tequilaOS/platform_system_sepolicy

Fork 0

Commit graph

Author	SHA1	Message	Date
dcashman	cc39f63773	Split general policy into public and private components. Divide policy into public and private components. This is the first step in splitting the policy creation for platform and non-platform policies. The policy in the public directory will be exported for use in non-platform policy creation. Backwards compatibility with it will be achieved by converting the exported policy into attribute-based policy when included as part of the non-platform policy and a mapping file will be maintained to be included with the platform policy that maps exported attributes of previous versions to the current platform version. Eventually we would like to create a clear interface between the platform and non-platform device components so that the exported policy, and the need for attributes is minimal. For now, almost all types and avrules are left in public. Test: Tested by building policy and running on device. Change-Id: Idef796c9ec169259787c3f9d8f423edf4ce27f8c	2016-10-06 13:09:06 -07:00
James Hawkins	2e8d71c3be	bootstat: Fix the SELinux policy after removing domain_deprecated. * Allow reading /proc. type=1400 audit(1453834004.239:7): avc: denied { read } for pid=1305 comm="bootstat" name="uptime" dev="proc" ino=4026536600 scontext=u:r:bootstat:s0 tcontext=u:object_r:proc:s0 tclass=file permissive=0 * Define domain for the /system/bin/bootstat file. init: Service exec 4 (/system/bin/bootstat) does not have a SELinux domain defined. Bug: 21724738 Change-Id: I4baa2fa7466ac35a1ced79776943c07635ec9804	2016-01-26 18:52:58 +00:00
James Hawkins	39c198ac6f	bootstat: Implement the SELinux policy to allow reading/writing to /data/misc/bootstat. BUG: 21724738 Change-Id: I2789f57cc8182af1a7c33672ef82297f32f54e2e	2016-01-22 08:08:37 -08:00

Author

SHA1

Message

Date

dcashman

cc39f63773

Split general policy into public and private components.

Divide policy into public and private components.  This is the first
step in splitting the policy creation for platform and non-platform
policies.  The policy in the public directory will be exported for use
in non-platform policy creation.  Backwards compatibility with it will
be achieved by converting the exported policy into attribute-based
policy when included as part of the non-platform policy and a mapping
file will be maintained to be included with the platform policy that
maps exported attributes of previous versions to the current platform
version.

Eventually we would like to create a clear interface between the
platform and non-platform device components so that the exported policy,
and the need for attributes is minimal.  For now, almost all types and
avrules are left in public.

Test: Tested by building policy and running on device.

Change-Id: Idef796c9ec169259787c3f9d8f423edf4ce27f8c

2016-10-06 13:09:06 -07:00

James Hawkins

2e8d71c3be

bootstat: Fix the SELinux policy after removing domain_deprecated.

* Allow reading /proc.

type=1400 audit(1453834004.239:7): avc: denied { read } for pid=1305
comm="bootstat" name="uptime" dev="proc" ino=4026536600
scontext=u:r:bootstat:s0 tcontext=u:object_r:proc:s0 tclass=file
permissive=0

* Define domain for the /system/bin/bootstat file.

init: Service exec 4 (/system/bin/bootstat) does not have a SELinux
domain defined.

Bug: 21724738
Change-Id: I4baa2fa7466ac35a1ced79776943c07635ec9804

2016-01-26 18:52:58 +00:00

James Hawkins

39c198ac6f

bootstat: Implement the SELinux policy to allow reading/writing to

/data/misc/bootstat.

BUG: 21724738
Change-Id: I2789f57cc8182af1a7c33672ef82297f32f54e2e

2016-01-22 08:08:37 -08:00

3 commits