Commit graph

24468 commits

Author SHA1 Message Date
Nikita Ioffe
91cecb75ca Merge "Allow priv_app to search apex_data_file and read staging_data_file" into rvc-dev 2020-04-24 21:44:40 +00:00
Collin Fijalkovich
a24d7ccd8f Merge "Use prefixes for binder cache SELinux properties." into rvc-dev 2020-04-24 20:54:04 +00:00
Petri Gynther
284c189cf7 Merge "Allow adb shell user to collect vmstat" into rvc-dev 2020-04-24 16:40:40 +00:00
David Sehr
96b06bc2ae Merge "Control use of dex2oat64 by device property" into rvc-dev 2020-04-23 23:38:26 +00:00
David Sehr
cfe6717d05 Control use of dex2oat64 by device property
Gate use of dex2oat64 by a device property.

Bug: 153380900
Test: atest -c  installd_dexopt_test
(cherry picked from commit 80a1403c62)
Merged-In: I640085b5cd744cdc4563f565f8a914f9b1adc3ab
Change-Id: Ic81916085112d6556ade78476dbc61bb3f318ce9
2020-04-23 21:41:28 +00:00
Petri Gynther
0e19ccc49f Allow adb shell user to collect vmstat
Bug: 154839500
Test: adb shell vmstat 2 5
Merged-In: I6e93c4b5b29f38549f49f7f1ed0bd505613d648f
Change-Id: I6e93c4b5b29f38549f49f7f1ed0bd505613d648f
2020-04-23 11:12:45 -07:00
Automerger Merge Worker
4dd363d511 Use prefixes for binder cache SELinux properties.
Adds a context for telephony related cache properties and changes
the bluetooth and system_server properties to match off of prefix
instead of exact string matches.

Bug: 151953109
Test: Flashed phone with PowerManager caches enabled and verified
that the phone boots.

Merged-In: I9110192a12bb6222e49a8fb6b266d6067ef2ea92
Change-Id: I3128596a2f893954a54499cf295e5c88a94d4965
(cherry picked from commit bae0bd2016)
2020-04-23 18:02:31 +00:00
Treehugger Robot
a07eaa4eec Adding file group for vts_treble_sys_prop_test.
Bug: 147720376
Test: m vts_treble_sys_prop_test
Change-Id: I81a0e21a989dd89f8c37adf5a5c739ca0bdfbac0
Merged-In: I81a0e21a989dd89f8c37adf5a5c739ca0bdfbac0
2020-04-23 17:55:04 +00:00
TreeHugger Robot
deddd22d0b Merge "Enable incidentd access to ro.boot.bootreason" into rvc-dev 2020-04-22 20:19:38 +00:00
Ashwini Oruganti
a917c9f6e1 Merge "Fix typo: s/com.google.android.gfs/com.google.android.gsf" into rvc-dev 2020-04-22 20:15:54 +00:00
Nikita Ioffe
34849cb3f1 Merge "Add new apexd.status value of "activated"." into rvc-dev 2020-04-22 18:43:02 +00:00
Wenjie Zhou
eee53bc24b Enable incidentd access to ro.boot.bootreason
incident report contains similar data as in a bugreport, but in proto
format.

This is a cherry-pick from aosp/1283764 with conflicts resolved.


Test: adb shell incident -p LOCAL 1000
Bug: 152173578
Change-Id: Iee53a3b8a6c95629a1d5c15b4d17f3d680b14178
Merged-In: Iee53a3b8a6c95629a1d5c15b4d17f3d680b14178
2020-04-22 17:55:18 +00:00
Ashwini Oruganti
1c46259081 Fix typo: s/com.google.android.gfs/com.google.android.gsf
Bug: 154597032
Test: TH
Change-Id: Ia8de313a9573649c456568abb3a8190dc2960bc3
Merged-In: Ia8de313a9573649c456568abb3a8190dc2960bc3
2020-04-22 10:35:56 -07:00
Oli Lan
c8fcff6bfe Add new apexd.status value of "activated".
- Cherry-pick of aosp/1228660

As of aosp/1224611, there is a new step in the preparation of APEXes
where init calls back into apexd after DE user data is unencrypted to
allow DE apex data to be snapshotted or restored.

This adds a new enum value for the apexd.status property to allow
this status to be described.

Bug: 148672144
Test: build & flash, check boot completes and check in logs that the
correct status values are set.
Merged-In: I7effcf16280eabcd5b9a0d70d33bd34d79121312
Change-Id: Ibe023ac0155419f2dfa8b1d5ce4c1e2a6ca87277
2020-04-22 13:05:11 +00:00
Rambo Wang
f7ba4f4726 Merge "Add policy to allow EmergencyAffordanceService to dump state" into rvc-dev 2020-04-22 01:18:54 +00:00
Nikita Ioffe
89d43a51ba Allow priv_app to search apex_data_file and read staging_data_file
This changes are necessary to make files under /data/apex/active
be readable by Phonesky.

