tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
7124 commits 1 branch 0 tags 50 MiB
Commit graph

7124 commits

This branch
This branch
All branches
Author SHA1 Message Date
Ajay Panicker
82f9989062 Allow bluetooth service to access bluetooth directory and add /logs (6/6) am: a45672614d 
am: ebcc814eb5

Change-Id: Iabada4aedcd7752909f985ca0cb09d0d7613c44d
 2016-09-19 20:18:58 +00:00
Ajay Panicker
ebcc814eb5 Allow bluetooth service to access bluetooth directory and add /logs (6/6) 
am: a45672614d

Change-Id: I295c9a5fb67688538d2cbc4470b9bf463e2cd3e3
 2016-09-19 20:11:01 +00:00
Ajay Panicker
a45672614d Allow bluetooth service to access bluetooth directory and add /logs (6/6) 
Bug: 31466840
Change-Id: I3984754034349e6c41de6ae9cccbaab95ca5a918
 2016-09-16 20:20:31 +00:00
Fyodor Kupolov
eb7ecd7199 Merge "Allow system_server to delete directories in preloads" am: f23299c547 
am: 66c10511ee

Change-Id: I17cc645175060c6465b6571d25f31fb6f21c9a91
 2016-09-15 19:42:01 +00:00
Fyodor Kupolov
66c10511ee Merge "Allow system_server to delete directories in preloads" 
am: f23299c547

Change-Id: I5a9bc357635f8567ecd37a1041c1330decb43f0f
 2016-09-15 19:40:02 +00:00
Treehugger Robot
f23299c547 Merge "Allow system_server to delete directories in preloads" 2016-09-15 18:18:24 +00:00
Janis Danisevskis
254e36b3ab Allow debuggerd execmem on debuggable domains am: 071b935d0b 
am: 241f358f73

Change-Id: Icf5fcaf9725bfb5dd01fcba0d8e88229e359e27e
 2016-09-15 16:33:31 +00:00
Fyodor Kupolov
3189945192 Allow system_server to delete directories in preloads 
(cherry picked from commit 028ed753b5)

avc: denied { rmdir } for name="apps" scontext=u:r:system_server:s0 tcontext=u:object_r:preloads_data_file:s0 tclass=dir permissive=0
avc: denied { rmdir } for name="demo" scontext=u:r:system_server:s0 tcontext=u:object_r:preloads_data_file:s0 tclass=dir permissive=0

Bug: 28855287
Change-Id: Ia470f94d1d960cc4ebe68cb364b8425418acdbd4
 2016-09-15 09:31:05 -07:00
Janis Danisevskis
241f358f73 Allow debuggerd execmem on debuggable domains 
am: 071b935d0b

Change-Id: I77d1b7c6797d1401abc5e49617090f2e55cee2f6
 2016-09-15 16:31:00 +00:00
Janis Danisevskis
071b935d0b Allow debuggerd execmem on debuggable domains 
In anticipation of fixing a loophole in the Linux kernel that allows
circumventing the execmem permission by using the ptrace interface,
this patch grants execmem permission on debuggable domains to
debuggerd. This will be required for setting software break points
once the kernel has been fixed.

Bug: 31000401
Change-Id: I9b8d5853b643d24b94d36e2adbcb135dbaef8b1e
 2016-09-15 15:11:31 +01:00
Janis Danisevskis
5c3b1cdd67 Merge "Allow keystore to access KeyAttestationApplicationIDProviderService" am: 1a640f327d 
am: 8e74f2f817

Change-Id: I4927882190874226b2d1ca6a5f824552988a02e0
 2016-09-14 21:33:04 +00:00
Janis Danisevskis
8e74f2f817 Merge "Allow keystore to access KeyAttestationApplicationIDProviderService" 
am: 1a640f327d

