tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
11952 commits 1 branch 0 tags 50 MiB
Commit graph

11952 commits

This branch
This branch
All branches
Author SHA1 Message Date
Jin Qian
0e479700b5 Revert "allow recovery to run mke2fs tools" 
This reverts commit 7e57731898.
 2017-07-05 12:11:48 -07:00
Dan Cashman
2e8cebe6e7 Add compat changes for tracing_shell_writable removal. 
Commits 7fa51593c8 and
92fdd8954f removed the
tracing_shell_writable and tracing_shell_writable_debug types, and
relabeled the files with debugfs_tracing and debugfs_tracing_debug,
respectively.  Record this in the compatibility file so that vendor
policy using these types will still work.

Bug: 62573845
Test: None. Prebuilt change only.
Change-Id: Ic6573518035514a86abe2081483431427612699e
 2017-07-05 09:41:49 -07:00
Dan Cashman
ebea2b459c Record netd_stable_secret_prop in compat infra. 
Commit: abb1ba6532 added policy for a
new property, which was not present in O.  This policy introduced a
new type.  Record it as such.

Bug: 62573845
Test: None, prebuilt change only.
Change-Id: I7d90cd69a5e6e29677598cc109676d5b1ce5ba05
 2017-07-05 09:18:14 -07:00
Dan Cashman
3eed3eacfb Map mediaprovider to priv_app in 26.0 compat mapping 
Commit: bde5c8013d added a new type,
mediaprovider, which is being applied to an object (process) formerly
labeled as priv_app. Add the new type to the versioned attribute for
priv_app so that any vendor policy written for interaction with
mediaprovider continues to work.

Bug: 62573845
Test: None.  Prebuilt-only change.
Change-Id: Id98293369401a2af23c2328a1cb4a5bb2258aac8
 2017-07-05 09:16:48 -07:00
Dan Cashman
e78e8dcf11 Record timezone_service in compat infra. 
Commit: 50889ce0eb added policy for a
new service, which was not present in O.  This policy introduced a
new type.  Record it as such.

Bug: 62573845
Test: None, prebuilt change only.
Change-Id: If9cfaff813c47d3b1c8374e8abfb4aedb902d486
 2017-07-05 09:15:21 -07:00
Dan Cashman
b1c4967e8a Record tombstoned_java_trace_socket in compat record. 
Commit: 11bfcc1e96 added policy for
a new socket which was not present in O.  This socket has a new
type associated with it.  Record the type as a new type so that
compatibility testing will not complain.

Bug: 62573845
Test: None, prebuilt change only.
Change-Id: I375fc9ca0bd201e277a0302d9b34c0da0eb40fbd
 2017-07-05 09:13:50 -07:00
Dan Cashman
f875ee074c Add compat changes for e2fs addition. 
Commit 5f573ab2aa added policy for
the additions of upstream fs tools.  Make sure the new types are
denoted as such (no object relabeling needs to be done) and that
objects which are relabeled are.

Bug: 35219933
Bug: 62573845
Test: None. Prebuilt change only.
Change-Id: I6515e05ebc60ca08e98029f471cf2861826036fc
 2017-07-05 09:11:28 -07:00
Nick Kralevich
141ac20664 resolve merge conflicts of a92d3135 to stage-aosp-master am: b748e652e9 am: aa33afc90d 
am: 46f2dcb18e  -s ours

Change-Id: Ide86623fdfb3567df3ca5825a9e5cb5cb9e03b79
 2017-07-03 07:26:47 +00:00
Nick Kralevich
46f2dcb18e resolve merge conflicts of a92d3135 to stage-aosp-master am: b748e652e9 
am: aa33afc90d

Change-Id: I39b6028f7960b13af1fd83cbfa0f7fec4cac1bab
 2017-07-03 07:23:47 +00:00
Nick Kralevich
aa33afc90d resolve merge conflicts of a92d3135 to stage-aosp-master 
am: b748e652e9

Change-Id: I4cd3587232e426b2684c77a7cb548b006f6f8647
 2017-07-03 07:20:17 +00:00
Nick Kralevich
b748e652e9 resolve merge conflicts of a92d3135 to stage-aosp-master 
Test: Policy compiles.
Change-Id: Iaa19c64f6b54423dbfa5ae16d288501ab0e64cbc
 2017-07-02 22:26:12 -07:00
Treehugger Robot
a92d313561 Merge "recovery: clean up audit logspam" 2017-07-03 03:55:41 +00:00
Jeff Sharkey
bb145d2191 Merge "Allow installd to delete files via sdcardfs." am: a6f6295cdb am: b41291f57e am: 6433a09c3b 
am: 5b277641ba

