Commit graph

33013 commits

Author SHA1 Message Date
Yi-Yo Chiang
43352fab2d Merge "Dist userdebug_plat_sepolicy.cil to facilitate VTS testing" 2021-10-18 06:32:36 +00:00
Maurice Lam
1517644d4d SELinux rules for virtual device
Bug: 194949534
Test: Manual
Change-Id: I5fcc83e313ce464e4a855b24d32fc2d82ee0b07e
2021-10-15 18:16:01 -07:00
Tianjie Xu
9cd93e48da Merge "Add context for checkin directory" 2021-10-15 21:19:26 +00:00
Yi-Yo Chiang
68478b1f1a Dist userdebug_plat_sepolicy.cil to facilitate VTS testing
repack_bootimg can use the userdebug_plat_sepolicy.cil artifact to
prepare a debuggable boot image for VTS testing.

(TODO in follow-up) The eliminates the need for GSI
boot-with-debug-ramdisk-*.img, and we can skip building them to
conserve build resources.

Bug: 202129499
Test: m out/target/product/generic_arm64/userdebug_plat_sepolicy.cil
Test: Check presubmit artifacts include userdebug_plat_sepolicy.cil
Change-Id: I7629e462d4febd05ebe8a89a7bc00e8724dcb4a4
2021-10-16 03:23:05 +08:00
Arthur Ishiguro
29dc02c044 Sensors stable AIDL HAL sepolicy
Bug: 195593357
Test: TreeHugger
Change-Id: I02b88a93d829654a1ce946681b59e648b2cd7550
2021-10-15 17:39:56 +00:00
Treehugger Robot
c080cea0a6 Merge "Microdroid: Allow apexd again to access block device information" 2021-10-15 14:37:55 +00:00
Zimuzo Ezeozue
dcb9369554 Merge "Allow MediaProvider to access the media metrics service" 2021-10-15 13:32:12 +00:00
Zim
26d73ceb6e Allow MediaProvider to access the media metrics service
This allows MediaProvider call certain MediaCodec APIs

Test: atest TranscodeTest
Bug: 190422448
Change-Id: Ied609152e6a9ba6d17b70db325ca33f1cb345eb8
2021-10-15 08:39:30 +00:00
Tianjie
b729aa6c5e Add context for checkin directory
Checkin apps use /data/misc_ce/<id>/checkin to backup the checkin
metadata. So users won't lose the checkin tokens when they clear
the app's storage.

One example is when GMScore is used for checkin, users may clear
GMScore data via "settings". If the device accidentally loses the
token without backup, it won't be able to checkin again until
factory reset.

The contents in checkin dir will be cleaned up when a user is removed
from the device. We also plan to add Gmscore test to ensure the dir
is cleaned up at checkin time, thus prevent other Gmscore modules
from using this storage by mistake.

Bug: 197636740
Test: boot device, check selinux label, check gmscore writes to the new dir
Change-Id: If3ff5e0fb75b4d49ce80d91b0086b58db002e4fb
2021-10-14 16:21:10 -07:00
Bart Van Assche
e475c8f1b5 Microdroid: Allow apexd again to access block device information
This patch is the Microdroid equivalent of
https://android-review.googlesource.com/c/platform/system/sepolicy/+/1850655

Bug: 202520796
Tests: Treehugger
Change-Id: I3428934115a62f64390738b144fbb801fc595561
Signed-off-by: Bart Van Assche <bvanassche@google.com>
2021-10-14 15:38:28 -07:00
Treehugger Robot
7609e175c5 Merge "Stop using the bdev_type and sysfs_block_type SELinux attributes" 2021-10-14 17:58:57 +00:00
Bart Van Assche
398b0af20f Stop using the bdev_type and sysfs_block_type SELinux attributes
Stop using these attributes since these will be removed soon.

Bug: 202520796
Test: (AOSP) source build/envsetup.sh && lunch aosp_x86_64 && m && launch_cvd && adb -e shell dmesg | grep avc
Test: (sc-v2-dev) source build/envsetup.sh && lunch ...-userdebug && m && install-images-on-phone && adb root && adb dmesg | grep 'avc.*comm=.init'
Change-Id: I9f5a4c5c4d6c44fefa8e66c69fec62c99f9a728d
Signed-off-by: Bart Van Assche <bvanassche@google.com>
2021-10-14 09:13:58 -07:00
Treehugger Robot
b732951030 Merge "Add ComposHostTestCases to system/sepolicy/TEST_MAPPING" 2021-10-14 01:03:18 +00:00
Dave McCloskey
74fd233c29 Merge "SEPolicy changes to support Attestation Verification Service" 2021-10-14 00:12:50 +00:00
Victor Hsieh
5844adf113 Add ComposHostTestCases to system/sepolicy/TEST_MAPPING
Bug: 195752513
Test: TH
Change-Id: I0e61e8cc46c248847a529ddc32f2636e97422b23
2021-10-13 16:42:27 -07:00
Steven Moreland
0c1991eee4 Merge "authfs - remove getattr perm for fd pass" 2021-10-13 17:30:11 +00:00
Bart Van Assche
41b61b7772 Merge "Revert "Stop granting init access to block device properties"" 2021-10-13 17:11:01 +00:00
Bart Van Assche
60b7d9a36e Revert "Stop granting init access to block device properties"
This reverts commit f20fea50f1.

