tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
41827 commits 1 branch 0 tags 50 MiB
Commit graph

41827 commits

This branch
This branch
All branches
Author SHA1 Message Date
Inseob Kim
8bc8b75f95 Revert^3 "Start tracking vendor seapp coredomain violations" 
This reverts commit b193c80986.

Reason for revert: Fix is merged

Change-Id: Ia2dcd6584ee763c6da3f3b7fdd9f4710ffde9bfc
 2023-09-18 04:08:19 +00:00
Inseob Kim
b193c80986 Revert^2 "Start tracking vendor seapp coredomain violations" 
This reverts commit 6ec4e5f048.

Reason for revert: breaking build

Change-Id: If99f309fd8d5dd5b42a871259451c10530e1769d
 2023-09-15 03:58:00 +00:00
Inseob Kim
6ec4e5f048 Revert "Start tracking vendor seapp coredomain violations" 
This reverts commit 292f22a33b.

Reason for revert: removed all attribute usages; no need

Change-Id: Iab489f1a94733438ba0c552fb9e3eb354423a156
 2023-09-14 15:57:04 +00:00
Inseob Kim
292f22a33b Start tracking vendor seapp coredomain violations 
As part of Treble, enforce that vendor's seapp_contexts can't label apps
using coredomains. Apps installed to system/system_ext/product should be
labeled with platform side sepolicy.

This change adds the violators attribute that will be used to mark
violating domains that need to be fixed.

Bug: 280547417
Test: manual
Change-Id: I64f3bb2880bd19e65450ea3d3692d1b424402d92
 2023-08-18 15:24:59 +09:00
Victor Hsieh
aecd87d3dd Merge "Remove shell from neverallow of frp_block_device access" into main 2023-08-17 15:26:55 +00:00
Treehugger Robot
37e095bbf1 Merge "Add sepolicy rules for crashrecovery APEX." into main 2023-08-17 01:03:27 +00:00
Dennis Shen
df3a1680d2 Update name from trunk_stable_flags to aconfig flags 
the name "trunk stable" is not recommended to appear in android code
base as it is an internal concept. therefore the name change.

Bug: b/295379636
Change-Id: Ice045ac00e2d4987221cc6516baa0d013e6e0943
 2023-08-16 19:10:13 +00:00
Victor Hsieh
1020cada2d Remove shell from neverallow of frp_block_device access 
Since shell doesn't have any frp_block_device rule anyway.

Bug: None
Test: m

Change-Id: I5aeb54969359500f9473bc08cb1fd42e3470b428
 2023-08-16 11:17:31 -07:00
Dennis Shen
5fe5b43bb5 Merge "Setup a common channel to trunk stable flags in system properties" into main 2023-08-16 12:32:56 +00:00
Harshit Mahajan
cd4f71a8b5 Add sepolicy rules for crashrecovery APEX. 
Bug: b/289203818
Test: NA

Change-Id: I6d25d413fb512a48e765088bc8dde59c89aec257
 2023-08-16 12:00:48 +00:00
Treehugger Robot
243e100005 Merge "Allow typical app domains to measure fs-verity on data file" into main 2023-08-15 14:23:23 +00:00
Treehugger Robot
7dec1e253e Merge "Allow installd to enable fs-verity on app's file" into main 2023-08-15 14:23:23 +00:00
Dennis Shen
d32299780f Setup a common channel to trunk stable flags in system properties 
This is a common root node for native trunk stable flags in system properties. Each flag in a namespace will appear in the sys prop as

persist.device_config.trunk_stable_flags.<namespace>.<flag>

Bug: b/295379636
Change-Id: I42e4a799781a9ced442cbdcbdb6b905446d72d73
 2023-08-14 14:23:59 +00:00
Greg Kaiser
8cd6556686 Merge "Revert "Add rules for reading VM DTBO by vfio_handler"" into main 2023-08-14 13:19:31 +00:00
Alfred Piccioni
cbb3ddd15f Revert "Add rules for reading VM DTBO by vfio_handler" 
This reverts commit 70d70e6be4.

