This commit adds sepolicy on user build so that Thread HAL simulation
can run on cuttlefish user builds.
Bug: 342154029
Test: presubmit
Change-Id: I576f52a1bdf5b0966e73ee93e4b68bed613b0796
I locked down binderfs in Android V (this release still), but
part of it was opened up too much, so transactions restricted
to userdebug.
transaction_log and failed_transaction_log are not used in AOSP,
but they are requested by partners.
Bug: 316970771 for transactions
Bug: 336711420 for request to open up transaction history logs
Test: boot, bugreport, also:
:) adb shell ls -Z /dev/binderfs/binder_logs
u:object_r:binderfs_logs_transaction_history:s0 failed_transaction_log
u:object_r:binderfs_logs_proc:s0 proc
u:object_r:binderfs_logs:s0 state
u:object_r:binderfs_logs_stats:s0 stats
u:object_r:binderfs_logs_transaction_history:s0 transaction_log
u:object_r:binderfs_logs_transactions:s0 transactions
:) adb shell cat /dev/binderfs/binder_logs/transaction_log
10058502: reply from 6450:8668 to 6766:6766 context binder node 0 handle -1 size 36:0 ret 0/0 l=0
10058503: call from 6766:6766 to 6450:0 context binder node 199747 handle 23 size 116:0 ret 0/0 l=0
10058504: reply from 6450:8668 to 6766:6766 context binder node 0 handle -1 size 12:0 ret 0/0 l=0
10058505: call from 6766:6766 to 6450:0 context binder node 199747 handle 23 size 84:0 ret 0/0 l=0
...
:) adb shell cat /dev/binderfs/binder_logs/failed_transaction_log
26418: reply from 584:1568 to 0:0 context binder node 0 handle -1 size 20:0 ret 29189/0 l=3194
57265: async from 2978:4304 to 3039:0 context binder node 40111 handle 6 size 96:0 ret 29189/-3 l=3465
57269: call from 4437:4613 to 670:0 context binder node 57183 handle 44 size 116:0 ret 29189/-3 l=3465
57288: async from 4252:4450 to 3039:0 context binder node 34895 handle 1 size 92:0 ret 29189/-3 l=3465
...
Change-Id: I73e570dee8e59e76acaf0def615701e0e85e207f
We need to maintain the Pre-reboot Dexopt state across system server
crashes and restarts, but not across reboots. System properties are
suitable for this use case. The state includes whether the job has run
and the OTA slot.
Bug: 311377497
Change-Id: I527d4ba6064c1600d97ce2efc8be211b9460a8f0
Test: Presubmit
Define new classes and access vectors recognised by the kernel.
Bug: 340491179
Test: boot and check logs for undefined class or permission
Change-Id: I9b32916ea231cf396aa326ed7e08cb14e4eb2c9b
Symlink the access vectors and classes definitions of microdroid
reqd_mask to microdroid platform.
These definitions are not yet linked to the generic platform policy.
Bug: 340491179
Bug: 215093641
Test: build & TH
Change-Id: I7c4771dedfd2f35a7dda7d78bf863cbc0c288e67
dumpstate may be executed by apps in different domains. Notably, a
system_app needs to be able to save the output in its own directory.
avc: denied { append } for comm="binder:575_1" dev="dm-50"
ino=10712 scontext=u:r:dumpstate:s0
tcontext=u:object_r:system_app_data_file:s0 tclass=file
Using the app_data_file_type attribute to capture all the potential app
data types. For info, the current Cuttlefish policy has:
$ seinfo -x -a app_data_file_type cf_policy
attribute app_data_file_type;
app_data_file
bluetooth_data_file
nfc_data_file
privapp_data_file
radio_data_file
sdk_sandbox_data_file
shell_data_file
storage_area_app_dir
storage_area_content_file
storage_area_dir
system_app_data_file
Test: bugreport
Change-Id: I7685c1fcdb3896c44fe44008b1b262c3f1e90a01
When odsign spawns compos_verify it has our stdin/out connected to its
console. But none of the VM processes use stdin/out at all; they log
to logcat instead.
So instead of allowing the access (which immediately leads to the same
denials in virtualizationmanager), just suppress the audit logs.
Bug: 293259827
Test: Exercise isolated compilation successfully with no denials seen.
Change-Id: I454bb2fe106b656a9695511cbf09350402b30bdd
Some entries in Tests were not matching their actual function (e.g.,
TestSystemTypeViolators instead of TestSystemTypeViolations).
Automatically generate the list of tests, based on the 'Test' prefix in
their name.
Test: sepolicy_tests -h
Change-Id: I1865e24c6cc1bfe15f633263897ea7530140c41d