Test: builds
Bug: 154635217
Change-Id: I14116f02f3d3f0a8390f1d968a3971f15bd4b3f2
2020-04-22 00:05:07 +01:00
Ashwini Oruganti
f7c70427b4 Route com.google.android.gsf to gmscore_app
com.google.android.gms and com.google.android.gsf have a sharedUserId
but were being routed to two different domains:

com.google.android.gms 10145 0 /data/user/0/com.google.android.gms google:privapp:targetSdkVersion=10000
com.google.android.gsf 10145 0 /data/user/0/com.google.android.gsf google:privapp:targetSdkVersion=10000

This change routes them to the same domain: gmscore_app

Bug: 154597032
Test: TH
Change-Id: I0a309a687eb8608604cabf65b58763a1a3262153
Merged-In: I0a309a687eb8608604cabf65b58763a1a3262153
2020-04-21 11:49:28 -07:00
PO HUNG CHEN
85f81e8706 Merge "Allow developer settings to query gsid status" into rvc-dev 2020-04-21 03:41:10 +00:00
Chi Zhang
42f302f7bd Merge "Allow radio to send pulled atoms to statsd." into rvc-dev 2020-04-21 00:33:46 +00:00
Rambo Wang
d52c69f2e6 Add policy to allow EmergencyAffordanceService to dump state
Bug: 130187110
Test: adb shell dumpsys emergency_affordance
Merged-In: I4dcc227ba949a02a0393999c8065f8bd8b981959
Change-Id: I4dcc227ba949a02a0393999c8065f8bd8b981959
(cherry picked from commit 25e527634a)
2020-04-20 19:48:22 +00:00
Primiano Tucci
2b44fdfccb Allow traced to create files within /data/misc/perfetto-traces
Together with aosp/1282157 this change allows the service to
create trace files in the /data/misc/perfetto-traces folder.
Before this change they needed to be created by the perfetto
cmdline client and pass the FD.
This doesn't work for host tools like Android GPU Inspector
(https://gpuinspector.dev/) which talk to the UNIX socket
over adb forward and cannot pass a FD from the host.

Bug: 153519149
Test: manual: adb shell perfetto --txt -c -
  buffers { size_kb: 65536 }
  data_sources {
    config {
      name: "linux.ftrace"
      ftrace_config { ftrace_events: "sched_switch" }
    }
  }
  duration_ms: 5000
  write_into_file: true
  output_path: "/data/misc/perfetto-traces/ttt"

Change-Id: I184329805741654983843e6a29c1fac19a836f59
(cherry picked from commit 386d95b15f)
2020-04-20 16:16:58 +01:00
Howard Chen
e6925b7de4 Allow developer settings to query gsid status
When the device is running DSU, the DSULoader button should
be disabled.

Bug: 151792130
Test: open developer settings and check the DSULoader

Merged-In: Iae2d3dcc9d2b6de1fa5f6a0931465b355fe74ddf
Change-Id: Iae2d3dcc9d2b6de1fa5f6a0931465b355fe74ddf
(cherry picked from commit 7833aa4751)
2020-04-20 15:35:05 +08:00
Martijn Coenen
c2e570f8dd Merge "Add external_storage properties." into rvc-dev 2020-04-17 07:59:26 +00:00
TreeHugger Robot
c7a8148327 Merge "sepolicy: Add a new property for aware iface" into rvc-dev 2020-04-16 16:10:58 +00:00
Roshan Pius
02c36b38ef sepolicy: Add a new property for aware iface
Bug: 153852667
Test: Compiles
Change-Id: I696cd9334ecf5e947e0459910de258bf904eb520
Merged-In: I696cd9334ecf5e947e0459910de258bf904eb520
2020-04-16 13:48:31 +00:00
Martijn Coenen
51b1d918ca Add external_storage properties.
Since these need to be set from a vendor context.

Bug: 152170470
Bug: 153525566
Test: N/A
Change-Id: I2e90ad08fa0a5bd2b4759d92f95d35cec2b316df
Merged-In: I2e90ad08fa0a5bd2b4759d92f95d35cec2b316df
2020-04-16 10:14:44 +02:00
Nikita Ioffe
68bf668a62 Merge "Add init.userspace_reboot.started.timeoutmillis property" into rvc-dev 2020-04-14 10:02:01 +00:00
Nikita Ioffe
90ad5fc78d Add init.userspace_reboot.started.timeoutmillis property
This property controls how much userspace reboot watchdog will wait for
userspace reboot to start before falling back to hard reboot.

