tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
platform_system_sepolicy/public
History
Jeff Vander Stoep ed876a5e96 Fix CTS regressions 
Commit 7688161 "hal_*_(client|server) => hal(client|server)domain"
added neverallow rules on hal_*_client attributes while simultaneously
expanding these attribute which causes them to fail CTS neverallow
tests. Remove these neverallow rules as they do not impose specific
security properties that we want to enforce.

Modify Other neverallow failures which were imposed on hal_foo
attributes and should have been enforced on hal_foo_server attributes
instead.

Bug: 69566734
Test: cts-tradefed run cts -m CtsSecurityHostTestCases -t \
    android.cts.security.SELinuxNeverallowRulesTest

    CtsSecurityHostTestCases completed in 7s. 627 passed, 1 failed
    remaining failure appears to be caused by b/68133473
Change-Id: I83dcb33c3a057f126428f88a90b95f3f129d9f0e
2017-11-21 18:06:20 +00:00
..
adbd.te Moving adbd from rootdir to system/bin 2017-08-28 17:38:13 +08:00
asan_extract.te Sync internal master and AOSP sepolicy. 2017-09-26 14:38:47 -07:00
attributes Start tracking platform/vendor data access violations 2017-10-17 13:07:54 -07:00
audioserver.te Move audioserver policy to private 2017-02-07 10:47:18 -08:00
blkid.te Move blkid policy to private 2017-02-07 23:57:53 +00:00
blkid_untrusted.te Move blkid policy to private 2017-02-07 23:57:53 +00:00
bluetooth.te Move bluetooth policy to private 2017-02-06 15:29:10 -08:00
bootanim.te Sync internal master and AOSP sepolicy. 2017-09-26 14:38:47 -07:00
bootstat.te Remove bootstat access to proc label. 2017-09-18 10:29:24 -07:00
bufferhubd.te SELinux policies for PDX services 2017-05-15 10:07:05 -07:00
cameraserver.te Restrict access to hwservicemanager 2017-04-21 09:54:53 -07:00
charger.te sepolicy: Add rules for non-init namespaces 2017-11-21 08:34:32 -07:00
clatd.te sepolicy: Add rules for non-init namespaces 2017-11-21 08:34:32 -07:00
cppreopts.te Grant cppreopts.sh permissions to cleanup if it fails 2017-08-23 16:00:23 +00:00
crash_dump.te sepolicy: Add rules for non-init namespaces 2017-11-21 08:34:32 -07:00
device.te Sync internal master and AOSP sepolicy. 2017-09-26 14:38:47 -07:00
dex2oat.te Move domain_deprecated into private policy 2017-07-24 07:39:54 -07:00
dhcp.te sepolicy: Add rules for non-init namespaces 2017-11-21 08:34:32 -07:00
display_service_server.te Add fwk_display_hwservice. 2017-05-17 11:00:28 -07:00
dnsmasq.te sepolicy: Add rules for non-init namespaces 2017-11-21 08:34:32 -07:00
domain.te Fix CTS regressions 2017-11-21 18:06:20 +00:00
drmserver.te No access to tee domain over Unix domain sockets 2017-04-03 11:26:01 -07:00
dumpstate.te sepolicy: Add rules for non-init namespaces 2017-11-21 08:34:32 -07:00
e2fs.te Sync internal master and AOSP sepolicy. 2017-09-26 14:38:47 -07:00
ephemeral_app.te Move ephemeral_app policy to private 2017-01-09 15:34:27 -08:00
file.te system_server: access to /proc/sys/fs/pipe-max-size 2017-11-16 12:30:53 -08:00
fingerprintd.te Remove fingerprintd access to sysfs_type and cgroup label. 2017-09-19 17:12:14 -07:00
fsck.te Sync internal master and AOSP sepolicy. 2017-09-26 14:38:47 -07:00
fsck_untrusted.te Sync internal master and AOSP sepolicy. 2017-09-26 14:38:47 -07:00
gatekeeperd.te Sync internal master and AOSP sepolicy. 2017-09-26 14:38:47 -07:00
global_macros sepolicy: Add rules for non-init namespaces 2017-11-21 08:34:32 -07:00
hal_allocator.te Restrict access to hwservicemanager 2017-04-21 09:54:53 -07:00
hal_audio.te Fix CTS regressions 2017-11-21 18:06:20 +00:00
