tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
platform_system_sepolicy/public
History
Jeff Vander Stoep 5b557888dd Move platform/vendor data violations to device policy 
Sharing data folders by path will be disallowed because it violates
the approved API between platform and vendor components tested by
VTS. Move all violating permissions from core selinux policy to
device specific policy so that we can exempt existing devices from
the ban and enforce it on new devices.

Bug: 34980020
Test: Move permissions. Build and test wifi, wifi AP, nfc, fingerprint
    and Play movies on Marlin and Taimen.
Test: build on Angler, Bullhead, Dragon, Fugu, Marlin, Walleye

(cherry picked from commit ba2130a882)

Change-Id: Iaedbbe31237822cf3348209028bba45ad85465f8
2017-11-22 08:59:08 -08:00
..
adbd.te Moving adbd from rootdir to system/bin 2017-08-28 17:38:13 +08:00
asan_extract.te Sync internal master and AOSP sepolicy. 2017-09-26 14:38:47 -07:00
attributes Start tracking platform/vendor data access violations 2017-10-17 13:07:54 -07:00
audioserver.te Move audioserver policy to private 2017-02-07 10:47:18 -08:00
blkid.te Move blkid policy to private 2017-02-07 23:57:53 +00:00
blkid_untrusted.te Move blkid policy to private 2017-02-07 23:57:53 +00:00
bluetooth.te Move bluetooth policy to private 2017-02-06 15:29:10 -08:00
bootanim.te Sync internal master and AOSP sepolicy. 2017-09-26 14:38:47 -07:00
bootstat.te Remove bootstat access to proc label. 2017-09-18 10:29:24 -07:00
bufferhubd.te SELinux policies for PDX services 2017-05-15 10:07:05 -07:00
cameraserver.te Restrict access to hwservicemanager 2017-04-21 09:54:53 -07:00
charger.te sepolicy: Add rules for non-init namespaces 2017-11-21 08:34:32 -07:00
clatd.te sepolicy: Add rules for non-init namespaces 2017-11-21 08:34:32 -07:00
cppreopts.te Grant cppreopts.sh permissions to cleanup if it fails 2017-08-23 16:00:23 +00:00
crash_dump.te sepolicy: Add rules for non-init namespaces 2017-11-21 08:34:32 -07:00
device.te Sync internal master and AOSP sepolicy. 2017-09-27 18:55:47 -07:00
dex2oat.te Move domain_deprecated into private policy 2017-07-24 07:39:54 -07:00
dhcp.te sepolicy: Add rules for non-init namespaces 2017-11-21 08:34:32 -07:00
display_service_server.te Add fwk_display_hwservice. 2017-05-17 11:00:28 -07:00
dnsmasq.te sepolicy: Add rules for non-init namespaces 2017-11-21 08:34:32 -07:00
domain.te Move platform/vendor data violations to device policy 2017-11-22 08:59:08 -08:00
drmserver.te No access to tee domain over Unix domain sockets 2017-04-03 11:26:01 -07:00
dumpstate.te sepolicy: Add rules for non-init namespaces 2017-11-21 08:34:32 -07:00
e2fs.te Sync internal master and AOSP sepolicy. 2017-09-27 18:55:47 -07:00
ephemeral_app.te Move ephemeral_app policy to private 2017-01-09 15:34:27 -08:00
file.te Merge "system_server: access to /proc/sys/fs/pipe-max-size" am: 25576730c9 am: 1bd4443aa6 2017-11-17 17:25:23 +00:00
fingerprintd.te Remove fingerprintd access to sysfs_type and cgroup label. 2017-09-19 17:12:14 -07:00
fsck.te Sync internal master and AOSP sepolicy. 2017-09-27 18:55:47 -07:00
fsck_untrusted.te Sync internal master and AOSP sepolicy. 2017-09-27 18:55:47 -07:00
gatekeeperd.te Sync internal master and AOSP sepolicy. 2017-09-26 14:38:47 -07:00
global_macros sepolicy: Add rules for non-init namespaces 2017-11-21 08:34:32 -07:00
hal_allocator.te Restrict access to hwservicemanager 2017-04-21 09:54:53 -07:00
hal_audio.te Fix CTS regressions 2017-11-22 04:54:41 +00:00
hal_bluetooth.te sepolicy: Add rules for non-init namespaces 2017-11-21 08:34:32 -07:00
hal_bootctl.te Restrict access to hwservicemanager 2017-04-21 09:54:53 -07:00
