Commit graph

45616 commits

Author SHA1 Message Date
Thiébaud Weksteen
99a4cbcee7 Grant lockdown integrity to all processes
The default policy for the "lockdown" access vector on Android was
introduced in commit bcfca1a6. While the "confidentiality" permission
was granted to all processes, the "integrity" was marked as
neverallowed.

Upstream, the support for that access vector was removed from kernel
5.16 onwards.

It was found that the "integrity" permission either does not apply to
Android or duplicates other access control (e.g., capabilities
sys_admin).

Instead of simply removing the neverallow rule, the access is granted to
all processes. This will prevent the proliferation of references to this
access vector in vendors' policies and ultimately facilitate its
removal.

Test: presubmit
Bug: 285443587
Bug: 269377822
Bug: 319390252
Change-Id: If2ad34fbbf2c0d29ac54ab5d1be430623f86f1f7
2024-02-22 12:20:38 +11:00
Treehugger Robot
f9f826fb30 Merge "Support multiple se_flags modules" into main 2024-02-19 04:30:04 +00:00
Jooyung Han
77b2a438fc Merge "Revert^2 "Relax neverallows for vendor to use /system/bin/sh"" into main 2024-02-19 02:03:06 +00:00
Inseob Kim
d1fada7e61 Merge "label boot animations on oem with bootanim_oem_file" into main 2024-02-19 01:21:00 +00:00
Jooyung Han
9a123be434 Revert^2 "Relax neverallows for vendor to use /system/bin/sh"
This reverts commit f77cf6780c.

Reason for revert: sepolicy change is still necessary. (won't break things)

Change-Id: If47218b39ac34c21f3e09d29a5e713b240c4f0a6
2024-02-16 11:06:40 +00:00
Jernej Virag
bbff9f5ea1 Merge "Revert "Relax neverallows for vendor to use /system/bin/sh"" into main 2024-02-16 10:13:22 +00:00
Håkan Kvist
1f915b4b13 label boot animations on oem with bootanim_oem_file
Bootanimation only access boot animation files on oem. Label
these files with bootanim_oem_file and remove oemfs file allow rule.

Also allow mediaserver and app to read this new label as they can access
/oem/media folder.

Bug: 324437684
Test: Confirm that boot animation on oem is shown without violations
Change-Id: I940ccde9391a5daa920f31926d32e68b1de5b7eb
2024-02-16 11:08:30 +01:00
Joonhun Shin
f77cf6780c Revert "Relax neverallows for vendor to use /system/bin/sh"
Revert submission 2964802-sh_path

Reason for revert: <b/325569171>

Reverted changes: /q/submissionid:2964802-sh_path

Change-Id: I89e635e742d8f4f8a79afa1bb2646c7621705994
2024-02-16 09:22:42 +00:00
Inseob Kim
bf7f4a4401 Support multiple se_flags modules
Instead of centralized one se_flags module under system/sepolicy,
additional se_flags modules can be defined anywhere to support defining
downstream branches' own flagging.

Bug: 321875465
Test: TH
Test: soong test
Change-Id: I6e45c859b7f09e27ba1d60033b0db1424472cb63
2024-02-16 16:14:40 +09:00
Jooyung Han
0ae95839d3 Merge "Relax neverallows for vendor to use /system/bin/sh" into main 2024-02-16 06:56:45 +00:00
Trevor David Black
4105da26f9 Add fifo_file read access to enable gpuservice within device cts
Bug: 299537644
Test: atest -c CtsGraphicsTestCases:VulkanFeaturesTest#testAndroidBaselineProfile2021Support
Change-Id: Iab5c4255f01317c197488158ef8cc63fcf0ebb3b
2024-02-15 22:21:30 +00:00
Mikhail Naganov
ead55ce93a Merge "Add ro.audio.ihaladaptervendorextension_enabled property" into main 2024-02-15 17:08:10 +00:00
Dennis Shen
537a704088 Merge "selinux setup for files under /metadata/aconfig dir" into main 2024-02-15 13:20:02 +00:00
Tej Singh
aebd92592a Merge "stats_service: only disallow untrusted access" into main 2024-02-15 08:30:19 +00:00
Jooyung Han
f0ba322926 Relax neverallows for vendor to use /system/bin/sh
Since 202404, vendor components will use /system/bin/sh for system(3),
popen(3), etc.

