Commit graph

43925 commits

Author SHA1 Message Date
Dennis Shen
72da88530f Merge "add next_boot_prop SELinux context to store staged sys prop" into main 2023-10-13 18:22:56 +00:00
Dennis Shen
bb028e3e9a add next_boot_prop SELinux context to store staged sys prop
Bug: b/300111812
Change-Id: I02f1ba586fb6dfec90ae1ff6d4bb6518f294c5d7
Merged-In: I02f1ba586fb6dfec90ae1ff6d4bb6518f294c5d7
2023-10-12 16:12:30 +00:00
Jiakai Zhang
b6a3360ea3 Merge "Allow profman to read from memfd created by artd." into main 2023-10-12 14:59:38 +00:00
Jiakai Zhang
8ff6c55fc4 Allow profman to read from memfd created by artd.
Bug: 257532944

Change-Id: I13a953c533b1789eb06158a5ffa227fa986870fc
2023-10-12 13:48:00 +00:00
Maciej Żenczykowski
b5114387a0 Merge "tethering apex - label netbpfload" into main 2023-10-11 17:03:34 +00:00
Alex Buynytskyy
d328cfccee Merge "Fix sepolicy finalization build error" into main 2023-10-11 15:31:43 +00:00
Inseob Kim
9ca80edf2a Fix sepolicy finalization build error
Bug: 304532197
Test: manually run finalization script
Change-Id: I62caa28b45940753c11cb6d44c1270a4637c120a
2023-10-11 22:58:45 +09:00
Maciej Żenczykowski
6b7fe0b63e tethering apex - label netbpfload
We may want to use a dedicated selinux context
for this in the future, but in the mean time we
need this.

Test: TreeHugger
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: Ib3ed06efc4d2e3a621f187543fad4ab1a84027ec
2023-10-11 03:49:23 -07:00
Treehugger Robot
57056e5249 Merge "Fix context for mapping/xx.yy.compat.cil files" into main 2023-10-11 03:18:57 +00:00
Maciej Żenczykowski
834447d058 file_contexts: remove btfloader, add netbpfload
btfloader is dead.  bpfloader is being split in twain.
(it will eventually get it's own context, but for now this works)

Test: TreeHugger
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I7577e777545a0fa77a6467fb425aefc99a6e68d0
2023-10-09 18:46:07 +00:00
Daniele Di Proietto
c9b8e1b2b0 Merge "tracing: SELinux access to a couple of more binder events" into main 2023-10-09 10:23:06 +00:00
Vladimir Komsiyski
6e07de8088 Merge "Policy for virtualdevice_native service." into main 2023-10-06 14:20:09 +00:00
Vladimir Komsiyski
31facf0677 Policy for virtualdevice_native service.
A parallel implementation of certain VDM APIs that need to
be exposed to native framework code.

Similar to package_native_service.

Not meant to be used directly by apps but should still be
available in the client process via the corresponding native
manager (e.g. SensorManager).

Starting the service: ag/24955732
Testing the service: ag/24955733

Bug: 303535376
Change-Id: I90bb4837438de5cb964d0b560585b085cc8eabef
Test: manual
2023-10-06 12:52:42 +00:00
Thiébaud Weksteen
6bf1581f1c Fix context for mapping/xx.yy.compat.cil files
The current file_contexts regular expression did not include the
.compat part of the policy.

Before:
  # ls -alZ /system/etc/selinux/mapping
  drwxr-xr-x 2 root root u:object_r:system_file:s0       332 2009-01-01 00:00 .
  drwxr-xr-x 3 root root u:object_r:system_file:s0       376 2009-01-01 00:00 ..
  -rw-r--r-- 1 root root u:object_r:sepolicy_file:s0  224062 2009-01-01 00:00 10000.0.cil
  -rw-r--r-- 1 root root u:object_r:sepolicy_file:s0  112668 2009-01-01 00:00 29.0.cil
  -rw-r--r-- 1 root root u:object_r:system_file:s0      1003 2009-01-01 00:00 29.0.compat.cil
  -rw-r--r-- 1 root root u:object_r:sepolicy_file:s0  125916 2009-01-01 00:00 30.0.cil
  -rw-r--r-- 1 root root u:object_r:system_file:s0      1059 2009-01-01 00:00 30.0.compat.cil
After:
  # ls -alZ /system/etc/selinux/mapping
  drwxr-xr-x 2 root root u:object_r:system_file:s0       332 2023-10-06 03:40 .
  drwxr-xr-x 3 root root u:object_r:system_file:s0       376 2023-10-06 03:40 ..
  -rw-r--r-- 1 root root u:object_r:sepolicy_file:s0  224062 2023-10-04 22:58 10000.0.cil
  -rw-r--r-- 1 root root u:object_r:sepolicy_file:s0  112668 2023-10-04 22:58 29.0.cil
  -rw-r--r-- 1 root root u:object_r:sepolicy_file:s0    1003 2023-09-06 01:51 29.0.compat.cil
  -rw-r--r-- 1 root root u:object_r:sepolicy_file:s0  125916 2023-10-04 22:58 30.0.cil
  -rw-r--r-- 1 root root u:object_r:sepolicy_file:s0    1059 2023-09-06 01:51 30.0.compat.cil

