tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
platform_system_sepolicy/private
History
Nick Kralevich 4cae28d43c tracefs: avoid overly generic regexes 
On boot, Android runs restorecon on a number of virtual directories,
such as /sys and /sys/kernel/debug, to ensure that the SELinux labels
are correct. To avoid causing excessive boot time delays, the restorecon
code aggressively prunes directories, to avoid recursing down directory
trees which will never have a matching SELinux label.

See:
* https://android-review.googlesource.com/93401
* https://android-review.googlesource.com/109103

The key to this optimization is avoiding unnecessarily broad regular
expressions in file_contexts. If an overly broad regex exists, the tree
pruning code is ineffective, and the restorecon ends up visiting lots of
unnecessary directories.

The directory /sys/kernel/debug/tracing contains approximately 4500
files normally, and on debuggable builds, this number can jump to over
9000 files when the processing from wifi-events.rc occurs. For
comparison, the entire /sys/kernel/debug tree (excluding
/sys/kernel/debug/tracing) only contains approximately 8000 files. The
regular expression "/sys/kernel(/debug)?/tracing/(.*)?" ends up matching
a significant number of files, which impacts boot performance.

Instead of using an overly broad regex, refine the regex so only the
files needed have an entry in file_contexts. This list of files is
essentially a duplicate of the entries in
frameworks/native/cmds/atrace/atrace.rc .

This change reduces the restorecon_recursive call for /sys/kernel/debug
from approximately 260ms to 40ms, a boot time reduction of approximately
220ms.

Bug: 35248779
Test: device boots, no SELinux denials, faster boot.
Change-Id: I70f8af102762ec0180546b05fcf014c097135f3e
2017-02-12 08:40:32 -08:00
..
access_vectors Remove obsolete netlink_firewall_socket and netlink_ip6fw_socket classes. 2017-02-06 14:24:41 -05:00
adbd.te Move adbd policy to private 2017-02-07 09:55:05 -08:00
app.te Add policies for new services. 2017-02-09 15:15:11 -08:00
app_neverallows.te Remove obsolete netlink_firewall_socket and netlink_ip6fw_socket classes. 2017-02-06 14:24:41 -05:00
atrace.te Move atrace policy to private 2017-02-07 10:54:20 -08:00
audioserver.te Move audioserver policy to private 2017-02-07 10:47:18 -08:00
binderservicedomain.te Move binderservicedomain policy to private 2017-02-08 09:09:39 -08:00
blkid.te Move blkid policy to private 2017-02-07 23:57:53 +00:00
blkid_untrusted.te Move blkid policy to private 2017-02-07 23:57:53 +00:00
bluetooth.te Move bluetooth policy to private 2017-02-06 15:29:10 -08:00
bluetoothdomain.te Move bluetoothdomain policy to private 2017-02-06 15:32:08 -08:00
bootanim.te Split general policy into public and private components. 2016-10-06 13:09:06 -07:00
bootstat.te Split general policy into public and private components. 2016-10-06 13:09:06 -07:00
bufferhubd.te Add policies for new services. 2017-02-09 15:15:11 -08:00
cameraserver.te Split general policy into public and private components. 2016-10-06 13:09:06 -07:00
cppreopts.te Split general policy into public and private components. 2016-10-06 13:09:06 -07:00
crash_dump.te crash_dump: temporarily make permissive. 2017-01-19 10:28:43 -08:00
dexoptanalyzer.te SElinux policies for compiling secondary dex files 2017-01-24 14:28:07 -08:00
dhcp.te Split general policy into public and private components. 2016-10-06 13:09:06 -07:00
domain.te Introduce crash_dump debugging helper. 2017-01-18 15:03:24 -08:00
drmserver.te sepolicy: add version_policy tool and version non-platform policy. 2016-12-06 08:56:02 -08:00
