tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
28640 commits 1 branch 0 tags 50 MiB
Commit graph

28640 commits

This branch
This branch
All branches
Author SHA1 Message Date
Ram Muthiah
fa10ab3955 Merge "Revert "Add qemu.hw.mainkeys to system property_contexts"" am: 523a649401 
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/1590671

MUST ONLY BE SUBMITTED BY AUTOMERGER

Change-Id: Ibc3afb978c5f79942d6a10b5790172bceb920288
 2021-02-16 19:35:42 +00:00
Ram Muthiah
523a649401 Merge "Revert "Add qemu.hw.mainkeys to system property_contexts"" 2021-02-16 19:05:10 +00:00
Ram Muthiah
509b35e5d9 Revert "Add qemu.hw.mainkeys to system property_contexts" 
Revert submission 1582845-qemu-prop

Reason for revert: aosp_hawk-userdebug is broken on an RVC branch
Reverted Changes:
Idfc2bffa5:Add qemu.hw.mainkeys to system property_contexts
If013ff33f:Remove qemu.hw.mainkeys from vendor_qemu_prop
Bug: 180412668
Change-Id: I335afb931eaeb019f66e3feedea80b0c8888f7a3
 2021-02-16 18:58:10 +00:00
Weilun Du
baf97e40f9 Merge "Add qemu.hw.mainkeys to system property_contexts" am: 23bb01756e 
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/1582845

MUST ONLY BE SUBMITTED BY AUTOMERGER

Change-Id: I7eb61f01903b343c1cf2a210ffe6f7bae3034922
 2021-02-16 17:22:58 +00:00
Weilun Du
23bb01756e Merge "Add qemu.hw.mainkeys to system property_contexts" 2021-02-16 16:44:00 +00:00
Maciej Żenczykowski
fd596bf799 Merge "apply 'fs_bpf_tethering' label to /sys/fs/bpf/tethering" am: c281113ea8 
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/1566557

MUST ONLY BE SUBMITTED BY AUTOMERGER

Change-Id: Iec1e9556373de5508097bf9a9264455238728353
 2021-02-15 12:52:33 +00:00
Galia Peycheva
efff2e4789 Merge "Add blur sysprop to sepolicy" am: 7959b6eb1b 
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/1585067

MUST ONLY BE SUBMITTED BY AUTOMERGER

Change-Id: I5a046f94f8233ffdaf5cb6fef3a1952393448ad3
 2021-02-15 12:51:58 +00:00
Maciej Żenczykowski
c281113ea8 Merge "apply 'fs_bpf_tethering' label to /sys/fs/bpf/tethering" 2021-02-15 12:21:54 +00:00
Galia Peycheva
7959b6eb1b Merge "Add blur sysprop to sepolicy" 2021-02-15 12:20:29 +00:00
Treehugger Robot
cec7de1859 Merge changes from topic "uid_pid with recovery mode" am: cbf08f8cc7 
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/1587544

MUST ONLY BE SUBMITTED BY AUTOMERGER

Change-Id: Ibffd60cdad4211d0d95f5068b1457161ff0a34d6
 2021-02-13 21:52:06 +00:00
Marco Ballesio
9afaef844b sepolicy: rules for uid/pid cgroups v2 hierarchy am: aa4ce95c6f 
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/1585406

MUST ONLY BE SUBMITTED BY AUTOMERGER

Change-Id: Icd7136331223fa9f4a215ce07330da173ba61db0
 2021-02-13 21:51:47 +00:00
Treehugger Robot
cbf08f8cc7 Merge changes from topic "uid_pid with recovery mode" 
* changes:
  sepolicy: grant system_server process group creation rights
  sepolicy: rules for uid/pid cgroups v2 hierarchy
 2021-02-13 21:32:31 +00:00
Marco Ballesio
98a5e60592 sepolicy: grant system_server process group creation rights 
system_server must be allowed to create process groups in behalf of
processes spawned by the app zygote

Bug: 62435375
Bug: 168907513
Test: verified that webview processes are migrated in their own process
group

Change-Id: Icd9cd53b759a79fe4dc46f7ffabc0cf248e6e4b8
 2021-02-12 15:16:18 -08:00
Mohammad Islam
3663ec7d1e Merge "Allow apexd to relabel files in /data/apex/decompressed" am: 1a2a3bd369 
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/1561696

