Commit graph

62 commits

Author SHA1 Message Date
Roshan Pius
cd8333b53a sepolicy: Change UWB HAL from HIDL to versioned AIDL
No new HIDL HAL's are allowed in Android T. UWB HAL converted to
versioned AIDL interface to be compliant.

Bug: 195308730
Test: Compiles
Change-Id: I35cf8edd244baa02778ee8eff46840ae26424869
2021-08-27 00:28:56 +00:00
Roshan Pius
8a5370c5e4 sepolicy: Add UWB HAL interface in AOSP
Adding sepolicy rules for the AOSP HAL interface.

Ignore-AOSP-First: Dependent changes in internal-only projects.

Bug: 195308730
Test: Compiles
Change-Id: I56302b570a749f7d72b6fe8f4f4a8767ea4785c1
Merged-In: I56302b570a749f7d72b6fe8f4f4a8767ea4785c1
2021-08-24 20:10:21 -07:00
Amos Bianchi
f778a0bd89 SELinux policy for lazy AIDL/HIDL testing services.
These services are used for running tests on Cuttlefish.

Bug: 191781736
Test: atest aidl_lazy_test
Test: atest hidl_lazy_test
Change-Id: Iec43c3d19ba5072dbfa6573a6d74106672f94972
2021-07-21 12:24:43 -07:00
Steven Moreland
19deb1f856 Remove thermalcallback_hwservice.
There is no need for this type to be declared because it is never
registered with hwservicemanager.

This has been removed in the past but it seems it didn't automerge.

Bug: 109802374
Test: N/A
Change-Id: Id9bbc5762b6dcc8066c8543cb93db937cc4fc858
2020-09-16 21:57:05 +00:00
Roshan Pius
d42c7571aa sepolicy: Remove offload HAL sepolicy rules
This is unused currently & there are no concrete plans to use it
in the future.

Bug: 130080335
Test: Device boots up & connects to networks.
Test: Will send for regression tests
Change-Id: I785389bc2c934c8792c8f631362d6aa0298007af
Merged-In: I785389bc2c934c8792c8f631362d6aa0298007af
(cherry picked from commit 56dfc06397)
2020-05-08 11:17:12 +09:00
Steven Moreland
e4f0ccf29c Add rules for hidl_lazy_test*
eng/userdebug rules added for integration testing of hidl_lazy_test,
similar to aidl_lazy_test.

This is required in sepolicy since the test requires defining a service
in an init.rc file, and so there needs to be sepolicy for init to start
this service.

Bug: 148114689
Test: hidl_lazy_test
Change-Id: Id6549cbb89b62d3f6de1ae2690ce95c3e8656f66
2020-03-24 18:34:58 -07:00
Changyeon Jo
17b38d526d Update automotive display service rules
This change updates sepolicies for automotive display service to make it
available to the vendor processes.

Bug: 149017572
Test: m -j selinux_policy
Change-Id: I48708fe25e260f9302e02749c3777c0ca0d84e4b
Signed-off-by: Changyeon Jo <changyeon@google.com>
2020-02-25 02:02:54 +00:00
David Zeuthen
02bf814aa2 Add SELinux policy for credstore and update for IC HAL port from HIDL to AIDL.
The credstore service is a system service which backs the
android.security.identity.* Framework APIs. It essentially calls into
the Identity Credential HAL while providing persistent storage for
credentials.

