tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
24082 commits 1 branch 0 tags 50 MiB
Commit graph

24082 commits

This branch
This branch
All branches
Author SHA1 Message Date
Automerger Merge Worker
4b669dd17a Merge "Make platform_compat discoverable everywhere" am: c79be18ddd am: 20d98449ac am: bcd4ef9fcf 
Change-Id: I69e75e90af15b496a8cb29e00ad4cfd8ebbb5c4f
 2020-02-06 14:18:16 +00:00
Automerger Merge Worker
bcd4ef9fcf Merge "Make platform_compat discoverable everywhere" am: c79be18ddd am: 20d98449ac 
Change-Id: I09d019fd9bc8e7dcd572641a1ba3d969084481d5
 2020-02-06 14:08:44 +00:00
Automerger Merge Worker
20d98449ac Merge "Make platform_compat discoverable everywhere" am: c79be18ddd 
Change-Id: Idfa1540dd171d6ada539f06cc50bb1f11b1fc82a
 2020-02-06 13:51:30 +00:00
Andrei-Valentin Onea
c79be18ddd Merge "Make platform_compat discoverable everywhere" 2020-02-06 13:40:34 +00:00
Automerger Merge Worker
3d57202fe8 Merge "Don't audit dumpstate reading /mnt/user, /mnt/installer." am: 55b7ccd989 am: c22738a787 am: a7d42f069a 
Change-Id: I9b0585ac754a8089f9ac2d5c01bf5df3375eec2a
 2020-02-06 13:06:46 +00:00
Automerger Merge Worker
2c6ac32b05 Merge "net_dns_prop: neverallow most access" am: 9788ca1738 am: 0bbe440a69 am: 45b34f9bc3 
Change-Id: Ic3de14b1fb43a0dd3bb07ffdd18a7d5bdf88b459
 2020-02-06 13:06:34 +00:00
Automerger Merge Worker
a7d42f069a Merge "Don't audit dumpstate reading /mnt/user, /mnt/installer." am: 55b7ccd989 am: c22738a787 
Change-Id: Ib56c48db0ea1e8ad929342870485e2b69ff1a3be
 2020-02-06 12:50:54 +00:00
Automerger Merge Worker
45b34f9bc3 Merge "net_dns_prop: neverallow most access" am: 9788ca1738 am: 0bbe440a69 
Change-Id: I5d58f756d84ee6784611afc8fc460874df82f186
 2020-02-06 12:50:44 +00:00
Automerger Merge Worker
c22738a787 Merge "Don't audit dumpstate reading /mnt/user, /mnt/installer." am: 55b7ccd989 
Change-Id: Ie00ede70277839dfaeb291ee21825fab99bfc134
 2020-02-06 12:42:27 +00:00
Martijn Coenen
55b7ccd989 Merge "Don't audit dumpstate reading /mnt/user, /mnt/installer." 2020-02-06 12:37:24 +00:00
Automerger Merge Worker
0bbe440a69 Merge "net_dns_prop: neverallow most access" am: 9788ca1738 
Change-Id: If7272632fd3e7162b37ac1530ec49fd49f028b0c
 2020-02-06 12:34:42 +00:00
Jeffrey Vander Stoep
9788ca1738 Merge "net_dns_prop: neverallow most access" 2020-02-06 12:16:22 +00:00
Andrei Onea
25b39acefe Make platform_compat discoverable everywhere 
The binder's methods are protected by signature
permissions (LOG_COMPAT_CHANGE, READ_COMPAT_CHANGE_CONFIG and
OVERRIDE_COMPAT_CHANGE_CONFIG).

This is a re-landing of https://r.android.com/1210143, which was
reverted due to http://b/142942524. The actual fix was done in
http://ag/10234812.

Bug: 142650523
Test: atest PlatformCompatGatingTest
Change-Id: Ibddac8933ea58d44457a5d80b540347e796ebe71
 2020-02-06 12:11:37 +00:00
Narayan Kamath
2deb97055d Merge "Reland: Rework platform version to hide codenames." 2020-02-06 10:51:15 +00:00
Martijn Coenen
722026676b Don't audit dumpstate reading /mnt/user, /mnt/installer. 
Dumpstate runs 'df', which in turn tries to get attributes on all
mounted filesystems. We don't care much for stats on /mnt/user, since
it's simply a mapping of /data. /mnt/installer is simply a bind mount of
/mnt/user, and we don't need to show that in df either.

