policy
system, system_ext, product and vendor partitions have aconfig storage
files under /<partition>/etc/aconfig dir. need to grant access to
aconfigd.
Bug: b/312459182
Test: m and tested with AVD
Change-Id: I9750c24ffa26994e4f5deadd9d772e31211a446a
The default policy for the "lockdown" access vector on Android was
introduced in commit bcfca1a6. While the "confidentiality" permission
was granted to all processes, the "integrity" was marked as
neverallowed.
Upstream, the support for that access vector was removed from kernel
5.16 onwards.
It was found that the "integrity" permission either does not apply to
Android or duplicates other access control (e.g., capabilities
sys_admin).
Instead of simply removing the neverallow rule, the access is granted to
all processes. This will prevent the proliferation of references to this
access vector in vendors' policies and ultimately facilitate its
removal.
Test: presubmit
Bug: 285443587
Bug: 269377822
Bug: 319390252
Change-Id: If2ad34fbbf2c0d29ac54ab5d1be430623f86f1f7
(cherry picked from commit 99a4cbcee7)
Merged-In: If2ad34fbbf2c0d29ac54ab5d1be430623f86f1f7
debug/eng builds.
This change is to allow SystemUI, a platform_app, to start, stop,
and share Perfetto/Winscope traces.
Bug: 305049544
Test: Verified everything works on my local device.
Change-Id: I8fc35a5a570c2199cfdd95418a6caf0c48111c46
am skip reason: Merged-In I7e4c044a6a2afb48c33d65cc421e797d77aacc12 with SHA-1 28b811df1c is already in history
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/2977032
Change-Id: I674060405e05470708ce20d95cf828ab9c5b2b17
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
am skip reason: Merged-In I7e4c044a6a2afb48c33d65cc421e797d77aacc12 with SHA-1 28b811df1c is already in history
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/2977032
Change-Id: Ie115d6f1b4683ddc625809756a7caf824cd406d4
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
This is needed to allow vendor xt_bpf programs.
Bug: 325709490
Test: TreeHugger
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I7ff8a0319bec2f3a57c7ce48939b13b2fca182de
(cherry picked from commit 37ca69e5c8)
Merged-In: I7ff8a0319bec2f3a57c7ce48939b13b2fca182de
The default policy for the "lockdown" access vector on Android was
introduced in commit bcfca1a6. While the "confidentiality" permission
was granted to all processes, the "integrity" was marked as
neverallowed.
Upstream, the support for that access vector was removed from kernel
5.16 onwards.
It was found that the "integrity" permission either does not apply to
Android or duplicates other access control (e.g., capabilities
sys_admin).
Instead of simply removing the neverallow rule, the access is granted to
all processes. This will prevent the proliferation of references to this
access vector in vendors' policies and ultimately facilitate its
removal.
Test: presubmit
Bug: 285443587
Bug: 269377822
Bug: 319390252
Change-Id: If2ad34fbbf2c0d29ac54ab5d1be430623f86f1f7
(cherry picked from commit 99a4cbcee7)
Merged-In: If2ad34fbbf2c0d29ac54ab5d1be430623f86f1f7
This includes rules for starting Perfetto as well as rules for
communicating over stdio between Perfetto and system_server.
This is a cherrypick of aosp/2958867 with prebuilts updated.
Bug: 325709490
Test: Presubmit
Change-Id: I7e4c044a6a2afb48c33d65cc421e797d77aacc12
Merged-In: I7e4c044a6a2afb48c33d65cc421e797d77aacc12
This is causing denials in case the fence fd comes from
graphic composer.