Reason for revert: unbreak the git_sc-v2-dev-plus-aosp tests
Bug: 202879263

Change-Id: I79245afb4ba7f5be8ee46f2e91921a7327b650c5
2021-10-13 16:21:54 +00:00
Nicolas Geoffray
47a5f31980 Merge "Allow incidentd to read apex-info-list.xml." 2021-10-13 09:32:08 +00:00
Steven Moreland
2868112dff authfs - remove getattr perm for fd pass
We are no longer reading the ashmem size on every transaction.

Fixes: 195752513
Test: atest ComposHostTestCases (no denial logs)
Change-Id: If27c2b1d0efdccf30bc8c09e1004feb789e2425d
2021-10-12 21:54:42 +00:00
Treehugger Robot
b664b0ac79 Merge "Stop using the bdev_type and sysfs_block_type SELinux attributes" 2021-10-12 18:26:02 +00:00
Bart Van Assche
f4a1c36369 Merge "Stop granting init access to block device properties" 2021-10-12 17:37:59 +00:00
Bart Van Assche
6b53d731fd Stop using the bdev_type and sysfs_block_type SELinux attributes
Stop using these attributes since these will be removed soon.

Bug: 202520796
Test: source build/envsetup.sh && lunch aosp_x86_64 && m && launch_cvd
Change-Id: I61dffb482f4e952299156f34be642ae52fcbfeb3
Signed-off-by: Bart Van Assche <bvanassche@google.com>
2021-10-12 09:45:11 -07:00
Bart Van Assche
f20fea50f1 Stop granting init access to block device properties
Although there has been a plan to add code to the init process that
requires access to block device properties, that plan has not been
realized. Hence stop granting the init process access to block device
properties

Bug: 202520796
Test: source build/envsetup.sh && lunch aosp_x86_64 && m && launch_cvd
Change-Id: I0ed83bd533a901f85986d15f636c9b3f39fec271
Signed-off-by: Bart Van Assche <bvanassche@google.com>
2021-10-12 09:20:03 -07:00
Ian Hua
91d153e9b5 Update sepolicy for adding nnapi_native namespace.
Test: mm
Bug: 201399117
Change-Id: I40a2431b6f5a54deae27fe68f503aff9b99e2793
2021-10-12 11:50:26 +01:00
Nicolas Geoffray
7a2693b61e Allow incidentd to read apex-info-list.xml.
Spotted looking at a bugreport.

Test: m
Change-Id: I034099e5899b4fd75ec58f16f0fa49a3bdc079e1
2021-10-09 15:46:44 +01:00
Dave McCloskey
a7e47db710 SEPolicy changes to support Attestation Verification Service
Bug: 201696614
Change-Id: I4a7a830ba809ed59a030a87c4f479199685d8a42
Test: Verify device boots
2021-10-08 14:53:24 -07:00
Andrew Scull
aedd65ac20 Allow vendor_init to read AVF device configs
Bug: 192819132
Test: build
Change-Id: Iefa4d2d2dc0a13a9a6c95779d6ebde5cb2834295
2021-10-08 14:51:30 +00:00
Treehugger Robot
a5d1958d3e Merge "Add sepolicy for com.android.car.framework module" 2021-10-08 06:29:28 +00:00
Jooyung Han
1103fb887a Merge "virtualizationservice to use "staged" apexes" 2021-10-08 00:26:40 +00:00
Xin Li
2b2247f14c Merge "Merge Android 12" 2021-10-07 23:50:37 +00:00
Treehugger Robot
27d22e670a Merge "Fix error in systemui when toggling airplane mode" 2021-10-07 16:17:57 +00:00
David Anderson
2c6b2326a7 Merge "allow init to set status on loop device" 2021-10-07 15:49:18 +00:00
Keun young Park
44025b07eb Add sepolicy for com.android.car.framework module
Bug: 192665266
Test: build
Change-Id: I69036c20a3bae10e34a3c076eb8e1c7c2f1d2517
2021-10-07 00:45:19 +00:00
Xin Li
ca1bb9d4d0 Merge Android 12
Bug: 202323961
Merged-In: Icd70009f62d023fb68bb1355f804f9489362c0ed
Change-Id: I7fbd1b2ee2ba72e90ce098f235f2f7a927898c09
2021-10-06 22:55:14 +00:00
Treehugger Robot
21dac7a746 Merge "Add media.resolution.limit.32bit to media_config_prop" am: a257817b5d
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/1840355

