tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
40407 commits 1 branch 0 tags 50 MiB
Commit graph

40407 commits

This branch
This branch
All branches
Author SHA1 Message Date
Treehugger Robot
b348fcfef3 Merge "Allow apkdmverity/zipfuse to write to kmsg_debug" am: 5a28628dbe 
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/2308282

Change-Id: I2343534cf971b99d113ef03894a675f4698379df
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
 2022-11-22 03:18:27 +00:00
Thiébaud Weksteen
a6e583ee5a [conflict] Add SEPolicy for PRNG seeder daemon. am: 7836cbb295 am: 5db530c021 
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/2311226

Change-Id: Id7760f3cd61ec3b0b21c8a581d78b63420d67e8d
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
 2022-11-22 03:18:08 +00:00
Treehugger Robot
5a28628dbe Merge "Allow apkdmverity/zipfuse to write to kmsg_debug" 2022-11-22 03:00:37 +00:00
Inseob Kim
e987dcff74 Allow apkdmverity/zipfuse to write to kmsg_debug 
..which is inherited from microdroid_manager.

Bug: 258760809
Test: atest MicrodroidHostTestCases MicrodroidTestApp
Change-Id: I839a0e6b4702e811db58b0cc44dd3b599c10a0b8
 2022-11-22 10:13:48 +09:00
Thiébaud Weksteen
5db530c021 [conflict] Add SEPolicy for PRNG seeder daemon. am: 7836cbb295 
Original change:
https://android-review.googlesource.com/c/platform/system/sepolicy/+/2308419

Bug: 259998530
Change-Id: Iee13bcb5e37aab23e7663986c95992db669fe922
 2022-11-22 10:36:13 +11:00
Alessandra Loro
37db54ead6 Merge "Hide ro.debuggable and ro.secure from ephemeral and isolated applications" am: 790d6b99ee 
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/2308440

Change-Id: Ia086989ae274c95cdb63d76bf3a452d059842970
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
 2022-11-21 15:12:42 +00:00
Alessandra Loro
790d6b99ee Merge "Hide ro.debuggable and ro.secure from ephemeral and isolated applications" 2022-11-21 14:34:40 +00:00
Alice Wang
d3aaa4f9b5 Merge "Cleanup authfs_service / servicemanager communication permissions" am: 3a7809a818 
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/2310528

Change-Id: Ib1bc496d763622e376c35368f2d7c2893cea529c
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
 2022-11-21 12:26:56 +00:00
Alice Wang
ee8682a018 Merge "[rpc_binder] Remove permissions about virual_machine_payload_service" am: 9e7c7655e3 
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/2310527

Change-Id: I97423b5e2c32628712ecb1101b8331824fc02b83
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
 2022-11-21 12:26:45 +00:00
Alice Wang
3a7809a818 Merge "Cleanup authfs_service / servicemanager communication permissions" 2022-11-21 12:13:27 +00:00
Alice Wang
9e7c7655e3 Merge "[rpc_binder] Remove permissions about virual_machine_payload_service" 2022-11-21 12:11:30 +00:00
Alice Wang
33fba3f1eb [rpc_binder] Remove permissions about virual_machine_payload_service 
This cl removes the SELinux permissions about
virual_machine_payload_service / servicemanager communication.

Bug: 257260848
Test: atest MicrodroidTests
Change-Id: I2aeac92bdba7db1256ca48cdfca2265441882abf
 2022-11-21 09:42:06 +00:00
Alice Wang
1a0c3f88e0 Cleanup authfs_service / servicemanager communication permissions 
This cl removes SELinux policies related to
authfs_service / servicemanager communication as authfs_service
now uses rpc binder instead of servicemanager.

Bug: 257260848
Test: atest ComposHostTestCases
Change-Id: I3e3de94a837c95e8f486438cc6a76fea39ffc6f3
 2022-11-21 09:29:41 +00:00
Treehugger Robot
cd2ca82f6d Merge "allow com.android.vending to access vendor_apex_file" am: 25ccbc7d90 
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/2237570

Change-Id: I491c3ff924f141e14177540512837e068554cc00
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
 2022-11-21 07:55:05 +00:00
Treehugger Robot
25ccbc7d90 Merge "allow com.android.vending to access vendor_apex_file" 2022-11-21 07:18:37 +00:00
Ray Essick
006e02629c mediaserver needs package_native access am: 1ff668ae62 
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/2308752

Change-Id: Ic5d23e79ea5adecc576b00d66193119192098c90
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
 2022-11-21 03:52:07 +00:00
Pete Bentley
7836cbb295 Add SEPolicy for PRNG seeder daemon. 
Manual testing protocol:
* Verify prng_seeder daemon is running and has the
  correct label (via ps -Z)
* Verify prng_seeder socket present and has correct
  label (via ls -Z)
* Verify no SELinux denials
* strace a libcrypto process and verify it reads seeding
  data from prng_seeder (e.g. strace bssl rand -hex 1024)
* strace seeder daemon to observe incoming connections
  (e.g. strace -f -p `pgrep prng_seeder`)
* Kill daemon, observe that init restarts it
* strace again and observe clients now seed from new instance

Bug: 243933553
Test: Manual - see above
Change-Id: I0a7e339115a2cf6b819730dcf5f8b189a339c57d
(cherry picked from commit e6da3b80d1)
 2022-11-21 09:32:48 +11:00
Ray Essick
1ff668ae62 mediaserver needs package_native access 
when recording, the encoders need access to determine if on
a handheld and enable some quality standards.

