tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
15432 commits 1 branch 0 tags 50 MiB
Commit graph

190 commits

Author SHA1 Message Date
sqian
64839e874b Add sepolicy for radio sap 1.2 
Bug: 74114758
Test: Checked radio-service and sap-service is on the lshal after running the service
Change-Id: I1b18711286e000a7d17664e7d3a2045aeeb8c285
 2018-04-11 01:40:37 +00:00
TreeHugger Robot
13c46ef54c Merge "Hide denial for wpa_supplicant writing to /data/misc/wifi." into pi-dev 2018-03-12 22:35:29 +00:00
Joel Galenson
e7cad6cdc2 Hide denial for wpa_supplicant writing to /data/misc/wifi. 
It should instead write to /data/vendor/wifi.

Bug: 36645291
Test: Built policy.
Change-Id: Ib7ba3477fbc03ebf07b886c60bcf4a64b954934a
(cherry picked from commit cc9b30a1cd)
 2018-03-12 13:24:52 -07:00
TreeHugger Robot
7cfabb12be Merge "Ensure taking a bugreport generates no denials." into pi-dev 2018-03-12 20:19:01 +00:00
TreeHugger Robot
37666db3ff Merge "Revert "Revert "Move rild from public to vendor.""" into pi-dev 2018-03-12 20:02:01 +00:00
Amit Mahajan
312248ff72 Revert "Revert "Move rild from public to vendor."" 
This reverts commit 016f0a58a9.

Reason for revert: Was temporarily reverted, merging back in with fix.

Bug: 74486619
Bug: 36427227
Change-Id: Ide68726a90d5485c2758673079427407aee1e4f2
 2018-03-12 17:12:53 +00:00
TreeHugger Robot
cb4e3b77ca Merge "Revert "Move rild from public to vendor."" into pi-dev 2018-03-12 00:01:17 +00:00
Jeffrey Vander Stoep
016f0a58a9 Revert "Move rild from public to vendor." 
This reverts commit eeda6c6106.

Reason for revert: broken presubmit tests

Bug: 74486619
Change-Id: I103c3faa1604fddc27b3b4602b587f2d733827b1
 2018-03-11 20:46:50 +00:00
TreeHugger Robot
910f63f9ee Merge "Move rild from public to vendor." into pi-dev 2018-03-09 22:42:30 +00:00
Amit Mahajan
eeda6c6106 Move rild from public to vendor. 
Also change the neverallow exceptions to be for hal_telephony_server
instead of rild.

Test: Basic telephony sanity, treehugger
Bug: 36427227
Change-Id: If892b28416d98ca1f9c241c5fcec70fbae35c82e
 2018-03-08 12:50:13 -08:00
TreeHugger Robot
178d0adbfc Merge "Add secure_element_device" into pi-dev 2018-03-08 17:53:28 +00:00
Joel Galenson
ba0c279de4 Ensure taking a bugreport generates no denials. 
This commit adds new SELinux permissions and neverallow rules so that
taking a bugreport does not produce any denials.

Bug: 73256908
Test: Captured bugreports on Sailfish and Walleye and verified
that there were no denials.

Merged-In: If3f2093a2b51934938e3d7e5c42036b2e2bf6de9
Change-Id: If3f2093a2b51934938e3d7e5c42036b2e2bf6de9
(cherry picked from commit daf1cdfa5a)
 2018-03-08 02:25:18 +00:00
Ruchi Kandoi
e0e2342e16 Add secure_element_device 
Test: eSE initializes at boot
Bug: 64881253
Change-Id: Ib2388b7368c790c402c000adddf1488bee492cce
(cherry picked from commit ea3cf0007e)
 2018-03-07 13:54:21 -08:00
Daichi Ueura
e029085840 sepolicy(hostapd): Allow socket based control iface 
Update sepolicy permission to allow hostapd to setup
socket for socket based control interface.

