tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
platform_system_sepolicy/private
History
Chenbo Feng 68ef8c070e Allow netd to setup xt_bpf iptable rules 
To better record the network traffic stats for each network interface.
We use xt_bpf netfilter module to do the iface stats accounting instead
of the cgroup bpf filter we currently use for per uid stats accounting.
The xt_bpf module will take pinned eBPF program as iptables rule and run
the program when packet pass through the netfilter hook. To setup the
iptables rules. netd need to be able to access bpf filesystem and run the
bpf program at boot time. The program used will still be created and
pinned by the bpfloader process.

Test: With selinux enforced, run "iptables -L -t raw" should show the
xt_bpf related rule present in bw_raw_PREROUTING chain.
Bug: 72111305

Change-Id: I11efe158d6bd5499df6adf15e8123a76cd67de04
(cherry picked from aosp commit 5c95c16841)
2018-03-21 14:37:37 -07:00
..
compat Allow only public-readable to ro.secure and ro.adb.secure 2018-03-19 08:35:39 +09:00
access_vectors sepolicy: New sepolicy classes and rules about bpf object 2018-01-02 11:52:33 -08:00
adbd.te Adding write permissions to traceur 2018-01-22 21:06:36 +00:00
app.te Allow More Apps to Recv UDP Sockets from SystemServer 2018-01-15 23:10:42 +00:00
app_neverallows.te authsecret HAL policies. 2018-02-05 11:19:46 +00:00
asan_extract.te Sepolicy: Add ASAN-Extract 2017-04-05 13:09:29 -07:00
atrace.te Use a whitelisting strategy for tracefs. 2018-02-05 10:03:06 -08:00
audioserver.te Allow audioserver to access audio_device on non-Treble devices. 2018-03-20 09:32:42 -07:00
binder_in_vendor_violators.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
binderservicedomain.te Move binderservicedomain policy to private 2017-02-08 09:09:39 -08:00
blank_screen.te Add policy for 'blank_screen'. 2018-01-22 20:27:01 +00:00
blkid.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
blkid_untrusted.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
bluetooth.te Bluetooth A2DP offload: Binder call to audio HAL 2018-03-12 19:21:08 +00:00
bluetoothdomain.te Move bluetoothdomain policy to private 2017-02-06 15:32:08 -08:00
bootanim.te Dontaudit denials caused by race with labeling. 2018-02-14 17:07:13 -08:00
bootstat.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
bpfloader.te Allow netd to setup xt_bpf iptable rules 2018-03-21 14:37:37 -07:00
bufferhubd.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
bug_map Merge "Track platform_app SELinux denial." into pi-dev 2018-03-07 19:22:54 +00:00
cameraserver.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
charger.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
clatd.te domain_deprecated is dead 2017-07-28 22:01:46 +00:00
coredomain.te Remove vendor_init from coredomain 2018-01-29 18:07:41 +00:00
cppreopts.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
crash_dump.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
dex2oat.te domain_deprecated is dead 2017-07-28 22:01:46 +00:00
dexoptanalyzer.te Don't allow dexoptanalyzer to open app_data_files 2017-11-02 10:45:09 -07:00
dhcp.te domain_deprecated is dead 2017-07-28 22:01:46 +00:00
dnsmasq.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
domain.te Add functionfs access to system_server. 2018-03-01 12:07:15 -08:00
drmserver.te Tighten restrictions on core <-> vendor socket comms 2017-03-31 09:17:54 -07:00
dumpstate.te Ensure taking a bugreport generates no denials. 2018-03-08 02:25:18 +00:00
ephemeral_app.te Allow More Apps to Recv UDP Sockets from SystemServer 2018-01-15 23:10:42 +00:00
file.te SELinux policies for Perfetto cmdline client (/system/bin/perfetto) 2018-01-29 11:06:00 +00:00
file_contexts /odm is another vendor partition other than /vendor 2018-03-08 10:09:16 +09:00
file_contexts_asan /odm is another vendor partition that can be customied by ODMs 2017-12-15 19:07:58 +09:00
fingerprintd.te domain_deprecated is dead 2017-07-28 22:01:46 +00:00
fs_use Split general policy into public and private components. 2016-10-06 13:09:06 -07:00
fsck.te Allow access to the metadata partition for metadata encryption. 2018-01-19 14:45:08 -08:00
fsck_untrusted.te domain_deprecated is dead 2017-07-28 22:01:46 +00:00
gatekeeperd.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
genfs_contexts Allow perfetto traced_probes to access tracefs on user 2018-02-13 15:54:11 +00:00