Test: boot cf & inspect new labels
Bug: 299839280
Change-Id: Ic833ccf59a6c75b0757df9de6e3fed0992839c74
2023-10-06 15:20:35 +11:00
Xin Li
d1b58121a5 Merge Android 14
Bug: 298295554
Merged-In: I3339a7abfe2612993ee659fd5492c323aa895999
Change-Id: Iced16bd9ddd92f0fbd2e7729c1be3d1da77e3e46
2023-10-05 15:45:28 -07:00
Treehugger Robot
f0abf27f6f Merge "Add prebuilt_sepolicy_srcs filegroup" into main am: e91594e4e4
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/2770384

Change-Id: Icc2f107e285989503093905b33a3cb522dcc54db
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
2023-10-05 17:12:29 +00:00
Treehugger Robot
e91594e4e4 Merge "Add prebuilt_sepolicy_srcs filegroup" into main 2023-10-05 16:23:23 +00:00
Treehugger Robot
c6dc0891a3 Merge "Ignore non-API access by gmscore_app" into main am: e63aa48664
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/2773824

Change-Id: Ia4dccb7864a7a0fcb7db4c948d0df67e882acbdf
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
2023-10-05 09:22:22 +00:00
Treehugger Robot
e63aa48664 Merge "Ignore non-API access by gmscore_app" into main 2023-10-05 08:53:18 +00:00
Hyundo Moon
91c06fcea1 Merge "Add system property bluetooth.profile.pbap.sim.enabled" into main am: c044f04024
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/2771284

Change-Id: I88e1aae7e15e589a62cb7e8132117696c6a6f610
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
2023-10-05 08:05:57 +00:00
Hyundo Moon
c044f04024 Merge "Add system property bluetooth.profile.pbap.sim.enabled" into main 2023-10-05 07:30:40 +00:00
Treehugger Robot
695b1b571b Merge "Show only violating entries on sepolicy_tests" into main am: e896f19f55
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/2762846

Change-Id: I1c2fbaa8a86187c5b5cd839dfb5d9ad403d8fc05
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
2023-10-05 01:48:58 +00:00
Treehugger Robot
e896f19f55 Merge "Show only violating entries on sepolicy_tests" into main 2023-10-05 01:12:26 +00:00
Garfield Tan
d8c51f24ce Add prebuilt_sepolicy_srcs filegroup
This allows OEM to get a copy of precompiled SEPolicy. This can be
useful when an OEM needs to bind-mount some of the Android partitions
across the VM boundary to ensure the correct labeling.

Bug: 301629552
Test: Presubmit builds should be enough.
Change-Id: I3339a7abfe2612993ee659fd5492c323aa895999
2023-10-04 17:39:32 -07:00
Thiébaud Weksteen
a9020309f6 Ignore non-API access by gmscore_app
Bug: 303319090
Bug: 303272800
Bug: 303374964
Test: m selinux_policy
Change-Id: I0999023b315bd31d70b1908353acebc87182747c
2023-10-05 09:49:49 +11:00
Hyundo Moon
db5f0df869 Add system property bluetooth.profile.pbap.sim.enabled
Bug: 291519380
Test: Builds successfully
Change-Id: Ic19dd934c84c28e9a5d78c06fb07c2579b2c0a35
2023-10-04 23:18:45 +09:00
Steve Muckle
bd24038bb1 Merge "allow writes to /sys/power/sync_on_suspend from init" into main am: a4c440948b
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/2771125

Change-Id: I45a1841088438d19052353bab114b2d28006d103
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
2023-10-04 14:05:29 +00:00
Steve Muckle
a4c440948b Merge "allow writes to /sys/power/sync_on_suspend from init" into main 2023-10-04 13:32:58 +00:00
Steve Muckle
75603e3ccd allow writes to /sys/power/sync_on_suspend from init
When suspend.disable_sync_on_suspend is set init must write to
/sys/power/sync_on_suspend.

