Commit graph

83 commits

Author SHA1 Message Date
Nick Kralevich
69103378b1 Merge "Get rid of more auditallow spam" am: 82b9182ef3 am: fa418650d2 am: ce35d13319
am: 324efbce57

Change-Id: I3d9a5329304d2d1287a1143d5a20318b32616691
2016-10-31 16:14:53 +00:00
Nick Kralevich
fa418650d2 Merge "Get rid of more auditallow spam"
am: 82b9182ef3

Change-Id: I3dc912af723af37c9fdee2118e0621ed74704f2e
2016-10-31 15:55:22 +00:00
Treehugger Robot
82b9182ef3 Merge "Get rid of more auditallow spam" 2016-10-31 15:43:42 +00:00
Nick Kralevich
77f64cc4c2 kernel.te: tighten entrypoint / execute_no_trans neverallow am: 02cfce49ae am: 74b8425929 am: 02e44d0e7e
am: b6c9f6ddd8

Change-Id: I75048848a689b485aa3c70c7b709da413393c00e
2016-10-31 15:42:21 +00:00
Nick Kralevich
74b8425929 kernel.te: tighten entrypoint / execute_no_trans neverallow
am: 02cfce49ae

Change-Id: I68d9a9a44eb6e11a3d9471a46c307e66afe42c35
2016-10-31 15:22:50 +00:00
Nick Kralevich
02cfce49ae kernel.te: tighten entrypoint / execute_no_trans neverallow
The kernel domain exists solely on boot, and is used by kernel threads.
Because of the way the system starts, there is never an entrypoint for
that domain, not even a file on rootfs. So tighten up the neverallow
restriction.

Remove an obsolete comment. The *.rc files no longer have a setcon
statement, and the transition from the kernel domain to init occurs
because init re-execs itself. The statement no longer applies.

Test: bullhead policy compiles.
Change-Id: Ibe75f3d25804453507dbb05c7a07bba1d37a1c7b
2016-10-30 18:46:44 -07:00
Nick Kralevich
2c8ea36ad8 Get rid of more auditallow spam
Addresses the following audit messages:

[    7.984957] type=1400 audit(33873666.610:40): avc: granted { getattr
} for pid=1 comm="init" name="system@framework@boot-ext.art" dev="dm-2"
ino=106324 scontext=u:r:init:s0
tcontext=u:object_r:dalvikcache_data_file:s0 tclass=file

[   65.528068] type=1400 audit(1477751916.508:96): avc: granted { search
} for pid=6330 comm="main" name="/" dev="cgroup" ino=12428
scontext=u:r:dumpstate:s0 tcontext=u:object_r:cgroup:s0 tclass=dir

[   65.530425] type=1400 audit(1477751916.508:97): avc: granted { search
} for pid=6330 comm="main" name="/" dev="cgroup" ino=12428
scontext=u:r:dumpstate:s0 tcontext=u:object_r:cgroup:s0 tclass=dir

[   65.530487] type=1400 audit(1477751916.508:98): avc: granted { open }
for pid=6330 comm="main" path="/dev/cpuctl/tasks" dev="cgroup" ino=12429
scontext=u:r:dumpstate:s0 tcontext=u:object_r:cgroup:s0 tclass=file

[   65.530800] type=1400 audit(1477751916.508:98): avc: granted { open }
for pid=6330 comm="main" path="/dev/cpuctl/tasks" dev="cgroup" ino=12429
scontext=u:r:dumpstate:s0 tcontext=u:object_r:cgroup:s0 tclass=file

[   65.530842] type=1400 audit(1477751916.508:99): avc: granted { search
} for pid=6330 comm="main" name="/" dev="cgroup" ino=12428
scontext=u:r:dumpstate:s0 tcontext=u:object_r:cgroup:s0 tclass=dir

[   65.531138] type=1400 audit(1477751916.508:99): avc: granted { search
} for pid=6330 comm="main" name="/" dev="cgroup" ino=12428
scontext=u:r:dumpstate:s0 tcontext=u:object_r:cgroup:s0 tclass=dir

[   65.531176] type=1400 audit(1477751916.508:100): avc: granted {
search } for pid=6330 comm="main" name="bg_non_interactive" dev="cgroup"
ino=12444 scontext=u:r:dumpstate:s0 tcontext=u:object_r:cgroup:s0
tclass=dir

