Commit graph

244 commits

Author SHA1 Message Date
Julia Reynolds
859e5a3093 Allow people service to publish apis
Test:IPeopleManager.Stub.asInterface(ServiceManager.getService(Context.PEOPLE_SERVICE) is
not null when called from another process
Bug: 169783793

Change-Id: I280568955c50f9deef0a35ad1b9864ffc0a82db4
2020-10-16 19:22:33 +00:00
Primiano Tucci
ce31e4ba0e Merge "Keep AOSP sepolicy up to date with internal master" 2020-10-14 08:33:09 +00:00
Primiano Tucci
5d026b3152 Keep AOSP sepolicy up to date with internal master
This re-alignes aosp and internal master to avoid
conflicts when uploading CLs upstream.

Bug: 170126760
Change-Id: I9c087e70998cd529b71dec7428641c4bfef10d31
2020-10-13 18:52:25 +00:00
Darryl L Johnson
d6cc359691 Add device_state_service to SEPolicy.
This is to support the addition of the device state manager service and
its associated binder service.

Test: Manual - Modify policy and verify binder service can be published.
Fixes: 170034199
Change-Id: Id63cb1db3ee80ec699e98443457c113d6be809fe
2020-10-13 07:48:56 -07:00
Lais Andrade
ac2da76606 Add sepolicy for vibrator manager
This will allow SystemServer to add the new vibrator manager service.

Bug: 166586119
Test: manually build and install on test device
Change-Id: I496f46e2f5482aaa7bfba31d6c6b2967486941cc
2020-10-07 13:17:58 +00:00
Neil Fuller
5d1e781b66 Merge "Expand timezonedetector_service API access" 2020-10-05 10:24:21 +00:00
Neil Fuller
804329881f Expand timezonedetector_service API access
TimeZoneDetectorService will be accessed as part of a new @SystemApi,
TimeManager.

For CTS testing, the TimeZoneDetectorService needs to be accessible by
the CTS test app, this means the sepolicy for the service needs to be
expanded to less trusted clients. During tests we can expand the Android
permissions to those of the Shell process, but it looks like selinux
still needs this change even though "real" clients will be privileged
apps.

It's probable that the time / time detector services will be used in
public SDK TimeManager APIs in the future.

Bug: 159891384
Test: build only (and CTS tests not yet submitted in AOSP)
Change-Id: Ieb4b40505aa990e572435c098a66c489746d4c45
2020-09-30 13:44:41 +01:00
Ilya Matyukhin
d2acfb0f9c Merge "Add sepolicy for IFace" 2020-09-29 20:20:00 +00:00
Ilya Matyukhin
9bd164241e Add sepolicy for IFace
Bug: 168730443
Test: run on cuttlefish
Change-Id: Ie3cf791e7aac090788c7213d23487ae9f50b0690
2020-09-28 15:57:59 -07:00
Yu-Han Yang
bbd0ecedbb Add GNSS AIDL interfaces (system/sepolicy)
Bug: 159467682
Test: built and run on cuttlefish
Change-Id: I071e8427ea0251139661aa8123376c56e0839390
2020-09-24 12:03:30 -07:00
Nick Moukhine
affe2399b5 Add sepolicy for music recognition service.
Denial when not listed in priv_app.te:
E SELinux : avc:  denied  { find } for pid=3213 uid=10170 name=music_recognition scontext=u:r:priv_app:s0:c512,c768 tcontext=u:object_r:music_recognition_service:s0 tclass=service_manager permissive=0


Bug: 158194857
Test: patched and tested on internal master
Change-Id: I30e9ea79a57d9c353b732b629bd5a829c89bbcb0
2020-09-23 10:57:19 +00:00
Benjamin Schwartz
dc505c51ea Merge "Create Power Stats AIDL interface" 2020-09-15 16:39:36 +00:00
Neil Fuller
dbc1ccac14 Add location_time_zone_manager_service
The LocationTimeZoneManagerService is being added as a "true" service so
that it can be invoked by a shell command (i.e. adb shell cmd). This
also means it will be dumped as part of dumpsys.