Bug: 285395636
Change-Id: Ica1b039c3192f08ec84aa07d35c2d0c61e7449c0
2023-10-04 07:44:33 +00:00
Inseob Kim
34d6c64705 Show only violating entries on sepolicy_tests
This is for more visibility upon error.

Test: m sepolicy_test
Change-Id: Idad76505c9574e356d101c14f24ef68414475f65
2023-10-04 16:03:12 +09:00
Thiébaud Weksteen
0ae3f11e2d Merge "Track denials from gmscore_app to read_policy" into main am: c9daa54919
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/2770201

Change-Id: I7e0172f0bd3eb401648c64281ff9f3406af449c3
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
2023-10-04 05:43:56 +00:00
Thiébaud Weksteen
c9daa54919 Merge "Track denials from gmscore_app to read_policy" into main 2023-10-04 05:11:58 +00:00
Thiébaud Weksteen
6f67245436 Track denials from gmscore_app to read_policy
avc:  denied  { read_policy } for  comm="IntentService[D" scontext=u:r:gmscore_app:s0:c512,c768 tcontext=u:object_r:kernel:s0 tclass=security permissive=0 app=com.google.android.gms

Bug: 303319090
Test: presubmit
Change-Id: I99f328e1a8e116120d4915ed5dc55c305c6ca77f
2023-10-04 05:10:39 +00:00
Roshan Pius
0282b5dfbf sepolicy(apex): Create NFC apex am: bca3c75421
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/2770906

Change-Id: Id4f3b571ec0432129acbb9d5013a3ddd5a174fbf
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
2023-10-04 01:42:43 +00:00
Roshan Pius
bca3c75421 sepolicy(apex): Create NFC apex
Bug: 303286040
Test: Compiles
Change-Id: I6a0edcb29879880f18e96d7d7a9cb1b08be1dc1b
2023-10-03 13:31:42 -07:00
Brian Lindahl
0b19988829 [automerger skipped] Allow for server-side configuration of libstagefright am: 74ced30a63 -s ours am: 6d6c375441 -s ours am: d9c3aec4f2 -s ours am: b200a756a0 -s ours
am skip reason: Merged-In I72670ee42c268dd5747c2411d25959d366dd972c with SHA-1 6d3e772828 is already in history

Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/2762385

Change-Id: I2494150690c97f2c13ba829a6840d5e36b5d67d2
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
2023-09-29 22:52:40 +00:00
Brian Lindahl
b200a756a0 [automerger skipped] Allow for server-side configuration of libstagefright am: 74ced30a63 -s ours am: 6d6c375441 -s ours am: d9c3aec4f2 -s ours
am skip reason: Merged-In I72670ee42c268dd5747c2411d25959d366dd972c with SHA-1 6d3e772828 is already in history

Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/2762385

Change-Id: Iacb6a5a7d103fd7125a5bdf48e2438fd3aece40e
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
2023-09-29 21:35:59 +00:00
Brian Lindahl
d9c3aec4f2 [automerger skipped] Allow for server-side configuration of libstagefright am: 74ced30a63 -s ours am: 6d6c375441 -s ours
am skip reason: Merged-In I72670ee42c268dd5747c2411d25959d366dd972c with SHA-1 6d3e772828 is already in history

Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/2762385

Change-Id: I9f39e5b28001ed8307bb444b46e846b9d8767d76
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
2023-09-29 20:36:18 +00:00
Brian Lindahl
6d6c375441 [automerger skipped] Allow for server-side configuration of libstagefright am: 74ced30a63 -s ours
am skip reason: Merged-In I72670ee42c268dd5747c2411d25959d366dd972c with SHA-1 6d3e772828 is already in history

Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/2762385

Change-Id: Ib82db36340060d01bf9284135768cb4cb6744e73
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
2023-09-29 19:32:34 +00:00
Brian Lindahl
74ced30a63 Allow for server-side configuration of libstagefright
Relaxation of SELinux policies to allow users of libstagefright and
MediaCodec to be able to query server-side configurable flags.

