tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
platform_system_sepolicy/public
History
Inseob Kim 8c34247c7f Add bootloader_prop for ro.boot. properties 
ro.boot. properties assigned as "exported2_default_prop" are now
"bootloader_prop", to remove bad context name "exported2_default_prop".

Two things to clarify:

1) We have both the prefix entry and the exact entries. Although the
exact entries may be redundant, we may want to keep them. Vendors are
still allowed to have properties starting with "ro.boot." on
vendor_property_contexts file. The exact entries can prevent vendors
from modifying them to random contexts.

2) ro.boot. is special as it is originally for kernel command line
"androidboot.". But some ro.boot. properties are being used as if they
were normal. To avoid regression, ro.boot. properties having contexts
other than "exported2_default_prop" are not changed here. They will be
tracked later.

Bug: 155844385
Test: m selinux_policy
Change-Id: Ic0f4117ae68a828787304187457b5e1e105a52c7
Merged-In: Ic0f4117ae68a828787304187457b5e1e105a52c7
2020-07-24 00:15:23 +00:00
..
adbd.te Move system property rules to private 2020-03-18 16:46:04 +00:00
aidl_lazy_test_server.te Add aidl_lazy_test_server 2020-01-07 15:11:03 -08:00
apexd.te Move system property rules to private 2020-03-18 16:46:04 +00:00
app.te Make cross-user apps mlstrustedsubject. 2020-07-22 14:41:31 +01:00
app_zygote.te Properly Treble-ize tmpfs access 2019-01-26 17:30:41 +00:00
asan_extract.te asan_extract: add system_file_type to asan_extract_exec 2020-05-06 13:25:28 -07:00
attributes sepolicy: Remove offload HAL sepolicy rules 2020-05-08 11:17:12 +09:00
audioserver.te audioserver: allow audioserver to generate audio HAL tombstones 2019-11-04 18:05:28 -08:00
blkid.te
blkid_untrusted.te
bluetooth.te Remove unused *_tmpfs types 2019-01-30 21:54:40 +00:00
bootanim.te Allow the boot animation to receive display events 2020-05-20 15:04:34 +02:00
bootstat.te Move system property rules to private 2020-03-18 16:46:04 +00:00
bufferhubd.te Properly define hal_codec2 and related policies 2019-05-23 03:53:47 -07:00
camera_service_server.te Abstract use of cameraserver behind an attribute 2019-03-01 14:02:59 -08:00
cameraserver.te Properly define hal_codec2 and related policies 2019-05-23 03:53:47 -07:00
charger.te Move system property rules to private 2020-03-18 16:46:04 +00:00
crash_dump.te crash_dump: suppress denials on properties 2019-02-07 08:45:15 -08:00
credstore.te Add SELinux policy for credstore and update for IC HAL port from HIDL to AIDL. 2020-02-19 13:46:45 -05:00
device.te Add gnss_device dev_type 2020-03-17 20:25:51 +00:00
dhcp.te Move system property rules to private 2020-03-18 16:46:04 +00:00
display_service_server.te
dnsmasq.te add dontaudit dnsmasq kernel:system module_request 2020-01-18 18:22:12 -08:00
domain.te Add bootloader_prop for ro.boot. properties 2020-07-24 00:15:23 +00:00
drmserver.te mediaserver, mediaextractor, drmserver: allow vendor_overlay_file 2020-04-29 11:52:45 +09:00
dumpstate.te Let dumpstate access hal_identity 2020-06-24 10:40:44 +08:00
e2fs.te Allow e2fs more ioctls to device-mapper devices. 2019-02-05 18:05:50 -08:00
ephemeral_app.te Remove unused *_tmpfs types 2019-01-30 21:54:40 +00:00
fastbootd.te Merge "fastbootd: Allow flashing the cache partition." 2020-03-27 23:48:13 +00:00
file.te sepolicy: label vendor_service_contexts as vendor_service_contexts_file 2020-06-15 17:09:46 +08:00
fingerprintd.te Introduce system_file_type 2018-09-27 12:52:09 -07:00