Sepolicy denial for accessing /data/vendor/wifi/hostapd/ctrl:
02-23 12:32:06.186  3068  3068 I hostapd : type=1400 audit(0.0:36):
avc: denied { create } for name="ctrl"
scontext=u:r:hal_wifi_hostapd_default:s0
tcontext=u:object_r:hostapd_data_file:s0 tclass=dir permissive=1

02-23 12:32:06.186  3068  3068 I hostapd : type=1400 audit(0.0:37):
avc: denied { setattr } for name="ctrl" dev="sda35" ino=131410
scontext=u:r:hal_wifi_hostapd_default:s0
tcontext=u:object_r:hostapd_data_file:s0 tclass=dir permissive=1

02-23 12:32:06.190  3068  3068 I hostapd : type=1400 audit(0.0:38):
avc: denied { create } for name="wlan0"
scontext=u:r:hal_wifi_hostapd_default:s0
tcontext=u:object_r:hostapd_data_file:s0 tclass=sock_file permissive=1

02-23 12:32:06.190  3068  3068 I hostapd : type=1400 audit(0.0:39):
avc: denied { setattr } for name="wlan0" dev="sda35" ino=131411
scontext=u:r:hal_wifi_hostapd_default:s0
tcontext=u:object_r:hostapd_data_file:s0 tclass=sock_file permissive=1

Bug: 73419160
Test: Manual check that softAp works
Change-Id: I2e733e168feceeab2d557f7704832c143e352375
 2018-03-05 20:12:47 +00:00
Joel Galenson
0c272518c6 Dontaudit denials caused by race with labeling. am: f7ec413844 am: 67057bd934 
am: 9680dcdebc

Change-Id: I8bacd8b10c3bd94824cf860a1290e92caafbd4f0
 2018-02-16 01:03:25 +00:00
Joel Galenson
f7ec413844 Dontaudit denials caused by race with labeling. 
These denials seem to be caused by a race with the process that labels
the files.  While we work on fixing them, hide the denials.

Bug: 68864350
Bug: 70180742
Test: Built policy.
Change-Id: I58a32e38e6384ca55e865e9575dcfe7c46b2ed3c
 2018-02-14 17:07:13 -08:00
Pavel Grafov
54c9dafb5e Allow wpa_supplicant to read security logging property. 
This is needed to allow it to log audit events, e.g. cert
validation failure.

Bug: 70886042
Test: manual, attempt connecting to EAP-TLS wifi with bad cert.
Merged-In: Ia1b0f3c6e02697fdb5018082d5c851f116013fb1
Change-Id: Ia1b0f3c6e02697fdb5018082d5c851f116013fb1
 2018-02-14 17:07:35 +00:00
Pavel Grafov
fb22704002 Allow wpa_supplicant to read security logging property. 
This is needed to allow it to log audit events, e.g. cert
validation failure.

Bug: 70886042
Test: manual, attempt connecting to EAP-TLS wifi with bad cert.
Change-Id: Ia1b0f3c6e02697fdb5018082d5c851f116013fb1
 2018-02-14 13:45:00 +00:00
Tom Cherry
13ad150ceb Prevent vendor_init from using binder or sockets am: a099830e3d am: 40e15ab342 
am: 4f0b721c29

Change-Id: I904afb67ec4c38e5c1d214edfd9f34473e92c6ba
 2018-02-12 16:54:03 +00:00
Tom Cherry
a099830e3d Prevent vendor_init from using binder or sockets 
Bug: 72809699
Test: build
Change-Id: Ifb66ad13557af7d2dc6d3ef823e326a5fba51b24
 2018-02-09 19:32:59 +00:00
Andrew Scull
64f35fa01e authsecret HAL policies. 
Bug: 71527305
Test: compile and boot
Change-Id: I91097bd62d99b8dd9eb6f53060badbaf0f4b8b4a
(cherry picked from commit 1aedf4b5f8)
 2018-02-05 11:19:46 +00:00
Ruchi Kandoi
b3411068cd Add sepolicy for NFC 1.1 HAL service am: 0be3fbf5b2 am: 2f09bc16d1 
am: be3d06b7f8

Change-Id: Idd1606fd9316772ff69429bee6dc39191d9aab2a
 2018-01-31 21:45:22 +00:00
Ruchi Kandoi
0be3fbf5b2 Add sepolicy for NFC 1.1 HAL service 
Bug: 72746517
Test: Boot a device and check NFC 1.1 service loads
Change-Id: Ia281af8add0371525971f076bf513c694e7ea912
 2018-01-31 11:18:35 -08:00
Joel Galenson
0644a001da Merge "Clean up bug_map." am: 31f2ec19e8 am: 3d909ec13d 
am: b24abc012b

Change-Id: I3dab03795ff9f7b5709e2a10bced6445da6e09f0
 2018-01-31 17:50:40 +00:00
Treehugger Robot
31f2ec19e8 Merge "Clean up bug_map." 2018-01-31 17:32:27 +00:00
Joel Galenson
26ccebd74a Clean up bug_map. 
Remove bugs that have been fixed, re-map duped bugs, and alphabetize
the list.

