Commit graph

26 commits

Author SHA1 Message Date
Nicolas Geoffray
92b18f575d Fix braino in dexoptanalyzer policy and add dex2oat postinstall rule.
Test: m
Bug: 190817237
Change-Id: I4f73d7a137f2e2ee9497ca5e4c8ef28b3f86c35c
(cherry picked from commit f82451e0a4)
2021-06-29 14:15:48 +01:00
TreeHugger Robot
98f9af8bc1 Merge "Ensure that only desired processes can access TracingServiceProxy" into sc-dev 2021-06-24 22:02:23 +00:00
Carmen Jackson
2d6fb3971b Ensure that only desired processes can access TracingServiceProxy
This change adds a neverallow rule in traced.te to limit the processes
that can find tracingproxy_service, the context for TracingServiceProxy.

I wanted to avoid moving the tracingproxy_service definition to public,
so there were a few services that are exempted from this neverallow
rule.

Bug: 191391382
Test: Manually verified that with this change, along with the other
change in this topic, I see no errors when taking a bugreport while a
Traceur trace is running and the expected trace is included in the
generated bugreport.

Change-Id: I28d0b1b08baac43a53fe5a1ff0f67b788d51dc74
Merged-In: I8658df0db92ae9cf4fefe2eebb4d6d9a5349ea89
2021-06-24 18:42:57 +00:00
Dario Freni
25d2099d44 Allow apexd to create links in otapreopt_chroot.
Fixes: 191919967
Test: triggered bug on cf by running
m dist && python3 system/update_engine/scripts/update_device.py out/dist/cf_x86_64_phone-ota-eng.dariofreni.zip

Change-Id: I7a3abfdecd2d2276a291ab6c1ffe9a7d3f5fd60a
Merged-In: I7a3abfdecd2d2276a291ab6c1ffe9a7d3f5fd60a
Ignore-AOSP-first: this branch is not merging aosp changes anymore.
2021-06-24 14:11:00 +00:00
Thierry Strudel
b65cd0a1d6 Merge "Add support for hal_uwb" into sc-dev 2021-06-24 00:45:50 +00:00
Michael Ayoubi
142f375055 Add support for hal_uwb
Bug: 187386527
Test: Boot and confirm HAL is up
Signed-off-by: Michael Ayoubi <mayoubi@google.com>
Change-Id: Ia866a9a72b6f2ea5b31de25baefd13c2fd0b9c22
Merged-In: Ia866a9a72b6f2ea5b31de25baefd13c2fd0b9c22
2021-06-23 01:25:09 +00:00
TreeHugger Robot
22a1482add Merge "Update automotive_display_service selinux policy" into sc-dev 2021-06-22 23:58:47 +00:00
TreeHugger Robot
254cf3a1a5 Merge "Reland: Add ro.vendor.build.dont_use_vabc to property_contexts" into sc-dev 2021-06-22 19:25:01 +00:00
Changyeon Jo
6357834dab Update automotive_display_service selinux policy
Add a permission to use the graphics allocator.

Bug: 191094033
Test: Build a target and run the service after enforcing selinux
Ignore-AOSP-First: aosp won't auto merge to sc-dev
Change-Id: I52b6851bb95565c92fc4774a2de1f0791e6fdd23
2021-06-22 19:11:57 +00:00
Ricky Wai
70b98482e5 Update sepolicy api 31 ART profile ref dir change
Align the chagnes in aosp/1729396

Bug: 189787375
Test: AppDataIsolationTests
Ignore-AOSP-First: aosp won't auto merge to sc-dev

Change-Id: Ibf915e23e7db9c333e87cad75604d8251404092e
2021-06-22 16:22:31 +00:00
Nicolas Geoffray
b17a5ae970 Merge "Allow dexoptanalyzer to read /apex/apex-info-list.xml" into sc-dev 2021-06-22 10:37:57 +00:00
Diego Wilson
11d810a7fb Add camera2 extension property policies
These properties allow to vendors to provide their
own camera2 extensions service. The properties
must be accesible to any android app that wishes
to use camera2 extensions.

Bug: 183533362
Change-Id: I94c7ac336b3103355124830320787472f0d2a8b6
Merged-In: I94c7ac336b3103355124830320787472f0d2a8b6
2021-06-21 22:34:29 +00:00
Nicolas Geoffray
112b58852f Allow dexoptanalyzer to read /apex/apex-info-list.xml
This is needed to know the state of a .oat file.

