Kenny Root
9c08abbd3b
Merge "Allow domain access to /dev/ion"
2012-09-17 11:46:46 -07:00
William Roberts
c2cb712a0d
am c27d30a6: Correct spelling mistake
...
* commit 'c27d30a6ad46963988ca1e312fa824196687e231':
Correct spelling mistake
2012-09-13 15:51:50 -07:00
William Roberts
ccc8271aba
Allow domain access to /dev/ion
...
Change-Id: I87f81a632ed61f284f2fe09726f5c4529d36f252
2012-09-13 14:30:11 -07:00
William Roberts
c27d30a6ad
Correct spelling mistake
...
Change-Id: If4deccfe740c8de6b88929a0d0439667c3ea340d
2012-09-06 19:38:39 -07:00
Jean-Baptiste Queru
d0f027ccc8
am 10f9a372: Merge upstream sepolicy into AOSP
...
* commit '10f9a3727a5c46ef23f5f0385ae4ffec20cb46d9':
Corrected gramatical issues
Added new line to end of file
Changed seapp_contexts temporary file naming
Fix mls checking code
Support overrides in seapp_contexts
Add tf_daemon labeling support.
Add ppp/mtp policy.
per device seapp_context support
dhcp policy.
Trusted Execution Environment policy.
2012-09-05 19:46:52 -07:00
Jean-Baptiste Queru
10f9a3727a
Merge upstream sepolicy into AOSP
...
Change-Id: If3ed9998033378de5b47472315444f5b8bd4743e
2012-09-05 18:43:48 -07:00
seandroid
1148bc2a6b
Merge checkseapp support.
2012-09-05 16:07:40 -04:00
William Roberts
ae23a1f36a
Corrected gramatical issues
...
Change-Id: I62ce62475f4a17d278243cc96db773872b2dc89c
2012-09-05 12:53:52 -07:00
William Roberts
a861318074
Added new line to end of file
...
Change-Id: I4f0576a47ca2e99bca719bf321349c7d7d05cd3c
2012-09-05 11:23:40 -07:00
William Roberts
98ed392e68
Changed seapp_contexts temporary file naming
...
Change-Id: I4f522869eeaa6f84771e4ee2328f65296dcc29db
2012-09-05 11:23:19 -07:00
William Roberts
0ae3a8a2d5
Fix mls checking code
...
Change-Id: I614caa520e218f8f148eef641fed2301571da8e1
2012-09-04 11:51:04 -07:00
William Roberts
f0e0a94e03
Support overrides in seapp_contexts
...
Provides support for overriding seapp_contexts declerations
in per device seapp_contexts files.
Change-Id: I23a0ffa1d24f1ce57825b168f29a2e885d3e1c51
2012-09-04 10:55:38 -07:00
rpcraig
a363683c57
Add tf_daemon labeling support.
2012-08-24 08:23:20 -04:00
rpcraig
d49f7e6e36
Add ppp/mtp policy.
...
Initial policy for Point-to-Point tunneling and
tunneling manager services.
2012-08-20 06:19:36 -04:00
William Roberts
171a062571
per device seapp_context support
2012-08-16 14:00:19 -04:00
rpcraig
867ae0561c
dhcp policy.
2012-08-15 06:25:14 -04:00
Jean-Baptiste Queru
aa7fb3be1b
resolved conflicts for merge of 0c2e5705 to jb-mr1-dev
...
Change-Id: Iee1d877788b9397ca29a6cfe7bc3015c3edbe5ac
2012-08-13 09:06:44 -07:00
Jean-Baptiste Queru
0c2e5705d8
Merge upstream sepolicy into AOSP
...
Change-Id: Ia292607cbd06514a8ac3b0ad49eaefcdce12ef16
2012-08-13 07:50:58 -07:00
rpcraig
e07b8a56b9
Trusted Execution Environment policy.
2012-08-13 06:09:39 -04:00
Stephen Smalley
a1ce2fa221
Define wake_alarm and block_suspect capabilities.
2012-08-10 09:23:21 -04:00
rpcraig
abd977a79e
Additions for grouper/JB
2012-08-10 06:25:52 -04:00
Stephen Smalley
fed246510c
Allow debugfs access and setsched for mediaserver.
2012-08-09 08:36:10 -04:00
Stephen Smalley
6cce6199c3
Merge asec changes.
2012-07-31 09:52:17 -04:00
Stephen Smalley
1d19f7e356
Allow system_server to relabel /data/anr.
2012-07-31 09:45:01 -04:00
Stephen Smalley
5f9917c136
Allow debuggerd to restorecon the tombstone directory.
2012-07-31 09:15:46 -04:00
Haiqing Jiang
901cc36664
Untrusted_app gets route information
2012-07-30 16:54:24 -04:00
Haiqing Jiang
c70dc4e3c7
domain writes to cgroup pseudo filesystem
2012-07-30 16:40:03 -04:00
Stephen Smalley
d28714c6f9
Introduce app_read_logs boolean.