Bug: 111446262
Test: atest android.security.identity.cts
Test: VtsHalIdentityTargetTest
Test: android.hardware.identity-support-lib-test
Change-Id: I5cd9a6ae810e764326355c0842e88c490f214c60
2020-02-19 13:46:45 -05:00
Haoxiang Li
741b9cd5ac Sepolicy update for Automotive Display Service
Bug: 140395359
Test: make sepolicy -j
Change-Id: Ib6ddf55210d8a8ee4868359c88e3d177edce9610
Signed-off-by: Changyeon Jo <changyeon@google.com>
2020-01-21 18:43:27 +00:00
David Zeuthen
b8b5da4305 Add SELinux policy for Identity Credential HAL
Bug: 111446262
Test: VtsHalIdentityCredentialTargetTest
Change-Id: Icb5a0d8b24d463a2f1533f8dd3bfa84bf90acc6f
2020-01-14 20:13:39 -05:00
Tri Vo
bfcddbe25e sepolicy: remove ashmemd
Bug: 139855428
Test: m selinux_policy
Change-Id: I8d7f66b16be025f7cb9c5269fae6fd7540c2fdc9
2019-09-27 17:43:53 +00:00
Amy
89b4bbd4d8 Tuner Hal 1.0 Enable ITuner service
Test: cuttlefish
Bug: 135708935
Change-Id: Ica063458860df45f0e2ab640a2ab35cd4da3da8e
2019-08-14 11:22:09 -07:00
Tomasz Wasilczyk
602b30302a SEPolicy rules for CAN bus HAL
Bug: 135918744
Test: VTS (separate new change)
Change-Id: Idd3ca882e3bd36b95a5412bdfbf6fe9d6e911ba9
2019-08-01 10:24:00 -07:00
Kalesh Singh
46303aa1f7 Sepolicy for IAshmem HIDL interface
Change-Id: Id78f995661120f136d671ea0084db358e7662122
Bug: 133443879
Test: Manually check logcat for sepolicy denials (logcat | grep IAshmem)
2019-05-29 14:44:47 -07:00
Jayant Chowdhary
ca41deb378 Add selinux rules for HIDL ICameraServer.
Bug: 110364143

Test: lshal->android.frameworks.cameraservice.service@2.0::ICameraService/default
      is registered.

Merged-In: I689ca5a570c169581b2bfb9d117fcdafced0a7e0
Change-Id: I689ca5a570c169581b2bfb9d117fcdafced0a7e0
Signed-off-by: Jayant Chowdhary <jchowdhary@google.com>
(cherry picked from commit 039d4151da)
2019-03-01 14:01:07 -08:00
Cheney Ni
a6946d7929 Add Bluetooth Audio HAL interface V2 as hal_audio_hwservice
Bluetooth Audio HAL interface is an unified HIDL interface for BT Stack
and Audio HAL. It works the same as IBluetoothAudioOffload and uses the
same rules.

Bug: 111519504
Test: manual

Change-Id: Ifdff0d2d9a111abc51ed74c223d2e430ad51b203
2019-01-14 22:26:22 +08:00
Siarhei Vishniakou
41a871ba84 Permissions for InputClassifier HAL
Add the required permissions for the InputClassifier HAL.

Bug: 62940136
Test: no selinux denials in logcat when HAL is used inside input flinger.
Change-Id: Ibc9b115a83719421d56ecb4bca2fd196ec71fd76
2019-01-11 02:08:19 +00:00
Zachary Iqbal
893272d883 Added placeholder SELinux policy for the biometric face HAL.
Notes:
- Added face hal domain, context and file types for the default
  SELinux policy.
- Please see aosp/q/topic:"Face+Authentication"

Bug: 80155388
Test: Built successfully.
Change-Id: I2e02cf6df009c5ca476dfd842b493c6b76b7712a
2018-12-28 12:23:56 -08:00
Benjamin Schwartz
e7040eada0 Add power.stats HAL 1.0 sepolicy
Also giving statsd permission to access it. This change copies the internal sepolicy to AOSP.

