Commit graph

196 commits

Author SHA1 Message Date
Victor Hsieh
48a7b5a580 sepolicy: new file_integrity_service
Test: didn't see denials in dmesg during boot or API calls.
Bug: 142573505
Change-Id: Ifa271956bc51bf47d781cd9c9f95afb99c5f940f
2019-12-19 09:25:35 -08:00
Treehugger Robot
f1f79242f3 Merge "Allow application to find tethering service" 2019-12-17 10:45:45 +00:00
markchien
9cc39d9acf Allow application to find tethering service
Mark tethering_service as app_api_service to allow applications to find
tethering service. Apps should able to use tethering service to
know tethering state if they have ACCESS_NETWORK_STATE permission, but
they may need privileged permission if they want to change tethering.

Bug: 144320246
Test: -build, flash, boot
      -ON/OFF hotspot

Change-Id: Ie414618766144c4a4ad89c5cf03398a472638e71
2019-12-16 21:32:04 +08:00
Treehugger Robot
a48a2f185e Merge "selinux config for Incremental service" 2019-12-13 19:41:39 +00:00
Songchun Fan
f3380b151d selinux config for Incremental service
BUG: 136132412
Test: boots
Change-Id: I0bff222af54d617b7c849bbed6fa52b96d945e32
2019-12-12 22:01:00 +00:00
Ytai Ben-tsvi
8f7a81ef5d Merge changes I7620902b,Ia7cb4f84,Iff95982d
* changes:
  Allow audio_server to access soundtrigger_middleware service
  Allow soundtrigger_middleware system service
  Allow system service to access audio HAL (for soundtrigger)
2019-12-12 21:42:23 +00:00
Songchun Fan
7a9f01d159 Merge "selinux config for data loader manager service" 2019-12-12 19:50:40 +00:00
Ytai Ben-Tsvi
29c819c015 Allow soundtrigger_middleware system service
New system service, intended to replace all of the soundtrigger
middleware.

Change-Id: Ia7cb4f8436719ca3bf71ea4c2bc32995568ff01d
Bug: 142070343
2019-12-12 10:56:35 -08:00
Songchun Fan
c111e5a9b3 selinux config for data loader manager service
Test: boots
Change-Id: If489054a51838d4215202b5768d46c6278ed1aa2
2019-12-11 17:09:44 -08:00
Kenny Root
6a9f7b265a Merge "Support Resume on Reboot" 2019-12-10 12:59:35 +00:00
Kenny Root
76ea325a3d Support Resume on Reboot
When an OTA is downloaded, the RecoverySystem can be triggered to store
the user's lock screen knowledge factor in a secure way using the
IRebootEscrow HAL. This will allow the credential encrypted (CE)
storage, keymaster credentials, and possibly others to be unlocked when
the device reboots after an OTA.

Bug: 63928581
Test: make
Test: boot emulator with default implementation
Test: boot Pixel 4 with default implementation
Change-Id: I1f02e7a502478715fd642049da01eb0c01d112f6
2019-12-09 14:25:04 -08:00
Treehugger Robot
09ecf475e9 Merge "Add sepolicy for AppIntegrityService." 2019-12-06 18:37:02 +00:00
Treehugger Robot
b1e670c24c Merge "[Tether15] Allow system app to find TetheringManager" 2019-12-06 03:32:50 +00:00
Song Pan
8be46bf2e0 Add sepolicy for AppIntegrityService.
CL that adds the service: http://ag/9554748

BUG:145674997
Test: Manually flash the device. Without this change, the devices goes into a
bootloop (http://gpaste/5033431010377728) if I uncommit the guard in
http://ag/c/platform/frameworks/base/+/9652133/21/services/core/java/com/android/server/integrity/AppIntegrityManagerService.java

Change-Id: Ib2daf9191900d94abeae207e18a77a5914d14783
2019-12-05 12:22:51 +00:00
Hangyu Kuang
ee3a8ea798 MediaTranscodingService: Add sepolicy for MediaTranscodingService.
Bug:145233472
Test: Build and flash the phone.
"adb shell dumpsys -l | grep media" shows media.transcoding service.

Change-Id: I48a42e7b595754989c92a8469eb91360ab6db7c6
2019-12-02 13:57:28 -08:00
Mark Chien
9dfaa7dcc6 [Tether15] Allow system app to find TetheringManager
Bug: 144320246
Test: -build, flash, boot
      -OFF/ON hotspot

Change-Id: I8ce7ac5eb8198f0df4a2da426e3c56e8915e746a
2019-12-02 18:01:33 +08:00
Roshan Pius
d804a76d03 Revert "sepolicy: Permission changes for new wifi mainline module"
This reverts commit 3aa1c1725e.

Reason for revert: Wifi services no longer plan to be a separate
APK/process for mainline. Will instead become a jar loaded from Apex.

Bug: 144722612
Test: Device boots up & connects to wifi networks
Change-Id: Ifa33dae971dccfd5d14991727e2f27d2398fdc74
2019-11-22 09:49:32 -08:00
Terry Wang
9a2296252f Add a new system service for app search management.
This change app-search-service to sepolicy system service.

