Commit graph

117 commits

Author SHA1 Message Date
Inseob Kim
d781909856 Merge "Remove 28.0 compat support" am: 1174fcf338 am: 9cf125cb34
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/2519755

Change-Id: Idc225a85b5b95d770e6367bc2d0c606225c5b8a4
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
2023-04-07 02:00:23 +00:00
Inseob Kim
d16612cd8a Remove 28.0 compat support
Treble doesn't support U system + P vendor, so removing P (28.0)
prebuilts and compat files.

Bug: 267692547
Test: build
Change-Id: I3734a3d331ba8071d00cc196a2545773ae6a7a60
2023-04-03 15:17:03 +09:00
Andy Hung
bd89baaecf Merge "sepolicy: Add spatial audio tuning properties." 2023-03-27 15:22:49 +00:00
Andy Hung
789c2937a5 sepolicy: Add spatial audio tuning properties. am: 574369e474
Original change: https://googleplex-android-review.googlesource.com/c/platform/system/sepolicy/+/22241161

Change-Id: I00a6e7937068ee8a3006223ba6d320c90a73321e
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
2023-03-24 04:22:53 +00:00
Andy Hung
16a79f885d sepolicy: Add spatial audio tuning properties.
audio.spatializer.pose_predictor_type
audio.spatializer.prediction_duration_ms

Test: compiles
Test: adb shell setprop with invalid enum fails.
Bug: 274849680
Merged-In: Ie7e656acbdd3fe101ecbd2cc9dfb6c8a440a6a8b
Change-Id: Ie7e656acbdd3fe101ecbd2cc9dfb6c8a440a6a8b
2023-03-23 20:56:59 -07:00
Andy Hung
574369e474 sepolicy: Add spatial audio tuning properties.
audio.spatializer.pose_predictor_type
audio.spatializer.prediction_duration_ms

Ignore-AOSP-First: will land in AOSP later.
Test: compiles
Test: adb shell setprop with invalid enum fails.
Bug: 274849680
Change-Id: Ie7e656acbdd3fe101ecbd2cc9dfb6c8a440a6a8b
2023-03-23 18:01:42 -07:00
Andy Hung
64a1d36e3d Merge "sepolicy: Add spatial audio configuration properties" into tm-qpr-dev am: 816d7372d3
Original change: https://googleplex-android-review.googlesource.com/c/platform/system/sepolicy/+/22142639

Change-Id: I0f164623b16f992ca90a10c07d86781934b29775
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
2023-03-22 12:55:52 +00:00
Andy Hung
03c348df74 sepolicy: Add spatial audio configuration properties
Controls default enable or disable for binaural and transaural.

Test: see bug
Bug: 270980127
Merged-In: I190644e88a520cf13ee2b56066d5afd258460b9e
Change-Id: I190644e88a520cf13ee2b56066d5afd258460b9e
2023-03-21 15:08:27 -07:00
Andy Hung
816d7372d3 Merge "sepolicy: Add spatial audio configuration properties" into tm-qpr-dev 2023-03-21 17:53:50 +00:00
Ioannis Ilkos
865d0883ac Merge changes from topic "tm-qpr-oome-perfetto" into tm-qpr-dev am: 37883b47f8
Original change: https://googleplex-android-review.googlesource.com/c/platform/system/sepolicy/+/21986580

Change-Id: I66f23e61f789b8a18f44f6a68af9f399e9d06be0
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
2023-03-20 11:02:24 +00:00
Ioannis Ilkos
ad1c3e4200 Merge changes from topic "tm-qpr-syssrv-perfetto" into tm-qpr-dev am: a6494f6163
Original change: https://googleplex-android-review.googlesource.com/c/platform/system/sepolicy/+/21986577

Change-Id: I37e9725ed27177234f34357ebacd27e1c648dfec
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
2023-03-20 11:01:53 +00:00
Andy Hung
3b7b6c3b30 sepolicy: Add spatial audio configuration properties
Controls default enable or disable for binaural and transaural.