[   65.531465] type=1400 audit(1477751916.508:100): avc: granted {
search } for pid=6330 comm="main" name="bg_non_interactive" dev="cgroup"
ino=12444 scontext=u:r:dumpstate:s0 tcontext=u:object_r:cgroup:s0
tclass=dir

[   65.531502] type=1400 audit(1477751916.508:101): avc: granted { open
} for pid=6330 comm="main" path="/dev/cpuctl/bg_non_interactive/tasks"
dev="cgroup" ino=12445 scontext=u:r:dumpstate:s0
tcontext=u:object_r:cgroup:s0 tclass=file

[   65.531789] type=1400 audit(1477751916.508:101): avc: granted { open
} for pid=6330 comm="main" path="/dev/cpuctl/bg_non_interactive/tasks"
dev="cgroup" ino=12445 scontext=u:r:dumpstate:s0
tcontext=u:object_r:cgroup:s0 tclass=file

[   65.531827] type=1400 audit(1477751916.508:102): avc: granted {
search } for pid=6330 comm="main" name="/" dev="cgroup" ino=12459
scontext=u:r:dumpstate:s0 tcontext=u:object_r:cgroup:s0 tclass=dir

[   65.713056] type=1400 audit(1477751916.508:102): avc: granted {
search } for pid=6330 comm="main" name="/" dev="cgroup" ino=12459
scontext=u:r:dumpstate:s0 tcontext=u:object_r:cgroup:s0 tclass=dir

Bug: 32246161
Test: policy compiles
Test: dumpstate no longer generates the audit messages above.
Change-Id: Id5afe2ebeb24f8a7407aac1a0a09806b1521b0e4
2016-10-29 08:15:08 -07:00
Roshan Pius
8b6e9561f8 wifi_hal: Rename to 'hal_wifi' am: 8224596a32 am: e1d1b3dc07 am: 4522d48285
am: fc9d7cdf10

Change-Id: Ibe5dee75d6cf1e02b18380820b584de64395e248
2016-10-28 23:59:20 +00:00
Roshan Pius
abed124f05 wpa: Add permissions for hwbinder am: 6caeac7b47 am: 35ac63bab2 am: 97ad8ac9c2
am: fb4b4f9c82

Change-Id: I4bcdd85b9b6ad15d9d6ca45ecd12d0ee74f7119e
2016-10-28 23:59:16 +00:00
Roshan Pius
e1d1b3dc07 wifi_hal: Rename to 'hal_wifi'
am: 8224596a32

Change-Id: Ie52222c18d95aebe320a664fdbca2c47547f30d8
2016-10-28 23:43:17 +00:00
Roshan Pius
35ac63bab2 wpa: Add permissions for hwbinder
am: 6caeac7b47

Change-Id: I45bf2358586a6bb1dc5b17646c360c9065b17c23
2016-10-28 23:43:15 +00:00
Treehugger Robot
ece327292c Merge changes I5bbbcad3,Ifa4630ed
* changes:
  wifi_hal: Rename to 'hal_wifi'
  wpa: Add permissions for hwbinder
2016-10-28 23:36:21 +00:00
Nick Kralevich
2db17a4064 Get rid of auditallow spam. am: 79a08e13bd am: 6f2f72c2b1 am: 4a5db591dc
am: 3509802774

Change-Id: Idc0a3105ef731a7930cc4cc955f89c5eb5b63c62
2016-10-28 21:06:09 +00:00
Nick Kralevich
6f2f72c2b1 Get rid of auditallow spam.
am: 79a08e13bd

