Commit graph

542 commits

Author SHA1 Message Date
Yixiao Luo
e83ae791aa TV Input HAL 2.0 sepolicy
Bug: 227673740
Test: atest VtsHalTvInputTargetTest
Change-Id: I53f6537a8f911661e368824a5a5dc5db57413980
2022-08-25 14:31:49 -07:00
Hongguang
9515559657 Add properties to configure whether the lazy tuner is enabled.
ro.tuner.lazyhal: system_vendor_config_prop to decide whether the lazy
tuner HAL is enabled.
tuner.server.enable: system_internal_prop to decide whether tuner server
should be enabled.

Bug: 236002754
Test: Check tuner HAL and framework behavior
Change-Id: I6a2ebced0e0261f669e7bda466f46556dedca016
2022-08-23 07:01:05 +00:00
Shunkai Yao
3a6c68f2ba AIDL effect: Add default Effect factory implementation to platform sepolicy
Add example implementation services: IFactory under android.hardware.audio.effect.
An audio HAL AIDL example service will register with the default implementations.

Bug: 238913361
Test: m, and flash with Pixel 6a.

Change-Id: Ib331899fd47b6b334b120e20617174d01e71ddb8
2022-08-22 19:27:26 +00:00
Kelvin Zhang
f70d708544 Merge "Add proper permission for AIDL bootcontrol server" 2022-06-23 23:44:39 +00:00
Kelvin Zhang
65d6bf5391 Add proper permission for AIDL bootcontrol server
Bug: 227536004
Test: th
Change-Id: I6aff2742fb23bf7e7ce8d09493f02c4be9262fd3
2022-06-22 13:38:01 -07:00
Avichal Rakesh
3baabb9157 Allow camera provider services following AIDL naming conventions
Android 13 moved to using AIDL for HALs, which have different version
and naming conventions as compared to the new deprecated HIDL. This CL
updates the regex to include camera provider implementations that follow
AIDL naming conventions in the allowlist.

Bug: 219974678
Test: Manually tested that AIDL implementation is allowed to run
Change-Id: Ic005703bdaaa6376ca4714f22f89271b2a8878f2
2022-06-14 22:39:54 +00:00
Vova Sharaienko
7816224ea2 Merge "hal_vehicle_default: enabled communication with statsd" 2022-06-09 22:51:21 +00:00
Kelvin Zhang
187cb2c64c Add sepolicy for IBootControl AIDL
Test: th
Bug: 227536004
Change-Id: I1206b4aae1aab904a76836c893ee583b5ce54624
2022-06-07 16:26:19 -07:00
Vova Sharaienko
5aa340abc2 hal_vehicle_default: enabled communication with statsd
Bug: 233754988
Test: build & boot, logcat | grep SELinux
Change-Id: I92ca95e0088550677baab64fcc36afdc8845e2fc
2022-06-06 19:00:01 +00:00
Joshua McCloskey
f42a5c953b Add sysprops for virtual Fingerprint/Face HAL
Test: Manually verified virtual Fingerprint/Face HAL could set/get props
Bug: 230514750
Change-Id: I7ab5ff81d128b486ef181824c67cfa0ded230e08
2022-05-13 22:52:50 +00:00
Rick Chen
8cb9f4385d Add sensor multi-HAL AIDL sepolicy
Bug: 228525902
Test: Device can boot to home.
Change-Id: I9d27967213df83b20cb49014317dcfb7afac1880
2022-04-22 01:49:26 +00:00
Jason Macnak
a93398051c Adds GPU sepolicy to support devices with DRM gralloc/rendering
... such as Cuttlefish (Cloud Android virtual device) which has a
DRM virtio-gpu based gralloc and (sometimes) DRM virtio-gpu based
rendering (when forwarding rendering commands to the host machine
with Mesa3D in the guest and virglrenderer on the host).

After this change is submitted, changes such as aosp/1997572 can
be submitted to removed sepolicy that is currently duplicated
across device/google/cuttlefish and device/linaro/dragonboard as
well.

Adds a sysfs_gpu type (existing replicated sysfs_gpu definitions
across several devices are removed in the attached topic). The
uses of `sysfs_gpu:file` comes from Mesa using libdrm's
`drmGetDevices2()` which calls into `drmParsePciDeviceInfo()` to
get vendor id, device id, version etc.

