tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
29037 commits 1 branch 0 tags 50 MiB
Commit graph

29037 commits

This branch
This branch
All branches
Author SHA1 Message Date
Treehugger Robot
099e2f1a09 Merge "Allow dumpsys meminfo to print out DMA-BUF statistics" am: 83d6f96fdc 
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/1582856

MUST ONLY BE SUBMITTED BY AUTOMERGER

Change-Id: Id76c925e6f3a36fca52962d75c8a4f5b8907ac76
 2021-02-12 00:28:10 +00:00
Treehugger Robot
83d6f96fdc Merge "Allow dumpsys meminfo to print out DMA-BUF statistics" 2021-02-11 23:48:04 +00:00
Marco Ballesio
aa4ce95c6f sepolicy: rules for uid/pid cgroups v2 hierarchy 
Bug: 168907513
Test: verified the correct working of the v2 uid/pid hierarchy in normal
and recovery modes

This reverts commit aa8bb3a29b.

Change-Id: Ib344d500ea49b86e862e223ab58a16601eebef47
 2021-02-11 23:40:38 +00:00
shubang
2210767054 Add SE policy for media_metrics 
Test: CTS;
Change-Id: Ib9382f2513d8fd0e6812d0157c710d0ad5817231
 2021-02-11 18:38:07 +00:00
Hridya Valsaraju
0001dee765 Allow dumpsys meminfo to print out DMA-BUF statistics 
These permissions fix the following denials:

avc: denied { read } for name="buffers" dev="sysfs" ino=3267
scontext=u:r:system_server:s0 tcontext=u:object_r:sysfs_dmabuf_stats:s0
tclass=dir permissive=1
avc: denied { open } for path="/sys/kernel/dmabuf/buffers" dev="sysfs"
ino=3267 scontext=u:r:system_server:s0
tcontext=u:object_r:sysfs_dmabuf_stats:s0 tclass=dir permissive=1
avc: denied { read } for name="size" dev="sysfs"
ino=30556 scontext=u:r:system_server:s0
tcontext=u:object_r:sysfs_dmabuf_stats:s0 tclass=file permissive=1
avc: denied { open } for path="/sys/kernel/dmabuf/buffers/41673/size" dev="sysfs"
ino=30556 scontext=u:r:system_server:s0
tcontext=u:object_r:sysfs_dmabuf_stats:s0 tclass=file permissive=1
avc: denied { getattr } for path="/sys/kernel/dmabuf/buffers/41673/size" dev="sysfs"
ino=30556 scontext=u:r:system_server:s0 tcontext=u:object_r:sysfs_dmabuf_stats:s0
tclass=file permissive=1
avc: denied { read } for name="dma_heap" dev="tmpfs" ino=344
scontext=u:r:system_server:s0 tcontext=u:object_r:dmabuf_heap_device:s0
tclass=dir permissive=1
avc: denied { open } for path="/dev/dma_heap" dev="tmpfs" ino=344
scontext=u:r:system_server:s0 tcontext=u:object_r:dmabuf_heap_device:s0
tclass=dir permissive=1

Test: adb shell dumpsys meminfo
Bug: 167709539
Change-Id: Ifa43fd16369d5da1db16e45ff0e189da0c975b75
 2021-02-11 10:04:26 -08:00
Galia Peycheva
201414cff6 Add blur sysprop to sepolicy 
Bug: 170378891
Test: m
Change-Id: I6876e3bfe9dfdf066bfa54334555fdab5b3598d5
 2021-02-11 17:32:30 +00:00
Weilun Du
180a277d67 Add qemu.hw.mainkeys to system property_contexts 
Bug: 178143857

Signed-off-by: Weilun Du <wdu@google.com>
Change-Id: Idfc2bffa52016d1e880974bb193025400e90a538
 2021-02-11 04:18:54 +00:00
Vova Sharaienko
28497aaed1 Merge "Stats: new sepolicy for the AIDL service" am: e8d2732651 
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/1570880

MUST ONLY BE SUBMITTED BY AUTOMERGER

Change-Id: I46f47561663e9a3fb200cc061859c4e23ab8217c
 2021-02-11 03:48:46 +00:00
Vova Sharaienko
e8d2732651 Merge "Stats: new sepolicy for the AIDL service" 2021-02-11 03:07:56 +00:00
Vova Sharaienko
c64a5b42aa Stats: new sepolicy for the AIDL service 
Allows the AIDL IStats service to be exposed via ServiceManager
Defines IStats service client domain to be used by pixelstats_vendor

