tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
6032 commits 1 branch 0 tags 50 MiB
Commit graph

6032 commits

This branch
This branch
All branches
Author SHA1 Message Date
Tao Bao
51523e59da resolve merge conflicts of 42baca019b to master. 
Change-Id: I7fe13cbe563dcd2f286696010f0a5034dfee0202
 2016-01-25 21:03:36 -08:00
Tao Bao
42baca019b Merge "Allow update_engine to use Binder IPC." 
am: 6899e0a38b

* commit '6899e0a38b14047f561493e87341b72dfbf3fe8a':
  Allow update_engine to use Binder IPC.
 2016-01-26 04:52:53 +00:00
Tao Bao
6899e0a38b Merge "Allow update_engine to use Binder IPC." 2016-01-26 04:33:51 +00:00
dcashman
d357760531 Add adbd socket perms to system_server. am: b037a6c94b 
am: c37fa20383

* commit 'c37fa2038327c8879e297b6fa9b76ba45ddcf67c':
  Add adbd socket perms to system_server.
 2016-01-26 01:44:45 +00:00
dcashman
c37fa20383 Add adbd socket perms to system_server. 
am: b037a6c94b

* commit 'b037a6c94b357c9a85d13dde548f5799c592c6ac':
  Add adbd socket perms to system_server.
 2016-01-26 01:42:44 +00:00
Tao Bao
dce317cf43 Allow update_engine to use Binder IPC. 
Register service with servicemanager and name the context.

avc: denied { call } for scontext=u:r:update_engine:s0 tcontext=u:r:servicemanager:s0 tclass=binder
avc: denied { add } for service=android.os.IUpdateEngine scontext=u:r:update_engine:s0 tcontext=u:object_r:update_engine_service:s0 tclass=service_manager

Also allow priv_app to communicate with update_engine.

avc: denied { find } for service=android.os.IUpdateEngine scontext=u:r:priv_app:s0:c512,c768 tcontext=u:object_r:update_engine_service:s0 tclass=service_manager
avc: denied { call } for scontext=u:r:priv_app:s0:c512,c768 tcontext=u:r:update_engine:s0 tclass=binder
avc: denied { call } for scontext=u:r:update_engine:s0 tcontext=u:r:priv_app:s0 tclass=binder

Change-Id: Ib4498717c1a72f5faab5ea04c636924ee4eb412c
 2016-01-25 16:42:38 -08:00
dcashman
b037a6c94b Add adbd socket perms to system_server. 
Commit 2fdeab3789 added ability to debug
over adbd for zygote-spawned apps, required by removal of domain_deprecated
from untrusted_app.  This functionality is a core debugabble component
of the android runtime, so it is needed by system_server as well.

Bug: 26458796
Change-Id: I29f5390122b3644449a5c3dcf4db2d0e969f6a9a
 2016-01-25 16:09:01 -08:00
Jeff Vander Stoep
dfd82ecbbf app: connect to adbd am: 2fdeab3789 
am: 97ebf96aba

* commit '97ebf96aba44f9cf14b975051b240bade5841053':
  app: connect to adbd
 2016-01-25 23:29:18 +00:00
Jeff Vander Stoep
97ebf96aba app: connect to adbd 
am: 2fdeab3789

* commit '2fdeab3789ec6e5ec6f7424abf41a9aaa73564b0':
  app: connect to adbd
 2016-01-25 23:27:33 +00:00
Jeff Vander Stoep
2fdeab3789 app: connect to adbd 
Permission to connect to adb was removed from untrusted_app when
the domain_deprecated attribute was removed. Add it back to support
debugging of apps. Grant to all apps as eventually
domain_deprecated will be removed from everything.