Test: Build only
Bug: 149014708
Change-Id: Ie60c4bea3af27a89b88ed753f9cf6e74aab04cd3
2020-09-14 15:19:02 +01:00
Benjamin Schwartz
af8b21a6d2 Create Power Stats AIDL interface
Bug: 162472196
Test: m
Merged-In: I948ef2959b25d776d3b01985fea5eb695fd4fc1e
Change-Id: I12dc33ce055c7275559cce33142cfb2aacc5471f
2020-09-10 22:34:49 -07:00
Ilya Matyukhin
c71c2993e9 Add sepolicy for IFingerprint
Bug: 152416783
Test: run on cuttlefish
Change-Id: I58d7c3bc9c81612b03bab3b9da938c091c02e3c1
2020-09-10 16:50:19 -07:00
Xin Li
11da9e6792 Merge Android R (rvc-dev-plus-aosp-without-vendor@6692709)
Bug: 166295507
Merged-In: I6d0b1be1a46288fff42c3689dbef2f7443efebcc
Change-Id: I133180d20457b9f805f3da0915e2cf6e48229132
2020-08-29 01:45:24 -07:00
Benjamin Schwartz
6b5deb1e3f Revert "Create Power Stats AIDL interface"
Revert "Fix sepolicy for con_monitor"

Revert submission 1404976-bs_ps_aidl

Reason for revert: Caused build breakages b/165908363
Reverted Changes:
I17883a16f:Fix sepolicy for con_monitor
Icd029f58a:Create Power Stats AIDL interface

Change-Id: Iab2a7ef6fcef40c59275db37b6fca090b304e9da
2020-08-21 15:35:25 +00:00
Benjamin Schwartz
ba876ef1b3 Create Power Stats AIDL interface
Bug: 162472196
Test: m
Merged-In: I948ef2959b25d776d3b01985fea5eb695fd4fc1e
(cherry picked from commit 550e376769)
Change-Id: Icd029f58a7babee0ad8249087b76683d104736d5
2020-08-20 23:25:55 +00:00
Yifan Hong
537ec551c8 Merge "Add update_engine_stable_service" 2020-08-04 19:06:08 +00:00
Yifan Hong
42351f9aab Add update_engine_stable_service
This is the stable AIDL binder interface that update_engine exposes in
addition to update_engine_service.

Test: run update_engine
Bug: 160996544

Change-Id: I28ba11810844373d48c8c203f79e98150f932942
2020-07-31 15:49:10 -07:00
Danning Chen
134ac19776 Add sepolicy for people service
This is to allow people service to publish a binder service that expose
system private APIs to retrive and manage the recent cached
conversations.

Test: build and run on a test device
Bug: 162593584
Change-Id: I31b5d8bc851ea7225e215b3f86ed6d47b32b1ba4
2020-07-31 14:37:47 -07:00
Amy Zhang
2ff7d07dfb Merge "Add app_api_service in TunerResourceManager system service sepolicy" into rvc-dev am: 9212c417f1
Original change: https://googleplex-android-review.googlesource.com/c/platform/system/sepolicy/+/11852496

Change-Id: Ib724b264d6f15f88a583a8f3db9858db40bc7a42
2020-06-17 17:55:15 +00:00
Amy Zhang
0379e48ecf Add app_api_service in TunerResourceManager system service sepolicy
Make TunerResourceManager accessible through CTS
Test: atest android.media.tv.tuner.cts
Bug: 158868205

Change-Id: Ica202eacd674ae8f05000b31b76b31c50d8f761c
2020-06-12 15:37:05 -07:00
Collin Fijalkovich
3227125cc7 Merge "Allow ActivityManagerService to start cacheDump service." into rvc-dev am: 148998495c
Change-Id: I0e0ec5fd5f6e1ad65682574451d9850febffae29
2020-05-18 20:59:01 +00:00
Collin Fijalkovich
77efb419f3 Allow ActivityManagerService to start cacheDump service.
Configures SELinux to allow ActivityManagerService to start a cacheinfo
service that is responsible for dumping per-process cache state.

Bug: 153661880
Test: adb shell dumpsys cacheinfo
Test: adb bugreport
Change-Id: Id6a4bdf2a9cb6d7f076b08706e0f91d377f38603
2020-05-13 11:20:10 -07:00
Inseob Kim
5131ff6544 DO NOT MERGE Add fake 30.0 prebuilts
This prebuilt is based on the AOSP policy, but slightly manipulated so
that the set of types and attributes are identical with R policy.