Change-Id: Iee32c3aab31156606142101a0f85a10383cdf712
2016-10-28 20:50:31 +00:00
Nick Kralevich
79a08e13bd Get rid of auditallow spam.
Fixes the following SELinux messages when running adb bugreport:

avc: granted { read } for name="libart.so" dev="dm-0" ino=1886
scontext=u:r:dumpstate:s0 tcontext=u:object_r:libart_file:s0 tclass=file

avc: granted { read open } for path="/system/lib64/libart.so" dev="dm-0"
ino=1886 scontext=u:r:dumpstate:s0 tcontext=u:object_r:libart_file:s0
tclass=file

avc: granted { getattr } for path="/system/lib64/libart.so" dev="dm-0"
ino=1886 scontext=u:r:dumpstate:s0 tcontext=u:object_r:libart_file:s0
tclass=file

avc: granted { read } for path="/system/lib64/libart.so" dev="dm-0"
ino=1886 scontext=u:r:dumpstate:s0 tcontext=u:object_r:libart_file:s0
tclass=file

avc: granted { read } for path="/system/lib64/libart.so" dev="dm-0"
ino=1886 scontext=u:r:dumpstate:s0 tcontext=u:object_r:libart_file:s0
tclass=file

avc: granted { read } for path="/system/lib64/libart.so" dev="dm-0"
ino=1886 scontext=u:r:dumpstate:s0 tcontext=u:object_r:libart_file:s0
tclass=file

avc: granted { read } for path="/system/lib64/libart.so" dev="dm-0"
ino=1886 scontext=u:r:dumpstate:s0 tcontext=u:object_r:libart_file:s0
tclass=file

avc: granted { read execute } for path="/system/lib64/libart.so"
dev="dm-0" ino=1886 scontext=u:r:dumpstate:s0
tcontext=u:object_r:libart_file:s0 tclass=file

avc: granted { read } for path="/system/lib64/libart.so" dev="dm-0"
ino=1886 scontext=u:r:dumpstate:s0 tcontext=u:object_r:libart_file:s0
tclass=file

avc: granted { read } for path="/system/lib64/libart.so" dev="dm-0"
ino=1886 scontext=u:r:dumpstate:s0 tcontext=u:object_r:libart_file:s0
tclass=file

avc: granted { search } for name="dalvik-cache" dev="dm-2" ino=106289
scontext=u:r:dumpstate:s0 tcontext=u:object_r:dalvikcache_data_file:s0
tclass=dir

avc: granted { getattr } for path="/data/dalvik-cache/arm64" dev="dm-2"
ino=106290 scontext=u:r:dumpstate:s0
tcontext=u:object_r:dalvikcache_data_file:s0 tclass=dir

avc: granted { search } for name="dalvik-cache" dev="dm-2" ino=106289
scontext=u:r:dumpstate:s0 tcontext=u:object_r:dalvikcache_data_file:s0
tclass=dir

avc: granted { search } for name="arm64" dev="dm-2" ino=106290
scontext=u:r:dumpstate:s0 tcontext=u:object_r:dalvikcache_data_file:s0
tclass=dir

avc: granted { getattr } for
path="/data/dalvik-cache/arm64/system@framework@boot.art" dev="dm-2"
ino=106318 scontext=u:r:dumpstate:s0
tcontext=u:object_r:dalvikcache_data_file:s0 tclass=file

avc: granted { search } for name="dalvik-cache" dev="dm-2" ino=106289
scontext=u:r:dumpstate:s0 tcontext=u:object_r:dalvikcache_data_file:s0
tclass=dir

avc: granted { search } for name="arm64" dev="dm-2" ino=106290
scontext=u:r:dumpstate:s0 tcontext=u:object_r:dalvikcache_data_file:s0
tclass=dir

avc: granted { read } for name="system@framework@boot.art" dev="dm-2"
ino=106318 scontext=u:r:dumpstate:s0
tcontext=u:object_r:dalvikcache_data_file:s0 tclass=file

avc: granted { read open } for
path="/data/dalvik-cache/arm64/system@framework@boot.art" dev="dm-2"
ino=106318 scontext=u:r:dumpstate:s0
tcontext=u:object_r:dalvikcache_data_file:s0 tclass=file

avc: granted { search } for name="dalvik-cache" dev="dm-2" ino=106289
scontext=u:r:dumpstate:s0 tcontext=u:object_r:dalvikcache_data_file:s0
tclass=dir

[  169.349480] type=1400 audit(1477679159.734:129): avc: granted { read
} for pid=6413 comm="main" name="ipv6_route" dev="proc" ino=4026535947
scontext=u:r:dumpstate:s0 tcontext=u:object_r:proc_net:s0 tclass=file

[  169.350030] type=1400 audit(1477679159.734:130): avc: granted { read
open } for pid=6413 comm="main" path="/proc/6413/net/ipv6_route"
dev="proc" ino=4026535947 scontext=u:r:dumpstate:s0
tcontext=u:object_r:proc_net:s0 tclass=file

