tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
20370 commits 1 branch 0 tags 50 MiB
Commit graph

18 commits

Author SHA1 Message Date
Tao Bao
75182a1ea6 Add persist.sys.theme. 
This property will be set by system_server (to indicate the currently
selected theme for device), and can be accessed by vendor init.rc.

avc:  denied  { read } for property=persist.sys.theme pid=0 uid=0 gid=0 scontext=u:r:vendor_init:s0 tcontext=u:object_r:theme_prop:s0 tclass=file

Bug: 113028175
Test: Set a vendor init trigger that waits on `persist.sys.theme`. Check
      that the trigger fires without denial.
Change-Id: Ibb4e392d5059b76059f36f7d11ba82cd65cbe970
 2019-06-17 10:48:21 -07:00
David Anderson
51fae66027 Allow init to mkdir inside /data/gsi. 
Bug: 133435561
Test: adb shell gsi_tool install
Change-Id: Iaa610c72d8098e157bb89e321624369f86f4ea19
Merged-In: Iaa610c72d8098e157bb89e321624369f86f4ea19
 2019-05-28 13:42:42 -07:00
Alistair Strachan
4cd2db897d Merge "Fix selinux denials when applying updates in recovery." into qt-dev 2019-05-24 17:50:56 +00:00
TreeHugger Robot
cf48bfd082 Merge "Properly define hal_codec2 and related policies" into qt-dev 2019-05-24 07:21:23 +00:00
David Anderson
115aafa7ab Fix selinux denials when applying updates in recovery. 
These lines are copied from update_engine.te, and are needed to update
dynamic partitions in recovery.

Bug: 132943965
Test: sideload OTA on cuttlefish
Change-Id: Id03a658aac69b8d20fa7bb758530a4469c75cf9c
Merged-In: Id03a658aac69b8d20fa7bb758530a4469c75cf9c
 2019-05-23 13:20:03 -07:00
Pawin Vongmasa
609c243dd0 Properly define hal_codec2 and related policies 
Test: make cts -j123 && cts-tradefed run cts-dev -m \
CtsMediaTestCases --compatibility:module-arg \
CtsMediaTestCases:include-annotation:\
android.platform.test.annotations.RequiresDevice

Bug: 131677974
Change-Id: I59c3d225499a8c53c2ed9f3bd677ff3d7423990b
 2019-05-23 03:53:47 -07:00
Tri Vo
ab2e89a695 Merge "sepolicy: allow hal_omx to access audio devices" into qt-dev 2019-05-22 21:49:49 +00:00
TreeHugger Robot
63ab8cd63c Merge "Add support_kernel_idle_timer to sepolicy" into qt-dev 2019-05-22 18:47:52 +00:00
Tao Bao
0ad88f096a Merge changes from topic "darkboot-sepolicy" into qt-dev 
* changes:
  Add vendor_misc_writer change to API 29 prebuilts.
  Add vendor_misc_writer.
  Add persist.sys.device_provisioned change to API 29 prebuilts.
  Set persist.sys.device_provisioned vendor-init-readable.
 2019-05-22 18:35:19 +00:00
Vignesh Kulothungan
ce9fc89865 sepolicy: allow hal_omx to access audio devices 
hal_omx needs to access audio devices to use OMX HW decoders and
encoders. Allow hal_omx to access audio devices.

authored-by: Banajit Goswami <bgoswami@codeaurora.org>

Bug: 133224154
Change-Id: I742c29c4105e5647ca1a7e017e311559a0567b52
(cherry picked from commit 155ca12879)
 2019-05-22 10:35:16 -07:00
TreeHugger Robot
dc42fed227 Merge "Allow init to set context for super_block_device" into qt-dev 2019-05-21 20:10:56 +00:00
Hridya Valsaraju
6d66c0214f Allow init to set context for super_block_device 
Fixes the following denial during boot:

[    1.358156] selinux: SELinux: Could not set context for
/dev/block/platform/soc/1d84000.ufshc/by-name/super:  Permission denied\x0a
[    1.358275] audit: type=1400 audit(951562.676:7):
avc:  denied  { relabelto } for  pid=1 comm="init" name="super"
dev="tmpfs" ino=17657 scontext=u:r:init:s0 tcontext=u:object_r:super_block_device:s0
tclass=lnk_file permissive=0

Bug: 124410201
Test: make
Change-Id: Ib6752b8a6ae4211ba8c0a7417295b8144a2fed67
Merged-In: Ib6752b8a6ae4211ba8c0a7417295b8144a2fed67
 2019-05-21 16:53:39 +00:00
Tao Bao
e618874192 Add vendor_misc_writer change to API 29 prebuilts. 
This is a matching change for commit 8f39cce73a ("Add
vendor_misc_writer."), which updates the prebuilts for API 29.

Bug: 132906936
Test: Build crosshatch that includes misc_writer module. Invoke
      /vendor/bin/misc_writer to write data to /misc.
Change-Id: Id12a1ed45c8cef6e4039a9dda6a1fb41f9e014de
 2019-05-21 07:11:36 -07:00
Tao Bao
ab8db0999c Add persist.sys.device_provisioned change to API 29 prebuilts. 
This is a matching change for commit 97d4561941 ("Set
persist.sys.device_provisioned vendor-init-readable."), which updates
the prebuilts for API 29.

Bug: 131702833
Bug: 132906936
Test: Set an init trigger that waits on `persist.sys.device_provisioned`.
      Check that there's no longer a denial.
Change-Id: I2cea3d000b7faa471fa524dcd7a3d4843ae5960f
 2019-05-21 07:04:37 -07:00
Nikita Ioffe
f7c3d19d29 selinux: Allow dumpstate send signals to vold 
Test: adb bugreport
Test: verified vold stacktrace is present in bugreport
Bug: 132344997
Change-Id: I0ebf7f171d854b9aaf894ccb8c7a5f68f18e692b
 2019-05-21 13:03:55 +01:00
Alec Mouri
2e4dd2b6f2 Add support_kernel_idle_timer to sepolicy 
Bug: 130684082
Test: boots
Change-Id: I7ee84a5ff1024162037634d6f5efe7b09557e18a
 2019-05-20 10:34:40 -07:00
Ady Abraham
a6ba39bde1 Add ro.surface_flinger.set_touch_timer_ms to sepolicy 
Test: set ro.surface_flinger.set_touch_timer_ms from init
Bug: 131906818
Change-Id: If489ae4ac993984305f764fb172014f42c41df67
 2019-05-16 14:07:32 -07:00
Ian Pedowitz
94b7372534 SEPolicy Prebuilts for Q 
Bug: 129943426
Test: Build
Change-Id: I3e091652fa8d1757b1f71f7559186d5b32f000d5
 2019-05-14 21:42:22 -07:00