Test: Booted Walleye and Sailfish, tested wifi and camera, and
observed no new denials.

Change-Id: I94627d532ea13f623fe29cf259dd404bfd850c13
 2018-01-30 15:01:54 -08:00
Jeff Vander Stoep
8be8322b78 Correctly label data types 
Data outside /data/vendor must have the core_data_file_type
attribute.

Test: build (this is a build time test)
Bug: 34980020
Change-Id: Ia727fcad813d5fcfbe8f714246364bae0bda43bd
Merged-In: Ibacfcc938deab40096b54b8d0e608d53ca91b947
 2018-01-30 13:18:06 -08:00
Ruchi Kandoi
1c57b81c1e Merge "SE Policy for Secure Element app and Secure Element HAL" am: 6a60cb3e69 am: f285f2db4b 
am: 4757882300

Change-Id: I36147d7f0359cef7f80ee36086150936bed2e672
 2018-01-30 01:26:15 +00:00
Ruchi Kandoi
8a2b4a783e SE Policy for Secure Element app and Secure Element HAL 
Test: App startup on boot
Change-Id: I7740aafc088aadf676328e3f1bb8db5175d97102
 2018-01-29 21:31:42 +00:00
yinxu
9a786ae738 Merge "Add sepolicy for radio.config" am: 2638cd2c96 am: 2af6b8602c 
am: ec5ab9db31

Change-Id: I808c3b1f4abe806b2e3ae558a01206368359edc0
 2018-01-25 04:19:17 +00:00
Jeffrey Vander Stoep
20897145c0 Merge "wpa_supplicant: move control sockets to /data/vendor" 2018-01-25 00:57:23 +00:00
yinxu
612350e34f Add sepolicy for radio.config 
Bug: 64131518
Test: Compile and flash the device, check whether service vendor.radio-config-hal-1-0 starts
Change-Id: Id728658b4acdda87748259b74e6b7438f6283ea5
 2018-01-24 12:13:10 -08:00
Janis Danisevskis
f5ea7ab181 Added default policy for Confirmation UI HAL am: 97c56bdd78 am: 5029fe7236 
am: a2f243dc35

Change-Id: I670465743596b35c37a4ca591e5a8f4848222bb9
 2018-01-24 20:09:47 +00:00
Janis Danisevskis
97c56bdd78 Added default policy for Confirmation UI HAL 
Bug: 63928580
Test: Manually tested.

Change-Id: If6bb10cb7c009883d853e46dcdeb92cd33877d53
 2018-01-24 10:22:40 -08:00
Jeff Vander Stoep
b1590adc2f wpa_supplicant: move control sockets to /data/vendor 
Treble compliance.

Bug: 70228425
Bug: 70393317
Test: complete wifi test in b/70393317
Test: Test wifi on Taimen and Sailfish
Test: verify sockets exist in /data/vendor/wifi/wpa/sockets
Change-Id: I217c0eda0e5af50bb603cfcc35d60bf0d9cad72e
 2018-01-24 08:50:24 -08:00
Andrew Scull
8d11ef5a37 Merge "authsecret HAL policies." 2018-01-23 17:43:59 +00:00
Yin-Chia Yeh
973201891e Camera: add external camera service am: 30793234f6 am: d8f10c505e 
am: 500ecf7517

Change-Id: I8066f0f196891ccd02324588fbdfacda8d8cf2ac
 2018-01-22 05:51:03 +00:00
Yin-Chia Yeh
30793234f6 Camera: add external camera service 
Change-Id: I37695d6c952b313e641dd145aa1af1d02e9cc537
 2018-01-21 16:25:07 -08:00
Roshan Pius
5bca3e860d sepolicy(hostapd): Add a HIDL interface for hostapd 
Change sepolicy permissions to now classify hostapd as a HAL exposing
HIDL interface.

