tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
platform_system_sepolicy/public
History
Dan Cashman 3e307a4de5 Remove neverallow preventing hwservice access for apps. 
Same-process HALs are forbidden except for very specific HALs that have
been provided and whitelisted by AOSP.  As a result, a vendor extension
HAL may have a need to be accessed by untrusted_app.  This is still
discouraged, and the existing AOSP hwservices are still forbidden, but
remove the blanket prohibition.  Also indicate that this is temporary,
and that partners should expect to get exceptions to the rule into AOSP
in the future.

Bug: 62806062
Test: neverallow-only change builds.  Verify new attribute is in policy.
Change-Id: I6d3e659147d509a3503c2c9e0b6bb9016cc75832
2017-06-21 12:30:36 -07:00
..
adbd.te Move adbd policy to private 2017-02-07 09:55:05 -08:00
asan_extract.te Sepolicy: Add ASAN-Extract 2017-04-05 13:09:29 -07:00
attributes Remove neverallow preventing hwservice access for apps. 2017-06-21 12:30:36 -07:00
audioserver.te Move audioserver policy to private 2017-02-07 10:47:18 -08:00
blkid.te Move blkid policy to private 2017-02-07 23:57:53 +00:00
blkid_untrusted.te Move blkid policy to private 2017-02-07 23:57:53 +00:00
bluetooth.te Move bluetooth policy to private 2017-02-06 15:29:10 -08:00
bootanim.te Allow hals to read hwservicemanager prop. am: d3ce5dc38c am: d437f0e09d 2017-03-23 03:53:11 +00:00
bootstat.te
bufferhubd.te SELinux policies for PDX services 2017-05-10 16:39:19 -07:00
cameraserver.te Restrict access to hwservicemanager 2017-04-21 09:54:53 -07:00
charger.te
clatd.te Move domain_deprecated into private policy 2017-05-15 13:37:59 -07:00
cppreopts.te
crash_dump.te sepolicy: relabel /vendor 2017-04-05 13:58:32 -07:00
device.te Define policy for "loop-control" device. 2017-03-25 21:39:03 -06:00
dex2oat.te Move domain_deprecated into private policy 2017-05-15 13:37:59 -07:00
dhcp.te Move domain_deprecated into private policy 2017-05-15 13:37:59 -07:00
display_service_server.te Add fwk_display_hwservice. 2017-05-17 11:00:28 -07:00
dnsmasq.te
domain.te Add extraneous neverallow rule to enforce attribute inclusion. 2017-06-16 11:19:53 -07:00
drmserver.te No access to tee domain over Unix domain sockets 2017-04-03 11:26:01 -07:00
dumpstate.te Move domain_deprecated into private policy 2017-05-15 13:37:59 -07:00
ephemeral_app.te
file.te Move sensord sepolicy 2017-05-11 16:25:03 -07:00
fingerprintd.te Move domain_deprecated into private policy 2017-05-15 13:37:59 -07:00
fsck.te Move domain_deprecated into private policy 2017-05-15 13:37:59 -07:00
fsck_untrusted.te Move domain_deprecated into private policy 2017-05-15 13:37:59 -07:00
gatekeeperd.te Fix sepolicy for Gatekeeper HAL 2017-03-20 07:39:33 -07:00
global_macros Remove obsolete netlink_firewall_socket and netlink_ip6fw_socket classes. 2017-02-06 14:24:41 -05:00
hal_allocator.te Restrict access to hwservicemanager 2017-04-21 09:54:53 -07:00
hal_audio.te hal_audio: Allow writing dump info into pipes when capturing BR 2017-05-08 10:12:45 -07:00
hal_bluetooth.te Grant CAP_SYS_NICE to processes that need it. 2017-05-09 09:53:46 -07:00
hal_bootctl.te Restrict access to hwservicemanager 2017-04-21 09:54:53 -07:00
hal_camera.te hal_camera: remove video_device restriction 2017-05-16 09:42:09 -07:00
hal_configstore.te Restrict access to hwservicemanager 2017-04-21 09:54:53 -07:00
hal_contexthub.te Restrict access to hwservicemanager 2017-04-21 09:54:53 -07:00
hal_drm.te Merge "Allow DRM hal to access fd allocated by mediaserver" into oc-dev 2017-04-25 23:54:48 +00:00
hal_dumpstate.te Restrict access to hwservicemanager 2017-04-21 09:54:53 -07:00
hal_fingerprint.te Restrict access to hwservicemanager 2017-04-21 09:54:53 -07:00
hal_gatekeeper.te Restrict access to hwservicemanager 2017-04-21 09:54:53 -07:00