[  169.350361] type=1400 audit(1477679159.734:130): avc: granted { read
open } for pid=6413 comm="main" path="/proc/6413/net/ipv6_route"
dev="proc" ino=4026535947 scontext=u:r:dumpstate:s0
tcontext=u:object_r:proc_net:s0 tclass=file

[  169.350399] type=1400 audit(1477679159.734:131): avc: granted {
getattr } for pid=6413 comm="main" path="/proc/6413/net/ipv6_route"
dev="proc" ino=4026535947 scontext=u:r:dumpstate:s0
tcontext=u:object_r:proc_net:s0 tclass=file

[  169.350963] type=1400 audit(1477679159.734:131): avc: granted {
getattr } for pid=6413 comm="main" path="/proc/6413/net/ipv6_route"
dev="proc" ino=4026535947 scontext=u:r:dumpstate:s0
tcontext=u:object_r:proc_net:s0 tclass=file

[  169.351002] type=1400 audit(1477679159.734:132): avc: granted { read
} for pid=6413 comm="main" name="if_inet6" dev="proc" ino=4026535946
scontext=u:r:dumpstate:s0 tcontext=u:object_r:proc_net:s0 tclass=file

[  169.351330] type=1400 audit(1477679159.734:132): avc: granted { read
} for pid=6413 comm="main" name="if_inet6" dev="proc" ino=4026535946
scontext=u:r:dumpstate:s0 tcontext=u:object_r:proc_net:s0 tclass=file

[  169.351366] type=1400 audit(1477679159.734:133): avc: granted { read
open } for pid=6413 comm="main" path="/proc/6413/net/if_inet6"
dev="proc" ino=4026535946 scontext=u:r:dumpstate:s0
tcontext=u:object_r:proc_net:s0 tclass=file

[  169.351861] type=1400 audit(1477679159.734:133): avc: granted { read
open } for pid=6413 comm="main" path="/proc/6413/net/if_inet6"
dev="proc" ino=4026535946 scontext=u:r:dumpstate:s0
tcontext=u:object_r:proc_net:s0 tclass=file

[  169.351910] type=1400 audit(1477679159.734:134): avc: granted {
getattr } for pid=6413 comm="main" path="/proc/6413/net/if_inet6"
dev="proc" ino=4026535946 scontext=u:r:dumpstate:s0
tcontext=u:object_r:proc_net:s0 tclass=file

[  169.353105] type=1400 audit(1477679159.734:134): avc: granted {
getattr } for pid=6413 comm="main" path="/proc/6413/net/if_inet6"
dev="proc" ino=4026535946 scontext=u:r:dumpstate:s0
tcontext=u:object_r:proc_net:s0 tclass=file

[  169.353186] type=1400 audit(1477679159.734:135): avc: granted { read
} for pid=6413 comm="main" name="if_inet6" dev="proc" ino=4026535946
scontext=u:r:dumpstate:s0 tcontext=u:object_r:proc_net:s0 tclass=file

[  169.353594] type=1400 audit(1477679159.734:135): avc: granted { read
} for pid=6413 comm="main" name="if_inet6" dev="proc" ino=4026535946
scontext=u:r:dumpstate:s0 tcontext=u:object_r:proc_net:s0 tclass=file

[  169.353636] type=1400 audit(1477679159.734:136): avc: granted { read
open } for pid=6413 comm="main" path="/proc/6413/net/if_inet6"
dev="proc" ino=4026535946 scontext=u:r:dumpstate:s0
tcontext=u:object_r:proc_net:s0 tclass=file

[  169.354230] type=1400 audit(1477679159.734:136): avc: granted { read
open } for pid=6413 comm="main" path="/proc/6413/net/if_inet6"
dev="proc" ino=4026535946 scontext=u:r:dumpstate:s0
tcontext=u:object_r:proc_net:s0 tclass=file

[  169.354437] type=1400 audit(1477679159.734:137): avc: granted {
getattr } for pid=6413 comm="main" path="/proc/6413/net/if_inet6"
dev="proc" ino=4026535946 scontext=u:r:dumpstate:s0
tcontext=u:object_r:proc_net:s0 tclass=file