Bug: 178859845
Test: Build, flash, and aidl_stats_client
Change-Id: If41e50d0182993d0b7f8501e9147e0becf526689
 2021-02-10 23:48:35 +00:00
Treehugger Robot
f749766036 Merge "Fix ANR permission denial for AIDL HALs." am: 654f8b82a8 
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/1582316

MUST ONLY BE SUBMITTED BY AUTOMERGER

Change-Id: Ie1bd6c28ef20741f9d1f1d6a780af6728ef362b0
 2021-02-10 21:53:29 +00:00
Treehugger Robot
654f8b82a8 Merge "Fix ANR permission denial for AIDL HALs." 2021-02-10 21:16:35 +00:00
Elliott Hughes
d0f06f5489 Merge "Allow priv_app system_linker_exec:file execute_no_trans" am: e92be7b6a6 
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/1582850

MUST ONLY BE SUBMITTED BY AUTOMERGER

Change-Id: I20bc071b1d686e9174186ea25a47fdaca49bbe77
 2021-02-10 21:04:21 +00:00
Elliott Hughes
e92be7b6a6 Merge "Allow priv_app system_linker_exec:file execute_no_trans" 2021-02-10 20:45:23 +00:00
Chirag Pathak
814e89a1b2 The SE Policies to incorporate ISecureClock and ISharedSecret services along with IKeyMintDevice service into default keymint HAL Server. 
Test: Rebuild, execute and run atest VtsAidlSharedSecretTargetTest and atest VtsAidlSecureClockTargetTest.
Bug: b/171844725, b/168673523.

Change-Id: I8b81ec12c45566d31edcd117e41fd559df32c37d
 2021-02-10 18:45:07 +00:00
Elliott Hughes
25cb9046ef Allow priv_app system_linker_exec:file execute_no_trans 
Chrome Crashpad uses the the dynamic linker to load native executables
from an APK (b/112050209, crbug.com/928422)

We made the equivalent change to untrusted_app_all in
9ea8c0701d but webview also runs in
priv_app contexts.

Bug: http://b/112050209
Test: treehugger
Change-Id: I19bbadc7f9c9e668e2c6d932c7da24f18e7731bd
 2021-02-10 10:32:44 -08:00
Steven Moreland
afb345c94b Fix ANR permission denial for AIDL HALs. 
Recently, WatchDog gained the ability to query AIDL HAL PIDs in order to
amend ANR reports. However, since this was tested on cuttlefish (and
b/65201432 means that system_server is permissive), the denial was not
enforced, and broke ANRs in the dogfood population.

Fixes: 179753319
Test: simulate hanging w/ 'adb shell am hang', and the following denial
   no longer occurs:
02-10 00:50:05.719   200   200 E SELinux : avc:  denied  { list } for
pid=575 uid=1000 name=service_manager scontext=u:r:system_server:s0
tcontext=u:r:servicemanager:s0 tclass=service_manager permissive=1

Change-Id: I210527ad7492b155d7cf08c7d67894ef602d37a6
 2021-02-10 17:06:00 +00:00
Florian Mayer
076e0e56b1 Merge changes from topics "norootintegrationtest", "profileshelltestdatafile" am: 7b3ae03026 
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/1575363

MUST ONLY BE SUBMITTED BY AUTOMERGER

Change-Id: I526f7b7f9f0c8954d929184592b57928685f3b39
 2021-02-10 11:43:01 +00:00
Florian Mayer
7b3ae03026 Merge changes from topics "norootintegrationtest", "profileshelltestdatafile" 
* changes:
  Allow shell to create shell_[test_]_data_file sockets.
  Allow heapprofd to read shell_test_data_file.
 2021-02-10 11:16:10 +00:00
Treehugger Robot
1018f58e44 Merge "SEPolicy for RemoteProvisioning App" am: e6654e8bfd 
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/1536783

MUST ONLY BE SUBMITTED BY AUTOMERGER

Change-Id: I958e7dcfda6bde2b5e37d9f32df9f530590e097f
 2021-02-10 04:53:04 +00:00
Treehugger Robot
e6654e8bfd Merge "SEPolicy for RemoteProvisioning App" 2021-02-10 04:20:52 +00:00
Treehugger Robot
258ee7802e Merge "[selinux] allow priv_app to get incremental progress" am: f14e49be1c 
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/1581966