flags_health_check.te Move system property rules to private 2020-03-18 16:46:04 +00:00
fsck.te fs_mgr: overlayfs support legacy devices (marlin) Part Deux 2019-02-15 15:56:16 +00:00
fsck_untrusted.te
fwk_bufferhub.te Allow app to conntect to BufferHub service 2019-01-14 10:49:35 -08:00
gatekeeperd.te Move system property rules to private 2020-03-18 16:46:04 +00:00
global_macros global_macros: trim back various watch* permissions 2019-08-28 12:36:58 -07:00
gmscore_app.te Create a separate SELinux domain for gmscore 2019-11-22 10:39:19 -08:00
gpuservice.te Game Driver: sepolicy update for plumbing GpuStats into GpuService 2019-02-08 18:15:17 -08:00
hal_allocator.te same_process_hal_file: access to individual coredomains 2018-10-26 18:03:01 +00:00
hal_atrace.te Add atrace HAL 1.0 sepolicy 2018-09-27 23:18:29 +00:00
hal_audio.te Move ro.audio.* props to audio_config_prop 2020-06-23 23:52:55 +09:00
hal_audiocontrol.te hal_attribute_hwservice_client drop '_client' 2018-06-06 09:30:18 -07:00
hal_authsecret.te hal_attribute_hwservice_client drop '_client' 2018-06-06 09:30:18 -07:00
hal_bluetooth.te Add rules for accessing the related bluetooth_audio_hal_prop 2019-03-20 03:12:25 +00:00
hal_bootctl.te add hal_bootctl to white-list of sys_rawio 2019-02-13 12:38:22 +00:00
hal_broadcastradio.te Allow radio server to client binder callback 2019-03-29 15:22:16 -07:00
hal_camera.te hal_attribute_hwservice_client drop '_client' 2018-06-06 09:30:18 -07:00
hal_can.te Move usb_serial_device to device.te 2019-12-13 17:01:27 -08:00
hal_cas.te hal_attribute_hwservice_client drop '_client' 2018-06-06 09:30:18 -07:00
hal_codec2.te Allow XML file paths to be customized with sysprop 2020-03-18 06:02:55 -07:00
hal_configstore.te debug builds: allow perf profiling of most domains 2020-01-22 22:04:02 +00:00
hal_confirmationui.te hal_attribute_hwservice_client drop '_client' 2018-06-06 09:30:18 -07:00
hal_contexthub.te hal_attribute_hwservice_client drop '_client' 2018-06-06 09:30:18 -07:00
hal_drm.te Allow drm hals to access allocator hal 2020-04-13 17:30:18 +00:00
hal_dumpstate.te hal_attribute_hwservice_client drop '_client' 2018-06-06 09:30:18 -07:00
hal_evs.te Update sepolicy for EVS v1.x 2019-07-30 13:22:03 -07:00
hal_face.te Revert "Allow hal_face to write to /data/vendor/camera_calibration/*." 2019-06-19 20:15:50 +00:00
hal_fingerprint.te Revert "Add placeholder iris and face policy for vold data directory" 2018-11-19 15:00:19 -08:00
hal_gatekeeper.te hal_attribute_hwservice_client drop '_client' 2018-06-06 09:30:18 -07:00
hal_gnss.te hal_attribute_hwservice_client drop '_client' 2018-06-06 09:30:18 -07:00
hal_graphics_allocator.te same_process_hal_file: access to individual coredomains 2018-10-26 18:03:01 +00:00
hal_graphics_composer.te Initial selinux policy support for memfd 2019-01-30 19:11:49 +00:00
hal_health.te Allow to getattr kmsg_device 2019-03-25 10:14:20 -07:00
hal_health_storage.te health.filesystem HAL renamed to health.storage 2018-09-20 04:12:45 +00:00
hal_identity.te Add SELinux policy for credstore and update for IC HAL port from HIDL to AIDL. 2020-02-19 13:46:45 -05:00
hal_input_classifier.te Permissions for InputClassifier HAL 2019-01-11 02:08:19 +00:00
hal_ir.te hal_attribute_hwservice_client drop '_client' 2018-06-06 09:30:18 -07:00
hal_keymaster.te hal_attribute_hwservice_client drop '_client' 2018-06-06 09:30:18 -07:00
hal_light.te Allow blank_screen to make binder calls to the servicemanager 2020-04-02 18:40:11 +02:00