Test: builds
Bug: 152803929
Change-Id: I6955e8c94708e7e4161e4f334b03c052d42c0f9f
Merged-In: I6955e8c94708e7e4161e4f334b03c052d42c0f9f
(cherry picked from commit 7947d580e3)
2020-04-14 00:22:31 +01:00
Robert Shih
67bbb71550 Allow drm hals to access allocator hal
Bug: 150468341
Test: atest VtsHalDrmV1_3TargetTest
Change-Id: Iea8934567cda343dedf17f75cb0807a68742764d
Merged-In: Iea8934567cda343dedf17f75cb0807a68742764d
2020-04-13 20:01:06 +00:00
Ytai Ben-Tsvi
25d07d9934 Allow system_server to set audio properties
Defined a new signal intended to allow the system to reboot
the audio/soundtrigger HAL process.

Fixes: 153461865
Test: See main change in topic
Change-Id: I1e4a770670bb1274fa6a23cd0641f2554d4679f7
Merged-In: I1e4a770670bb1274fa6a23cd0641f2554d4679f7
2020-04-10 16:04:09 -07:00
Florian Mayer
9eba8e7e95 Merge "Refactor sepolicy to support central mode on user." into rvc-dev 2020-04-08 13:56:43 +00:00
TreeHugger Robot
668dd31475 Merge "Vendors may choose dm-default-key options format" into rvc-dev 2020-04-08 00:10:59 +00:00
Collin Fijalkovich
c6c9229cfa Allow Traceur record the mm_event trace event.
Bug: 150130660
Test: Took a trace with Traceur and verified mm_event records
were included when the memory category was enabled.

Merged-In: I5e783fbbe91dbe330b49fb11cd7d32ac820e7a5c
Change-Id: I5e783fbbe91dbe330b49fb11cd7d32ac820e7a5c
(cherry picked from commit 45be3aa649)
2020-04-07 16:29:50 +00:00
Paul Crowley
34058dc5b4 Vendors may choose dm-default-key options format
Bug: 150761030
Test: setting to 1 in device/google/cuttlefish/shared/device.mk
    causes "default-key: Not enough arguments" as expected.
Cherry-Picked-From: c115da5968
Merged-In: I73262efff0be15f0295d23168049ed9e3721a7f7
Change-Id: I73262efff0be15f0295d23168049ed9e3721a7f7
2020-04-07 07:29:38 -07:00
Florian Mayer
856391e9eb Refactor sepolicy to support central mode on user.
Functionally this is a no-op change.

This is a cherry-pick of 356b98d552.

Bug: 152976928
Change-Id: If4c0c6c74e60cc84f4adedfd430b385795cd15eb
Merged-In: If4c0c6c74e60cc84f4adedfd430b385795cd15eb
2020-04-06 19:40:55 +01:00
TreeHugger Robot
3deb842263 Merge "Allow incidentd to attach perfetto traces on user." into rvc-dev 2020-04-03 21:07:41 +00:00
Robin Lee
a006484f22 Allow blank_screen to make binder calls to the servicemanager
blank_screen can not find and use the lights HAL if it cannot use the servicemanager. This
broke turning off the display during shutdown.

Test: adb root; adb shell setenforce 0; adb shell setprop ctl.start blank_screen
Test: adb logcat -b all | grep 'denied'
Fix: 151363454
Merged-In: I6aff1cb71f805637abc79493ba2574143c5cf7cf
Change-Id: I6aff1cb71f805637abc79493ba2574143c5cf7cf
2020-04-02 19:38:36 +00:00
TreeHugger Robot
61d58248fc Merge "Reduce graphics logspam" into rvc-dev 2020-04-02 16:12:40 +00:00
Florian Mayer
c7000de5ad Allow incidentd to attach perfetto traces on user.
This is a cherry-pick 487bf1c5ff.

Bug: 151140716
Change-Id: I821d1a504e6ffcea3a52e2c76bf2290e7b382a48
Merged-In: I821d1a504e6ffcea3a52e2c76bf2290e7b382a48
2020-04-02 15:44:00 +00:00
Jeff Vander Stoep
8200faed61 Reduce graphics logspam
There is no change in behavior. These denials were already
being blocked.

Bug: 79617173
Test: build
Change-Id: Iffd1e5ba42854615eeea9490fe9150678ac98796
Merged-In: Iffd1e5ba42854615eeea9490fe9150678ac98796
(cherry picked from commit 67896eef07)
2020-04-02 14:43:17 +02:00
Bowgo Tsai
2d54a6ea6a Merge "Ignore the denial when system_other is erased" into rvc-dev 2020-04-02 07:08:03 +00:00
David Anderson
e449594ee1 fastbootd: Allow flashing the cache partition.
This fixes the following denial:
  avc:  denied  { write } for  pid=332 comm="fastbootd" name="mmcblk0p35" dev="tmpfs" ino=11234 scontext=u:r:fastbootd:s0 tcontext=u:object_r:cache_block_device:s0 tclass=blk_file permissive=0
  avc:  denied  { ioctl } for  pid=294 comm="fastbootd" path="/dev/block/mmcblk0p35" dev="tmpfs" ino=6953 ioctlcmd=0x1277 scontext=u:r:fastbootd:s0 tcontext=u:object_r:cache_block_device:s0 tclass=blk_file permissive=0