Bug: 324142245
Test: system("readlink /proc/$$/exe") in vendor HALs
Change-Id: I521499678e87a7d0216a276e014888867f495803
2024-02-15 13:18:40 +09:00
Tej Singh
000b251c7d stats_service: only disallow untrusted access
Allow device-specific domains to access stats_service. All access must
be done over proper APIs (StatsManager, AStatsManager) instead of
accessing the AIDL interfaces directly.

Test: build
Bug: 318788254
Change-Id: I98ddc1900350daf755372be7249f25a462e3242d
2024-02-14 15:07:21 -08:00
Brandon Liu
37c4c7c500 Merge "Revert "[res] Allow accessing idmap files in all zygotes"" into main 2024-02-14 20:49:22 +00:00
Mikhail Naganov
8b69e5fd48 Add ro.audio.ihaladaptervendorextension_enabled property
This property is used by libaudiohal@aidl to detect whether
the system_ext partition provides an instance of
IHalAdapterVendorExtension. This is a "system internal"
property because it belongs to `system_ext`.

Bug: 323989070
Test: atest audiorouting_test
Ignore-AOSP-First: coupled with Pixel change, will upstream
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:17406cd0a723cb89a03705709ec78d37b3d66042)
Merged-In: I81267da070958a70f2f3c4882718cac4600e3476
Change-Id: I81267da070958a70f2f3c4882718cac4600e3476
2024-02-14 18:53:37 +00:00
Dennis Shen
6c8210da20 selinux setup for files under /metadata/aconfig dir
1, /metadata/aconfig is the directory that stores aconfig storage
related protobuf files and flag value files boot copy. Grant read
access to everybody. But limit the write access only to init and
aconfig storage service process (to be created later)

2, /metadata/aconfig/flags is the sub directory that stores persistent
aconfig value files.Initially set it up to be accessible by
system_server process only . When aconfig storage service process is
created, will add another permission to storage service process.

Context to why we are hosting flag data on /metadata partition:

Android is adopting trunk stable workflow, flagging and A/B testing is
essential to every platform component. We need some place to host the
flag that are accessible to system processes that starts before /data
partition becomes available.

In addition, there has been a long discussion regarding utilizing
/metadata partition for some process data, another example is mainline
modules, we are trying to make them to be able to be mounted earlier,
but cannot due to /data availability.

Bug: 312444587
Test: m
Change-Id: I7e7dae5cf8c4268d71229c770af31b5e9f071428
2024-02-14 17:56:29 +00:00
Patrick Baumann
7ee66a0391 Revert "[res] Allow accessing idmap files in all zygotes"
This reverts commit 1195b5eb14.

Reason for revert: b/325161357

Change-Id: I7e6846791020938fb732311105e0f692c648a0f1
2024-02-14 16:24:59 +00:00
Changyeon Jo
41f83574eb [automerger skipped] [RESTRICT AUTOMERGE] Allow dumpstate to make binder IPC to automotive display service am: d16bdc461f -s ours
am skip reason: skipped by inseob

Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/2960075

Change-Id: I44f8d2b6ad20f33521b363781a843a5aa1d5cfed
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
2024-02-14 05:03:04 +00:00
Yurii Zubrytskyi
1195b5eb14 [res] Allow accessing idmap files in all zygotes
Resources now cache open idmap fds to speed up the up-to-date
checks, and this requires zygote processes to be able to access
them

Bug: 282215580
Test: atest android.text.cts.EmojiTest
Change-Id: I808be8a5d321a01193e7f76e316f5f64d4235753
2024-02-14 02:04:55 +00:00
Seungjae Yoo
01c4f57431 Allow appdomain to read dir and files under vendor_microdroid_file
For testing purpose, now we need to use microdroid vendor image for the
production due to vendor hashtree digest value comes from the
bootloader. In the past, we've used distinguished image file for testing
purpose, but we can't now.