Bug: b/161819018
Test: launch_cvd
Test: launch_cvd --gpu_mode=gfxstream
Change-Id: I4f7d4b0fb90bfeef72f94396ff0c5fe44d53510c
Merged-In: I4f7d4b0fb90bfeef72f94396ff0c5fe44d53510c
2022-04-18 17:30:56 -07:00
Ilya Matyukhin
93b6949083 Fix fingerprint failing to start on GSI images
This fixes the following denial:

W/storageproxyd: type=1400 audit(0.0:4): avc: denied { create } for \
name="alternate" scontext=u:r:tee:s0 \
tcontext=u:object_r:tee_data_file:s0 tclass=dir permissive=0

Bug: 221173716
Test: flash vendor image + dsu gsi -> observe fingerprint HAL works
Change-Id: I8aff86dda159c3f023cd98d1e0ad38ba21e5e8c9
2022-04-11 22:44:54 -07:00
Treehugger Robot
288fee1744 Merge "Allow EVS HAL to use cardisplayproxyd" 2022-03-28 22:04:20 +00:00
Chris Weir
9e4f9120ee Merge "Allow wpa_supplicant to access Netlink Interceptor" 2022-03-28 21:47:48 +00:00
Chris Weir
6e92194802 Allow wpa_supplicant to access Netlink Interceptor
wpa_supplicant needs permission to access the Netlink Interceptor HAL.

Bug: 224844967
Test: Modified version of wpa_supplicant can access Netlink Interceptor
Change-Id: I80c6c980b6655beadfaf14535702ad8e96c2befe
2022-03-24 16:49:30 -07:00
Mikhail Naganov
676da7273f Add AIDL audio HAL service to SEPolicy
This adds the two top interfaces: IConfig and IModule
to service context, allows the HAL service to call
Binder, and registers the example implementation
service executable.

Bug: 205884982
Test: m
Change-Id: I322e813c96123167ea29b6c25a08ec9677c9b4d1
2022-03-24 01:39:29 +00:00
Changyeon Jo
3518c9e7f8 Allow EVS HAL to use cardisplayproxyd
This change adds selinux policies to allow EVS HAL implementations to
use cardisplayproxyd, which implements a stable AIDL version of the
automotive display proxy service interface.

Bug: 170401743
Bug: 217271351
Test: Manually confirm that evs_app renders the camera preview through
      cardisplayproxyd
Change-Id: Ia301b782c6c031fe8351bdcda5ce264da6b8aa4d
2022-03-23 12:35:28 +00:00
Stephane Lee
52862a32c1 Add sepolicies to allow hal_health_default to load BPFs.
Bug: 203462310
Test: Ensure that the BPF filter can be loaded
Change-Id: Ib507d4c1718dd56fb336501ed7598de7b44a687b
2022-03-21 12:54:49 -07:00
Robert Shih
ec7f4244e8 clearkey aidl file_contexts: update path regex
Bug: 221078453
Change-Id: Ic7c0e5a68554f254afb7fbe886fce106c34056ff
2022-03-09 22:57:12 +00:00
Changyeon Jo
8c4ebe21f5 Allow EVS HAL to access data from surfaceflinger
Bug: 216727303
Test: m -j selinux_policy
Change-Id: Id89a99372e334c87cd1c80c06b5b695e5c8d69e6
2022-03-07 15:42:17 +00:00
Ankit Goyal
2736da21a4 Add sepolicy for graphics IAllocator AIDL based HAL
Bug: 217776226
Bug: 218383959
Test: Boots to home with the new HAL
Change-Id: I8d0d2182d389c39b54f492d4d6df64ca14737997
2022-02-24 17:14:29 -08:00
Changyeon Jo
eacb1095a8 Revert^2 "Updates sepolicy for EVS HAL"
418f41ad13

Bug: 216727303
Test: m -j selinux_policy on failed targets reported
      in b/218802298
Change-Id: Iec8fd2a1e9073bf3dc679e308407572a8fcf44d9
2022-02-10 17:21:54 +00:00
Mohammed Rashidy
418f41ad13 Revert "Updates sepolicy for EVS HAL"
Revert submission 1967140-EVS_sepolicy_updates_T

