Commit graph

6777 commits

Author SHA1 Message Date
Diego Wilson
5908c353e3 Add camera2 extension property policies
These properties allow to vendors to provide their
own camera2 extensions service. The properties
must be accesible to any android app that wishes
to use camera2 extensions.

Change-Id: I94c7ac336b3103355124830320787472f0d2a8b6
2021-06-18 23:59:41 +00:00
Joanne Chung
a079c3a9a8 Merge "[Sepolicy] Change sepolicy name back to formal name." 2021-06-18 06:56:05 +00:00
Michael Ayoubi
26c35067d5 Merge "Add support for hal_uwb" 2021-06-18 04:53:19 +00:00
Adam Shih
ff7ba7e301 make system_app_data_file shareable over binder
Apps should be able to share their private files over binder,
including system_app.

Bug: 188869889
Test: go to setting ==> system ==> multi-users ==> tap icon to change
profile photo with camera

Change-Id: I3dc732f727b9b697c9a73f6089392690109ae035
2021-06-16 00:49:53 +00:00
Aaron Huang
0f69ba0cfe Merge "Add app_api_service to pac_proxy_service" 2021-06-15 05:00:05 +00:00
Treehugger Robot
0e1f6a5ddf Merge "Allow cameraserver to access permission checker" 2021-06-14 05:47:01 +00:00
Svet Ganov
da0c8923f7 Allow cameraserver to access permission checker
Test: No SELinux errors and can access

Change-Id: Id7884e0fde4afc235b097be640ffde45fd067f33
2021-06-12 02:56:00 +00:00
Songchun Fan
f1a60ca2fe [sepolicy] allow installd to query apps installed on Incremental File System
Addresses denial messages like:
06-10 19:36:56.269  1214  1214 I Binder:1214_5: type=1400 audit(0.0:58): avc: denied { use } for path="/data/incremental/MT_data_app_vmdl199/backing_store/st_2_1/com.unity.megacity-HlbmeQJjThgePchBlByuoQ==" dev="dm-5" ino=10445 scontext=u:r:installd:s0 tcontext=u:r:vold:s0 tclass=fd permissive=1
06-10 19:36:56.516  1214  1214 I Binder:1214_6: type=1400 audit(0.0:59): avc: denied { use } for path="/data/incremental/MT_data_app_vmdl199/backing_store/st_2_1/com.unity.megacity-HlbmeQJjThgePchBlByuoQ==" dev="dm-5" ino=10445 scontext=u:r:installd:s0 tcontext=u:r:vold:s0 tclass=fd permissive=1

BUG: 190699430
Test: manual
Change-Id: Iee4bdb382b6af5bc8cd63fde2c0db5f0b9b4f02b
2021-06-10 13:16:28 -07:00
Michael Ayoubi
0be7c67da0 Add support for hal_uwb
Bug: 187386527
Test: Boot and confirm HAL is up
Signed-off-by: Michael Ayoubi <mayoubi@google.com>
Change-Id: Ia866a9a72b6f2ea5b31de25baefd13c2fd0b9c22
2021-06-10 17:46:23 +00:00
Joanne Chung
a6657178f4 [Sepolicy] Change sepolicy name back to formal name.
The feature is public, we can change the fake name to formal name.

Bug: 185550380
Test: build pass and can run service correctly
Merged-In: I956d916077f9a71cdf1df2f0be6f83e6f1f30a98

Change-Id: Idc29942eee6c2fd7658beb69ba62a70397176a66
2021-06-10 11:02:27 +00:00
Yifan Hong
a66a5df13d Merge "Allow binder services to r/w su:tcp_socket" 2021-06-08 22:13:23 +00:00
Yifan Hong
be04b091bb Allow binder services to r/w su:tcp_socket
Test: binderHostDeviceTest
Bug: 182914638
Change-Id: I1c8d3b2194bc20bd2bcde566190aa5c73d7e7db9
2021-06-08 10:39:02 -07:00
Inseob Kim
5d269aaa55 Remove microdroid specific rules and files
These are moved to packages/modules/Virtualization.

Bug: 189165759
Test: boot device and microdroid
Test: atest MicrodroidHostTestCases
Change-Id: I050add7fef56ced4787117f338e7b5d1fda1c193
2021-06-07 19:22:18 +09:00
Calin Juravle
c4efcbdc06 Merge "Enable ART properties modularization" 2021-06-02 14:39:36 +00:00
Treehugger Robot
17a5e930cb Merge "uncrypt: allow reading /proc/bootconfig" 2021-06-02 10:35:28 +00:00
Jeff Vander Stoep
e4116b4e44 uncrypt: allow reading /proc/bootconfig
It's needed when calling ReadDefaultFstab.

