Commit graph

33006 commits

Author SHA1 Message Date
Inseob Kim
5a8afdcfa6 Make 31.0 prebuilts and compat files up to date
Bug: 208126864
Test: m selinux_policy 31.0_compat_test treble_sepolicy_tests_31.0
Change-Id: Ic97d17b39f7307ed5af200c97c8c09ca0511c216
2021-11-29 19:40:59 +09:00
Jiyong Park
cc82a6ae89 Merge "app_data_file is the only app_data_file_type that is allowed for crosvm" 2021-11-26 06:11:03 +00:00
Jiyong Park
028e722934 app_data_file is the only app_data_file_type that is allowed for crosvm
Bug: 204852957
Test: monitor TH
Change-Id: Ie92aa25336087519661002624b486cb35740cda6
2021-11-26 01:20:20 +09:00
Thiébaud Weksteen
274636c958 Merge "Refactor fc_sort and add unit tests" 2021-11-25 04:59:56 +00:00
Thiébaud Weksteen
b75b4d2477 Refactor fc_sort and add unit tests
Clean up fc_sort to facilitate the migration to Python3. Use PEP8 for
naming scheme.

Test: atest --host fc_sort_test
Bug: 200119288
Change-Id: Ia2c40a850a48ec75e995d5233b5abaae10917a89
2021-11-25 13:18:05 +11:00
Navinprashath
d35bd44109 sepolicy: Add badge for gsm properties
Add badge for gsm.operator.iso-country and gsm.sim.operator.iso-country.

Test: Manual test
Bug: 205807505
Change-Id: If4f399cd97b2297094ef9431450f29e0a91e5300
2021-11-24 16:46:55 +08:00
Jack Yu
b25774f53c Merge changes from topic "OMAPI_VNTF"
* changes:
  Added sepolicy rule for vendor uuid mapping config
  Support for OMAPI Vendor stable interface
2021-11-23 04:54:02 +00:00
Richard Fung
6d3bc08dbb Merge "Support reading block apexes from system_server" 2021-11-23 03:19:05 +00:00
Richard Fung
d34435c257 Support reading block apexes from system_server
This relaxes the neverallow so that it is possible to write a new
SELinux allow for system_server to read /dev/block/vd*. It still isn't
possible unless a vendor enables it.

Bug: 196965847
Test: m -j
local_test_runner arc.Boot.vm

Change-Id: Idad79284778cf02066ff0b982480082828f24e19
2021-11-22 21:18:54 +00:00
Akilesh Kailash
b295d44694 Merge "New property to control virtual a/b user-space snapshots" 2021-11-22 20:16:06 +00:00
Treehugger Robot
441be957ca Merge "Mark safety_center_service as app_api_service in SELinux Policy." 2021-11-22 12:54:32 +00:00
Treehugger Robot
6d485dfd89 Merge "Split composd's service in two" 2021-11-22 11:19:40 +00:00
Alan Stokes
8788f7afe2 Split composd's service in two
They are served by the same process but have different clients:
- the main interface is exposed to system server;
- the internal interface is called by odrefresh when spawned by composd.

Test: compos_cmd forced-compile-test
Bug: 199147668
Change-Id: Ie1561b7700cf633d7d5c8df68ff58797a8d8bced
2021-11-22 09:36:45 +00:00
Rajesh Nyamagoud
ce542660c9 Added sepolicy rule for vendor uuid mapping config
New type added in sepolicy to restrict Vendor defined uuid mapping
config file access to SecureElement.

