tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
17869 commits 1 branch 0 tags 50 MiB
Commit graph

17869 commits

This branch
This branch
All branches
Author SHA1 Message Date
Tri Vo
a532088e7f Decouple system_suspend from hal attributes. 
System suspend service is not a HAL, so avoid using HAL-specific macros
and attributes.

Use system_suspend_server attribute for ISystemSuspend.hal permissions.
Use system_suspend type directly for internal .aidl interface
permissions.

Bug: 126259100
Test: m selinux_policy
Test: blueline boots; wakelocks can still be acquired; device suspends
if left alone.
Change-Id: Ie811e7da46023705c93ff4d76d15709a56706714
 2019-02-26 18:10:28 -08:00
Treehugger Robot
3e7ad0b081 Merge "Add ro.surface_flinger.display_primary*" 2019-02-25 01:02:34 +00:00
Andreas Gampe
2a9eaecf9a Sepolicy: Clean up moved files 
Coalesce statements to clean up policies.

Test: m
Change-Id: I3794d6bf1bce04e700d2d8e3365249cf75bd527d
 2019-02-22 08:36:41 -08:00
Andreas Gampe
4abfe60215 Sepolicy: Move some parts from public to private 
Those should not have been public before, but were forced to by
old neverallow rules.

Test: m
Change-Id: If8430b9c8d42b7cbcd28bbfbc79d579c69067edd
 2019-02-22 05:11:08 -08:00
Andreas Gampe
63c7b0fa18 Sepolicy: Move dalvik cache neverallow to private 
In preparation for additions that should be private-only, move
the neverallows to domain's private part.

Bug: 125474642
Test: m
Change-Id: I7def500221701500956fc0b6948afc58aba5234e
 2019-02-22 05:11:08 -08:00
Treehugger Robot
cac127c8fd Merge "Add sysfs_extcon for /sys/class/extcon" 2019-02-22 07:42:33 +00:00
Tri Vo
877fe9dea6 audit apps opening /dev/ashmem 
Bug: 113362644
Test: boot device
Test: use Chrome app, no audit logs
Change-Id: I6c78c7ac258a4ea90d501a152b5c9e7851afcf08
 2019-02-21 11:43:20 -08:00
Nick Chalko
4ccc8568ec Add sysfs_extcon for /sys/class/extcon 
Bug: 124364409
Change-Id: Idc33732454674bbdc7f4ff6eda173acc24e318b3
Test: cherry picked to pi-tv-dr-dev and tested on JBL Link bar
 2019-02-21 17:16:34 +00:00
Treehugger Robot
ba1be2c4bb Merge "Allow shell /proc/loadavg access" 2019-02-21 01:32:22 +00:00
Sundong Ahn
88bb57ec88 Add ro.surface_flinger.display_primary* 
The ro.surface_flinger.display_primary* properties are added to
property_contexts. Because these properties are located in vendor
partition, but surfaceflinger service which use these properties
is in the system partition.

Bug: 124531214
Test: m -j && boot test
Change-Id: If90c4bc75796d8966bbf3ee2e3bab39145395800
 2019-02-21 09:54:13 +09:00
Daniel Rosenberg
f63fe72142 Allow postinstall scripts to trigger F2FS GC 
Test: Add checkpoint_gc to postinstall scripts
Bug: 123367711
Change-Id: I24a0bd1c2c2086545f1587765bb9814da24ec7f2
 2019-02-20 22:40:53 +00:00
Daniel Rosenberg
46c50683d6 Add Label to f2fs sysfs files 
Test: ls -lZ /sys/fs/f2fs
Bug: 123367711
Change-Id: I0035feb8409b7ec8e11510795fb7d8845992694e
 2019-02-20 22:40:40 +00:00
Nick Kralevich
28e4b83ec7 Allow shell /proc/loadavg access 
Needed for the bionic stdlib.getloadavg test.

Access to /proc/loadavg was inadvertantly removed when a new label was
assigned to that file in system/sepolicy commit
8c2323d3f9.

Addresses the following denial:

  CtsBionicTestCa: type=1400 audit(0.0:188192): avc: denied { read } for name="loadavg" dev="proc" ino=4026531959 scontext=u:r:shell:s0 tcontext=u:object_r:proc_loadavg:s0 tclass=file permissive=0