hal_gnss.te Restrict access to hwservicemanager 2017-04-21 09:54:53 -07:00
hal_graphics_allocator.te Grant CAP_SYS_NICE to processes that need it. 2017-05-09 09:53:46 -07:00
hal_graphics_composer.te Fix graphics composer denial. 2017-05-19 14:14:35 -07:00
hal_health.te Restrict access to hwservicemanager 2017-04-21 09:54:53 -07:00
hal_ir.te Restrict access to hwservicemanager 2017-04-21 09:54:53 -07:00
hal_keymaster.te Restrict access to hwservicemanager 2017-04-21 09:54:53 -07:00
hal_light.te Restrict access to hwservicemanager 2017-04-21 09:54:53 -07:00
hal_memtrack.te Restrict access to hwservicemanager 2017-04-21 09:54:53 -07:00
hal_neverallows.te Removing UDP access for hal_gnss 2017-05-18 13:55:51 -07:00
hal_nfc.te Remove access to sock_file for hal_nfc 2017-04-27 09:05:27 -07:00
hal_oemlock.te Add missing sepolicies for OemLock HAL. 2017-05-31 15:22:05 +01:00
hal_power.te Restrict access to hwservicemanager 2017-04-21 09:54:53 -07:00
hal_sensors.te Grant CAP_SYS_NICE to processes that need it. 2017-05-09 09:53:46 -07:00
hal_telephony.te Restrict access to hwservicemanager 2017-04-21 09:54:53 -07:00
hal_tetheroffload.te SE Policy for Tether Offload HAL 2017-05-23 23:00:23 +00:00
hal_thermal.te Restrict access to hwservicemanager 2017-04-21 09:54:53 -07:00
hal_tv_cec.te Restrict access to hwservicemanager 2017-04-21 09:54:53 -07:00
hal_tv_input.te Restrict access to hwservicemanager 2017-04-21 09:54:53 -07:00
hal_usb.te Restrict access to hwservicemanager 2017-04-21 09:54:53 -07:00
hal_vibrator.te Restrict access to hwservicemanager 2017-04-21 09:54:53 -07:00
hal_vr.te Restrict access to hwservicemanager 2017-04-21 09:54:53 -07:00
hal_weaver.te Add missing sepolicies for the Weaver HAL. 2017-05-31 15:17:11 +01:00
hal_wifi.te Restrict access to hwservicemanager 2017-04-21 09:54:53 -07:00
hal_wifi_offload.te SE Policy for Wifi Offload HAL 2017-05-18 09:49:55 -07:00
hal_wifi_supplicant.te Restrict access to hwservicemanager 2017-04-21 09:54:53 -07:00
healthd.te Restrict access to hwservicemanager 2017-04-21 09:54:53 -07:00
hwservice.te Merge "Add missing sepolicies for OemLock HAL." into oc-dev 2017-06-01 22:05:18 +00:00
hwservicemanager.te Add hwservice_contexts and support for querying it. 2017-04-12 18:07:12 -07:00
idmap.te sepolicy: restrict /vendor/overlay from most coredomains 2017-04-06 13:28:16 -07:00
incident.te Add incident command and incidentd daemon se policy. 2017-02-07 15:52:07 -08:00
incidentd.te Add incident command and incidentd daemon se policy. 2017-02-07 15:52:07 -08:00
init.te Assert ban on framework <-> vendor comms over VndBinder 2017-04-25 14:15:52 -07:00
inputflinger.te
install_recovery.te Fix build time warning 2017-04-21 09:42:50 -07:00
installd.te Move domain_deprecated into private policy 2017-05-15 13:37:59 -07:00
ioctl_defines
ioctl_macros
isolated_app.te
kernel.te file_context: explicitly label all file context files 2017-03-29 10:17:21 -07:00
keystore.te Move domain_deprecated into private policy 2017-05-15 13:37:59 -07:00
lmkd.te
logd.te
logpersist.te
mdnsd.te Move mdnsd policy to private 2017-02-06 15:02:32 -08:00
mediacodec.te SELinux policies for PDX services 2017-05-10 16:39:19 -07:00
mediadrmserver.te grant mediadrmserver permission to read dir from /system/* 2017-04-19 17:58:27 +00:00
mediaextractor.te MediaExtractor: Allow reading of app data files. 2017-05-24 14:18:38 -07:00
mediametrics.te allow media.metrics to write to file descriptor in /data 2017-04-04 10:30:50 -07:00
mediaserver.te Allow mediaserver to access fd allocated by hal_graphics_composer 2017-04-28 17:55:20 -07:00
modprobe.te Fix coredomain violation for modprobe 2017-06-05 08:09:18 -07:00
mtp.te Move domain_deprecated into private policy 2017-05-15 13:37:59 -07:00
net.te Move netdomain policy to private 2017-02-06 15:02:00 -08:00
