tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
29472 commits 1 branch 0 tags 50 MiB
Commit graph

29472 commits

This branch
This branch
All branches
Author SHA1 Message Date
Xusong Wang
7dfd4783bc Merge "Allow NN HAL service to read files from apk data files" am: c5bae6f802 
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/1679971

Change-Id: I074eb4d1252917bf0681fc91da22f21c7ee87bb0
 2021-04-28 15:43:24 +00:00
Xusong Wang
c5bae6f802 Merge "Allow NN HAL service to read files from apk data files" 2021-04-28 15:09:42 +00:00
Midas Chien
fca308fbdf Add a sysprop to set display update imminent timeout am: 3c24ea1793 
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/1688265

Change-Id: Ib241e58bda3208dd2c886722b9061f4d35e02e9c
 2021-04-28 06:58:00 +00:00
Midas Chien
3c24ea1793 Add a sysprop to set display update imminent timeout 
Adding 'ro.surface_flinger.display_update_imminent_timeout_ms' to set
timeout for rate limit display update imminent notifications.

Bug: 164411401
Change-Id: I90a00fe7f8df3aa505f08081d096fd83b3342f59
 2021-04-27 20:45:29 +08:00
Treehugger Robot
5fc200133c Merge "[incfs] Allow everyone read the IncFS sysfs features" am: 98914119ae 
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/1683348

Change-Id: Ib74b71af500a1751407697b658a30cd1f06635fe
 2021-04-26 22:48:30 +00:00
Treehugger Robot
98914119ae Merge "[incfs] Allow everyone read the IncFS sysfs features" 2021-04-26 22:19:37 +00:00
Treehugger Robot
e85d0ef89c Merge "Fix permissions for vold.post_fs_data_done" am: 206d6d80a1 
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/1684054

Change-Id: Ie7b4b792d06130a9d2b9b1121a2b1c6cb487d90c
 2021-04-26 20:58:55 +00:00
Treehugger Robot
206d6d80a1 Merge "Fix permissions for vold.post_fs_data_done" 2021-04-26 20:36:34 +00:00
Eric Biggers
040ce199b2 Fix permissions for vold.post_fs_data_done 
The system property "vold.post_fs_data_done" is used by init and vold to
communicate with each other in order to set up FDE on devices that use
FDE.  It needs to be gettable and settable by vold, and settable by init
and vendor_init.  This was the case in Android 11 and earlier; however,
the change
https://android-review.googlesource.com/c/platform/system/sepolicy/+/1277447
("Rename exported and exported2 vold prop") broke this by giving this
property the type "vold_config_prop", which made it no longer settable
by vold.

Since none of the existing property types appear to be appropriate for
this particular property, define a new type "vold_post_fs_data_prop" and
grant the needed domains permission to get/set it.

This is one of a set of changes that is needed to get FDE working again
so that devices that launched with FDE can be upgraded to Android 12.

Bug: 186165644
Test: Tested FDE on Cuttlefish
Change-Id: I2fd8af0091f8b921ec37381ad3b85a156d074566
 2021-04-26 12:43:05 -07:00
Hridya Valsaraju
b4fe53980f Merge changes from topic "revert-1668411-MWQWEZISXF" am: 7362f58895 
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/1685768

Change-Id: I70943f02d4d3d7d915e5c820db872519c9766e06
 2021-04-23 22:26:18 +00:00
Hridya Valsaraju
7362f58895 Merge changes from topic "revert-1668411-MWQWEZISXF" 
* changes:
  Revert "Add a neverallow for debugfs mounting"
  Revert "Add neverallows for debugfs access"
  Revert "Exclude vendor_modprobe from debugfs neverallow restrictions"
  Revert "Check that tracefs files are labelled as tracefs_type"
 2021-04-23 22:06:31 +00:00
Robert Horvath
03070a86ec Merge "Add bootanim property context, ro.bootanim.quiescent.enabled property" am: dbfe4809ba 
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/1676224

