Commit graph

30085 commits

Author SHA1 Message Date
rpcraig
f1cd33ff05 am 8f4600c0: am 5dbfdc0b: Add double free protection to checkseapp.
* commit '8f4600c0f84584ebbf23f17821b4461e71550f05':
  Add double free protection to checkseapp.
2012-10-23 16:10:53 -07:00
rpcraig
8f4600c0f8 am 5dbfdc0b: Add double free protection to checkseapp.
* commit '5dbfdc0b0fec04d670912c4eed179983f98abe8a':
  Add double free protection to checkseapp.
2012-10-23 16:07:27 -07:00
rpcraig
5dbfdc0b0f Add double free protection to checkseapp.
A double free error occurs when building with non glibc
devices. The hdestroy() function frees all comparison
keys internally in these cases. So avoid an explicit
call to free().

Change-Id: If9c5dc1a969605cd1eeb9218de02a9f8dbbd3ae1
Signed-off-by: rpcraig <rpcraig@tycho.ncsc.mil>
2012-10-23 13:46:11 -04:00
rpcraig
7672eac5fb Add SELinux policy for asec containers.
Creates 2 new types:
- asec_apk_file : files found under /mnt/asec
                  when the asec images are mounted
- asec_image_file : the actual encrypted apks under
                    /data/app-asec

Change-Id: I963472add1980ac068d3a6d36a24f27233022832
Signed-off-by: rpcraig <rpcraig@tycho.ncsc.mil>
2012-10-22 14:14:11 -04:00
Kenny Root
560463548f am 84b7472d: am 6766cc9e: Merge "allow apps access to the keystore, dhcp/pptp fixes, wifi fixes and isolated_app access"
* commit '84b7472db097580a68899470b20f5770de9eaf4e':
  allow apps access to the keystore, dhcp/pptp fixes, wifi fixes and isolated_app access
2012-10-19 13:22:11 -07:00
Kenny Root
d7de0b7f4c am ca895fbc: am 91c12e3c: Merge "file class macro cleanup"
* commit 'ca895fbc0b6bf4070c2c275945cbdfae22150590':
  file class macro cleanup
2012-10-19 13:22:06 -07:00
Kenny Root
84b7472db0 am 6766cc9e: Merge "allow apps access to the keystore, dhcp/pptp fixes, wifi fixes and isolated_app access"
* commit '6766cc9e3c1d5dcec5db445a8d06bb6d4f301562':
  allow apps access to the keystore, dhcp/pptp fixes, wifi fixes and isolated_app access
2012-10-19 12:15:12 -07:00
Kenny Root
ca895fbc0b am 91c12e3c: Merge "file class macro cleanup"
* commit '91c12e3c0c7639cae727e8dec2d390474de546f9':
  file class macro cleanup
2012-10-19 12:15:11 -07:00
Kenny Root
6766cc9e3c Merge "allow apps access to the keystore, dhcp/pptp fixes, wifi fixes and isolated_app access" 2012-10-19 11:44:34 -07:00
Kenny Root
91c12e3c0c Merge "file class macro cleanup" 2012-10-19 11:29:38 -07:00
Stephen Smalley
37c885ac1e am ced365aa: am 01a58af1: Add a checkfc utility to check file_contexts validity and invoke it.
* commit 'ced365aa645d35f022f413f53731af61ada812fd':
  Add a checkfc utility to check file_contexts validity and invoke it.
2012-10-17 13:00:21 -07:00
Stephen Smalley
ced365aa64 am 01a58af1: Add a checkfc utility to check file_contexts validity and invoke it.
* commit '01a58af19494420bb259505bc5404790a21fdd64':
  Add a checkfc utility to check file_contexts validity and invoke it.
2012-10-17 12:57:32 -07:00
Stephen Smalley
01a58af194 Add a checkfc utility to check file_contexts validity and invoke it.
Change-Id: I4b12dc3dcb432edbdf95dd3bc97f809912ce86d1
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2012-10-17 12:02:25 -07:00
Kenny Root
b3e8a10e0b am b83bb3f0: Revert "ISSUE 6849488 Bluedroid stack, remove system/bluetooth."
* commit 'b83bb3f05d6fe76ec5dbdd3e669b81ca9563459e':
  Revert "ISSUE 6849488 Bluedroid stack, remove system/bluetooth."
2012-10-16 18:11:27 -07:00
Kenny Root
b83bb3f05d Revert "ISSUE 6849488 Bluedroid stack, remove system/bluetooth."
This reverts commit b620dc60b1.

