Commit graph

5318 commits

Author SHA1 Message Date
TreeHugger Robot
deddd22d0b Merge "Enable incidentd access to ro.boot.bootreason" into rvc-dev 2020-04-22 20:19:38 +00:00
Wenjie Zhou
eee53bc24b Enable incidentd access to ro.boot.bootreason
incident report contains similar data as in a bugreport, but in proto
format.

This is a cherry-pick from aosp/1283764 with conflicts resolved.


Test: adb shell incident -p LOCAL 1000
Bug: 152173578
Change-Id: Iee53a3b8a6c95629a1d5c15b4d17f3d680b14178
Merged-In: Iee53a3b8a6c95629a1d5c15b4d17f3d680b14178
2020-04-22 17:55:18 +00:00
Ashwini Oruganti
1c46259081 Fix typo: s/com.google.android.gfs/com.google.android.gsf
Bug: 154597032
Test: TH
Change-Id: Ia8de313a9573649c456568abb3a8190dc2960bc3
Merged-In: Ia8de313a9573649c456568abb3a8190dc2960bc3
2020-04-22 10:35:56 -07:00
Rambo Wang
f7ba4f4726 Merge "Add policy to allow EmergencyAffordanceService to dump state" into rvc-dev 2020-04-22 01:18:54 +00:00
Ashwini Oruganti
f7c70427b4 Route com.google.android.gsf to gmscore_app
com.google.android.gms and com.google.android.gsf have a sharedUserId
but were being routed to two different domains:

com.google.android.gms 10145 0 /data/user/0/com.google.android.gms google:privapp:targetSdkVersion=10000
com.google.android.gsf 10145 0 /data/user/0/com.google.android.gsf google:privapp:targetSdkVersion=10000

This change routes them to the same domain: gmscore_app

Bug: 154597032
Test: TH
Change-Id: I0a309a687eb8608604cabf65b58763a1a3262153
Merged-In: I0a309a687eb8608604cabf65b58763a1a3262153
2020-04-21 11:49:28 -07:00
PO HUNG CHEN
85f81e8706 Merge "Allow developer settings to query gsid status" into rvc-dev 2020-04-21 03:41:10 +00:00
Chi Zhang
42f302f7bd Merge "Allow radio to send pulled atoms to statsd." into rvc-dev 2020-04-21 00:33:46 +00:00
Rambo Wang
d52c69f2e6 Add policy to allow EmergencyAffordanceService to dump state
Bug: 130187110
Test: adb shell dumpsys emergency_affordance
Merged-In: I4dcc227ba949a02a0393999c8065f8bd8b981959
Change-Id: I4dcc227ba949a02a0393999c8065f8bd8b981959
(cherry picked from commit 25e527634a)
2020-04-20 19:48:22 +00:00
Primiano Tucci
2b44fdfccb Allow traced to create files within /data/misc/perfetto-traces
Together with aosp/1282157 this change allows the service to
create trace files in the /data/misc/perfetto-traces folder.
Before this change they needed to be created by the perfetto
cmdline client and pass the FD.
This doesn't work for host tools like Android GPU Inspector
(https://gpuinspector.dev/) which talk to the UNIX socket
over adb forward and cannot pass a FD from the host.

Bug: 153519149
Test: manual: adb shell perfetto --txt -c -
  buffers { size_kb: 65536 }
  data_sources {
    config {
      name: "linux.ftrace"
      ftrace_config { ftrace_events: "sched_switch" }
    }
  }
  duration_ms: 5000
  write_into_file: true
  output_path: "/data/misc/perfetto-traces/ttt"

Change-Id: I184329805741654983843e6a29c1fac19a836f59
(cherry picked from commit 386d95b15f)
2020-04-20 16:16:58 +01:00
Howard Chen
e6925b7de4 Allow developer settings to query gsid status
When the device is running DSU, the DSULoader button should
be disabled.

Bug: 151792130
Test: open developer settings and check the DSULoader

Merged-In: Iae2d3dcc9d2b6de1fa5f6a0931465b355fe74ddf
Change-Id: Iae2d3dcc9d2b6de1fa5f6a0931465b355fe74ddf
(cherry picked from commit 7833aa4751)
2020-04-20 15:35:05 +08:00
Martijn Coenen
51b1d918ca Add external_storage properties.
Since these need to be set from a vendor context.