Sepolicy denial for accessing /data/vendor/misc/wifi/hostapd:
12-27 23:40:55.913  4952  4952 W hostapd : type=1400 audit(0.0:19): avc:
denied { write } for name="hostapd" dev="sda13" ino=4587601
scontext=u:r:hal_wifi_hostapd_default:s0
tcontext=u:object_r:system_data_file:s0 tclass=dir permissive=0

01-02 19:07:16.938  5791  5791 W hostapd : type=1400 audit(0.0:31): avc:
denied { search } for name="net" dev="sysfs" ino=30521
scontext=u:r:hal_wifi_hostapd_default:s0
tcontext=u:object_r:sysfs_net:s0 tclass=dir permissive=0

Bug: 36646171
Test: Device boots up and able to turn on SoftAp.
Change-Id: Ibacfcc938deab40096b54b8d0e608d53ca91b947
 2018-01-12 14:05:38 -08:00
Andrew Scull
1aedf4b5f8 authsecret HAL policies. 
Bug: 71527305
Test: compile and boot
Change-Id: I91097bd62d99b8dd9eb6f53060badbaf0f4b8b4a
 2018-01-10 16:26:44 +00:00
Jeff Tinker
d2ad36f902 Merge "Allow default drm hal to access allocator hal" am: 0eb0a7bb5b am: f5468cd454 
am: 4648fb1bdb

Change-Id: I70580eebfccd2673b475b093845e313bcd140d02
 2018-01-04 04:26:50 +00:00
Treehugger Robot
0eb0a7bb5b Merge "Allow default drm hal to access allocator hal" 2018-01-04 04:12:19 +00:00
Jeff Tinker
e1a7190f51 Allow default drm hal to access allocator hal 
This fixes failing vts drm tests

bug:67675811

Test:vts-tradefed run commandAndExit vts -m VtsHalDrmV1_0Target
Change-Id: I2f7e1c97e8c70fc312ca3c2c901f0a9607b05e83
 2018-01-03 23:44:05 +00:00
Shawn Willden
6e0c071d4c Merge "Add file context for keymaster 4.0 service." am: 4dd97a0bb8 am: 2ea1f6fda5 
am: b1deb4951f

Change-Id: I1b348ad385e48279d6ef339925d686c505f90ccd
 2018-01-03 21:53:38 +00:00
Shawn Willden
219c66c1f0 Add file context for keymaster 4.0 service. 
Test: Boot the device
Change-Id: Ia468941e78803edebe311c73f424a41ac1faeaee
 2018-01-03 10:56:06 -07:00
Tomasz Wasilczyk
222a1fd559 Merge "Add broadcast radio HAL 2.0 default implementation to the sepolicy." am: 6413f9dadc am: 8689d5b84d 
am: b1a960f649

Change-Id: Idb2e1d0a5d1d2fe69e5bee6eedc98def69ab73bd
 2017-12-09 00:04:33 +00:00
Tomasz Wasilczyk
4f7bb7576a Add broadcast radio HAL 2.0 default implementation to the sepolicy. 
Test: VTS
Bug: 69958777
Change-Id: I6db7dd9afc9c7f254a0233ff3144b02e48727038
 2017-12-07 09:48:16 -08:00
Jeff Vander Stoep
5b557888dd Move platform/vendor data violations to device policy 
Sharing data folders by path will be disallowed because it violates
the approved API between platform and vendor components tested by
VTS. Move all violating permissions from core selinux policy to
device specific policy so that we can exempt existing devices from
the ban and enforce it on new devices.

Bug: 34980020
Test: Move permissions. Build and test wifi, wifi AP, nfc, fingerprint
    and Play movies on Marlin and Taimen.
Test: build on Angler, Bullhead, Dragon, Fugu, Marlin, Walleye

(cherry picked from commit ba2130a882)

Change-Id: Iaedbbe31237822cf3348209028bba45ad85465f8
 2017-11-22 08:59:08 -08:00
Michael Wright
d8b864cb41 Revert "Move platform/vendor data violations to device policy" 
This reverts commit ba2130a882.

Test: lunch elfin-userdebug && m -j
Change-Id: I83e8a37cac97e2f994fd2defb94888ec73b41f3b
 2017-11-22 13:59:40 +00:00
Jeffrey Vander Stoep
69420280c9 Merge "Move platform/vendor data violations to device policy" 2017-11-22 04:57:32 +00:00