Ignore-AOSP-First: will land in AOSP afterwards
Test: see bug
Bug: 270980127
Change-Id: I190644e88a520cf13ee2b56066d5afd258460b9e
2023-03-17 14:58:36 -07:00
Ioannis Ilkos
c3fa8c0d82 update api=33 sepolicy prebuilts for perfetto oome heap dumps
Bug: 272719059
Ignore-AOSP-First: tm-qpr-dev backports
Change-Id: I7e0703ce8fb8fb46217f67046c19fb71653bc86e
2023-03-13 17:48:46 +00:00
Ryan Savitski
be99ac546a update api=33 sepolicy prebuilts for perfetto profiling of system_server and sys/platform apps
Bug: 272719059
Ignore-AOSP-First: tm-qpr-dev backports
Change-Id: Iadee4b1a04d032e901b58bc76a0b658782fe027f
2023-03-13 17:14:04 +00:00
David Duarte
1d17625658 Update prebuilt to add bluetooth_prop to system_server sepolicy. am: c9530bbdfd
Original change: https://googleplex-android-review.googlesource.com/c/platform/system/sepolicy/+/21359400

Change-Id: Idadf25b8631d21ab7eaa3834c500419253a7edb9
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
2023-02-15 07:23:13 +00:00
David Duarte
c9530bbdfd Update prebuilt to add bluetooth_prop to system_server sepolicy.
Ignore-AOSP-First: Update after cherry-pick from AOSP
Fix: 268537356
Test: None
Change-Id: I72ad993e73b31045ce529e108b143e890955a167
2023-02-10 00:27:32 +00:00
Hongwei Wang
95f1221fc1 Allow platform_app:systemui to write protolog file
This is enabled on debuggable builds only, includes
- Grant mlstrustedobject typeattribute to wm_trace_data_file
- Grant platform_app (like systemui) the write access to
  wm_trace_data_file

Bug: 251513116
Test: adb shell dumpsys activity service SystemUIService \
      WMShell protolog [start | stop]
Ignore-AOSP-First: cherry-pick of aosp/2397593
Merged-In: I9f77f8995e4bf671616ce6c49eeb93720e31430e
Change-Id: I9f77f8995e4bf671616ce6c49eeb93720e31430e
2023-02-08 18:30:30 +00:00
Hongwei Wang
7476ab79ff Merge "Allow platform_app:systemui to write protolog file" am: f4979adab7
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/2397593

Change-Id: Id077867308be1b610fd4b12ed50e87908bd5e8d2
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
2023-01-31 20:58:01 +00:00
Kalesh Singh
eb1a50003c suspend: Allow access to /sys/power/wake_[un]lock
This is needed to prevent autosuspend when the framework is restarting
See: go/no-suspend-deadlocks

Bug: 255898234
Bug: 265513788
Bug: 266077359
Test: Check logcat for avc denials
Change-Id: I6313e28d0f2e4bc553881fcc3742dc74ca319b44
Merged-In: I6313e28d0f2e4bc553881fcc3742dc74ca319b44
2023-01-25 16:39:05 -08:00
Hongwei Wang
9372026ad2 Allow platform_app:systemui to write protolog file
This is enabled on debuggable builds only, includes
- Grant mlstrustedsubject typeattribute to wm_trace_data_file
- Grant platform_app (like systemui) the write access to
  wm_trace_data_file

Bug: 251513116
Test: adb shell dumpsys activity service SystemUIService \
      WMShell protolog [start | stop]
Change-Id: I9f77f8995e4bf671616ce6c49eeb93720e31430e
2023-01-24 16:30:57 -08:00
Kalesh Singh
3316353002 Merge "Allow update_verifier to connect to snapuserd daemon" into tm-qpr-dev 2023-01-10 17:08:09 +00:00
Akilesh Kailash
abeeb42d0f Allow update_verifier to connect to snapuserd daemon
Bug: 193863442
Bug: 261913544
Test: OTA
Signed-off-by: Akilesh Kailash <akailash@google.com>
Merged-In: I10cb900466078930c9124fc381ba2adfc50ffcd4
Change-Id: I10cb900466078930c9124fc381ba2adfc50ffcd4
2023-01-09 13:19:20 -08:00
Bill Yi
15ee6d11bc Merge TQ1A.230105.002 to aosp-master - DO NOT MERGE
Merged-In: I9acac60411da6eee86246a9e375b35dfb61691d1
Merged-In: If343dba5dae2821fa345135abafb891e85be5574
Change-Id: Ia868a5a11f13d47bf11fbb21b3d5cee12d7c8c99
2023-01-06 07:13:50 -08:00
Andy Hung
a8b6900a49 audio HAL: SELinux changes for Spatial Audio optimization
Add CAP_SYS_NICE.
Reduce glitches caused by core migration.
Reduce power consumption as Spatializer Effect is DSP compute bound.

