"
2016-10-27 23:45:58 +00:00
William Roberts
c3f1da99b2
domain: neverallow on setfcap
...
Filesystem capabilities should only be set by the build tools
or by recovery during an update. Place a neverallow ensuring
this property.
Change-Id: I136c5cc16dff0c0faa3799d0ab5e29b43454a610
Signed-off-by: William Roberts <william.c.roberts@intel.com>
2016-10-27 12:45:47 -07:00
Roshan Pius
6caeac7b47
wpa: Add permissions for hwbinder
...
Modify permissions for wpa_supplicant to use hwbinder (for HIDL),
instead of binder.
Denials:
01-15 14:31:58.573 541 541 W wpa_supplicant: type=1400
audit(0.0:10): avc: denied { call } for scontext=u:r:wpa:s0
tcontext=u:r:hwservicemanager:s0 tclass=binder permissive=0
01-15 14:31:58.573 541 541 W wpa_supplicant: type=1400
audit(0.0:11): avc: denied { call } for scontext=u:r:wpa:s0
tcontext=u:r:hwservicemanager:s0 tclass=binder permissive=0
BUG: 31365276
Test: Compiled and ensured that the selinux denials are no longer
present in logs.
Change-Id: Ifa4630edea6ec5a916b3940f9a03ef9dc6fc9af2
2016-10-26 14:52:12 -07:00
Jeff Vander Stoep
addccaf9d4
Merge "Rename macros for (non)binderized HALs" am: 70591fedf5 am: 3ad4428c73 am: 04f9ac372f
...
am: e0812afccd
2016-10-26 19:19:30 +00:00
Jeff Vander Stoep
3ad4428c73
Merge "Rename macros for (non)binderized HALs"
...
am: 70591fedf5
2016-10-26 19:06:41 +00:00
Treehugger Robot
70591fedf5
Merge "Rename macros for (non)binderized HALs"
2016-10-26 18:48:30 +00:00
Jeff Vander Stoep
472936e031
clean up hal types am: 27ae545a78 am: 95bd7984b5 am: 8937ed099f
...
am: ad49687b7f
2016-10-26 18:44:48 +00:00
Jeff Vander Stoep
95bd7984b5
clean up hal types
...
am: 27ae545a78
2016-10-26 18:32:44 +00:00
Jeff Vander Stoep
f579ef15a8
Rename macros for (non)binderized HALs
...
Test: builds
Bug: 32243668
Change-Id: I1ad4b53003462e932cf80b6972db1520dc66d735
2016-10-26 10:04:18 -07:00
Jeff Vander Stoep
27ae545a78
clean up hal types
...
Bug: 32123421
Test: build Hikey
Change-Id: Iaf02626f3f3a94104c0f9d746c3cf5f20751a27d
2016-10-26 09:50:04 -07:00
Connor O'Brien
3b54a6b35c
sepolicy for boot_control HAL service am: 2370fc775c am: 6771f2885f am: b7bcaecd84
...
am: a2c00abc21
2016-10-25 22:43:10 +00:00
Connor O'Brien
6771f2885f
sepolicy for boot_control HAL service
...
am: 2370fc775c
2016-10-25 22:31:02 +00:00
Connor O'Brien
2370fc775c
sepolicy for boot_control HAL service
...
Bug: 31864052
Test: Logging confirms service runs on boot
Merged-In: I41e9e5c45d2d42886cdf7ff6d364e9e6e3df1ff4
Change-Id: I41e9e5c45d2d42886cdf7ff6d364e9e6e3df1ff4
Signed-off-by: Connor O'Brien <connoro@google.com>
2016-10-25 13:33:48 -07:00
Jeff Vander Stoep
a8dc9cf324
Merge "Add macros for treble and non-treble only policy" am: 367d90b6a4 am: fb2be31617 am: e0b7c140fc
...
am: 4fe5038184
2016-10-25 20:23:29 +00:00
Jeff Vander Stoep
fb2be31617
Merge "Add macros for treble and non-treble only policy"
...
am: 367d90b6a4
2016-10-25 20:10:24 +00:00
Treehugger Robot
367d90b6a4
Merge "Add macros for treble and non-treble only policy"
2016-10-25 20:06:02 +00:00
Jeff Vander Stoep
53f7996427
Merge "isolated_app: no sdcard access" am: 626edc7555 am: 5855b4884c
...