Reason for revert: See internal bug for clarification: http://b/291191362

Change-Id: If37670f7d71635314c618f7ac88802bfbc6fa007
 2023-08-14 13:04:00 +00:00
Treehugger Robot
9ea3a16197 Merge "Make font_fallback.xml unreadable" into main 2023-08-14 07:47:20 +00:00
Seungjae Yoo
70d70e6be4 Add rules for reading VM DTBO by vfio_handler 
Bug: 291191362
Test: m

Change-Id: If93ca63324679aa1d65b3bb6bf792f8745184132
 2023-08-14 10:46:44 +09:00
Seigo Nonaka
d570a5c30f Make font_fallback.xml unreadable 
Bug: 281769620
Test: atest CtsGraphicsTestCases
Test: atest CtsTextTestCases
Change-Id: I05011c9313fa3818ec50d9884227512ef1b0fda9
 2023-08-14 07:46:19 +09:00
Jooyung Han
c30e7cdce3 Merge "Revert "Allow vold_prepare_subdirs to use apex_service"" into main 2023-08-11 23:23:18 +00:00
Nolan Scobie
51c6453ed7 Merge "Allow Perfetto's traced daemon to set debug sysprops" into main 2023-08-11 16:07:45 +00:00
Jooyung Han
701a0dab5c Revert "Allow vold_prepare_subdirs to use apex_service" 
Revert submission 2685449-apexdata-dirs

Reason for revert: b/295345486 performance regression.

Reverted changes: /q/submissionid:2685449-apexdata-dirs

Change-Id: Iceb277cd8a291fb008b45310cc03b5df2057f08c
 2023-08-11 15:34:44 +00:00
Treehugger Robot
3c2597caee Merge "webview: Add cgroup setattr of file permission" into main 2023-08-10 09:19:40 +00:00
Jooyung Han
04462f3010 Merge "Revert^2 "Add /bootstrap-apex"" into main 2023-08-10 02:38:30 +00:00
Jooyung Han
8677587245 Revert^2 "Add /bootstrap-apex" 
aca291806e

Change-Id: I99d9ba6e804ded5d2fd983e42f143f562c32ce58
 2023-08-09 07:05:31 +00:00
Jooyung Han
1158a1559e Merge "Allow vold_prepare_subdirs to use apex_service" into main 2023-08-09 06:37:02 +00:00
Igor Zaslavsky
805daca25e Merge "Add RemoteAuthService" into main 2023-08-08 16:48:51 +00:00
Martin Stjernholm
5896f3e58a Merge "Allow otapreopt_chroot to use stdin and stdout pipes." into main 2023-08-08 13:06:14 +00:00
Victor Hsieh
fefc95666b Allow typical app domains to measure fs-verity on data file 
Bug: 285185747
Test: Call installd from a local client
Change-Id: I93a9ffae5d1530dd9ddbc9504784701c7f962445
 2023-08-07 13:59:48 -07:00
Martin Stjernholm
2d6ee0286e Allow otapreopt_chroot to use stdin and stdout pipes. 
Test: See https://r.android.com/2681675
Bug: 293639539
Change-Id: I89ed8bcf5b5307736c53f9b345ac8a288584afad
 2023-08-07 21:21:20 +01:00
Victor Hsieh
264432ab71 Allow installd to enable fs-verity on app's file 
See aosp/2681476 for more details.

Bug: 285185747
Test: Call installd from a local client, no denial
Change-Id: Ie3fa45aceb8a6e61123d477bd994d964a3ae6529
 2023-08-07 11:08:34 -07:00
Jiyong Park
a5365f94de Fix typo: async_persist_write -> async_persist_writes 
The correct property name that init uses ends with 's' and shown in [1].

[1] https://cs.android.com/android/platform/superproject/main/+/main:system/core/init/property_service.cpp;l=1513?q=ro.property_service.async_persist_writes&ss=android%2Fplatform%2Fsuperproject%2Fmain#:~:text=1512-,1513,-1514

Bug: 250125146
Test: N/A
Change-Id: I8cd09e2908d53ecb41a1dee621821a2faca604b1
 2023-08-08 02:01:50 +09:00
Treehugger Robot
995ee52887 Merge "Use regular file for VM DTBO" into main 2023-08-07 08:54:53 +00:00
igorzas
7489e93613 Add RemoteAuthService 
Add SEPolicy for the RemoteAuth Manager/Service
Add Fuzzer exception, remote_auth service is going to be in Java and
Rust only