Change-Id: I01eefcff7299c87e95fa2fb90dd69d7d5c63f40e
 2017-07-03 03:15:31 +00:00
Jeff Sharkey
5b277641ba Merge "Allow installd to delete files via sdcardfs." am: a6f6295cdb am: b41291f57e 
am: 6433a09c3b

Change-Id: I2efd5ff367424b86ea336ad0a4bb56eca368f4f2
 2017-07-03 03:12:31 +00:00
Jeff Sharkey
6433a09c3b Merge "Allow installd to delete files via sdcardfs." am: a6f6295cdb 
am: b41291f57e

Change-Id: I8e1151461bdd5a47cc81a9be744a8918bb61560a
 2017-07-03 03:09:30 +00:00
Jeff Sharkey
b41291f57e Merge "Allow installd to delete files via sdcardfs." 
am: a6f6295cdb

Change-Id: I0c54b62288aa73842a9f0dc8fa0f9a5c8e64bc98
 2017-07-03 03:06:31 +00:00
Treehugger Robot
a6f6295cdb Merge "Allow installd to delete files via sdcardfs." 2017-07-03 03:02:15 +00:00
Jeffrey Vander Stoep
b9669f6c26 Merge "Add SEPolicy for new Java-based Broadcast Radio service." am: 6466092f18 am: f44267a5a8 am: 739f75987b 
am: c6ef555e96

Change-Id: Ic93ebe3cc8148eee16334ff57674ed961d00afb5
 2017-07-03 02:55:19 +00:00
Jeff Vander Stoep
8d959fc999 domain_deprecated: remove ion access am: 88e4be54a6 am: 8745ac4363 am: c8338f2669 
am: efb5a5ba15

Change-Id: Ie2461f25e7ac409837c84d7f467b63d4f23d918f
 2017-07-03 02:55:01 +00:00
Jeffrey Vander Stoep
c6ef555e96 Merge "Add SEPolicy for new Java-based Broadcast Radio service." am: 6466092f18 am: f44267a5a8 
am: 739f75987b

Change-Id: I0e63a008436b860549cdc687276c33df475afa77
 2017-07-03 02:52:13 +00:00
Jeff Vander Stoep
efb5a5ba15 domain_deprecated: remove ion access am: 88e4be54a6 am: 8745ac4363 
am: c8338f2669

Change-Id: Id3db0306763ca605dcdf11409f3b591d6ceda312
 2017-07-03 02:51:59 +00:00
Jeffrey Vander Stoep
739f75987b Merge "Add SEPolicy for new Java-based Broadcast Radio service." am: 6466092f18 
am: f44267a5a8

Change-Id: Iea0f7ef8960d89d19451b7a47dc1852155dd3af9
 2017-07-03 02:49:41 +00:00
Jeff Vander Stoep
c8338f2669 domain_deprecated: remove ion access am: 88e4be54a6 
am: 8745ac4363

Change-Id: I6816eea55ad110d7aeea43ec3088452b38b7ccc7
 2017-07-03 02:49:29 +00:00
Jeff Vander Stoep
9bbe420b42 recovery: clean up audit logspam 
avc: granted { search } scontext=u:r:recovery:s0 tcontext=u:object_r:cache_file:s0 tclass=dir
avc: granted { getattr } scontext=u:r:recovery:s0 tcontext=u:object_r:rootfs:s0 tclass=file
avc: granted { read } scontext=u:r:recovery:s0 tcontext=u:object_r:rootfs:s0 tclass=file
avc: granted { read open } scontext=u:r:recovery:s0 tcontext=u:object_r:rootfs:s0 tclass=file
avc: granted { read } scontext=u:r:recovery:s0 tcontext=u:object_r:sysfs:s0 tclass=file
avc: granted { read open } scontext=u:r:recovery:s0 tcontext=u:object_r:sysfs:s0 tclass=file
avc: granted { search } scontext=u:r:recovery:s0 tcontext=u:object_r:tmpfs:s0 tclass=dir

Fixes: 62619253
Test: policy builds, no more "granted" messages in dmesg for recovery.
Merged-In: I3f6d8ceee80307a01a8fd40cb4f8362a9825b1a3
Change-Id: I3f6d8ceee80307a01a8fd40cb4f8362a9825b1a3
(cherry picked from commit ea1d6e7dc2)
 2017-07-03 02:47:49 +00:00
Jeffrey Vander Stoep
f44267a5a8 Merge "Add SEPolicy for new Java-based Broadcast Radio service." 
am: 6466092f18

Change-Id: I856e01d9d06978dfcaf13fff078430cefbc7a9eb
 2017-07-03 02:46:45 +00:00
Jeff Vander Stoep
8745ac4363 domain_deprecated: remove ion access 
am: 88e4be54a6