hal_allocator_default.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
halclientdomain.te Restrict access to hwservicemanager 2017-04-21 09:54:53 -07:00
halserverdomain.te Allow hals to read hwservicemanager prop. 2017-03-23 01:50:50 +00:00
healthd.te healthd provides health@2.0 service. 2017-10-17 13:48:42 -07:00
hwservice_contexts Bluetooth A2DP offload: Binder call to audio HAL 2018-03-12 19:21:08 +00:00
hwservicemanager.te sepolicy for lazy starting HIDL services 2017-10-17 16:36:10 -07:00
idmap.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
incident.te Add this rule allows incidentd CTS tests be able to use incident 2018-01-31 12:33:57 -08:00
incident_helper.te Selinux permissions for incidentd project 2018-01-23 19:08:49 +00:00
incidentd.te Enabling incidentd to get top and ps data. 2018-03-07 11:43:30 -08:00
init.te add vendor_init.te 2017-10-25 09:21:30 -07:00
initial_sid_contexts Split general policy into public and private components. 2016-10-06 13:09:06 -07:00
initial_sids Split general policy into public and private components. 2016-10-06 13:09:06 -07:00
inputflinger.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
install_recovery.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
installd.te Ensure taking a bugreport generates no denials. 2018-03-08 02:25:18 +00:00
isolated_app.te Remove rules for starting the webview_zygote as a child of init. 2018-02-23 10:55:22 -05:00
kernel.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
keys.conf Split general policy into public and private components. 2016-10-06 13:09:06 -07:00
keystore.te Allow Keystore to check security logging property. 2018-01-24 19:49:18 +00:00
lmkd.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
logd.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
logpersist.te sepolicy: Add rules for non-init namespaces 2017-11-21 08:34:32 -07:00
mac_permissions.xml Move MediaProvider to its own domain, add new MtpServer permissions 2016-12-12 11:05:33 -08:00
mdnsd.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
mediadrmserver.te update sepolicy for gralloc HAL 2017-03-30 14:43:35 -07:00
mediaextractor.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
mediametrics.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
mediaprovider.te allow mediaprovider to use media extractor 2018-03-19 22:46:16 +00:00
mediaserver.te Restrict access to hwservicemanager 2017-04-21 09:54:53 -07:00
mls Enforce per-app data protections for targetSdk 28+ 2018-01-18 13:32:57 -08:00
mls_decl sepolicy: add version_policy tool and version non-platform policy. 2016-12-06 08:56:02 -08:00
mls_macros Split general policy into public and private components. 2016-10-06 13:09:06 -07:00
modprobe.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
mtp.te domain_deprecated is dead 2017-07-28 22:01:46 +00:00
net.te Move netdomain policy to private 2017-02-06 15:02:00 -08:00
netd.te Allow netd to setup xt_bpf iptable rules 2018-03-21 14:37:37 -07:00
netutils_wrapper.te sepolicy: Add rules for non-init namespaces 2017-11-21 08:34:32 -07:00
nfc.te SE Policy for Secure Element app and Secure Element HAL 2018-01-29 21:31:42 +00:00
otapreopt_chroot.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
otapreopt_slot.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
perfetto.te label /data/vendor{_ce,_de} 2018-02-08 17:21:25 +00:00
performanced.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
perfprofd.te domain_deprecated is dead 2017-07-28 22:01:46 +00:00
platform_app.te Remove proc and sysfs access from system_app and platform_app. 2018-01-20 01:05:21 +00:00
policy_capabilities Define extended_socket_class policy capability and socket classes 2017-02-06 13:53:11 -05:00
port_contexts Split general policy into public and private components. 2016-10-06 13:09:06 -07:00
postinstall.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
postinstall_dexopt.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
ppp.te domain_deprecated is dead 2017-07-28 22:01:46 +00:00
preopt2cachename.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
priv_app.te priv_app: suppress denials for /proc/stat 2018-01-30 05:04:23 +00:00
profman.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
property_contexts Add default namespaces of odm properties 2018-01-18 13:31:37 +09:00
racoon.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
radio.te domain_deprecated is dead 2017-07-28 22:01:46 +00:00