am: e88718d6e1
2016-10-21 21:02:15 +00:00
Jeff Vander Stoep
5855b4884c
Merge "isolated_app: no sdcard access"
...
am: 626edc7555
2016-10-21 20:45:29 +00:00
Treehugger Robot
626edc7555
Merge "isolated_app: no sdcard access"
2016-10-21 20:29:01 +00:00
Mikhail Naganov
e53f9f24f4
Update SELinux policy for audiohal am: 2ff6b4da73 am: 9f90cadc1d
...
am: b8f75b39ae
2016-10-21 19:25:25 +00:00
Mikhail Naganov
9f90cadc1d
Update SELinux policy for audiohal
...
am: 2ff6b4da73
2016-10-21 19:08:08 +00:00
Mikhail Naganov
2ff6b4da73
Update SELinux policy for audiohal
...
Change-Id: Iaa9907ed516c947175a59bf49938c0ee03b4f6d1
2016-10-21 09:53:15 -07:00
Felipe Leme
d8dc4b8042
Merge "Creates an autofill system service." am: f5312f8e81 am: ce4c82a8c2
...
am: 908aeba743
2016-10-21 16:36:32 +00:00
Felipe Leme
ce4c82a8c2
Merge "Creates an autofill system service."
...
am: f5312f8e81
2016-10-21 16:19:26 +00:00
Jeff Vander Stoep
ce4b5eeaee
isolated_app: no sdcard access
...
Remove and neverallow isolated_app access to external storage and
USB accessories.
Test: aosp_angler-userdebug builds
Bug: 21643067
Change-Id: Ie912706a954a38610f2afd742b1ab4b8cd4b1f36
2016-10-21 09:15:48 -07:00
Treehugger Robot
f5312f8e81
Merge "Creates an autofill system service."
2016-10-21 16:09:31 +00:00
Craig Donner
3c6c4d2df2
sepolicy: Add policy for VR HIDL service. am: 7ba0485665 am: 8bae22ecea
...
am: ac775e3d0a
2016-10-21 03:02:59 +00:00
Craig Donner
8bae22ecea
sepolicy: Add policy for VR HIDL service.
...
am: 7ba0485665
2016-10-21 02:47:31 +00:00
Felipe Leme
8221d59711
Creates an autofill system service.
...
BUG: 31001899
Test: manual
Change-Id: I8d462b40d931310eab26bafa09645ac88f13fc97
2016-10-20 17:33:27 -07:00
Craig Donner
7ba0485665
sepolicy: Add policy for VR HIDL service.
...
Test: built and ran on device.
Bug: 31442830
Change-Id: Idd7870b4dd70eed8cd4dc55e292be39ff703edd2
2016-10-20 17:03:54 -07:00
Prashant Malani
8d9f4a62c4
Merge "Cleanup and renaming of vibrator HAL sepolicy" am: fe360ad6bd am: 566ffd0252
...
am: 120cfb275e
2016-10-20 22:15:14 +00:00
Prashant Malani
566ffd0252
Merge "Cleanup and renaming of vibrator HAL sepolicy"
...
am: fe360ad6bd
2016-10-20 21:53:31 +00:00
Treehugger Robot
fe360ad6bd
Merge "Cleanup and renaming of vibrator HAL sepolicy"
2016-10-20 21:42:19 +00:00
Jeff Vander Stoep
288483de90
Merge "racoon: remove domain_deprecated attribute" am: 41c727bce8 am: 9ec8d943c1
...
am: f13610c69a
2016-10-20 02:53:13 +00:00
Jeff Vander Stoep
9ec8d943c1
Merge "racoon: remove domain_deprecated attribute"
...
am: 41c727bce8
2016-10-20 02:34:04 +00:00
Treehugger Robot
41c727bce8
Merge "racoon: remove domain_deprecated attribute"
2016-10-20 02:27:39 +00:00
Jeff Vander Stoep
1b1745672b
Merge "racoon: allow setting options on tun interface" am: 76b467aedb am: 4692d61295
...
am: bed45e739c
2016-10-20 00:50:07 +00:00
Jeff Vander Stoep
4692d61295
Merge "racoon: allow setting options on tun interface"
...
am: 76b467aedb
2016-10-20 00:33:20 +00:00
Treehugger Robot
76b467aedb
Merge "racoon: allow setting options on tun interface"
2016-10-20 00:22:52 +00:00
Jeff Vander Stoep
d733d161cf
Add macros for treble and non-treble only policy
...