Change-Id: I064f2becfde44f300ddf9d36802972b35c54e152
 2017-07-03 02:46:30 +00:00
Jeffrey Vander Stoep
6466092f18 Merge "Add SEPolicy for new Java-based Broadcast Radio service." 2017-07-03 02:41:22 +00:00
Jeff Sharkey
dd57e69886 Allow installd to delete files via sdcardfs. 
When installd clears cached files on external storage, the sdcardfs
kernel filesystem needs to be kept in the loop to release any cached
dentries that it's holding onto.  (Otherwise the underlying disk
space isn't actually released.)

installd can already delete the underlying files directly (via the
media_rw_data_file rules), so this technically isn't expanding its
capabilities.

avc: granted { search } for name="/" dev="tmpfs" ino=6897 scontext=u:r:installd:s0 tcontext=u:object_r:tmpfs:s0 tclass=dir
avc: denied { open } for path="/mnt/runtime/default/emulated/0/Android/data" dev="sdcardfs" ino=589830 scontext=u:r:installd:s0 tcontext=u:object_r:sdcardfs:s0 tclass=dir permissive=1
avc: denied { write } for name="com.google.android.inputmethod.japanese" dev="sdcardfs" ino=590040 scontext=u:r:installd:s0 tcontext=u:object_r:sdcardfs:s0 tclass=dir permissive=0
avc: denied { remove_name } for name="cache_r.m" dev="sdcardfs" ino=589868 scontext=u:r:installd:s0 tcontext=u:object_r:sdcardfs:s0 tclass=dir permissive=0
avc: denied { getattr } for path="/mnt/runtime/default/emulated/0/Android/data/.nomedia" dev="sdcardfs" ino=589831 scontext=u:r:installd:s0 tcontext=u:object_r:sdcardfs:s0 tclass=file permissive=1

Test: cts-tradefed run commandAndExit cts-dev -m CtsAppSecurityHostTestCases -t android.appsecurity.cts.StorageHostTest
Bug: 37486230
Change-Id: Icfd00a9ba379b1f50c48fe85849304cf9859bcb2
(cherry picked from commit 72f4c61979)
 2017-07-03 00:34:26 +00:00
Jeff Vander Stoep
88e4be54a6 domain_deprecated: remove ion access 
Logs show that only dumpstate requires access.

avc: granted { read open } for comm="screencap" path="/dev/ion"
dev="tmpfs" ino=14324 scontext=u:r:dumpstate:s0
tcontext=u:object_r:ion_device:s0 tclass=chr_file
avc: granted { ioctl } for comm="screencap" path="/dev/ion" dev="tmpfs"
ino=14324 ioctlcmd=4906 scontext=u:r:dumpstate:s0
tcontext=u:object_r:ion_device:s0 tclass=chr_file

Grant ion permission to dumpstate which uses it for screencap
feature.

Bug: 28760354
Test: build. Check logs.
Change-Id: I6435b7dbf7656669dac5dcfb205cf0aeda93991b
 2017-07-03 00:12:55 +00:00
Jeff Vander Stoep
96f0e1fd6c Remove more domain_deprecated permissions am: e39d5c875e am: 9ce812fbe0 am: 685db0b279 
am: 4b7aa90918

Change-Id: I222af35247d5fc4d99f2cdeca79f86cd0a815739
 2017-07-01 14:48:57 +00:00
Jeff Vander Stoep
4b7aa90918 Remove more domain_deprecated permissions am: e39d5c875e am: 9ce812fbe0 
am: 685db0b279

Change-Id: I5c4ae29b9623ee04f0409c5f2e4da9fb325a430f
 2017-07-01 14:43:57 +00:00
Jeff Vander Stoep
685db0b279 Remove more domain_deprecated permissions am: e39d5c875e 
am: 9ce812fbe0

Change-Id: Ie71e8eb97e3ace63a230fcd70b81961d1a8f4884
 2017-07-01 14:38:56 +00:00
Jeff Vander Stoep
9ce812fbe0 Remove more domain_deprecated permissions 
am: e39d5c875e

Change-Id: Ibdb49f80b11fca40f5c4de7a92780be26b3280eb
 2017-07-01 14:33:56 +00:00
Andres Oportus
880932d95b Merge "Allow only system_server to read uid_time_in_state" am: 439364d20e am: e96aad0998 am: 3ce2c6f866 
am: 2f0d04962a

Change-Id: I0a3b2c00a083bebdf658cd3695d51ed7af21b1ca
 2017-07-01 13:09:12 +00:00
Jeff Vander Stoep
6f842f8aea Merge "Remove adbd tcontexts from domain_deprecated" am: 056710b38a am: 2af7c84fac am: 1a1cefcc96 
am: 902dbafbe8

