tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
platform_system_sepolicy/private
History
Primiano Tucci 79d1dbbc05 Allow iorapd to access perfetto 
This requires moving the type declaration of
perfetto traced to public, because iorapd
needs to refer to it.

Denials without this CL:
https://pastebin.com/raw/sxHMeLEU

Bug: 72170747
Test: 1. runcon u:r:iorapd:s0 iorap.cmd.perfetto \
          -v --output-proto /data/misc/iorapd/test
      2. Check that no selinux denials other than
         avc: denied { entrypoint } for path="/system/bin/iorap.cmd.perfetto" dev="sda6" ino=21 scontext=u:r:iorapd:s0 tcontext=u:object_r:system_file:s0 tclass=file permissive=1
         show up (this is a side-effect of runcon).

Change-Id: Iacd1ab201fe9fb2a6302dbd528f42f709cbca054
2019-01-23 22:43:47 +00:00
..
compat Clean up server_configurable_flags test prop 2019-01-22 01:42:36 +00:00
access_vectors Update access_vectors 2018-11-01 19:53:50 -07:00
adbd.te Add the testharness service to sepolicy rules 2019-01-17 13:10:37 -08:00
apexd.te Allow apexd to also create dirs/files in its storage. 2019-01-14 09:15:46 +01:00
app.te Add the testharness service to sepolicy rules 2019-01-17 13:10:37 -08:00
app_neverallows.te Allow app to conntect to BufferHub service 2019-01-14 10:49:35 -08:00
app_zygote.te Initial sepolicy for app_zygote. 2019-01-21 08:24:41 +00:00
asan_extract.te Sepolicy: Add ASAN-Extract 2017-04-05 13:09:29 -07:00
atrace.te sepolicy: add rules for traced_probes to capture stderr and kill atrace on timeout 2018-11-16 14:47:19 +00:00
audioserver.te Allow audioserver to access persist.log.tag 2018-11-08 19:01:47 +09:00
binder_in_vendor_violators.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
binderservicedomain.te Move binderservicedomain policy to private 2017-02-08 09:09:39 -08:00
blank_screen.te Introduce system_file_type 2018-09-27 12:52:09 -07:00
blkid.te Introduce system_file_type 2018-09-27 12:52:09 -07:00
blkid_untrusted.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
bluetooth.te Fix permissions for bluetooth tethering. 2019-01-19 11:52:32 +09:00
bluetoothdomain.te Move bluetoothdomain policy to private 2017-02-06 15:32:08 -08:00
bootanim.te Dontaudit denials caused by race with labeling. 2018-02-14 17:07:13 -08:00
bootstat.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
bpfloader.te Add permissions for bpf.progs_loaded property 2019-01-14 10:59:10 -05:00
bufferhubd.te Remove unused bufferhub sepolicy 2018-12-10 13:36:11 -08:00
bug_map Track isolated_app app_data_file SELinux denial. 2018-12-04 05:45:33 +08:00
cameraserver.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
charger.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
clatd.te domain_deprecated is dead 2017-07-28 22:01:46 +00:00
coredomain.te Initial sepolicy for app_zygote. 2019-01-21 08:24:41 +00:00
cppreopts.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
crash_dump.te Add policy for apexd. 2018-10-04 07:06:45 +00:00
dex2oat.te domain_deprecated is dead 2017-07-28 22:01:46 +00:00
dexoptanalyzer.te Introduce system_file_type 2018-09-27 12:52:09 -07:00
dhcp.te domain_deprecated is dead 2017-07-28 22:01:46 +00:00
dnsmasq.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
domain.te Allow heap profiling of certain app domains on user builds 2019-01-21 14:30:57 +00:00
drmserver.te Tighten restrictions on core <-> vendor socket comms 2017-03-31 09:17:54 -07:00
dumpstate.te Revoke ftrace selinux access from dumpstate 2019-01-17 16:09:01 +00:00
ephemeral_app.te Allow heap profiling of certain app domains on user builds 2019-01-21 14:30:57 +00:00