Change-Id: Icd70009f62d023fb68bb1355f804f9489362c0ed
2021-10-05 17:33:32 +00:00
Treehugger Robot
a257817b5d Merge "Add media.resolution.limit.32bit to media_config_prop" 2021-10-05 17:13:35 +00:00
Nicolas Geoffray
d6d00365f1 Merge "Allow system server to map zygote_tmpfs files." am: 02211e449d
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/1844917

Change-Id: I738edf09d8cd58e15ce0e4d987c902ad7b660de9
2021-10-05 16:14:57 +00:00
Nicolas Geoffray
02211e449d Merge "Allow system server to map zygote_tmpfs files." 2021-10-05 16:02:56 +00:00
Nicolas Geoffray
cd470d1e51 Allow system server to map zygote_tmpfs files.
Needed for an ART optimization.

Test: build
Change-Id: I120cdbe410248ac08f4e56cdeb6588681630a964
2021-10-05 15:03:54 +01:00
Jooyung Han
970166fb4a virtualizationservice to use "staged" apexes
Virtualizationservice queries "package_native" service to get staged
apex info and then reads staged apexes to VM.

Bug: 199146189
Test: MicrodroidHostTestCases
Change-Id: Icbfe5b9a05abc08d3e0270d15969f632b3f57c66
2021-10-05 19:57:20 +09:00
Treehugger Robot
1e04545bb3 Merge "Allow compos_fd_server to signal readiness" am: a12dc09f78
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/1844302

Change-Id: Ia0cd0cbb89675f1de7e4e3e450a5aa6dae2ef2d8
2021-10-05 10:08:17 +00:00
Treehugger Robot
a12dc09f78 Merge "Allow compos_fd_server to signal readiness" 2021-10-05 09:44:27 +00:00
Enrico Granata
393ebdda04 Merge "Introduce ro.boot.hypervisor properties" am: dd35626853
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/1843773

Change-Id: I4ff9a7c008590a5ca17987aac95c5afab441f392
2021-10-04 19:20:47 +00:00
Enrico Granata
dd35626853 Merge "Introduce ro.boot.hypervisor properties" 2021-10-04 19:10:28 +00:00
Treehugger Robot
1ad1e9240e Merge "Strip excess spaces in build_policy" am: 7ba07be13f
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/1842578

Change-Id: I5509e6c9fec808646d0ba38bf94d2d0439243dcf
2021-10-04 18:40:11 +00:00
Treehugger Robot
7ba07be13f Merge "Strip excess spaces in build_policy" 2021-10-04 18:28:56 +00:00
Enrico Granata
645c390d1a Introduce ro.boot.hypervisor properties
In virtualized deployments of Android, it can be useful to have
access to a description of the hypervisor/host environment being
used to run the guest OS instance.

This is represented by means of a new system property
ro.boot.hypervisor.version, which is meant to convey a
free-form descriptor of the current host/hypervisor version

The property is meant to be provided to Android as androidboot.
by whatever host-specific means are used to supply other boot
properties to the target Android instance. Access could be later
opened to other vendor processes to set if needed for specific
setups where init is not a sufficiently-early stage for
host/guest communication. Such setups are not known at this time.

For a native Android incantation, the property defaults to
being missing

Other properties could later be added to this same namespace
and context if they turn out to be useful in specific scenarios.

Bug: 178749018
Test: build cuttlefish
Change-Id: Id721c14ef1958b525c2866a660dcae8fd176a79d
2021-10-04 11:14:03 -06:00
Beth Thibodeau
a279bdba64 Fix error in systemui when toggling airplane mode
Fixes: 197722115
Test: manual - toggle, no avc: denied message
Change-Id: I17929f7cb77a4ba4f9720783c9913243f74db080
2021-10-04 15:34:19 +00:00
Daniele Di Proietto
43ace3bad3 Merge "Allow init to run perfetto" am: 6634fe524e
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/1842419

Change-Id: If4405103e120e70b7dc6035d24261d35bc4a31ca
2021-10-04 13:38:30 +00:00