Test: m
Bug: 190817237
Change-Id: Ie33ce7930689fea84e3240c2e0509c00464e6385
2021-06-21 20:33:52 +01:00
TreeHugger Robot
de25e307c4 Merge "Allow shell to read /vendor/apex/*" into sc-dev 2021-06-19 01:28:52 +00:00
Nikita Ioffe
ed10b9c977 Merge "Allow apexd to call f2fs-compression related ioctls on staging_data_file" into sc-dev 2021-06-18 19:51:43 +00:00
Kelvin Zhang
2e7abeb570 Reland: Add ro.vendor.build.dont_use_vabc to property_contexts
Bug: 185400304
Test: mm

Change-Id: Iae58ef223073f7d4c3135f7387fc28d813291be6
Merged-In: I7d06d0c1d137471a0d7b78678a372b29158f1be7
(cherry picked from commit 407b21b3cd)
2021-06-18 12:15:43 -04:00
Ray Chi
a2b5c91863 Merge "Add sys.usb.mtp.batchcancel to usb_config_prop" into sc-dev 2021-06-18 06:03:59 +00:00
Ray Chi
087c63461a Add sys.usb.mtp.batchcancel to usb_config_prop
Add sys.usb.mtp.batchcancel to usb_config_prop to allow
mediaprovider to read this property.

Bug: 181729410
Test: boot the device, and confirm the property could be read
Change-Id: I2964efde0cc831bb7e91fcafb7b35e57438ef306
Merged-In: I44b2d9c36bfa439cdbf8b8a874ead424381e3e50
(cherry picked from commit 07bb5d076a)
2021-06-17 06:47:03 +00:00
Nikita Ioffe
a12ba8a439 Allow apexd to call f2fs-compression related ioctls on staging_data_file
apexd needs to call the following two ioctls:

* FS_COMPR_FL - to check if fs supports compression.
* F2FS_IOC_RELEASE_COMPRESS_BLOCKS - to release compressed blocks.

Bug: 188859167
Test: m
Change-Id: Ia105d3dbcd64286cc33d1e996b2d2b85c09eae7a
2021-06-16 19:59:24 +01:00
Suren Baghdasaryan
88b6d77592 sepolicy: Allow lmkd to access bpf map to read GPU allocation statistics
Lmkd needs read access to /sys/fs/bpf/map_gpu_mem_gpu_mem_total_map BPF
map to obtain information on GPU memory allocations.

Bug: 189366037
Test: lmkd_unit_test
Signed-off-by: Suren Baghdasaryan <surenb@google.com>
Change-Id: I59ded4bc5ec97861e50b4fd1fdd6efb23990b79c
Merged-In: I59ded4bc5ec97861e50b4fd1fdd6efb23990b79c
2021-06-16 15:53:56 +00:00
Jiyong Park
023c5c37ea Allow shell to read /vendor/apex/*
It is used for future xTS tests to read the raw files.

Bug: 190858091
Test: m
Merged-In: If1c7fd92772ff84d92a95fbee74f6c1f8d1cd365
Change-Id: If1c7fd92772ff84d92a95fbee74f6c1f8d1cd365
(cherry picked from commit abdc9739fc)
2021-06-16 15:04:17 +09:00
Hongguang
afa541d30f Allow priv_app to run the renderscript compiler. am: 737b098a71
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/1732952

Bug: 157478854
Test: Manual
Change-Id: I926aa35dcae148ab38629077a9725a6e9263a4be
(cherry picked from commit b264eae769)
2021-06-15 19:15:27 +00:00
Ioannis Ilkos
02fcaf2c02 Allow system_server to read /proc/vmstat
/proc/vmstat oom_kill counts the number of times __oom_kill_process
was actioned
(https://lore.kernel.org/lkml/149570810989.203600.9492483715840752937.stgit@buzz/)

We want to record this in the context of system_server for tracking
purposes.

Bug: 154233512
Change-Id: I27bcbcd5d839e59a1dca0e87e2f4ae107201654c
Merged-In: I27bcbcd5d839e59a1dca0e87e2f4ae107201654c
Test: build, verify vmstat can be read
2021-06-15 14:50:07 +01:00
Jeff Sharkey
c784fc7ef9 platform/system/sepolicy - SEPolicy Prebuilts for S
Bug: 171506470
Test: Build
Change-Id: Ia4ea2999f4bc8ae80f13e51d99fba3e98e293447
2021-06-14 12:55:31 -06:00
Tej Singh
93c52f14b5 Update S sepolicy prebuilt for apex-info-list
Add shell permission to read apex-info-list.xml to S prebuilt

Ignore-AOSP-First:prebuilt for S
Test: TH
Bug: 186767843
Change-Id: I2bb14d4bce661f1b4daf1c486004271837f0d3c2
2021-06-09 09:38:21 +00:00
Jeff Sharkey
6a5fd26e7a platform/system/sepolicy - SEPolicy Prebuilts for S
Bug: 171506470
Test: Build
Change-Id: I8bf6c8833ecc65ca241fb9bc8be1b7b919825414
2021-06-01 06:49:23 -06:00