Test: builds
Change-Id: Idd1d90a89a9ecbb2738d6b483af0e8479e87aa15
2016-10-19 15:05:05 -07:00
Prashant Malani
2d9d3e6de3
Cleanup and renaming of vibrator HAL sepolicy
...
Renaming vibrator sepolicy to remove the version number.
Also moving the related binder_call() to maintain alphabetical order.
Bug: 32123421
Change-Id: I2bfa835085519ed10f61ddf74e7e668dd12bda04
Test: booted, and checked vibrate on keypress on bullhead
2016-10-19 09:54:20 -07:00
Prashant Malani
c026f5ef0f
Add sysfs rule for vibrator in system_server am: c86eb96f45 am: bd1d36de60
...
am: 5d1524c867
2016-10-18 22:05:38 +00:00
Prashant Malani
bd1d36de60
Add sysfs rule for vibrator in system_server
...
am: c86eb96f45
2016-10-18 21:51:20 +00:00
Prashant Malani
c86eb96f45
Add sysfs rule for vibrator in system_server
...
Helps fix vibrator HAL open issue
avc: denied { write } for pid=907 comm="system_server" name="enable" dev="sysfs" ino=20423 scontext=u:r:system_server:s0 tcontext=u:object_r:sysfs_vibrator:s0 tclass=file permissive=0
Bug: 32209928
Bug: 32225232
Test: m, booted, tested keypad to make sure vibrator works
Change-Id: I4977c42b7fac0c9503be04b6520487f2d6cbc903
2016-10-18 12:59:20 -07:00
Jeff Vander Stoep
d7a64e4e8b
racoon: remove domain_deprecated attribute
...
Test: builds/boots on Angler. No "granted" messages for the removed
permissions observed in three months of log audits.
Bug: 28760354
Change-Id: Ib6da57f6249a5571015b649bae843590229be714
2016-10-15 17:15:25 -07:00
Jeff Vander Stoep
d063d23032
racoon: allow setting options on tun interface
...
Fixes failure in VPN connection
avc: denied { ioctl } for pid=2870 comm="ip-up-vpn" ioctlcmd=8914
scontext=u:r:racoon:s0 tcontext=u:r:racoon:s0 tclass=udp_socket
avc: denied { ioctl } for pid=2870 comm="ip-up-vpn" ioctlcmd=8916
scontext=u:r:racoon:s0 tcontext=u:r:racoon:s0 tclass=udp_socket
Test: VPN works
Bug: 32011648
Change-Id: I28c4dc7ffbf7e35ef582176674c4e9764719a2a9
2016-10-15 14:09:45 -07:00
Daniel Micay
d84440d914
remove unnecessary dalvik rules from recovery am: 510771ff92 am: 1573f55bdd
...
am: a85cca8fd7
2016-10-15 00:05:22 +00:00
Daniel Micay
1573f55bdd
remove unnecessary dalvik rules from recovery
...
am: 510771ff92
2016-10-14 23:53:48 +00:00
Daniel Micay
510771ff92
remove unnecessary dalvik rules from recovery
...
Change-Id: Ic0dd1162e268ce54e11de08b18dd7df47ab12147
2016-10-14 02:27:31 -04:00
Prashant Malani
55cf83525c
sepolicy: Add policy for vibrator HIDL service am: b32b4a112f am: d55ef92371 am: 5b87c66933
...
am: d7cbaf298e
2016-10-13 21:03:34 +00:00
Prashant Malani
d7cbaf298e
sepolicy: Add policy for vibrator HIDL service am: b32b4a112f am: d55ef92371
...
am: 5b87c66933
2016-10-13 21:01:40 +00:00
Prashant Malani
5b87c66933
sepolicy: Add policy for vibrator HIDL service am: b32b4a112f
...
am: d55ef92371
2016-10-13 20:54:33 +00:00
Prashant Malani
b32b4a112f
sepolicy: Add policy for vibrator HIDL service
...