fastbootd.te Add sepolicy for fastbootd 2018-08-15 08:45:22 -07:00
file.te Add initial sepolicy for app data snapshots. 2019-01-16 15:22:51 +00:00
file_contexts [layout compilation] Modify sepolicy to allow installd to run viewcompiler 2019-01-18 23:29:47 +00:00
file_contexts_asan Label /data/asan/* libs as system_lib_file. 2018-10-10 11:23:00 -07:00
file_contexts_overlayfs fs_mgr: add /mnt/scratch to possible overlayfs support directories 2018-10-08 14:23:01 +00:00
fingerprintd.te domain_deprecated is dead 2017-07-28 22:01:46 +00:00
flags_health_check.te sepolicy for server configurable flags 2018-11-01 03:28:56 +00:00
fs_use fs_mgr: add overlayfs handling for squashfs system filesystems 2018-08-08 07:33:10 -07:00
fsck.te Allow access to the metadata partition for metadata encryption. 2018-01-19 14:45:08 -08:00
fsck_untrusted.te domain_deprecated is dead 2017-07-28 22:01:46 +00:00
fwk_bufferhub.te Allow bufferhub service to allocate buffer 2018-11-07 13:57:55 -08:00
gatekeeperd.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
genfs_contexts Add filemap events for iorapd 2019-01-17 18:38:32 +00:00
gpuservice.te [gpuservice] allow "adb shell cmd gpu vkjson" 2018-11-27 15:58:20 -08:00
gsid.te sepolicy for gsid 2019-01-15 20:43:33 -08:00
hal_allocator_default.te Introduce system_file_type 2018-09-27 12:52:09 -07:00
hal_system_suspend_default.te Introduce system_file_type 2018-09-27 12:52:09 -07:00
halclientdomain.te Restrict access to hwservicemanager 2017-04-21 09:54:53 -07:00
halserverdomain.te Allow hals to read hwservicemanager prop. 2017-03-23 01:50:50 +00:00
healthd.te healthd provides health@2.0 service. 2017-10-17 13:48:42 -07:00
heapprofd.te Allow heap profiling of certain app domains on user builds 2019-01-21 14:30:57 +00:00
hwservice_contexts Permissions for InputClassifier HAL 2019-01-11 02:08:19 +00:00
hwservicemanager.te Finer grained permissions for ctl. properties 2018-05-22 13:47:16 -07:00
idmap.te Add idmap2 and idmap2d 2018-11-15 14:42:10 +00:00
incident.te Introduce system_file_type 2018-09-27 12:52:09 -07:00
incident_helper.te Allow dumpstate to dump incidentd 2018-12-04 15:42:56 -08:00
incidentd.te Allow dumpstate to dump incidentd 2018-12-04 15:42:56 -08:00
init.te Allow executing bpfloader from init and modify rules 2019-01-14 10:59:10 -05:00
initial_sid_contexts Split general policy into public and private components. 2016-10-06 13:09:06 -07:00
initial_sids Split general policy into public and private components. 2016-10-06 13:09:06 -07:00
inputflinger.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
install_recovery.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
installd.te [layout compilation] Modify sepolicy to allow installd to run viewcompiler 2019-01-18 23:29:47 +00:00
iorapd.te iorapd: Add new binder service iorapd. 2018-10-08 15:00:34 -07:00
isolated_app.te Allow heap profiling of certain app domains on user builds 2019-01-21 14:30:57 +00:00
iw.te Allow iw to be run at init phase. 2018-11-14 19:10:12 +00:00
kernel.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
keys.conf Split general policy into public and private components. 2016-10-06 13:09:06 -07:00
keystore.te Allow Keystore to check security logging property. 2018-01-24 19:49:18 +00:00
llkd.te Add policy for apexd. 2018-10-04 07:06:45 +00:00
lmkd.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
logd.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
logpersist.te sepolicy: Add rules for non-init namespaces 2017-11-21 08:34:32 -07:00
mac_permissions.xml Move MediaProvider to its own domain, add new MtpServer permissions 2016-12-12 11:05:33 -08:00