Change-Id: I54ee8a4383490b5e05ed5dda46676bb3e0db145b
 2021-04-23 17:06:58 +00:00
Robert Horvath
dbfe4809ba Merge "Add bootanim property context, ro.bootanim.quiescent.enabled property" 2021-04-23 16:45:32 +00:00
Hridya Valsaraju
f9dbb72654 Revert "Add a neverallow for debugfs mounting" 
Revert submission 1668411

Reason for revert: Suspect for b/186173384
Reverted Changes:
Iaa4fce9f0:Check that tracefs files are labelled as tracefs_t...
I743a81489:Exclude vendor_modprobe from debugfs neverallow re...
I63a22402c:Add neverallows for debugfs access
I289f2d256:Add a neverallow for debugfs mounting

Change-Id: Ie04d7a4265ace43ba21a108af85f82ec137c6af0
 2021-04-23 16:38:20 +00:00
Hridya Valsaraju
e95e0ec0a5 Revert "Add neverallows for debugfs access" 
Revert submission 1668411

Reason for revert: Suspect for b/186173384
Reverted Changes:
Iaa4fce9f0:Check that tracefs files are labelled as tracefs_t...
I743a81489:Exclude vendor_modprobe from debugfs neverallow re...
I63a22402c:Add neverallows for debugfs access
I289f2d256:Add a neverallow for debugfs mounting

Change-Id: I9b7d43ac7e2ead2d175b265e97c749570c95e075
 2021-04-23 16:38:20 +00:00
Hridya Valsaraju
231c04b2b9 Revert "Exclude vendor_modprobe from debugfs neverallow restrictions" 
Revert submission 1668411

Reason for revert: Suspect for b/186173384
Reverted Changes:
Iaa4fce9f0:Check that tracefs files are labelled as tracefs_t...
I743a81489:Exclude vendor_modprobe from debugfs neverallow re...
I63a22402c:Add neverallows for debugfs access
I289f2d256:Add a neverallow for debugfs mounting

Change-Id: I04f8bfdc0e5fe8d2f7d6596ed7b840332d611485
 2021-04-23 16:38:20 +00:00
Hridya Valsaraju
a00863e4d8 Revert "Check that tracefs files are labelled as tracefs_type" 
Revert submission 1668411

Reason for revert: Suspect for b/186173384
Reverted Changes:
Iaa4fce9f0:Check that tracefs files are labelled as tracefs_t...
I743a81489:Exclude vendor_modprobe from debugfs neverallow re...
I63a22402c:Add neverallows for debugfs access
I289f2d256:Add a neverallow for debugfs mounting

Change-Id: I398e7ecb0403c2044027c3145438d02b9ffaeb8a
 2021-04-23 16:38:20 +00:00
Treehugger Robot
d9544031d3 Merge "Revert^3 "Build userdebug_plat_sepolicy.cil with Android.bp"" am: f02af9d91c 
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/1684313

Change-Id: If4392f68e7a7daea7f269741380ad14f3ef35541
 2021-04-23 13:20:36 +00:00
Treehugger Robot
f02af9d91c Merge "Revert^3 "Build userdebug_plat_sepolicy.cil with Android.bp"" 2021-04-23 13:09:24 +00:00
Inseob Kim
a46d61cd3f Revert^3 "Build userdebug_plat_sepolicy.cil with Android.bp" 
e10ceab330

Change-Id: Ia1b38d6b709edb0e819ea4700e70ba68b1b61332
 2021-04-22 23:14:58 +00:00
Andrew Walbran
787c8b3320 Merge "Add crosvm domain and give virtmanager and crosvm necessary permissions." am: 3b6a385137 
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/1655917

Change-Id: I6da1e0688f85bf8f9c911e6cd4084e101e7b805d
 2021-04-22 20:24:58 +00:00
Andrew Walbran
3b6a385137 Merge "Add crosvm domain and give virtmanager and crosvm necessary permissions." 2021-04-22 18:57:15 +00:00
Treehugger Robot
95fef2b070 Merge changes from topic "debugfs_neverallow" am: 005ae599cd 
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/1668411