Bug: 26458796
Change-Id: I4356e6d011094cdb6829210dd0eec443b21f8496
 2016-01-25 15:20:05 -08:00
Jeff Vander Stoep
042d37c3a4 domain: allow dir search in selinuxfs am: 45517a7547 
am: cfa5d76fb8

* commit 'cfa5d76fb8c9ec4d68d1664c540ebe2f03e09d49':
  domain: allow dir search in selinuxfs
 2016-01-25 18:31:12 +00:00
Jeff Vander Stoep
cfa5d76fb8 domain: allow dir search in selinuxfs 
am: 45517a7547

* commit '45517a7547de0a9f0c13b5907c243456ec61bf04':
  domain: allow dir search in selinuxfs
 2016-01-25 18:28:59 +00:00
Jeff Vander Stoep
45517a7547 domain: allow dir search in selinuxfs 
Domain is already allowed to stat selinuxfs, it also needs
dir search.

Addresses:
avc: denied { search } for name="/" dev="selinuxfs" ino=1 scontext=u:r:watchdogd:s0 tcontext=u:object_r:selinuxfs:s0 tclass=dir

Change-Id: I3e5bb96e905db480a2727038f80315d9544e9c07
 2016-01-25 18:18:36 +00:00
Jeffrey Vander Stoep
5c091945c7 Merge "watchdog: remove domain_deprecated" am: c1b0ffcfdc 
am: febf92ea52

* commit 'febf92ea529aedf7341b15330a90ad49e4cf544f':
  watchdog: remove domain_deprecated
 2016-01-25 17:16:59 +00:00
Jeffrey Vander Stoep
febf92ea52 Merge "watchdog: remove domain_deprecated" 
am: c1b0ffcfdc

* commit 'c1b0ffcfdcb331d578eb159b58b871041e49fb90':
  watchdog: remove domain_deprecated
 2016-01-25 17:14:11 +00:00
Jeffrey Vander Stoep
c1b0ffcfdc Merge "watchdog: remove domain_deprecated" 2016-01-25 17:09:46 +00:00
Jeff Vander Stoep
1eeaa47eac watchdog: remove domain_deprecated 
Change-Id: I60d66da98a8da9cd7a9d0130862242e09b7dccf1
 2016-01-25 08:12:21 -08:00
Nick Kralevich
9ed70dc59b app.te: grant /system dir/file/symlink read am: 5c8854abef 
am: 2f89f3c1e6

* commit '2f89f3c1e6bcc64c589c5fe56c1064063d769f8d':
  app.te: grant /system dir/file/symlink read
 2016-01-23 17:28:44 +00:00
Nick Kralevich
2f89f3c1e6 app.te: grant /system dir/file/symlink read 
am: 5c8854abef

* commit '5c8854abef570bf62930902ec6ca6b9df4523458':
  app.te: grant /system dir/file/symlink read
 2016-01-23 17:26:53 +00:00
Nick Kralevich
5c8854abef app.te: grant /system dir/file/symlink read 
Renderscript needs the ability to read directories on
/system. Allow it and file/symlink read access.

Addresses the following denials:
  RenderScript: Invoking /system/bin/ld.mc with args '/system/bin/ld.mc -shared -nostdlib
    /system/lib64/libcompiler_rt.so -mtriple=aarch64-none-linux-gnueabi
    --library-path=/system/vendor/lib64 --library-path=/system/lib64
    -lRSDriver -lm -lc
    /data/user/0/com.android.rs.test/code_cache/com.android.renderscript.cache/primitives.o
    -o
    /data/user/0/com.android.rs.test/code_cache/com.android.renderscript.cache/librs.primitives.so'
  ld.mc   : type=1400 audit(0.0:1340): avc: denied { read } for name="lib64" dev="mmcblk0p24" ino=212 scontext=u:r:untrusted_app:s0:c512,c768 tcontext=u:object_r:system_file:s0 tclass=dir permissive=0
  ld.mc   : type=1400 audit(0.0:1341): avc: denied { read } for name="lib64" dev="mmcblk0p29" ino=1187 scontext=u:r:untrusted_app:s0:c512,c768 tcontext=u:object_r:system_file:s0 tclass=dir permissive=0
  RenderScript: Child process "/system/bin/ld.mc" terminated with status 256

Change-Id: I9fb989f66975ed553dbc0c49e9c5b5e5bc45b3c3
 2016-01-23 08:41:47 -08:00
dcashman
ee25c98428 Remove domain_deprecated from untrusted_app. am: cbf7ba18db 
am: b768bd4642