mdnsd.te Introduce system_file_type 2018-09-27 12:52:09 -07:00
mediadrmserver.te update sepolicy for gralloc HAL 2017-03-30 14:43:35 -07:00
mediaextractor.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
mediametrics.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
mediaprovider.te mediaprovider: add functionfs ioctl 2018-10-17 10:14:40 -07:00
mediaserver.te mediacodec->mediacodec+hal_omx{,_server,_client} 2018-05-30 18:12:32 +00:00
mediaswcodec.te add mediaswcodec service 2018-10-11 15:10:17 -07:00
mls sepolicy: Allow apps to get info from priv_app by ashmem 2018-10-23 12:37:03 +08:00
mls_decl sepolicy: add version_policy tool and version non-platform policy. 2016-12-06 08:56:02 -08:00
mls_macros Split general policy into public and private components. 2016-10-06 13:09:06 -07:00
modprobe.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
mtp.te domain_deprecated is dead 2017-07-28 22:01:46 +00:00
netd.te Allow netd to write to statsd 2019-01-16 13:33:18 +00:00
netutils_wrapper.te Start the process of locking down proc/net 2018-05-04 21:36:33 +00:00
network_stack.te Allow NetworkStack to find the telephony service 2019-01-15 16:57:32 +09:00
nfc.te SE Policy for Secure Element app and Secure Element HAL 2018-01-29 21:31:42 +00:00
otapreopt_chroot.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
otapreopt_slot.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
perfetto.te Allow to signal perfetto from shell. 2018-12-13 10:46:42 +00:00
performanced.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
perfprofd.te Sepolicy for system suspend HAL. 2018-08-13 17:26:34 -07:00
platform_app.te app: Allow all apps to read dropbox FDs 2018-09-04 20:23:43 +00:00
policy_capabilities Add nnp_nosuid_transition policycap and related class/perm definitions. 2018-09-07 10:52:31 -07:00
port_contexts Split general policy into public and private components. 2016-10-06 13:09:06 -07:00
postinstall.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
postinstall_dexopt.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
ppp.te domain_deprecated is dead 2017-07-28 22:01:46 +00:00
preloads_copy.te Add sepolicy for preloads_copy script 2018-10-23 17:11:36 +01:00
preopt2cachename.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
priv_app.te Allow heap profiling of certain app domains on user builds 2019-01-21 14:30:57 +00:00
profman.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
property_contexts Clean up server_configurable_flags test prop 2019-01-22 01:42:36 +00:00
racoon.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
radio.te Add label for time (zone) system properties 2018-06-25 17:59:56 +01:00
recovery.te domain_deprecated is dead 2017-07-28 22:01:46 +00:00
recovery_persist.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
recovery_refresh.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
roles_decl sepolicy: add version_policy tool and version non-platform policy. 2016-12-06 08:56:02 -08:00
rs.te rs: add tests to ensure rs cannot abuse app data 2019-01-17 15:24:34 -08:00
rss_hwm_reset.te SELinux policy for rss_hwm_reset 2018-12-15 10:13:03 +00:00
runas.te domain_deprecated is dead 2017-07-28 22:01:46 +00:00
runas_app.te Add permissions in runas_app domain to debug/profile debuggable apps. 2019-01-09 17:24:31 +00:00
sdcardd.te domain_deprecated is dead 2017-07-28 22:01:46 +00:00
seapp_contexts Initial sepolicy for app_zygote. 2019-01-21 08:24:41 +00:00
secure_element.te SE Policy for Secure Element app and Secure Element HAL 2018-01-29 21:31:42 +00:00
security_classes Update access_vectors 2018-11-01 19:53:50 -07:00
service.te sepolicy for gsid 2019-01-15 20:43:33 -08:00