Bug: 323768068
Test: atest MicrodroidTests#bootsWithVendorPartition
Test: atest MicrodroidBenchmarks#testMicrodroidDebugBootTime_withVendorPartition
Change-Id: Ic58e51466da0273cf27219d9228f33000e0ecb88
2024-02-13 05:44:15 +00:00
Changyeon Jo
d16bdc461f [RESTRICT AUTOMERGE] Allow dumpstate to make binder IPC to automotive display service
Bug: 280837170
Bug: 313360015
Test: atest android.security.cts.SELinuxHostTest#testNoBugreportDenials
Change-Id: I8239ba23bb60b95e7dd07a4c8a99167f1e08192b
(cherry picked from commit 152a2f1755)
2024-02-13 05:16:32 +00:00
Inseob Kim
d88d8959a8 Merge changes from topic "revert-2954994-revert-2952245-vfrc_as_tot_sepolicy-AMFGMLDWQF-IIRWTIICIK" into main
* changes:
  Revert^2 "Add 1000000.0 mapping file temporarily"
  Revert^2 "Fix freeze test condition to board api"
2024-02-13 04:02:36 +00:00
Inseob Kim
e41e95e0ea Revert^2 "Add 1000000.0 mapping file temporarily"
82126e9d77

Change-Id: Ia2ef237d9918532f24cd00688ae2bc15196123e9
2024-02-13 02:19:24 +00:00
Inseob Kim
e28eb52f4e Revert^2 "Fix freeze test condition to board api"
f3fad1a66b

Change-Id: I19b36342de003a32a2c76fb513382f1b34cf5a7e
2024-02-13 02:19:48 +00:00
Treehugger Robot
f80a830b32 Merge "Add rules for Perfetto to be used from system_server" into main 2024-02-12 20:51:16 +00:00
Nate Myren
a8f2bbf7c2 Merge "Remove mounton from app and web zygote" into main 2024-02-12 20:13:33 +00:00
Carmen Jackson
28b811df1c Add rules for Perfetto to be used from system_server
This includes rules for starting Perfetto as well as rules for
communicating over stdio between Perfetto and system_server.

Bug: 293957254
Test: Presubmit & tested in conjunction with internal change
Change-Id: I7e4c044a6a2afb48c33d65cc421e797d77aacc12
2024-02-12 18:33:32 +00:00
Yisroel Forta
e510cb8696 Merge "SELinux permissions for ProfilingService" into main 2024-02-12 14:22:31 +00:00
Yisroel Forta
aa9d0bf24c SELinux permissions for ProfilingService
Test: Presubmit, manually confirm service accessible
Bug: 293957254
Change-Id: I7103be95ff49eb87b4c7164a38a481034d72a9aa
2024-02-09 19:25:32 +00:00
Håkan Kvist
e38af22c5e remount: allow bootanimation to run animation from oem
Grant bootanimation all read permissions on oem using
r_dir_file macro instead of specifying individual permissions.

This prevents failure to read the bootanimation on oem if
partition has been remounted.

After remount, bootanimation will log violation for the
/oem/media directory when reading an existing file (boot animation can
is still played).
avc:  denied  { read } for  pid=2820 comm="bootanimation" name="media"
   dev="sda75" ino=152 scontext=u:r:bootanim:s0
   tcontext=u:object_r:oemfs:s0 tclass=dir permissive=0

After remount, if modifying/adding file in /oem/media directory,
bootanimation will fail to read the bootanimation zip, now with
violation:
avc:  denied  { read } for  pid=2838 comm="bootanimation" name="media"
   dev="dm-8" ino=70 scontext=u:r:bootanim:s0 tcontext=u:object_r:oemfs:s0
   tclass=dir permissive=0

Bug: 324437684
Test: adb remount
      replace /oem/media/bootanimation.zip with custom animation
      adb reboot
      confirm that expected bootanimation is played
      confirm no selinux violations are seen in logcat
Change-Id: Iaafdeeacaf88d8f5c1214700edc8eec2824b0159
2024-02-09 16:09:05 +01:00
Jiakai Zhang
95d371bcfd Merge "Update sepolicy for service dexopt_chroot_setup and artd_pre_reboot." into main 2024-02-09 02:52:58 +00:00
mrulhania
9a7700cd46 Add SELinux policy for ContentProtectionManagerService
Bug: 324348549
Test: build
Change-Id: Ieb319ed033d2fdb18cf76107c44cd6357221ecc4
2024-02-08 19:56:49 +00:00
Ikjoon Jang
1c9aa0cb18 Merge changes from topic "revert-2952245-vfrc_as_tot_sepolicy-AMFGMLDWQF" into main
* changes:
  Revert "Fix freeze test condition to board api"
  Revert "Add 1000000.0 mapping file temporarily"
2024-02-08 04:47:21 +00:00
Ikjoon Jang
f3fad1a66b Revert "Fix freeze test condition to board api"
Revert submission 2952245-vfrc_as_tot_sepolicy