Bug: 301023410
Test: atest CtsCameraTestCases with test virtual camera enabled
Change-Id: I14cb26c058342470aa2dc214ab47cc61aa2f3255
am skip reason: Merged-In I6c966c92b238a2262d2eb7f41041ed4c359e9e0a with SHA-1 d2a0892121 is already in history
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/2974133
Change-Id: Ic9437442074bbdc06daa44a2d4041074ed2357d7
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
am skip reason: Merged-In I6c966c92b238a2262d2eb7f41041ed4c359e9e0a with SHA-1 d2a0892121 is already in history
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/2974133
Change-Id: I6a8242a6da2ede1f9d3f27cfb3fc52bb452e7510
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
The tracing filesystem used to be mounted on /sys/kernel/debug/tracing,
but is nowaways available at /sys/kernel/tracing.
Since debugfs itself is no longer mounted on release devices, there is
no need for rules that relax specific .../debug/tracing/... files to be
available on release devices. Leave them as debugfs_tracing_debug.
Not touching other labels such as debugfs_tracing_printk_formats in case
there are debug-only tools that grant themselves access to just that
label. Might revisit those in a different patch.
Bug: 303590268
Change-Id: Ic234c73ac7256117179c4b3eb35da0eac9a50eaa
This is a tracing control file that userspace can read/write an ascii
number (e.g. "50"). In turn, it controls the behaviour of blocking
read(), splice(), and poll() on the tracing kernel ring buffer fds.
A blocked syscall will only be woken up once the kernel fills the buffer
past the "buffer_percent" watermark (so 50% -> half-full).
We'll be using this file in perfetto's traced_probes, but it should also
be safe to expose to other users of the tracing file system (aka
debugfs_tracing in sepolicy) on release builds.
Added to linux in:
https://android.googlesource.com/kernel/common/+/03329f99
Change-Id: Ifcdc73cb0162e8cdadf2e7c16b0215410134ccae
libft2.so is removed from LLNDK, as it was LLNDK-private just because it is
referenced from VNDK-SPs, but it is no longer true because of VNDK
deprecation. This change adds libft2.so to have same sepolicy with other
sphal libraries, so it can be loaded from sphal libraries same as
before. Mark same to libpng.so as it is referenced from libft2.so
Bug: 326402649
Test: Barbet boot succeeded without sepolicy error
Change-Id: Id8c1194da478bd4fc02e701230fd1a3c0b3c00be
This new property is to set an apex name when input configuration files
are bundled in an apex.
libinput checks the new sysprop when loading input configuration.
This removes hard-coded apex name (com.android.input.config).
Bug: 315080500
Test: adb shell dumpsys input
# set "touch.orientationAware = 0" in Touchscreen_0.idc
# build/install the input config apex
# Observe the Input configuration
# "Touch Input Mapper" shows "OrientationAware: false"
Change-Id: Ie0bf30bff2ed7f983caa5b893994a5bd2759e192
In AVF, virtualizationmanager checks the selinux label of given disk
image for proving whether the given image is edited maliciously.
Existing one(vendor_configs_file, /vendor/etc/*) was too wide to
use for this purpose.
Bug: 325709490
Bug: 285854379
Test: m
Merged-In: I6c966c92b238a2262d2eb7f41041ed4c359e9e0a
Change-Id: I6c966c92b238a2262d2eb7f41041ed4c359e9e0a
(cherry picked from commit d2a0892121)
The default policy for the "lockdown" access vector on Android was
introduced in commit bcfca1a6. While the "confidentiality" permission
was granted to all processes, the "integrity" was marked as
neverallowed.
Upstream, the support for that access vector was removed from kernel
5.16 onwards.
It was found that the "integrity" permission either does not apply to
Android or duplicates other access control (e.g., capabilities
sys_admin).
Instead of simply removing the neverallow rule, the access is granted to
all processes. This will prevent the proliferation of references to this
access vector in vendors' policies and ultimately facilitate its
removal.
Test: presubmit
Bug: 285443587
Bug: 269377822
Bug: 319390252
Change-Id: If2ad34fbbf2c0d29ac54ab5d1be430623f86f1f7
misctrl can set properties which can be injected into
bugreports.
Limit visibility of these properties so that no device
code can branch based off these properties.
Bug: 317262681
Test: bugreport
Change-Id: I74f6f240b08b2681540bca262dcc76bcdca9cdad