Bug: 142567528
Test: Manual
Change-Id: Ife7b09365d667da0ad370e586af828f8f4423660
2019-11-18 16:06:58 -08:00
Ilya Matyukhin
517fee8781 Merge "Add AuthService to sepolicy" 2019-11-18 20:45:38 +00:00
Ilya Matyukhin
d2309dafcb Add AuthService to sepolicy
AuthService is introduced in ag/9700446.

Bug: 141025588
Test: can successfully publish AuthService with publishBinderService(...)
Change-Id: I0f9fceac0c555d05a29467e4ab1380f389b60af4
2019-11-16 02:24:30 +00:00
Neil Fuller
dcda8d0bb7 Add new time zone detection service
Add entries necessary for the new time zone detection service.

Bug:140712361
Test: See related frameworks/base change
Change-Id: Ide4244104e2add843c1d699d528328dd71a6b525
2019-11-15 13:33:23 +00:00
Sudheer Shanka
426f2e77c0 Merge "Add a new system service "blob_store"." 2019-11-07 18:04:24 +00:00
Steven Moreland
d87649c645 stable aidl vibrator policy
Bug: 141828236
Test: boot, dumpsys -l
Change-Id: Id3fc8724238883116e840794309efbf6c91226c9
2019-10-29 16:39:55 -07:00
Sudheer Shanka
c9d3f222e7 Add a new system service "blob_store".
Bug: 143559646
Test: manual
Change-Id: Id13566e9efc815f4a6ebb7228a1145aa91d6d526
2019-10-29 15:34:11 -07:00
Steven Moreland
48fbbbeae2 Service context for servicemanager.
Create a service context for manager itself and allow servicemanager to
register itself. This is so that tools like dumpsys can reference
servicemanager the same way they would reference other services.

That things can still get ahold of the servicemanager directly via
libbinder APIs since it is a context manager.

Bug: 136027762
Test: dumpsys -l
Change-Id: If3d7aa5d5284c82840ed1877b969572ce0561d2e
2019-10-16 16:31:42 -07:00
Steven Moreland
2092764024 Merge "Remove mediacodec_service." into stage-aosp-master 2019-08-23 17:33:44 +00:00
Tri Vo
d0cb128907 Merge "selinux: tag gpu_service as app_api_service"
am: 9203c0009d

Change-Id: If18eb15656c871446292f23ff2eb53e70bb66ba6
2019-08-22 13:31:42 -07:00
Tri Vo
5511676b31 selinux: tag gpu_service as app_api_service
gpu_service is already accessible to untrusted 3p apps aosp/898376.
Otherwise, vendor apps can't access gpu_service.

Bug: 139685237
Test: m selinux_policy
Change-Id: I30a951cd712b0ae4aacd2c4d6d42e74fac5c0707
Merged-In: I30a951cd712b0ae4aacd2c4d6d42e74fac5c0707
(cherry picked from commit 32f279c096)
2019-08-22 11:38:08 -07:00
Steven Moreland
d181bc2c16 Remove mediacodec_service.
Since this service no longer exists.

Fix: 80317992
Test: TH, codesearch.
Change-Id: I257c8cc3dba657d98f19eb61b36aae147afea393
2019-08-21 01:19:20 +00:00
Elliott Hughes
509135ac69 Merge "Remove perfprofd references."
am: c807b3fd8a

Change-Id: I90501f397c29847e2e497f10515571fa10f9d992
2019-07-23 17:10:33 -07:00
Elliott Hughes
c807b3fd8a Merge "Remove perfprofd references." 2019-07-23 23:23:15 +00:00
Andrei-Valentin Onea
6863758a7b Merge "Add rule for platform_compat service"
am: 72211e36ad

Change-Id: I6eca69732654e27a9192b4bdca27908539ff0b1e
2019-07-23 08:01:19 -07:00
Elliott Hughes
132b081ee3 Remove perfprofd references.
perfprofd was never finished, and has been removed.

Test: treehugger
Change-Id: I4fc8aa9b737360a66d89c5be39651284ee2d6ffd
2019-07-19 11:15:12 -07:00
Andrei Onea
2bbcc9db89 Add rule for platform_compat service
Bug: 137769727
Test: m
Change-Id: Ib6160a82597198f4a120592293f90ffe1ffb123b
2019-07-19 18:57:11 +01:00
Roshan Pius
3754b4b007 sepolicy: Permission changes for new wifi mainline module
am: 3aa1c1725e

Change-Id: Ia9e876cdd12f1305dacb2961f398c492cc03dadb
2019-07-16 17:20:00 -07:00
Roshan Pius
3aa1c1725e sepolicy: Permission changes for new wifi mainline module
Move wifi services out of system_server into a separate APK/process.

Changes:
a) Created sepolicy for the new wifi apk.
b) The new APK will run with network_stack uid (eventually will be moved
to the same process).

Used 'audit2allow' tool to gather list of permissions required.

Note: The existing wifi related permissions in system_server is left
behind to allow the module to be loaded into system_server or
network_stack process depending on device configuration.

