Commit graph

562 commits

Author SHA1 Message Date
Sandeep Dhavale
d64fb55474 Merge "Fastboot AIDL Sepolicy changes" 2022-11-10 18:29:00 +00:00
Sandeep Dhavale
f0ea953e60 Fastboot AIDL Sepolicy changes
Bug: 205760652
Test: Build & flash
Change-Id: I2709c5cc2ca859481aac6fecbc99fe30a52a668b
Signed-off-by: Sandeep Dhavale <dhavale@google.com>
2022-11-09 22:21:27 +00:00
Lakshman Annadorai
4d277b7baa Revert "Add sepolicies for CPU HAL."
This reverts commit f4ab6c9f3c.

Reason for revert: CPU HAL is no longer required because the CPU frequency sysfs files are stable Linux Kernel interfaces and could be read directly from the framework.

Change-Id: I8e992a72e59832801fc0d8087e51efb379d0398f
2022-11-09 16:47:07 +00:00
Lakshman Annadorai
f4ab6c9f3c Add sepolicies for CPU HAL.
Change-Id: Ia091bf8f597a25351b5ee33b2c2afc982f175d51
Test: Ran `m; emulator; adb logcat -b all -d > logcat.txt;`
      and verified CPU HAL is running without any sepolicy violation.
Bug: 252883241
2022-11-04 18:13:00 +00:00
Treehugger Robot
e6a43ec4c9 Merge "Add selinux rules for android.hardware.usb.gadget.IUsbGadget AIDL migration" 2022-10-27 14:03:48 +00:00
Ricky Niu
fc1463c164 Add selinux rules for android.hardware.usb.gadget.IUsbGadget AIDL migration
Covers the rules needed for the default AIDL implementation.

10-26 10:22:42.408   448   448 I auditd  : type=1400 audit(0.0:95): avc: denied { read } for comm="android.hardwar" name="interrupts" dev="proc" ino=4026531995 scontext=u:r:hal_usb_gadget_default:s0 tcontext=u:object_r:proc_interrupts:s0 tclass=file permissive=0

Bug: 218791946
Test: reboot and check if AIDL service is running.

Signed-off-by: Ricky Niu <rickyniu@google.com>
Change-Id: I8bdab3a682398f3c7e825a8894f45af2a9b6c199
2022-10-27 15:42:56 +08:00
Henry Fang
0c3f615602 Merge "Allow CAS AIDL sample HAL" 2022-10-25 16:38:20 +00:00
Arthur Ishiguro
3002f1afe2 Merge "Add sepolicy for default Context Hub HAL access to stats service" 2022-10-20 16:29:32 +00:00
Arthur Ishiguro
ca5474c5cf Add sepolicy for default Context Hub HAL access to stats service
Bug: 254328944
Test: Verify no selinux error through logcat
Change-Id: Iebc7e6c42a99d091dd1afcc5ff0204bd6f3c71e7
2022-10-19 16:49:01 +00:00
Treehugger Robot
4a5c2dee68 Merge "Add policies for new services HDMI and HDMICEC" 2022-10-19 02:58:03 +00:00
Steven Moreland
586703a90c Merge "servicemanager: kernel log perms" 2022-10-18 20:06:41 +00:00
Steven Moreland
5c3f315771 servicemanager: kernel log perms
Bug: 210919187
Fixes: 235390578
Test: boot (logs still only show up sometimes)
Change-Id: I16b9814260103ce550836655d0409d43b8850ea0
2022-10-17 21:30:50 +00:00
Treehugger Robot
184064cd13 Merge "Add selinux policy to register remote access HAL." 2022-10-15 03:13:07 +00:00
Shraddha Basantwani
bacf949002 Allow CAS AIDL sample HAL
Bug: 230377377, 227673974
Test: manual
Change-Id: Ied6822d8114404b85dbed56ae4806de1bfb43e54
2022-10-12 19:42:20 +05:30
Venkatarama Avadhani
38ff3b4115 Add policies for new services HDMI and HDMICEC
Test: atest vts_treble_vintf_framework_test
      atest vts_treble_vintf_vendor_test
Change-Id: Ic2c0525368218e207be236d073a3fe736151c43f
2022-10-10 15:40:42 +05:30
Yu Shan
941ab0a90b Add selinux policy to register remote access HAL.
All remote access HAL needs to register itself to service manager,
so add the policy to system/sepolicy/vendor.