hal_broadcastradio.te Move Broadcast Radio HAL to a separate binary. 2017-09-15 10:16:48 -07:00
hal_camera.te Fix CTS regressions 2017-11-22 04:54:41 +00:00
hal_cas.te Fix CTS regressions 2017-11-22 04:54:41 +00:00
hal_configstore.te Sync internal master and AOSP sepolicy. 2017-09-26 14:38:47 -07:00
hal_contexthub.te Restrict access to hwservicemanager 2017-04-21 09:54:53 -07:00
hal_drm.te Move platform/vendor data violations to device policy 2017-11-22 08:59:08 -08:00
hal_dumpstate.te Restrict access to hwservicemanager 2017-04-21 09:54:53 -07:00
hal_fingerprint.te Move platform/vendor data violations to device policy 2017-11-22 08:59:08 -08:00
hal_gatekeeper.te Restrict access to hwservicemanager 2017-04-21 09:54:53 -07:00
hal_gnss.te Restrict access to hwservicemanager 2017-04-21 09:54:53 -07:00
hal_graphics_allocator.te sepolicy: Add rules for non-init namespaces 2017-11-21 08:34:32 -07:00
hal_graphics_composer.te sepolicy: Add rules for non-init namespaces 2017-11-21 08:34:32 -07:00
hal_health.te hal_health_default: permissions for default impl 2017-10-31 15:11:23 -07:00
hal_ir.te Restrict access to hwservicemanager 2017-04-21 09:54:53 -07:00
hal_keymaster.te Restrict access to hwservicemanager 2017-04-21 09:54:53 -07:00
hal_light.te Restrict access to hwservicemanager 2017-04-21 09:54:53 -07:00
hal_lowpan.te Sync internal master and AOSP sepolicy. 2017-09-27 18:55:47 -07:00
hal_memtrack.te Restrict access to hwservicemanager 2017-04-21 09:54:53 -07:00
hal_neuralnetworks.te Sync internal master and AOSP sepolicy. 2017-09-26 14:38:47 -07:00
hal_neverallows.te sepolicy: Add rules for non-init namespaces 2017-11-21 08:34:32 -07:00
hal_nfc.te Move platform/vendor data violations to device policy 2017-11-22 08:59:08 -08:00
hal_oemlock.te Add missing sepolicies for OemLock HAL. 2017-05-31 15:22:05 +01:00
hal_power.te Restrict access to hwservicemanager 2017-04-21 09:54:53 -07:00
hal_sensors.te sepolicy: Add rules for non-init namespaces 2017-11-21 08:34:32 -07:00
hal_telephony.te Restrict access to hwservicemanager 2017-04-21 09:54:53 -07:00
hal_tetheroffload.te Sync internal master and AOSP sepolicy. 2017-09-26 14:38:47 -07:00
hal_thermal.te Restrict access to hwservicemanager 2017-04-21 09:54:53 -07:00
hal_tv_cec.te Restrict access to hwservicemanager 2017-04-21 09:54:53 -07:00
hal_tv_input.te Restrict access to hwservicemanager 2017-04-21 09:54:53 -07:00
hal_usb.te Allow callers of uevent_kernel_*() access to /proc/sys/kernel/overflowuid 2017-11-08 01:39:28 +00:00
hal_vibrator.te Restrict access to hwservicemanager 2017-04-21 09:54:53 -07:00
hal_vr.te Restrict access to hwservicemanager 2017-04-21 09:54:53 -07:00
hal_weaver.te Add missing sepolicies for the Weaver HAL. 2017-05-31 15:17:11 +01:00
hal_wifi.te sepolicy: Add rules for non-init namespaces 2017-11-21 08:34:32 -07:00
hal_wifi_offload.te Sync internal master and AOSP sepolicy. 2017-09-26 14:38:47 -07:00
hal_wifi_supplicant.te Move platform/vendor data violations to device policy 2017-11-22 08:59:08 -08:00
healthd.te Merge "sepolicy: Add rules for non-init namespaces" am: b9ea282c65 am: d41e616199 2017-11-21 17:47:23 +00:00
hwservice.te Sync internal master and AOSP sepolicy. 2017-09-27 18:55:47 -07:00
hwservicemanager.te Add hwservice_contexts and support for querying it. 2017-04-12 18:07:12 -07:00
idmap.te sepolicy: restrict /vendor/overlay from most coredomains 2017-04-06 13:28:16 -07:00
incident.te Add incident command and incidentd daemon se policy. 2017-02-07 15:52:07 -08:00
incidentd.te Add incident command and incidentd daemon se policy. 2017-02-07 15:52:07 -08:00
init.te Merge "sepolicy: Add rules for non-init namespaces" am: b9ea282c65 am: d41e616199 2017-11-21 17:47:23 +00:00