Bug: 152170470
Bug: 153525566
Test: N/A
Change-Id: I2e90ad08fa0a5bd2b4759d92f95d35cec2b316df
Merged-In: I2e90ad08fa0a5bd2b4759d92f95d35cec2b316df
2020-04-16 10:14:44 +02:00
Nikita Ioffe
90ad5fc78d Add init.userspace_reboot.started.timeoutmillis property
This property controls how much userspace reboot watchdog will wait for
userspace reboot to start before falling back to hard reboot.

Test: builds
Bug: 152803929
Change-Id: I6955e8c94708e7e4161e4f334b03c052d42c0f9f
Merged-In: I6955e8c94708e7e4161e4f334b03c052d42c0f9f
(cherry picked from commit 7947d580e3)
2020-04-14 00:22:31 +01:00
Ytai Ben-Tsvi
25d07d9934 Allow system_server to set audio properties
Defined a new signal intended to allow the system to reboot
the audio/soundtrigger HAL process.

Fixes: 153461865
Test: See main change in topic
Change-Id: I1e4a770670bb1274fa6a23cd0641f2554d4679f7
Merged-In: I1e4a770670bb1274fa6a23cd0641f2554d4679f7
2020-04-10 16:04:09 -07:00
Florian Mayer
9eba8e7e95 Merge "Refactor sepolicy to support central mode on user." into rvc-dev 2020-04-08 13:56:43 +00:00
Collin Fijalkovich
c6c9229cfa Allow Traceur record the mm_event trace event.
Bug: 150130660
Test: Took a trace with Traceur and verified mm_event records
were included when the memory category was enabled.

Merged-In: I5e783fbbe91dbe330b49fb11cd7d32ac820e7a5c
Change-Id: I5e783fbbe91dbe330b49fb11cd7d32ac820e7a5c
(cherry picked from commit 45be3aa649)
2020-04-07 16:29:50 +00:00
Florian Mayer
856391e9eb Refactor sepolicy to support central mode on user.
Functionally this is a no-op change.

This is a cherry-pick of 356b98d552.

Bug: 152976928
Change-Id: If4c0c6c74e60cc84f4adedfd430b385795cd15eb
Merged-In: If4c0c6c74e60cc84f4adedfd430b385795cd15eb
2020-04-06 19:40:55 +01:00
TreeHugger Robot
3deb842263 Merge "Allow incidentd to attach perfetto traces on user." into rvc-dev 2020-04-03 21:07:41 +00:00
Robin Lee
a006484f22 Allow blank_screen to make binder calls to the servicemanager
blank_screen can not find and use the lights HAL if it cannot use the servicemanager. This
broke turning off the display during shutdown.

Test: adb root; adb shell setenforce 0; adb shell setprop ctl.start blank_screen
Test: adb logcat -b all | grep 'denied'
Fix: 151363454
Merged-In: I6aff1cb71f805637abc79493ba2574143c5cf7cf
Change-Id: I6aff1cb71f805637abc79493ba2574143c5cf7cf
2020-04-02 19:38:36 +00:00
TreeHugger Robot
61d58248fc Merge "Reduce graphics logspam" into rvc-dev 2020-04-02 16:12:40 +00:00
Florian Mayer
c7000de5ad Allow incidentd to attach perfetto traces on user.
This is a cherry-pick 487bf1c5ff.

Bug: 151140716
Change-Id: I821d1a504e6ffcea3a52e2c76bf2290e7b382a48
Merged-In: I821d1a504e6ffcea3a52e2c76bf2290e7b382a48
2020-04-02 15:44:00 +00:00
Jeff Vander Stoep
8200faed61 Reduce graphics logspam
There is no change in behavior. These denials were already
being blocked.

Bug: 79617173
Test: build
Change-Id: Iffd1e5ba42854615eeea9490fe9150678ac98796
Merged-In: Iffd1e5ba42854615eeea9490fe9150678ac98796
(cherry picked from commit 67896eef07)
2020-04-02 14:43:17 +02:00
Bowgo Tsai
68ba302bbd Ignore the denial when system_other is erased
This CL addresses the following denial, when the system_other
partition is erased. This happens when 1) the device gets an
OTA update and 2) factory reset to wipe userdata partition.

Note that the system_other partition will be mounted under
/postinstall only in the first boot after factory reset.
Also, system_other.img is only included in the factory ROM and
is absent in the OTA package. When it is absent and userdata
is wiped, the mount will fail and triggers the following denials
when both cppreopts.sh and preloads_copy.sh access /postinstall dir.

