Commit graph

13614 commits

Author SHA1 Message Date
Treehugger Robot
795eae3a41 Merge changes from topic "dontaudit_proc_sys"
* changes:
  silence innocuous denials to /proc and /sys
  proc_type attribute for files under /proc.
2018-03-20 21:16:19 +00:00
Andreas Gampe
c9df843773 Sepolicy: Give system server fd rights to perfprofd
So that perfprofd can send larger packets to dropbox.

Follow-up of commit 3fa95acb1e.

Bug: 73175642
Test: m
Test: manual
Change-Id: I88d1f83962243589909ff1ce3d02195e7c494256
2018-03-20 15:45:00 +00:00
Hector Dearman
3bf4f641fe Merge "Allow system server to set persist.traced.enable" 2018-03-20 11:20:11 +00:00
Treehugger Robot
e09ad393db Merge "Revert "Allow dexopt to follow /odm/lib(64) symlinks."" 2018-03-20 05:57:26 +00:00
Treehugger Robot
03754b18f7 Merge "Allow audioserver to access audio_device on non-Treble devices." 2018-03-20 04:06:08 +00:00
Treehugger Robot
caf6dafc39 Merge "Add alanstokes as an owner." 2018-03-20 01:49:44 +00:00
Treehugger Robot
e837c8e751 Merge changes from topic "odm-sepolicy"
* changes:
  Add /odm/etc/selinux/odm_mac_permissions.xml
  Add /odm/etc/selinux/odm_hwservice_contexts
  Add /odm/etc/selinux/odm_property_contexts
  Add /odm/etc/selinux/odm_seapp_contexts
  Add /odm/etc/selinux/odm_file_contexts
  Add /odm/etc/selinux/odm_sepolicy.cil
2018-03-20 01:06:04 +00:00
Bowgo Tsai
942500b910 Revert "Allow dexopt to follow /odm/lib(64) symlinks."
This reverts commit 88cd813fe2.

Bug: 75287236
Test: boot a device
Change-Id: Id1bc324e7bd0722065d8a410af31fd6b7aaa9d1c
2018-03-20 09:03:57 +08:00
Joel Galenson
6e8bfa2d3e Allow audioserver to access audio_device on non-Treble devices.
This should fix audio on non-Treble devices.

Bug: 75949883
Test: Built policy.
Change-Id: I90a4648aaf975d59be36afd5f62c88a015af10f7
2018-03-19 17:16:52 -07:00
Alan Stokes
ac40afadd7 Add alanstokes as an owner.
Test: n/a
Change-Id: Iba86b7d77582e85de7469bedaf31465205e42433
2018-03-19 23:35:48 +00:00
Tri Vo
09b1d962ef silence innocuous denials to /proc and /sys
Bug: 74182216
Test: build policy
Change-Id: Idf90c1a96943266d52508ce72b8554d8b5c594c9
2018-03-19 14:58:25 -07:00
Tri Vo
41bf08e592 proc_type attribute for files under /proc.
With this attribute it will be easier to reference /proc files.

Bug: 74182216
Test: policy builds
Change-Id: I5b7da508d821e45f122832261a742a201e8fdf2c
2018-03-19 14:58:25 -07:00
Chong Zhang
8e3fef3d2c allow mediaprovider to use media extractor
When extraction exif info, certain file formats may requires
parsing the container. Allow mediaprovider to use extractor
to do the parsing.

bug: 73978990
Test: manually test the scenario in b/73978990 and verify
      the Exif is extracted correctly.

Change-Id: I1cd46d793ebc9c38b816a3b63f361967e551d046
2018-03-19 13:05:24 -07:00
Hector Dearman
6f2040f873 Allow system server to set persist.traced.enable
To enable/disable the traced and traced_probes deamons remotely we would
like system server to be able to set persist.traced.enable.
See also ag/3736001.

Denial:
selinux: avc: denied { set } for
property=persist.traced.enable
pid=1606 uid=1000 gid=1000
scontext=u:r:system_server:s0
tcontext=u:object_r:default_prop:s0 tclass=property_service
permissive=0\x0a

Run:
$ adb shell 'ps -A | grep traced'
Should see traced.
$ adb shell 'settings put global sys_traced 0'
$ adb shell 'ps -A | grep traced'
Should no longer see traced.

Test: See above.
Change-Id: I245b7df3853cabeb0e75db41fb4facaa178ab8f1
2018-03-19 15:48:50 +00:00
Treehugger Robot
8e0b882cd6 Merge "Allow dexopt to follow /odm/lib(64) symlinks." 2018-03-19 07:54:46 +00:00
Bowgo Tsai
88cd813fe2 Allow dexopt to follow /odm/lib(64) symlinks.
Several /odm/* symlinks are added in the following change, to fallback
to /vendor/odm/* when there is no /odm partition on the device.

  https://android-review.googlesource.com/#/c/platform/system/sepolicy/+/638159/

This change allows dexopt operations to 'getattr' those symlinks during
OTA.

