Commit graph

21084 commits

Author SHA1 Message Date
Steven Moreland
88fedc2159 Merge "Reland "Re-open /dev/binder access to all.""
am: aa6793febd

Change-Id: I34360631751c98aab0c34fff9bdcdbae02c52297
2019-08-22 16:15:59 -07:00
Steven Moreland
aa6793febd Merge "Reland "Re-open /dev/binder access to all."" 2019-08-22 22:55:04 +00:00
Robert Shih
30e9337e4e Merge "Allow drmserver to communicate with mediametrics"
am: 444b5483a2

Change-Id: I0afe78e401867b03c798ee4653fd08ff9fe7e396
2019-08-22 15:03:44 -07:00
Treehugger Robot
444b5483a2 Merge "Allow drmserver to communicate with mediametrics" 2019-08-22 21:51:24 +00:00
Tri Vo
d0cb128907 Merge "selinux: tag gpu_service as app_api_service"
am: 9203c0009d

Change-Id: If18eb15656c871446292f23ff2eb53e70bb66ba6
2019-08-22 13:31:42 -07:00
Tri Vo
9203c0009d Merge "selinux: tag gpu_service as app_api_service" 2019-08-22 19:57:04 +00:00
Tri Vo
a1a3ea37aa Merge "Expand typattribute declarations into older maps"
am: dc887eeb7a

Change-Id: I323d999841682ac2980c33d6278ebf9fbc9f504a
2019-08-22 12:53:18 -07:00
Tri Vo
dc887eeb7a Merge "Expand typattribute declarations into older maps" 2019-08-22 19:33:26 +00:00
Tri Vo
5511676b31 selinux: tag gpu_service as app_api_service
gpu_service is already accessible to untrusted 3p apps aosp/898376.
Otherwise, vendor apps can't access gpu_service.

Bug: 139685237
Test: m selinux_policy
Change-Id: I30a951cd712b0ae4aacd2c4d6d42e74fac5c0707
Merged-In: I30a951cd712b0ae4aacd2c4d6d42e74fac5c0707
(cherry picked from commit 32f279c096)
2019-08-22 11:38:08 -07:00
Robert Shih
353c4ab3a4 Allow drmserver to communicate with mediametrics
Bug: 134789967
Test: dumpsys media.metrics
Change-Id: I550e328dac9592f66ea589eacfb2d349a8666878
2019-08-22 11:31:03 -07:00
Marissa Wall
6782faba9f Merge "gralloc: add IAllocator/IMapper 4.0 sepolicy"
am: 1751aa5b80

Change-Id: I072a3950a3f57ab0a78e95ee2c73c6d71245d373
2019-08-22 10:48:50 -07:00
Treehugger Robot
1751aa5b80 Merge "gralloc: add IAllocator/IMapper 4.0 sepolicy" 2019-08-22 17:20:45 +00:00
Tri Vo
b5a4640f65 selinux: remove sysfs_mac_address
am: f1e71dc75c

Change-Id: I0bed37692eed895d8bad9af9ea4e507a6dc4f50f
2019-08-22 03:14:30 -07:00
Tri Vo
f1e71dc75c selinux: remove sysfs_mac_address
Nothing is actually labeled as 'sysfs_mac_address'.

Bug: 137816564
Test: m selinux_policy
Change-Id: I2d7e71ecb3a2b4ed76c13eb05ecac3064c1bc469
2019-08-21 13:07:09 -07:00
Maciej enczykowski
8f5e8e5b82 Do not allow untrusted apps to read sysfs_net files
am: 804d99ac76

Change-Id: I9be056dbdc7146857737bb6847fe51b90702a874
2019-08-20 23:25:28 -07:00
Maciej Żenczykowski
804d99ac76 Do not allow untrusted apps to read sysfs_net files
(this includes /sys/class/net/*/address device mac addresses)

Test: builds
Bug: 137816564
Change-Id: I84268b2e0207559ed00baafb8a3f231c676f8df1
Signed-off-by: Maciej Żenczykowski <maze@google.com>
2019-08-20 16:09:46 -07:00
Tri Vo
7bfd7303b3 Expand typattribute declarations into older maps
Say, foo_attribute is removed in 30 API. We need to preserve
typeattribute declaration in 29.0.cil, 28.0.cil, etc for backwards
compatibility.
(typeattribute binder_in_vendor_violators)

Automatically expand these typeattribute declaration into older map
files, so that we only need to update 29.0.cil.

Test: remove binder_in_vendor_violators; only 29.0.cil map needs to be
updated
Change-Id: Ifa7767d771f802e122b2f1ff6faf198ba2afa42e
2019-08-20 16:07:29 -07:00
Steven Moreland
b75b047f44 Reland "Re-open /dev/binder access to all."
This reverts commit 6b2eaade82.