dumpstate.te Storaged permissions for task I/O 2017-01-07 01:12:51 +00:00
ephemeral_app.te Merge ephemeral data and apk files into app 2017-02-06 10:16:50 -08:00
file.te sepolicy: add version_policy tool and version non-platform policy. 2016-12-06 08:56:02 -08:00
file_contexts tracefs: avoid overly generic regexes 2017-02-12 08:40:32 -08:00
file_contexts_asan Split general policy into public and private components. 2016-10-06 13:09:06 -07:00
fingerprintd.te Split general policy into public and private components. 2016-10-06 13:09:06 -07:00
fs_use Split general policy into public and private components. 2016-10-06 13:09:06 -07:00
fsck.te Split general policy into public and private components. 2016-10-06 13:09:06 -07:00
gatekeeperd.te Split general policy into public and private components. 2016-10-06 13:09:06 -07:00
genfs_contexts Define policy for /proc/uid_io/stats 2017-01-18 11:00:57 -08:00
hal_allocator.te Sepolicy for allocator hal. 2016-12-22 11:39:23 -08:00
hal_audio_default.te Group all HAL impls using haldomain attribute 2017-01-17 11:20:49 -08:00
hal_bluetooth_default.te Allow the Bluetooth HAL to log firmware versions 2017-01-17 15:15:07 -08:00
hal_boot.te sepolicy for boot_control HAL service 2016-10-25 13:33:48 -07:00
hal_camera_default.te DO NOT MERGE: Camera: Add initial Treble camera HAL sepolicy 2017-01-18 12:02:36 -08:00
hal_configstore_default.te configstore: add selinux policy for configstore@1.0 hal 2017-02-02 17:46:41 +09:00
hal_contexthub_default.te Group all HAL impls using haldomain attribute 2017-01-17 11:20:49 -08:00
hal_drm_default.te Fix selinux denial for binderized drm hal 2017-02-08 20:48:18 +00:00
hal_dumpstate_default.te Group all HAL impls using haldomain attribute 2017-01-17 11:20:49 -08:00
hal_fingerprint_default.te Group all HAL impls using haldomain attribute 2017-01-17 11:20:49 -08:00
hal_gatekeeper_default.te Group all HAL impls using haldomain attribute 2017-01-17 11:20:49 -08:00
hal_gnss_default.te Group all HAL impls using haldomain attribute 2017-01-17 11:20:49 -08:00
hal_graphics_allocator_default.te Group all HAL impls using haldomain attribute 2017-01-17 11:20:49 -08:00
hal_health_default.te Group all HAL impls using haldomain attribute 2017-01-17 11:20:49 -08:00
hal_ir_default.te Group all HAL impls using haldomain attribute 2017-01-17 11:20:49 -08:00
hal_keymaster.te Preliminary policy for hal_keymaster (TREBLE) 2017-01-27 15:02:57 -08:00
hal_light_default.te Group all HAL impls using haldomain attribute 2017-01-17 11:20:49 -08:00
hal_memtrack_default.te Group all HAL impls using haldomain attribute 2017-01-17 11:20:49 -08:00
hal_nfc_default.te Group all HAL impls using haldomain attribute 2017-01-17 11:20:49 -08:00
hal_power_default.te Group all HAL impls using haldomain attribute 2017-01-17 11:20:49 -08:00
hal_sensors_default.te Group all HAL impls using haldomain attribute 2017-01-17 11:20:49 -08:00
hal_thermal_default.te Group all HAL impls using haldomain attribute 2017-01-17 11:20:49 -08:00
hal_usb_default.te sepolicy for usb hal 2017-01-27 00:05:19 +00:00
hal_vibrator_default.te Group all HAL impls using haldomain attribute 2017-01-17 11:20:49 -08:00
hal_vr_default.te Group all HAL impls using haldomain attribute 2017-01-17 11:20:49 -08:00
hal_wifi_default.te Group all HAL impls using haldomain attribute 2017-01-17 11:20:49 -08:00
haldomain.te haldomain: search for passthrough hals 2017-01-24 16:41:00 -08:00
healthd.te storaged: allow register and callback from batteryproperties 2017-02-06 11:06:05 -08:00
hostapd.te Split general policy into public and private components. 2016-10-06 13:09:06 -07:00