Test: instrumented
Test: adb shell 'uclampset -a -p $(pgrep -of android.hardware.audio.service)'
Test: adb shell cat "/proc/$(adb shell pgrep -of android.hardware.audio.service)/status"
Test: adb shell 'ps -Tl -p $(pgrep -of android.hardware.audio.service)'
Bug: 181148259
Bug: 260918856
Bug: 261228892
Bug: 261686532
Bug: 262803152
Ignore-AOSP-First: tm-qpr-dev fix, will move to AOSP afterwards.
Merged-In: Id5f052116834034a9e4fd5c3adf17d3d7ef6610a
Change-Id: Id5f052116834034a9e4fd5c3adf17d3d7ef6610a
2022-12-28 16:55:07 -08:00
Andy Hung
7a0d4f0c6c Merge "audio HAL: SELinux changes for Spatial Audio optimization" into tm-qpr-dev am: 5190b9b589
Original change: https://googleplex-android-review.googlesource.com/c/platform/system/sepolicy/+/20612611

Change-Id: If12fd121484ec20231e7f32636610832cd2f6db1
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
2022-12-17 04:05:42 +00:00
Andy Hung
2461bf39bd audio HAL: SELinux changes for Spatial Audio optimization
Add CAP_SYS_NICE.
Reduce glitches caused by core migration.
Reduce power consumption as Spatializer Effect is DSP compute bound.

Test: instrumented
Test: adb shell 'uclampset -a -p $(pgrep -of android.hardware.audio.service)'
Test: adb shell cat "/proc/$(adb shell pgrep -of android.hardware.audio.service)/status"
Test: adb shell 'ps -Tl -p $(pgrep -of android.hardware.audio.service)'
Bug: 181148259
Bug: 260918856
Bug: 261228892
Bug: 261686532
Bug: 262803152
Ignore-AOSP-First: tm-qpr-dev fix, will move to AOSP afterwards.
Change-Id: Id5f052116834034a9e4fd5c3adf17d3d7ef6610a
2022-12-16 12:08:17 -08:00
Austin Borger
20017dd6fd Create a new system property for the landscape to portrait override. am: 3299216872
Original change: https://googleplex-android-review.googlesource.com/c/platform/system/sepolicy/+/20580418

Change-Id: Ie5845cb9a9a7a2c0d79a4c76b9179de272b7770f
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
2022-12-09 00:29:13 +00:00
Austin Borger
3299216872 Create a new system property for the landscape to portrait override.
Apps commonly do not handle landscape orientation cameras correctly. In
order to prevent stretching and rotation issues in these apps, this
patch adds a flag to override the behavior of these landscape cameras
to produce a portrait image instead by changing the SENSOR_ORIENTATION
reported by CameraCharacteristics and applying a 90 degree rotate and
crop.

The camera2 framework needs to be able to turn this on only for certain
devices. Hence, this patch adds a system property for it.

Test: Ran on foldable device with several camera apps to verify behavior.
Bug: 250678880
Change-Id: I13783d81f5fada71805865a840e4135580f1d876
Merged-In: I13783d81f5fada71805865a840e4135580f1d876
2022-12-05 21:07:50 -08:00
Alessandra Loro
8e9a03e4a3 Drop back-compatibility for hiding ro.debuggable and ro.secure
Ignore-AOSP-First: cherry-pick for tm-qpr-dev
Bug: 193912100
Test: N/A for cherry-pick
Change-Id: I47f2ddc4fa87bf6c8f872d2679348b2eecddcaad
Merged-In: I47f2ddc4fa87bf6c8f872d2679348b2eecddcaad
2022-11-17 19:24:09 +00:00
Alessandra Loro
9fd568871e Disallow untrusted apps to read ro.debuggable and ro.secure
ro.secure and ro.debuggable system properties are not intended
to be visible via Android SDK. This change blocks untrusted
apps from reading these properties.