Test: Manually run cf_x86_64_auto, verify remote access HAL is
running.
Bug: 241483300

Change-Id: If8c1162eecfcce4792e6309ba351c498e8117687
2022-10-07 13:29:22 -07:00
Peiyong Lin
4a5d0f13c4 Update SEPolicy for Thermal AIDL
Bug: b/205762943
Test: build and boot
Change-Id: I301b85dafbf8fbb1c4be388aa0291e22f4717c99
2022-10-05 00:55:20 +00:00
Yu Shan
e799e9284c Merge "Create selinux policy for remoteaccess HAL." 2022-09-22 01:17:00 +00:00
Weilin Xu
52546635b2 Applying new IBroadcastRadio AIDL
Update Sepolicy for AIDL broadcast radio HAL. Ignore
fuzzer default AIDL implementation for now.

Bug: 170336130
Test: m -j
Change-Id: Ie55c08c6a721de1f8dc40acc81de68565f99f7d7
2022-09-21 23:17:20 +00:00
Yu Shan
05a7389aa9 Create selinux policy for remoteaccess HAL.
Will add fuzzer once the service is implemented.

Test: Run remoteaccess HAL on gcar_emu. Verify the service is running.
Bug: 241483300
Change-Id: I01b31a88414536ddd90f9098f422ae43a48cf726
2022-09-20 18:09:49 -07:00
Yixiao Luo
e83ae791aa TV Input HAL 2.0 sepolicy
Bug: 227673740
Test: atest VtsHalTvInputTargetTest
Change-Id: I53f6537a8f911661e368824a5a5dc5db57413980
2022-08-25 14:31:49 -07:00
Hongguang
9515559657 Add properties to configure whether the lazy tuner is enabled.
ro.tuner.lazyhal: system_vendor_config_prop to decide whether the lazy
tuner HAL is enabled.
tuner.server.enable: system_internal_prop to decide whether tuner server
should be enabled.

Bug: 236002754
Test: Check tuner HAL and framework behavior
Change-Id: I6a2ebced0e0261f669e7bda466f46556dedca016
2022-08-23 07:01:05 +00:00
Shunkai Yao
3a6c68f2ba AIDL effect: Add default Effect factory implementation to platform sepolicy
Add example implementation services: IFactory under android.hardware.audio.effect.
An audio HAL AIDL example service will register with the default implementations.

Bug: 238913361
Test: m, and flash with Pixel 6a.

Change-Id: Ib331899fd47b6b334b120e20617174d01e71ddb8
2022-08-22 19:27:26 +00:00
Kelvin Zhang
f70d708544 Merge "Add proper permission for AIDL bootcontrol server" 2022-06-23 23:44:39 +00:00
Kelvin Zhang
65d6bf5391 Add proper permission for AIDL bootcontrol server
Bug: 227536004
Test: th
Change-Id: I6aff2742fb23bf7e7ce8d09493f02c4be9262fd3
2022-06-22 13:38:01 -07:00
Avichal Rakesh
3baabb9157 Allow camera provider services following AIDL naming conventions
Android 13 moved to using AIDL for HALs, which have different version
and naming conventions as compared to the new deprecated HIDL. This CL
updates the regex to include camera provider implementations that follow
AIDL naming conventions in the allowlist.