Bug: b/180639372
Test: Run OMAPI CTS and VTS tests
Change-Id: I81d715fa5d5a72c893c529eb542ce62747afcd03
2021-11-20 01:08:11 +00:00
Rajesh Nyamagoud
453dcf6752 Support for OMAPI Vendor stable interface
Label defined for OMAPI Vendor Stable Interface

Bug: b/180639372
Test: Run OMAPI CTS and VTS tests
Change-Id: Ifa67a22c85ffb38cb377a6e347b0e1f18af1d0f8
2021-11-20 01:05:07 +00:00
Elliot Sisteron
6703102c79 Mark safety_center_service as app_api_service in SELinux Policy.
This is to make the SafetyCenterManager usable in CTS tests.
Test: SafetyCenterManager CTS test in ag/16284943
Bug: 203098016

Change-Id: I28a42da32f1f7f93c45294c7e984e6d1fd2cdd8d
2021-11-20 00:14:50 +00:00
Akilesh Kailash
8a9ec2a496 New property to control virtual a/b user-space snapshots
Bug: 193863443
Test: OTA on pixel
Signed-off-by: Akilesh Kailash <akailash@google.com>
Change-Id: I89e5d105071c2529c9ceb661c04588ff88ffdd76
2021-11-19 23:35:32 +00:00
Treehugger Robot
d6c57bb99d Merge "recovery init domain_trans to health HAL." 2021-11-19 21:25:33 +00:00
Yuntao Xu
9fcf271f71 Merge "Split property/file/service contexts modules" 2021-11-19 19:24:55 +00:00
Elliot Sisteron
67cedde1fe SELinux policy changes for SafetyCenter APIs.
Context about this is on ag/16182563.

Test: Ensure no build failures, ensure no SecurityException on boot when
SafetyCenterService is added as boot phase
Bug: 203098016

Change-Id: I4c20980301a3d0f53e6d8cba0b56ae0992833c30
2021-11-19 14:32:11 +00:00
Yuntao Xu
42e732c861 Split property/file/service contexts modules
1. Splitted plat_property_contexts, plat_file_contexts, and
plat_service_contexts so they can be included by the
CtsSecurityHostTestCases module.

2. Add temporary seapp_contexts Soong module, which are needed by the
CtsSecurityHostTestCases, and makefile_goal is an interim solution before
migrating both of them to Soong.

Bug: 194096505
Test: m CtsSecurityHostTestCases
Change-Id: I99ba55b1a89f196b3c8504e623b65960a9262165
2021-11-19 18:23:12 +09:00
Yifan Hong
705db2b7e8 recovery init domain_trans to health HAL.
Test: run health HAL in recovery
Bug: 177269435
Bug: 170338625
Change-Id: Iac800463d4d29c56466a6671929a51139ca3fde7
2021-11-18 18:16:09 -08:00
Treehugger Robot
b8f39c49f5 Merge "Sepolicy for StatsBootstrapAtomService" 2021-11-18 23:25:21 +00:00
Vova Sharaienko
919fa4f9fc Merge "Revert "Split property and file contexts modules"" 2021-11-18 17:56:09 +00:00
Vova Sharaienko
bec08097c9 Revert "Split property and file contexts modules"
Revert "Convert security/Android.mk to Android.bp"

Revert "Add seapp_contexts to allowlist of makefile goal"

Revert submission 1795972-Convert security/Android.mk to Android.bp

Reason for revert: http://b/206976319 Broken build 7928060 on aosp-master on sdk_arm64-sdk
Reverted Changes:
I0e0e7f677:Split property and file contexts modules
I5596d6f00:Add seapp_contexts to allowlist of makefile goal
If685e5ccc:Convert security/Android.mk to Android.bp

Change-Id: Ibbca0a17886d15b3fd7ecaf974a06df7107fd9aa
2021-11-18 17:29:01 +00:00
Yuntao Xu
1b76673577 Merge "Split property and file contexts modules" 2021-11-18 17:05:46 +00:00
Treehugger Robot
c1ebd11f2c Merge "Allow system server to access composd." 2021-11-18 13:03:01 +00:00
Yifan Hong
28f9b97646 Merge changes from topic "servicemanager-recovery"
* changes:
  servicemanager: recovery write to kmsg.
  Add recovery service_contexts files.
2021-11-18 04:39:15 +00:00
Treehugger Robot
1b0415fcb0 Merge changes I74797b13,I5d0b06e3
* changes:
  Dice HAL: Add policy for dice HAL.
  Diced: Add policy for diced the DICE daemon.
2021-11-17 23:56:14 +00:00
Janis Danisevskis
bc7a33ece9 Dice HAL: Add policy for dice HAL.
And allow diced to talk to the dice HAL.