Bug: 124024827
Test: compiles
Change-Id: Iadb5c98cb96f69ddc9418a64720370adae1bb51f
 2019-02-20 13:56:52 -08:00
David Anderson
8bcd43a33e Merge "Add sepolicy for gsid properties, and allow system_server to read them." 2019-02-20 19:49:01 +00:00
Xin Li
0e8a36f38f Merge "DO NOT MERGE - Merge PPRL.190205.001 into master" 2019-02-20 16:25:58 +00:00
Treehugger Robot
21eac99526 Merge "Add permissions required for flashing" 2019-02-20 09:43:23 +00:00
David Anderson
8fe3c74654 Add sepolicy for gsid properties, and allow system_server to read them. 
Bug: 123777418
Test: manual test
Change-Id: I9f8c721dfd074e638573d85cf1d8045a69c3854e
 2019-02-19 21:08:09 +00:00
Gavin Corkery
52c1d81aa4 Merge "Rename data/staging to data/pkg_staging." 2019-02-19 19:44:13 +00:00
Gavin Corkery
2db5015b4c Rename data/staging to data/pkg_staging. 
Test: Build and flash, atest apex_e2e_tests
Fixes: 122999313
Change-Id: I2cfa49d8467d67edc470b1cade3746426fa86e37
Merged-In: I2cfa49d8467d67edc470b1cade3746426fa86e37
 2019-02-19 15:51:14 +00:00
Xin Li
7636cff2b7 DO NOT MERGE - Merge PPRL.190205.001 into master 
Bug: 124234733
Change-Id: I78dac98a0d72fc8b8fe868c964458a98f5727786
 2019-02-18 15:58:55 -08:00
Jeff Vander Stoep
b3b7543de6 Whitelist flaky presubmit failures 
These denials already have tracking bugs.

Addresses
avc: denied { write } for comm=".gms.persistent" name="0" dev="tmpfs"
scontext=u:r:priv_app:s0:c512,c768 tcontext=u:object_r:mnt_user_file:s0
tclass=dir permissive=0 app=com.google.android.gms
avc: denied { getattr } for path="/data/system_ce/0/accounts_ce.db"
scontext=u:r:vold:s0 tcontext=u:object_r:system_data_file:s0
tclass=file permissive=0

Bug: 124108085
Bug: 118185801
Test: build tests
Change-Id: I97192e5c85d8d3a9efe950a0bbb33ea88aac76bd
 2019-02-18 21:24:46 +00:00
Jeff Vander Stoep
504a654983 crash_dump: dontaudit gpu_device access 
And add neverallow so that it's removed from partner policy if
it was added there due to denials.

Fixes: 124476401
Test: build
Change-Id: I16903ba43f34011a0753b5267c35425dc7145f05
 2019-02-18 21:06:42 +00:00
Remi NGUYEN VAN
286bce8bfb Merge "sepolicy change for NetworkStack signature" 
am: ec651944a0

Change-Id: I8588994f31e531ccc022b41d3a805b5da7aef24a
 2019-02-15 17:56:38 -08:00
Remi NGUYEN VAN
ec651944a0 Merge "sepolicy change for NetworkStack signature" 2019-02-16 01:48:49 +00:00
Hridya Valsaraju
e6c36ef12f Add permissions required for flashing 
These are required to handle the following denials:

audit: type=1400 audit(96805.060:7): avc:  denied  { sys_admin } for
pid=517 comm="fastbootd" capability=21  scontext=u:r:fastbootd:s0 tcontext=u:r:fastbootd:s0
tclass=capability permissive=0␍␊

[14:14:36:606] [   11.196190] audit: type=1400 audit(103042.976:10): avc:  denied  { read } for
pid=520 comm="fastbootd" name="by-name" dev="tmpfs" ino=18500 scontext=u:r:fastbootd:s0
tcontext=u:object_r:block_device:s0 tclass=dir permissive=1

Test: fastboot flashall
Bug: 124410201
Change-Id: I80041a78a5b6df09c6526be6a4066eb771887265
 2019-02-15 14:45:18 -08:00
Sudheer Shanka
b8df6eda98 Merge "Track untrusted_app_27 SELinux denial" 
am: 161601cbf6

Change-Id: Ic859ec704972e2f2195e72f053687bb3cf657f0e
 2019-02-15 14:37:23 -08:00
Sudheer Shanka
161601cbf6 Merge "Track untrusted_app_27 SELinux denial" 2019-02-15 22:26:09 +00:00
Mark Salyzyn
2340f1017a fs_mgr: overlayfs support legacy devices (marlin) Part Deux 
am: bd80e63e03

Change-Id: I62e00a260f7367222f9aed1cfd71777f0bdeef46
 2019-02-15 13:47:22 -08:00
Mark Salyzyn
bd80e63e03 fs_mgr: overlayfs support legacy devices (marlin) Part Deux 
On legacy devices system_<other> partition is blocked from
becoming the backing store under certain circumstances.

Test: system/core/fs_mgr/tests/adb-remount-test.sh
Bug: 120448575
Bug: 123079041
Change-Id: I1803f072ca21bc116554eee1d01a1dbd2c9ed0c9
 2019-02-15 15:56:16 +00:00
Sudheer Shanka
9c96649b27 Track untrusted_app_27 SELinux denial 
vrcore is trying to access external storage before
it is available.