hal_lowpan.te hal_attribute_hwservice_client drop '_client' 2018-06-06 09:30:18 -07:00
hal_memtrack.te hal_attribute_hwservice_client drop '_client' 2018-06-06 09:30:18 -07:00
hal_neuralnetworks.te Allow neuralnetworks hal service to read files from /sdcard 2020-04-28 08:08:48 +00:00
hal_neverallows.te SEPolicy rules for CAN bus HAL 2019-08-01 10:24:00 -07:00
hal_nfc.te hal_attribute_hwservice_client drop '_client' 2018-06-06 09:30:18 -07:00
hal_oemlock.te hal_attribute_hwservice_client drop '_client' 2018-06-06 09:30:18 -07:00
hal_omx.te Allow XML file paths to be customized with sysprop 2020-03-18 06:02:55 -07:00
hal_power.te grant power hal client to access stable power hal service 2020-02-10 16:32:35 -08:00
hal_power_stats.te Add power.stats HAL 1.0 sepolicy 2018-12-11 00:11:08 +00:00
hal_rebootescrow.te Support Resume on Reboot 2019-12-09 14:25:04 -08:00
hal_secure_element.te hal_attribute_hwservice_client drop '_client' 2018-06-06 09:30:18 -07:00
hal_sensors.te hal_attribute_hwservice_client drop '_client' 2018-06-06 09:30:18 -07:00
hal_telephony.te Grant app and hal access to telephony_config_prop 2020-06-05 10:40:16 +09:00
hal_tetheroffload.te hal_attribute_hwservice_client drop '_client' 2018-06-06 09:30:18 -07:00
hal_thermal.te hal_attribute_hwservice_client drop '_client' 2018-06-06 09:30:18 -07:00
hal_tv_cec.te hal_attribute_hwservice_client drop '_client' 2018-06-06 09:30:18 -07:00
hal_tv_input.te hal_attribute_hwservice_client drop '_client' 2018-06-06 09:30:18 -07:00
hal_tv_tuner.te Tuner Hal 1.0 Enable ITuner service 2019-08-14 11:22:09 -07:00
hal_usb.te Allow hal_usb to call getsockopt on uevent socket 2018-12-03 18:37:25 +00:00
hal_usb_gadget.te hal_attribute_hwservice_client drop '_client' 2018-06-06 09:30:18 -07:00
hal_vehicle.te hal_attribute_hwservice_client drop '_client' 2018-06-06 09:30:18 -07:00
hal_vibrator.te Allow dumping vibrator HAL. 2019-12-09 11:17:55 -08:00
hal_vr.te hal_attribute_hwservice_client drop '_client' 2018-06-06 09:30:18 -07:00
hal_weaver.te hal_attribute_hwservice_client drop '_client' 2018-06-06 09:30:18 -07:00
hal_wifi.te Add wifi_hal_prop and remove exported_wifi_prop 2020-07-17 17:38:13 +09:00
hal_wifi_hostapd.te hal_attribute_hwservice_client drop '_client' 2018-06-06 09:30:18 -07:00
hal_wifi_supplicant.te hal_attribute_hwservice_client drop '_client' 2018-06-06 09:30:18 -07:00
healthd.te Move system property rules to private 2020-03-18 16:46:04 +00:00
heapprofd.te Add userdebug selinux config for heapprofd. 2018-11-14 09:22:07 +00:00
hwservice.te sepolicy: Remove offload HAL sepolicy rules 2020-05-08 11:17:12 +09:00
hwservicemanager.te Move system property rules to private 2020-03-18 16:46:04 +00:00
idmap.te idmap: add binderservice permissions 2019-09-18 13:47:09 +02:00
incident.te
incident_helper.te Selinux permissions for incidentd project 2018-01-23 19:08:49 +00:00
incidentd.te
init.te allow init to access /proc/pagetypeinfo 2020-06-15 15:24:17 +00:00
inputflinger.te SEPolicy for InputFlinger Service. 2018-11-16 21:52:01 +00:00
installd.te Allow installd to read /proc/filesystems. 2020-02-20 14:05:18 +01:00
ioctl_defines [selinux] permissions on new ioctls for filling blocks 2020-03-19 16:31:52 -07:00
ioctl_macros more ioctl work 2018-10-17 11:12:18 -07:00
iorap_inode2filename.te sepolicy: policies for iorap.inode2filename 2020-02-20 16:38:17 -08:00
iorap_prefetcherd.te sepolicy: Add iorap_prefetcherd rules 2019-10-22 12:45:46 -07:00
iorapd.te iorapd: Allow dumpstate (bugreport) to dump iorapd 2020-03-31 13:48:47 -07:00