Bug: 251205971
Test: atest android.media.recorder.cts.MediaRecorderTest
Change-Id: I534a6aa24c188002ab0baab9d891e07db0af81f2
 2022-11-19 09:59:57 -06:00
Etienne Ruffieux
65c71b2657 Merge "Add bluetooth_prop to system_server sepolicy." am: fb4ca780fe 
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/2299497

Change-Id: I77e2083ee6232281226931509d2ea1576cc7b290
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
 2022-11-18 22:49:09 +00:00
Etienne Ruffieux
fb4ca780fe Merge "Add bluetooth_prop to system_server sepolicy." 2022-11-18 22:08:11 +00:00
Devin Moore
dce4fb0d63 Merge "Add sepolicy for new AIDL sensorservice" am: 45d8baf70d 
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/2292579

Change-Id: I4aea1885153ae6bb28d0abff31266c53558e99d1
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
 2022-11-18 19:41:23 +00:00
Devin Moore
371f7a448e Add AIDL sensorservice's new fuzzer to the mapping 
Test: atest libsensorserviceaidl_fuzzer
Bug: 205764765
Change-Id: I6b81f110df4573e135746c9d2031d2469bcc43fc
 2022-11-18 19:32:50 +00:00
Devin Moore
45d8baf70d Merge "Add sepolicy for new AIDL sensorservice" 2022-11-18 19:21:47 +00:00
Alessandra Loro
24d90e792e Hide ro.debuggable and ro.secure from ephemeral and isolated applications 
Bug: 193912100
Test: N/A

Change-Id: I916c9795d96e4a4a453f9aed5e380f11981804e9
 2022-11-18 14:13:36 +00:00
Inseob Kim
de4f1750e0 Merge changes from topic "microdroid_selinux_denial_fix" am: 29fb4ae40b 
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/2299690

Change-Id: I95f1b2a3d6eb09f9f2ae7141f955a84dbb0f01e8
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
 2022-11-18 12:07:24 +00:00
Inseob Kim
c5ba5a208e Grant kmsg_debug permission to kexec am: cb2c533d83 
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/2299689

Change-Id: I1ff6e6ad969c3eff14b5e80853442023cc39fffc
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
 2022-11-18 12:07:20 +00:00
Alice Wang
c7e13ae286 [rpc_binder] Enable connection for authfs_service socket am: b1c2e19a71 
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/2305572

Change-Id: I96b21eb9b60613ac516bcfa0ba594c589e84e7fb
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
 2022-11-18 12:06:24 +00:00
Inseob Kim
29fb4ae40b Merge changes from topic "microdroid_selinux_denial_fix" 
* changes:
  Add listen/accept permission to MM's vsock
  Grant kmsg_debug permission to kexec
 2022-11-18 12:04:34 +00:00
Alice Wang
b1c2e19a71 [rpc_binder] Enable connection for authfs_service socket 
Bug: 222479468
Test: atest ComposHostTestCases
Change-Id: I2e60010beebf05391c7df6d38ef7be976ad8d06f
 2022-11-18 09:22:20 +00:00
Seth Moore
121ad0534e Merge "Add new appdomain for RKPD mainline app" am: dcef71f890 
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/2276971

Change-Id: Ic7fffb658079edd092cd0949aa204573f1ec1782
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
 2022-11-17 15:58:37 +00:00
Seth Moore
dcef71f890 Merge "Add new appdomain for RKPD mainline app" 2022-11-17 15:45:18 +00:00
Inseob Kim
5df428bea8 Add listen/accept permission to MM's vsock 
Bug: 259241719
Test: atest MicrodroidHostTestCases MicrodroidTestApp
Change-Id: I7403b2ae777fd72bb056b5cb260e693ef0793cff
 2022-11-17 14:57:41 +00:00
Inseob Kim
cb2c533d83 Grant kmsg_debug permission to kexec 
microdroid_manager has stdio_to_kmsg, so it's good to have the same
permission to microdroid_manager's children for better debuggability.