Bug: 148761246
Test: atest
CtsSecurityHostTestCases:android.security.cts.SELinuxHostTest#testNoBugreportDenials
Change-Id: Ie71b9cde08eb08bd3a7a3e2659ea71c61ca5ab3b
 2020-02-06 09:44:24 +00:00
Automerger Merge Worker
17fb4281f2 Merge "sepolicy: Relabel wifi. properties as wifi_prop" am: 15d70fec33 am: 557f360d29 am: 63b4bf379b 
Change-Id: Iae2bd1e7e565628c45824d7587941bb9f4189496
 2020-02-06 03:30:03 +00:00
Automerger Merge Worker
63b4bf379b Merge "sepolicy: Relabel wifi. properties as wifi_prop" am: 15d70fec33 am: 557f360d29 
Change-Id: Id4798053c4bdce64961f17b07b073ea1dc814c4f
 2020-02-06 03:19:25 +00:00
Automerger Merge Worker
557f360d29 Merge "sepolicy: Relabel wifi. properties as wifi_prop" am: 15d70fec33 
Change-Id: I496b18dadf830a96e6e6a27e14a985b784707a5a
 2020-02-06 03:06:08 +00:00
Automerger Merge Worker
8c414dafa2 Merge "adbd should be able to shutdown shell:unix_stream_socket" am: ca3d3dfa70 am: 49f6767ac7 am: 2e4330a595 
Change-Id: I3798b80045dfa3688728a85d7626c5dc122d3039
 2020-02-06 02:55:07 +00:00
Treehugger Robot
15d70fec33 Merge "sepolicy: Relabel wifi. properties as wifi_prop" 2020-02-06 02:53:51 +00:00
Automerger Merge Worker
2e4330a595 Merge "adbd should be able to shutdown shell:unix_stream_socket" am: ca3d3dfa70 am: 49f6767ac7 
Change-Id: I8e76db4e59f91f3a081629749da7409fd90de1fb
 2020-02-06 02:45:39 +00:00
Automerger Merge Worker
84faab70f0 Merge "Add filegroup for extservices file context" am: f9e9eabea5 am: 74f0d2e626 am: fb2106ea6c 
Change-Id: Ie872465ab0caa13f40f760235d16bc4ba5791199
 2020-02-06 02:31:10 +00:00
Automerger Merge Worker
7edd7b8efe Merge "Surfaceflinger binder call StatsManagerService" am: f8ddb83890 am: 8312d3a4f3 am: cb0fba75e2 
Change-Id: I01a164e0ba0dfe3dfd1549fa7194a50131db71c9
 2020-02-06 02:31:03 +00:00
Automerger Merge Worker
49f6767ac7 Merge "adbd should be able to shutdown shell:unix_stream_socket" am: ca3d3dfa70 
Change-Id: I5fbc449b0d6f463aaa4e4b0e22638cc684b811b3
 2020-02-06 02:30:57 +00:00
Treehugger Robot
ca3d3dfa70 Merge "adbd should be able to shutdown shell:unix_stream_socket" 2020-02-06 02:17:31 +00:00
Automerger Merge Worker
fb2106ea6c Merge "Add filegroup for extservices file context" am: f9e9eabea5 am: 74f0d2e626 
Change-Id: I407492d092e66b920c412b43813d8b8242bd0753
 2020-02-06 02:15:11 +00:00
Automerger Merge Worker
cb0fba75e2 Merge "Surfaceflinger binder call StatsManagerService" am: f8ddb83890 am: 8312d3a4f3 
Change-Id: Id65ba24270f0f68d40c32493c7e923ea9a8b95c4
 2020-02-06 02:14:53 +00:00
Automerger Merge Worker
67225596e4 Allow init to set the encryption policy on unlabeled directories. am: 5e175476f2 am: 07fd2bc27b am: 19c3592a0d 
Change-Id: If4c9df5c1c6ed38903fa9ebc91f2fc0a86173c67
 2020-02-06 02:12:01 +00:00
Automerger Merge Worker
74f0d2e626 Merge "Add filegroup for extservices file context" am: f9e9eabea5 
Change-Id: I7988f26f5741c78273b8dd05da8194e5ca301c35
 2020-02-06 02:11:51 +00:00
Treehugger Robot
f9e9eabea5 Merge "Add filegroup for extservices file context" 2020-02-06 02:06:41 +00:00
Automerger Merge Worker
8312d3a4f3 Merge "Surfaceflinger binder call StatsManagerService" am: f8ddb83890 
Change-Id: I08f1b3a9cb50e4981489274d3cd780bebdf93262
 2020-02-06 02:03:09 +00:00
Automerger Merge Worker
19c3592a0d Allow init to set the encryption policy on unlabeled directories. am: 5e175476f2 am: 07fd2bc27b 
Change-Id: I4aee5ae459f2f2eb4d2fe820acd05336dc5db9ec
 2020-02-06 01:57:40 +00:00
Howard Ro
f8ddb83890 Merge "Surfaceflinger binder call StatsManagerService" 2020-02-06 01:52:40 +00:00
Automerger Merge Worker
07fd2bc27b Allow init to set the encryption policy on unlabeled directories. am: 5e175476f2 
Change-Id: Id4c9b5ac74bbfcea4de0c744052b2b81cbf48147
 2020-02-06 01:44:20 +00:00
Josh Gao
b9c7001837 adbd should be able to shutdown shell:unix_stream_socket 
adbd started calling shutdown and waiting for EOF before closing
sockets in commit 74b7ec72, because closing a TCP socket while you have
pending data to read is specified to send a TCP RST to the other end,
which can result in data that we've written into the socket to be
prematurely thrown away on the other end. Not being able to do so on a
Unix domain socket is benign, aside from the denial showing up in the
log.