SELinux denials to address:
  avc: denied { search } for comm="find" name="postinstall" dev="dm-5"
  ino=44 scontext=u:r:preloads_copy:s0
  tcontext=u:object_r:postinstall_mnt_dir:s0 tclass=dir permissive=0

  avc: denied { search } for comm="cppreopts.sh" name="postinstall" dev="dm-5"
  ino=44 scontext=u:r:cppreopts:s0
  tcontext=u:object_r:postinstall_mnt_dir:s0 tclass=dir permissive=0

Bug: 152453231
Test: fastboot erase system_other (e.g., system_b) and fastboot -w
Change-Id: Ie67f02467d5da51b0caba6e8fda56bc2c6bbc944
Merged-In: Ie67f02467d5da51b0caba6e8fda56bc2c6bbc944
(cherry picked from commit 35c2f102f2)
2020-03-31 20:10:26 +08:00
Ram Muthiah
32b675cb13 Merge "Update core sepolicy with neuralnetwork hal" into rvc-dev 2020-03-26 23:53:23 +00:00
Alistair Delva
1e18fcb51e Merge "Update core sepolicy with gnss hal" into rvc-dev 2020-03-26 21:38:29 +00:00
Ram Muthiah
302f4b20ed Update core sepolicy with neuralnetwork hal
Bug: 152338071
Bug: 145388549
Test: Forrest
Change-Id: I8224c04806db829ef20156d656755f7fc5874e3e
Merged-In: I8224c04806db829ef20156d656755f7fc5874e3e
2020-03-26 13:40:10 -07:00
Nikita Ioffe
9448d4d130 Use properties for various userspace reboot timeouts
Test: adb reboot userspace
Bug: 146560409
Change-Id: I62408f0e59622c2dab1245897c3057d02c5716a9
Merged-In: I62408f0e59622c2dab1245897c3057d02c5716a9
(cherry picked from commit 9e6588dc95)
2020-03-25 21:46:41 +00:00
TreeHugger Robot
3a9759cc5a Merge "Ignore errors that zygote tries to setattr media_rw_data_file dir" into rvc-dev 2020-03-24 17:53:07 +00:00
Ricky Wai
351d3dd63b Ignore errors that zygote tries to setattr media_rw_data_file dir
Bug: 152043945
Test: No selinux error in boot
Change-Id: Id01377e6b8c7be9103bd1dec3283cf720e6f6af9
Merged-In: Id01377e6b8c7be9103bd1dec3283cf720e6f6af9
(cherry picked from commit 037e11b86e)
2020-03-24 16:04:32 +00:00
Sasha Kuznetsov
561286ad44 Update core sepolicy with gnss hal
Test: n/a
Bug: 152028150
Change-Id: I41989392b3b03a2036fc8c1dbfc87207f9af73ad
Merged-In: I41989392b3b03a2036fc8c1dbfc87207f9af73ad
2020-03-24 00:11:45 +00:00
Jeffrey Huang
0d8d8cc3c7 Merge "Allow statsd to access a new metadata directory" into rvc-dev 2020-03-20 21:07:48 +00:00
Songchun Fan
6191f719b2 [incremental] remove legacy service name from sepolicy
We now only have one system service, called "incremental".

Test: builds
BUG: 150406132
Change-Id: I47643bac5711dcd4291bf4bf1cdcb853a0f51fb4
2020-03-19 16:20:29 -07:00
Chi Zhang
3f6abeb24f Allow radio to send pulled atoms to statsd.
Test: build and statsd_testdrive
Bug: 146066107
Bug: 141631489
Bug: 122371089
Bug: 149880090
Bug: 127666858
Bug: 142026991