[  169.395359] type=1400 audit(1477679159.734:137): avc: granted {
getattr } for pid=6413 comm="main" path="/proc/6413/net/if_inet6"
dev="proc" ino=4026535946 scontext=u:r:dumpstate:s0
tcontext=u:object_r:proc_net:s0 tclass=file

Test: policy compiles
Test: adb bugreport runs without auditallow messages above.
Bug: 32246161
Change-Id: Ie0ab2ed3c6babc1f93d3b8ae47c92dd905ebc93a
2016-10-28 11:46:00 -07:00
Roshan Pius
8224596a32 wifi_hal: Rename to 'hal_wifi'
Renaming the wifi HIDL implementation to 'hal_wifi' from 'wifi_hal_legacy'
to conform with HIDL style guide.

Denials:
01-01 21:55:23.896  2865  2865 I android.hardware.wifi@1.0-service:
wifi_hal_legacy is starting up...
01-01 21:55:23.898  2865  2865 W android.hardware.wifi@1.0-service:
/odm/lib64/hw/ does not exit.
01-01 21:55:23.899  2865  2865 F android.hardware.wifi@1.0-service:
service.cpp:59] Check failed: service->registerAsService("wifi") ==
android::NO_ERROR (service->registerAsService("wifi")=-2147483646,
android::NO_ERROR=0) Failed to register wifi HAL
01-01 21:55:23.899  2865  2865 F libc    : Fatal signal 6 (SIGABRT),
code -6 in tid 2865 (android.hardwar)
01-01 21:55:23.901   377   377 W         : debuggerd: handling request:
pid=2865 uid=2000 gid=2000 tid=2865
01-01 21:55:23.907  2867  2867 E         : debuggerd: Unable to connect
to activity manager (connect failed: Connection refused)
01-01 21:55:23.908  2867  2867 F DEBUG   : *** *** *** *** *** *** ***
*** *** *** *** *** *** *** *** ***
01-01 21:55:23.908  2867  2867 F DEBUG   : Build fingerprint:
'Android/aosp_angler/angler:7.0/NYC/rpius10031052:userdebug/test-keys'
01-01 21:55:23.908  2867  2867 F DEBUG   : Revision: '0'
01-01 21:55:23.908  2867  2867 F DEBUG   : ABI: 'arm64'
01-01 21:55:23.908  2867  2867 F DEBUG   : pid: 2865, tid: 2865, name:
android.hardwar  >>> /system/bin/hw/android.hardware.wifi@1.0-service
<<<
01-01 21:55:23.909  2867  2867 F DEBUG   : signal 6 (SIGABRT), code -6
(SI_TKILL), fault addr --------
01-01 21:55:23.910  2867  2867 F DEBUG   : Abort message:
'service.cpp:59] Check failed: service->registerAsService("wifi") ==
android::NO_ERROR (service->registerAsService("wifi")=-2147483646,
android::NO_ERROR=0) Failed to register wifi HAL'

Bug: 31821133
Test: Compiled and ensured that the selinux denials are no longer
present in logs.
Change-Id: I5bbbcad307e9bb9e59fff87e2926751b3aecc813
2016-10-28 09:00:31 -07:00
William Roberts
05ce9f96a6 Merge "domain: neverallow on setfcap" am: e112faeaa8 am: 14742b0f92 am: eecdbb830a
am: 4603f469d7

Change-Id: Ifbfc6a361aa8eaf64ab5f7efa3df65059f86661b
2016-10-28 00:15:53 +00:00
William Roberts
14742b0f92 Merge "domain: neverallow on setfcap"
am: e112faeaa8

Change-Id: I57d5ed15ae69613145a9ef4efc9e16ec72ad420b
2016-10-28 00:03:22 +00:00
Treehugger Robot
e112faeaa8 Merge "domain: neverallow on setfcap" 2016-10-27 23:45:58 +00:00
William Roberts
c3f1da99b2 domain: neverallow on setfcap
Filesystem capabilities should only be set by the build tools
or by recovery during an update. Place a neverallow ensuring
this property.