Bug: 301372559
Bug: 301250938
Test: run cts -m CtsSecurityHostTestCases
Change-Id: I72670ee42c268dd5747c2411d25959d366dd972c
Merged-In: I72670ee42c268dd5747c2411d25959d366dd972c
2023-09-29 16:14:52 +00:00
Brian Lindahl
8d20608696 [automerger skipped] Allow for server-side configuration of libstagefright am: 6d3e772828 -s ours am: 35d4336d4c -s ours am: 9ba6bba67e -s ours
am skip reason: Merged-In I72670ee42c268dd5747c2411d25959d366dd972c with SHA-1 1b32bccc1a is already in history

Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/2762618

Change-Id: I2305cd00e3c8f3c2ff721674c6fe8af500d04da4
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
2023-09-28 19:39:50 +00:00
Brian Lindahl
9ba6bba67e [automerger skipped] Allow for server-side configuration of libstagefright am: 6d3e772828 -s ours am: 35d4336d4c -s ours
am skip reason: Merged-In I72670ee42c268dd5747c2411d25959d366dd972c with SHA-1 1b32bccc1a is already in history

Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/2762618

Change-Id: I4eea155c28552d50ebcb312aa162dab2863e2483
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
2023-09-28 18:09:14 +00:00
Brian Lindahl
35d4336d4c [automerger skipped] Allow for server-side configuration of libstagefright am: 6d3e772828 -s ours
am skip reason: Merged-In I72670ee42c268dd5747c2411d25959d366dd972c with SHA-1 1b32bccc1a is already in history

Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/2762618

Change-Id: I556bbfb35c7aeb3564e63cd9ed993aae15e2baae
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
2023-09-28 17:10:46 +00:00
Brian Lindahl
6d3e772828 Allow for server-side configuration of libstagefright
Relaxation of SELinux policies to allow users of libstagefright and
MediaCodec to be able to query server-side configurable flags.

Bug: 301372559
Bug: 301250938
Test: run cts -m CtsSecurityHostTestCases
Change-Id: I72670ee42c268dd5747c2411d25959d366dd972c
Merged-In: I72670ee42c268dd5747c2411d25959d366dd972c
2023-09-28 13:25:32 +00:00
Treehugger Robot
fad17a0f0b Merge "create disable_sync_on_suspend property" into main am: da002632a2
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/2762619

Change-Id: Ica5164157405df6ef1963e57f372680a462bdb0b
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
2023-09-28 00:52:03 +00:00
Treehugger Robot
da002632a2 Merge "create disable_sync_on_suspend property" into main 2023-09-28 00:03:50 +00:00
Brian Lindahl
7c5134977f [automerger skipped] Allow for server-side configuration of libstagefright am: 1b32bccc1a -s ours am: 41e9533e8e -s ours
am skip reason: Merged-In I95aa6772a40599636d109d6960c2898e44648c9b with SHA-1 ffeb680417 is already in history

Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/2762467

Change-Id: If30fb80505eb55e02b7bd76e8c69f04dcd94a5ab
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
2023-09-27 21:50:59 +00:00
Brian Lindahl
41e9533e8e [automerger skipped] Allow for server-side configuration of libstagefright am: 1b32bccc1a -s ours
am skip reason: Merged-In I95aa6772a40599636d109d6960c2898e44648c9b with SHA-1 ffeb680417 is already in history

Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/2762467

Change-Id: I719b9b0dd51bac4ac0fc513402918ca1c73dbe10
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
2023-09-27 20:32:10 +00:00
Steve Muckle
931b1a0f35 create disable_sync_on_suspend property
Bug: 285395636
Test: suspend/resume testing
Change-Id: I6a770241bca41929bc99dd86828b28a570dea68c
2023-09-27 16:33:09 +00:00
Yu-Ting Tseng
f3e2bf3bc2 Merge "Revert "Revert "SELinux policy changes for uprobe.""" into main am: 7a9e87c4dc
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/2762026

Change-Id: I8bc9096be89bea5d84e63e5f040a4ee170171676
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
2023-09-27 16:26:11 +00:00