Bug: 111185513
Bug: 120551881
Test: make
Change-Id: I7e0386777e05580299caf9b97cb7804459f1a9d0
2018-12-11 00:11:08 +00:00
Pawin Vongmasa
7d9d64dcd9 Add public Codec2 HIDL interfaces
Test: make cts -j123 && cts-tradefed run cts-dev -m \
CtsMediaTestCases --compatibility:module-arg \
CtsMediaTestCases:include-annotation:\
android.platform.test.annotations.RequiresDevice

Bug: 112362730
Bug: 119853704

Change-Id: Ie84dab48c4f068eb1f6289b5c022525cd06ef7fc
2018-11-30 05:11:21 -08:00
Jiwen 'Steve' Cai
d5c5ef900c Sepolicy for bufferhub hwservice
Bug: 118124442
Test: device can boot with android.frameworks.bufferhub@1.0-service
      running
Change-Id: I1d186d5350671b0d2dd4e831429b8fba828316e0
2018-10-25 10:08:05 -07:00
Howard Ro
b41dd1b54f Merge "Update sepolicies for stats hal"
am: aabee5fe5f

Change-Id: Ib271b23881eeff75f62613054714a11e8d67dc44
2018-10-02 14:06:31 -07:00
Howard Ro
578a189178 Update sepolicies for stats hal
Bug: 116732452
Test: No sepolicy violations observed with this change
(cherry picked from commit I1958182dd8ecc496625da2a2a834f71f5d43e7bb)

Change-Id: Ib386767d8acfacf9fedafd9a79dd555ce233f41c
2018-09-28 13:34:37 -07:00
Wei Wang
a15a0804bc Add atrace HAL 1.0 sepolicy
am: bc71a6109e

Change-Id: Iad34b6a0a8e4a9b885244804e07c93bc79f8731b
2018-09-27 16:27:11 -07:00
Wei Wang
bc71a6109e Add atrace HAL 1.0 sepolicy
Bug: 111098596
Test: atrace/systrace

(cherry picked from commit 9ed5cf6e43)

Change-Id: I97772ff21754d03a0aea0d53b39e8da5312a17c0
2018-09-27 23:18:29 +00:00
Yifan Hong
fc433b5553 health.filesystem HAL renamed to health.storage
am: 1cef6a94eb

Change-Id: Ia7c2b0c347eb945777eac435c45df2683c556b80
2018-09-20 22:36:15 -07:00
Yifan Hong
1cef6a94eb health.filesystem HAL renamed to health.storage
...to reflect that the HAL operates on storage devices,
not filesystem.

Bug: 111655771
Test: compiles
Change-Id: Ibb0572cb1878359e5944aa6711331f0c7993ba6e
Merged-In: Ibb0572cb1878359e5944aa6711331f0c7993ba6e
2018-09-20 04:12:45 +00:00
Tri Vo
e5374e6784 Sepolicy for system suspend HAL.
am: dac2a4a3a4

Change-Id: Ia03441639efe7f2147db104c7b1533b941c60f9e
2018-08-13 18:52:30 -07:00
Tri Vo
dac2a4a3a4 Sepolicy for system suspend HAL.
Bug: 78888165
Test: device can boot with HAL running.
Change-Id: I3bf7c8203e038b892176c97ec006152a2904c7be
2018-08-13 17:26:34 -07:00
Yifan Hong
562a0d2f97 Merge "Add sepolicy for health filesystem HAL" am: 3dd465a097
am: 33eee9c584

Change-Id: I84d7cc56ec9280957218357ed97c1ca606b24795
2018-08-10 16:10:17 -07:00
Yifan Hong
0814795c79 Add sepolicy for health filesystem HAL
Test: builds
Test: vts
Bug: 111655771
Change-Id: Iabad3d124bf476cb624addf7d7898e0c2894d550
2018-08-10 11:02:21 -07:00
Todd Poynor
c6afcb7fc0 remove thermalcallback_hwservice
This hwservice isn't registered with hwservicemanager but rather passed
to the thermal hal, so it doesn't need sepolicy associated with it to
do so.