Bug: 198197213
Test: N/A
Change-Id: I74797b13656b38b50d7cd28a4c4c6ec4c8d1d1aa
2021-11-17 13:36:18 -08:00
Janis Danisevskis
2b6c6063ae Diced: Add policy for diced the DICE daemon.
Bug: 198197213
Test: N/A
Change-Id: I5d0b06e3cd0c594cff6120856ca3bb4f7c1dd98d
2021-11-17 13:36:18 -08:00
Daniel Norman
0dd5118c74 Merge "Revert "Revert "Adds a new prop context for choosing between mul..."" 2021-11-17 21:24:28 +00:00
Ashwini Oruganti
ed7ebb867e Merge "Define and add the migrate_any_key permission to system_server" 2021-11-17 17:55:13 +00:00
Alan Stokes
ca83dcce15 Merge "Add type and mapping for /metadata/sepolicy" 2021-11-17 14:11:14 +00:00
Jeff Vander Stoep
5aa5e5e845 Add type and mapping for /metadata/sepolicy
Test: make -j; launch_cvd; adb shell ls -laZ /metadata
Bug: 199914227
Change-Id: I573af0949d92f401589238dab8c3e9fbe2ee7efe
2021-11-17 10:45:24 +00:00
Yifan Hong
31fdcc8369 servicemanager: recovery write to kmsg.
Test: recovery mode
Bug: 170338625
Change-Id: Ic3883fda1a0b1d8d0965b3997d19f2fad4667c14
2021-11-16 20:54:17 -08:00
Yifan Hong
d6b2901748 Add recovery service_contexts files.
This allows binder services to run in recovery.

Test: build them
Bug: 170338625
Change-Id: If8580c3fc1b3add87178365c58288126e61345b4
2021-11-16 20:54:17 -08:00
Daniel Norman
2f8ce0d9c1 Revert "Revert "Adds a new prop context for choosing between mul..."
Revert "Revert "Adds multi_install_skip_symbol_files field (defa..."

Revert submission 1893459-revert-1869814-vapex-multi-config-VKODFOVCWY

Reason for revert: Fix-forward in https://r.android.com/1894088
Reverted Changes:
I087bfe0dc:Revert "Adds a new prop context for choosing betwe...
I27a498506:Revert "Load persist props before starting apexd."...
Ib5344edc0:Revert "Allow users to choose between multi-instal...
If09bf590e:Revert "Adds multi_install_skip_symbol_files field...
I905dac14c:Revert "Demonstrate multi-installed APEXes."

Change-Id: I03fb124d4e7044f236539a132816fd96cb814775
2021-11-16 20:28:29 +00:00
Ashwini Oruganti
41843731cc Define and add the migrate_any_key permission to system_server
This change adds a permission migrate_any_key that will help the system
server in migrating keys for an app that wants to leave a sharedUserId.

Bug: 179284822
Test: compiles
Change-Id: I2f35a1335092e69f5b3e346e2e27284e1ec595ec
2021-11-16 10:18:19 -08:00
Treehugger Robot
a594876cfe Merge "Add camera.disable_preview_scheduler property" 2021-11-16 15:16:25 +00:00
Alan Stokes
9112c9aa6d Allow system server to access composd.
Also allow composd to kill odrefresh (it execs it); this is necessary
for cancel() to work.

Bug: 199147668
Test: manual
Change-Id: I233cac50240130da2f4e99f452697c1162c10c40
2021-11-16 09:29:58 +00:00
Owen Kim
95d7aaa339 Merge "Revert "Adds a new prop context for choosing between multi-insta..."" 2021-11-16 08:39:27 +00:00
Owen Kim
780cd02d52 Revert "Adds a new prop context for choosing between multi-insta..."
Revert "Adds multi_install_skip_symbol_files field (default fals..."