Change-Id: I2b0c214e4e6842c7e9eb56a28d014c814a9c8670
 2017-07-01 13:08:52 +00:00
Andres Oportus
2f0d04962a Merge "Allow only system_server to read uid_time_in_state" am: 439364d20e am: e96aad0998 
am: 3ce2c6f866

Change-Id: Ic54d118a477d1827952e1c54216ff01838d985d7
 2017-07-01 13:04:04 +00:00
Jeff Vander Stoep
902dbafbe8 Merge "Remove adbd tcontexts from domain_deprecated" am: 056710b38a am: 2af7c84fac 
am: 1a1cefcc96

Change-Id: I93ad1ad5f769f68c856e7a3cfcc0bcd8792633f2
 2017-07-01 13:03:51 +00:00
Andres Oportus
3ce2c6f866 Merge "Allow only system_server to read uid_time_in_state" am: 439364d20e 
am: e96aad0998

Change-Id: I0742836c6b613afeab2dcf6d59c37dd9787dc91a
 2017-07-01 12:59:05 +00:00
Jeff Vander Stoep
1a1cefcc96 Merge "Remove adbd tcontexts from domain_deprecated" am: 056710b38a 
am: 2af7c84fac

Change-Id: Id52f1fd3e79a0a36df42abca24c93b28b277c570
 2017-07-01 12:58:51 +00:00
Andres Oportus
e96aad0998 Merge "Allow only system_server to read uid_time_in_state" 
am: 439364d20e

Change-Id: I726672b2e3379e2e53d3c6b26482147f11d06d8e
 2017-07-01 12:54:07 +00:00
Jeff Vander Stoep
2af7c84fac Merge "Remove adbd tcontexts from domain_deprecated" 
am: 056710b38a

Change-Id: Id44e16b03b1b5398bb4fd73bc4950e5da8acd5b7
 2017-07-01 12:53:51 +00:00
Jeff Vander Stoep
e39d5c875e Remove more domain_deprecated permissions 
Logs indicate no usage of these permissions.

Bug: 28760354
Test: check logs.
Change-Id: I3d75aea6afd4e326f705274ab2790e5d0bbdb367
 2017-07-01 12:49:22 +00:00
Treehugger Robot
439364d20e Merge "Allow only system_server to read uid_time_in_state" 2017-07-01 12:48:41 +00:00
Treehugger Robot
056710b38a Merge "Remove adbd tcontexts from domain_deprecated" 2017-07-01 12:47:40 +00:00
TreeHugger Robot
20a319de4d Merge "file_contexts: allow to run make_f2fs during initial boot-up" 2017-07-01 08:06:24 +00:00
Jeff Vander Stoep
4d5721a5a3 Remove adbd tcontexts from domain_deprecated 
Logs indicate apps, system_server, and runas are the only
domains that require this permission.

Bug: 28760354
Test: check logs.
Change-Id: I93dc53ec2d892bb91c0cd6f5d7e9cbf76b9bcd9f
 2017-07-01 06:30:58 +00:00
Andres Oportus
97b955de13 Allow only system_server to read uid_time_in_state 
Bug: 62706738
Bug: 34133340
Test: Check that uid_time_in_state can't be read from
the shell without root permissions and that
"dumpsys batterystats --checkin| grep ctf" shows frequency
data (system_server was able to read uid_time_in_state)

Change-Id: Ic6a54da4ebcc9e10b0e3af8f14a45d7408e8686e
(cherry picked from commit 4dc88795d0)
 2017-06-30 22:07:57 -07:00
Tomasz Wasilczyk
53bc8bf360 Add SEPolicy for new Java-based Broadcast Radio service. 
Bug: b/36863239
Test: manual
Change-Id: I7e929926efbb1570ea9723ef3810a511c71dc11a
(cherry picked from commit 38f0928fb0)
 2017-06-30 21:38:32 -07:00
Jeff Vander Stoep
e7d7f3ab66 dexoptanalyzer: suppress access(2) denial am: 06aee357e4 am: e8bf363d3f am: 2d74ecde52 
am: 3afd02581a

Change-Id: I5b44585eaf29c8a68e3ea7c0ddfc1e8d8ea8e127
 2017-07-01 00:02:48 +00:00
Jeff Vander Stoep
3afd02581a dexoptanalyzer: suppress access(2) denial am: 06aee357e4 am: e8bf363d3f 
am: 2d74ecde52

Change-Id: I553c794c40406da42f36d64fdd84684d157bccad
 2017-06-30 23:57:38 +00:00