Change-Id: I90babf42eb8504fb2b0fa269a4e538b557d2328d
 2021-04-22 17:03:14 +00:00
Florian Mayer
f5120b98a6 Merge "Revert^2 "Build userdebug_plat_sepolicy.cil with Android.bp"" am: 2b525c5ca3 
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/1683876

Change-Id: I690561365a51af21a5c1cc1a5bcf368b00304b9f
 2021-04-22 17:00:37 +00:00
Treehugger Robot
005ae599cd Merge changes from topic "debugfs_neverallow" 
* changes:
  Check that tracefs files are labelled as tracefs_type
  Exclude vendor_modprobe from debugfs neverallow restrictions
  Add neverallows for debugfs access
  Add a neverallow for debugfs mounting
 2021-04-22 16:41:06 +00:00
Florian Mayer
2b525c5ca3 Merge "Revert^2 "Build userdebug_plat_sepolicy.cil with Android.bp"" 2021-04-22 16:40:24 +00:00
Florian Mayer
e10ceab330 Revert^2 "Build userdebug_plat_sepolicy.cil with Android.bp" 
0177004c7f

Change-Id: I40aa5025d487922decd9909c0d35c9e3a6b8dd61
 2021-04-22 16:38:47 +00:00
Treehugger Robot
66f16a9acc Merge "Revert "Build userdebug_plat_sepolicy.cil with Android.bp"" am: 714864cc24 
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/1684325

Change-Id: Ib548845a0887bb5266e1f06ddbb342b4d943e15f
 2021-04-22 15:35:27 +00:00
Treehugger Robot
714864cc24 Merge "Revert "Build userdebug_plat_sepolicy.cil with Android.bp"" 2021-04-22 15:28:06 +00:00
Treehugger Robot
eba4818e88 Merge "sepolicy: Give access to ahal to flinger standby prop" am: e0646ba15b 
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/1658623

Change-Id: I0836fd09ee17319299413c3544e4765b43c4851f
 2021-04-22 02:58:37 +00:00
Treehugger Robot
e0646ba15b Merge "sepolicy: Give access to ahal to flinger standby prop" 2021-04-22 02:36:46 +00:00
Bowgo Tsai
0177004c7f Revert "Build userdebug_plat_sepolicy.cil with Android.bp" 
This reverts commit 57b64bd282.

Because it breaks the usage of boot-debug.img and
vendor_boot-debug.img.

Bug: 185970130
Bug: 185990198
Test: make bootimage_debug
Change-Id: I2c7c4f9954540a9be301b3ed0a6c2f0af2019803
 2021-04-22 09:55:21 +08:00
David Massoud
eeb537fcb8 Merge "Allow traced_probes to read devfreq" am: 47b6227134 
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/1676945

Change-Id: I21217e5e095b3113e6d65d006c043be75295a4d1
 2021-04-22 00:40:18 +00:00
David Massoud
47b6227134 Merge "Allow traced_probes to read devfreq" 2021-04-22 00:18:35 +00:00
Yurii Zubrytskyi
b382f02bf4 [incfs] Allow everyone read the IncFS sysfs features 
Every process needs to be able to determine the IncFS features
to choose the most efficient APIs to call

Bug: 184357957
Test: build + atest PackageManagerShellCommandTest
Change-Id: Ia84e3fecfd7be1209af076452cc27cc68aefd80d
 2021-04-21 15:15:40 -07:00
Hridya Valsaraju
fde9b8f069 Check that tracefs files are labelled as tracefs_type 
Bug: 184381659
Test: make
Change-Id: Iaa4fce9f02d85f2657f2331b68ae5af318d0820f
 2021-04-21 14:13:54 -07:00
Hridya Valsaraju
4b6d50dcb4 Exclude vendor_modprobe from debugfs neverallow restrictions 
vendor_modprobe loads kernel modules which may create files in
debugfs during module_init().

Bug: 179760914
Test: build
Change-Id: I743a81489f469d52f94a88166f8583a7d797db16
 2021-04-21 14:13:41 -07:00
Hridya Valsaraju
a0b504a484 Add neverallows for debugfs access 
Android R launching devices and newer must not ship with debugfs
mounted. For Android S launching devices and newer, debugfs must only be
mounted in userdebug/eng builds by init(for boot time initializations)
and dumpstate(for grabbing debug information from debugfs using the
dumpstate HAL).