Revert submission 1869814-vapex-multi-config

Bug: 206551398
Reason for revert: DroidMonitor-triggered revert due to breakage https://android-build.googleplex.com/builds/tests/view?invocationId=I55600009996329947&testResultId=TR93527797572038984, bug b/206551398
Reverted Changes:
I0cd9d748d:Adds multi_install_skip_symbol_files field (defaul...
I5912a18e3:Demonstrate multi-installed APEXes.
I0e6881e3a:Load persist props before starting apexd.
I932442ade:Adds a new prop context for choosing between multi...
I754ecc3f7:Allow users to choose between multi-installed vend...

Change-Id: I087bfe0dcf8d6ab38d861b82196bac4e9147e8e6
2021-11-16 07:08:15 +00:00
Daniel Norman
8e276eae6b Merge "Adds a new prop context for choosing between multi-installed APEXes." 2021-11-16 00:45:32 +00:00
Jiyong Park
5d0397047d Merge "Fix bootchart on android12" 2021-11-15 07:04:06 +00:00
Treehugger Robot
8797f5841c Merge "Add file_contexts for sepolicy mainline module" 2021-11-12 15:21:29 +00:00
Jeff Vander Stoep
07246483ad Add file_contexts for sepolicy mainline module
Test: m com.android.sepolicy
Bug: 202394777
Change-Id: I6d11c693463206632237de1c4042845153fd6415
2021-11-12 14:55:54 +01:00
Yi-Yo Chiang
9fcecef0a8 Merge "Treblelize bug_map: split bug_map to multiple partitions" 2021-11-12 06:53:27 +00:00
Daniel Norman
6b0049dcf0 Adds a new prop context for choosing between multi-installed APEXes.
Bug: 199290365
Test: see https://r.android.com/1872018
Change-Id: I932442adefc7ad10d7cd81e61e95efd41f8cf379
2021-11-11 19:11:11 +00:00
Maciej Żenczykowski
3702f3385e introduce new 'proc_bpf' for bpf related sysctls
What to tag chosen based on output of:
  find /proc 2>/dev/null | egrep bpf
on a 5.10 kernel.

Tagged with prefixes to be more likely not require changes in the future

  $ adb root
  $ adb shell 'ls -lZ /proc/sys/net/core/bpf_* /proc/sys/kernel/*bpf*'

Before:
  -rw-r--r-- 1 root root u:object_r:proc:s0      0 2021-11-11 02:11 /proc/sys/kernel/bpf_stats_enabled
  -rw-r--r-- 1 root root u:object_r:proc:s0      0 2021-11-11 02:11 /proc/sys/kernel/unprivileged_bpf_disabled
  -rw-r--r-- 1 root root u:object_r:proc_net:s0  0 2021-11-11 02:11 /proc/sys/net/core/bpf_jit_enable
  -rw------- 1 root root u:object_r:proc_net:s0  0 2021-11-11 02:11 /proc/sys/net/core/bpf_jit_harden
  -rw------- 1 root root u:object_r:proc_net:s0  0 2021-11-11 02:11 /proc/sys/net/core/bpf_jit_kallsyms
  -rw------- 1 root root u:object_r:proc_net:s0  0 2021-11-11 02:11 /proc/sys/net/core/bpf_jit_limit

After:
  -rw-r--r-- 1 root root u:object_r:proc_bpf:s0  0 2021-11-11 02:08 /proc/sys/kernel/bpf_stats_enabled
  -rw-r--r-- 1 root root u:object_r:proc_bpf:s0  0 2021-11-11 02:08 /proc/sys/kernel/unprivileged_bpf_disabled
  -rw-r--r-- 1 root root u:object_r:proc_bpf:s0  0 2021-11-11 02:08 /proc/sys/net/core/bpf_jit_enable
  -rw------- 1 root root u:object_r:proc_bpf:s0  0 2021-11-11 02:08 /proc/sys/net/core/bpf_jit_harden
  -rw------- 1 root root u:object_r:proc_bpf:s0  0 2021-11-11 02:08 /proc/sys/net/core/bpf_jit_kallsyms
  -rw------- 1 root root u:object_r:proc_bpf:s0  0 2021-11-11 02:08 /proc/sys/net/core/bpf_jit_limit

Test: TreeHugger
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I46ea81ff42d3b915cf7a96735dc2636d9808ead6
2021-11-11 02:54:21 -08:00