Bug: 150112538
Test: fastboot flash cache on non-A/B device
Test: fastboot erase cache on non-A/B device
Change-Id: Ib2288b42f2bb47e83b1476319669d6c2719db2ec
Merged-In: Ib2288b42f2bb47e83b1476319669d6c2719db2ec
2020-03-31 13:21:04 -07:00
Bowgo Tsai
68ba302bbd Ignore the denial when system_other is erased
This CL addresses the following denial, when the system_other
partition is erased. This happens when 1) the device gets an
OTA update and 2) factory reset to wipe userdata partition.

Note that the system_other partition will be mounted under
/postinstall only in the first boot after factory reset.
Also, system_other.img is only included in the factory ROM and
is absent in the OTA package. When it is absent and userdata
is wiped, the mount will fail and triggers the following denials
when both cppreopts.sh and preloads_copy.sh access /postinstall dir.

SELinux denials to address:
  avc: denied { search } for comm="find" name="postinstall" dev="dm-5"
  ino=44 scontext=u:r:preloads_copy:s0
  tcontext=u:object_r:postinstall_mnt_dir:s0 tclass=dir permissive=0

  avc: denied { search } for comm="cppreopts.sh" name="postinstall" dev="dm-5"
  ino=44 scontext=u:r:cppreopts:s0
  tcontext=u:object_r:postinstall_mnt_dir:s0 tclass=dir permissive=0

Bug: 152453231
Test: fastboot erase system_other (e.g., system_b) and fastboot -w
Change-Id: Ie67f02467d5da51b0caba6e8fda56bc2c6bbc944
Merged-In: Ie67f02467d5da51b0caba6e8fda56bc2c6bbc944
(cherry picked from commit 35c2f102f2)
2020-03-31 20:10:26 +08:00
Ytai Ben-tsvi
cf9ae010cf Merge "Allow audio HAL to access application shared memory" into rvc-dev 2020-03-30 18:57:12 +00:00
Tao Bao
086085b8ad Ignore the denial due to vendor_misc_writer reading DT fstab. am: ab38d7073e
Change-Id: I33416cf74bab1bd45fb7eec879391976943c9b00
2020-03-30 14:19:01 +00:00
Tao Bao
ab38d7073e Ignore the denial due to vendor_misc_writer reading DT fstab.
This CL addresses the following denial, when vendor_misc_writer tries to
read DT fstab (i.e. device tree fstab) for /misc entry.

avc: denied { search } for comm="misc_writer" name="android" dev="sysfs" ino=17456 scontext=u:r:vendor_misc_writer:s0 tcontext=u:object_r:sysfs_dt_firmware_android:s0 tclass=dir

DT fstab was used for devices shipped prior to Q, for early-mounting
partitions (e.g. /system, /vendor, /product), which has been disallowed
for Q launch devices. vendor_misc_writer is a new module added since Q,
so it doesn't need to worry about the legacy code path; in practice
there's no benefit of putting /misc entry into DT fstab either.

Bug: 134122603
Bug: 152718206
Test: Build and flash taimen with the change that enables
      vendor_misc_writer. Check that it no longer gives the above denial
      during boot.
Change-Id: Id2fb206706f7cd19a4cde2701e4155bfc03f01b4
2020-03-30 11:49:35 +02:00
TreeHugger Robot
afd27274cd Merge "Add sepolicy to access ion dev from Tuner service" into rvc-dev 2020-03-28 03:55:51 +00:00
TreeHugger Robot
739c3f5403 Merge "iorapd: Allow dumpstate (bugreport) to dump iorapd" into rvc-dev 2020-03-28 03:06:31 +00:00
Amy Zhang
73f0159390 Add sepolicy to access ion dev from Tuner service
Tuner default implementation is testing with Ion buffer on Cuttlefish
to make sure the secure handle merchanism would work with media data
pass between the Tuner Hal and the Tuner Java.

Ion access would be needed for all the Tuner Hal implementation

Test: atest
Bug: 150952766
Change-Id: I39117f96bdc84ce24afcb3ef528b6d942ded505e
2020-03-27 17:40:41 -07:00
Igor Murashkin
cb8a889b64 iorapd: Allow dumpstate (bugreport) to dump iorapd
Bug: 152616197
Test: adb bugreport
Change-Id: I36e3b6d847341ddd84792ccc3f2c2c620e1c3f7b
2020-03-27 13:15:12 -07:00