Reason for revert: DroidMonitor-triggered revert due to breakage https://android-build.corp.google.com/builds/quarterdeck?branch=git_main&target=mainline_modules_arm64-mainline-userdebug&lkgb=11421838&lkbb=11421957&fkbb=11421841, b/324335916

Reverted changes: /q/submissionid:2952245-vfrc_as_tot_sepolicy

Bug: 324335916
Change-Id: Iada55b1298872ae2f2ff4112726dcbcd089597f1
2024-02-08 04:45:26 +00:00
Ikjoon Jang
82126e9d77 Revert "Add 1000000.0 mapping file temporarily"
Revert submission 2952245-vfrc_as_tot_sepolicy

Reason for revert: DroidMonitor-triggered revert due to breakage https://android-build.corp.google.com/builds/quarterdeck?branch=git_main&target=mainline_modules_arm64-mainline-userdebug&lkgb=11421838&lkbb=11421957&fkbb=11421841, b/324335916

Reverted changes: /q/submissionid:2952245-vfrc_as_tot_sepolicy

Bug: 324335916
Change-Id: I9375f4d467596bc961527216b3f68c0f21016ca3
2024-02-08 02:54:29 +00:00
Jiakai Zhang
817c49f74c Update sepolicy for service dexopt_chroot_setup and artd_pre_reboot.
Bug: 311377497
Test: manual - Call
  getDexoptChrootSetupServiceRegisterer().waitForService()
Test: manual - Set up a chroot environment and call
  getArtdPreRebootServiceRegisterer().waitForService()
Change-Id: I50b5f7f858dab37f05174cb9787f64303d50d083
2024-02-08 10:13:27 +08:00
Jooyung Han
41e786ae48 Merge "Check if ./bin entries are not vendor_file" into main 2024-02-08 01:33:07 +00:00
Inseob Kim
569241f82f Merge changes from topic "vfrc_as_tot_sepolicy" into main
* changes:
  Add 1000000.0 mapping file temporarily
  Fix freeze test condition to board api
2024-02-08 01:12:47 +00:00
Nikhil Bhanu
67c12aa98d Merge "Add property for enabling stereo spatialization" into main 2024-02-07 16:41:01 +00:00
Jooyung Han
c945a104c0 Check if ./bin entries are not vendor_file
This can detect a common mistake of not labeling binaries in APEX.

Note - we can't simply check if the lable has exec_type attribute
because there're many exceptions.

Bug: 324005965
Test: atest apex_sepolicy_tests_test
Change-Id: Ib643e8b73fac1a3b8851804e58e69b19d32b997d
2024-02-07 16:26:25 +09:00
Treehugger Robot
49a519234b Merge "Changes in SELinux Policy for CSS API" into main 2024-02-06 20:28:45 +00:00
Nikhil Bhanu
977260767a Add property for enabling stereo spatialization
Bug: 323223919
Test: manual
Change-Id: I49d12bfc878ec63d8fe036880033e1c309961430
2024-02-06 08:52:42 -08:00
Justin Yun
385d5099cf Set ro.llndk.api_level as a system prop
ro.llndk.api_level is included in system/build.prop.
It must have the system build_prop context instead of the vendor prop.

Bug: 312098788
Test: TH
Change-Id: I223ae2cd56490a2cfd6f6454ad685d23d90d9329
2024-02-06 13:55:52 +09:00
David Dai
8a216be443 Merge "Allow CAP_SYS_NICE for crosvm" into main 2024-02-05 22:20:13 +00:00
Jooyung Han
d4ae4c1165 Merge "Add hal_graphics_mapper_service type" into main 2024-02-05 21:02:15 +00:00
David Dai
7066a961bd Allow CAP_SYS_NICE for crosvm
Open up CAP_SYS_NICE policies so that crosvm can adjust uclamp on its
vCPU threads to provide a boost in performance.

Bug: 322197421
Test: Booted device and processes that checked that the correct
capabilites are given with no sepolicy denials.

Change-Id: I089bf26caf862c32e85440575800bb095bb9087b
Signed-off-by: David Dai <davidai@google.com>
2024-02-05 11:14:53 -08:00
Alan Stokes
e01e8d5595 Merge "Suppress spurious ipc_lock denials" into main 2024-02-05 09:37:52 +00:00