Test: manual: boot, inspect logs
Test: VtsHalThermalV1_1TargetTest
Bug: 109802374
Change-Id: Ifb727572bf8eebddc58deba6c0ce513008e01861
Merged-In: Ifb727572bf8eebddc58deba6c0ce513008e01861
2018-06-29 23:01:43 +00:00
Pavel Maltsev
43e172af66 Move automotive HALs sepolicy to system/
Bug: 70637118
Test: build, flash and boot automotive builds

Change-Id: I6db23258de30174d6db09d241e91b08aa5afedef
Merged-In: I6db23258de30174d6db09d241e91b08aa5afedef
(cherry picked from commit 394dbe34a0)
2018-05-04 21:36:48 +00:00
Roshan Pius
d7b34a48ff sepolicy(hostapd): Add a HIDL interface for hostapd
* Note on cherry-pick: Some of the dependent changes are not in AOSP.
In order to keep hostapd running correctly in AOSP, I've modified this
change to only include policy additions.

Change sepolicy permissions to now classify hostapd as a HAL exposing
HIDL interface.

Sepolicy denial for accessing /data/vendor/misc/wifi/hostapd:
12-27 23:40:55.913  4952  4952 W hostapd : type=1400 audit(0.0:19): avc:
denied { write } for name="hostapd" dev="sda13" ino=4587601
scontext=u:r:hal_wifi_hostapd_default:s0
tcontext=u:object_r:system_data_file:s0 tclass=dir permissive=0

01-02 19:07:16.938  5791  5791 W hostapd : type=1400 audit(0.0:31): avc:
denied { search } for name="net" dev="sysfs" ino=30521
scontext=u:r:hal_wifi_hostapd_default:s0
tcontext=u:object_r:sysfs_net:s0 tclass=dir permissive=0

Bug: 36646171
Test: Device boots up and able to turn on SoftAp.
Change-Id: Ibacfcc938deab40096b54b8d0e608d53ca91b947
Merged-In: Ibacfcc938deab40096b54b8d0e608d53ca91b947
(cherry picked from commit 5bca3e860d)
2018-05-04 21:36:24 +00:00
Pavel Maltsev
394dbe34a0 Move automotive HALs sepolicy to system/
Bug: 70637118
Test: build, flash and boot bat_land and owl automotive builds

Change-Id: I6db23258de30174d6db09d241e91b08aa5afedef
2018-04-23 15:46:41 -07:00
Jeff Vander Stoep
c41f5b8465 hal_tetheroffload: move hwservice mapping to core policy
Addresses:
avc: denied { find } for
interface=android.hardware.tetheroffload.config::IOffloadConfig
scontext=u:r:system_server:s0
tcontext=u:object_r:default_android_hwservice:s0
tclass=hwservice_manager

Bug: 77855688
Test: build/boot Sailfish, turn on tethering, no selinux denial
Change-Id: I97cae0928b5311a4da41d19cbd5c863c3137a49f
(cherry picked from commit 3a346ea732)
2018-04-11 15:03:13 -07:00
Jeff Vander Stoep
3a346ea732 hal_tetheroffload: move hwservice mapping to core policy
Addresses:
avc: denied { find } for
interface=android.hardware.tetheroffload.config::IOffloadConfig
scontext=u:r:system_server:s0
tcontext=u:object_r:default_android_hwservice:s0
tclass=hwservice_manager

Bug: 77855688
Test: build/boot Sailfish, turn on tethering, no selinux denial
Change-Id: I97cae0928b5311a4da41d19cbd5c863c3137a49f
2018-04-11 14:52:48 -07:00
Sunny Kapdi
bc0c88f37d Bluetooth A2DP offload: Binder call to audio HAL
Add rule to allow Binder call from Bluetooth process to Bluetooth
audio HIDL interface running in audio HAL service process.

Bug: 72242910
Test: Manual; TestTracker/148125
Change-Id: I1981a78bece10b8e516f218d3edde8b77943d130
(cherry picked from commit e8cfac90e8)
2018-03-12 13:28:43 -07:00
Sunny Kapdi
863a4efaf3 Bluetooth A2DP offload: Binder call to audio HAL
Add rule to allow Binder call from Bluetooth process to Bluetooth
audio HIDL interface running in audio HAL service process.