(cherry picked from commit 128db96282)

Change-Id: I21227e6232c925a42597e5c8fc0fcc0585d7a876
2012-10-16 18:08:53 -07:00
Kenny Root
1cabf0f41e am 44374bc5: am 659aaced: Remove HAVE_SELINUX guard
* commit '44374bc5edc0ed46d402d1f0353fd9ff1e2ee0ac':
  Remove HAVE_SELINUX guard
2012-10-16 17:51:24 -07:00
Kenny Root
44374bc5ed am 659aaced: Remove HAVE_SELINUX guard
* commit '659aaced054c21048c712fe1f5831a86c99213d8':
  Remove HAVE_SELINUX guard
2012-10-16 17:48:23 -07:00
Joshua Brindle
f26d813033 allow apps access to the keystore, dhcp/pptp fixes, wifi fixes and isolated_app access
- allow all apps to connect to the keystore over unix socket
- dhcp runs scripts in /system/etc/dhcpcd/dhcpcd-hooks and creates/removes lease files
- mtp connects to dnsproxyd when a pptp vpn connection is established
- allow appdomain to also open qtaguid_proc and release_app to read qtaguid_device
- WifiWatchDog uses packet_socket when wifi comes up
- apps interact with isolated_apps when an app uses an isolated service and uses sockets for that interaction
- for apps with levelFromUid=true to interact with isolated_app, isolated_app must be an mlstrustedsubject

Change-Id: I09ff676267ab588ad4c73f04d8f23dba863c5949
Signed-off-by: Joshua Brindle <jbrindle@tresys.com>
2012-10-16 09:48:40 -04:00
Kenny Root
659aaced05 Remove HAVE_SELINUX guard
Change-Id: I45b4a749bf4fb085d96d912871bae33aa5288119
2012-10-10 10:52:46 -07:00
William Roberts
7104df5cae file class macro cleanup
Change-Id: I328bc882b3d6e200742e017aa23154fb01e638a5
2012-10-04 11:34:57 -07:00
Stephen Smalley
7f5975ca10 am 382381b6: am 3ac1d26a: Switch app_* and isolated to _app and _isolated in seapp_contexts.
* commit '382381b6d108a961967c106a82d4da7f6d5760db':
  Switch app_* and isolated to _app and _isolated in seapp_contexts.
2012-09-26 10:08:29 -07:00
Stephen Smalley
382381b6d1 am 3ac1d26a: Switch app_* and isolated to _app and _isolated in seapp_contexts.
* commit '3ac1d26a585b0cef73b626656e90005617725662':
  Switch app_* and isolated to _app and _isolated in seapp_contexts.
2012-09-26 09:58:23 -07:00
Kenny Root
128db96282 Revert "ISSUE 6849488 Bluedroid stack, remove system/bluetooth."
This reverts commit b620dc60b1.
2012-09-26 08:44:31 -07:00
Stephen Smalley
3ac1d26a58 Switch app_* and isolated to _app and _isolated in seapp_contexts.
The app_* syntax was a legacy of the original approach of looking up
the username returned by getpwuid() and the original username encoding
scheme by bionic.  With the recent changes to move away from this approach,
there is no reason to retain that syntax.  Instead, just use _app to match
app UIDs and _isolated to match isolated service UIDs.  The underscore
prefix is to signify that these are not real usernames and to avoid
conflicts with any system usernames.

Requires a corresponding change to libselinux.

Change-Id: Ic388a12c1c9d3e47386c8849db607140ef8a3d75
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2012-09-24 10:16:03 -04:00
Zhihai Xu
acbded32b2 Merge "ISSUE 6849488 Bluedroid stack, remove system/bluetooth." into jb-mr1-dev 2012-09-20 16:45:49 -07:00
Stephen Smalley
c6c6aba0ec am 061f254d: Define security labeling for isolated processes.
* commit '061f254def394fdc4784fe6c446bdd779cfec768':
  Define security labeling for isolated processes.
2012-09-20 13:04:55 -07:00
Zhihai Xu
b620dc60b1 ISSUE 6849488 Bluedroid stack, remove system/bluetooth.
remove system/bluetooth dependency.

bug 6849488

Change-Id: I259322385adafa4128deef5324e854bebef2b033
2012-09-20 11:14:34 -07:00
Stephen Smalley
061f254def Define security labeling for isolated processes.
Used when an app service is declared with android:isolatedProcess="true".
Place such processes in a separate domain, and further isolate them
from each other via categories.

Change-Id: I1d64f8278f0619eedb448f9a741f1d2c31985325
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2012-09-20 11:00:43 -04:00
Stephen Smalley
9822c1d08f am 66a3e8d9: Drop the use of a policy version suffix on the sepolicy file.
* commit '66a3e8d91ef6098dd7cab127530f1cdb7973f53e':
  Drop the use of a policy version suffix on the sepolicy file.
2012-09-18 16:29:39 -07:00
Stephen Smalley
66a3e8d91e Drop the use of a policy version suffix on the sepolicy file.
The policy version suffix support was carried over from conventional
Linux distributions, where we needed to support simultaneous installation
of multiple kernels and policies.  This isn't required for Android, so
get rid of it and thereby simplify the policy pathname.

We still default to generating a specific policy version (the highest
one supported by the emulator kernel), but this can be overridden
by setting POLICYVERS on the make command-line or in the environment.

Requires a corresponding change to libselinux.