Reason for revert: reland original CL

Separate runtime infrastructure now makes sure that only Stable AIDL
interfaces are used system<->vendor.

Bug: 136027762
Change-Id: Id5ba44c36a724e2721617de721f7cffbd3b1d7b6
Test: boot device, use /dev/binder from vendor
2019-08-20 16:03:37 -07:00
Steven Moreland
db28fe2381 Revert "Re-open /dev/binder access to all."
am: 6b2eaade82

Change-Id: Ic2d53641d0cebee31be81307d7a31809fa326f2d
2019-08-20 15:55:40 -07:00
Steven Moreland
6b2eaade82 Revert "Re-open /dev/binder access to all."
This reverts commit 94ff361501.

Fix: 139759536
Test: marlin build fixed

Change-Id: I3ea2e29896722a80b22f09c405be205ffb7de6b2
2019-08-20 22:39:43 +00:00
Steven Moreland
169bfcfe88 Merge changes Icdf207c5,I20aa48ef
am: 30a06d278f

Change-Id: Ia505b1539cfd64bb93c2f5fe0dbd0603df5e9f5f
2019-08-20 13:41:45 -07:00
Steven Moreland
30a06d278f Merge changes Icdf207c5,I20aa48ef
* changes:
  Re-open /dev/binder access to all.
  mediacodec: remove non-Treble allows
2019-08-20 19:50:24 +00:00
Steven Moreland
a23822b6cb [automerger skipped] Add uce service to core policy.
am: 20414effb6 -s ours
am skip reason: change_id Ibc5b048aaa1c9eda7b9180caca92cb876c3f6b28 with SHA1 92f72cd22d is in history

Change-Id: Ia107358692a2670e26683114bf61178dd5c7d36d
2019-08-20 12:12:13 -07:00
Steven Moreland
94ff361501 Re-open /dev/binder access to all.
Separate runtime infrastructure now makes sure that only Stable AIDL
interfaces are used system<->vendor.

Bug: 136027762
Test: boot device, use /dev/binder from vendor
Change-Id: Icdf207c5d5a4ef769c0ca6582dc58306f65be67e
2019-08-20 00:03:34 +00:00
Steven Moreland
641c45e258 mediacodec: remove non-Treble allows
Since mediacodec system services have been entirely deleted.

Bug: 80317992
Test: TH
Change-Id: I20aa48ef57474df000279a487f6b077790d273c1
2019-08-20 00:03:24 +00:00
Steven Moreland
dbfbddbf0e Merge "Add uce service to core policy." into stage-aosp-master 2019-08-19 21:38:00 +00:00
Roland Levillain
2d47c5da94 Allow dexoptanalyzer to mmap files with Linux 4.14+ that it can already access.
am: c72b7d1731

Change-Id: I39667ccca82601ef1afa3d38df0d184c73edc87b
2019-08-19 13:52:23 -07:00
Steven Moreland
20414effb6 Add uce service to core policy.
This service is requested by AOSP framework, but there is no context for
it defined.

Bug: 136023468
Test: N/A
Change-Id: Ibc5b048aaa1c9eda7b9180caca92cb876c3f6b28
Merged-In: Ibc5b048aaa1c9eda7b9180caca92cb876c3f6b28
(cherry picked from commit 67cb30fabf)
2019-08-19 12:42:56 -07:00
Steven Moreland
92f72cd22d Add uce service to core policy.
This service is requested by AOSP framework, but there is no context for
it defined.

Bug: 136023468
Test: N/A
Change-Id: Ibc5b048aaa1c9eda7b9180caca92cb876c3f6b28
Merged-In: Ibc5b048aaa1c9eda7b9180caca92cb876c3f6b28
(cherry picked from commit 67cb30fabf)
2019-08-19 12:29:39 -07:00
Roland Levillain
c72b7d1731 Allow dexoptanalyzer to mmap files with Linux 4.14+ that it can already access.
SELinux has a separate file mmap permission in 4.14+ kernels. Add this
to dexoptanalyzer(d) in cases where it could already access files (in
particular, secondary dex files).

Addresses denials of the form:

  avc: denied { map } for […] path="/data/data/[…]" […]
  scontext=u:r:dexoptanalyzer:s0 tcontext=u:object_r:app_data_file:s0

Test: Reproduce steps in bug 138683603 on a device with a 4.14+ kernel
      and check the absence of SELinux denials
Bug: 138683603

Change-Id: Ieba53eb431c0ba3914dcb5e5abdae667bd063555
2019-08-16 20:02:32 +01:00
Amy Zhang
3b62596f4f Merge "Tuner Hal 1.0 Enable ITuner service"
am: 3e7429359f

Change-Id: Ic4442460d60d51e97c84ea430830cd12c205e5f6
2019-08-15 13:23:33 -07:00
Amy Zhang
3e7429359f Merge "Tuner Hal 1.0 Enable ITuner service" 2019-08-15 18:04:05 +00:00
Remi NGUYEN VAN
b65731efb8 Merge "Add MAINLINE_SEPOLICY_DEV_CERTIFICATES to keys.conf"
am: 1fc3f318bf