Change-Id: I136c5cc16dff0c0faa3799d0ab5e29b43454a610
Signed-off-by: William Roberts <william.c.roberts@intel.com>
2016-10-27 12:45:47 -07:00
Roshan Pius
6caeac7b47 wpa: Add permissions for hwbinder
Modify permissions for wpa_supplicant to use hwbinder (for HIDL),
instead of binder.

Denials:
01-15 14:31:58.573   541   541 W wpa_supplicant: type=1400
audit(0.0:10): avc: denied { call } for scontext=u:r:wpa:s0
tcontext=u:r:hwservicemanager:s0 tclass=binder permissive=0
01-15 14:31:58.573   541   541 W wpa_supplicant: type=1400
audit(0.0:11): avc: denied { call } for scontext=u:r:wpa:s0
tcontext=u:r:hwservicemanager:s0 tclass=binder permissive=0

BUG: 31365276
Test: Compiled and ensured that the selinux denials are no longer
present in logs.

Change-Id: Ifa4630edea6ec5a916b3940f9a03ef9dc6fc9af2
2016-10-26 14:52:12 -07:00
Jeff Vander Stoep
addccaf9d4 Merge "Rename macros for (non)binderized HALs" am: 70591fedf5 am: 3ad4428c73 am: 04f9ac372f
am: e0812afccd

Change-Id: I4f44f5aceb8786e6b50bfaf6a32bc26c4df1fa45
2016-10-26 19:19:30 +00:00
Jeff Vander Stoep
3ad4428c73 Merge "Rename macros for (non)binderized HALs"
am: 70591fedf5

Change-Id: Idc7a114d5a80be369db31ad9954fde6a555bcd64
2016-10-26 19:06:41 +00:00
Treehugger Robot
70591fedf5 Merge "Rename macros for (non)binderized HALs" 2016-10-26 18:48:30 +00:00
Jeff Vander Stoep
472936e031 clean up hal types am: 27ae545a78 am: 95bd7984b5 am: 8937ed099f
am: ad49687b7f

Change-Id: Ia827da1639841410e039d9fb8f8b09613089ebad
2016-10-26 18:44:48 +00:00
Jeff Vander Stoep
95bd7984b5 clean up hal types
am: 27ae545a78

Change-Id: If6c2fdc6d0313b212724e7c3448668049d77e9d4
2016-10-26 18:32:44 +00:00
Jeff Vander Stoep
f579ef15a8 Rename macros for (non)binderized HALs
Test: builds
Bug: 32243668
Change-Id: I1ad4b53003462e932cf80b6972db1520dc66d735
2016-10-26 10:04:18 -07:00
Jeff Vander Stoep
27ae545a78 clean up hal types
Bug: 32123421
Test: build Hikey
Change-Id: Iaf02626f3f3a94104c0f9d746c3cf5f20751a27d
2016-10-26 09:50:04 -07:00
Connor O'Brien
3b54a6b35c sepolicy for boot_control HAL service am: 2370fc775c am: 6771f2885f am: b7bcaecd84
am: a2c00abc21

Change-Id: I15e2df4f33b389a648936336ec5c8bd42f7a6638
2016-10-25 22:43:10 +00:00
Connor O'Brien
6771f2885f sepolicy for boot_control HAL service
am: 2370fc775c

Change-Id: I63f386c60595b9a8db29ecb2715558c78ddb4c70
2016-10-25 22:31:02 +00:00
Connor O'Brien
2370fc775c sepolicy for boot_control HAL service
Bug: 31864052
Test: Logging confirms service runs on boot
Merged-In: I41e9e5c45d2d42886cdf7ff6d364e9e6e3df1ff4
Change-Id: I41e9e5c45d2d42886cdf7ff6d364e9e6e3df1ff4
Signed-off-by: Connor O'Brien <connoro@google.com>
2016-10-25 13:33:48 -07:00
Jeff Vander Stoep
a8dc9cf324 Merge "Add macros for treble and non-treble only policy" am: 367d90b6a4 am: fb2be31617 am: e0b7c140fc
am: 4fe5038184

Change-Id: I1f38bb03e12f9f4d0837c62d13df0ee5bdf7964d
2016-10-25 20:23:29 +00:00
Jeff Vander Stoep
fb2be31617 Merge "Add macros for treble and non-treble only policy"
am: 367d90b6a4