Following types are removed.

boot_status_prop
dalvik_config_prop
gnss_device
surfaceflinger_color_prop
surfaceflinger_prop
systemsound_config_prop
vold_config_prop
vold_status_prop

Following type is renamed.

wificond_service -> wifinl80211_service

Bug: 153661471
Test: N/A
Change-Id: I018d5e43f53c2bf721db1d13f5f4be42b9782b29
2020-05-11 13:18:52 +09:00
Rambo Wang
d52c69f2e6 Add policy to allow EmergencyAffordanceService to dump state
Bug: 130187110
Test: adb shell dumpsys emergency_affordance
Merged-In: I4dcc227ba949a02a0393999c8065f8bd8b981959
Change-Id: I4dcc227ba949a02a0393999c8065f8bd8b981959
(cherry picked from commit 25e527634a)
2020-04-20 19:48:22 +00:00
Rambo Wang
31f5ce5adb Merge "Add policy to allow EmergencyAffordanceService to dump state" am: 018214dd8e am: ad67e32182
Change-Id: I9f7025f79f8da4b9e18e27c629f2498c1fbf7e76
2020-04-17 16:05:08 +00:00
Rambo Wang
018214dd8e Merge "Add policy to allow EmergencyAffordanceService to dump state" 2020-04-17 15:19:54 +00:00
Treehugger Robot
2ea0a74a59 Merge "sepolicy: clean up redundant rules around gpuservice" am: 68598f7ff4 am: ec800dee2e
Change-Id: I0c2d85f2729c4f1816e4fef1c3f8678e469299b9
2020-04-15 18:43:07 +00:00
Yiwei Zhang
3db5a3140f sepolicy: clean up redundant rules around gpuservice
Test: m selinux_policy
Change-Id: I67389253aa3c6071a553e123fa9883cbdb331614
2020-04-15 09:24:16 -07:00
Rambo Wang
25e527634a Add policy to allow EmergencyAffordanceService to dump state
Bug: 152506122
Test: adb shell dumpsys emergency_affordance
Change-Id: I4dcc227ba949a02a0393999c8065f8bd8b981959
2020-04-14 14:54:52 -07:00
Amy
7f4526612d Adding sepolicy of tuner resource manager service
This is to allow adding the Tuner Resource Manager as a system service

Test: cuttlefish
Bug: 147380513
Change-Id: I3f61f2542c7fd934bb69dde08079f830196e2344
(cherry picked from commit 3791549dc4)
2020-02-24 13:59:46 -08:00
Automerger Merge Worker
070c384332 Merge "Adding sepolicy of tuner resource manager service" am: 1ddfce5fc6 am: 344aaa983c
Change-Id: I2f24486e041372f483fabb77d9f91b061eb1abb7
2020-02-23 04:13:34 +00:00
Amy
3791549dc4 Adding sepolicy of tuner resource manager service
This is to allow adding the Tuner Resource Manager as a system service

Test: cuttlefish
Bug: 147380513
Change-Id: I3f61f2542c7fd934bb69dde08079f830196e2344
2020-02-21 23:33:46 +00:00
Automerger Merge Worker
7934472245 Merge "Add SELinux policy for credstore and update for IC HAL port from HIDL to AIDL." am: 1948c11d13 am: 19516eb39f am: 5d5da562ba
Change-Id: Id5d55d29f52b7ed56c16de946c4c0e5fdf054f35
2020-02-19 23:18:16 +00:00
David Zeuthen
02bf814aa2 Add SELinux policy for credstore and update for IC HAL port from HIDL to AIDL.
The credstore service is a system service which backs the
android.security.identity.* Framework APIs. It essentially calls into
the Identity Credential HAL while providing persistent storage for
credentials.

Bug: 111446262
Test: atest android.security.identity.cts
Test: VtsHalIdentityTargetTest
Test: android.hardware.identity-support-lib-test
Change-Id: I5cd9a6ae810e764326355c0842e88c490f214c60
2020-02-19 13:46:45 -05:00
Etan Cohen
fde1dadc71 [WIFICOND] Rename service to nl80211
Per API council feedback.