Change-Id: I40c88e13e8063ea37c2b9ab5b3ff8b0aa595402a
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2012-09-18 15:11:49 -04:00
Kenny Root
dfd4cfc32c am fc6b1032: Merge changes I98fc14e1,If334ba73
* commit 'fc6b1032349381315bde67a82cf4312dbd53b9f4':
  Fix for segfault/jmp depends on unitialized variable
  Fix check_seapp segfault and undefined linking err
2012-09-18 00:06:27 -07:00
Kenny Root
fc6b103234 Merge changes I98fc14e1,If334ba73
* changes:
  Fix for segfault/jmp depends on unitialized variable
  Fix check_seapp segfault and undefined linking err
2012-09-17 16:58:12 -07:00
William Roberts
b3ab56c2bf Fix for segfault/jmp depends on unitialized variable
When realloc creates the first block of memory, it must
be initialized to NULL for the following strcat functions
to operate correctly.

Change-Id: I98fc14e1b19de5aa205354d16e54445293430d8e
2012-09-17 16:45:48 -07:00
William Roberts
a53ccf39c2 Fix check_seapp segfault and undefined linking err
When LINK_SEPOL_STATIC was not defined, symbol
log_warning was trying to be resolved by the linker.
That symbol was not defined as it should have been
log_warn and not log_warning.

When a key would be validated in key_map_validate(), an
unchecked key, like user, could cuase a segfault when
the se_key was getting free'd no matter what at the end
of the function, even if no se_key was alloc'd.

Change-Id: If334ba7350e6d2ad1fa9bed142bb2fabe7caa057
2012-09-17 13:20:07 -07:00
Kenny Root
2e44ea3c1b am 9c08abbd: Merge "Allow domain access to /dev/ion"
* commit '9c08abbd3b21f61544335d350b7b982a5cc54eee':
  Allow domain access to /dev/ion
2012-09-17 12:07:03 -07:00
Kenny Root
9c08abbd3b Merge "Allow domain access to /dev/ion" 2012-09-17 11:46:46 -07:00
William Roberts
c2cb712a0d am c27d30a6: Correct spelling mistake
* commit 'c27d30a6ad46963988ca1e312fa824196687e231':
  Correct spelling mistake
2012-09-13 15:51:50 -07:00
William Roberts
ccc8271aba Allow domain access to /dev/ion
Change-Id: I87f81a632ed61f284f2fe09726f5c4529d36f252
2012-09-13 14:30:11 -07:00
William Roberts
c27d30a6ad Correct spelling mistake
Change-Id: If4deccfe740c8de6b88929a0d0439667c3ea340d
2012-09-06 19:38:39 -07:00
Jean-Baptiste Queru
d0f027ccc8 am 10f9a372: Merge upstream sepolicy into AOSP
* commit '10f9a3727a5c46ef23f5f0385ae4ffec20cb46d9':
  Corrected gramatical issues
  Added new line to end of file
  Changed seapp_contexts temporary file naming
  Fix mls checking code
  Support overrides in seapp_contexts
  Add tf_daemon labeling support.
  Add ppp/mtp policy.
  per device seapp_context support
  dhcp policy.
  Trusted Execution Environment policy.
2012-09-05 19:46:52 -07:00
Jean-Baptiste Queru
10f9a3727a Merge upstream sepolicy into AOSP
Change-Id: If3ed9998033378de5b47472315444f5b8bd4743e
2012-09-05 18:43:48 -07:00
seandroid
1148bc2a6b Merge checkseapp support. 2012-09-05 16:07:40 -04:00
William Roberts
ae23a1f36a Corrected gramatical issues
Change-Id: I62ce62475f4a17d278243cc96db773872b2dc89c
2012-09-05 12:53:52 -07:00
William Roberts
a861318074 Added new line to end of file
Change-Id: I4f0576a47ca2e99bca719bf321349c7d7d05cd3c
2012-09-05 11:23:40 -07:00
William Roberts
98ed392e68 Changed seapp_contexts temporary file naming
Change-Id: I4f522869eeaa6f84771e4ee2328f65296dcc29db
2012-09-05 11:23:19 -07:00
William Roberts
0ae3a8a2d5 Fix mls checking code
Change-Id: I614caa520e218f8f148eef641fed2301571da8e1
2012-09-04 11:51:04 -07:00
William Roberts
f0e0a94e03 Support overrides in seapp_contexts
Provides support for overriding seapp_contexts declerations
in per device seapp_contexts files.

Change-Id: I23a0ffa1d24f1ce57825b168f29a2e885d3e1c51
2012-09-04 10:55:38 -07:00
rpcraig
a363683c57 Add tf_daemon labeling support. 2012-08-24 08:23:20 -04:00
rpcraig
d49f7e6e36 Add ppp/mtp policy.
Initial policy for Point-to-Point tunneling and
tunneling manager services.
2012-08-20 06:19:36 -04:00
William Roberts
171a062571 per device seapp_context support 2012-08-16 14:00:19 -04:00