Change-Id: Ic6cd61685cd27b4a9213697eb24870aea91b0542
 2016-09-14 21:29:32 +00:00
Treehugger Robot
1a640f327d Merge "Allow keystore to access KeyAttestationApplicationIDProviderService" 2016-09-14 21:11:00 +00:00
Jeff Vander Stoep
6ce7513653 Merge "nfc: allow access to drmserver_service" am: 52c8adb34a 
am: 2c24ec8bb3

Change-Id: I13929222fe188267325cd253658955ddcb9986f6
 2016-09-14 20:06:51 +00:00
Jeff Vander Stoep
2c24ec8bb3 Merge "nfc: allow access to drmserver_service" 
am: 52c8adb34a

Change-Id: Icc1dacfe3e9009c777a697e9c16884d8be7d2b50
 2016-09-14 20:03:54 +00:00
Treehugger Robot
52c8adb34a Merge "nfc: allow access to drmserver_service" 2016-09-14 19:59:19 +00:00
Takahiro Aizawa
61043ff5cc Merge "selinux: Update policies for mediadrmserver" am: 0dc5d020ac 
am: 75bbefc03a

Change-Id: I2b3f2c7f1315d25a3d3ae66768fed3fcd4c4e079
 2016-09-14 19:48:58 +00:00
Tianjie Xu
88fae39798 Add sepolicy for update_verifier am: 59379d8b48 
am: 8a521266d2

Change-Id: I3c504611c5a17ff2311ab961f5c1e92e13955582
 2016-09-14 19:48:58 +00:00
Tao Bao
a3e136f897 update_verifier: Allow searching /dev/block. am: 1e17dafc6d 
am: 58a3175c80

Change-Id: I1a421302231862c24ec7750d72e4a37b46ac5675
 2016-09-14 19:48:55 +00:00
Takahiro Aizawa
75bbefc03a Merge "selinux: Update policies for mediadrmserver" 
am: 0dc5d020ac

Change-Id: Ie03dd802e556b881c17ffe1701312e025ad75491
 2016-09-14 19:42:57 +00:00
Tianjie Xu
8a521266d2 Add sepolicy for update_verifier 
am: 59379d8b48

Change-Id: Ifb74c4dc2b611edd3549a0882faaa85d14654b32
 2016-09-14 19:42:57 +00:00
Tao Bao
58a3175c80 update_verifier: Allow searching /dev/block. 
am: 1e17dafc6d

Change-Id: Ic500bc6ef04d33c38aeaf3400944d6d732a38128
 2016-09-14 19:42:54 +00:00
Treehugger Robot
0dc5d020ac Merge "selinux: Update policies for mediadrmserver" 2016-09-14 19:36:45 +00:00
Tianjie Xu
59379d8b48 Add sepolicy for update_verifier 
(cherry picked from commit 5d8d2dc9f9)

Grant update_verifier the permissions to read /data/ota_package/
and the blocks on system partition.

The denial messages:
update_verifier: type=1400 audit(0.0:29): avc: denied { read }
scontext=u:r:update_verifier:s0 tcontext=u:object_r:ota_package_file:s0 tclass=file permissive=1

update_verifier: type=1400 audit(0.0:30): avc: denied { open }
scontext=u:r:update_verifier:s0 tcontext=u:object_r:ota_package_file:s0 tclass=file permissive=1

update_verifier: type=1400 audit(0.0:31): avc: denied { read } dev="tmpfs"
scontext=u:r:update_verifier:s0 tcontext=u:object_r:system_block_device:s0 tclass=blk_file permissive=1

update_verifier: type=1400 audit(0.0:32): avc: denied { open } dev="tmpfs"
scontext=u:r:update_verifier:s0 tcontext=u:object_r:system_block_device:s0 tclass=blk_file permissive=1

Test: On device, update_verifier reads the blocks successfully during boot time.
Bug: 30020920

Change-Id: I10777c1e6ba649b82c4a73171124742edeb05997
 2016-09-14 19:31:22 +00:00
Tao Bao
1e17dafc6d update_verifier: Allow searching /dev/block. 
update_verifier calls bootcontrol HAL to mark the currently booting slot
as successfully booted.

