Hridya Valsaraju 8c9cf62edb Allow coredomain access to only approved categories of vendor heaps ... One of the advantages of the DMA-BUF heaps framework over ION is that each heap is a separate char device and hence it is possible to create separate sepolicy permissions to restrict access to each heap. In the case of ION, allocation in every heap had to be done through /dev/ion which meant that there was no away to restrict allocations in a specific heap. This patch intends to restrict coredomain access to only approved categories of vendor heaps. Currently, the only identified category as per partner feedback is the system-secure heap which is defined as a heap that allocates from protected memory. Test: Build, video playback works on CF with ION disabled and without sepolicy denials Bug: 175697666 Change-Id: I923d2931c631d05d569e97f6e49145ef71324f3b		2020-12-16 10:08:54 -08:00
..
include	Assert types labeled in genfs_contexts have correct attributes	2018-03-23 14:34:46 -07:00
Android.bp	Fix sepolicy_tests on Mac 10.15	2019-11-23 17:45:01 -08:00
combine_maps.py	sepolicy: don't construct mappings for ignored types	2020-01-08 08:53:27 -08:00
fc_sort.py	fc_sort: delete c version, migrate to python version	2019-04-11 10:19:16 -07:00
mini_parser.py	Only maintain maps between current and previous selinux versions.	2018-10-02 15:10:13 -07:00
policy.py	Exempt app_data_file_type from neverallow rules.	2020-11-12 18:08:18 +00:00
searchpolicy.py	Sync internal master and AOSP sepolicy.	2017-09-26 14:38:47 -07:00
sepol_wrap.cpp	gracefully handle hashtab_search failures	2018-09-26 14:28:44 -07:00
sepolicy_tests.py	Allow coredomain access to only approved categories of vendor heaps	2020-12-16 10:08:54 -08:00
treble_sepolicy_tests.py	Remove binder_in_vendor_violators.	2020-08-27 00:00:35 +00:00