MUST ONLY BE SUBMITTED BY AUTOMERGER

Change-Id: If428dfe89afd31a5f491553c3dc6e7a99a3eb9e1
 2021-02-10 01:25:12 +00:00
Treehugger Robot
f14e49be1c Merge "[selinux] allow priv_app to get incremental progress" 2021-02-10 00:32:39 +00:00
Pavel Grafov
7ea497a17e Keystore 2.0: Allow system_server to manage wifi keys am: 20bc79bb3f 
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/1581903

MUST ONLY BE SUBMITTED BY AUTOMERGER

Change-Id: I74b8b25388c00eddafc238ae4ed1a52a53230f36
 2021-02-10 00:05:26 +00:00
Songchun Fan
b4c9491aed [selinux] allow priv_app to get incremental progress 
This allows phonesky to get incremental install progress.

Addresses denial message like below:

W/BlockingExecuto: type=1400 audit(0.0:5582): avc: denied { ioctl } for path="/data/incremental/MT_data_app_vmdl133/mount/.index/04abf89d12c3fe8f6fe9b381a670255c" dev="incremental-fs" ino=52957 ioctlcmd=0x6722 scontext=u:r:priv_app:s0:c512,c768 tcontext=u:object_r:apk_data_file:s0 tclass=file permissive=0 app=com.android.vending

Test: builds
BUG: 172965880
Change-Id: Ibecd4e07746e7bb3ca6bdf762382744b38f677cb
 2021-02-09 22:46:27 +00:00
Pavel Grafov
20bc79bb3f Keystore 2.0: Allow system_server to manage wifi keys 
This is needed because Wifi module needs to import and
generate keys and it runs in system_server.

Also, remove "grant" from system_app and system_server
since there is no need to grant any keys.

Test: Create an enterprise wifi config with EAP-TLS
Bug: 171305388
Change-Id: I50c25f2fe52e968c8cdf1ea20d110f9f052699db
 2021-02-09 20:36:51 +00:00
Janis Danisevskis
17c9463c6e Merge "Keystore 2.0: Add wifi namespace to sepolicy." am: 6691c9c411 
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/1570000

MUST ONLY BE SUBMITTED BY AUTOMERGER

Change-Id: Id996eb24c7e76234de89fd0461f801b85752be97
 2021-02-09 18:45:12 +00:00
Janis Danisevskis
6691c9c411 Merge "Keystore 2.0: Add wifi namespace to sepolicy." 2021-02-09 18:27:16 +00:00
Janis Danisevskis
df31f20dfe Keystore 2.0: Add wifi namespace to sepolicy. 
Add the wifi namespace to sepolicy and allow system_app (Settings) and
wifi_supplicant to manage/use the keys in that namespace

Test: N/A
Bug: 171305388
Change-Id: Ib6af8656b18288a1116c241c2e76d9aea421a889
 2021-02-09 08:28:45 -08:00
Treehugger Robot
672b014e90 Merge "Allow dumpsys to read total DMA-BUF heap pool size" am: efef83f745 
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/1566386

MUST ONLY BE SUBMITTED BY AUTOMERGER

Change-Id: Id42bddda4968b88f89c8538c5bdc85e156db892b
 2021-02-09 14:38:53 +00:00
Treehugger Robot
efef83f745 Merge "Allow dumpsys to read total DMA-BUF heap pool size" 2021-02-09 14:16:42 +00:00
Florian Mayer
ea00b68ee5 Allow shell to create shell_[test_]_data_file sockets. 
This makes it easier to write some tests without requiring root for
creating a temporary socket.

Test: m
Test: atest perfetto_integrationtests with https://r.android.com/1575345
      passed with this CL
      failed without with
        avc: denied { create } for name="traced_consumer"
        scontext=u:r:shell:s0 tcontext=u:object_r:shell_data_file:s0
        tclass=sock_file permissive=0

Change-Id: I281778259a55973cda9d6e7af6dea5637591502c
 2021-02-09 13:29:05 +00:00
Florian Mayer
5cefb23c4f Allow heapprofd to read shell_test_data_file. 
This is so we can run integrationtests on user.