Bug: 149105833
Bug: 148680192
Test: atest android.net.wifi
Test: atest com.android.server.wifi
Test: manual - flash/boot - verify Wi-Fi scan/associate
Change-Id: Idaf7603d4ab79ddde5c223097ed9fe8734299eea
2020-02-12 11:26:59 -08:00
Andrei Onea
25b39acefe Make platform_compat discoverable everywhere
The binder's methods are protected by signature
permissions (LOG_COMPAT_CHANGE, READ_COMPAT_CHANGE_CONFIG and
OVERRIDE_COMPAT_CHANGE_CONFIG).

This is a re-landing of https://r.android.com/1210143, which was
reverted due to http://b/142942524. The actual fix was done in
http://ag/10234812.

Bug: 142650523
Test: atest PlatformCompatGatingTest
Change-Id: Ibddac8933ea58d44457a5d80b540347e796ebe71
2020-02-06 12:11:37 +00:00
Andrei-Valentin Onea
606f3d7fcf Merge "Revert "Make platform_compat discoverable everywhere"" 2020-01-30 22:37:03 +00:00
Andrei-Valentin Onea
8a40e7c132 Revert "Make platform_compat discoverable everywhere"
Revert "Add new permissions to test"

Revert submission 1210143-platformcompat-permissions

Reason for revert: http://b/142942524
Reverted Changes:
I3601b12d5: Add new permissions to test
I65d425aac: Make platform_compat discoverable everywhere
I1c8cbb656: Add permissions for using PlatformCompat methods

Change-Id: I356c1d1c4d1213eea6e5585b23faa40722b1a01a
2020-01-30 21:38:35 +00:00
Andrei-Valentin Onea
88da0687fb Merge "Make platform_compat discoverable everywhere" 2020-01-28 12:04:43 +00:00
Andrei Onea
59da5e821f Make platform_compat discoverable everywhere
The binder's methods are protected by signature
permissions (READ_COMPAT_CHANGE_CONFIG and
OVERRIDE_COMPAT_CHANGE_CONFIG).

Bug: 142650523
Test: atest PlatformCompatTest
Test: atest CompatConfigTest
Test: atest OverrideValidatorImplTest
Change-Id: I65d425aacb120c6481076431151cf43ecab2509f
2020-01-24 17:01:37 +00:00
Ivailo Karamanolev
254d757289 Add rules for Lights AIDL HAL
Test: manual; yukawa and cuttlefish; adb logcat | grep -i avc
Bug: 142230898
Change-Id: I9f576511d1fc77c5f0ad3cf1b96b038b301773d7
2020-01-22 20:33:42 +01:00
Treehugger Robot
13722174b7 Merge "Add selinux contexts for system_config_service" 2020-01-16 22:41:42 +00:00
Wei Wang
32b24c0f0b stable aidl Power HAL policy
Test: boot and dumpsys -l
Change-Id: I58022c9e0c24ba4e2d695acf63375c9f74c51b22
2020-01-15 16:53:40 -08:00
Hall Liu
719bf1b8ca Add selinux contexts for system_config_service
Add selinux contexts for the new system config service.

Test: atest -it -w SystemConfigTest
Bug: 143112379
Change-Id: Ibe67acb404b6951e1fda9ce28bd50a0efdd44c5f
2020-01-15 11:15:29 -08:00
Jon Spivack
ae2df6b5de Add aidl_lazy_test_server
This is a test service for testing dynamic start/stop of AIDL services. In order to test realistic use cases with SELinux enabled, it requires the same permissions as a regular service.

Bug: 147153962
Test: aidl_lazy_test aidl_lazy_test_1 aidl_lazy_test_2
Change-Id: Ifc3b2eaefba9c06c94f9cf24b4474107d4e26563
2020-01-07 15:11:03 -08:00
Victor Hsieh
48a7b5a580 sepolicy: new file_integrity_service
Test: didn't see denials in dmesg during boot or API calls.
Bug: 142573505
Change-Id: Ifa271956bc51bf47d781cd9c9f95afb99c5f940f
2019-12-19 09:25:35 -08:00
Treehugger Robot
f1f79242f3 Merge "Allow application to find tethering service" 2019-12-17 10:45:45 +00:00