isolated_app.te Remove unused *_tmpfs types 2019-01-30 21:54:40 +00:00
kernel.te Allow kernel to write to update_engine_data_file 2020-02-18 23:43:00 -08:00
keystore.te sepolicy(wifi): Allow keystore-wificond communication 2020-01-17 21:14:25 +00:00
llkd.te Introduce system_file_type 2018-09-27 12:52:09 -07:00
lmkd.te sepolicy: Allow lmkd to communicate with its other instance for reinit 2020-05-07 15:42:24 +00:00
logd.te Move system property rules to private 2020-03-18 16:46:04 +00:00
logpersist.te logpersist is now a shell script, so give it the appropriate permissions 2019-10-30 13:54:35 -07:00
mdnsd.te
mediadrmserver.te Introduce system_file_type 2018-09-27 12:52:09 -07:00
mediaextractor.te mediaserver, mediaextractor, drmserver: allow vendor_overlay_file 2020-04-29 11:52:45 +09:00
mediametrics.te Allow mediametrics to log records to statsd 2019-02-25 20:09:54 -08:00
mediaprovider.te Remove unused *_tmpfs types 2019-01-30 21:54:40 +00:00
mediaserver.te mediaserver, mediaextractor, drmserver: allow vendor_overlay_file 2020-04-29 11:52:45 +09:00
mediaswcodec.te Move system property rules to private 2020-03-18 16:46:04 +00:00
modprobe.te allow modprobe to read /proc/cmdline 2020-05-05 08:50:11 -07:00
mtp.te mtp: support using pppox_socket family 2019-05-08 06:01:58 -07:00
net.te untrusted_app: disallow bind RTM_ROUTE socket 2020-01-28 10:49:50 +01:00
netd.te Add dontaudit statement to suppress denials 2020-07-14 09:49:06 +08:00
netutils_wrapper.te Introduce system_file_type 2018-09-27 12:52:09 -07:00
network_stack.te Remove unused *_tmpfs types 2019-01-30 21:54:40 +00:00
neverallow_macros neverallow_macros: add watch* perms 2019-09-05 09:54:43 -07:00
nfc.te Remove unused *_tmpfs types 2019-01-30 21:54:40 +00:00
perfetto.te Allow to signal perfetto from shell. 2018-12-13 10:46:42 +00:00
performanced.te Introduce system_file_type 2018-09-27 12:52:09 -07:00
platform_app.te Remove unused *_tmpfs types 2019-01-30 21:54:40 +00:00
postinstall.te Allow postinstall scripts to trigger F2FS GC 2019-02-20 22:40:53 +00:00
ppp.te ppp: support using pppox_socket family 2019-05-06 14:11:02 -07:00
priv_app.te Remove unused *_tmpfs types 2019-01-30 21:54:40 +00:00
profman.te Introduce system_file_type 2018-09-27 12:52:09 -07:00
property.te Add bootloader_prop for ro.boot. properties 2020-07-24 00:15:23 +00:00
racoon.te racoon: allow ioctl TUNSETIFF 2018-11-15 10:32:45 -08:00
radio.te Move system property rules to private 2020-03-18 16:46:04 +00:00
recovery.te Merge "Allow recovery mount metadata" 2020-03-20 19:13:31 +00:00
recovery_persist.te Introduce system_file_type 2018-09-27 12:52:09 -07:00
recovery_refresh.te Introduce system_file_type 2018-09-27 12:52:09 -07:00
roles
rs.te sepolicy: Add "rs" and "rs_exec" to public policy 2018-12-21 17:47:54 +00:00
rss_hwm_reset.te SELinux policy for rss_hwm_reset 2018-12-15 10:13:03 +00:00
runas.te Relabel /data/system/packages.list to new type. 2019-03-28 10:27:43 +00:00
runas_app.te Remove unused *_tmpfs types 2019-01-30 21:54:40 +00:00
scheduler_service_server.te Treble-ize sepolicy for fwk HIDL services. 2019-04-22 17:07:06 -07:00
sdcardd.te Move layout_version to /data/misc/installd 2019-08-21 10:11:35 -07:00
secure_element.te Remove unused *_tmpfs types 2019-01-30 21:54:40 +00:00
sensor_service_server.te Treble-ize sepolicy for fwk HIDL services. 2019-04-22 17:07:06 -07:00
service.te DO NOT MERGE Add fake 30.0 prebuilts 2020-05-11 13:18:52 +09:00
servicemanager.te sepolicy: label vendor_service_contexts as vendor_service_contexts_file 2020-06-15 17:09:46 +08:00