Design doc: go/remote-auth-manager-fishfood-design

Test: loaded on device.
Bug: 290092977
Change-Id: I4decb29b863170aed5e7c85da9c4b50c0675d3bd
 2023-08-04 17:55:14 +00:00
Jakob Schneider
09916a69c9 Merge "Add SEPolicy for the ArchiveManager/Service." into main 2023-08-04 16:10:01 +00:00
Jakob Schneider
5c5a6af643 Add SEPolicy for the ArchiveManager/Service. 
Test: boots - CTS coming in a future change
Change-Id: Ia42bc21e1523c7b225b7c84c3a3f18dd3ed1a54f
 2023-08-04 14:13:03 +01:00
Inseob Kim
bbe514d9b3 Use regular file for VM DTBO 
Bug: 287379025
Test: adb shell /apex/com.android.virt/bin/vm run-microdroid \
      --protected --mem 512 --devices \
      /sys/bus/platform/devices/16d00000.eh
Change-Id: Id77c25f5f22672da9281078fc17f45087d893f4d
 2023-08-04 15:26:17 +09:00
Jiyong Park
bf36988355 Merge "Label ro.property_service.async_persist_write as build_config_prop" into main 2023-08-04 04:09:48 +00:00
Treehugger Robot
a1beaa570b Merge "Don't audit shell_test_data_file for runas_app" into main 2023-08-04 00:06:39 +00:00
Fabien Sanglard
0876d7a978 Don't audit shell_test_data_file for runas_app 
Test: NA
Bug: 291838956
Change-Id: Iab61ade7fc105004c59da7b827f0aa5151b5f3ab
 2023-08-03 21:28:21 +00:00
Kangping Dong
9d965761ca Merge "add sepolicy rules for OT daemon binder service" into main 2023-08-03 14:13:21 +00:00
Kangping Dong
0b3e8c62ee add sepolicy rules for OT daemon binder service 
Bug: 262681784
Change-Id: I3b4d3603709a761ad1410b81c0e5b4e4fc51c43c
 2023-08-03 13:31:53 +08:00
Kelvin Zhang
0e7babefee Merge "Give vold permission to wipe a block device" into main 2023-08-02 23:31:50 +00:00
Kelvin Zhang
2b413622ce Give vold permission to wipe a block device 
During mountFstab call, vold might need to wipe and re-format a device.
See code in system/vold/model/PublicVolume.cpp , PublicVolume::doFormat
Allow IOCTLs such as BLKDISCARDZEROES for wiping.

Test: th
Bug: 279808236
Change-Id: I0bebf850aa45ece6227fa5c3e9c3fdb38164f79e
 2023-08-02 14:27:08 -07:00
Bin Huang
bdb54b5d38 webview: Add cgroup setattr of file permission 
On 32 bit gsi img, when the webview launch, system will crash, due to
system_server cgroup not have the selinux permission that setattr of file.

Bug:288190486
Test: flash 32-bit GSI image and boot to check whether webview crash

Change-Id: Ibe136965d7c47c6240a8e4464e4580fe7bd7eccc
 2023-08-02 11:09:58 +00:00
Treehugger Robot
6ebc7deb48 Merge "Add permission for VFIO device binding" into main 2023-08-02 10:51:08 +00:00
Jiyong Park
b08766a6ea Label ro.property_service.async_persist_write as build_config_prop 
So far, it has been labeled as default_prop because there was no entry
for the sysprop in property_context. As a result, it couldn't be set by
vendor_init.

Fixing that by correctly labeling it. build_config_prop is defined as
`system_vendor_config_prop` which vendor_init can set.

Bug: 250125146
Test: adb root && adb shell ro.property_service.async_persist_write 1
adb shell getprop -Z ro.property_service.async_persist_write

shows [ro.property_service.async_persist_write]: [u:object_r:build_config_prop:s0]

Change-Id: Ib30c708c8c2693892503a8f0d590541984c2667b
 2023-08-02 16:21:07 +09:00
Inseob Kim
825056de9a Add permission for VFIO device binding 
vfio_handler will bind platform devices to VFIO driver, and then
return a file descriptor containing DTBO. This change adds
permissions needed for that.

Bug: 278008182
Test: adb shell /apex/com.android.virt/bin/vm run-microdroid \
      --devices /sys/bus/platform/devices/16d00000.eh --protected
Change-Id: Ie947adff00d138426d4703cbb8e7a8cd429c2272
 2023-08-02 15:06:51 +09:00
Jooyung Han
0ce8184bed Allow vold_prepare_subdirs to use apex_service 
to get the list of active APEXes.

Bug: 293949266
Bug: 293546778
Test: CtsPackageSettingHostTestCases
Change-Id: I86f58158b97463206fb76a0c31f29b78874f4c35
 2023-08-01 10:46:03 +00:00
Jooyung Han
e9e32f58a1 Merge "Revert "Add /bootstrap-apex"" into main 2023-08-01 10:44:45 +00:00
Jooyung Han
aca291806e Revert "Add /bootstrap-apex" 
Revert submission 2666915-share-bootstrap

Reason for revert: b/293949266 vold_prepare_subdirs fails to create apexdata directories.

Reverted changes: /q/submissionid:2666915-share-bootstrap

Change-Id: Idab6db691c1130a1f5d596f5e05783cab7fdde05
 2023-08-01 09:06:42 +00:00