Change-Id: I68c0bd2748080e71672169544222cce17e0156cb
Merged-In: I011417db8415f5f0edabb98e9d60970bac991809
Merged-In: Ia8d3f264713698b623b386dd790967cecb71479f
Merged-In: I5587467acf80740058daa9ae09aa7831c34f4e3a
Merged-In: I3834264c59a4e807089889ecc2598d86b851b3d1
2020-03-19 23:01:12 +00:00
Jeffrey Huang
534befb29d Allow statsd to access a new metadata directory
Test: m -j
Bug: 149838525
Merged-In: I8633d21feb827c67288eb2894bafae166b103f92
Change-Id: I4da09a7345609c9e35385a413c8bb6413a842aab
2020-03-19 10:15:12 -07:00
Pawin Vongmasa
4bec1e37a2 Allow XML file paths to be customized with sysprop
Three properties are declared as vendor-init-settable:
ro.media.xml_variant.codecs
ro.media.xml_variant.codecs_performance
ro.media.xml_variant.profiles

media_codecs.xml can now be named
media_codecs${ro.media.xml_variant.codecs}.xml

media_codecs_performance.xml can now be named
media_codecs_performance${ro.media.xml_variant.codecs_performance}.xml

media_profiles_V1_0 can now be named
media_profiles${ro.media.xml_variant.profiles}.xml

Test: Rename "media_codecs.xml" to "media_codecs_test.xml",
set ro.media.xml_variant.codecs to "_test", then
call "stagefright -i".

Test: Rename "media_codecs_performance.xml" to
"media_codecs_performance_test.xml",
set ro.media.xml_variant.codecs_performance to "_test", then
run android.media.cts.VideoDecoderPerfTest.

Test: Rename "media_profiles_V1_0.xml" to "media_profiles_test.xml",
set ro.media.xml_variant.profiles to "_test", then
run vts_mediaProfiles_validate_test.

Bug: 142102953
Change-Id: I407a0a327fcc8e799bb4079b11048a497565be48
Merged-In: I407a0a327fcc8e799bb4079b11048a497565be48
2020-03-18 22:55:36 +00:00
Alistair Delva
398aa5e5ce Merge "Add sepolicy for the securityfs mount type." into rvc-dev 2020-03-18 21:49:03 +00:00
Yurii Zubrytskyi
469434c302 Merge "[selinux] permissions on new ioctls for filling blocks" into rvc-dev 2020-03-18 15:09:38 +00:00
Songchun Fan
4ba3045740 [selinux] permissions on new ioctls for filling blocks
Denial messages:

03-17 20:30:54.274  1445  1445 I PackageInstalle: type=1400 audit(0.0:6): avc: denied { ioctl } for path=2F646174612F696E6372656D656E74616C2F4D545F646174615F696E6372656D656E74616C5F746D705F313134353234353836342F6D6F756E742F2E70656E64696E675F7265616473202864656C6574656429 dev="incremental-fs" ino=2 ioctlcmd=0x6721 scontext=u:r:system_server:s0 tcontext=u:object_r:incremental_control_file:s0 tclass=file permissive=1

03-17 20:30:54.274  1445  1445 I PackageInstalle: type=1400 audit(0.0:7): avc: denied { ioctl } for path="/data/incremental/MT_data_incremental_tmp_1145245864/mount/.index/2b300000000000000000000000000000" dev="incremental-fs" ino=6794 ioctlcmd=0x6720 scontext=u:r:system_server:s0 tcontext=u:object_r:apk_data_file:s0 tclass=file permissive=1

03-17 20:49:11.797 16182 16182 I Binder:16182_6: type=1400 audit(0.0:13): avc: denied { ioctl } for path=2F646174612F696E6372656D656E74616C2F4D545F646174615F696E6372656D656E74616C5F746D705F3537383539353635322F6D6F756E742F2E70656E64696E675F7265616473202864656C6574656429 dev="incremental-fs" ino=2 ioctlcmd=0x6721 scontext=u:r:priv_app:s0:c512,c768 tcontext=u:object_r:incremental_control_file:s0 tclass=file permissive=1 app=com.android.vending

03-17 20:49:11.797 16182 16182 I Binder:16182_6: type=1400 audit(0.0:14): avc: denied { ioctl } for path="/data/incremental/MT_data_incremental_tmp_578595652/mount/.index/626173652e61706b0000000000000000" dev="incremental-fs" ino=5810 ioctlcmd=0x6720 scontext=u:r:priv_app:s0:c512,c768 tcontext=u:object_r:apk_data_file:s0 tclass=file permissive=1 app=com.android.vending

Test: manual
BUG: 150809360
Change-Id: If43fa9edad0848a59c0712b124adfcdbbd0c99a4
2020-03-17 20:25:27 -07:00
Nicolas Geoffray
074d072ce8 Merge "Revert "Sepolicy: Allow system_server_startup to load dalvikcache artifacts"" into rvc-dev 2020-03-17 08:30:05 +00:00
Nicolas Geoffray
4c671592be Revert "Sepolicy: Allow system_server_startup to load dalvikcache artifacts"
Bug: 128688902
Bug: 150032912
Test: boots

This reverts commit e074312077.