Change-Id: I032862523987c6d59965c332a92c0fadaeda6250
2016-10-25 20:10:24 +00:00
Treehugger Robot
367d90b6a4 Merge "Add macros for treble and non-treble only policy" 2016-10-25 20:06:02 +00:00
Jeff Vander Stoep
53f7996427 Merge "isolated_app: no sdcard access" am: 626edc7555 am: 5855b4884c
am: e88718d6e1

Change-Id: I0edeaeae952ae7533ef553ffece6dd4b8bb4d460
2016-10-21 21:02:15 +00:00
Jeff Vander Stoep
5855b4884c Merge "isolated_app: no sdcard access"
am: 626edc7555

Change-Id: I6a02275d4b618677f6540295c0290e53c62ff55e
2016-10-21 20:45:29 +00:00
Treehugger Robot
626edc7555 Merge "isolated_app: no sdcard access" 2016-10-21 20:29:01 +00:00
Mikhail Naganov
e53f9f24f4 Update SELinux policy for audiohal am: 2ff6b4da73 am: 9f90cadc1d
am: b8f75b39ae

Change-Id: Ie5005b7c2dff724de37a69514b8c08dba2119871
2016-10-21 19:25:25 +00:00
Mikhail Naganov
9f90cadc1d Update SELinux policy for audiohal
am: 2ff6b4da73

Change-Id: I10765cef79fa42538e5987985de24de1c0090396
2016-10-21 19:08:08 +00:00
Mikhail Naganov
2ff6b4da73 Update SELinux policy for audiohal
Change-Id: Iaa9907ed516c947175a59bf49938c0ee03b4f6d1
2016-10-21 09:53:15 -07:00
Felipe Leme
d8dc4b8042 Merge "Creates an autofill system service." am: f5312f8e81 am: ce4c82a8c2
am: 908aeba743

Change-Id: I047518d8183b6fe90e40ab62bdbdaecdab82e67a
2016-10-21 16:36:32 +00:00
Felipe Leme
ce4c82a8c2 Merge "Creates an autofill system service."
am: f5312f8e81

Change-Id: I6472e55c079805a97bd3f60800331ace7b3959a5
2016-10-21 16:19:26 +00:00
Jeff Vander Stoep
ce4b5eeaee isolated_app: no sdcard access
Remove and neverallow isolated_app access to external storage and
USB accessories.

Test: aosp_angler-userdebug builds
Bug: 21643067
Change-Id: Ie912706a954a38610f2afd742b1ab4b8cd4b1f36
2016-10-21 09:15:48 -07:00
Treehugger Robot
f5312f8e81 Merge "Creates an autofill system service." 2016-10-21 16:09:31 +00:00
Craig Donner
3c6c4d2df2 sepolicy: Add policy for VR HIDL service. am: 7ba0485665 am: 8bae22ecea
am: ac775e3d0a

Change-Id: Iae2c060ad326a328a2e37bd39fe33d0d662cc2f8
2016-10-21 03:02:59 +00:00
Craig Donner
8bae22ecea sepolicy: Add policy for VR HIDL service.
am: 7ba0485665

Change-Id: I5ab2f5a0924715128420ba7edf877ee2ed3d2bc0
2016-10-21 02:47:31 +00:00
Felipe Leme
8221d59711 Creates an autofill system service.
BUG: 31001899
Test: manual
Change-Id: I8d462b40d931310eab26bafa09645ac88f13fc97
2016-10-20 17:33:27 -07:00
Craig Donner
7ba0485665 sepolicy: Add policy for VR HIDL service.
Test: built and ran on device.
Bug: 31442830
Change-Id: Idd7870b4dd70eed8cd4dc55e292be39ff703edd2
2016-10-20 17:03:54 -07:00
Prashant Malani
8d9f4a62c4 Merge "Cleanup and renaming of vibrator HAL sepolicy" am: fe360ad6bd am: 566ffd0252
am: 120cfb275e

Change-Id: Id8f9674e30e452a38541645899e537236d633048
2016-10-20 22:15:14 +00:00
Prashant Malani
566ffd0252 Merge "Cleanup and renaming of vibrator HAL sepolicy"
am: fe360ad6bd

Change-Id: I880c24b3b566e8566b5cb3ececbe27ddd513a4e4
2016-10-20 21:53:31 +00:00