Bug: 259241719
Test: atest MicrodroidHostTestCases MicrodroidTestApp
Change-Id: Ibaaed365e970e6b9f2d458ccae4d128fd3b84f38
 2022-11-17 14:57:17 +00:00
Pete Bentley
b1c5a3215d [automerger skipped] Update sepolicy prebuilts for PRNG seeder changes. am: e635929f6f -s ours am: d24a493f07 -s ours 
am skip reason: Merged-In Idc011c66dfe71aa6c8dfdbc0b0377d2957571b83 with SHA-1 96268c6622 is already in history

Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/2300079

Change-Id: I0c86fbf3f6ec4f715e041c2d43c400696701af5e
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
 2022-11-17 05:52:35 +00:00
Pete Bentley
d24a493f07 [automerger skipped] Update sepolicy prebuilts for PRNG seeder changes. am: e635929f6f -s ours 
am skip reason: Merged-In Idc011c66dfe71aa6c8dfdbc0b0377d2957571b83 with SHA-1 96268c6622 is already in history

Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/2300079

Change-Id: If35e0a373418e1205aba8d87c1b6e6f8169592e5
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
 2022-11-17 05:23:05 +00:00
Seth Moore
71fa94edae Add new appdomain for RKPD mainline app 
This app talks to the remote provisioning HALs, and therefore requires
access to the tee_device domain.

Bug: 254112668
Test: Manually verify rkpd can run and find remote provisioning hals
Change-Id: I876b0890f3d4e8956406d73e956084b99488ce56
 2022-11-16 12:55:31 -08:00
Shikha Panwar
81bf90de4d encryptedstore - Create Selinux context & grant permissions 
encryptedstore is Microdroid's dm-crypt based encryption solution. It
requires access to block device, mapper devices etc.

Test: Run a VM & look for sepolicy denials.
Bug: 241541860
Change-Id: I556f56a184fc7a1ea71d67c3e591cc567dab2431
 2022-11-16 18:18:34 +00:00
Sandro Montanari
94f7b16893 Merge "Move get_prop rules from public/domain.te to private/domain.te" am: de243c1585 
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/2284275

Change-Id: If637e8ae2123df474c66ae765ef8841e07b8bc15
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
 2022-11-16 10:54:35 +00:00
Sandro Montanari
de243c1585 Merge "Move get_prop rules from public/domain.te to private/domain.te" 2022-11-16 10:33:10 +00:00
Treehugger Robot
4b6d1f5ea4 Merge "Add IAllocator-V2" am: 299ee9fb24 
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/2263543

Change-Id: I7093809290ebe11d245f0429293fa697ddffea56
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
 2022-11-15 23:36:39 +00:00
Treehugger Robot
299ee9fb24 Merge "Add IAllocator-V2" 2022-11-15 23:13:42 +00:00
Steven Moreland
4c6586817a sepolicy for SE HAL 
Bug: 205762050
Test: N/A
Change-Id: I76cd5ebc4d0e456a3e4f1aa22f5a932fb21f6a23
 2022-11-15 22:41:09 +00:00
Sandro
bcc04e69fc Move get_prop rules from public/domain.te to private/domain.te 
This way we can prevent private types (e.g., sdk_sandbox) from accessing
those properties.

Bug: 210811873
Test: m -j, boot device
Change-Id: Idbcc4928c8d0d433f819d8b114e84a5f09466ad0
 2022-11-15 17:05:11 +00:00
Deyao Ren
dfb3182725 allow com.android.vending to access vendor_apex_file 
Widevine is now in an APEX. com.android.vending tries to access widevine
apex, which results in a sepolicy error. Modifying sepolicy to allow
com.android.vending to access apex directory.

Bug: 247100406
Test: https://android-build.googleplex.com/builds/abtd/run/L54600000956675013
Change-Id: Ie73411dbe1c35027cb498c2cfa6847515a41d08a
 2022-11-15 13:28:49 +09:00
Seungjae Yoo
3d9b334391 Merge "Allow reading proc file in crosvm process for reading cpu/mem stat in VM" am: b43e1b1c19 
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/2300539

Change-Id: I0981485fb364b89e3a697d263d8323126ac7837c
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
 2022-11-15 02:36:10 +00:00
Seungjae Yoo
b43e1b1c19 Merge "Allow reading proc file in crosvm process for reading cpu/mem stat in VM" 2022-11-15 01:47:50 +00:00
Devin Moore
e714ba95ed Add sepolicy for new AIDL sensorservice 
Test: boot cuttlefish and check for avc denials
Bug: 205764765
Change-Id: Ie9d02b43250ca3c5f642b2d87d2a5b532a9b5195
 2022-11-14 17:26:24 +00:00
Treehugger Robot
80e6a481d8 Merge "Allow microdroid_manager to do stdio_to_kmsg" am: 069b9502b1 
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/2300540

Change-Id: I9d366d7e6b9ca87d817819394fd48225416bd650
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
 2022-11-14 14:20:46 +00:00
Treehugger Robot
069b9502b1 Merge "Allow microdroid_manager to do stdio_to_kmsg" 2022-11-14 13:48:17 +00:00
Treehugger Robot
5bdeb76422 Merge "Add adaptive haptics restricted system property" am: bc37c334e5 
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/2300027

Change-Id: I5dd21700c9f64d08785855436c4c5eeb2e88a616
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
 2022-11-14 11:21:07 +00:00