2012-07-30 16:04:47 -04:00
Haiqing Jiang
3261feef97
untrusted_app reads logs when android_cts enabled
2012-07-30 16:02:44 -04:00
Haiqing Jiang
173cbdd352
read permission over lnk_file to devices when android_cts enabled
2012-07-30 16:02:36 -04:00
rpcraig
e7e65d474f
New asec container labeling.
...
This patchset covers the /mnt/asec variety only.
2012-07-30 14:20:40 -04:00
rpcraig
b19665c39d
Add mac_permissions.xml file.
...
This was moved from external/mac-policy.git
2012-07-30 09:33:03 -04:00
Haiqing Jiang
1f0f77fcdf
Allow CTS Test apps to access to system_data_file
2012-07-30 08:26:53 -04:00
Haiqing Jiang
59e9680825
socket permissions to untrusted_app
2012-07-30 08:26:47 -04:00
Haiqing Jiang
1ce0fe382a
appdomain r/w apk_tmp_file and shell_data_file on android_cts enabled
2012-07-30 08:26:40 -04:00
Stephen Smalley
dd31ddfd87
seinfo can be used to select types, and sebool is now supported.
2012-07-27 17:08:21 -04:00
Haiqing Jiang
2b47c3fc35
allocate perms to platformappdomain over system_data_file
2012-07-27 17:01:33 -04:00
Haiqing Jiang
19e7fbeb25
mediaserver and system require abstract socket connnection
2012-07-27 16:22:14 -04:00
Haiqing Jiang
f6ca1605bc
installd unlink platform_app_data_file
2012-07-27 16:16:39 -04:00
Haiqing Jiang
7585fc6400
Platform app domain sdcard accesses
2012-07-27 15:10:47 -04:00
Stephen Smalley
b9760aa0d5
Only enforce per-app process and file isolation via SELinux for third party apps, not platform apps.
...
Platform (any of the apps signed by build keys, i.e. platform|release|shared|media) apps expect to be able to share files with each other or with third party apps by passing open files or pathnames over Binder. Therefore, we switch to only enforcing the per-app process and file isolation via SELinux on third party apps, not platform apps.
Make the platform app domains mlstrustedsubjects so that they can access any files created by third party apps.
Introduce a new platform_app_data_file type for platform apps so that we can mark it as a mlstrustedobject and allow third party apps to read/write files created by the platform apps.
Specify this new type for the platform app entries in seapp_contexts.
Remove levelFromUid=true for the platform apps in seapp_contexts since we are no longer enforcing per-app separation among them.
2012-07-27 11:07:09 -04:00
Haiqing Jiang
3296dea427
external/sepolicy: mediaserver open application data files
2012-07-24 09:01:02 -04:00
hqjiang
569f589aa6
external/sepolicy: system r/w udp_socket of appdomain
2012-07-24 09:00:32 -04:00
hqjiang
8f781f5767
external/sepolicy: install daemon unlink application data files
2012-07-24 08:59:27 -04:00
hqjiang
4c06d273bc
Target the denials/policies over qtaguid file and device: 1. Relabel /proc/net/xt_qtaguid/ctrl from "qtaguid" to "qtaguid_proc"; 2. Label /dev/xt_qtaguid with "qtaguid_device"; 3. Allow mediaserver read/[write] to qtaguid_proc and qtaguid_device; 4. Allow media apps read/[write] to qtaguid_proc and qtaguid_device; 5. Allow system read/[write] to qtaguid_proc and qtaguid_device.
...
Actually, some of policies related to qtaguid have been there already, but
we refind existing ones and add new ones.
2012-07-19 16:11:24 -04:00
hqjiang
20d6963ac2
allow camera calibration
2012-07-19 16:09:58 -04:00
Matt Finifter
af56ac1954
Include su.te only for userdebug/eng builds.
...
Change-Id: Ia544f13910abbe5e9f6a6cafae397415a41a7a94
2012-07-18 13:25:23 -07:00
Stephen Smalley
1c7351652c
Address various denials introduced by JB/4.1.
2012-07-12 13:26:15 -04:00
Stephen Smalley
c331d0fefa
Restore devnull initial sid context.
2012-07-12 10:14:38 -04:00
William Roberts
dc1072365e
Support for ocontexts per device.
...
ocontexts was split up into 4 files:
1.fs_use
2.genfs_contexts
3.initial_sid_contexts
4.port_contexts
Each file has their respective declerations in them.
Devices, in their respective device directory, can now specify sepolicy.fs_use, sepolicy.genfs_contexts, sepolicy.port_contexts, and sepolicy.initial_sid_contexts. These declerations will be added right behind their respective sepolicy counterparts in the concatenated configuration file.
2012-07-12 10:02:45 -04:00