sgdisk.te Allow sgdisk to use BLKPBSZGET ioctl 2020-05-15 10:51:40 -07:00
shared_relro.te Remove unused *_tmpfs types 2019-01-30 21:54:40 +00:00
shell.te Allow adb shell user to collect vmstat 2020-04-22 20:46:01 -07:00
simpleperf.te perf_event: rules for system and simpleperf domain 2020-01-15 16:56:41 +00:00
simpleperf_app_runner.te Relabel /data/system/packages.list to new type. 2019-03-28 10:27:43 +00:00
slideshow.te sepolicy: Add rules for non-init namespaces 2017-11-21 08:34:32 -07:00
stats_service_server.te Treble-ize sepolicy for fwk HIDL services. 2019-04-22 17:07:06 -07:00
statsd.te Remove perfprofd references. 2019-07-19 11:15:12 -07:00
su.te sepolicy: Remove offload HAL sepolicy rules 2020-05-08 11:17:12 +09:00
surfaceflinger.te Initial selinux policy support for memfd 2019-01-30 19:11:49 +00:00
system_app.te Remove unused *_tmpfs types 2019-01-30 21:54:40 +00:00
system_server.te Initial selinux policy support for memfd 2019-01-30 19:11:49 +00:00
system_suspend_server.te Decouple system_suspend from hal attributes. 2019-02-26 18:10:28 -08:00
te_macros Refactor sepolicy to support central mode on user. 2020-04-06 12:33:43 +00:00
tee.te Revert "Add placeholder iris and face policy for vold data directory" 2018-11-19 15:00:19 -08:00
tombstoned.te Introduce system_file_type 2018-09-27 12:52:09 -07:00
toolbox.te Allow setattr for chattr 2020-02-03 17:57:03 -08:00
traced.te Allow iorapd to access perfetto 2019-01-23 22:43:47 +00:00
traced_perf.te initial policy for traced_perf daemon (perf profiler) 2020-01-22 22:04:01 +00:00
traced_probes.te Make traced_probes mlstrustedsubject. 2018-04-17 18:12:28 +00:00
traceur_app.te Move system property rules to private 2020-03-18 16:46:04 +00:00
tzdatacheck.te Introduce system_file_type 2018-09-27 12:52:09 -07:00
ueventd.te Move system property rules to private 2020-03-18 16:46:04 +00:00
uncrypt.te Uncrypt: Allow uncrypt to write on ota_package_file. 2020-07-07 00:03:11 +00:00
untrusted_app.te reland: untrusted_app_29: add new targetSdk domain 2020-01-22 09:47:53 +00:00
update_engine.te Move system property rules to private 2020-03-18 16:46:04 +00:00
update_engine_common.te Allow update_engine to search metadata_file:dir. 2020-03-02 18:20:37 -08:00
update_verifier.te Move system property rules to private 2020-03-18 16:46:04 +00:00
usbd.te Move system property rules to private 2020-03-18 16:46:04 +00:00
vdc.te Allow to getattr kmsg_device 2019-03-25 10:14:20 -07:00
vendor_init.te Remove exported3_default_prop 2020-07-21 04:16:04 +00:00
vendor_misc_writer.te Ignore the denial due to vendor_misc_writer reading DT fstab. 2019-10-10 22:17:53 -07:00
vendor_shell.te Allow shell to start vendor shell 2018-01-16 18:28:51 +00:00
vendor_toolbox.te
virtual_touchpad.te Introduce system_file_type 2018-09-27 12:52:09 -07:00
vndservice.te Allow vndservicemanager to self-register. 2020-03-05 17:43:35 +00:00
vndservicemanager.te
vold.te Add sepolicy for FUSE control filesystem. 2020-06-08 20:40:01 +02:00
vold_prepare_subdirs.te Introduce system_file_type 2018-09-27 12:52:09 -07:00
vr_hwc.te Introduce system_file_type 2018-09-27 12:52:09 -07:00
watchdogd.te Introduce system_file_type 2018-09-27 12:52:09 -07:00
webview_zygote.te Properly Treble-ize tmpfs access 2019-01-26 17:30:41 +00:00
wificond.te DO NOT MERGE Add fake 30.0 prebuilts 2020-05-11 13:18:52 +09:00
wpantund.te Introduce system_file_type 2018-09-27 12:52:09 -07:00
zygote.te Properly Treble-ize tmpfs access 2019-01-26 17:30:41 +00:00