service_contexts Add the testharness service to sepolicy rules 2019-01-17 13:10:37 -08:00
servicemanager.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
sgdisk.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
shared_relro.te domain_deprecated is dead 2017-07-28 22:01:46 +00:00
shell.te Allow to signal perfetto from shell. 2018-12-13 10:46:42 +00:00
slideshow.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
stats.te Incidentd gets statsd incident section 2018-11-13 09:18:34 -08:00
statsd.te Incidentd gets statsd incident section 2018-11-13 09:18:34 -08:00
storaged.te Introduce system_file_type 2018-09-27 12:52:09 -07:00
su.te SELinux policies for Perfetto cmdline client (/system/bin/perfetto) 2018-01-29 11:06:00 +00:00
surfaceflinger.te Remove coredomain /dev access no longer needed after Treble 2018-11-29 04:56:18 +00:00
system_app.te Add sepolicy for IpMemoryStoreService 2019-01-10 18:06:56 +09:00
system_server.te Clean up server_configurable_flags test prop 2019-01-22 01:42:36 +00:00
system_server_startup.te Transient SELinux domain for system_server JIT 2018-10-31 12:32:01 +00:00
technical_debt.cil Allow app to conntect to BufferHub service 2019-01-14 10:49:35 -08:00
thermalserviced.te Revert "Move thermal service into system_server" 2018-12-11 17:04:17 +00:00
tombstoned.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
toolbox.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
traced.te Allow iorapd to access perfetto 2019-01-23 22:43:47 +00:00
traced_probes.te Allow perfetto to ingest logs on userdebug/eng 2019-01-10 20:14:06 +00:00
traceur_app.te Allow the Traceur app to start Perfetto. 2018-12-10 18:51:29 -08:00
tzdatacheck.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
ueventd.te domain_deprecated is dead 2017-07-28 22:01:46 +00:00
uncrypt.te domain_deprecated is dead 2017-07-28 22:01:46 +00:00
untrusted_app.te Add untrusted_app_27 2018-04-03 12:25:51 -07:00
untrusted_app_25.te audit use of net.dns. property 2019-01-08 18:44:29 +00:00
untrusted_app_27.te Un-revert "Audit execution of app_data_file native code." 2019-01-07 14:08:11 +00:00
untrusted_app_all.te Allow heap profiling of certain app domains on user builds 2019-01-21 14:30:57 +00:00
update_engine.te domain_deprecated is dead 2017-07-28 22:01:46 +00:00
update_engine_common.te Split general policy into public and private components. 2016-10-06 13:09:06 -07:00
update_verifier.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
usbd.te usbd sepolicy 2018-01-20 03:41:21 +00:00
users Split general policy into public and private components. 2016-10-06 13:09:06 -07:00
vdc.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
vendor_init.te Remove vendor_init from coredomain 2018-01-29 18:07:41 +00:00
viewcompiler.te [layout compilation] Modify sepolicy to allow installd to run viewcompiler 2019-01-18 23:29:47 +00:00
virtual_touchpad.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
vold.te Abolish calls to shell in vold 2018-11-30 16:02:04 -08:00
vold_prepare_subdirs.te Add rules for multi-user backup/restore 2019-01-17 12:53:08 +00:00
vr_hwc.te Restrict access to hwservicemanager 2017-04-21 09:54:53 -07:00
wait_for_keymaster.te Introduce system_file_type 2018-09-27 12:52:09 -07:00
watchdogd.te Move watchdogd out of init and into its own domain 2018-08-03 19:28:05 +00:00
webview_zygote.te Allow webview_zygote to JIT. 2018-11-20 13:31:49 +00:00
wificond.te SE Policy for Wifi Offload HAL 2017-05-18 09:49:55 -07:00
wpantund.te lowpan: Add wpantund to SEPolicy 2017-10-16 14:10:40 -07:00
zygote.te Initial sepolicy for app_zygote. 2019-01-21 08:24:41 +00:00