tequilaOS/platform_system_sepolicy

8364 commits 1 branch 0 tags 50 MiB

Author	SHA1	Message	Date
Glen Kuhne	9147a23835	hwbinder_use: allow for hwservicemanager callbacks. In order for hal clients to use IServiceManager::registerForNotifications, the hwservicemanager needs to be able to call into client processes. Test: WIP Bug: 33383725 Change-Id: I59470e9cd5cbeafda010fedc0b91eeb41280e0a1	2016-12-15 14:17:27 -08:00
Nick Kralevich	49e3588429	Add directory read permissions to certain domains. Addresses the following denials and auditallows: avc: denied { read } for pid=561 comm="hwservicemanage" name="hw" dev="dm-0" ino=1883 scontext=u:r:hwservicemanager:s0 tcontext=u:object_r:system_file:s0 tclass=dir permissive=0 avc: denied { read } for pid=748 comm="gatekeeperd" name="hw" dev="dm-0" ino=1883 scontext=u:r:gatekeeperd:s0 tcontext=u:object_r:system_file:s0 tclass=dir permissive=0 avc: granted { read open } for pid=735 comm="fingerprintd" path="/system/lib64/hw" dev="dm-0" ino=1883 scontext=u:r:fingerprintd:s0 tcontext=u:object_r:system_file:s0 tclass=dir Test: no denials on boot Change-Id: Ic363497e3ae5078e564d7195f3739a654860a32f	2016-11-28 17:03:41 +00:00
dcashman	cc39f63773	Split general policy into public and private components. Divide policy into public and private components. This is the first step in splitting the policy creation for platform and non-platform policies. The policy in the public directory will be exported for use in non-platform policy creation. Backwards compatibility with it will be achieved by converting the exported policy into attribute-based policy when included as part of the non-platform policy and a mapping file will be maintained to be included with the platform policy that maps exported attributes of previous versions to the current platform version. Eventually we would like to create a clear interface between the platform and non-platform device components so that the exported policy, and the need for attributes is minimal. For now, almost all types and avrules are left in public. Test: Tested by building policy and running on device. Change-Id: Idef796c9ec169259787c3f9d8f423edf4ce27f8c	2016-10-06 13:09:06 -07:00

Author

SHA1

Message

Date

Glen Kuhne

9147a23835

hwbinder_use: allow for hwservicemanager callbacks.

In order for hal clients to use IServiceManager::registerForNotifications,
the hwservicemanager needs to be able to call into client processes.

Test: WIP
Bug: 33383725
Change-Id: I59470e9cd5cbeafda010fedc0b91eeb41280e0a1

2016-12-15 14:17:27 -08:00

Nick Kralevich

49e3588429

Add directory read permissions to certain domains.

Addresses the following denials and auditallows:

avc: denied { read } for pid=561 comm="hwservicemanage" name="hw"
dev="dm-0" ino=1883 scontext=u:r:hwservicemanager:s0
tcontext=u:object_r:system_file:s0 tclass=dir permissive=0

avc: denied { read } for pid=748 comm="gatekeeperd" name="hw" dev="dm-0"
ino=1883 scontext=u:r:gatekeeperd:s0 tcontext=u:object_r:system_file:s0
tclass=dir permissive=0

avc: granted { read open } for pid=735 comm="fingerprintd"
path="/system/lib64/hw" dev="dm-0" ino=1883 scontext=u:r:fingerprintd:s0
tcontext=u:object_r:system_file:s0 tclass=dir

Test: no denials on boot
Change-Id: Ic363497e3ae5078e564d7195f3739a654860a32f

2016-11-28 17:03:41 +00:00

dcashman

cc39f63773

Split general policy into public and private components.

Divide policy into public and private components.  This is the first
step in splitting the policy creation for platform and non-platform
policies.  The policy in the public directory will be exported for use
in non-platform policy creation.  Backwards compatibility with it will
be achieved by converting the exported policy into attribute-based
policy when included as part of the non-platform policy and a mapping
file will be maintained to be included with the platform policy that
maps exported attributes of previous versions to the current platform
version.

Eventually we would like to create a clear interface between the
platform and non-platform device components so that the exported policy,
and the need for attributes is minimal.  For now, almost all types and
avrules are left in public.

Test: Tested by building policy and running on device.

Change-Id: Idef796c9ec169259787c3f9d8f423edf4ce27f8c

2016-10-06 13:09:06 -07:00

Renamed from hwservicemanager.te (Browse further)

3 commits