Fixes: 189509028
Test: build
Change-Id: I0d4bac7f2e3a25faa921c8d77cbf92f7808f0ab7
2021-06-02 08:46:59 +02:00
Calin Juravle
0b2ca6c22c Enable ART properties modularization
ART is becoming a module and we need to be able to add new properties
without modifying the non updatable part of the platform:

- convert ART properties to use prefix in the namespace of
[ro].dalvik.vm.
- enable appdomain and coredomain to read device_config properties
that configure ART

Test: boot
Bug: 181748174
Change-Id: Id23ff78474dba947301e1b6243a112b0f5b4a832
2021-06-01 16:14:55 -07:00
Alexander Dorokhine
73854e626d Merge "Allow the appsearch apex access to the apexdata misc_ce dir." 2021-05-27 20:39:03 +00:00
Alexander Dorokhine
0b2553a32b Allow the appsearch apex access to the apexdata misc_ce dir.
Bug: 177685938
Test: AppSearchSessionCtsTest
Change-Id: I727860a02cb9e612ce6c322662d418cddc2ff358
2021-05-26 09:47:19 -07:00
Treehugger Robot
b8c6055b6f Merge "Allow mke2fs to format virtual block devices in microdroid" 2021-05-26 00:03:08 +00:00
Jiyong Park
e1bfe4332f Allow mke2fs to format virtual block devices in microdroid
Bug: 185767624
Test: atest MicrodroidHostTestCases
Change-Id: I324064a8b58eb07a34f5724f36865865156d0db5
2021-05-26 00:40:24 +09:00
Jaegeuk Kim
da1d8a3ce6 sepolicy: add f2fs ioctls
This cleans up ioctl definitions.

Bug: 189169940
Signed-off-by: Jaegeuk Kim <jaegeuk@google.com>
Change-Id: I8cf2daa11911ef2fb817e125fcfc4f8ad91af0ed
2021-05-25 05:54:14 -07:00
Michael Ayoubi
77c10eff1e Add DCK eligibility properties
Bug: 186488185
Test: Confirm GMSCore access
Change-Id: I20baf5c9ae9fbebc9e43d2798401ad49776fb74a
2021-05-21 23:31:09 +00:00
Svet Ganov
365c57f338 Allow mediaserver/audioserver to access permission checker service
bug: 158792096

Test: atest CtsMediaTestCases
      atest CtsPermissionTestCases
      atest CtsPermission2TestCases
      atest CtsPermission3TestCases
      atest CtsPermission4TestCases

Change-Id: I392c87f0a85a09d891bceaaefeae1b3f9acff55a
2021-05-20 19:07:29 +00:00
Yabin Cui
4c26361472 Merge "Allow simpleperf_app_runner to write to shell pipe fds." 2021-05-14 20:45:39 +00:00
Yabin Cui
d34a1dd223 Allow simpleperf_app_runner to write to shell pipe fds.
Currently simpleperf knows whether an app is debuggable or profileable
by running commands via run-as and simpleperf_app_runner and seeing if
they fail. This isn't convenient. So we want simpleperf_app_runner to
pass app type to simpleperf through pipe fds.

Bug: 186469540
Test: run CtsSimpleperfTestCases.
Change-Id: Ia2d276def83361336bb25d9cf367073a01cb4932
2021-05-14 10:16:24 -07:00
Treehugger Robot
9327c4f1cc Merge "Allow /dev/dma_heap directory to be readable" 2021-05-14 05:10:33 +00:00
Hridya Valsaraju
920939df71 Allow /dev/dma_heap directory to be readable
Allow everyone to read /dev/dma_heap so that they can query the set of
available heaps with the GetDmabufHeapList() API in libdmabufheap.
This patch fixes the following denials that happen when clients use the
API:

avc: denied { read } for name="dma_heap" dev="tmpfs" ino=369
scontext=u:r:mediaswcodec:s0 tcontext=u:object_r:dmabuf_heap_device:s0
tclass=dir permissive=0
9507:05-12 17:19:59.567  1647  1647 W com.android.systemui: type=1400
audit(0.0:93): avc: denied { read } for
comm=4E444B204D65646961436F6465635F name="dma_heap" dev="tmpfs" ino=369
scontext=u:r:platform_app:s0:c512,c768
tcontext=u:object_r:dmabuf_heap_device:s0 tclass=dir permissive=0
app=com.android.systemui

Test: manual
Bug: 184397788
Change-Id: I84672bc0be5b409cd49080501d0bf3c269ca610c
2021-05-14 05:09:30 +00:00
liuyg
04c85dcfc4 Revert "Allow the MediaProvider app to set FUSE passthrough property"
This reverts commit c1e2918fd9.

