tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
platform_system_sepolicy/private
History
Alan Stokes 832a7042b0 Suppress harmless denials for file creation in cgroupfs. 
The kernel generates file creation audits when O_CREAT is passed even
if the file already exists - which it always does in the cgroup cases.

We add neverallow rules to prevent mistakenly allowing unnecessary
create access. We also suppress these denials, which just add noise to
the log, for the more common culprits.

Bug: 72643420
Bug: 74182216

Test: Ran build_policies.sh and checked failures were unrelated.
Test: Device still boots, denials gone.
Change-Id: I034b41ca70da1e73b81fe90090e656f4a3b542dc
(cherry picked from commit 92c149d077)
2018-03-29 10:18:54 -07:00
..
compat Allow vendor-init-settable to persist.radio.multisim.config 2018-03-27 13:41:47 +09:00
access_vectors sepolicy: New sepolicy classes and rules about bpf object 2018-01-02 11:52:33 -08:00
adbd.te Adding write permissions to traceur 2018-01-22 21:06:36 +00:00
app.te Allow More Apps to Recv UDP Sockets from SystemServer 2018-01-15 23:10:42 +00:00
app_neverallows.te Improve neverallows on /proc and /sys 2018-03-28 15:56:36 -07:00
asan_extract.te Sepolicy: Add ASAN-Extract 2017-04-05 13:09:29 -07:00
atrace.te Reland: perfetto: allow traced_probes to execute atrace 2018-03-22 01:51:39 +00:00
audioserver.te Allow audioserver to access audio_device on non-Treble devices. 2018-03-19 17:16:52 -07:00
binder_in_vendor_violators.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
binderservicedomain.te
blank_screen.te Add policy for 'blank_screen'. 2018-01-22 20:27:01 +00:00
blkid.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
blkid_untrusted.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
bluetooth.te Bluetooth A2DP offload: Binder call to audio HAL 2018-03-12 13:28:43 -07:00
bluetoothdomain.te
bootanim.te Dontaudit denials caused by race with labeling. 2018-02-14 17:07:13 -08:00
bootstat.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
bpfloader.te Allow netd to setup xt_bpf iptable rules 2018-03-21 11:06:03 -07:00
bufferhubd.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
bug_map crashdump: cleanup logs 2018-03-26 15:45:04 -07:00
cameraserver.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
charger.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
clatd.te domain_deprecated is dead 2017-07-28 22:01:46 +00:00
coredomain.te Remove vendor_init from coredomain 2018-01-29 18:07:41 +00:00
cppreopts.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
crash_dump.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
dex2oat.te domain_deprecated is dead 2017-07-28 22:01:46 +00:00
dexoptanalyzer.te Don't allow dexoptanalyzer to open app_data_files 2017-11-02 10:45:09 -07:00
dhcp.te domain_deprecated is dead 2017-07-28 22:01:46 +00:00
dnsmasq.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
domain.te Reland: perfetto: allow traced_probes to execute atrace 2018-03-22 01:51:39 +00:00
drmserver.te Tighten restrictions on core <-> vendor socket comms 2017-03-31 09:17:54 -07:00
dumpstate.te Ensure taking a bugreport generates no denials. 2018-03-05 12:23:25 -08:00
ephemeral_app.te Allow More Apps to Recv UDP Sockets from SystemServer 2018-01-15 23:10:42 +00:00
file.te proc_type attribute for files under /proc. 2018-03-19 14:58:25 -07:00
file_contexts Add /odm/etc/selinux/odm_mac_permissions.xml 2018-03-16 15:45:02 +08:00
file_contexts_asan /odm is another vendor partition that can be customied by ODMs 2017-12-15 19:07:58 +09:00
fingerprintd.te domain_deprecated is dead 2017-07-28 22:01:46 +00:00
fs_use
fsck.te Allow access to the metadata partition for metadata encryption. 2018-01-19 14:45:08 -08:00
fsck_untrusted.te domain_deprecated is dead 2017-07-28 22:01:46 +00:00
gatekeeperd.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