Change-Id: Ie6afad9758968e6cdeb030fbf4d3b75a61813269
 2021-02-09 13:28:49 +00:00
Josh Gao
ce1c4a54ae Let apps read tombstones given to them. 
Bug: http://b/159164105
Test: atest CtsNativeTombstoneTestCases
Change-Id: I278c7ab815bb044b939afeb1f8a5ae37ec2f4c91
 2021-02-08 17:19:43 -08:00
Treehugger Robot
1a6bdc50bb Merge "Update OWNERS." am: c86c173de7 
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/1580968

MUST ONLY BE SUBMITTED BY AUTOMERGER

Change-Id: I1c6bcaccdff4f5cc9275708cc97e26c0a38db3a7
 2021-02-08 23:29:55 +00:00
Treehugger Robot
c86c173de7 Merge "Update OWNERS." 2021-02-08 22:35:12 +00:00
Treehugger Robot
3d390db9bb Merge "Allow snapuserd interaction in recovery and fastbootd." am: 585b826c7e 
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/1576378

MUST ONLY BE SUBMITTED BY AUTOMERGER

Change-Id: If6cd217c6b76abba13fd577944e76ade2f186429
 2021-02-08 22:13:54 +00:00
Treehugger Robot
585b826c7e Merge "Allow snapuserd interaction in recovery and fastbootd." 2021-02-08 21:30:11 +00:00
Treehugger Robot
3c57bd75aa Merge "Keystore 2.0: Rename Keystore 2.0 enable property." am: 0137685e55 
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/1577884

MUST ONLY BE SUBMITTED BY AUTOMERGER

Change-Id: I9dddd74c573ca99808f3fd3266b3f981a7326db3
 2021-02-08 20:52:01 +00:00
Elliott Hughes
616eaa9d08 Update OWNERS. 
nnk's gone :-(

Test: N/A
Change-Id: I24daddb775e4adea1516c063a0d43a89235c0749
 2021-02-08 12:24:25 -08:00
Treehugger Robot
0137685e55 Merge "Keystore 2.0: Rename Keystore 2.0 enable property." 2021-02-08 20:04:38 +00:00
Yifan Hong
2005aaa721 Merge "Allow CTS DeviceInfo to read VAB prop." am: ef663f6cf5 
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/1576751

MUST ONLY BE SUBMITTED BY AUTOMERGER

Change-Id: I68db59c9738b2f7b275391ef148e97aebc698773
 2021-02-08 18:35:12 +00:00
Yifan Hong
ef663f6cf5 Merge "Allow CTS DeviceInfo to read VAB prop." 2021-02-08 18:20:00 +00:00
Collin Fijalkovich
0ac7fa9374 Merge "Configure sepolicy for TracingServiceProxy" am: 1f318c8cab 
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/1528451

MUST ONLY BE SUBMITTED BY AUTOMERGER

Change-Id: Ibd10fe6793a1b851f8b29eabff421d3dfbb0f1e7
 2021-02-08 17:49:45 +00:00
Collin Fijalkovich
1f318c8cab Merge "Configure sepolicy for TracingServiceProxy" 2021-02-08 17:24:06 +00:00
Treehugger Robot
cdccadbb6c Merge "Fix service name for VPN_MANAGEMENT_SERVICE." am: 47d078e1d4 
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/1579864

MUST ONLY BE SUBMITTED BY AUTOMERGER

Change-Id: I5e540a4b6cca8d76ec25982bd40eb32661f6666f
 2021-02-08 10:05:11 +00:00
Treehugger Robot
47d078e1d4 Merge "Fix service name for VPN_MANAGEMENT_SERVICE." 2021-02-08 09:42:34 +00:00
Max Bires
23f0f3b28a SEPolicy for RemoteProvisioning App 
This change adds the SEPolicy changes required to support the remote
provisioning flow. The notable additions are specifically labeling the
remote provisioning app and giving it access to find the remote
provisioning service which is added in keystore. It also requires
network access in order to communicate to the provisioning servers.

This functionality is extremely narrow to the point that it seems worth
it to define a separate domain for this app, rather than add this in to
the priv_app or platform_app permission files. Since this app also
communicates with the network, it also seems advantageous to limit its
permissions only to what is absolutely necessary to perform its
function.

Test: No denials!
Change-Id: I602c12365a575d914afc91f55e6a9b6aa2e14189
 2021-02-08 01:33:12 -08:00
Martijn Coenen
39d56f944e Merge "Allow on-device signing daemon to talk to keystore." am: d8f68bf8d8 
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/1573147

MUST ONLY BE SUBMITTED BY AUTOMERGER

Change-Id: Ic44fc5f22715f955dccc76ab0b954b4f8ac76a45
 2021-02-08 09:19:33 +00:00
Martijn Coenen
d8f68bf8d8 Merge "Allow on-device signing daemon to talk to keystore." 2021-02-08 08:37:17 +00:00