avc: denied { search } for name="block" dev="tmpfs" scontext=u:r:update_verifier:s0 tcontext=u:object_r:block_device:s0 tclass=dir permissive=0
avc: denied { search } for name="block" dev="tmpfs" scontext=u:r:update_verifier:s0 tcontext=u:object_r:block_device:s0 tclass=dir permissive=0

Bug: 29569601
Test: Device boots up with no update_verifier denials and 'bootctl is-slot-marked-successful 0' returns 0.
Change-Id: I1baa7819bc829e3c4b83d7168008a5b06b01cc9f
 2016-09-14 19:29:06 +00:00
Wei Wang
66dc4709c3 Merge "allow system_server to set bootanim scheduling priority" am: 2c1b02eba6 
am: 90d84da7e2

Change-Id: I233f337ded37128b3776bba77a11fe741bac9eb9
 2016-09-14 19:28:54 +00:00
Wei Wang
90d84da7e2 Merge "allow system_server to set bootanim scheduling priority" 
am: 2c1b02eba6

Change-Id: I3e666f32b37a87749780d6b6aaaa7a46c698a66e
 2016-09-14 19:25:53 +00:00
Janis Danisevskis
61e5ccae9e Allow keystore to access KeyAttestationApplicationIDProviderService 
(cherry picked from commit 58b079a259)

Bug: 22914603
Change-Id: I8ae1a786702694ca2bb8707a4c142b8a233042ee
 2016-09-14 19:24:48 +00:00
Treehugger Robot
2c1b02eba6 Merge "allow system_server to set bootanim scheduling priority" 2016-09-14 19:22:48 +00:00
Hugo Benichi
8c488decc6 Merge "New service name for IpConnectivity metrics" am: ed06b57b77 
am: cd66025669

Change-Id: I8f3c466e26835b8c45f179c07cdfb0dece4e9712
 2016-09-14 19:20:23 +00:00
Hugo Benichi
cd66025669 Merge "New service name for IpConnectivity metrics" 
am: ed06b57b77

Change-Id: I794baa7503672277af9accc13b53d6d66715bf16
 2016-09-14 19:17:23 +00:00
Treehugger Robot
ed06b57b77 Merge "New service name for IpConnectivity metrics" 2016-09-14 19:04:10 +00:00
Martijn Coenen
053df7d9fa Allow the NFC process to access hwservicemanager. am: 50ab0b1ace 
am: 41726e3420

Change-Id: I0be76fe8adc4da1cef7aa4fda3bf85f183bf1259
 2016-09-14 17:55:49 +00:00
Martijn Coenen
8b01f03284 Initial hardware servicemanager sepolicy. am: 6b952393f6 
am: 1988efc001

Change-Id: I07f2f4ab6a050352fda0d8c43e12ecba0ce4bcdf
 2016-09-14 17:55:47 +00:00
Jeff Vander Stoep
2a00c64a4f nfc: allow access to drmserver_service 
(cherry picked from commit 24ad5862bd)

avc:  denied  { find } for service=drm.drmManager pid=4320 uid=1027 scontext=u:r:nfc:s0 tcontext=u:object_r:drmserver_service:s0 tclass=service_manager

Arrange in alphabetical order.

Bug: 30112127
Change-Id: I6592497a937c6a6d2c7c3d444beba3db333f4852
 2016-09-14 17:53:27 +00:00
Martijn Coenen
41726e3420 Allow the NFC process to access hwservicemanager. 
am: 50ab0b1ace

Change-Id: I26c87e57827a7dfdd24a290c6f942c93b77d3952
 2016-09-14 17:52:49 +00:00
Martijn Coenen
1988efc001 Initial hardware servicemanager sepolicy. 
am: 6b952393f6

Change-Id: I190a397a35e5aa4ee0ddbe7b4638c08d5461f9c0
 2016-09-14 17:52:46 +00:00
Takahiro Aizawa
ec7508546b selinux: Update policies for mediadrmserver 
(cherry picked from commit 23a276a295)

DRM 3rd party application with platform signature
requires the permission.