Reason for revert: Build broke

Change-Id: I4b95e977cf66c586b0d0b465f1b3654c01074152
2021-05-13 18:18:28 +00:00
Alessio Balsini
c1e2918fd9 Allow the MediaProvider app to set FUSE passthrough property
Allow the MediaProvider app to write the system property
fuse.passthrough.enabled in case FUSE passthrough is enabled.
The need for this additional system property is due to the ScopedStorage
CTS tests that are assuming FUSE passtrhough is always on for devices
supporting it, but there may be some cases (e.g., GSI mixed builds)
where this is not possible true and the feature is disabled at runtime,
thus causing the tests to fail.
This additional system property is only set when FUSE passthrough is
actually being used by the system.

Bug: 186635810
Test: CtsScopedStorageDeviceOnlyTest
Signed-off-by: Alessio Balsini <balsini@google.com>
Change-Id: I623042d67399253a9167188c3748d93eb0f2d41f
2021-05-13 17:38:16 +00:00
Aaron Huang
0bcca11b72 Add app_api_service to pac_proxy_service
Add app_api_service to pac_proxy_service so that
it can be reach by Cts tests.

Bug: 181745786
Test: CtsNetTestCases:PacProxyManagetTest
Change-Id: I9bf4ff810635aa5b3cbf984b77b547aa96cdd543
2021-05-13 17:28:04 +08:00
Vova Sharaienko
ad8cf2fe1b Merge "Stats: Marked service as app_api_service" 2021-05-07 16:05:57 +00:00
Vova Sharaienko
a96cb4d339 Stats: Marked service as app_api_service
Marked the fwk_stats_service service as app_api_service so that
it can be reached by apps (also means that it's stable)

Bug: 185789914
Test: Build, flash, boot & and logcat | grep "SELinux"
Change-Id: Ifbb111dbee0429d8aaea4688c0390ee80e25cb22
2021-05-06 22:03:47 +00:00
David Anderson
018004d9d1 Allow fastbootd to mount /metadata in recovery.
It is important that fastbootd is able to mount /metadata in recovery, in
order to check whether Virtual A/B snapshots are present. This is
enabled on userdebug builds, but currently fails on user builds.

Fixes:

        audit: type=1400 audit(7258310.023:24): avc:  denied  { mount } for pid=511 comm="fastbootd" name="/" dev="sda15" ino=2 scontext=u:r:fastbootd:s0 tcontext=u:object_r:labeledfs:s0 tclass=filesystem permissive=0

Bug: 181097763
Test: fastboot flash on user build
Change-Id: I1abeeaa3109e08755a1ba44623a46b12d9bfdedc
2021-05-05 16:37:56 -07:00
Hridya Valsaraju
f35c70b0dd Merge changes If26ba23d,Ibea38822
* changes:
  Revert "Revert "Exclude vendor_modprobe from debugfs neverallow restrictions""
  Revert "Revert "Add neverallows for debugfs access""
2021-05-05 17:31:35 +00:00
Songchun Fan
633f7ca868 [sepolicy] allow system server to read incfs metrics from sysfs
Address denial messages like:

05-05 05:02:21.480  1597  1597 W Binder:1597_12: type=1400 audit(0.0:140): avc: denied { read } for name="reads_delayed_min" dev="sysfs" ino=107358 scontext=u:r:system_server:s0 tcontext=u:object_r:sysfs:s0 tclass=file permissive=0

BUG: 184844615
Test: atest android.cts.statsdatom.incremental.AppErrorAtomTests#testAppCrashOnIncremental
Change-Id: I201e27e48a08f99f41a030e06c6f22518294e056
2021-05-04 22:56:41 -07:00
Hridya Valsaraju
498318cc65 Revert "Revert "Exclude vendor_modprobe from debugfs neverallow restrictions""
This reverts commit 231c04b2b9.

Now that b/186727553 is fixed, it should be safe to revert this revert.

Test: build
Bug: 184381659
Change-Id: If26ba23df19e9854a121bbcf10a027c738006515
2021-05-04 22:07:08 -07:00
Hridya Valsaraju
23f9f51fcd Revert "Revert "Add neverallows for debugfs access""
This reverts commit e95e0ec0a5.

