Commit graph

2429 commits

Author SHA1 Message Date
Yifan Hong
bf7bf3ba0e perfprofd: talk to health HAL.
am: 65c568d0dd

Change-Id: I67a358cb33f9ba546ab3b42f58d48c1c0a5c763e
2018-07-17 13:24:23 -07:00
Yifan Hong
65c568d0dd perfprofd: talk to health HAL.
Test: perfprofd tests
Bug: 110890430
Change-Id: I0f7476d76b8d35b6b48fe6b77544ca8ccc71534d
2018-07-17 11:37:26 -07:00
Jeff Vander Stoep
3d4d8899d1 crash_dump: disallow ptrace of TCB components
am: 573d333589

Change-Id: I5d0bd81b6b486a6a5cffd8159d99cfcdcf0f464f
2018-07-13 21:35:08 -07:00
Jeff Vander Stoep
573d333589 crash_dump: disallow ptrace of TCB components
Remove permissions.

Bug: 110107376
Test: kill -6 <components excluded from ptrace>
Change-Id: If8b9c932af03a551e40e786d591544ecdd4e5c98
Merged-In: If8b9c932af03a551e40e786d591544ecdd4e5c98
(cherry picked from commit f1554f1588)
2018-07-12 11:33:30 -07:00
Florian Mayer
139bb3f279 Merge "Allow to read events/header_page with debugfs_tracing"
am: 7d7328b807

Change-Id: I6bd14e069dd07b81b6cf33cfe8dd22e641d8f1f9
2018-07-10 21:35:06 -07:00
Florian Mayer
a62ce04a8c Allow to read events/header_page with debugfs_tracing
Bug: 110900684
Change-Id: I9fd141e0d56d0135c563467b7ca2f08b6af6700b`
2018-07-03 09:36:42 +00:00
Bowgo Tsai
dc7e8d3de5 Merge "Sepolicy for rw mount point for product extensions."
am: 589dbe1429

Change-Id: Ife838a971f7145583d2d1444a2c366515060e5a4
2018-07-02 19:03:52 -07:00
Pawin Vongmasa
35f9e08bcd Merge "Allow surfaceflinger to call into mediacodec"
am: 48f1c4ce22

Change-Id: I9362732c00cf9daf4b68f30885664a000dd0f3b8
2018-07-02 19:03:07 -07:00
Treehugger Robot
589dbe1429 Merge "Sepolicy for rw mount point for product extensions." 2018-07-03 00:21:01 +00:00
Treehugger Robot
48f1c4ce22 Merge "Allow surfaceflinger to call into mediacodec" 2018-07-03 00:19:50 +00:00
Yabin Cui
ca685e9e91 Merge "Export more files in proc_perf."
am: 74f86551af

Change-Id: I16f29c89431a5ca4ac604869e21cd8312bd37f9e
2018-07-02 15:18:49 -07:00
Yabin Cui
74f86551af Merge "Export more files in proc_perf." 2018-07-02 22:12:03 +00:00
Yabin Cui
09464811ca Export more files in proc_perf.
Export /proc/sys/kernel/perf_cpu_time_max_percent and
/proc/sys/kernel/perf_event_mlock_kb in proc_perf. So
they can be read in shell and written by init.

This is needed by simpleperf to control cpu percent and
memory used for profiling.

Bug: 110706031
Test: build and boot hikey960 successfully.

Change-Id: I2a01f583508003ab73427bab30a7982a27dfa677
2018-07-02 11:39:40 -07:00
Pawin Vongmasa
ff2dccaf38 Allow surfaceflinger to call into mediacodec
Test: adb logcat | grep "Wrong interface type."

Bug: 77924251
Change-Id: Idf9d7ae6db0d41bb0c2f94b2183bfe23f0c21155
2018-07-01 19:04:03 -07:00
Todd Poynor
c6afcb7fc0 remove thermalcallback_hwservice
This hwservice isn't registered with hwservicemanager but rather passed
to the thermal hal, so it doesn't need sepolicy associated with it to
do so.

Test: manual: boot, inspect logs
Test: VtsHalThermalV1_1TargetTest
Bug: 109802374
Change-Id: Ifb727572bf8eebddc58deba6c0ce513008e01861
Merged-In: Ifb727572bf8eebddc58deba6c0ce513008e01861
2018-06-29 23:01:43 +00:00
Jeff Vander Stoep
9256ec00b8 Merge "priv_app: dontaudit read access to default sysfs label"
am: 05fc3f2526

Change-Id: Iebf4303790c7b87cd9e82abf073c895f7b4fa38e
2018-06-29 14:41:05 -07:00
Treehugger Robot
05fc3f2526 Merge "priv_app: dontaudit read access to default sysfs label" 2018-06-29 20:43:53 +00:00
Jeff Vander Stoep
4894d9fde8 priv_app: dontaudit read access to default sysfs label
Suppress selinux logspam for non-API files in /sys.