hwservicemanager.te Split general policy into public and private components. 2016-10-06 13:09:06 -07:00
incident.te Add incident command and incidentd daemon se policy. 2017-02-07 15:52:07 -08:00
incidentd.te Add incident command and incidentd daemon se policy. 2017-02-07 15:52:07 -08:00
init.te logcat: introduce split to logd and logpersist domains 2016-12-20 20:31:03 +00:00
initial_sid_contexts Split general policy into public and private components. 2016-10-06 13:09:06 -07:00
initial_sids Split general policy into public and private components. 2016-10-06 13:09:06 -07:00
inputflinger.te Whitespace fix 2016-12-09 20:14:31 -08:00
install_recovery.te Split general policy into public and private components. 2016-10-06 13:09:06 -07:00
installd.te SElinux policies for compiling secondary dex files 2017-01-24 14:28:07 -08:00
isolated_app.te Move neverallows from untrusted_app.te to app_neverallows.te 2017-02-06 10:16:50 -08:00
kernel.te Split general policy into public and private components. 2016-10-06 13:09:06 -07:00
keys.conf Split general policy into public and private components. 2016-10-06 13:09:06 -07:00
keystore.te Split general policy into public and private components. 2016-10-06 13:09:06 -07:00
lmkd.te Split general policy into public and private components. 2016-10-06 13:09:06 -07:00
logd.te logd: add getEventTag command and service 2017-01-31 15:50:42 +00:00
logpersist.te logd: add getEventTag command and service 2017-01-31 15:50:42 +00:00
mac_permissions.xml Move MediaProvider to its own domain, add new MtpServer permissions 2016-12-12 11:05:33 -08:00
mdnsd.te Move mdnsd policy to private 2017-02-06 15:02:32 -08:00
mediacodec.te Split general policy into public and private components. 2016-10-06 13:09:06 -07:00
mediadrmserver.te Split general policy into public and private components. 2016-10-06 13:09:06 -07:00
mediaextractor.te Split general policy into public and private components. 2016-10-06 13:09:06 -07:00
mediametrics.te rename mediaanalytics->mediametrics, wider access 2017-01-24 16:57:19 -08:00
mediaserver.te Split general policy into public and private components. 2016-10-06 13:09:06 -07:00
mls sepolicy: add version_policy tool and version non-platform policy. 2016-12-06 08:56:02 -08:00
mls_decl sepolicy: add version_policy tool and version non-platform policy. 2016-12-06 08:56:02 -08:00
mls_macros Split general policy into public and private components. 2016-10-06 13:09:06 -07:00
mtp.te Split general policy into public and private components. 2016-10-06 13:09:06 -07:00
net.te Move netdomain policy to private 2017-02-06 15:02:00 -08:00
netd.te Split general policy into public and private components. 2016-10-06 13:09:06 -07:00
nfc.te Whitespace fix 2016-12-09 20:14:31 -08:00
otapreopt_chroot.te Split general policy into public and private components. 2016-10-06 13:09:06 -07:00
otapreopt_slot.te Split general policy into public and private components. 2016-10-06 13:09:06 -07:00
performanced.te Add policies for new services. 2017-02-09 15:15:11 -08:00
perfprofd.te Whitespace fix 2016-12-09 20:14:31 -08:00
platform_app.te Merge ephemeral data and apk files into app 2017-02-06 10:16:50 -08:00
policy_capabilities Define extended_socket_class policy capability and socket classes 2017-02-06 13:53:11 -05:00
port_contexts Split general policy into public and private components. 2016-10-06 13:09:06 -07:00
postinstall.te Split general policy into public and private components. 2016-10-06 13:09:06 -07:00
postinstall_dexopt.te Split general policy into public and private components. 2016-10-06 13:09:06 -07:00
ppp.te Split general policy into public and private components. 2016-10-06 13:09:06 -07:00