Fixes the following denials:
avc: denied { open } for pid=7530 comm="android.hardwar" path="/sys/devices/virtual/timed_output/vibrator/enable" dev="sysfs" ino=20519 scontext=u:r:android_hardware_vibrator_1_0_service:s0 tcontext=u:object_r:sysfs:s0 tclass=file permissive=1
avc: denied { call } for pid=9173 comm="Binder:7735_C" scontext=u:r:system_server:s0 tcontext=u:r:android_hardware_vibrator_1_0_service:s0 tclass=binder permissive=1
Test: m
Bug: 32021191
Change-Id: I243a86b449794e3c2f0abf91ddcf405eff548d0c
2016-10-13 11:41:30 -07:00
Chad Brubaker
d6f929ca88
Rename autoplay_app to ephemeral_app am: 06cf31eb63 am: 90b552d941 am: 83ad69b11c
...
am: c5ef0152ed
2016-10-07 19:54:34 +00:00
Chad Brubaker
c5ef0152ed
Rename autoplay_app to ephemeral_app am: 06cf31eb63 am: 90b552d941
...
am: 83ad69b11c
2016-10-07 19:46:10 +00:00
Chad Brubaker
83ad69b11c
Rename autoplay_app to ephemeral_app am: 06cf31eb63
...
am: 90b552d941
2016-10-07 19:41:10 +00:00
Prashant Malani
c541bb6814
system_server: Allow hwservicemanager to make binder calls am: abb5c72b8b am: f8ac3b7cab am: 15d439b8c2
...
am: 95b0515b4b
2016-10-07 16:57:55 +00:00
Chad Brubaker
06cf31eb63
Rename autoplay_app to ephemeral_app
...
Test: Builds and boots
Change-Id: I3db64e12f0390c6940f5745eae83ce7efa7d65a9
2016-10-07 09:52:31 -07:00
Prashant Malani
95b0515b4b
system_server: Allow hwservicemanager to make binder calls am: abb5c72b8b am: f8ac3b7cab
...
am: 15d439b8c2
2016-10-07 05:06:17 +00:00
Prashant Malani
15d439b8c2
system_server: Allow hwservicemanager to make binder calls am: abb5c72b8b
...
am: f8ac3b7cab
2016-10-07 05:02:47 +00:00
Prashant Malani
abb5c72b8b
system_server: Allow hwservicemanager to make binder calls
...
Fixes the following denial:
avc: denied { call } for pid=791 comm="system_server" scontext=u:r:system_server:s0 tcontext=u:r:hwservicemanager:s0 tclass=binder permissive=1
Test: Builds, boots, vibrator works on bullhead
Change-Id: I56a0a86b64f5d46dc490f6f3255009c40e6e3f8f
2016-10-06 14:41:49 -07:00
dcashman
7cfa40594c
Split general policy into public and private components. am: cc39f63773 am: 1d233a6328 am: e8647916b8
...
am: 360da5bc47
2016-10-06 20:30:01 +00:00
dcashman
360da5bc47
Split general policy into public and private components. am: cc39f63773 am: 1d233a6328
...
am: e8647916b8
2016-10-06 20:23:15 +00:00
dcashman
e8647916b8
Split general policy into public and private components. am: cc39f63773
...
am: 1d233a6328
2016-10-06 20:20:15 +00:00
dcashman
cc39f63773
Split general policy into public and private components.
...
Divide policy into public and private components. This is the first
step in splitting the policy creation for platform and non-platform
policies. The policy in the public directory will be exported for use
in non-platform policy creation. Backwards compatibility with it will
be achieved by converting the exported policy into attribute-based
policy when included as part of the non-platform policy and a mapping
file will be maintained to be included with the platform policy that
maps exported attributes of previous versions to the current platform
version.
Eventually we would like to create a clear interface between the
platform and non-platform device components so that the exported policy,
and the need for attributes is minimal. For now, almost all types and
avrules are left in public.
Test: Tested by building policy and running on device.
Change-Id: Idef796c9ec169259787c3f9d8f423edf4ce27f8c
2016-10-06 13:09:06 -07:00
