Commit graph

477 commits

Author SHA1 Message Date
Chirag Pathak
814e89a1b2 The SE Policies to incorporate ISecureClock and ISharedSecret services along with IKeyMintDevice service into default keymint HAL Server.
Test: Rebuild, execute and run atest VtsAidlSharedSecretTargetTest and atest VtsAidlSecureClockTargetTest.
Bug: b/171844725, b/168673523.

Change-Id: I8b81ec12c45566d31edcd117e41fd559df32c37d
2021-02-10 18:45:07 +00:00
ChengYou Ho
291890a954 Add sepolicy for weaver aidl HAL service
Bug: 176107318
Change-Id: I9ca1a68e45b462c9b6ac912debb196b3a3ca45ba
2021-01-22 06:34:41 +00:00
Yifan Hong
06e4b8417a Add health storage AIDL service.
Test: adb shell sm idle-maint run
Bug: 177470478
Change-Id: Id7ee5af64e8d21eafd041c9e8fa1382f65a3958b
2021-01-15 18:23:01 -08:00
Treehugger Robot
cf7118cc65 Merge "Allow mediacodec to allocate from the DMA-BUF system heap" 2021-01-14 18:02:59 +00:00
Hridya Valsaraju
0fee0133c6 Allow mediacodec to allocate from the DMA-BUF system heap
mediacodec currently only has permissions to allocate from ION heaps.
The following permission is required for it to allocate from the
DMA-BUF system heap via the the codec2 allocator.

It resolves the following denial in the sdk_gphone_x86_64-userdebug
target:

01-08 22:43:48.712   337   337 I auditd  : type=1400 audit(0.0:6): avc:
denied { getattr } for comm="android.hardwar"
path="/dev/dma_heap/system-uncached" dev="tmpfs" ino=311
scontext=u:r:mediacodec:s0
tcontext=u:object_r:dmabuf_system_heap_device:s0 tclass=chr_file
permissive=0

Bug: 170887642
Test: make and boot
Change-Id: I5503ed6ffa47a84f614792de866ddafbec0cdcda
2021-01-14 05:13:54 +00:00
Tomasz Wasilczyk
c848de1480 Merge "Revert "Revert "hal_can_*: use hal_attribute_service""" 2021-01-12 16:45:24 +00:00
Tomasz Wasilczyk
d99750d79e Revert "Revert "hal_can_*: use hal_attribute_service""
This reverts commit 061b56b497.

Reason for revert: second submission attempt

Change-Id: I632968c7c0c369ecc07ec829f59b629c39fb71e9
2021-01-11 18:25:51 +00:00
ChengYou Ho
553afe7242 Add sepolicy for oemlock aidl HAL
Bug: 176107318
Change-Id: I26f8926401b15136f0aca79b3d5964ab3b59fbdd
2021-01-11 05:57:17 +00:00
Nazanin Bakhshi
51872d888d Merge "Revert "hal_can_*: use hal_attribute_service"" 2020-12-29 22:57:03 +00:00
Nazanin Bakhshi
061b56b497 Revert "hal_can_*: use hal_attribute_service"
This reverts commit c8e937efe5.

Reason for revert: <DroidMonitor-triggered revert due to breakage https://android-build.googleplex.com/builds/quarterdeck?build-cop=true, bug 176180039>

Change-Id: I0aff6ebba8b6a7a45af7229a0506f0426a8ebadf
2020-12-29 22:53:29 +00:00
Steven Moreland
8e5c457f2e Merge "hal_can_*: use hal_attribute_service" 2020-12-29 20:43:20 +00:00
Steven Moreland
c8e937efe5 hal_can_*: use hal_attribute_service
This macro creates the necessary neverallow to assert the
hal_can_*_{client,server} attribute has exclusive ownership of
the service.