Bug: 110914297
Test: build
Change-Id: I9b3bcf2dbf80f282ae5c74b61df360c85d02483c
2018-06-29 11:06:10 -07:00
John Reck
10caa0c412 Merge "Add record-tgid tracefs support"
am: d6c47bc1b5

Change-Id: I9f8f996c182701bb52cb60c8403c9e817f777691
2018-06-29 10:54:55 -07:00
Bowgo Tsai
c287032f61 Sepolicy for rw mount point for product extensions.
Bug: 110808288
Test: device boots with /mnt/product present and selinux label
      mnt_product_file applied correctly.

Change-Id: I596e4b79285fe1a79d31ad1b07f4bcffe6a6cd98
2018-06-29 22:54:42 +08:00
John Reck
f6a375039f Add record-tgid tracefs support
Bug: 110757800
Test: none
Change-Id: I2627c43fc45a78c936fa4a7ca968c606c89b9728
2018-06-28 14:15:07 -07:00
Dmitry Shmidt
48bf5e998e Merge "btlinux: Move HAL definitions from system/bt"
am: 9214238418

Change-Id: Ib1a4c54dacb5e3999ffa130d170cdef04e383b57
2018-06-27 19:22:04 -07:00
Treehugger Robot
9214238418 Merge "btlinux: Move HAL definitions from system/bt" 2018-06-28 00:31:05 +00:00
Dmitry Shmidt
a0c3416b2a btlinux: Move HAL definitions from system/bt
Test: ls -laZ /vendor/bin/hw/android.hardware.bluetooth*
Change-Id: I394594ad041f87583ca6b5b44d836cfab5da8103
Signed-off-by: Dmitry Shmidt <dimitrysh@google.com>
Merged-In: I394594ad041f87583ca6b5b44d836cfab5da8103
2018-06-27 23:56:31 +00:00
Yi Jin
2f29d48e16 Merge "Allow incidentd to read kernel version"
am: 26d589a378

Change-Id: Icf8add102adce4f34f9800fdab872ad968989d49
2018-06-27 11:29:35 -07:00
Yi Jin
880de35b41 Allow incidentd to read kernel version
Bug: 110230810
Test: N/A
Change-Id: Ide135dd5a8da05f0ea639bf03ce9612862108225
2018-06-26 21:19:15 +00:00
Samuel Ha
eda0f3f372 Revert "Revert "Reduce the number of processes that can start adbd""
am: 22f98197b2

Change-Id: Ie2678a964788b3a064ec12b06cb7b129ccc9b4b5
2018-06-26 13:06:04 -07:00
Samuel Ha
22f98197b2 Revert "Revert "Reduce the number of processes that can start adbd""
This reverts commit b5dc6137ad.

Reason for revert: Reverted incorrect change

Change-Id: Ieafa3338e28ffeed40bcceb73486cffbfbd08b9d
2018-06-26 19:52:21 +00:00
Samuel Ha
d2bc137aed Revert "Reduce the number of processes that can start adbd"
am: b5dc6137ad

Change-Id: I27e69743664613630765598869203b71437182b2
2018-06-26 12:49:35 -07:00
Samuel Ha
b5dc6137ad Revert "Reduce the number of processes that can start adbd"
This reverts commit faebeacaa0.

Reason for revert: broke the build

Change-Id: I3d61ce011ad42c6ff0e9f122de3daa37e846407a
2018-06-26 19:36:38 +00:00
Luis Hector Chavez
72bebcec37 Reduce the number of processes that can start adbd
am: faebeacaa0

Change-Id: I263f10cc06e23a01f1928d3c8dae3ab4e6357788
2018-06-26 07:17:06 -07:00
Luis Hector Chavez
faebeacaa0 Reduce the number of processes that can start adbd
This change makes it such that only init can start adbd directly. It
also introduces new rules for ctl.{start,stop,restart} properties such
that only usbd and recovery (and su, since it's permissive) can directly
ask init to start adbd.

Bug: 64720460
Test: adbd still runs
Test: /data/nativetest64/adbd_test/adbd_test
Test: python system/core/adb/test_adb.py
Test: "USB debugging" in System Settings still start/stop adbd
Test: Recovery menu still make the device show as "recovery" in adb
      devices
Test: "Apply update from ADB" in recovery menu still works
Change-Id: Iafcda8aa44e85129afcc958036b472d856fa1192
2018-06-26 14:10:26 +00:00
Eino-Ville Talvala
67bd625c19 Make system property audio.camerasound.force a vendor-writable property,
am: 3ac71f8d82

Change-Id: Ia0db4d6a305d7f815f38a119475ebb346e873249
2018-06-25 22:00:50 -07:00
Eino-Ville Talvala
3ac71f8d82 Make system property audio.camerasound.force a vendor-writable property,
This property is read by the audio service in system server to toggle
camera shutter sound enforcement on a device-specific basis.