inputflinger.te te_macros: introduce add_service() macro 2017-01-26 04:43:16 +00:00
install_recovery.te sepolicy: Add rules for non-init namespaces 2017-11-21 08:34:32 -07:00
installd.te sepolicy: Add rules for non-init namespaces 2017-11-21 08:34:32 -07:00
ioctl_defines Fix TIOCSCTTY ioctl definition for mips 2017-08-31 18:16:46 +02:00
ioctl_macros Add TCSETS to unpriv_tty_ioctls 2016-12-07 15:59:34 -08:00
isolated_app.te Move isolated_app policy to private 2017-01-05 16:06:54 -08:00
kernel.te sepolicy: Add rules for non-init namespaces 2017-11-21 08:34:32 -07:00
keystore.te Move domain_deprecated into private policy 2017-07-24 07:39:54 -07:00
lmkd.te sepolicy: Add rules for non-init namespaces 2017-11-21 08:34:32 -07:00
logd.te sepolicy: Add rules for non-init namespaces 2017-11-21 08:34:32 -07:00
logpersist.te logpersist: do not permit dynamic transition to domain 2016-12-29 09:29:36 -08:00
mdnsd.te Move mdnsd policy to private 2017-02-06 15:02:32 -08:00
mediacodec.te Sync internal master and AOSP sepolicy. 2017-09-26 14:38:47 -07:00
mediadrmserver.te Sync internal master and AOSP sepolicy. 2017-09-26 14:38:47 -07:00
mediaextractor.te Merge "mediaextractor: ensure no direct open()s" am: e22e99a68b am: ea17be6014 am: cbb0543d3f 2017-10-07 18:07:18 +00:00
mediametrics.te Sync internal master and AOSP sepolicy. 2017-09-26 14:38:47 -07:00
mediaprovider.te Split mediaprovider from priv_app. 2017-07-10 11:17:18 -07:00
mediaserver.te mediaserver: remove access to 'sysfs' type. 2017-11-16 17:34:14 -08:00
modprobe.te sepolicy: Add rules for non-init namespaces 2017-11-21 08:34:32 -07:00
mtp.te sepolicy: Add rules for non-init namespaces 2017-11-21 08:34:32 -07:00
net.te Move netdomain policy to private 2017-02-06 15:02:00 -08:00
netd.te sepolicy: Add rules for non-init namespaces 2017-11-21 08:34:32 -07:00
netutils_wrapper.te add netutils_wrappers 2017-04-14 22:57:27 -07:00
neverallow_macros Ban socket connections between core and vendor 2017-03-27 08:49:13 -07:00
nfc.te Remove unnecessary rules from NFC HAL clients 2017-03-22 16:22:33 -07:00
otapreopt_chroot.te sepolicy: Add rules for non-init namespaces 2017-11-21 08:34:32 -07:00
otapreopt_slot.te Sepolicy: Give otapreopt_slot read on A/B artifact links 2017-04-07 20:19:41 -07:00
performanced.te sepolicy: Add rules for non-init namespaces 2017-11-21 08:34:32 -07:00
perfprofd.te sepolicy: Add rules for non-init namespaces 2017-11-21 08:34:32 -07:00
platform_app.te Move platform_app policy to private 2017-01-09 14:52:59 -08:00
postinstall.te Split general policy into public and private components. 2016-10-06 13:09:06 -07:00
postinstall_dexopt.te sepolicy: Add rules for non-init namespaces 2017-11-21 08:34:32 -07:00
ppp.te sepolicy: Add rules for non-init namespaces 2017-11-21 08:34:32 -07:00
preopt2cachename.te Split general policy into public and private components. 2016-10-06 13:09:06 -07:00
priv_app.te Move priv_app policy to private 2017-01-05 15:44:32 -08:00
profman.te Allow profman to analyze profiles for the secondary dex files 2017-03-15 18:47:13 -07:00
property.te Revert "Revert "Put pm.* property in new pm_prop context"" 2017-11-16 05:28:14 +00:00
racoon.te sepolicy: Add rules for non-init namespaces 2017-11-21 08:34:32 -07:00
radio.te Allow vendor apps to use surfaceflinger_service 2017-11-09 15:41:37 +00:00
recovery.te Clean up old file-based OTA SELinux rules 2017-11-21 14:20:17 -08:00
recovery_persist.te sepolicy: add version_policy tool and version non-platform policy. 2016-12-06 08:56:02 -08:00
recovery_refresh.te sepolicy: add version_policy tool and version non-platform policy. 2016-12-06 08:56:02 -08:00