Bug: 176180039
Test: build/TH
Change-Id: I876b50e4184ef787117d5ca67c7fbd522d82687c
2020-12-23 01:36:02 +00:00
Kalesh Singh
24ada7dbee Reland: Memtrack HAL stable aidl sepolicy
Bug: 175021432
Test: Check logcat for denials
Change-Id: Id92fc543791072d8682e3a89cbf08370007108bf
2020-12-22 16:08:53 -05:00
Joel Galenson
1c7eb3c3bd Clean up keymint service policy.
Test: VtsAidlKeyMintTargetTest
Change-Id: Id6e83d63ffb1de7c48dbdf435fd9988e9174cfe2
2020-12-16 08:59:09 -08:00
Kalesh Singh
3619437561 Merge "Revert "Memtrack HAL stable aidl sepolicy"" 2020-12-16 00:48:06 +00:00
Kalesh Singh
5db6857fe1 Revert "Memtrack HAL stable aidl sepolicy"
Revert "Add android.hardware.memtrack-unstable-ndk_platform"

Revert submission 1518702-memtrack-aidl

Reason for revert: Broken tests and boot time regressions
Reverted Changes:
Ic4dd70e2c:Add android.hardware.memtrack-unstable-ndk_platfor...
Iaf99d0ca4:Add stable aidl memtrack HAL to product packages
Iac54ae2ba:Add stable aidl memtrack hal to vndk list
If310210a3:libmemtrack: Add support for AIDL memtrack HAL
Ib6c634def:Memtrack HAL: Add stable AIDL implementation
I5e1d0e006:Memtrack HAL stable aidl sepolicy

Change-Id: I0c55ee100c7fd8d09a5b188a39b17c95c8a43c39
2020-12-16 00:19:38 +00:00
Treehugger Robot
6d560dee90 Merge "Memtrack HAL stable aidl sepolicy" 2020-12-14 18:36:10 +00:00
Shawn Willden
b41f4985a9 Revert^2 "Move keymint to android.hardware.security."
16d61d0383


Bug: 175345910
Bug: 171429297
Exempt-From-Owner-Approval: re-landing topic with no changes in this CL.
Change-Id: I1352c6b46b007dba3448b3c9cbdf454d7862a176
2020-12-11 20:36:53 +00:00
Orion Hodson
16d61d0383 Revert "Move keymint to android.hardware.security."
Revert submission 1522123-move_keymint

Reason for revert: Build breakage
Bug: 175345910
Bug: 171429297
Reverted Changes:
Ief0e9884a:Keystore 2.0: Move keymint spec to security namesp...
Idb54e8846:Keystore 2.0: Move keymint spec to security namesp...
I9f70db0e4:Remove references to keymint1
I2b4ce3349:Keystore 2.0 SPI: Move keymint spec to security na...
I2498073aa:Move keymint to android.hardware.security.
I098711e7d:Move keymint to android.hardware.security.
I3ec8d70fe:Configure CF to start KeyMint service by default.
Icbb373c50:Move keymint to android.hardware.security.
I86bccf40e:Move keymint to android.hardware.security.

Change-Id: Ib5591c2379bbd2fd6dde0558ba0e68f39d27fbaf
2020-12-11 10:45:43 +00:00
Selene Huang
2c3bdb28de Move keymint to android.hardware.security.
Test: VtsAidlKeyMintTargetTest
Change-Id: I098711e7ddbcac0fc761801a1bf582a71a8f9baa
2020-12-10 19:12:29 +00:00
Kalesh Singh
545c5bfe47 Memtrack HAL stable aidl sepolicy
Bug: 175021432
Test: Check logcat for denials
Change-Id: I5e1d0e006d86a65552acb78c23b421155881555b
2020-12-08 14:09:09 -05:00
Kevin Chyn
a492bf048d Add SEPolicy for fingerprint2.2 example HAL
Bug: 172957689
Test: atest CtsBiometricsTestCases
Change-Id: I0de92a880e4ca04765da3e3184e5ad0382dc958a
2020-12-03 01:11:30 -08:00
Hayden Gomes
bf08517f2c Adding support for AIDL AudioControl HAL
Bug: 170335834
Test: built and ran without sepolicy issues
Change-Id: Ia25b82aaf676fd2bd37e60bc0d2960f398fa3c90
2020-10-29 10:56:23 -07:00
Benjamin Schwartz
92bb74c851 Rename PowerStats HAL service
Bug: 169864180
Test: m
Merged-In: I79ddf26acf398e80c6ff4a96c26b04aef73feac3
Change-Id: Ic458514285f819f44e50e2bee26a08fc6cf54261
2020-10-07 21:56:53 +00:00
Ilya Matyukhin
d2acfb0f9c Merge "Add sepolicy for IFace" 2020-09-29 20:20:00 +00:00
Treehugger Robot
1ae3b13e39 Merge "Add android.hardware.audio@7.0-service.example service" 2020-09-28 22:58:29 +00:00
Ilya Matyukhin
9bd164241e Add sepolicy for IFace
Bug: 168730443
Test: run on cuttlefish
Change-Id: Ie3cf791e7aac090788c7213d23487ae9f50b0690
2020-09-28 15:57:59 -07:00
Treehugger Robot
0dab4a6be8 Merge "Restrict the policy for IFingerprint to example only" 2020-09-25 19:59:18 +00:00
Ilya Matyukhin
b27180660c Restrict the policy for IFingerprint to example only
Bug: 152416783
Test: run on cuttlefish
Change-Id: I3df58ca37c4d7f183690ab4f6917515f9a3eb5be
2020-09-25 11:00:15 -07:00
Mikhail Naganov
fc56fe6fd0 Add android.hardware.audio@7.0-service.example service
This service will demonstrate a minimal audio HAL V7.0