Bug: 30352348
Change-Id: Idd673506764ae435db1be8cc8c13658541ffa687
 2016-09-14 10:32:56 -07:00
Hugo Benichi
c1c82606f1 New service name for IpConnectivity metrics 
(cherry picked from commit f412cc623f)

Bug: 31254800
Change-Id: If8708c8a4e0ea7655f31028881248a14cf2ba5f7
 2016-09-14 10:19:02 -07:00
Wei Wang
88323b2e6d allow system_server to set bootanim scheduling priority 
(cherry picked from commit 1617c0ce89)

Addresses the following denial:
     avc: denied { setsched } for pid=1405 comm="Binder:1094_3" scontext=u:r:system_server:s0 tcontext=u:r:bootanim:s0 tclass=process permissive=0

Maybe fix bug 30118894.

Bug: 30118894
Change-Id: I29be26c68094c253778edc8e4fef2ef1a238ee2e
 2016-09-14 10:15:15 -07:00
Martijn Coenen
50ab0b1ace Allow the NFC process to access hwservicemanager. 
Add a macro to make this easier for other processes
as well.

Change-Id: I489d0ce042fe5ef88dc767a6fbdb9b795be91601
(cherry picked from commit c2b9c1561e4bd7ac86d78b44ca7927994e781da0)
 2016-09-14 16:47:09 +00:00
Martijn Coenen
6b952393f6 Initial hardware servicemanager sepolicy. 
Change-Id: I07d188e4dd8801a539db1e9f3edf82a1d662648e
(cherry picked from commit 61a082a55dbc2798d50d0d4b766151d69334729a)
 2016-09-14 16:35:34 +00:00
Jeff Tinker
c2103a9710 Merge "Fix SELinux denials for protected content playback" am: 36e260f772 
am: 90bca6f3c4

Change-Id: I8244b828412f6253b811c4bf0f849081a6adf6e4
 2016-09-14 02:55:51 +00:00
Jeff Tinker
90bca6f3c4 Merge "Fix SELinux denials for protected content playback" 
am: 36e260f772

Change-Id: I2f60519c6a6c5db363dffbe380964e7244359df1
 2016-09-14 02:52:50 +00:00
Treehugger Robot
36e260f772 Merge "Fix SELinux denials for protected content playback" 2016-09-14 02:35:37 +00:00
Andreas Gampe
04718d5626 sepolicy: give otapreopt getattr am: f9c741b860 
am: 35a560a4a4

Change-Id: Iad42e7a445239aeb60ce33c5d4b9e098d69f1133
 2016-09-13 22:00:32 +00:00
Andreas Gampe
feaeddce46 Sepolicy: Add otapreopt_slot am: a3a0bb446b 
am: c81a0a1a5e

Change-Id: I837306c006333141d350b9e7d86058af2fed2f4d
 2016-09-13 22:00:30 +00:00
Andreas Gampe
35a560a4a4 sepolicy: give otapreopt getattr 
am: f9c741b860

Change-Id: If468d207717615cb22f651efface9d60922e96b9
 2016-09-13 21:57:32 +00:00
Andreas Gampe
c81a0a1a5e Sepolicy: Add otapreopt_slot 
am: a3a0bb446b

Change-Id: I4c38cdbe36829a38289bd5a7c8cea46c735ed7b8
 2016-09-13 21:57:30 +00:00
Andreas Gampe
dc3f6fab00 Merge "Sepolicy: allow otapreopt_chroot to mount vendor" am: 9eae9a7181 
am: cbb4c08d7c

Change-Id: I6bd1ab3c9c5b2d9472b16e15455705286c81f65c
 2016-09-13 20:48:49 +00:00