Bug: 113174748
Test: Device boots up and able to make wifi connection.
Test: Tested hotspot functionality.
Test: Ran WifiManagerTest & WifiSoftApTest ACTS tests locally.
Test: Will send for wifi regression tests.
Change-Id: Id19643a235bf0c28238f2729926b893ac2025b97
(cherry-picked from c7aa90091e6bec70a31a643cc4519a9a86fb0b38)
2019-07-16 13:30:15 -07:00
Marco Nelissen
ba258f0ec0 Remove unneeded permissions
Media component update service is removed, so selinux
permissions for it are no longer needed.

Bug: 123250010
Test: boot, play video
Change-Id: I0fec6839f5caf53d16399cb72dcdd6df327efc95
2019-05-09 22:19:33 +00:00
Xiao Ma
7703c2726c Merge "revert ipmemorystore selinux policy." am: f99aa3cb66 am: a2d7ab7f4b
am: ddabaebdec

Change-Id: Iaad8edaaa6a31a3fb23e57555fc4c5e1a4eaa332
2019-04-01 21:19:40 -07:00
Xiao Ma
e2876a3d11 revert ipmemorystore selinux policy.
Since ipmemorystore service has been moved to network stack from
system service, also should revert the relevant sepolicy which is
corresponding to the previous configuration.

Bug: 128392280
Test: atest FrameworksNetTests NetworkStackTests
Change-Id: I1ae09696e620b246f817db71e7b71c32aae9be05
2019-04-01 16:37:25 +09:00
Yifan Hong
b9182b37a5 Merge changes from topic "lpdumpd" am: 40f1682ba6 am: 7f891f414f
am: 75117c19c9

Change-Id: I43b884e08059e242830b56e7ddee62c17e6af422
2019-03-26 16:36:36 -07:00
Yifan Hong
18ade868ff Add rules for lpdump and lpdumpd
- lpdump is a binary on the device that talks to lpdumpd
  via binder.

- lpdumpd is a daemon on the device that actually reads
  dynamic partition metadata. Only lpdump can talk to it.

Bug: 126233777
Test: boots (sanity)
Test: lpdump

Change-Id: I0e21f35ac136bcbb0603940364e8117f2d6ac438
2019-03-25 10:14:20 -07:00
Przemyslaw Szczepaniak
98dc828ffb Merge "Make package_native_serice an (ephemeral_)?app_api_service." am: 37f5cb2db0 am: bfd36c6b47
am: e014071309

Change-Id: I0ae52af5881525c5242fe4ee0fcd9f19ac7bb1a2
2019-03-25 09:11:09 -07:00
Przemyslaw Szczepaniak
8b2ad2c978 Make package_native_serice an (ephemeral_)?app_api_service.
This is required for accessing package_native_service
in libneuralnetworks.so for NNAPI Vendor Extension checks.

package_service is (ephemeral_)?app_api_service, native
one is a subset of it.

Bug: 120483623
Test: NeuralNetworksTest_FibonacciExtension
Change-Id: I9fa2c9aa263724d2256bbf26de19d6b357c82f9b
2019-03-19 16:37:45 +00:00
Luke Huang
325c9263ab Merge "Add sepolicy for resolver service" am: a116e1afe5 am: 551bfafd34
am: 5332340b5e

Change-Id: Iac635eaaae96a1d75fc398bf9a21bf8e40f94a73
2019-03-06 21:52:50 -08:00
Luke Huang
524f25ebb0 Add sepolicy for resolver service
Bug: 126141549
Test: built, flashed, booted
Change-Id: I34260e1e5cc238fbe92574f928252680c1e6b417
2019-03-05 15:49:33 +00:00
Neil Fuller
61873b800c Merge "Revert "sepolicy entries for time zone detector service"" am: 5f145acff0 am: 970f28223c
am: 8b9aa2fa4a

Change-Id: Iebec80db0ce332aa57f73accc2809a6a0d347572
2019-02-06 10:53:53 -08:00
Neil Fuller
970f28223c Merge "Revert "sepolicy entries for time zone detector service""
am: 5f145acff0

Change-Id: Ied46d69d3fbb215712cc807e7b812843d0db6ec0
2019-02-06 10:15:23 -08:00
Neil Fuller
62386fb9ab Revert "sepolicy entries for time zone detector service"
This reverts commit 1662495aec.

Bug: 78217059
Bug: 112827764
Test: make / booted device
2019-02-06 08:39:12 +00:00
Santos Cordon
bff499ee82 Merge "SEPolicy for Suspend Control interface."
am: 87988fa6a6

Change-Id: I6aa4102dd43daf2bd82eeb09b53e890e3c3dbe7a
2019-02-05 10:43:11 -08:00
Santos Cordon
b78a1f5e13 SEPolicy for Suspend Control interface.
Bug: 121210355
Test: manual
Change-Id: I9c46c72f0219309140ed2fb008ef57b4bca6ff2b
Merged-In: I9c46c72f0219309140ed2fb008ef57b4bca6ff2b
2019-02-05 18:03:32 +00:00