Bug: 219974678
Test: Manually tested that AIDL implementation is allowed to run
Change-Id: Ic005703bdaaa6376ca4714f22f89271b2a8878f2
2022-06-14 22:39:54 +00:00
Vova Sharaienko
7816224ea2 Merge "hal_vehicle_default: enabled communication with statsd" 2022-06-09 22:51:21 +00:00
Kelvin Zhang
187cb2c64c Add sepolicy for IBootControl AIDL
Test: th
Bug: 227536004
Change-Id: I1206b4aae1aab904a76836c893ee583b5ce54624
2022-06-07 16:26:19 -07:00
Vova Sharaienko
5aa340abc2 hal_vehicle_default: enabled communication with statsd
Bug: 233754988
Test: build & boot, logcat | grep SELinux
Change-Id: I92ca95e0088550677baab64fcc36afdc8845e2fc
2022-06-06 19:00:01 +00:00
Joshua McCloskey
f42a5c953b Add sysprops for virtual Fingerprint/Face HAL
Test: Manually verified virtual Fingerprint/Face HAL could set/get props
Bug: 230514750
Change-Id: I7ab5ff81d128b486ef181824c67cfa0ded230e08
2022-05-13 22:52:50 +00:00
Rick Chen
8cb9f4385d Add sensor multi-HAL AIDL sepolicy
Bug: 228525902
Test: Device can boot to home.
Change-Id: I9d27967213df83b20cb49014317dcfb7afac1880
2022-04-22 01:49:26 +00:00
Jason Macnak
a93398051c Adds GPU sepolicy to support devices with DRM gralloc/rendering
... such as Cuttlefish (Cloud Android virtual device) which has a
DRM virtio-gpu based gralloc and (sometimes) DRM virtio-gpu based
rendering (when forwarding rendering commands to the host machine
with Mesa3D in the guest and virglrenderer on the host).

After this change is submitted, changes such as aosp/1997572 can
be submitted to removed sepolicy that is currently duplicated
across device/google/cuttlefish and device/linaro/dragonboard as
well.

Adds a sysfs_gpu type (existing replicated sysfs_gpu definitions
across several devices are removed in the attached topic). The
uses of `sysfs_gpu:file` comes from Mesa using libdrm's
`drmGetDevices2()` which calls into `drmParsePciDeviceInfo()` to
get vendor id, device id, version etc.

Bug: b/161819018
Test: launch_cvd
Test: launch_cvd --gpu_mode=gfxstream
Change-Id: I4f7d4b0fb90bfeef72f94396ff0c5fe44d53510c
Merged-In: I4f7d4b0fb90bfeef72f94396ff0c5fe44d53510c
2022-04-18 17:30:56 -07:00
Ilya Matyukhin
93b6949083 Fix fingerprint failing to start on GSI images
This fixes the following denial:

W/storageproxyd: type=1400 audit(0.0:4): avc: denied { create } for \
name="alternate" scontext=u:r:tee:s0 \
tcontext=u:object_r:tee_data_file:s0 tclass=dir permissive=0

Bug: 221173716
Test: flash vendor image + dsu gsi -> observe fingerprint HAL works
Change-Id: I8aff86dda159c3f023cd98d1e0ad38ba21e5e8c9
2022-04-11 22:44:54 -07:00
Treehugger Robot
288fee1744 Merge "Allow EVS HAL to use cardisplayproxyd" 2022-03-28 22:04:20 +00:00
Chris Weir
9e4f9120ee Merge "Allow wpa_supplicant to access Netlink Interceptor" 2022-03-28 21:47:48 +00:00
Chris Weir
6e92194802 Allow wpa_supplicant to access Netlink Interceptor
wpa_supplicant needs permission to access the Netlink Interceptor HAL.

Bug: 224844967
Test: Modified version of wpa_supplicant can access Netlink Interceptor
Change-Id: I80c6c980b6655beadfaf14535702ad8e96c2befe
2022-03-24 16:49:30 -07:00
Mikhail Naganov
676da7273f Add AIDL audio HAL service to SEPolicy
This adds the two top interfaces: IConfig and IModule
to service context, allows the HAL service to call
Binder, and registers the example implementation
service executable.

Bug: 205884982
Test: m
Change-Id: I322e813c96123167ea29b6c25a08ec9677c9b4d1
2022-03-24 01:39:29 +00:00
Changyeon Jo
3518c9e7f8 Allow EVS HAL to use cardisplayproxyd
This change adds selinux policies to allow EVS HAL implementations to
use cardisplayproxyd, which implements a stable AIDL version of the
automotive display proxy service interface.