recovery.te domain_deprecated is dead 2017-07-28 22:01:46 +00:00
recovery_persist.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
recovery_refresh.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
roles_decl sepolicy: add version_policy tool and version non-platform policy. 2016-12-06 08:56:02 -08:00
runas.te domain_deprecated is dead 2017-07-28 22:01:46 +00:00
sdcardd.te domain_deprecated is dead 2017-07-28 22:01:46 +00:00
seapp_contexts Revert "Revert "Ensure only com.android.shell can run in the shell domain."" 2018-02-16 10:46:09 -08:00
secure_element.te SE Policy for Secure Element app and Secure Element HAL 2018-01-29 21:31:42 +00:00
security_classes sepolicy: New sepolicy classes and rules about bpf object 2018-01-02 11:52:33 -08:00
service.te Setting up SELinux policy for statsd and stats service 2017-12-19 01:41:48 +00:00
service_contexts Merge "SE Policy for Secure Element app and Secure Element HAL" am: 6a60cb3e69 am: f285f2db4b 2018-01-30 01:26:15 +00:00
servicemanager.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
sgdisk.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
shared_relro.te domain_deprecated is dead 2017-07-28 22:01:46 +00:00
shell.te Statsd allow shell in selinux policy 2018-02-13 09:34:55 -08:00
slideshow.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
stats.te Setting up SELinux policy for statsd and stats service 2017-12-19 01:41:48 +00:00
statsd.te Statsd sepolicy for thermal hal 2018-02-26 20:32:58 -08:00
storaged.te Ensure taking a bugreport generates no denials. 2018-03-08 02:25:18 +00:00
su.te SELinux policies for Perfetto cmdline client (/system/bin/perfetto) 2018-01-29 11:06:00 +00:00
surfaceflinger.te Dontaudit denials caused by race with labeling. 2018-02-14 17:07:13 -08:00
system_app.te Statsd allow shell in selinux policy 2018-02-13 09:34:55 -08:00
system_server.te Fix sepolicy for bpf object 2018-03-07 14:51:18 +09:00
technical_debt.cil Allow applications to use NN API HAL services 2018-01-16 13:50:37 -08:00
thermalserviced.te Sync internal master and AOSP sepolicy. 2017-09-26 14:38:47 -07:00
tombstoned.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
toolbox.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
traced.te perfetto: Make producer socket MLS-aware 2018-02-21 14:37:58 +00:00
traced_probes.te Allow traced_probes to list the system partition 2018-02-23 17:35:42 +00:00
traceur_app.te Allow Traceur app to remove trace files. 2018-02-20 17:03:08 -08:00
tzdatacheck.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
ueventd.te domain_deprecated is dead 2017-07-28 22:01:46 +00:00
uncrypt.te domain_deprecated is dead 2017-07-28 22:01:46 +00:00
untrusted_app.te Enforce per-app data protections for targetSdk 28+ 2018-01-18 13:32:57 -08:00
untrusted_app_25.te Enforce per-app data protections for targetSdk 28+ 2018-01-18 13:32:57 -08:00
untrusted_app_27.te Enforce per-app data protections for targetSdk 28+ 2018-01-18 13:32:57 -08:00
untrusted_app_all.te Merge "Adding permission for traceur to use content provider" am: d312b5fdbe am: faa8dc010b 2018-01-24 23:08:12 +00:00
untrusted_v2_app.te Perfetto SELinux policies 2018-01-10 00:18:46 +00:00
update_engine.te domain_deprecated is dead 2017-07-28 22:01:46 +00:00
update_engine_common.te Split general policy into public and private components. 2016-10-06 13:09:06 -07:00
update_verifier.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
usbd.te usbd sepolicy 2018-01-20 03:41:21 +00:00
users Split general policy into public and private components. 2016-10-06 13:09:06 -07:00
vdc.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
vendor_init.te Remove vendor_init from coredomain 2018-01-29 18:07:41 +00:00
virtual_touchpad.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
vold.te domain_deprecated is dead 2017-07-28 22:01:46 +00:00
vold_prepare_subdirs.te Merge "label /data/vendor{_ce,_de}" am: 3721b0513d am: 7fd715ea82 2018-02-09 06:09:45 +00:00
vr_hwc.te Restrict access to hwservicemanager 2017-04-21 09:54:53 -07:00
watchdogd.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
webview_zygote.te Remove rules for starting the webview_zygote as a child of init. 2018-02-23 10:55:22 -05:00
wificond.te SE Policy for Wifi Offload HAL 2017-05-18 09:49:55 -07:00
wpantund.te lowpan: Add wpantund to SEPolicy 2017-10-16 14:10:40 -07:00
zygote.te Allow zygote to setpgid on webview_zygote. 2018-02-21 16:34:10 -05:00