hal_bluetooth.te sepolicy: Add rules for non-init namespaces 2017-11-21 08:34:32 -07:00
hal_bootctl.te Restrict access to hwservicemanager 2017-04-21 09:54:53 -07:00
hal_broadcastradio.te Move Broadcast Radio HAL to a separate binary. 2017-09-15 10:16:48 -07:00
hal_camera.te Fix CTS regressions 2017-11-21 18:06:20 +00:00
hal_cas.te Fix CTS regressions 2017-11-21 18:06:20 +00:00
hal_configstore.te Sync internal master and AOSP sepolicy. 2017-09-26 14:38:47 -07:00
hal_contexthub.te Restrict access to hwservicemanager 2017-04-21 09:54:53 -07:00
hal_drm.te Fix CTS regressions 2017-11-21 18:06:20 +00:00
hal_dumpstate.te Restrict access to hwservicemanager 2017-04-21 09:54:53 -07:00
hal_fingerprint.te Move platform/vendor data violations to device policy 2017-11-20 17:18:56 +00:00
hal_gatekeeper.te Restrict access to hwservicemanager 2017-04-21 09:54:53 -07:00
hal_gnss.te Restrict access to hwservicemanager 2017-04-21 09:54:53 -07:00
hal_graphics_allocator.te sepolicy: Add rules for non-init namespaces 2017-11-21 08:34:32 -07:00
hal_graphics_composer.te sepolicy: Add rules for non-init namespaces 2017-11-21 08:34:32 -07:00
hal_health.te hal_health_default: permissions for default impl 2017-10-31 15:11:23 -07:00
hal_ir.te Restrict access to hwservicemanager 2017-04-21 09:54:53 -07:00
hal_keymaster.te Restrict access to hwservicemanager 2017-04-21 09:54:53 -07:00
hal_light.te Restrict access to hwservicemanager 2017-04-21 09:54:53 -07:00
hal_lowpan.te Sync internal master and AOSP sepolicy. 2017-09-26 14:38:47 -07:00
hal_memtrack.te Restrict access to hwservicemanager 2017-04-21 09:54:53 -07:00
hal_neuralnetworks.te Sync internal master and AOSP sepolicy. 2017-09-26 14:38:47 -07:00
hal_neverallows.te sepolicy: Add rules for non-init namespaces 2017-11-21 08:34:32 -07:00
hal_nfc.te Move platform/vendor data violations to device policy 2017-11-20 17:18:56 +00:00
hal_oemlock.te Add missing sepolicies for OemLock HAL. 2017-05-31 15:22:05 +01:00
hal_power.te Restrict access to hwservicemanager 2017-04-21 09:54:53 -07:00
hal_sensors.te sepolicy: Add rules for non-init namespaces 2017-11-21 08:34:32 -07:00
hal_telephony.te Restrict access to hwservicemanager 2017-04-21 09:54:53 -07:00
hal_tetheroffload.te Sync internal master and AOSP sepolicy. 2017-09-26 14:38:47 -07:00
hal_thermal.te Restrict access to hwservicemanager 2017-04-21 09:54:53 -07:00
hal_tv_cec.te Restrict access to hwservicemanager 2017-04-21 09:54:53 -07:00
hal_tv_input.te Restrict access to hwservicemanager 2017-04-21 09:54:53 -07:00
hal_usb.te Allow callers of uevent_kernel_*() access to /proc/sys/kernel/overflowuid 2017-11-08 01:39:28 +00:00
hal_vibrator.te Restrict access to hwservicemanager 2017-04-21 09:54:53 -07:00
hal_vr.te Restrict access to hwservicemanager 2017-04-21 09:54:53 -07:00
hal_weaver.te Add missing sepolicies for the Weaver HAL. 2017-05-31 15:17:11 +01:00
hal_wifi.te sepolicy: Add rules for non-init namespaces 2017-11-21 08:34:32 -07:00
hal_wifi_offload.te Sync internal master and AOSP sepolicy. 2017-09-26 14:38:47 -07:00
hal_wifi_supplicant.te sepolicy: Add rules for non-init namespaces 2017-11-21 08:34:32 -07:00
healthd.te sepolicy: Add rules for non-init namespaces 2017-11-21 08:34:32 -07:00
hwservice.te Sync internal master and AOSP sepolicy. 2017-09-26 14:38:47 -07:00
hwservicemanager.te Add hwservice_contexts and support for querying it. 2017-04-12 18:07:12 -07:00
idmap.te sepolicy: restrict /vendor/overlay from most coredomains 2017-04-06 13:28:16 -07:00