Now that b/186727553 is fixed, it should be safe to revert this revert.

Test: build
Bug: 184381659
Change-Id: Ibea3882296db880f5cafe4f9efa36d79a183c8a1
2021-05-04 22:06:46 -07:00
Hridya Valsaraju
a885dd84c7 Revert "Revert "Add a neverallow for debugfs mounting""
This reverts commit f9dbb72654.
Issues with GSI testing fixed with
https://android-review.googlesource.com/c/platform/build/+/1686425/

Bug: 184381659
Test: manual
Change-Id: Icd07430c606e294dfaad2fc9b37d34e3dae8cbfc
2021-05-02 21:41:53 -07:00
Shawn Willden
bdc4f744da Merge "Allowing userdebug/eng builds crash dump access to ks" 2021-04-30 22:19:04 +00:00
Max Bires
f09391624a Allowing userdebug/eng builds crash dump access to ks
This will make debugging of keystore issues in dogfood populations much
easier than it previously was, as developers will have detailed crash
dump reporting on any issues that do occur.

Bug: 186868271
Bug: 184006658
Test: crash dumps appear if keystore2 explodes
Change-Id: Ifb36cbf96eb063c9290905178b2fdc5934050b99
2021-04-30 18:50:54 +00:00
Songchun Fan
979a1f8f34 [sepolicy] allow system_server to ioctl INCFS_IOC_GET_LAST_READ_ERROR
Solves the denial message like:

04-30 03:54:46.972 21944 21944 I Binder:21944_17: type=1400 audit(0.0:502): avc: denied { ioctl } for path=2F646174612F696E6372656D656E74616C2F4D545F646174615F6170705F766D646C3133352F6D6F756E742F2E70656E64696E675F7265616473202864656C6574656429 dev="incremental-fs" ino=2 ioctlcmd=0x6727 scontext=u:r:system_server:s0 tcontext=u:object_r:incremental_control_file:s0 tclass=file permissive=1

BUG: 184844615
Test: manual
Change-Id: I3ef32613de348bca1d58cddf4ec1296d4828b51a
2021-04-30 16:46:06 +00:00
Nicolas Geoffray
82bf10a79c Merge "Allow boot animation to update boot status." 2021-04-29 07:53:05 +00:00
Christian Wailes
6553a8dbe6 Merge "Add SELinux properties for artd" 2021-04-28 16:41:09 +00:00
Xusong Wang
c5bae6f802 Merge "Allow NN HAL service to read files from apk data files" 2021-04-28 15:09:42 +00:00
Nicolas Geoffray
6a311471a6 Allow boot animation to update boot status.
This CL was missed from the topic:
https://android-review.googlesource.com/q/topic:bootanim-percent

Test: update ART module, see animation go to 100%
Bug: 184881321
Change-Id: I59706718af11751a7e1f4b5ab1ff2793f554fb19
2021-04-28 15:17:09 +01:00
Chris Wailes
467d8a80ea Add SELinux properties for artd
Test: boot device and check for artd process
Change-Id: I2a161701102ecbde3e293af0346d1db0b11d4aab
2021-04-27 14:49:13 -07:00
Treehugger Robot
98914119ae Merge "[incfs] Allow everyone read the IncFS sysfs features" 2021-04-26 22:19:37 +00:00
Treehugger Robot
206d6d80a1 Merge "Fix permissions for vold.post_fs_data_done" 2021-04-26 20:36:34 +00:00
Eric Biggers
040ce199b2 Fix permissions for vold.post_fs_data_done
The system property "vold.post_fs_data_done" is used by init and vold to
communicate with each other in order to set up FDE on devices that use
FDE.  It needs to be gettable and settable by vold, and settable by init
and vendor_init.  This was the case in Android 11 and earlier; however,
the change
https://android-review.googlesource.com/c/platform/system/sepolicy/+/1277447
("Rename exported and exported2 vold prop") broke this by giving this
property the type "vold_config_prop", which made it no longer settable
by vold.

Since none of the existing property types appear to be appropriate for
this particular property, define a new type "vold_post_fs_data_prop" and
grant the needed domains permission to get/set it.

This is one of a set of changes that is needed to get FDE working again
so that devices that launched with FDE can be upgraded to Android 12.

Bug: 186165644
Test: Tested FDE on Cuttlefish
Change-Id: I2fd8af0091f8b921ec37381ad3b85a156d074566
2021-04-26 12:43:05 -07:00