genfs_contexts Allow perfetto traced_probes to access tracefs on user 2018-02-13 15:54:11 +00:00
hal_allocator_default.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
halclientdomain.te Restrict access to hwservicemanager 2017-04-21 09:54:53 -07:00
halserverdomain.te Allow hals to read hwservicemanager prop. 2017-03-23 01:50:50 +00:00
healthd.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
hwservice_contexts Bluetooth A2DP offload: Binder call to audio HAL 2018-03-12 13:28:43 -07:00
hwservicemanager.te sepolicy for lazy starting HIDL services 2017-10-17 16:36:10 -07:00
idmap.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
incident.te Add this rule allows incidentd CTS tests be able to use incident 2018-01-31 12:33:57 -08:00
incident_helper.te Selinux permissions for incidentd project 2018-01-23 19:08:49 +00:00
incidentd.te Enabling incidentd to get top and ps data. 2018-03-06 17:43:15 -08:00
init.te Suppress harmless denials for file creation in cgroupfs. 2018-03-29 10:18:54 -07:00
initial_sid_contexts
initial_sids
inputflinger.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
install_recovery.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
installd.te Ensure taking a bugreport generates no denials. 2018-03-05 12:23:25 -08:00
isolated_app.te Remove rules for starting the webview_zygote as a child of init. 2018-02-23 10:55:22 -05:00
kernel.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
keys.conf
keystore.te Allow Keystore to check security logging property. 2018-01-24 19:49:18 +00:00
lmkd.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
logd.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
logpersist.te sepolicy: Add rules for non-init namespaces 2017-11-21 08:34:32 -07:00
mac_permissions.xml
mdnsd.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
mediadrmserver.te update sepolicy for gralloc HAL 2017-03-30 14:43:35 -07:00
mediaextractor.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
mediametrics.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
mediaprovider.te allow mediaprovider to use media extractor 2018-03-19 13:05:24 -07:00
mediaserver.te Restrict access to hwservicemanager 2017-04-21 09:54:53 -07:00
mls
mls_decl
mls_macros
modprobe.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
mtp.te domain_deprecated is dead 2017-07-28 22:01:46 +00:00
net.te
netd.te Allow netd to setup xt_bpf iptable rules 2018-03-21 11:06:03 -07:00
netutils_wrapper.te sepolicy: Add rules for non-init namespaces 2017-11-21 08:34:32 -07:00
nfc.te SE Policy for Secure Element app and Secure Element HAL 2018-01-29 21:31:42 +00:00
otapreopt_chroot.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
otapreopt_slot.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
perfetto.te label /data/vendor{_ce,_de} 2018-02-08 17:21:25 +00:00
performanced.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
perfprofd.te Statsd: Allow statsd to contact perfprofd in userdebug 2018-03-27 12:08:45 -07:00
platform_app.te Remove proc and sysfs access from system_app and platform_app. 2018-01-20 01:05:21 +00:00
policy_capabilities
port_contexts
postinstall.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
postinstall_dexopt.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
ppp.te domain_deprecated is dead 2017-07-28 22:01:46 +00:00
preopt2cachename.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
priv_app.te Adding ability for priv apps to read traceur fd 2018-03-13 21:50:04 +00:00
profman.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
property_contexts Revert "Allow system server to set persist.traced.enable" 2018-03-26 17:48:11 +00:00
racoon.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
radio.te domain_deprecated is dead 2017-07-28 22:01:46 +00:00
recovery.te domain_deprecated is dead 2017-07-28 22:01:46 +00:00
recovery_persist.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