Bug: 118185801
Test: n/a
Change-Id: Ieb38a1bfb977d9f6f642fecdd1000a195b2c8259
 2019-02-15 00:42:47 -08:00
Sudheer Shanka
a82094795e Merge "Update a comment to match the latest rules." 
am: 6c773be030

Change-Id: Ib720c5fc1a0a0287d6e29105b4a518272e2b6a3d
 2019-02-14 22:41:30 -08:00
Treehugger Robot
6c773be030 Merge "Update a comment to match the latest rules." 2019-02-15 06:38:25 +00:00
Alan Stokes
b7d23bc285 Merge "Fix typo in file name." 
am: 2379bb7603

Change-Id: I967eb883a468a6d3b9fb29c885254fc3f525b077
 2019-02-14 20:21:44 -08:00
Treehugger Robot
2379bb7603 Merge "Fix typo in file name." 2019-02-15 04:16:44 +00:00
Jeffrey Vander Stoep
0782f93463 Merge "Track SELinux denial." 
am: 567a8063a9

Change-Id: Ide783838773021f04e4a77c475bb3a9aa285347e
 2019-02-14 20:08:59 -08:00
Jeffrey Vander Stoep
567a8063a9 Merge "Track SELinux denial." 2019-02-15 03:59:41 +00:00
Jeff Vander Stoep
f05de2ee39 Track SELinux denial. 
This should help fix presubmit tests.

Bug: 124468495
Bug: 124476401
Test: Build.
Change-Id: I7d8befaef2a90d6dc824f99e3088a922c8d1fdc4
 2019-02-14 19:52:03 -08:00
Tianjie Xu
79d234f469 Merge "Allow update engine to write to statsd socket" 
am: 4dd5976170

Change-Id: I5a702f2c548678ad576c6ec63c7c88468a07dd09
 2019-02-14 14:13:40 -08:00
Xin Li
176f17cbff Merge "DO NOT MERGE - Merge pi-platform-release (PPRL.190205.001) into stage-aosp-master" into stage-aosp-master 2019-02-14 22:11:31 +00:00
Tianjie Xu
4dd5976170 Merge "Allow update engine to write to statsd socket" 2019-02-14 22:07:11 +00:00
Sudheer Shanka
a3423bb74b Update a comment to match the latest rules. 
Test: n/a
Change-Id: Ib45a25b3c9b987f56c350b91d72caca8a16fb52e
 2019-02-14 11:48:49 -08:00
Sudheer Shanka
4cb485a603 Merge "Allow zygote to create files under sdcardfs." 
am: be3748da12

Change-Id: I8e06267015a06b1b51a1940451950d63d2e11b6f
 2019-02-14 11:06:44 -08:00
Sudheer Shanka
be3748da12 Merge "Allow zygote to create files under sdcardfs." 2019-02-14 18:51:07 +00:00
Sudheer Shanka
868c075e0e Allow zygote to create files under sdcardfs. 
sdcardfs will automatically try to create .nomedia file
under Android/{data,obb} and this is being attributed
to whoever is trying to create Android/{data,obb} dirs.
Earlier this is used to done from app context but now
zygote handles the creation of these dirs.

Bug: 124345887
Test: manual
Change-Id: I96feada2f5edff2ece2586a532b069a58a36dd3b
 2019-02-14 18:49:57 +00:00
Alan Stokes
9b8b422938 Fix typo in file name. 
Test: Builds
Change-Id: I411f0c0f323565d951d4ba8031404171e3c9b364
 2019-02-14 16:09:44 +00:00
Pierre Lee
58d87035dc Merge "add hal_bootctl to white-list of sys_rawio" 
am: 8292117703

Change-Id: Iea654aedc4f858f025511fa4f6374e5726e6605d
 2019-02-13 23:30:47 -08:00
Treehugger Robot
8292117703 Merge "add hal_bootctl to white-list of sys_rawio" 2019-02-14 07:21:00 +00:00
Chenjie Yu
d098364298 Merge "train info persist to disk sepolicy" 
am: a0f56f1d63

Change-Id: I2aeef7e584bba6311e955ee63b952976adaa0456
 2019-02-13 15:56:50 -08:00
Remi NGUYEN VAN
3b006d9bd4 sepolicy change for NetworkStack signature 
Update the seinfo to the new network_stack seinfo, as the network stack
is now using its own certificate.
Remove the hard-coded package name, which may differ depending on
devices, and specify (uid, signature, priv-app) instead.

Bug: 124033493
Test: m
Change-Id: If3bbc21cf83f5d17406e9615833ee43011c9c9bc
 2019-02-14 07:58:13 +09:00
Treehugger Robot
a0f56f1d63 Merge "train info persist to disk sepolicy" 2019-02-13 22:45:18 +00:00