Change-Id: I434639e3c40d5d0f5e3a8218891c7f173a44bd9b
2019-08-15 01:11:27 -07:00
Treehugger Robot
1fc3f318bf Merge "Add MAINLINE_SEPOLICY_DEV_CERTIFICATES to keys.conf" 2019-08-15 07:43:46 +00:00
Xin Li
b08436b805 DO NOT MERGE - Skip qt-dev-plus-aosp-without-vendor (5713463) in stage-aosp-master
Bug: 134405016
Change-Id: I7d7912abeb19a2a3ca8685f72a54837388ca7e84
2019-08-14 11:35:24 -07:00
Amy
89b4bbd4d8 Tuner Hal 1.0 Enable ITuner service
Test: cuttlefish
Bug: 135708935
Change-Id: Ica063458860df45f0e2ab640a2ab35cd4da3da8e
2019-08-14 11:22:09 -07:00
Kiyoung Kim
039549102c Merge changes from topic "use_generated_linkerconfig"
am: aff00188eb

Change-Id: I82225595e27aee8677c94d6a713d6ef5a195e2d7
2019-08-14 02:47:24 -07:00
Kiyoung Kim
98d2042b00 Add more permission for linkerconfig
am: 70e931caba

Change-Id: I734adf5a17214c895a3799cf04bdabb8dbf53039
2019-08-14 02:47:20 -07:00
Kiyoung Kim
aff00188eb Merge changes from topic "use_generated_linkerconfig"
* changes:
  Define sepolicy with property for linker
  Add more permission for linkerconfig
2019-08-14 09:28:23 +00:00
Kiyoung Kim
82c87ede24 Define sepolicy with property for linker
To support linker-specific property, sys.linker.* has been defined as
linker_prop. This will have get_prop access from domain so all binaries
can start with linker using proper property access level.

Bug: 138920271
Test: m -j && Confirmed from cuttlefish that get_prop errors are no longer found
Change-Id: Iaf584e0cbdd5bca3d5667e93cf9a6401e757a314
2019-08-14 12:35:15 +09:00
Tri Vo
7e4ef4871e Merge "sepolicy: public links in error messages"
am: 58188e5f42

Change-Id: I412f6f6d5ac9445478b9a50e372467d801271a3a
2019-08-13 16:50:38 -07:00
Tri Vo
58188e5f42 Merge "sepolicy: public links in error messages" 2019-08-13 23:09:33 +00:00
Carmen Jackson
5860205f67 Allow Traceur to record the suspend_resume trace event
am: 1e414b5355

Change-Id: I32de6f61520474f1cb9895e416ba409847082e6d
2019-08-13 01:13:23 -07:00
Carmen Jackson
1e414b5355 Allow Traceur to record the suspend_resume trace event
This should be available in user and userdebug builds.

Bug: 137289935
Test: Alongside atrace changes, recorded a trace using Traceur and
verified that the tracepoints were included in the recorded trace in
both user and userdebug builds.

Change-Id: I6131557bdd0a298be9e75b39759599b189b9b988
2019-08-09 10:56:15 -07:00
Tri Vo
462c9c4382 sepolicy: public links in error messages
Bug: n/a
Test: n/a
Change-Id: Id449fe115fac8bf99c33bf4455a23dd29448f93d
2019-08-09 10:27:48 -07:00
vichang
146fd75622 Merge "Add sepolicy for com.android.i18n module"
am: 35108c95f5

Change-Id: I6c104082f1ad0b1fad63b79bbc9b9624a305927d
2019-08-08 04:25:00 -07:00
vichang
35108c95f5 Merge "Add sepolicy for com.android.i18n module" 2019-08-08 11:06:53 +00:00
Kiyoung Kim
70e931caba Add more permission for linkerconfig
Additional permission is required for linkerconfig from domain to get
access to ld.config.txt file from linker. This change allows linker to
get /dev/linkerconfig/ld.config.txt

Bug: 138920271
Test: m -j && confirmed from cuttlefish
Change-Id: Id130a072add8ae82840b0b4d9e997e146f502124
2019-08-08 17:18:21 +09:00
Zim
cf289bc411 Allow MediaProvider to host FUSE devices.
am: b56cc6fb1f

Change-Id: Id6909432f50669e4450e6c9fa9de8cc1a8164b08
2019-08-07 19:28:53 -07:00
Zim
b56cc6fb1f Allow MediaProvider to host FUSE devices.
This change is part of enabling upcoming platform changes that are
described in the bug linked below.

Bug: 135341433
Test: m
Change-Id: I6ef499b0d5aa403f8eb6699649a201d8cc004bc5
2019-08-07 19:00:15 +01:00