recovery_refresh.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
roles_decl
runas.te domain_deprecated is dead 2017-07-28 22:01:46 +00:00
sdcardd.te domain_deprecated is dead 2017-07-28 22:01:46 +00:00
seapp_contexts Revert "Revert "Ensure only com.android.shell can run in the shell domain."" 2018-02-16 10:46:09 -08:00
secure_element.te SE Policy for Secure Element app and Secure Element HAL 2018-01-29 21:31:42 +00:00
security_classes sepolicy: New sepolicy classes and rules about bpf object 2018-01-02 11:52:33 -08:00
service.te Setting up SELinux policy for statsd and stats service 2017-12-19 01:41:48 +00:00
service_contexts Added SELinux policy for BinderCallsStatsService 2018-03-20 21:51:17 +00:00
servicemanager.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
sgdisk.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
shared_relro.te domain_deprecated is dead 2017-07-28 22:01:46 +00:00
shell.te Statsd allow shell in selinux policy 2018-02-13 09:34:55 -08:00
slideshow.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
stats.te Setting up SELinux policy for statsd and stats service 2017-12-19 01:41:48 +00:00
statsd.te Statsd: Allow statsd to contact perfprofd in userdebug 2018-03-27 12:08:45 -07:00
storaged.te Ensure taking a bugreport generates no denials. 2018-03-05 12:23:25 -08:00
su.te SELinux policies for Perfetto cmdline client (/system/bin/perfetto) 2018-01-29 11:06:00 +00:00
surfaceflinger.te Dontaudit denials caused by race with labeling. 2018-02-14 17:07:13 -08:00
system_app.te Statsd allow shell in selinux policy 2018-02-13 09:34:55 -08:00
system_server.te Revert "Allow system server to set persist.traced.enable" 2018-03-26 17:48:11 +00:00
technical_debt.cil Allow applications to use NN API HAL services 2018-01-16 13:50:37 -08:00
thermalserviced.te Sync internal master and AOSP sepolicy. 2017-09-26 14:38:47 -07:00
tombstoned.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
toolbox.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
traced.te perfetto: allow traced to write into FDs received by the client 2018-03-26 01:01:31 +00:00
traced_probes.te Reland: perfetto: allow traced_probes to execute atrace 2018-03-22 01:51:39 +00:00
traceur_app.te Allow Traceur app to remove trace files. 2018-02-20 17:03:08 -08:00
tzdatacheck.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
ueventd.te domain_deprecated is dead 2017-07-28 22:01:46 +00:00
uncrypt.te domain_deprecated is dead 2017-07-28 22:01:46 +00:00
untrusted_app.te Allow More Apps to Recv UDP Sockets from SystemServer 2018-01-15 23:10:42 +00:00
untrusted_app_25.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
untrusted_app_all.te Hide some denials. 2018-03-28 15:17:02 -07:00
untrusted_v2_app.te Perfetto SELinux policies 2018-01-10 00:18:46 +00:00
update_engine.te domain_deprecated is dead 2017-07-28 22:01:46 +00:00
update_engine_common.te
update_verifier.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
usbd.te usbd sepolicy 2018-01-20 03:41:21 +00:00
users
vdc.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
vendor_init.te Remove vendor_init from coredomain 2018-01-29 18:07:41 +00:00
virtual_touchpad.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
vold.te domain_deprecated is dead 2017-07-28 22:01:46 +00:00
vold_prepare_subdirs.te label /data/vendor{_ce,_de} 2018-02-08 17:21:25 +00:00
vr_hwc.te Restrict access to hwservicemanager 2017-04-21 09:54:53 -07:00
watchdogd.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
webview_zygote.te Remove rules for starting the webview_zygote as a child of init. 2018-02-23 10:55:22 -05:00
wificond.te SE Policy for Wifi Offload HAL 2017-05-18 09:49:55 -07:00
wpantund.te lowpan: Add wpantund to SEPolicy 2017-10-16 14:10:40 -07:00
zygote.te Suppress harmless denials for file creation in cgroupfs. 2018-03-29 10:18:54 -07:00