(cherry-picked from commit 86111c9cd5)

Merged-In: Ib3871142a200ac64268eb02db98d3260758a4677
Change-Id: Ia625dbef3dd18cd06d827149d2b18c55fd076eaf
2020-03-16 16:44:55 +00:00
Nikita Ioffe
3bd53a9cee Add userspace_reboot_test_prop
This property type represents properties used in CTS tests of userspace
reboot. For example, test.userspace_reboot.requested property which is
used to check that userspace reboot was successful and didn't result in
full reboot, e.g.:
* before test setprop test.userspace_reboot.requested 1
* adb reboot userspace
* wait for boot to complete
* verify that value of test.userspace_reboot.requested is still 1

Test: adb shell setprop test.userspace_reboot.requested 1
Bug: 150901232
Change-Id: I45d187f386149cec08318ea8545ab864b5810ca8
2020-03-16 11:17:12 +00:00
A. Cody Schuffelen
158e176c5a Add sepolicy for the securityfs mount type.
See discussion in aosp/1233645. There was a concern about this
filesystem automounting when enabled, so this change adds sepolicy to
preemptively lock it down.

I'm not confident it actually automounts. If it does, it'll land in
/sys/kernel/security, which is also protected with the sysfs policy.

Test: Builds
Bug: 148102533
Change-Id: I78a246a5c18953f2471f84367ab383afb2742908
Merged-In: I78a246a5c18953f2471f84367ab383afb2742908
2020-03-13 15:55:05 +00:00
Adam Shih
4684ef7565 Merge "gmscore_app: suppress denials on /mnt" into rvc-dev 2020-03-13 01:33:54 +00:00
Hongyi Zhang
7f400c6841 Whitelist prop persist.device_config.configuration.
For system prop flags from DeviceConfig namespace "Configuration".

Test: Build and run on local device
Bug: 149420506

Change-Id: If4196b4bf231e7c52f98b92cc0031a08dad06120
Merged-In: If4196b4bf231e7c52f98b92cc0031a08dad06120
2020-03-12 01:17:36 +00:00
Adam Shih
0058302270 gmscore_app: suppress denials on /mnt
Bug: 149543390
Bug: 149062700
Bug: 151195371
Test: boot with no gmscore_app avc error
Change-Id: I70f20b88ce5b9e017e644cdbb5dc81f798c61640
2020-03-11 16:20:07 +08:00
Steven Moreland
6968e374c1 Merge "Allow vndservicemanager to self-register." into rvc-dev 2020-03-09 18:34:19 +00:00
Songchun Fan
3daa20f14f Merge "[sepolicy] remove vendor_incremental_module from global sepolicy rules" into rvc-dev 2020-03-09 01:40:27 +00:00
Steven Moreland
bfceeabe3c Allow vndservicemanager to self-register.
This is useful for tools like dumpsys, so that they work on all services
equally as well. Also, so that there is no difference with the regular
service manager.

Bug: 150579832
Test: 'adb shell /vendor/bin/dumpsys -l' shows 'manager'
Test: denial is no longer present:
03-05 12:23:47.346   221   221 E SELinux : avc:  denied  { add } for pid=221 uid=1000 name=manager scontext=u:r:vndservicemanager:s0 tcontext=u:object_r:service_manager_vndservice:s0 tclass=service_manager permissive=0

Change-Id: Id6126e8277462a2c4d5f6022ab67a4bacaa3241e
(cherry picked from commit 52a96cc7dd)
2020-03-06 16:35:52 -08:00
KRIS CHEN
6ffa674965 Merge "Add rules to dump fingerprint hal traces" into rvc-dev 2020-03-06 03:16:53 +00:00
PO HUNG CHEN
8834ca0f22 Merge "Allow gsid to callback system server for oneway method" into rvc-dev 2020-03-06 02:25:21 +00:00
Songchun Fan
5d7887850b [sepolicy] remove vendor_incremental_module from global sepolicy rules
Moving to pixel-sepolicy

BUG: 150882666
Test: atest PackageManagerShellCommandIncrementalTest
Change-Id: I55f5d53ee32d0557e06c070961526631e1bb1fc5
2020-03-05 15:36:23 -08:00