This CL the selinux rules for the property ro.usb.uvc.enabled which will
be used to toggle UVC Gadget functionality on the Android Device.
Bug: 242344221
Bug: 242344229
Test: Manually tested that the property can only be read at runtime,
not written to.
Change-Id: I0fd6051666d9554037acc68fa81226503f514a45
installd needs to kill profman if profman times out.
Bug: 242352919
Test: -
1. Add an infinate loop to profman.
2. Run `adb shell pm compile -m speed-profile com.android.chrome`
3. See profman being killed after 1 minute.
Change-Id: I71761eaab027698de0339d855b9a436b56580ed8
am skip reason: Merged-In I916c9795d96e4a4a453f9aed5e380f11981804e9 with SHA-1 813483e069 is already in history
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/2402006
Change-Id: I10162b5368f944d94c670926edf4002d4823a7ce
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
am skip reason: Merged-In I916c9795d96e4a4a453f9aed5e380f11981804e9 with SHA-1 813483e069 is already in history
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/2402006
Change-Id: Ifee6643e9c52631d661906e5cb3a5edb543b1ee5
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
am skip reason: Merged-In I916c9795d96e4a4a453f9aed5e380f11981804e9 with SHA-1 24d90e792e is already in history
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/2402006
Change-Id: I624f64455451c2db9a00ae9cfa588f53b0aeabd6
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
am skip reason: Merged-In I916c9795d96e4a4a453f9aed5e380f11981804e9 with SHA-1 813483e069 is already in history
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/2402006
Change-Id: I1e75918f68dfb4ba10a511c635f2313a5aa12857
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
am skip reason: Merged-In I916c9795d96e4a4a453f9aed5e380f11981804e9 with SHA-1 813483e069 is already in history
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/2402006
Change-Id: Ib50cc87e3afd8b0601164cc31dada2c29b5bc441
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
am skip reason: Merged-In I916c9795d96e4a4a453f9aed5e380f11981804e9 with SHA-1 24d90e792e is already in history
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/2402006
Change-Id: I0be31119235f8fa393f8aaf25af8aa10b2642121
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
am skip reason: Merged-In I916c9795d96e4a4a453f9aed5e380f11981804e9 with SHA-1 24d90e792e is already in history
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/2402006
Change-Id: I387d1a606d2f104e6cd85345966e3e88631c3be9
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
am skip reason: Merged-In I916c9795d96e4a4a453f9aed5e380f11981804e9 with SHA-1 24d90e792e is already in history
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/2402006
Change-Id: I270b951dd87754c9477b3d52f00b6dc21c9bc501
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
Brings in the io_uring class and associated restrictions and adds a new
macro, `io_uring_use`, to sepolicy.
In more detail, this change:
* Adds a new macro expands to ensure the domain it is passed can undergo a
type transition to a new type, `<domain>_iouring`, when the anon_inode
being accessed is labeled `[io_uring]`. It also allows the domain to
create, read, write, and map the io_uring anon_inode.
* Adds the ability for a domain to use the `IORING_SETUP_SQPOLL` flag
during `io_uring_setup` so that a syscall to `io_uring_enter` is not
required by the caller each time it wishes to submit IO. This can be
enabled securely as long as we don't enable sharing of io_uring file
descriptors across domains. The kernel polling thread created by `SQPOLL`
will inherit the credentials of the thread that created the io_uring [1].
* Removes the selinux policy that restricted all domains that make use of
the `userfault_fd` macro from any `anon_inode` created by another domain.
This is overly restrictive, as it prohibits the use of two different
`anon_inode` use cases in a single domain e.g. userfaultfd and io_uring.
This change also replaces existing sepolicy in fastbootd and snapuserd
that enabled the use of io_uring.
[1] https://patchwork.kernel.org/project/linux-security-module/patch/163159041500.470089.11310853524829799938.stgit@olly/
Bug: 253385258
Test: m selinux_policy
Test: cd external/liburing; mm; atest liburing_test; # requires WIP CL ag/20291423
Test: Manually deliver OTAs (built with m dist) to a recent Pixel device
and ensure snapuserd functions correctly (no io_uring failures)
Change-Id: I96f38760b3df64a1d33dcd6e5905445ccb125d3f