Bug: 142480271
Test: atest VtsHalAudioV7_0TargetTest
      (HAL and test are not available in AOSP yet)
Change-Id: I2e7f166a47f21eb6c8621d0ddb33cfea84aa20da
2020-09-24 23:35:34 +00:00
Yu-Han Yang
bbd0ecedbb Add GNSS AIDL interfaces (system/sepolicy)
Bug: 159467682
Test: built and run on cuttlefish
Change-Id: I071e8427ea0251139661aa8123376c56e0839390
2020-09-24 12:03:30 -07:00
Aleks Rozman
a1ba5a9f5a Revert "Add GNSS AIDL interfaces (system/sepolicy)"
This reverts commit d5f59b1b77.

Reason for revert: b/169150373

Change-Id: I3d5e20400ea8ee0e9ae439497245c09a13aaa716
2020-09-22 18:25:48 +00:00
Yu-Han Yang
d5f59b1b77 Add GNSS AIDL interfaces (system/sepolicy)
Bug: 159467682
Test: on cuttlefish
Change-Id: Iae7ceefe985096bcf9140e2a3592aade7ad70407
2020-09-17 13:31:29 -07:00
Benjamin Schwartz
dc505c51ea Merge "Create Power Stats AIDL interface" 2020-09-15 16:39:36 +00:00
Benjamin Schwartz
af8b21a6d2 Create Power Stats AIDL interface
Bug: 162472196
Test: m
Merged-In: I948ef2959b25d776d3b01985fea5eb695fd4fc1e
Change-Id: I12dc33ce055c7275559cce33142cfb2aacc5471f
2020-09-10 22:34:49 -07:00
Ilya Matyukhin
c71c2993e9 Add sepolicy for IFingerprint
Bug: 152416783
Test: run on cuttlefish
Change-Id: I58d7c3bc9c81612b03bab3b9da938c091c02e3c1
2020-09-10 16:50:19 -07:00
Amy Zhang
7a9148faa2 Merge "Add Tuner HAL 1.1 service into the default tuner domain" am: ce67a16be1 am: 71968d9d2c
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/1364041

Change-Id: Ie998140005353326d5d6b39d27d52aa8385354fc
2020-07-17 19:02:37 +00:00
Amy Zhang
2e148351af Add Tuner HAL 1.1 service into the default tuner domain
Test: cuttlefish, atest VtsHalTvTunerV1_1TargetTest
Bug: b/159058358
Change-Id: I67fbfb29c3097953e6d30d17a8d40d586162088f
2020-07-15 18:25:48 -07:00
Mark Salyzyn
3227821bce modprobe: add -s/--syslog flag am: c86d3886ab am: fb9c0d1e95
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/1349035

Change-Id: Idafe34481f5e78b4b618dc9e87cd3066566585bf
2020-06-25 20:39:23 +00:00
Mark Salyzyn
c86d3886ab modprobe: add -s/--syslog flag
There is a desire to ensure that modprobe as a service can log to
kmesg to help triage issues, so add support for the -s or --syslog
flag to do so.

Bug: 159424228
Bug: 151950334
Test: use modprobe as a service to load modules, check logs
Change-Id: I884995f364b0fc604861797eb90d7225a372f864
2020-06-25 11:30:24 -07:00
TreeHugger Robot
d5495ba9e8 Merge "Copying platform seinfo into vendor partition" into rvc-dev am: b1d807bbba
Original change: https://googleplex-android-review.googlesource.com/c/platform/system/sepolicy/+/11708190

Change-Id: I91aa36b0134df73a5b7fe8ed421317e043402032
2020-06-04 15:44:52 +00:00
Bowgo Tsai
3ffd6b3f01 Copying platform seinfo into vendor partition
Some vendor apps are using platform key for signing.
This moves them to untrusted_app domain when the system partition is
switched to a Generic System Image (GSI), because the value of
platform's seinfo in /system/etc/selinux/plat_mac_permissions.xml
has been changed.

