This reverts commit a00863e4d8.
All dependencies for this patch are now merged.
Bug: 184381659
Test: atest
android.security.cts.SELinuxHostTest#testTracefsTypeViolators
Change-Id: Ic268b24222a87cd9f7ff9158eb16a20f1cb3ecbb
Currently simpleperf knows whether an app is debuggable or profileable
by running commands via run-as and simpleperf_app_runner and seeing if
they fail. This isn't convenient. So we want simpleperf_app_runner to
pass app type to simpleperf through pipe fds.
Bug: 186469540
Test: run CtsSimpleperfTestCases.
Change-Id: Ia2d276def83361336bb25d9cf367073a01cb4932
Allow everyone to read /dev/dma_heap so that they can query the set of
available heaps with the GetDmabufHeapList() API in libdmabufheap.
This patch fixes the following denials that happen when clients use the
API:
avc: denied { read } for name="dma_heap" dev="tmpfs" ino=369
scontext=u:r:mediaswcodec:s0 tcontext=u:object_r:dmabuf_heap_device:s0
tclass=dir permissive=0
9507:05-12 17:19:59.567 1647 1647 W com.android.systemui: type=1400
audit(0.0:93): avc: denied { read } for
comm=4E444B204D65646961436F6465635F name="dma_heap" dev="tmpfs" ino=369
scontext=u:r:platform_app:s0:c512,c768
tcontext=u:object_r:dmabuf_heap_device:s0 tclass=dir permissive=0
app=com.android.systemui
Test: manual
Bug: 184397788
Change-Id: I84672bc0be5b409cd49080501d0bf3c269ca610c
Allow the MediaProvider app to write the system property
fuse.passthrough.enabled in case FUSE passthrough is enabled.
The need for this additional system property is due to the ScopedStorage
CTS tests that are assuming FUSE passtrhough is always on for devices
supporting it, but there may be some cases (e.g., GSI mixed builds)
where this is not possible true and the feature is disabled at runtime,
thus causing the tests to fail.
This additional system property is only set when FUSE passthrough is
actually being used by the system.
Bug: 186635810
Test: CtsScopedStorageDeviceOnlyTest
Signed-off-by: Alessio Balsini <balsini@google.com>
Change-Id: I623042d67399253a9167188c3748d93eb0f2d41f
Types defined in system_ext/public or product/public
can be referenced by vendor side so it is important
to make sure functionality is not broken across version
bumps. So we are adding the treble sepolicy test cases
for system_ext and product sepolicy.
Bug: 173571515
Change-Id: Ia45979497029f83b1ae6712d2d26ffab263a7f91
This reverts commit b44e506223.
Reason for revert: secilc is fixed by aosp/1701846, so the workaround is no longer needed
Bug: 183362912
Test: S GSI on R CF boot test
Change-Id: Ic73c7cea1ebe42b483049cbc29f192e738748894
This is to unblock the apex setup.
There is only a system_file in the context, but we might need more
specific ones later.
Bug: 186126404
Test: m
Change-Id: Icf713c9bb92e7f7402c0b45bd0f1b06e9cb35d2b
Add ro.audio.offload_wakelock to audio_config_prop to allow
AudioFlinger to read this property.
Bug: 178789331
Test: build pass, property can be successfully set and read
Signed-off-by: JJ Lee <leejj@google.com>
Change-Id: I4650e03eb0a406b7531c08001adcfebe822bd75b
Marked the fwk_stats_service service as app_api_service so that
it can be reached by apps (also means that it's stable)
Bug: 185789914
Test: Build, flash, boot & and logcat | grep "SELinux"
Change-Id: Ifbb111dbee0429d8aaea4688c0390ee80e25cb22
Bug: 33691272
Test: build with odm and build without odm
Test: boot and see precompiled sepolicy used
Change-Id: Id84cca38f81ba3ecf7480d41a704085c7fff8b87
It is important that fastbootd is able to mount /metadata in recovery, in
order to check whether Virtual A/B snapshots are present. This is
enabled on userdebug builds, but currently fails on user builds.
Fixes:
audit: type=1400 audit(7258310.023:24): avc: denied { mount } for pid=511 comm="fastbootd" name="/" dev="sda15" ino=2 scontext=u:r:fastbootd:s0 tcontext=u:object_r:labeledfs:s0 tclass=filesystem permissive=0
Bug: 181097763
Test: fastboot flash on user build
Change-Id: I1abeeaa3109e08755a1ba44623a46b12d9bfdedc
This reverts commit 231c04b2b9.
Now that b/186727553 is fixed, it should be safe to revert this revert.
Test: build
Bug: 184381659
Change-Id: If26ba23df19e9854a121bbcf10a027c738006515
This reverts commit e95e0ec0a5.
Now that b/186727553 is fixed, it should be safe to revert this revert.
Test: build
Bug: 184381659
Change-Id: Ibea3882296db880f5cafe4f9efa36d79a183c8a1
This is needed to debug hangs in keystore2.
Restricted to debuggable builds for now.
Bug: 186879912
Test: 'adb bugreport', then find the stack traces for keystore2 in the
"VM TRACES JUST NOW" section of the main bugreport file.
Change-Id: I4434cab7e79cb4aae8bbb2e3a8abff02e0073c13
Fixes the following denials:
avc: denied { getattr } for path="/dev/dma_heap/system" dev="tmpfs"
ino=534 scontext=u:r:mediatranscoding:s0
tcontext=u:object_r:dmabuf_system_heap_device:s0 tclass=chr_file
permissive=0
Bug: 185867872
Test: No more DMA-BUF heap related denials from
CtsMediaTranscodingTestCases
Change-Id: I45b57b45e0db996f08b82618dcd085ba0f7e6ef6
Once b/186727553 is fixed, booting GSI on cuttlefish will no longer load
cuttlefish's system_ext sepolicy. These domains are all private and
hence the permissions are being added to system/sepolicy to avoid
making them public(especially mediatranscoding that was changed from
public to private in Android S).
Test: build, boot
Change-Id: I4a78030015fff147545bb627c9e62afbd0daa9d7
This will make debugging of keystore issues in dogfood populations much
easier than it previously was, as developers will have detailed crash
dump reporting on any issues that do occur.
Bug: 186868271
Bug: 184006658
Test: crash dumps appear if keystore2 explodes
Change-Id: Ifb36cbf96eb063c9290905178b2fdc5934050b99