incident.te Add incident command and incidentd daemon se policy. 2017-02-07 15:52:07 -08:00
incidentd.te Add incident command and incidentd daemon se policy. 2017-02-07 15:52:07 -08:00
init.te sepolicy: Add rules for non-init namespaces 2017-11-21 08:34:32 -07:00
inputflinger.te te_macros: introduce add_service() macro 2017-01-26 04:43:16 +00:00
install_recovery.te sepolicy: Add rules for non-init namespaces 2017-11-21 08:34:32 -07:00
installd.te sepolicy: Add rules for non-init namespaces 2017-11-21 08:34:32 -07:00
ioctl_defines Fix TIOCSCTTY ioctl definition for mips 2017-08-31 18:16:46 +02:00
ioctl_macros Add TCSETS to unpriv_tty_ioctls 2016-12-07 15:59:34 -08:00
isolated_app.te Move isolated_app policy to private 2017-01-05 16:06:54 -08:00
kernel.te sepolicy: Add rules for non-init namespaces 2017-11-21 08:34:32 -07:00
keystore.te Move domain_deprecated into private policy 2017-07-24 07:39:54 -07:00
lmkd.te sepolicy: Add rules for non-init namespaces 2017-11-21 08:34:32 -07:00
logd.te sepolicy: Add rules for non-init namespaces 2017-11-21 08:34:32 -07:00
logpersist.te logpersist: do not permit dynamic transition to domain 2016-12-29 09:29:36 -08:00
mdnsd.te Move mdnsd policy to private 2017-02-06 15:02:32 -08:00
mediacodec.te Sync internal master and AOSP sepolicy. 2017-09-26 14:38:47 -07:00
mediadrmserver.te Sync internal master and AOSP sepolicy. 2017-09-26 14:38:47 -07:00
mediaextractor.te mediaextractor: ensure no direct open()s 2017-10-07 15:01:24 +00:00
mediametrics.te Sync internal master and AOSP sepolicy. 2017-09-26 14:38:47 -07:00
mediaprovider.te Split mediaprovider as a separate domain from priv_app 2017-04-17 15:30:35 -07:00
mediaserver.te mediaserver: remove access to 'sysfs' type. 2017-11-16 17:34:14 -08:00
modprobe.te sepolicy: Add rules for non-init namespaces 2017-11-21 08:34:32 -07:00
mtp.te sepolicy: Add rules for non-init namespaces 2017-11-21 08:34:32 -07:00
net.te Move netdomain policy to private 2017-02-06 15:02:00 -08:00
netd.te sepolicy: Add rules for non-init namespaces 2017-11-21 08:34:32 -07:00
netutils_wrapper.te add netutils_wrappers 2017-04-14 22:57:27 -07:00
neverallow_macros Ban socket connections between core and vendor 2017-03-27 08:49:13 -07:00
nfc.te Remove unnecessary rules from NFC HAL clients 2017-03-22 16:22:33 -07:00
otapreopt_chroot.te sepolicy: Add rules for non-init namespaces 2017-11-21 08:34:32 -07:00
otapreopt_slot.te Sepolicy: Give otapreopt_slot read on A/B artifact links 2017-04-07 20:19:41 -07:00
performanced.te sepolicy: Add rules for non-init namespaces 2017-11-21 08:34:32 -07:00
perfprofd.te sepolicy: Add rules for non-init namespaces 2017-11-21 08:34:32 -07:00
platform_app.te Move platform_app policy to private 2017-01-09 14:52:59 -08:00
postinstall.te
postinstall_dexopt.te sepolicy: Add rules for non-init namespaces 2017-11-21 08:34:32 -07:00
ppp.te sepolicy: Add rules for non-init namespaces 2017-11-21 08:34:32 -07:00
preopt2cachename.te
priv_app.te Move priv_app policy to private 2017-01-05 15:44:32 -08:00
profman.te Allow profman to analyze profiles for the secondary dex files 2017-03-15 18:47:13 -07:00
property.te Revert "Revert "Put pm.* property in new pm_prop context"" 2017-11-16 05:28:14 +00:00
racoon.te sepolicy: Add rules for non-init namespaces 2017-11-21 08:34:32 -07:00
radio.te Allow vendor apps to use surfaceflinger_service 2017-11-09 15:41:37 +00:00
recovery.te sepolicy: Add rules for non-init namespaces 2017-11-21 08:34:32 -07:00
recovery_persist.te sepolicy: add version_policy tool and version non-platform policy. 2016-12-06 08:56:02 -08:00