Bug: 75287236
Test: boot a device
Change-Id: I2710ce5e2c47eb1a3432123ab49f1b6f3dcb4ffe
2018-03-19 13:29:06 +08:00
Treehugger Robot
c828802643 Merge "Allow only public-readable to ro.secure and ro.adb.secure" 2018-03-18 23:21:34 +00:00
Tri Vo
eecc0ed4eb Merge "netd: silence innocuous denials to /proc and /sys" 2018-03-18 19:50:48 +00:00
Tri Vo
569e22e86f netd: silence innocuous denials to /proc and /sys
Bug: 74586749
Test: build policy
Change-Id: I72a3b7c38eb9030ffac0d2dde23a9ff7c26fd70a
2018-03-16 16:08:34 -07:00
Bowgo Tsai
af7d85f83f Add /odm/etc/selinux/odm_mac_permissions.xml
Bug: 64240127
Test: normal boot a device
Change-Id: I276ba6bc88eabb0d5562e4e96d3860eedb76aed5
2018-03-16 15:45:02 +08:00
Bowgo Tsai
ad6231f546 Add /odm/etc/selinux/odm_hwservice_contexts
Bug: 64240127
Test: normal boot and recovery boot a device
Change-Id: I22d29e8476380d19aca1be359e0228ab6bbc3b0f
2018-03-16 15:44:55 +08:00
Bowgo Tsai
1f717b1001 Add /odm/etc/selinux/odm_property_contexts
Bug: 64240127
Test: normal boot and recovery boot a device
Change-Id: Ibd71219f60644e57370c0293decf11d82f1cb35c
2018-03-16 15:44:48 +08:00
Bowgo Tsai
ecf656b06f Add /odm/etc/selinux/odm_seapp_contexts
Bug: 64240127
Test: normal boot a device
Change-Id: I3626357237cc18a99511f1ebd9dd3ff5a7655963
2018-03-16 15:44:41 +08:00
Bowgo Tsai
bae1517a58 Add /odm/etc/selinux/odm_file_contexts
Bug: 64240127
Test: normal boot and recovery boot a device
Change-Id: I087292fb23d05fc17272778d668ac78a721b2593
2018-03-16 15:44:33 +08:00
Bowgo Tsai
45457e3a2b Add /odm/etc/selinux/odm_sepolicy.cil
This change adds the support of odm sepolicy customization, which can
be configured through the newly added build varaible:
    - BOARD_ODM_SEPOLICY_DIRS += device/${ODM_NAME}/${BOM_NAME}/sepolicy

Also moving precompiled sepolicy to /odm when BOARD_ODM_SEPOLICY_DIRS
is set. On a DUT, precompiled sepolicy on /odm will override the one in
/vendor. This is intentional because /odm is the hardware customization
for /vendor and both should be updated together if desired.

Bug: 64240127
Test: boot a device with /odm partition
Change-Id: Ia8f81a78c88cbfefb3ff19e2ccd2648da6284d09
2018-03-16 15:44:23 +08:00
Jaekyun Seok
62acbce4a2 Allow only public-readable to ro.secure and ro.adb.secure
Bug: 74866333
Test: succeeded building and tested with taimen
Change-Id: Id19fec168ab266e386ea4c710a4c5cedfc4df33c
2018-03-16 04:49:45 +00:00
Treehugger Robot
4eb10d809a Merge "Mark some odm properties as vendor-init-settable" 2018-03-16 01:31:47 +00:00
Treehugger Robot
b4090d79a8 Merge "Init: Enable init to relabel symlinks for recovery_block_device." 2018-03-16 00:41:12 +00:00
Treehugger Robot
e7ceb68a65 Merge "Grant create_file_perms to hal_usb_gadget_server" 2018-03-16 00:29:43 +00:00
padarshr
bc14ee3cd7 Init: Enable init to relabel symlinks for recovery_block_device.
Allow init the ability to relabel recovery block devices. In the case
where we have recovery as a chain partition, due to its presence in
early mount node, init, in first stage itself would require relabel
permissions for the restorecon operation on recovery block device.

Bug: 73642793
Test: On bootup, recovery partition gets the appropriate se-label.
      Perform OTA on non-A/B device with recovery as chain partition,
      now the recovery partition gets upgraded successfully, now that
      it has the correct se-label.

Change-Id: I370c510320e78ab78c9c55573073415b4983d0f6
2018-03-15 14:03:04 -07:00
Bowgo Tsai
a47a1c25af Mark some odm properties as vendor-init-settable
Bug: 64195575
Test: boot a device
Change-Id: I7f7deb5e2c5c6e0a75cf22eb610a7973b5be0d7e
2018-03-15 16:59:29 +08:00
Treehugger Robot
35f6654354 Merge "hal_camera: Allow writing dump info into pipes" 2018-03-15 02:42:38 +00:00
Max Bires
8966b8e53d Merge "Adding ability for priv apps to read traceur fd" 2018-03-14 20:31:26 +00:00
Jaekyun Seok
46bc518c69 Allow vendor-init-settable to ro.enable_boot_charger_mode
vendor-init-settable should be allowed to ro.enable_boot_charger_mode so
that SoC vendors can set its default value.