Fixes the following selinux denial when installing a package:

  avc: denied { shutdown } for scontext=u:r:adbd:s0 tcontext=u:r:shell:s0 tclass=unix_stream_socket permissive=0

Test: manual
Change-Id: I266092a8323ac02bfe96738a8f4a8021f3a10387
 2020-02-05 17:24:46 -08:00
Automerger Merge Worker
871bbfbce0 Merge "GpuStats: sepolicy change for using new statsd puller api" am: 231b89410f am: d8f11b4663 am: b03f768cd0 
Change-Id: I7bf9249884d7864ec344e1b3fe0b69ea12ca0584
 2020-02-05 23:48:17 +00:00
Automerger Merge Worker
b03f768cd0 Merge "GpuStats: sepolicy change for using new statsd puller api" am: 231b89410f am: d8f11b4663 
Change-Id: Iaf980d83c8a7c467e5313031f3489cc5e9474ccc
 2020-02-05 23:37:24 +00:00
Automerger Merge Worker
d8f11b4663 Merge "GpuStats: sepolicy change for using new statsd puller api" am: 231b89410f 
Change-Id: Ibefa5654ab0825ab199ade05cee0afa7b0952270
 2020-02-05 23:24:02 +00:00
Automerger Merge Worker
e43596c420 Merge "Only write snapshotctl_log when debug" am: df701f3e45 am: e9f40bc112 am: 6882ef2e47 
Change-Id: I9641405215be04f6daeddf81038a0d072aba180d
 2020-02-05 23:22:50 +00:00
Joel Galenson
5e175476f2 Allow init to set the encryption policy on unlabeled directories. 
This fixes a bug where a directory's label was removed, causing it to
be unlabeled, and we crashed on trying to set its encryption policy.

Fixes: 148923156
Test: Successfully update from build with the deleted label.
Change-Id: I69c3707e3e66d9e44a22b0783d3016c8ddab6b8f
 2020-02-05 15:03:29 -08:00
Jeffrey Huang
225850bd0c Surfaceflinger binder call StatsManagerService 
This binder call is needed because we want to migrate
libstatspull to use StatsManagerService instead of Statsd

The binder call to statsd can be removed after the migration.

Test: m -j
Bug: 148641240
Change-Id: If6cf7eb77aa229751c44e5291d49f05177dbb8dd
 2020-02-05 14:40:40 -08:00
Treehugger Robot
231b89410f Merge "GpuStats: sepolicy change for using new statsd puller api" 2020-02-05 21:58:42 +00:00
Automerger Merge Worker
6882ef2e47 Merge "Only write snapshotctl_log when debug" am: df701f3e45 am: e9f40bc112 
Change-Id: Ife5817e33a0c6654550169ef315f1912f1253478
 2020-02-05 21:49:30 +00:00
Automerger Merge Worker
e9f40bc112 Merge "Only write snapshotctl_log when debug" am: df701f3e45 
Change-Id: I8aa0da7a0ae63be6787cef145f188052da42cc77
 2020-02-05 21:32:29 +00:00
Yifan Hong
df701f3e45 Merge "Only write snapshotctl_log when debug" 2020-02-05 21:23:11 +00:00
Automerger Merge Worker
763192f951 Merge "Allow update_engine to write snapshotctl log data" am: f58e6777b2 am: deda3c9203 am: 94e7163843 
Change-Id: I11f2e5667f06816a47655d70c226b6cef7f71e84
 2020-02-05 18:28:57 +00:00
Automerger Merge Worker
064a946498 Merge "Move virtual_ab_prop to vendor partition." am: 54411b5e3c am: d2e13c7ffb am: d15ac358bf 
Change-Id: I03859f154e1194f3d88b098eeb0b3589a7db67d9
 2020-02-05 18:28:42 +00:00
Automerger Merge Worker
94e7163843 Merge "Allow update_engine to write snapshotctl log data" am: f58e6777b2 am: deda3c9203 
Change-Id: I8c5b8d607d9922e0a4840eae200d6dea9fdf7e5f
 2020-02-05 18:14:44 +00:00
Automerger Merge Worker
d15ac358bf Merge "Move virtual_ab_prop to vendor partition." am: 54411b5e3c am: d2e13c7ffb 
Change-Id: Ie9a73163fd8da32f32fb79e09879e38ead917da4
 2020-02-05 18:14:28 +00:00
Automerger Merge Worker
deda3c9203 Merge "Allow update_engine to write snapshotctl log data" am: f58e6777b2 
Change-Id: I8f67eca8af03b625b71ecee017c5e795cab08f90
 2020-02-05 18:04:30 +00:00