* commit 'b768bd4642afb99f5ffaad46833e47c785667e3e':
  Remove domain_deprecated from untrusted_app.
 2016-01-23 01:04:30 +00:00
dcashman
0503a40570 Temporarily allow untrusted_app to read proc files. am: 2193f766bc 
am: d7ff314ada

* commit 'd7ff314adabc5646e77b844335408201811412d9':
  Temporarily allow untrusted_app to read proc files.
 2016-01-23 01:04:27 +00:00
dcashman
b768bd4642 Remove domain_deprecated from untrusted_app. 
am: cbf7ba18db

* commit 'cbf7ba18db3c607834d3f8d0745dae99f3e2a4ec':
  Remove domain_deprecated from untrusted_app.
 2016-01-23 00:03:24 +00:00
dcashman
d7ff314ada Temporarily allow untrusted_app to read proc files. 
am: 2193f766bc

* commit '2193f766bc1c7f997906a365238eb80839eb2617':
  Temporarily allow untrusted_app to read proc files.
 2016-01-23 00:03:21 +00:00
dcashman
cbf7ba18db Remove domain_deprecated from untrusted_app. 
Bug: 22032619
Change-Id: Iaa192f98df3128da5e11ce1fd3cf9d1a597fedf5
 2016-01-22 15:51:41 -08:00
dcashman
2193f766bc Temporarily allow untrusted_app to read proc files. 
Address the following denial:
01-22 09:15:53.998  5325  5325 W ChildProcessMai: type=1400 audit(0.0:44): avc: denied { read } for name="meminfo" dev="proc" ino=4026535444 scontext=u:r:untrusted_app:s0:c512,c768 tcontext=u:object_r:proc:s0 tclass=file permissive=0

Change-Id: Id2db5ba09dc9de58e6da7c213d4aa4657c6e655c
 2016-01-22 15:49:42 -08:00
James Hawkins
7060411a28 Merge "bootstat: Implement the SELinux policy to allow reading/writing to /data/misc/bootstat." am: 447041a940 
am: 701b7d3cae

* commit '701b7d3cae0cc2546e85fcfdc706c230713a517a':
  bootstat: Implement the SELinux policy to allow reading/writing to /data/misc/bootstat.
 2016-01-22 18:32:26 +00:00
dcashman
67211b022b resolve merge conflicts of 09f01c5f1d to master. 
Change-Id: Ia6fa29637a3679836c61800d6a1cbe2917e8c43e
 2016-01-22 10:21:19 -08:00
James Hawkins
701b7d3cae Merge "bootstat: Implement the SELinux policy to allow reading/writing to /data/misc/bootstat." 
am: 447041a940

* commit '447041a94010974be3ddcb321da4f991c8add3fd':
  bootstat: Implement the SELinux policy to allow reading/writing to /data/misc/bootstat.
 2016-01-22 18:10:57 +00:00
dcashman
09f01c5f1d Allow access to /dev/ion and proc_net dir. 
am: 8666bf25cf

* commit '8666bf25cf5de7c0bddfe858342dabfeea5ff823':
  Allow access to /dev/ion and proc_net dir.
 2016-01-22 18:08:07 +00:00
James Hawkins
447041a940 Merge "bootstat: Implement the SELinux policy to allow reading/writing to /data/misc/bootstat." 2016-01-22 18:05:25 +00:00
dcashman
8666bf25cf Allow access to /dev/ion and proc_net dir. 
Address the following:
01-21 13:35:41.147  5896  5896 W ndroid.music:ui: type=1400 audit(0.0:22): avc: denied { read } for name="ion" dev="tmpfs" ino=1237 scontext=u:r:untrusted_app:s0:c512,c768 tcontext=u:object_r:ion_device:s0 tclass=chr_file permissive=0
01-21 13:35:41.152  5896  5896 E qdmemalloc: open_device: Failed to open ion device - Permission denied
01-21 13:35:41.152  5896  5896 E qdgralloc: Could not mmap handle 0x7f827d7260, fd=55 (Permission denied)
01-21 13:35:41.152  5896  5896 E qdgralloc: gralloc_register_buffer: gralloc_map failed

and

01-22 08:58:47.667  7572  7572 W Thread-23: type=1400 audit(0.0:186): avc: denied { search } for name="xt_qtaguid" dev="proc" ino=4026535741 scontext=u:r:untrusted_app:s0:c512,c768 tcontext=u:object_r:proc_net:s0 tclass=dir permissive=0
01-22 08:58:47.671  7498  7572 I qtaguid : Untagging socket 68 failed errno=-13
01-22 08:58:47.671  7498  7572 W NetworkManagementSocketTagger: untagSocket(68) failed with errno -13