Bug: 170401743
Bug: 217271351
Test: Manually confirm that evs_app renders the camera preview through
      cardisplayproxyd
Change-Id: Ia301b782c6c031fe8351bdcda5ce264da6b8aa4d
2022-03-23 12:35:28 +00:00
Stephane Lee
52862a32c1 Add sepolicies to allow hal_health_default to load BPFs.
Bug: 203462310
Test: Ensure that the BPF filter can be loaded
Change-Id: Ib507d4c1718dd56fb336501ed7598de7b44a687b
2022-03-21 12:54:49 -07:00
Robert Shih
ec7f4244e8 clearkey aidl file_contexts: update path regex
Bug: 221078453
Change-Id: Ic7c0e5a68554f254afb7fbe886fce106c34056ff
2022-03-09 22:57:12 +00:00
Changyeon Jo
8c4ebe21f5 Allow EVS HAL to access data from surfaceflinger
Bug: 216727303
Test: m -j selinux_policy
Change-Id: Id89a99372e334c87cd1c80c06b5b695e5c8d69e6
2022-03-07 15:42:17 +00:00
Ankit Goyal
2736da21a4 Add sepolicy for graphics IAllocator AIDL based HAL
Bug: 217776226
Bug: 218383959
Test: Boots to home with the new HAL
Change-Id: I8d0d2182d389c39b54f492d4d6df64ca14737997
2022-02-24 17:14:29 -08:00
Changyeon Jo
eacb1095a8 Revert^2 "Updates sepolicy for EVS HAL"
418f41ad13

Bug: 216727303
Test: m -j selinux_policy on failed targets reported
      in b/218802298
Change-Id: Iec8fd2a1e9073bf3dc679e308407572a8fcf44d9
2022-02-10 17:21:54 +00:00
Mohammed Rashidy
418f41ad13 Revert "Updates sepolicy for EVS HAL"
Revert submission 1967140-EVS_sepolicy_updates_T

Reason for revert: triggered revert due to breakage https://android-build.googleplex.com/builds/quarterdeck?branch=git_master&target=cf_x86_64_auto-userdebug&lkgb=8168894&lkbb=8168958&fkbb=8168947, bug b/218802298
Reverted Changes:
I730d56ab1:Allows hal_evs_default to read directories
I2df8e10f5:Updates sepolicy for EVS HAL
Ie6cb3e269:Adds a sepolicy for EVS manager service

Change-Id: I1cc37b0e56646db61bdb34cb209aefe7376c5a50
2022-02-10 10:07:44 +00:00
Changyeon Jo
a083d7a8d8 Updates sepolicy for EVS HAL
This CL updates hal_evs_default to be sufficient for the defautl EVS HAL
implementation and modifies other services' policies to be able to
communicate with EVS HAL implementations

Bug: 217271351
Test: m -j selinux_policy and Treehugger
Change-Id: I2df8e10f574d62f8b84e0ff0381656ab1b18b52f
2022-02-10 01:42:59 +00:00
Robert Shih
d70f0af2bf Merge "Add sepolicy for DRM AIDL HAL" 2022-01-28 18:40:53 +00:00
Seth Moore
9e2ff8d975 Merge "Revert^2 "Allow default identity service to call keymint"" 2022-01-27 18:18:12 +00:00
Robert Shih
4968374205 Add sepolicy for DRM AIDL HAL
Bug: 208486736
Test: atest VtsAidlHalDrmTargetTest
Change-Id: Ia2b1488a564d94384d183d30291fbf5a6d2df4ab
2022-01-27 01:51:05 -08:00
Seth Moore
ea3b7e8938 Revert^2 "Allow default identity service to call keymint"
5a1e60c090

Change-Id: Ia04a96e6b5ce89b8ef5f34c33279e58c4de6430c
2022-01-25 23:04:37 +00:00
Seth Moore
c725aaf974 Merge "Revert "Allow default identity service to call keymint"" 2022-01-25 23:03:24 +00:00