This patch adds neverallow statements to prevent othe processes
being provided access to debugfs when the flag PRODUCT_SET_DEBUGFS_RESTRICTIONS
is set to true.

Test: make with/without PRODUCT_SET_DEBUGFS_RESTRICTIONS
Bug: 184381659
Change-Id: I63a22402cf6b1f57af7ace50000acff3f06a49be
 2021-04-21 14:13:22 -07:00
Hridya Valsaraju
1c3d898d87 Add a neverallow for debugfs mounting 
Android R launching devices and newer must not ship with debugfs
mounted. For Android S launching devices and newer, debugfs must only be
mounted in userdebug/eng builds by init(for boot time initializations)
and dumpstate(for grabbing debug information from debugfs). This patch
adds a neverallow statement that prevents processes other than init
from being provided access to mount debugfs in non-user builds
when the flag PRODUCT_SET_DEBUGFS_RESTRICTIONS is set to true.

Test: make with/without PRODUCT_SET_DEBUGFS_RESTRICTIONS
Bug: 184381659
Change-Id: I289f2d25662a78678929e29f83cb31cebd8ca737
 2021-04-21 14:13:02 -07:00
Steven Moreland
b1406bc54a Merge "sepolicy: allow BINDER_ENABLE_ONEWAY_SPAM_DETECTION for all processes" am: 7534762861 
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/1679693

Change-Id: I05b1c968f8446bfa49b42271c7d585a707af2dfd
 2021-04-21 16:59:56 +00:00
Steven Moreland
7534762861 Merge "sepolicy: allow BINDER_ENABLE_ONEWAY_SPAM_DETECTION for all processes" 2021-04-21 16:42:26 +00:00
Treehugger Robot
bed8f2ac24 Merge "Make suspend_prop system_vendor_config_prop" am: c78b80667c 
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/1681505

Change-Id: Ie6b1cfa813924da1f8a78ac37a638d6ad9a117b6
 2021-04-21 00:52:03 +00:00
Treehugger Robot
c78b80667c Merge "Make suspend_prop system_vendor_config_prop" 2021-04-21 00:28:12 +00:00
Seth Moore
ec3d371038 Merge "Enable pull metrics from keystore" am: 84742a3d92 
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/1674808

Change-Id: I4155db143c0b61da16e7f13fcbbe3816fd934f2e
 2021-04-20 16:25:35 +00:00
Benjamin Schwartz
c171a1d9b6 Make suspend_prop system_vendor_config_prop 
Bug: 185810834
Test: adb shell getprop suspend.short_suspend_threshold_millis
Change-Id: I270057e5f81b220b7168573b516dd102650f11e1
 2021-04-20 09:13:02 -07:00
Seth Moore
84742a3d92 Merge "Enable pull metrics from keystore" 2021-04-20 16:00:46 +00:00
Treehugger Robot
79d27196fd Merge "Move install_recovery.sh file_contexts mapping" am: 98dc738b57 
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/1679446

Change-Id: Ie3ff271da90697aba7d928debcd23f1aa7dc969e
 2021-04-20 11:36:53 +00:00
Treehugger Robot
98dc738b57 Merge "Move install_recovery.sh file_contexts mapping" 2021-04-20 11:18:35 +00:00
Jeff Vander Stoep
bf49a89ba5 Move install_recovery.sh file_contexts mapping 
The type is declared in vendor policy, so the mapping should live
there as well.

Fixes: 185288751
Test: TH
Change-Id: Ia446d7b5eb0444cdbd48d3628f54792d8a6b2786
 2021-04-20 11:32:24 +02:00
Treehugger Robot
b9f8fd42d5 Merge "Add a property to enable runtime debugfs restrictions in non-user builds" am: f5ec134342 
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/1663701

Change-Id: I06fff5f3ea60bfde9dc7b3230b780f3498cb5b6b
 2021-04-20 06:32:21 +00:00