Test: Camera shutter sound enforcement works when audio.camerasound.force is set
Bug: 110126976
Change-Id: I2720d3c699c4712d1a328f59dde0b16bbf1016f3
2018-06-25 22:50:14 +00:00
Neil Fuller
43d2c3d0b5 Add label for time (zone) system properties
am: b794ad0f8d

Change-Id: I46c7aa4b511da69d7f852023cff23871b6c8468e
2018-06-25 13:31:29 -07:00
Eino-Ville Talvala
fef2be8130 Merge "Make system property audio.camerasound.force a vendor-writable property," into pi-dev 2018-06-25 17:39:17 +00:00
Neil Fuller
b794ad0f8d Add label for time (zone) system properties
This adds a label for system properties that will affect system-wide
time / time detection logic.

The first example will be something like:
persist.time.detection_impl_version

Bug: 78217059
Test: build
Change-Id: I46044f1e28170760001da9acf2496a1e3037e48a
2018-06-25 17:59:56 +01:00
Peiyong Lin
8942de0640 Merge "Allow SurfaceFlinger to use Power HAL."
am: 0474b119ca

Change-Id: Ie24f599f2d7e74aac38393c20762d16d6a48e355
2018-06-22 13:45:56 -07:00
Peiyong Lin
a0b52c6fa5 Allow SurfaceFlinger to use Power HAL.
When we have wide color gamut content, SurfaceFlinger might want to send a
PowerHint through Power Hal to boost GPU to higher frequency, to make sure GPU
composition can finish in time.

BUG: 110112323
Test: adb shell cat /sys/class/kgsl/kgsl-3d0/devfreq/cur_freq
Change-Id: If60c13aedc4ff84eaefd3430794dc15a478c5a73
(cherry picked from commit 02be5975d6)
2018-06-22 13:31:56 -07:00
Treehugger Robot
0474b119ca Merge "Allow SurfaceFlinger to use Power HAL." 2018-06-22 20:24:26 +00:00
Jeff Vander Stoep
ed3f2dba34 Merge "Update socket ioctl restrictions"
am: 4b9a3128fd

Change-Id: I91b225a67ba9a63ac325882bdbb8ac78e487b323
2018-06-22 11:03:21 -07:00
Treehugger Robot
4b9a3128fd Merge "Update socket ioctl restrictions" 2018-06-22 17:55:32 +00:00
Peiyong Lin
02be5975d6 Allow SurfaceFlinger to use Power HAL.
When we have wide color gamut content, SurfaceFlinger might want to send a
PowerHint through Power Hal to boost GPU to higher frequency, to make sure GPU
composition can finish in time.

BUG: 110112323
Test: adb shell cat /sys/class/kgsl/kgsl-3d0/devfreq/cur_freq
Change-Id: If60c13aedc4ff84eaefd3430794dc15a478c5a73
2018-06-22 17:49:53 +00:00
Dario Freni
fc3dcaa992 Merge "Add a rule for /product-services partition."
am: 512e1c4d09

Change-Id: I452b2ac620461bc7d16dda8a0ec9855a8dbfd593
2018-06-22 02:18:05 -07:00
Dario Freni
512e1c4d09 Merge "Add a rule for /product-services partition." 2018-06-22 09:11:17 +00:00
Jeff Vander Stoep
0597ade15c Update socket ioctl restrictions
Grant access to icmp_socket to netdomain. This was previously
labeled as rawip_socket which apps are allowed to use. Neverallow
all other new socket types for apps.

Kernels versions > 4.9 redefine ICMP sockets from rawip_socket
to icmp_socket. To pass neverallow tests, we need to define
which IOCTLs are allowed (and disallowed).

Note that this does not change behavior on devices with
kernel versions <=4.9. However, it is necessary (although not
sufficient) to pass CTS on kernel version 4.14.

Bug: 110520616
Test: Grant icmp_socket in net.te and build.
Change-Id: I5c7cb6867d1a4cd1554a8da0d55daa8e06daf803
2018-06-22 05:35:07 +00:00
Neil Fuller
f351f7c662 Merge "Remove unnecessary permission"
am: 981aac14a3

Change-Id: I0d15f9bb47e3c77256f8c904662bedccd55333f3
2018-06-21 13:33:04 -07:00
Treehugger Robot
981aac14a3 Merge "Remove unnecessary permission" 2018-06-21 20:26:02 +00:00
Eino-Ville Talvala
d375e733fe Make system property audio.camerasound.force a vendor-writable property,
This property is read by the audio service in system server to toggle camera shutter sound
enforcement on a device-specific basis.

Test: Camera shutter sound enforcement works when audio.camerasound.force is set
Bug: 110126976
Change-Id: I2720d3c699c4712d1a328f59dde0b16bbf1016f3
2018-06-21 13:12:48 -07:00
Dario Freni
53a0763703 Add a rule for /product-services partition.
Like /system and /product, /product-services will contain apps that
should have the same privileges as the one in other system partitions.

Bug: 80741439
Test: successfully tested e2e on two devices, one with
/product-services partition and another with /product-services
symlinking to -> /system/product-services
Change-Id: Ieee7a9a7641a178f44bb406dbdef39ed46713899
2018-06-21 17:08:10 +01:00