Test: n/a  for cherry-pick
Ignore-AOSP-First: cherry-pick for tm-qpr-dev
Bug: 193912100
Change-Id: I40ac5d43da5778b5fa863b559c28e8d72961f831
Merged-In: I40ac5d43da5778b5fa863b559c28e8d72961f831
2022-11-17 15:52:13 +00:00
Chris Paulo
d22ef9a1ae system/sepolicy: Update prebuilts for adaptive haptics system prop am: 272f84ebb5
Original change: https://googleplex-android-review.googlesource.com/c/platform/system/sepolicy/+/20469962

Change-Id: I45394ed8306e8654034bbcb201bde437bab2744d
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
2022-11-16 20:52:17 +00:00
Chris Paulo
272f84ebb5 system/sepolicy: Update prebuilts for adaptive haptics system prop
Update prebuilts and api compat for the adaptive haptics restricted
system property.

Bug: 198239103
Test: Verified functionality
Ignore-AOSP-First: Prebuilts on top of aosp/2300027
Change-Id: I2e299053cc2ebdb5d69aa8d3551e602609daaeaf
Signed-off-by: Chris Paulo <chrispaulo@google.com>
2022-11-16 17:12:30 +00:00
Pete Bentley
1ce5ed5d46 Update sepolicy prebuilts for PRNG seeder changes.
Cherry-pick note: This contains the original AOSP change plus
an addition to private/compat/32.0/32.0.ignore.cil which
does not _appear_ to be required on AOSP and future releases
but is required for tm-dev.  If needed we can add this to
AOSP later.

Bug: 243933553
Test: m sepolicy_freeze_test
Change-Id: Idc011c66dfe71aa6c8dfdbc0b0377d2957571b83
Merged-In: Idc011c66dfe71aa6c8dfdbc0b0377d2957571b83
(cherry picked from commit 96268c6622)
(cherry picked from commit ff0cf6f2a8)
Merged-In: Idc011c66dfe71aa6c8dfdbc0b0377d2957571b83
2022-11-15 01:50:27 +00:00
Akilesh Kailash
fc9647264a Merge "Supress permissive audit messages post OTA reboot" am: 9f7ab3c0cf
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/2166090

Change-Id: I476e1687df7cbb231bd69d8d8ca8125cf82b3cca
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
2022-10-11 21:27:48 +00:00
Akilesh Kailash
1044702704 Supress permissive audit messages post OTA reboot
For post-OTA boot, we run a userspace block device daemon to mount /system.
However if we let the daemon run while loading sepolicy, it would spam permissive audits.
Since sepolicy is still not enforced yet, we can supress these
audit messages.

Bug: 240321741
Test: Full OTA on pixel
Signed-off-by: Akilesh Kailash <akailash@google.com>
Change-Id: I0af484f95b6a1deb41498d67de82afd3c6bb29b6
2022-10-10 21:58:41 +00:00
Xin Li
a563c2c4f4 Merge tm-qpr-dev-plus-aosp-without-vendor@9129937
Bug: 248070379
Merged-In: I7e89cfb4fb8a1ce845eaea64a33dbaad6bff9969
Change-Id: I5279b8730d4d19cd1f0ec9c4b107030e4e41b36a
2022-10-06 12:03:38 -07:00
Pete Bentley
ff0cf6f2a8 Update sepolicy prebuilts for PRNG seeder changes.
Cherry-pick note: This contains the original AOSP change plus
an addition to private/compat/32.0/32.0.ignore.cil which
does not _appear_ to be required on AOSP and future releases
but is required for tm-dev.  If needed we can add this to
AOSP later.

Bug: 243933553
Test: m sepolicy_freeze_test
Change-Id: Idc011c66dfe71aa6c8dfdbc0b0377d2957571b83
Merged-In: Idc011c66dfe71aa6c8dfdbc0b0377d2957571b83
(cherry picked from commit 96268c6622)
2022-10-04 15:02:53 +01:00
Pete Bentley
96268c6622 Update sepolicy prebuilts for PRNG seeder changes.
Bug: 243933553
Test: m sepolicy_freeze_test
Change-Id: Idc011c66dfe71aa6c8dfdbc0b0377d2957571b83
2022-10-04 14:29:12 +01:00
Ryan Savitski
1236e326a0 perfetto profiling: fix access to ART apex files
The profilers cannot open files under
/data/misc/apexdata/com.android.art/dalvik-cache because they're not
allowed to search /data/misc/apexdata with the apex_module_data_file
label.