Bug: 63932139
Bug: 72242910
Test: Manual; TestTracker/148125
Change-Id: I1981a78bece10b8e516f218d3edde8b77943d130
(cherry picked from commit e8cfac90e8)
2018-03-12 19:21:08 +00:00
Andrew Scull
64f35fa01e authsecret HAL policies.
Bug: 71527305
Test: compile and boot
Change-Id: I91097bd62d99b8dd9eb6f53060badbaf0f4b8b4a
(cherry picked from commit 1aedf4b5f8)
2018-02-05 11:19:46 +00:00
Ruchi Kandoi
1c57b81c1e Merge "SE Policy for Secure Element app and Secure Element HAL" am: 6a60cb3e69 am: f285f2db4b
am: 4757882300

Change-Id: I36147d7f0359cef7f80ee36086150936bed2e672
2018-01-30 01:26:15 +00:00
Ruchi Kandoi
8a2b4a783e SE Policy for Secure Element app and Secure Element HAL
Test: App startup on boot
Change-Id: I7740aafc088aadf676328e3f1bb8db5175d97102
2018-01-29 21:31:42 +00:00
yinxu
9a786ae738 Merge "Add sepolicy for radio.config" am: 2638cd2c96 am: 2af6b8602c
am: ec5ab9db31

Change-Id: I808c3b1f4abe806b2e3ae558a01206368359edc0
2018-01-25 04:19:17 +00:00
yinxu
612350e34f Add sepolicy for radio.config
Bug: 64131518
Test: Compile and flash the device, check whether service vendor.radio-config-hal-1-0 starts
Change-Id: Id728658b4acdda87748259b74e6b7438f6283ea5
2018-01-24 12:13:10 -08:00
Janis Danisevskis
f5ea7ab181 Added default policy for Confirmation UI HAL am: 97c56bdd78 am: 5029fe7236
am: a2f243dc35

Change-Id: I670465743596b35c37a4ca591e5a8f4848222bb9
2018-01-24 20:09:47 +00:00
Janis Danisevskis
97c56bdd78 Added default policy for Confirmation UI HAL
Bug: 63928580
Test: Manually tested.

Change-Id: If6bb10cb7c009883d853e46dcdeb92cd33877d53
2018-01-24 10:22:40 -08:00
Andrew Scull
8d11ef5a37 Merge "authsecret HAL policies." 2018-01-23 17:43:59 +00:00
Badhri Jagan Sridharan
7bee33e665 hal_usb_gadget sepolicy
Bug: 63669128
Test: Checked for avc denail messages.
Change-Id: I057b3cf9ccc945cb943b9cf60fc9cd6c023eddda
Merged-In: I057b3cf9ccc945cb943b9cf60fc9cd6c023eddda
2018-01-19 18:56:16 +00:00
Badhri Jagan Sridharan
9b07889452 hal_usb_gadget sepolicy
Bug: 63669128
Test: Checked for avc denail messages.
Change-Id: I057b3cf9ccc945cb943b9cf60fc9cd6c023eddda
2018-01-19 07:59:11 -08:00
Roshan Pius
5bca3e860d sepolicy(hostapd): Add a HIDL interface for hostapd
Change sepolicy permissions to now classify hostapd as a HAL exposing
HIDL interface.

Sepolicy denial for accessing /data/vendor/misc/wifi/hostapd:
12-27 23:40:55.913  4952  4952 W hostapd : type=1400 audit(0.0:19): avc:
denied { write } for name="hostapd" dev="sda13" ino=4587601
scontext=u:r:hal_wifi_hostapd_default:s0
tcontext=u:object_r:system_data_file:s0 tclass=dir permissive=0

01-02 19:07:16.938  5791  5791 W hostapd : type=1400 audit(0.0:31): avc:
denied { search } for name="net" dev="sysfs" ino=30521
scontext=u:r:hal_wifi_hostapd_default:s0
tcontext=u:object_r:sysfs_net:s0 tclass=dir permissive=0

Bug: 36646171
Test: Device boots up and able to turn on SoftAp.
Change-Id: Ibacfcc938deab40096b54b8d0e608d53ca91b947
2018-01-12 14:05:38 -08:00