priv_app.te logd: restrict access to /dev/event-log-tags 2017-01-31 15:50:15 +00:00
property_contexts Move net.dns* to it's own label. 2017-02-09 16:14:05 -08:00
racoon.te Split general policy into public and private components. 2016-10-06 13:09:06 -07:00
radio.te logd: restrict access to /dev/event-log-tags 2017-01-31 15:50:15 +00:00
recovery_persist.te sepolicy: add version_policy tool and version non-platform policy. 2016-12-06 08:56:02 -08:00
recovery_refresh.te sepolicy: add version_policy tool and version non-platform policy. 2016-12-06 08:56:02 -08:00
rild.te Split general policy into public and private components. 2016-10-06 13:09:06 -07:00
roles_decl sepolicy: add version_policy tool and version non-platform policy. 2016-12-06 08:56:02 -08:00
runas.te Split general policy into public and private components. 2016-10-06 13:09:06 -07:00
sdcardd.te Split general policy into public and private components. 2016-10-06 13:09:06 -07:00
seapp_contexts Merge ephemeral data and apk files into app 2017-02-06 10:16:50 -08:00
security_classes Remove obsolete netlink_firewall_socket and netlink_ip6fw_socket classes. 2017-02-06 14:24:41 -05:00
sensord.te Add policies for new services. 2017-02-09 15:15:11 -08:00
service_contexts Add policies for new services. 2017-02-09 15:15:11 -08:00
servicemanager.te logd: restrict access to /dev/event-log-tags 2017-01-31 15:50:15 +00:00
shared_relro.te Restore app_domain macro and move to private use. 2016-12-08 14:42:43 -08:00
shell.te tracefs: avoid overly generic regexes 2017-02-12 08:40:32 -08:00
storaged.te storaged: allow register and callback from batteryproperties 2017-02-06 11:06:05 -08:00
su.te Add incident command and incidentd daemon se policy. 2017-02-07 15:52:07 -08:00
surfaceflinger.te surfaceflinger: grant access to vr_manager_service 2017-02-10 13:36:43 -08:00
system_app.te Add incident command and incidentd daemon se policy. 2017-02-07 15:52:07 -08:00
system_server.te Move net.dns* to it's own label. 2017-02-09 16:14:05 -08:00
tee.te Split general policy into public and private components. 2016-10-06 13:09:06 -07:00
tombstoned.te Introduce crash_dump debugging helper. 2017-01-18 15:03:24 -08:00
toolbox.te Split general policy into public and private components. 2016-10-06 13:09:06 -07:00
tzdatacheck.te Split general policy into public and private components. 2016-10-06 13:09:06 -07:00
ueventd.te Split general policy into public and private components. 2016-10-06 13:09:06 -07:00
uncrypt.te Split general policy into public and private components. 2016-10-06 13:09:06 -07:00
untrusted_app.te Allow untrusted apps to access VrManager. 2017-02-10 16:30:31 -08:00
update_engine.te Split general policy into public and private components. 2016-10-06 13:09:06 -07:00
update_engine_common.te Split general policy into public and private components. 2016-10-06 13:09:06 -07:00
update_verifier.te Split general policy into public and private components. 2016-10-06 13:09:06 -07:00
users Split general policy into public and private components. 2016-10-06 13:09:06 -07:00
vdc.te Split general policy into public and private components. 2016-10-06 13:09:06 -07:00
virtual_touchpad.te Add policies for new services. 2017-02-09 15:15:11 -08:00
vold.te Split general policy into public and private components. 2016-10-06 13:09:06 -07:00
webview_zygote.te Remove obsolete netlink_firewall_socket and netlink_ip6fw_socket classes. 2017-02-06 14:24:41 -05:00
wificond.te Split general policy into public and private components. 2016-10-06 13:09:06 -07:00
wpa.te Split general policy into public and private components. 2016-10-06 13:09:06 -07:00
zygote.te Remove SElinux audit to libart_file 2017-01-31 23:43:14 +00:00