netd.te Move domain_deprecated into private policy 2017-05-15 13:37:59 -07:00
netutils_wrapper.te add netutils_wrappers 2017-04-14 22:57:27 -07:00
neverallow_macros Ban socket connections between core and vendor 2017-03-27 08:49:13 -07:00
nfc.te Remove unnecessary rules from NFC HAL clients 2017-03-22 16:22:33 -07:00
otapreopt_chroot.te
otapreopt_slot.te Sepolicy: Give otapreopt_slot read on A/B artifact links 2017-04-07 20:19:41 -07:00
performanced.te Move sensord sepolicy 2017-05-11 16:25:03 -07:00
perfprofd.te Move domain_deprecated into private policy 2017-05-15 13:37:59 -07:00
platform_app.te
postinstall.te
postinstall_dexopt.te Sepolicy: Fix new access from the linker for postinstall 2017-04-28 17:34:41 -07:00
ppp.te Move domain_deprecated into private policy 2017-05-15 13:37:59 -07:00
preopt2cachename.te
priv_app.te
profman.te Allow profman to analyze profiles for the secondary dex files 2017-03-15 18:47:13 -07:00
property.te Sepolicy: Add ASAN-Extract 2017-04-05 13:09:29 -07:00
racoon.te restore permissions to /vendor for non-treble devices 2017-04-14 10:01:14 -07:00
radio.te radio: disalllow radio and rild socket for treble devices 2017-06-14 09:42:21 -07:00
recovery.te Move domain_deprecated into private policy 2017-05-15 13:37:59 -07:00
recovery_persist.te
recovery_refresh.te
rild.te Move domain_deprecated into private policy 2017-05-15 13:37:59 -07:00
roles
runas.te Allow run-as to read/write unix_stream_sockets created by adbd. 2017-06-20 13:50:54 -07:00
sdcardd.te Move domain_deprecated into private policy 2017-05-15 13:37:59 -07:00
service.te Remove vr_wm service selinux policy 2017-04-21 17:15:09 -04:00
servicemanager.te Assert ban on framework <-> vendor comms over VndBinder 2017-04-25 14:15:52 -07:00
sgdisk.te
shared_relro.te Move domain_deprecated into private policy 2017-05-15 13:37:59 -07:00
shell.te Let shell and bugreport read logging related properties. 2017-04-21 16:24:45 +01:00
slideshow.te
su.te Make sure all public types are defined regardless of build variants 2017-04-21 12:34:12 -07:00
surfaceflinger.te Move surfaceflinger policy to private 2017-02-07 10:06:12 -08:00
system_app.te
system_server.te Move system_server policy to private 2017-02-07 20:24:05 +00:00
te_macros Add extraneous neverallow rule to enforce attribute inclusion. 2017-06-16 11:19:53 -07:00
tee.te Move TEE rules to vendor image 2017-04-03 11:11:48 -07:00
tombstoned.te
toolbox.te
tzdatacheck.te
ueventd.te Move domain_deprecated into private policy 2017-05-15 13:37:59 -07:00
uncrypt.te Move domain_deprecated into private policy 2017-05-15 13:37:59 -07:00
untrusted_app.te
untrusted_app_25.te untrusted_app: policy versioning based on targetSdkVersion 2017-02-14 13:30:12 -08:00
untrusted_v2_app.te Add new untrusted_v2_app domain 2017-02-21 12:39:55 -08:00
update_engine.te Move domain_deprecated into private policy 2017-05-15 13:37:59 -07:00
update_engine_common.te Allow update_engine to kill postinstall process. 2017-03-22 21:01:08 -07:00
update_verifier.te Allow update_verifier to reboot the device 2017-04-04 21:07:48 +00:00
vdc.te Grant vdc access to kmsg 2017-03-31 20:48:36 +00:00
vendor_shell.te vendor_shell: add sepolicy for vendor shell 2017-04-14 09:38:51 -07:00
vendor_toolbox.te Allow init to run vendor toybox for modprobe 2017-05-24 15:01:20 -07:00
virtual_touchpad.te Allow vr_hwc and virtual_touchpad to query for permissions 2017-04-21 17:15:03 -04:00
vndservice.te Add default label and mapping for vendor services 2017-04-28 14:56:57 -07:00
vndservicemanager.te Initial sepolicy for vndservicemanager. 2017-03-23 00:20:43 +00:00
vold.te Move domain_deprecated into private policy 2017-05-15 13:37:59 -07:00
vr_hwc.te SELinux policies for PDX services 2017-05-10 16:39:19 -07:00
watchdogd.te
webview_zygote.te
wificond.te Allow wificond to find permission 2017-04-04 16:52:25 -07:00
zygote.te