Reason for revert: triggered revert due to breakage https://android-build.googleplex.com/builds/quarterdeck?branch=git_master&target=cf_x86_64_auto-userdebug&lkgb=8168894&lkbb=8168958&fkbb=8168947, bug b/218802298
Reverted Changes:
I730d56ab1:Allows hal_evs_default to read directories
I2df8e10f5:Updates sepolicy for EVS HAL
Ie6cb3e269:Adds a sepolicy for EVS manager service

Change-Id: I1cc37b0e56646db61bdb34cb209aefe7376c5a50
2022-02-10 10:07:44 +00:00
Changyeon Jo
a083d7a8d8 Updates sepolicy for EVS HAL
This CL updates hal_evs_default to be sufficient for the defautl EVS HAL
implementation and modifies other services' policies to be able to
communicate with EVS HAL implementations

Bug: 217271351
Test: m -j selinux_policy and Treehugger
Change-Id: I2df8e10f574d62f8b84e0ff0381656ab1b18b52f
2022-02-10 01:42:59 +00:00
Robert Shih
d70f0af2bf Merge "Add sepolicy for DRM AIDL HAL" 2022-01-28 18:40:53 +00:00
Seth Moore
9e2ff8d975 Merge "Revert^2 "Allow default identity service to call keymint"" 2022-01-27 18:18:12 +00:00
Robert Shih
4968374205 Add sepolicy for DRM AIDL HAL
Bug: 208486736
Test: atest VtsAidlHalDrmTargetTest
Change-Id: Ia2b1488a564d94384d183d30291fbf5a6d2df4ab
2022-01-27 01:51:05 -08:00
Seth Moore
ea3b7e8938 Revert^2 "Allow default identity service to call keymint"
5a1e60c090

Change-Id: Ia04a96e6b5ce89b8ef5f34c33279e58c4de6430c
2022-01-25 23:04:37 +00:00
Seth Moore
c725aaf974 Merge "Revert "Allow default identity service to call keymint"" 2022-01-25 23:03:24 +00:00
Seth Moore
5a1e60c090 Revert "Allow default identity service to call keymint"
Revert submission 1956689-add rkp to identity-default

Reason for revert: Broke git-master. Will resubmit later.
Reverted Changes:
I96dcf3027:Add remote key provisioning to the IC HAL
Id686ac33a:Add dependency on keymint cpp lib
Ib368a2a00:Log to logd in the default identity service
I7d2906de0:Refactor IC support for RKP
Iae0f14f1c:Fix formatting of identity credential aidl
I01d086a4b:Allow default identity service to call keymint

Change-Id: I22a9e9bf8b7edc3d6b635b3e4a07a2efc4ff087a
2022-01-25 22:44:24 +00:00
Seth Moore
63fa21b46a Merge "Allow default identity service to call keymint" 2022-01-25 20:33:01 +00:00
Treehugger Robot
c23930818d Merge "Add sepolicy for IInputProcessor HAL" 2022-01-21 22:45:52 +00:00
Yu Shan
dd50991924 Merge "Allow AIDL VHAL service." 2022-01-21 20:12:58 +00:00
Siarhei Vishniakou
c655bece6a Add sepolicy for IInputProcessor HAL
This sepolicy is needed so that the vendor can launch a new HAL process,
and then this HAL process could join the servicemanager as an impl for
IInputProcessor. This HAL will be used to contain the previous impl of
InputClassifier and also new features that we are going to add.

Bug: 210158587
Test: use together with a HAL implementation, make sure HAL runs
Change-Id: I476c215ad622ea18b4ce5cba9c07ae3257a65817
2022-01-20 23:40:05 +00:00
Badhri Jagan Sridharan
c887ea3965 Add selinux rules for android.hardware.usb.IUsb AIDL migration
Covers the rules needed for the default AIDL implementation.

Bug: 200993386
Signed-off-by: Badhri Jagan Sridharan <badhri@google.com>
Change-Id: Ib152d12686e225e3c1074295a70c624a5115e9bd
2022-01-20 23:03:26 +00:00
Yu Shan
8ea307d300 Allow AIDL VHAL service.
Test: None
Bug: 215419573
Change-Id: Iaeb91e06a1a8e2218ab5cb98f05c024546c0c2e7
2022-01-19 19:01:44 -08:00
Seth Moore
157a94d40d Allow default identity service to call keymint
The identity service must be able to return a binder handle to an
IRemotelyProvisionableComponent for remote key provisioning support.
Since the default identity service works with the default keymint
service, allow calling into service manager to get an
IRemotelyProvisionableComponent binder handle.

