tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
platform_system_sepolicy/private
History
Jeff Vander Stoep 06aee357e4 dexoptanalyzer: suppress access(2) denial 
A legitimate call to access(2) is generating a denial. Use the
audit_access permission to suppress the denial on just the access()
call.

avc: denied { write } for name="verified_jars"
scontext=u:r:dexoptanalyzer:s0
tcontext=u:object_r:app_data_file:s0:c512,c768 tclass=dir

Bug: 62597207
Test: build policy
Test: The following cmd succeeds but no longer generates a denial
    adb shell cmd package compile -r bg-dexopt --secondary-dex \
    com.google.android.googlequicksearchbox

Change-Id: I7d03df2754c24c039bce11426bf8f317232f5e5f
(cherry picked from commit 575e627081)
2017-06-30 15:30:06 -07:00
..
access_vectors Define smc_socket security class. 2017-06-26 21:44:58 +00:00
adbd.te adbd: use hal_client_domain 2017-03-24 18:55:56 -07:00
app.te Add rules for vfat for sdcardfs 2017-06-22 00:20:59 +00:00
app_neverallows.te Add untrusted_v2_app to all_untrusted_apps 2017-04-26 16:19:47 -07:00
atrace.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
audioserver.te Mark all clients of Allocator HAL 2017-03-24 13:54:43 -07:00
binder_in_vendor_violators.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
binderservicedomain.te Move binderservicedomain policy to private 2017-02-08 09:09:39 -08:00
blkid.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
blkid_untrusted.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
bluetooth.te Allow Bluetooth sys_nice and system_server setsched for Bluetooth HAL 2017-04-24 17:57:59 -07:00
bluetoothdomain.te Move bluetoothdomain policy to private 2017-02-06 15:32:08 -08:00
bootanim.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
bootstat.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
bufferhubd.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
cameraserver.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
charger.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
clatd.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
cppreopts.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
crash_dump.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
dex2oat.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
dexoptanalyzer.te dexoptanalyzer: suppress access(2) denial 2017-06-30 15:30:06 -07:00
dhcp.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
dnsmasq.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
domain.te Remove crash_dump from sys_ptrace neverallow exception 2017-02-16 09:17:35 -08:00
drmserver.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
dumpstate.te Allow dumpstate to acquire xtables.lock 2017-04-25 16:22:11 +09:00
ephemeral_app.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
file.te Label /proc/config.gz 2017-02-16 12:07:01 -08:00
file_contexts SEPolicy: Changes for new stack dumping scheme. 2017-05-31 08:54:37 +01:00
file_contexts_asan Refactor sanitized library on-disk layout - SELinux. 2017-03-29 23:42:49 -07:00
fingerprintd.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
fs_use Split general policy into public and private components. 2016-10-06 13:09:06 -07:00
fsck.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
fsck_untrusted.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
gatekeeperd.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
genfs_contexts enabled /sbin/modprobe for recovery mode 2017-03-16 01:19:58 +00:00
hal_allocator_default.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
halclientdomain.te Allow hals to read hwservicemanager prop. 2017-03-23 01:50:50 +00:00
halserverdomain.te Allow hals to read hwservicemanager prop. 2017-03-23 01:50:50 +00:00
healthd.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
hostapd.te Split general policy into public and private components. 2016-10-06 13:09:06 -07:00
hwservicemanager.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
idmap.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
incident.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
incidentd.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
init.te SELinux changes for Treble Loadable Kernel Module 2017-04-05 18:43:44 +08:00
initial_sid_contexts Split general policy into public and private components. 2016-10-06 13:09:06 -07:00
initial_sids Split general policy into public and private components. 2016-10-06 13:09:06 -07:00
inputflinger.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
install_recovery.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
installd.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
isolated_app.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
kernel.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
keys.conf Split general policy into public and private components. 2016-10-06 13:09:06 -07:00
keystore.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
lmkd.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
logd.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
logpersist.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
mac_permissions.xml Move MediaProvider to its own domain, add new MtpServer permissions 2016-12-12 11:05:33 -08:00
mdnsd.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
mediacodec.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
mediadrmserver.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
mediaextractor.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
mediametrics.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
mediaprovider.te Add drm and kernel permissions to mediaprovider 2017-04-26 11:15:44 -07:00
mediaserver.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
mls sepolicy: add version_policy tool and version non-platform policy. 2016-12-06 08:56:02 -08:00
mls_decl sepolicy: add version_policy tool and version non-platform policy. 2016-12-06 08:56:02 -08:00
mls_macros Split general policy into public and private components. 2016-10-06 13:09:06 -07:00
modprobe.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
mtp.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
net.te Move netdomain policy to private 2017-02-06 15:02:00 -08:00
netd.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
nfc.te Allows nfc to access vr_manager_service 2017-05-25 15:59:52 -07:00
otapreopt_chroot.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
otapreopt_slot.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
performanced.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
perfprofd.te su and perfprofd are coredomain too 2017-03-24 09:31:50 -07:00
platform_app.te Enable the TimeZoneManagerService 2017-06-01 15:56:43 +00:00
policy_capabilities Define extended_socket_class policy capability and socket classes 2017-02-06 13:53:11 -05:00
port_contexts Split general policy into public and private components. 2016-10-06 13:09:06 -07:00
postinstall.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
postinstall_dexopt.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
ppp.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
preopt2cachename.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
priv_app.te Split mediaprovider as a separate domain from priv_app 2017-04-17 15:30:35 -07:00
profman.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
property_contexts SELinux policy for secure persistent netd storage 2017-06-12 11:00:59 +09:00
racoon.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
radio.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
recovery.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
recovery_persist.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
recovery_refresh.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
roles_decl sepolicy: add version_policy tool and version non-platform policy. 2016-12-06 08:56:02 -08:00
runas.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
sdcardd.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
seapp_contexts Split mediaprovider as a separate domain from priv_app 2017-04-17 15:30:35 -07:00
security_classes Define smc_socket security class. 2017-06-26 21:44:58 +00:00
sensord.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
service_contexts Enable the TimeZoneManagerService 2017-06-01 15:56:43 +00:00
servicemanager.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
sgdisk.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
shared_relro.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
shell.te Allow shell access on /dev/uhid node 2017-05-10 19:37:06 -07:00
slideshow.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
storaged.te storaged: add permissions for dumpstate 2017-05-03 10:40:18 -07:00
su.te su and perfprofd are coredomain too 2017-03-24 09:31:50 -07:00
surfaceflinger.te SELinux policies for PDX services 2017-05-15 10:07:05 -07:00
system_app.te Remove hal_binderization_prop 2017-04-04 09:46:45 -07:00
system_server.te Add getpgid to system_service and init 2017-06-13 15:23:01 -07:00
technical_debt.cil Mark all clients of Allocator HAL 2017-03-24 13:54:43 -07:00
tee.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
tombstoned.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
toolbox.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
tzdatacheck.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
ueventd.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
uncrypt.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
untrusted_app.te Allow UDP Sockets to be returned from IpSecService 2017-04-12 11:32:18 -07:00
untrusted_app_25.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
untrusted_app_all.te Split preloads into media_file and data_file 2017-03-15 00:49:37 +00:00
untrusted_v2_app.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
update_engine.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
update_engine_common.te Split general policy into public and private components. 2016-10-06 13:09:06 -07:00
update_verifier.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
users Split general policy into public and private components. 2016-10-06 13:09:06 -07:00
vdc.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
virtual_touchpad.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
vold.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
watchdogd.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
webview_zygote.te Define smc_socket security class. 2017-06-26 21:44:58 +00:00
wificond.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
zygote.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00