Bug: 74421250
Test: succeeded building and tested with taimen
Change-Id: I2859aab29fefb7882989413a089b0de55142d2f1
2018-03-13 22:16:55 +00:00
Max Bires
715e2ae383 Adding ability for priv apps to read traceur fd
Only untrusted apps had privilegs to read file descriptors passed in
from traceur, which was an oversight. This fixes the policy so that priv
apps can also access file descriptors from traceur in order to read
reports shared from traceur.

Bug: 74435522
Test: better bug has access to reports shared from traceur
Change-Id: I591872cdac31eec62edbc81d95f1220f1152427f
2018-03-13 21:50:04 +00:00
Treehugger Robot
529ce19708 Merge "Ensure taking a bugreport generates no denials." 2018-03-13 17:54:03 +00:00
Treehugger Robot
722bb479c4 Merge "Add ro.hardware.audio.hearing_aid" 2018-03-13 17:47:09 +00:00
Treehugger Robot
1fab9d8363 Merge changes from topic "bt-a2dp-offload-aosp"
* changes:
  sepolicy: Read access to audioserver for Bluetooth properties
  Bluetooth A2DP offload: Binder call to audio HAL
2018-03-13 02:50:51 +00:00
Treehugger Robot
49c4a4ee35 Merge "Revert "Revert "Move rild from public to vendor.""" 2018-03-12 22:44:38 +00:00
Aniket Kumar Lata
d3d7800469 sepolicy: Read access to audioserver for Bluetooth properties
Provide read/write access to audioserver for Bluetooth
properties used with A2DP offload.

Bug: 68824150
Test: Manual; TestTracker/148125
Change-Id: I40c932d085ac55bc45e6654f966b2c9d244263d0
(cherry picked from commit 041049bc7a)
2018-03-12 13:28:55 -07:00
Sunny Kapdi
bc0c88f37d Bluetooth A2DP offload: Binder call to audio HAL
Add rule to allow Binder call from Bluetooth process to Bluetooth
audio HIDL interface running in audio HAL service process.

Bug: 72242910
Test: Manual; TestTracker/148125
Change-Id: I1981a78bece10b8e516f218d3edde8b77943d130
(cherry picked from commit e8cfac90e8)
2018-03-12 13:28:43 -07:00
Treehugger Robot
1356a75fd5 Merge "Hide denial for wpa_supplicant writing to /data/misc/wifi." 2018-03-12 20:15:40 +00:00
Amit Mahajan
3007344dcd Revert "Revert "Move rild from public to vendor.""
This reverts commit 016f0a58a9.

Reason for revert: Was temporarily reverted, merging back in with fix.

Test: Basic telephony sanity, treehugger
Bug: 74486619
Bug: 36427227
Merged-in: Ide68726a90d5485c2758673079427407aee1e4f2
Change-Id: Ide68726a90d5485c2758673079427407aee1e4f2
(cherry picked from commit 312248ff72)
2018-03-12 13:13:39 -07:00
Jakub Pawlowski
a4b52dba6c Add ro.hardware.audio.hearing_aid
Bug: 69623109
Change-Id: I7d194a3489fc5ff278cef7bebe9bfe6c39d3b2b8
2018-03-12 19:11:09 +00:00
Treehugger Robot
0bbe19a4c6 Merge "Adding /odm support" 2018-03-12 19:00:25 +00:00
Treehugger Robot
463f8545d4 Merge "Revert "Move rild from public to vendor."" 2018-03-12 19:00:17 +00:00
Amit Mahajan
58758dc222 Revert "Move rild from public to vendor."
This reverts commit aed57d4e4d.

Reason for revert: This CL is expected to break pre-submit tests (b/74486619)

Merged-in: I103c3faa1604fddc27b3b4602b587f2d733827b1
Change-Id: I0eb7a744e0d43ab15fc490e7e7c870d0f44e1401
2018-03-12 17:35:17 +00:00
Treehugger Robot
b835b600ab Merge "Move rild from public to vendor." 2018-03-12 17:27:56 +00:00
Treehugger Robot
d4be470981 Merge "Use user policy when checking neverallow rules." 2018-03-12 16:28:20 +00:00
Bowgo Tsai
dd6efea232 Adding /odm support
/odm partition isn't mandatory and the following symlinks will exist on
a device without /odm partition.

  /odm/app ->/vendor/odm/app
  /odm/bin ->/vendor/odm/bin
  /odm/etc ->/vendor/odm/etc
  /odm/firmware ->/vendor/odm/firmware
  /odm/framework ->/vendor/odm/framework
  /odm/lib -> /vendor/odm/lib
  /odm/lib64 -> /vendor/odm/lib64
  /odm/overlay -> /vendor/odm/overlay
  /odm/priv-app -> /vendor/odm/priv-app

This CL allows all domains to access the symlinks, also removes the
Treble compliance neverallows on them because the actual restrictions
should apply to the real path directly.

Bug: 70678783
Test: boot a device
Change-Id: If1522780a13710d8a592272dc688685cbae29f52
2018-03-12 16:22:00 +00:00