Bug: 194696876
Test: VtsHalIdentityTargetTest
Change-Id: I01d086a4b38c23a6567fd36bcbb9421ea072caab
2022-01-18 16:17:45 -08:00
Valentin Iftime
e1a4b8c705 Add sepolicy for external lazy camera HALs
Test: atest CtsCameraTestCases

Bug: 191248460

Testt: m
Test: presubmit

Change-Id: Ia3b07247f9929c1898efa86d892ea8ad3c2041dc
2022-01-17 18:48:00 +01:00
Devin Moore
978b9e5d1c Add policy for new AIDL IR hal
IR interface is converted to AIDL and this contains the necessary
permissions for the default service to serve the interface.

Test: atest VtsHalIrTargetTest hal_implementation_test
Test: check for permission issues after tests
Bug: 205000342
Change-Id: I8d9d81d957bf6ef3c6d815ce089549f8f5337555
2021-12-16 20:24:27 +00:00
Treehugger Robot
885bc3ca66 Merge "Add hal_vehicle_service for AIDL VHAL service." 2021-12-11 00:49:12 +00:00
Yu Shan
78be3081e7 Add hal_vehicle_service for AIDL VHAL service.
Add selinux policy for AIDL Vehicel HAL service.
This CL mostly follows https://android-review.googlesource.com/c/platform/system/sepolicy/+/1541205/.

Test: Manually test on emulator, verify AIDL VHAL service is up and
accessible by client.
Bug: 209718034

Change-Id: Icad92e357dacea681b8539f6ebe6110a8ca8b357
2021-12-07 22:23:50 -08:00
Yifan Hong
035ce4b7f4 Add charger_vendor type
This is the context when health HAL runs in offline
charging mode.

This has the same permissions as the health HAL, but
is also able to do charger specific things.

Also restrict neverallow rules in charger_type.

Test: manual in offline charging mode
Bug: 203246116
Change-Id: I6034853c113dff95b26461153501ad0528d10279
2021-12-07 16:24:23 -08:00
Kedar Chitnis
a465cbc194 Update sepolicy to add dumpstate device service for AIDL HAL
- Add hal_dumpstate_service AIDL service to hal_dumpstate.te,
  service.te
- Add default example hal_dumpstate service to file_contexts,
  service_contexts
- Adde hal_dumpstate_service to API level 31 compatibility
  ignore list (31.0.ignore.cil)

Bug: 205760700
Test: VtsHalDumpstateTargetTest, dumpstate, dumpstate_test, dumpsys
Change-Id: If49fa16ac5ab1d3a1930bb800d530cbd32c5dec1
2021-11-25 07:52:32 +00:00
Janis Danisevskis
bc7a33ece9 Dice HAL: Add policy for dice HAL.
And allow diced to talk to the dice HAL.

Bug: 198197213
Test: N/A
Change-Id: I74797b13656b38b50d7cd28a4c4c6ec4c8d1d1aa
2021-11-17 13:36:18 -08:00
Treehugger Robot
28fc30ebc1 Merge "Enable Telephony AIDL-HIDL shim HAL" 2021-11-05 20:51:51 +00:00
Yifan Hong
388bbbccb3 Add health AIDL HAL.
Test: pass
Bug: 177269435
Change-Id: I755d5158715b38a89a28af753ad4c27cdfa93546
2021-10-26 19:34:34 -07:00
Tomasz Wasilczyk
9d56107b3d Enable Telephony AIDL-HIDL shim HAL
Bug: 203699028
Test: Boot with ag/16078505 applied
Change-Id: Ib9afbe2217670ccfc163812c6b73d9d11d748d2d
2021-10-25 12:59:46 -07:00
Ady Abraham
7ed18e6d66 Composer stable AIDL HAL sepolicy
Test: build + presubmit
Bug: 198690444
Change-Id: I6a26823c4ad363d137526c96580b05363d0ac894
2021-10-20 02:58:20 +00:00
Arthur Ishiguro
29dc02c044 Sensors stable AIDL HAL sepolicy
Bug: 195593357
Test: TreeHugger
Change-Id: I02b88a93d829654a1ce946681b59e648b2cd7550
2021-10-15 17:39:56 +00:00