Felipe Leme
549ccf77e3
Creates a new permission for /cache/recovery
...
This permission was created mostly for dumpstate (so it can include
recovery files on bugreports when an OTA fails), but it was applied to
uncrypt and recovery as well (since it had a wider access before).
Grant access to cache_recovery_file where we previously granted access
to cache_file. Add auditallow rules to determine if this is really
needed.
BUG: 25351711
Change-Id: I07745181dbb4f0bde75694ea31b3ab79a4682f18
2016-01-04 23:11:28 +00:00
dcashman
36f255ff52
Create sysfs_zram label.
...
Address following denials:
avc: denied { getattr } for path="/sys/devices/virtual/block/zram0/disksize" dev="sysfs" ino=14958 scontext=u:r:init:s0 tcontext=u:object_r:sysfs_zram:s0 tclass=file permissive=0
avc: denied { search } for name="zram0" dev="sysfs" ino=14903 scontext=u:r:system_server:s0 tcontext=u:object_r:sysfs_zram:s0 tclass=dir permissive=0
avc: denied { read } for name="mem_used_total" dev="sysfs" ino=14970 scontext=u:r:system_server:s0 tcontext=u:object_r:sysfs_zram:s0 tclass=file permissive=0
avc: denied { write } for name="uevent" dev="sysfs" ino=14904 scontext=u:r:ueventd:s0 tcontext=u:object_r:sysfs_zram:s0 tclass=file permissive=0
avc: denied { open } for path="/sys/devices/virtual/block/zram0/uevent" dev="sysfs" ino=14904 scontext=u:r:ueventd:s0 tcontext=u:object_r:sysfs_zram:s0 tclass=file permissive=0
avc: denied { read } for pid=348 comm="vold" name="zram0" dev="sysfs" ino=15223 scontext=u:r:vold:s0 tcontext=u:object_r:sysfs_zram:s0 tclass=dir permissive=0
avc: denied { search } for pid=3494 comm="ContactsProvide" name="zram0"dev="sysfs" ino=15223 scontext=u:r:priv_app:s0:c512,c768 tcontext=u:object_r:sysfs_zram:s0 tclass=dir permissive=0
Bug: 22032619
Change-Id: I40cf918b7cafdba6cb3d42b04b1616a84e4ce158
2016-01-04 14:24:09 -08:00
Daichi Hirono
a20802ddb8
Add new rules for appfuse.
...
The new rules are used to allow to mount FUSE file system for priv-app.
Change-Id: I5ce2d261be501e2b3fef09b7666f1e5d1cddbe52
2015-12-24 11:32:41 +09:00
Jeff Vander Stoep
2b56e4844e
Allow priv_apps to stat files on the system partition
...
Allows safetynet to scan the system partition which is made up of
files labeled system_file (already allowed) and/or files with the
exec_type attribute.
Bug: 25821333
Change-Id: I9c1c9c11bc568138aa115ba83238ce7475fbc5e4
2015-12-03 13:00:07 -08:00
Jeff Vander Stoep
d22987b4da
Create attribute for moving perms out of domain
...
Motivation: Domain is overly permissive. Start removing permissions
from domain and assign them to the domain_deprecated attribute.
Domain_deprecated and domain can initially be assigned to all
domains. The goal is to not assign domain_deprecated to new domains
and to start removing domain_deprecated where it is not required or
reassigning the appropriate permissions to the inheriting domain
when necessary.
Bug: 25433265
Change-Id: I8b11cb137df7bdd382629c98d916a73fe276413c
2015-11-03 23:11:11 +00:00
Jeff Vander Stoep
bcbb32e763
grant priv_app access to /dev/mtp_usb
...
android.process.media needs access to mtp_usb when MTP is enabled.
Bug: 25074672
Change-Id: Ic48a3ba8e4395104b0b957f7a9bad69f0e5ee38e
2015-10-19 13:07:15 -07:00
Jeff Vander Stoep
7f09a94596
Policy for priv_app domain
...
Verifier needs access to apk files.
avc: denied { search } for pid=11905 comm="ackageinstaller" name="vmdl2040420713.tmp" dev="dm-2" ino=13647 scontext=u:r:priv_app:s0:c512,c768 tcontext=u:object_r:apk_tmp_file:s0 tclass=dir permissive=0
Give bluetooth_manager_service and trust_service the app_api_service
attribute.
avc: denied { find } for service=bluetooth_manager pid=7916 uid=10058 scontext=u:r:untrusted_app:s0:c512,c768 tcontext=u:object_r:bluetooth_manager_service:s0 tclass=service_manager permissive=0
avc: denied { find } for service=trust pid=25664 uid=10069 scontext=u:r:untrusted_app:s0:c512,c768 tcontext=u:object_r:trust_service:s0 tclass=service_manager permissive=0
Bug: 25066911
Change-Id: I6be695546f8a951e3329c1ec412936b8637e5835
2015-10-19 10:35:20 -07:00
Jeff Vander Stoep
879df83384
Privileged apps require access to cache
...
gmscore uses cache for updates
Bug: 24977552
Change-Id: I45a713fcfc70b71a2de712e77b64fb9feab67dd7
2015-10-15 15:17:01 -07:00
Jeff Vander Stoep
ee9c0b5fb6
Add priv_app domain to global seapp_context
...
Assign priviliged apps not signed with the platform key to the priv_app
domain.
Bug: 22033466
Change-Id: Idf7fbe7adbdc326835a179b554f96951b69395bc
2015-10-14 21:23:54 +00:00