recovery_refresh.te sepolicy: add version_policy tool and version non-platform policy. 2016-12-06 08:56:02 -08:00
rild.te sepolicy: Add rules for non-init namespaces 2017-11-21 08:34:32 -07:00
roles sepolicy: add version_policy tool and version non-platform policy. 2016-12-06 08:56:02 -08:00
runas.te sepolicy: Add rules for non-init namespaces 2017-11-21 08:34:32 -07:00
sdcardd.te sepolicy: Add rules for non-init namespaces 2017-11-21 08:34:32 -07:00
service.te Allow vendor apps to use surfaceflinger_service 2017-11-09 15:41:37 +00:00
servicemanager.te Sync internal master and AOSP sepolicy. 2017-09-26 14:38:47 -07:00
sgdisk.te sepolicy: Add rules for non-init namespaces 2017-11-21 08:34:32 -07:00
shared_relro.te Allow shared_relro to connect to activity_service. 2017-07-24 17:38:40 -04:00
shell.te shell: neverallow access to 'proc' label. 2017-11-17 18:39:07 +00:00
slideshow.te sepolicy: Add rules for non-init namespaces 2017-11-21 08:34:32 -07:00
su.te Sync internal master and AOSP sepolicy. 2017-09-26 14:38:47 -07:00
surfaceflinger.te Move surfaceflinger policy to private 2017-02-07 10:06:12 -08:00
system_app.te Move system_app policy to private 2017-01-05 17:20:28 -08:00
system_server.te Move system_server policy to private 2017-02-07 20:24:05 +00:00
te_macros Fix CTS regressions 2017-11-21 18:06:20 +00:00
tee.te Move domain_deprecated into private policy 2017-07-24 07:39:54 -07:00
thermalserviced.te PowerUI access to thermalservice 2017-10-14 01:05:58 +00:00
tombstoned.te SEPolicy: Changes for new stack dumping scheme. 2017-05-31 10:01:48 +00:00
toolbox.te
tzdatacheck.te Allow the shell user to run tzdatacheck 2017-04-20 09:31:36 +00:00
ueventd.te sepolicy: Add rules for non-init namespaces 2017-11-21 08:34:32 -07:00
uncrypt.te sepolicy: Add rules for non-init namespaces 2017-11-21 08:34:32 -07:00
untrusted_app.te Move untrusted_app policy to private 2017-01-05 14:39:52 -08:00
untrusted_app_25.te untrusted_app: policy versioning based on targetSdkVersion 2017-02-14 13:30:12 -08:00
untrusted_v2_app.te Add new untrusted_v2_app domain 2017-02-21 12:39:55 -08:00
update_engine.te sepolicy: Add rules for non-init namespaces 2017-11-21 08:34:32 -07:00
update_engine_common.te Make /proc/sys/kernel/random available to everyone 2017-11-20 21:02:21 +00:00
update_verifier.te Create sysfs_dm label. 2017-10-10 14:42:24 -07:00
vdc.te Sync internal master and AOSP sepolicy. 2017-09-26 14:38:47 -07:00
vendor_init.te sepolicy: Add rules for non-init namespaces 2017-11-21 08:34:32 -07:00
vendor_shell.te vendor_shell: add sepolicy for vendor shell 2017-04-14 09:38:51 -07:00
vendor_toolbox.te Allow init to run vendor toybox for modprobe 2017-05-24 15:01:20 -07:00
virtual_touchpad.te Allow vr_hwc and virtual_touchpad to query for permissions 2017-04-21 17:15:03 -04:00
vndservice.te Add default label and mapping for vendor services 2017-04-28 14:56:57 -07:00
vndservicemanager.te Initial sepolicy for vndservicemanager. 2017-03-23 00:20:43 +00:00
vold.te Fix CTS regressions 2017-11-21 18:06:20 +00:00
vold_prepare_subdirs.te Move most of public/vold_prepare_subdirs.te to private 2017-10-25 13:06:25 -07:00
vr_hwc.te SELinux policies for PDX services 2017-05-10 16:39:19 -07:00
watchdogd.te
webview_zygote.te Move webview_zygote policy to private 2017-01-27 17:01:43 +00:00
wificond.te sepolicy: Add rules for non-init namespaces 2017-11-21 08:34:32 -07:00
wpantund.te sepolicy: Add rules for non-init namespaces 2017-11-21 08:34:32 -07:00
zygote.te Move zygote policy to private 2017-01-26 13:31:16 -08:00