MUST ONLY BE SUBMITTED BY AUTOMERGER

Change-Id: If4af5950e9a44a123331a2e94c3695d7a072c411
 2021-02-12 10:50:06 +00:00
Mohammad Islam
1a2a3bd369 Merge "Allow apexd to relabel files in /data/apex/decompressed" 2021-02-12 10:16:55 +00:00
Treehugger Robot
cf5f18538e Merge "The SE Policies to incorporate ISecureClock and ISharedSecret services along with IKeyMintDevice service into default keymint HAL Server. Test: Rebuild, execute and run atest VtsAidlSharedSecretTargetTest and atest VtsAidlSecureClockTargetTest. Bug: b/171844725, b/168673523." am: 98e48ac6b4 
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/1562770

MUST ONLY BE SUBMITTED BY AUTOMERGER

Change-Id: I0589e6bcbdde95f1d465ee5ec4d591ed96287f47
 2021-02-12 04:47:46 +00:00
Shubang Lu
fd40534a40 Merge "Add SE policy for media_metrics" am: a19f9d2455 
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/1580990

MUST ONLY BE SUBMITTED BY AUTOMERGER

Change-Id: I7f1fbabf3dd22beebd91654d046e9b3fff4b67c3
 2021-02-12 04:46:21 +00:00
Treehugger Robot
98e48ac6b4 Merge "The SE Policies to incorporate ISecureClock and ISharedSecret services along with IKeyMintDevice service into default keymint HAL Server. Test: Rebuild, execute and run atest VtsAidlSharedSecretTargetTest and atest VtsAidlSecureClockTargetTest. Bug: b/171844725, b/168673523." 2021-02-12 02:42:35 +00:00
Shubang Lu
a19f9d2455 Merge "Add SE policy for media_metrics" 2021-02-12 02:00:32 +00:00
Maciej Żenczykowski
d68cb48e90 apply 'fs_bpf_tethering' label to /sys/fs/bpf/tethering 
We want to label /sys/fs/bpf/tethering/... with a new label distinct
from /sys/fs/bpf, as this will allow locking down the programs/maps
tighter then is currently possible with the existing system.

These programs and maps are provided via the tethering mainline module,
and as such their number, names, key/value types, etc. are all prone to
be changed by a tethering mainline module update.

Test: atest, TreeHugger
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: Ifc4108d76a1106a936b941a3dda1abc5a65c05b0
 2021-02-11 17:45:06 -08:00
Treehugger Robot
099e2f1a09 Merge "Allow dumpsys meminfo to print out DMA-BUF statistics" am: 83d6f96fdc 
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/1582856

MUST ONLY BE SUBMITTED BY AUTOMERGER

Change-Id: Id76c925e6f3a36fca52962d75c8a4f5b8907ac76
 2021-02-12 00:28:10 +00:00
Treehugger Robot
83d6f96fdc Merge "Allow dumpsys meminfo to print out DMA-BUF statistics" 2021-02-11 23:48:04 +00:00
Marco Ballesio
aa4ce95c6f sepolicy: rules for uid/pid cgroups v2 hierarchy 
Bug: 168907513
Test: verified the correct working of the v2 uid/pid hierarchy in normal
and recovery modes

This reverts commit aa8bb3a29b.

Change-Id: Ib344d500ea49b86e862e223ab58a16601eebef47
 2021-02-11 23:40:38 +00:00
shubang
2210767054 Add SE policy for media_metrics 
Test: CTS;
Change-Id: Ib9382f2513d8fd0e6812d0157c710d0ad5817231
 2021-02-11 18:38:07 +00:00
Hridya Valsaraju
0001dee765 Allow dumpsys meminfo to print out DMA-BUF statistics 
These permissions fix the following denials:

avc: denied { read } for name="buffers" dev="sysfs" ino=3267
scontext=u:r:system_server:s0 tcontext=u:object_r:sysfs_dmabuf_stats:s0
tclass=dir permissive=1
avc: denied { open } for path="/sys/kernel/dmabuf/buffers" dev="sysfs"
ino=3267 scontext=u:r:system_server:s0
tcontext=u:object_r:sysfs_dmabuf_stats:s0 tclass=dir permissive=1
avc: denied { read } for name="size" dev="sysfs"
ino=30556 scontext=u:r:system_server:s0
tcontext=u:object_r:sysfs_dmabuf_stats:s0 tclass=file permissive=1
avc: denied { open } for path="/sys/kernel/dmabuf/buffers/41673/size" dev="sysfs"
ino=30556 scontext=u:r:system_server:s0
tcontext=u:object_r:sysfs_dmabuf_stats:s0 tclass=file permissive=1
avc: denied { getattr } for path="/sys/kernel/dmabuf/buffers/41673/size" dev="sysfs"
ino=30556 scontext=u:r:system_server:s0 tcontext=u:object_r:sysfs_dmabuf_stats:s0
tclass=file permissive=1
avc: denied { read } for name="dma_heap" dev="tmpfs" ino=344
scontext=u:r:system_server:s0 tcontext=u:object_r:dmabuf_heap_device:s0
tclass=dir permissive=1
avc: denied { open } for path="/dev/dma_heap" dev="tmpfs" ino=344
scontext=u:r:system_server:s0 tcontext=u:object_r:dmabuf_heap_device:s0
tclass=dir permissive=1

