Commit graph

5 commits

Author SHA1 Message Date
Paul Crowley
4a7945290d Remove wait_for_keymaster and references
No longer needed now init listens for property changes on a
separate thread.

Some references to wait_for_keymaster survive: in order to avoid
trouble downstream, we keep the definition of the `wait_for_keymaster`
and `wait_for_keymaster_exec` types, but remove all their permissions,
and of course prebuilds and compat cil files are unchanged.

Bug: 186580823
Test: Cuttlefish boots successfully
Change-Id: Id97fc2668743fb58dfd10c75a4f4c4d0348284ce
2021-06-17 11:12:16 -07:00
Thiébaud Weksteen
eb353bc228 Add transfer permission to wait_for_keymaster
Bug: 188809569
Test: m sepolicy
Change-Id: I79ead2fdf258f824ef9b0bf13c8179a6b819ccd7
2021-05-21 09:18:08 +02:00
Satya Tangirala
a999004528 Keystore 2.0: sepolicy changes for vold to use keystore2
Vold needs to be able to search for keystore2 and keystore2 maintenance
services, and call methods provided by those services.

Bug: 181910578
Change-Id: I6e336c3bfaabe158b850dc175b6c9a942dd717be
2021-04-07 02:14:33 -07:00
Nick Kralevich
5e37271df8 Introduce system_file_type
system_file_type is a new attribute used to identify files which exist
on the /system partition. It's useful for allow rules in init, which are
based off of a blacklist of writable files. Additionally, it's useful
for constructing neverallow rules to prevent regressions.

Additionally, add commented out tests which enforce that all files on
the /system partition have the system_file_type attribute. These tests
will be uncommented in a future change after all the device-specific
policies are cleaned up.

Test: Device boots and no obvious problems.
Change-Id: Id9bae6625f042594c8eba74ca712abb09702c1e5
2018-09-27 12:52:09 -07:00
Paul Crowley
9f760306ae Add wait_for_keymaster
Bug: 79228237
Test: audit2allow finds no relevant denials on boot
Merged-In: Ia80b77ba9a1ec2354127cd0ef68d50ebcf593fb0
Change-Id: Ia80b77ba9a1ec2354127cd0ef68d50ebcf593fb0
2018-05-09 13:41:37 -07:00