Change-Id: Id4e253879fe0f6daadd04d148a257a10add68d38
 2016-01-22 09:29:00 -08:00
James Hawkins
39c198ac6f bootstat: Implement the SELinux policy to allow reading/writing to 
/data/misc/bootstat.

BUG: 21724738
Change-Id: I2789f57cc8182af1a7c33672ef82297f32f54e2e
 2016-01-22 08:08:37 -08:00
Jeffrey Vander Stoep
0c34837e08 Merge "Allow domains to stat filesystems." am: e1224de04d 
am: f6da64bfb3

* commit 'f6da64bfb320878a225ea3ecb288cb8ac8dbd623':
  Allow domains to stat filesystems.
 2016-01-22 00:47:35 +00:00
Jeff Vander Stoep
14c17ebd07 vold launched e2fsck must run in fsck domain am: 67d9932c67 
am: 32eff0cb0d

* commit '32eff0cb0d4d78752b58b0e05f63c0715666a94e':
  vold launched e2fsck must run in fsck domain
 2016-01-22 00:47:30 +00:00
Jeffrey Vander Stoep
f6da64bfb3 Merge "Allow domains to stat filesystems." 
am: e1224de04d

* commit 'e1224de04d9c6ea52e753151441cdb378891cf6f':
  Allow domains to stat filesystems.
 2016-01-22 00:45:03 +00:00
Jeffrey Vander Stoep
e1224de04d Merge "Allow domains to stat filesystems." 2016-01-22 00:27:50 +00:00
Jeff Vander Stoep
32eff0cb0d vold launched e2fsck must run in fsck domain 
am: 67d9932c67

* commit '67d9932c6744885ee0ef3bab61bbae3b8f16de9b':
  vold launched e2fsck must run in fsck domain
 2016-01-22 00:17:58 +00:00
Jeffrey Vander Stoep
911292ee13 Merge "fsck: allow e2fsck to stat swap_block_device" am: 792622c383 
am: 26164a6331

* commit '26164a6331509d6bc7d192f879af0a9b60bce7a7':
  fsck: allow e2fsck to stat swap_block_device
 2016-01-22 00:03:55 +00:00
Jeffrey Vander Stoep
26164a6331 Merge "fsck: allow e2fsck to stat swap_block_device" 
am: 792622c383

* commit '792622c383928df03617ef472b15453dde8ace93':
  fsck: allow e2fsck to stat swap_block_device
 2016-01-21 23:49:18 +00:00
Jeff Vander Stoep
67d9932c67 vold launched e2fsck must run in fsck domain 
Bug: 22821100
Change-Id: I549abfd31f7286ad50be3adeadaf559816c0ee38
 2016-01-21 23:33:32 +00:00
Jeffrey Vander Stoep
792622c383 Merge "fsck: allow e2fsck to stat swap_block_device" 2016-01-21 23:26:27 +00:00
dcashman
fcea726390 Allow domains to stat filesystems. 
Address the following denials:
01-21 12:44:53.704  4595  4595 W ndroid.calendar: type=1400 audit(0.0:21): avc: denied { getattr } for name="/" dev="dm-0" ino=2 scontext=u:r:untrusted_app:s0:c512,c768 tcontext=u:object_r:labeledfs:s0 tclass=filesystem permissive=0
01-21 12:45:23.177  5544  5544 W roid.music:main: type=1400 audit(0.0:46): avc: denied { getattr } for name="/" dev="rootfs" ino=1 scontext=u:r:untrusted_app:s0:c512,c768 tcontext=u:object_r:rootfs:s0 tclass=filesystem permissive=0
7618 W .android.chrome: type=1400 audit(0.0:413): avc: denied { getattr } for path="/" dev="rootfs" ino=1 scontext=u:r:untrusted_app:s0:c512,c768 tcontext=u:object_r:rootfs:s0 tclass=dir permissive=0