Test: adb shell dumpsys meminfo
Bug: 167709539
Change-Id: Ifa43fd16369d5da1db16e45ff0e189da0c975b75
 2021-02-11 10:04:26 -08:00
Galia Peycheva
201414cff6 Add blur sysprop to sepolicy 
Bug: 170378891
Test: m
Change-Id: I6876e3bfe9dfdf066bfa54334555fdab5b3598d5
 2021-02-11 17:32:30 +00:00
Weilun Du
180a277d67 Add qemu.hw.mainkeys to system property_contexts 
Bug: 178143857

Signed-off-by: Weilun Du <wdu@google.com>
Change-Id: Idfc2bffa52016d1e880974bb193025400e90a538
 2021-02-11 04:18:54 +00:00
Vova Sharaienko
28497aaed1 Merge "Stats: new sepolicy for the AIDL service" am: e8d2732651 
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/1570880

MUST ONLY BE SUBMITTED BY AUTOMERGER

Change-Id: I46f47561663e9a3fb200cc061859c4e23ab8217c
 2021-02-11 03:48:46 +00:00
Vova Sharaienko
e8d2732651 Merge "Stats: new sepolicy for the AIDL service" 2021-02-11 03:07:56 +00:00
Vova Sharaienko
c64a5b42aa Stats: new sepolicy for the AIDL service 
Allows the AIDL IStats service to be exposed via ServiceManager
Defines IStats service client domain to be used by pixelstats_vendor

Bug: 178859845
Test: Build, flash, and aidl_stats_client
Change-Id: If41e50d0182993d0b7f8501e9147e0becf526689
 2021-02-10 23:48:35 +00:00
Treehugger Robot
f749766036 Merge "Fix ANR permission denial for AIDL HALs." am: 654f8b82a8 
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/1582316

MUST ONLY BE SUBMITTED BY AUTOMERGER

Change-Id: Ie1bd6c28ef20741f9d1f1d6a780af6728ef362b0
 2021-02-10 21:53:29 +00:00
Treehugger Robot
654f8b82a8 Merge "Fix ANR permission denial for AIDL HALs." 2021-02-10 21:16:35 +00:00
Elliott Hughes
d0f06f5489 Merge "Allow priv_app system_linker_exec:file execute_no_trans" am: e92be7b6a6 
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/1582850

MUST ONLY BE SUBMITTED BY AUTOMERGER

Change-Id: I20bc071b1d686e9174186ea25a47fdaca49bbe77
 2021-02-10 21:04:21 +00:00
Elliott Hughes
e92be7b6a6 Merge "Allow priv_app system_linker_exec:file execute_no_trans" 2021-02-10 20:45:23 +00:00
Chirag Pathak
814e89a1b2 The SE Policies to incorporate ISecureClock and ISharedSecret services along with IKeyMintDevice service into default keymint HAL Server. 
Test: Rebuild, execute and run atest VtsAidlSharedSecretTargetTest and atest VtsAidlSecureClockTargetTest.
Bug: b/171844725, b/168673523.

Change-Id: I8b81ec12c45566d31edcd117e41fd559df32c37d
 2021-02-10 18:45:07 +00:00
Elliott Hughes
25cb9046ef Allow priv_app system_linker_exec:file execute_no_trans 
Chrome Crashpad uses the the dynamic linker to load native executables
from an APK (b/112050209, crbug.com/928422)

We made the equivalent change to untrusted_app_all in
9ea8c0701d but webview also runs in
priv_app contexts.

Bug: http://b/112050209
Test: treehugger
Change-Id: I19bbadc7f9c9e668e2c6d932c7da24f18e7731bd
 2021-02-10 10:32:44 -08:00
Steven Moreland
afb345c94b Fix ANR permission denial for AIDL HALs. 
Recently, WatchDog gained the ability to query AIDL HAL PIDs in order to
amend ANR reports. However, since this was tested on cuttlefish (and
b/65201432 means that system_server is permissive), the denial was not
enforced, and broke ANRs in the dogfood population.