Duplicating the device-specific platform seinfo into
/vendor/etc/selinux/vendor_mac_permissions.xml to make it
self-contained within the vendor partition.

Bug: 157141777
Test: boot the device with a GSI, then `adb shell ps -eZ | grep qtidata`
Test: ./build/make/tools/releasetools/sign_target_files_apks \
      --default_key_mappings path/to/keydir \
      -o out/dist/<lunch>-target_files-*.zip \
      signed-tardis-target_files.zip and checks the platform seinfo in
      /vendor/etc/selinux/vendor_mac_permissions.xml is replaced.

Change-Id: Ic9a79780e30f456138e4de67210cc60ac2e490d6
Merged-In: Ic9a79780e30f456138e4de67210cc60ac2e490d6
(cherry picked from commit 8a86424e34)
2020-06-04 17:27:15 +08:00
Bowgo Tsai
8a86424e34 Copying platform seinfo into vendor partition
Some vendor apps are using platform key for signing.
This moves them to untrusted_app domain when the system partition is
switched to a Generic System Image (GSI), because the value of
platform's seinfo in /system/etc/selinux/plat_mac_permissions.xml
has been changed.

Duplicating the device-specific platform seinfo into
/vendor/etc/selinux/vendor_mac_permissions.xml to make it
self-contained within the vendor partition.

Bug: 157141777
Test: boot the device with a GSI, then `adb shell ps -eZ | grep qtidata`
Test: ./build/make/tools/releasetools/sign_target_files_apks \
      --default_key_mappings path/to/keydir \
      -o out/dist/<lunch>-target_files-*.zip \
      signed-tardis-target_files.zip and checks the platform seinfo in
      /vendor/etc/selinux/vendor_mac_permissions.xml is replaced.

Change-Id: Ic9a79780e30f456138e4de67210cc60ac2e490d6
2020-06-03 17:46:07 +08:00
Treehugger Robot
7a4adba63b Merge "Move aac_drc props to aac_drc_prop" am: a00b1ea2db am: b9688d505d
Change-Id: I76ba555e6d1e41e06c68088b59f5bd97a1aa809e
2020-05-12 05:16:46 +00:00
Inseob Kim
bdcbcf0742 Move aac_drc props to aac_drc_prop
Bug: 155844385
Test: sepolicy_tests
Change-Id: I1755672b5cef876955f93020c519aaaabf814bbf
2020-05-12 08:21:42 +09:00
Roshan Pius
d42c7571aa sepolicy: Remove offload HAL sepolicy rules
This is unused currently & there are no concrete plans to use it
in the future.

Bug: 130080335
Test: Device boots up & connects to networks.
Test: Will send for regression tests
Change-Id: I785389bc2c934c8792c8f631362d6aa0298007af
Merged-In: I785389bc2c934c8792c8f631362d6aa0298007af
(cherry picked from commit 56dfc06397)
2020-05-08 11:17:12 +09:00
Steve Muckle
9316da8e12 allow modprobe to read /proc/cmdline
This is needed for libmodprobe to pass module options on the kernel
commandline to kernel modules when they are loaded.

Bug: 155422904
Change-Id: I9df7e211765268815bfb9269365264f5ca468712
Merged-In: I9df7e211765268815bfb9269365264f5ca468712
2020-05-07 11:28:50 -07:00
Steve Muckle
c340f2a313 Merge "allow modprobe to read /proc/cmdline" am: 73c62d3516 am: c9c8d130b9
Change-Id: I3871b35c4de088917c3c1e941f8987ffba88953a
2020-05-06 00:53:12 +00:00
Steve Muckle
e3788c93e5 allow modprobe to read /proc/cmdline
This is needed for libmodprobe to pass module options on the kernel
commandline to kernel modules when they are loaded.

Bug: 155422904
Change-Id: I9df7e211765268815bfb9269365264f5ca468712
2020-05-05 08:50:11 -07:00
Robert Shih
a2e4038266 Merge "Allow drm hals to access allocator hal" am: b60b51d352 am: c5bf73f0d8
Change-Id: I57c6e21e36e4b4374c71204763f5481b99ee514f
2020-04-13 23:25:07 +00:00