Commit graph

19 commits

Author SHA1 Message Date
feiyuchen
70e1942fb3 Add SELinux policy for edgetpu_native device_config prop
The new android property namespace will store the configurations which are set on the server side and read by the EdgeTpu HAL.

Notes:
* This CL is similar to nnapi_native CL: https://android-review.git.corp.google.com/c/platform/system/sepolicy/+/1844919
* The read permission of EdgeTpu HAL will be added in another internal CL.

Test: mm
Bug: 243553703
Bug: 246401730
Change-Id: I5705f679148b313d919f334c51e31f7645aca82a
2023-02-13 21:55:57 +00:00
Florian Mayer
94926f51df [MTE] Add memory_safety_native_boot namespace
Bug: 267234468
Change-Id: I248fdf58a744f0c70a26d6a8f7d4caa0a6ce8edb
2023-01-31 15:48:40 -08:00
Mohi Montazer
ad059403ad SEPolicy updates for camera HAL
Updates SEPolicy files to give camera HAL permission to access
Android Core Experiment flags.

Example denials:
11-30 13:08:33.172  1027  1027 W binder:1027_3: type=1400 audit(0.0:7): avc: denied { read } for name="u:object_r:default_prop:s0" dev="tmpfs" ino=152 scontext=u:r:hal_camera_default:s0 tcontext=u:object_r:default_prop:s0 tclass=file permissive=0
11-30 13:08:33.172  1027  1027 W binder:1027_3: type=1400 audit(0.0:8): avc: denied { read } for name="u:object_r:default_prop:s0" dev="tmpfs" ino=152 scontext=u:r:hal_camera_default:s0 tcontext=u:object_r:default_prop:s0 tclass=file permissive=0
11-30 13:08:33.244  1027  1027 W 3AThreadPool:  type=1400 audit(0.0:9): avc: denied { read } for name="u:object_r:default_prop:s0" dev="tmpfs" ino=152 scontext=u:r:hal_camera_default:s0 tcontext=u:object_r:default_prop:s0 tclass=file permissive=0

Bug: 259433722
Test: m
Change-Id: I11165b56d7b7e38130698cf86d9739f878580a14
2022-12-13 09:52:04 -08:00
Vikram Gaur
e1c49f5524 Add SELinux policies for remote_key_provisioning_native namespace.
We need to separate out the feature flags in use by remote key
provisioning daemon (RKPD). For this, I have set up a new namespace
remote_key_provisioning_native. This change adds the SELinux policies to
make sure appropriate permissions are present when accessing the feature
flag for read/write.

Change-Id: I9e73a623f847a058b6236dd0aa370a7f9a9e6da7
Test: TreeHugger
2022-09-29 21:32:58 +00:00
Richard Chang
74334efa4b sepolicy: allow vendor system native boot experiments property
Grant system_server and flags_health_check permission to set the
properties that correspond to vendor system native boot experiments.

Bug: 241730607
Test: Build
Merged-In: Idc2334534c2d42a625b451cfce488d7d7a651036
Change-Id: I3e98f1b05058245cad345061d801ecd8de623109
2022-08-11 08:03:42 +00:00
Florian Mayer
5b3a8333af SELinux configuration for memory safety device configs.
These will get read by system libraries in arbitrary processes, so it's
a public property with read access by `domain`.

Bug: 235129567
Change-Id: I1ab880626e4efa2affe90165ce94a404b918849d
2022-06-15 10:34:54 -07:00
Richard Chang
1c8df204ff Merge "sepolicy: allow vendor system native experiments property" 2022-04-15 03:47:28 +00:00
Richard Chang
7057e4abca sepolicy: allow vendor system native experiments property
Grant system_server and flags_health_check permission to set the
properties that correspond to vendor system native experiments.

Bug: 226456604
Test: Build
Change-Id: Ib2420cf6eaf1645e7f938db32c93d085dd8950a3
2022-04-12 08:11:53 +00:00
Kalesh Singh
9e25714cd7 Add sepolicy for mglru_native flag namespace
Bug: 227651406
Bug: 228525049
Change-Id: I9311b23bd10573fcdb62aba65eb2c6e3d177b467
2022-04-08 13:37:34 -07:00
Andrew Scull
d7bed7733e Allow control of AVF experiments
Grant system_server and flags_health_check permission to set the
properties that correspond to the AVF experiments.

Bug: 192819132
Test: m
Change-Id: I0e6fa73187abb4412d07ecfd42c1074b8afa5346
2021-11-10 10:42:47 +00:00
Ian Hua
91d153e9b5 Update sepolicy for adding nnapi_native namespace.
Test: mm
Bug: 201399117
Change-Id: I40a2431b6f5a54deae27fe68f503aff9b99e2793
2021-10-12 11:50:26 +01:00
Suren Baghdasaryan
592e06c910 sepolicy updates for adding native flag namespace for lmkd
sepolicy updates for running lmkd experiments.

Bug: 194316048
Signed-off-by: Suren Baghdasaryan <surenb@google.com>
Change-Id: I21df3b76cce925639385111bd23adf419f026a65
2021-08-09 17:35:09 -07:00
rnlee
b6142ecc22 Add sepolicy SF native boot namespace.
Following go/android-native-flag-api-manual.

Bug: 190769260
Test: make.
Change-Id: I84fe7e9d046fbbe737f09043589b19e71981f521
2021-06-30 14:07:44 -07:00
Nick Chalko
81a4dd40d6 Add sepolicy swcodec native flag namespace.
Test: add sepolicy, build, check GetServerConfigurableFlag function
Bug: 179286276
Change-Id: Ia16d110900251b3fb3e3959d73524c8814199270
2021-02-16 09:22:16 -08:00
Xiao Ma
2d6c9f0fe8 Allow connectivity namespace to enable native level access flags.
Follow the steps: go/android-native-flag-api-manual

Bug: 179099277
Test: m -j
Test: manually verify connection to wifi after flash
Change-Id: Ieb5355d40aec9ed7a42b7ae5b250b696fcf00810
2021-02-04 05:31:33 +00:00
Tej Singh
dd0988fb9b Selinux changes for statsd flags
Test: manually verified statsd can get values using
GetServerConfigurableFlag
Bug: 172842175

Change-Id: I05cb2242dc758e32a22ddf30cb6f09088b70f5d4
2020-11-17 19:28:41 -08:00
Yi Kong
0ac00727c3 Configs for profcollect system properties
Test: build
Bug: 79161490
Change-Id: I83362b2089a54c4dcbf8da5a7720da8529ba1e34
2020-10-27 03:46:31 +08:00
Inseob Kim
55e5c9b513 Move system property rules to private
public/property split is landed to selectively export public types to
vendors. So rules happening within system should be in private. This
introduces private/property.te and moves all allow and neverallow rules
from any coredomains to system defiend properties.

Bug: 150331497
Test: system/sepolicy/tools/build_policies.sh
Change-Id: I0d929024ae9f4ae3830d4bf3d59e999febb22cbe
Merged-In: I0d929024ae9f4ae3830d4bf3d59e999febb22cbe
(cherry picked from commit 42c7d8966c)
2020-03-18 16:46:04 +00:00
Hongyi Zhang
a6f989241b sepolicy for server configurable flags
Test: manual on device
Change-Id: Ibafe1b345489c88a49a7ed3e2e61e5cc5e1880a1
2018-11-01 03:28:56 +00:00