Fixes: 179753319
Test: simulate hanging w/ 'adb shell am hang', and the following denial
   no longer occurs:
02-10 00:50:05.719   200   200 E SELinux : avc:  denied  { list } for
pid=575 uid=1000 name=service_manager scontext=u:r:system_server:s0
tcontext=u:r:servicemanager:s0 tclass=service_manager permissive=1

Change-Id: I210527ad7492b155d7cf08c7d67894ef602d37a6
 2021-02-10 17:06:00 +00:00
Florian Mayer
076e0e56b1 Merge changes from topics "norootintegrationtest", "profileshelltestdatafile" am: 7b3ae03026 
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/1575363

MUST ONLY BE SUBMITTED BY AUTOMERGER

Change-Id: I526f7b7f9f0c8954d929184592b57928685f3b39
 2021-02-10 11:43:01 +00:00
Florian Mayer
7b3ae03026 Merge changes from topics "norootintegrationtest", "profileshelltestdatafile" 
* changes:
  Allow shell to create shell_[test_]_data_file sockets.
  Allow heapprofd to read shell_test_data_file.
 2021-02-10 11:16:10 +00:00
Treehugger Robot
1018f58e44 Merge "SEPolicy for RemoteProvisioning App" am: e6654e8bfd 
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/1536783

MUST ONLY BE SUBMITTED BY AUTOMERGER

Change-Id: I958e7dcfda6bde2b5e37d9f32df9f530590e097f
 2021-02-10 04:53:04 +00:00
Treehugger Robot
e6654e8bfd Merge "SEPolicy for RemoteProvisioning App" 2021-02-10 04:20:52 +00:00
Treehugger Robot
258ee7802e Merge "[selinux] allow priv_app to get incremental progress" am: f14e49be1c 
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/1581966

MUST ONLY BE SUBMITTED BY AUTOMERGER

Change-Id: If428dfe89afd31a5f491553c3dc6e7a99a3eb9e1
 2021-02-10 01:25:12 +00:00
Treehugger Robot
f14e49be1c Merge "[selinux] allow priv_app to get incremental progress" 2021-02-10 00:32:39 +00:00
Pavel Grafov
7ea497a17e Keystore 2.0: Allow system_server to manage wifi keys am: 20bc79bb3f 
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/1581903

MUST ONLY BE SUBMITTED BY AUTOMERGER

Change-Id: I74b8b25388c00eddafc238ae4ed1a52a53230f36
 2021-02-10 00:05:26 +00:00
Songchun Fan
b4c9491aed [selinux] allow priv_app to get incremental progress 
This allows phonesky to get incremental install progress.

Addresses denial message like below:

W/BlockingExecuto: type=1400 audit(0.0:5582): avc: denied { ioctl } for path="/data/incremental/MT_data_app_vmdl133/mount/.index/04abf89d12c3fe8f6fe9b381a670255c" dev="incremental-fs" ino=52957 ioctlcmd=0x6722 scontext=u:r:priv_app:s0:c512,c768 tcontext=u:object_r:apk_data_file:s0 tclass=file permissive=0 app=com.android.vending

Test: builds
BUG: 172965880
Change-Id: Ibecd4e07746e7bb3ca6bdf762382744b38f677cb
 2021-02-09 22:46:27 +00:00
Pavel Grafov
20bc79bb3f Keystore 2.0: Allow system_server to manage wifi keys 
This is needed because Wifi module needs to import and
generate keys and it runs in system_server.

Also, remove "grant" from system_app and system_server
since there is no need to grant any keys.

Test: Create an enterprise wifi config with EAP-TLS
Bug: 171305388
Change-Id: I50c25f2fe52e968c8cdf1ea20d110f9f052699db
 2021-02-09 20:36:51 +00:00
Janis Danisevskis
17c9463c6e Merge "Keystore 2.0: Add wifi namespace to sepolicy." am: 6691c9c411 
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/1570000

MUST ONLY BE SUBMITTED BY AUTOMERGER

Change-Id: Id996eb24c7e76234de89fd0461f801b85752be97
 2021-02-09 18:45:12 +00:00
Janis Danisevskis
6691c9c411 Merge "Keystore 2.0: Add wifi namespace to sepolicy." 2021-02-09 18:27:16 +00:00
Janis Danisevskis
df31f20dfe Keystore 2.0: Add wifi namespace to sepolicy. 
Add the wifi namespace to sepolicy and allow system_app (Settings) and
wifi_supplicant to manage/use the keys in that namespace

Test: N/A
Bug: 171305388
Change-Id: Ib6af8656b18288a1116c241c2e76d9aea421a889
 2021-02-09 08:28:45 -08:00
Treehugger Robot
672b014e90 Merge "Allow dumpsys to read total DMA-BUF heap pool size" am: efef83f745 
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/1566386

MUST ONLY BE SUBMITTED BY AUTOMERGER

Change-Id: Id42bddda4968b88f89c8538c5bdc85e156db892b
 2021-02-09 14:38:53 +00:00