rild.te sepolicy: Add rules for non-init namespaces 2017-11-21 08:34:32 -07:00
roles sepolicy: add version_policy tool and version non-platform policy. 2016-12-06 08:56:02 -08:00
runas.te sepolicy: Add rules for non-init namespaces 2017-11-21 08:34:32 -07:00
sdcardd.te sepolicy: Add rules for non-init namespaces 2017-11-21 08:34:32 -07:00
service.te Merge "Add selinux policy for CrossProfileAppsService" 2017-11-13 06:43:36 +00:00
servicemanager.te Sync internal master and AOSP sepolicy. 2017-09-26 14:38:47 -07:00
sgdisk.te sepolicy: Add rules for non-init namespaces 2017-11-21 08:34:32 -07:00
shared_relro.te Allow shared_relro to connect to activity_service. 2017-07-24 17:38:40 -04:00
shell.te shell: neverallow access to 'proc' label. 2017-11-17 18:39:07 +00:00
slideshow.te sepolicy: Add rules for non-init namespaces 2017-11-21 08:34:32 -07:00
su.te Sync internal master and AOSP sepolicy. 2017-09-27 18:55:47 -07:00
surfaceflinger.te Move surfaceflinger policy to private 2017-02-07 10:06:12 -08:00
system_app.te Move system_app policy to private 2017-01-05 17:20:28 -08:00
system_server.te Move system_server policy to private 2017-02-07 20:24:05 +00:00
te_macros Fix CTS regressions am: 6a28b68d54 am: 7dc46564d0 2017-11-22 05:04:04 +00:00
tee.te Move domain_deprecated into private policy 2017-07-24 07:39:54 -07:00
thermalserviced.te PowerUI access to thermalservice 2017-10-14 01:05:58 +00:00
tombstoned.te DO NOT MERGE ANYWHERE Revert "SEPolicy: Changes for new stack dumping scheme." 2017-06-23 17:36:26 +01:00
toolbox.te Split general policy into public and private components. 2016-10-06 13:09:06 -07:00
tzdatacheck.te Allow the shell user to run tzdatacheck 2017-04-20 09:31:36 +00:00
ueventd.te sepolicy: Add rules for non-init namespaces 2017-11-21 08:34:32 -07:00
uncrypt.te sepolicy: Add rules for non-init namespaces 2017-11-21 08:34:32 -07:00
untrusted_app.te Move untrusted_app policy to private 2017-01-05 14:39:52 -08:00
untrusted_app_25.te untrusted_app: policy versioning based on targetSdkVersion 2017-02-14 13:30:12 -08:00
untrusted_v2_app.te Add new untrusted_v2_app domain 2017-02-21 12:39:55 -08:00
update_engine.te sepolicy: Add rules for non-init namespaces 2017-11-21 08:34:32 -07:00
update_engine_common.te Make /proc/sys/kernel/random available to everyone 2017-11-20 21:02:21 +00:00
update_verifier.te Create sysfs_dm label. 2017-10-10 14:42:24 -07:00
vdc.te Sync internal master and AOSP sepolicy. 2017-09-27 18:55:47 -07:00
vendor_init.te sepolicy: Add rules for non-init namespaces 2017-11-21 08:34:32 -07:00
vendor_shell.te vendor_shell: add sepolicy for vendor shell 2017-04-14 09:38:51 -07:00
vendor_toolbox.te Allow init to run vendor toybox for modprobe 2017-05-24 15:01:20 -07:00
virtual_touchpad.te Allow vr_hwc and virtual_touchpad to query for permissions 2017-04-21 17:15:03 -04:00
vndservice.te Add default label and mapping for vendor services 2017-04-28 14:56:57 -07:00
vndservicemanager.te Initial sepolicy for vndservicemanager. 2017-03-23 00:20:43 +00:00
vold.te Fix CTS regressions 2017-11-22 04:54:41 +00:00
vold_prepare_subdirs.te Move most of public/vold_prepare_subdirs.te to private 2017-10-25 13:06:25 -07:00
vr_hwc.te SELinux policies for PDX services 2017-05-10 16:39:19 -07:00
watchdogd.te Split general policy into public and private components. 2016-10-06 13:09:06 -07:00
webview_zygote.te Move webview_zygote policy to private 2017-01-27 17:01:43 +00:00
wificond.te sepolicy: Add rules for non-init namespaces 2017-11-21 08:34:32 -07:00
wpantund.te sepolicy: Add rules for non-init namespaces 2017-11-21 08:34:32 -07:00
zygote.te Move zygote policy to private 2017-01-26 13:31:16 -08:00