01-21 12:44:53.709  4595  4595 D AndroidRuntime: Shutting down VM
01-21 12:44:53.727  4595  4595 E AndroidRuntime: FATAL EXCEPTION: main
01-21 12:44:53.727  4595  4595 E AndroidRuntime: Process: com.google.android.calendar, PID: 4595
01-21 12:44:53.727  4595  4595 E AndroidRuntime: java.lang.RuntimeException: Unable to get provider com.google.android.syncadapters.calendar.timely.TimelyProvider: java.lang.IllegalArgumentException: Invalid path: /data
01-21 12:44:53.727  4595  4595 E AndroidRuntime: 	at android.app.ActivityThread.installProvider(ActivityThread.java:5550)
...

Change-Id: I0e9d65438d031e19c9abc5dca8969ed4356437a0
 2016-01-21 15:18:39 -08:00
Jeff Vander Stoep
d644f26066 fsck: allow e2fsck to stat swap_block_device 
In libext2fs ext2fs_check_mount_point() calls is_swap_device() to
verify that a device is swap before setting the EXT2_MF_SWAP mount
flag.

Addresses:
avc: denied { getattr } for path="/dev/block/zram0" dev="tmpfs" ino=9951
scontext=u:r:fsck:s0 tcontext=u:object_r:swap_block_device:s0 tclass=blk_file

Bug: 22821100
Change-Id: Ic7a1b6f83b34a40bf4bd35a1564300c58ca27089
 2016-01-21 14:43:36 -08:00
Jeffrey Vander Stoep
9b16fbb99e Merge "vold: allow execute cp and rm" am: 352e63546f 
am: 0bbe2ffff9

* commit '0bbe2ffff92d0eaa2e13d0dbc96a66fdbc84bcf6':
  vold: allow execute cp and rm
 2016-01-21 20:15:15 +00:00
Jeffrey Vander Stoep
0bbe2ffff9 Merge "vold: allow execute cp and rm" 
am: 352e63546f

* commit '352e63546f4786d5774a67a30a1de5afc224584b':
  vold: allow execute cp and rm
 2016-01-21 20:13:25 +00:00
Jeffrey Vander Stoep
352e63546f Merge "vold: allow execute cp and rm" 2016-01-21 20:07:53 +00:00
Jeff Vander Stoep
d1f8f731ea vold: allow execute cp and rm 
Used in system/vold/MoveTask.cpp

Addresses:
avc: denied { execute } for name="toolbox" dev="mmcblk0p29" ino=359 scontext=u:r:vold:s0 tcontext=u:object_r:toolbox_exec:s0 tclass=file permissive=1
avc: denied { read open } for path="/system/bin/toolbox" dev="mmcblk0p29" ino=359 scontext=u:r:vold:s0 tcontext=u:object_r:toolbox_exec:s0 tclass=file permissive=1
avc: denied { execute_no_trans } for path="/system/bin/toolbox" dev="mmcblk0p29" ino=359 scontext=u:r:vold:s0 tcontext=u:object_r:toolbox_exec:s0 tclass=file permissive=1

Change-Id: I2eb6288aaed510ae5be0f3605088ace6b865ef83
 2016-01-21 11:02:02 -08:00
Jeffrey Vander Stoep
0f10bd0acb Merge "system_app: remove perms to write to system_data_file" am: db634aa0ac 
am: c199f0a6a4

* commit 'c199f0a6a4b1819b7f7d43cc76b1d62860e9fa66':
  system_app: remove perms to write to system_data_file
 2016-01-21 18:59:56 +00:00
Jeffrey Vander Stoep
c199f0a6a4 Merge "system_app: remove perms to write to system_data_file" 
am: db634aa0ac

* commit 'db634aa0acb5c3671d15923102c573778f61d855':
  system_app: remove perms to write to system_data_file
 2016-01-21 18:55:49 +00:00