Example denial:
  avc: denied { search } for name="apexdata" dev="dm-37" ino=89
  scontext=u:r:traced_perf:s0
  tcontext=u:object_r:apex_module_data_file:s0 tclass=dir permissive=0

(cherry-picked from aosp + updated prebuilts)

Tested: patched & flashed onto a TM device, then profiled system_server
Bug: 241544593
Merged-In: Ifd8b94a9ebcae09701e95f6cd6a14383209963db
Change-Id: Ifd8b94a9ebcae09701e95f6cd6a14383209963db
(cherry picked from commit 3f3e222527)
2022-08-19 11:34:48 +01:00
Mitch Phillips
2438114ece Merge "Add API level 33 persistent GWP-ASan Sysprop" into tm-qpr-dev 2022-08-17 17:58:10 +00:00
Richard Chang
6d5bb236da Merge "sepolicy: allow vendor system native boot experiments property" 2022-08-17 06:29:30 +00:00
Richard Chang
5dd28a9ef8 sepolicy: allow vendor system native boot experiments property am: f9d66684a6
Original change: https://googleplex-android-review.googlesource.com/c/platform/system/sepolicy/+/19591236

Change-Id: I4e321ba6bb72926db1afc0648e27dae6ddd3e5fe
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
2022-08-15 02:39:45 +00:00
Richard Chang
f9d66684a6 sepolicy: allow vendor system native boot experiments property
Grant system_server and flags_health_check permission to set the
properties that correspond to vendor system native boot experiments.

Ignore-AOSP-First: Will cherry-pick to aosp/2183135
Bug: 241730607
Test: Build
Change-Id: Idc2334534c2d42a625b451cfce488d7d7a651036
2022-08-12 03:21:26 +00:00
Richard Chang
74334efa4b sepolicy: allow vendor system native boot experiments property
Grant system_server and flags_health_check permission to set the
properties that correspond to vendor system native boot experiments.

Bug: 241730607
Test: Build
Merged-In: Idc2334534c2d42a625b451cfce488d7d7a651036
Change-Id: I3e98f1b05058245cad345061d801ecd8de623109
2022-08-11 08:03:42 +00:00
Garfield Tan
d6c002c10b Allow zygote to read persist.wm.debug.* prop
Window manager team wants to leverage system properties for feature
flags that need to be read in ViewRootImpl and other classes preloaded
in Zygote. Appdomain is allowed to read that permission in commit
I5808bf92dbba37e9e6da5559f8e0a5fdac016bf3.

Bug: 241464028
Test: Zygote can preload persist.wm.debug.* props.
Ignore-AOSP-First: Cherry pick of aosp/2175950
Change-Id: I0c2ae63db53530c1facd8c2132f99c0d919b4ad8
Merged-In: I0c2ae63db53530c1facd8c2132f99c0d919b4ad8
2022-08-04 15:12:42 -07:00
Treehugger Robot
a79cfaeb4d Merge "Add API level 33 persistent GWP-ASan Sysprop" am: 1d538e9b22 am: 0930d82c76 am: 5e00816491
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/2147179

Change-Id: I6086a1574ecae94a6c809b76d95eec57d8d0144a
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
2022-08-03 06:30:11 +00:00
Treehugger Robot
0930d82c76 Merge "Add API level 33 persistent GWP-ASan Sysprop" am: 1d538e9b22
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/2147179

Change-Id: Iff91be573efa4b3b37a2256a334daa66018f35d0
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
2022-08-03 05:11:02 +00:00
Mitch Phillips
d8b81419cb Add API level 33 persistent GWP-ASan Sysprop
Looks like this is needed for TM.

Bug: 236738714
Test: atest bionic-unit-tests && presubmit ag/19136924 PS#3
Change-Id: Ida26db898f2edaddce67ae13a5859115126a18cb
Merged-In: Ida26db898f2edaddce67ae13a5859115126a18cb
2022-08-03 05:05:32 +00:00
Treehugger Robot
1d538e9b22 Merge "Add API level 33 persistent GWP-ASan Sysprop" 2022-08-03 04:41:57 +00:00
Siarhei Vishniakou
a4fb5a7890 Allow system_server to signal InputProcessor HAL am: a445318b8f
Original change: https://googleplex-android-review.googlesource.com/c/platform/system/sepolicy/+/19283101

Change-Id: I4cace6896b99170a07b7bb07f414aa4844f68833
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
2022-07-14 19:37:52 +00:00