Evolution-X-Tensor/device_google_gs-common
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
2438 commits 1 branch 0 tags 325 MiB
Commit graph

2438 commits

This branch
This branch
All branches
Author SHA1 Message Date
hwandy
6265f1f2eb Add sepolicy for gcam app 
Bug: b/359815606.
Bug: b/363018500.
Flag: EXEMPT bugfix.
Test: Locally built selinux policy and a local GCAEng (go/ab/12329728) and run GCAEng and saw selinux policy denial message gone.

AVC evidence from b/363018500:

    08-27 22:57:12.442   340   340 I auditd  : avc:  denied  { find } for pid=15696 uid=10286 name=activity scontext=u:r:debug_camera_app:s0:c30,c257,c512,c768 tcontext=u:object_r:activity_service:s0 tclass=service_manager permissive=0

    08-27 21:35:58.954   332   332 I auditd  : avc:  denied  { find } for pid=4055 uid=10286 name=media.audio_policy scontext=u:r:debug_camera_app:s0:c30,c257,c512,c768 tcontext=u:object_r:audioserver_service:s0 tclass=service_manager permissive=1

    08-27 21:34:50.138   332   332 I auditd  : avc:  denied  { find } for pid=4055 uid=10286 name=media.camera scontext=u:r:debug_camera_app:s0:c30,c257,c512,c768 tcontext=u:object_r:cameraserver_service:s0 tclass=service_manager permissive=1

    08-27 21:34:53.320   332   332 I auditd  : avc:  denied  { find } for pid=4055 uid=10286 name=media.extractor scontext=u:r:debug_camera_app:s0:c30,c257,c512,c768 tcontext=u:object_r:mediaextractor_service:s0 tclass=service_manager permissive=1

    08-27 21:34:51.622   332   332 I auditd  : avc:  denied  { find } for pid=4055 uid=10286 name=media.metrics scontext=u:r:debug_camera_app:s0:c30,c257,c512,c768 tcontext=u:object_r:mediametrics_service:s0 tclass=service_manager permissive=1

    08-27 21:35:59.012   332   332 I auditd  : avc:  denied  { find } for pid=4055 uid=10286 name=media.resource_manager scontext=u:r:debug_camera_app:s0:c30,c257,c512,c768 tcontext=u:object_r:mediaserver_service:s0 tclass=service_manager permissive=1

AVC evidence from go/ab/12328923:

09-06 11:16:24.421   328   328 E SELinux : avc:  denied  { find } for pid=17252 uid=10289 name=netstats scontext=u:r:debug_camera_app:s0:c33,c257,c512,c768 tcontext=u:object_r:netstats_service:s0 tclass=service_manager permissive=1
09-06 11:16:24.627   328   328 E SELinux : avc:  denied  { find } for pid=17252 uid=10289 name=shortcut scontext=u:r:debug_camera_app:s0:c33,c257,c512,c768 tcontext=u:object_r:shortcut_service:s0 tclass=service_manager permissive=1
09-06 11:16:24.812 17252 17252 I GoogleCameraEng: type=1400 audit(0.0:1091): avc:  denied  { read } for  name="enforce" dev="selinuxfs" ino=4 scontext=u:r:debug_camera_app:s0:c33,c257,c512,c768 tcontext=u:object_r:selinuxfs:s0 tclass=file permissive=1 app=com.google.android.GoogleCameraEng
09-06 11:16:24.812 17252 17252 I GoogleCameraEng: type=1400 audit(0.0:1092): avc:  denied  { open } for  path="/sys/fs/selinux/enforce" dev="selinuxfs" ino=4 scontext=u:r:debug_camera_app:s0:c33,c257,c512,c768 tcontext=u:object_r:selinuxfs:s0 tclass=file permissive=1 app=com.google.android.GoogleCameraEng
09-06 11:16:25.222   328   328 E SELinux : avc:  denied  { find } for pid=17252 uid=10289 name=content_capture scontext=u:r:debug_camera_app:s0:c33,c257,c512,c768 tcontext=u:object_r:content_capture_service:s0 tclass=service_manager permissive=1
09-06 11:16:25.220 17252 17252 I RenderThread: type=1400 audit(0.0:1093): avc:  denied  { read } for  name="uevent" dev="sysfs" ino=45203 scontext=u:r:debug_camera_app:s0:c33,c257,c512,c768 tcontext=u:object_r:sysfs:s0 tclass=file permissive=1 app=com.google.android.GoogleCameraEng
09-06 11:16:25.220 17252 17252 I RenderThread: type=1400 audit(0.0:1094): avc:  denied  { open } for  path="/sys/devices/platform/34f00000.gpu0/uevent" dev="sysfs" ino=45203 scontext=u:r:debug_camera_app:s0:c33,c257,c512,c768 tcontext=u:object_r:sysfs:s0 tclass=file permissive=1 app=com.google.android.GoogleCameraEng
09-06 11:16:25.220 17252 17252 I RenderThread: type=1400 audit(0.0:1095): avc:  denied  { getattr } for  path="/sys/devices/platform/34f00000.gpu0/uevent" dev="sysfs" ino=45203 scontext=u:r:debug_camera_app:s0:c33,c257,c512,c768 tcontext=u:object_r:sysfs:s0 tclass=file permissive=1 app=com.google.android.GoogleCameraEng
09-06 11:16:25.877   328   328 E SELinux : avc:  denied  { find } for pid=17252 uid=10289 name=voiceinteraction scontext=u:r:debug_camera_app:s0:c33,c257,c512,c768 tcontext=u:object_r:voiceinteraction_service:s0 tclass=service_manager permissive=1
09-06 11:16:25.902   328   328 E SELinux : avc:  denied  { find } for pid=17252 uid=10289 name=autofill scontext=u:r:debug_camera_app:s0:c33,c257,c512,c768 tcontext=u:object_r:autofill_service:s0 tclass=service_manager permissive=1
09-06 11:16:25.920   328   328 E SELinux : avc:  denied  { find } for pid=17252 uid=10289 name=sensitive_content_protection_service scontext=u:r:debug_camera_app:s0:c33,c257,c512,c768 tcontext=u:object_r:sensitive_content_protection_service:s0 tclass=service_manager permissive=1
09-06 11:16:25.928   328   328 E SELinux : avc:  denied  { find } for pid=17252 uid=10289 name=performance_hint scontext=u:r:debug_camera_app:s0:c33,c257,c512,c768 tcontext=u:object_r:hint_service:s0 tclass=service_manager permissive=1
09-06 11:16:26.060   328   328 E SELinux : avc:  denied  { find } for pid=17252 uid=10289 name=clipboard scontext=u:r:debug_camera_app:s0:c33,c257,c512,c768 tcontext=u:object_r:clipboard_service:s0 tclass=service_manager permissive=1
09-06 11:16:29.417   328   328 E SELinux : avc:  denied  { find } for pid=17252 uid=10289 name=backup scontext=u:r:debug_camera_app:s0:c33,c257,c512,c768 tcontext=u:object_r:backup_service:s0 tclass=service_manager permissive=1
09-06 11:16:29.484   328   328 E SELinux : avc:  denied  { find } for pid=17252 uid=10289 name=android.frameworks.stats.IStats/default scontext=u:r:debug_camera_app:s0:c33,c257,c512,c768 tcontext=u:object_r:fwk_stats_service:s0 tclass=service_manager permissive=1
09-06 11:17:01.249   328   328 E SELinux : avc:  denied  { find } for pid=17252 uid=10289 name=audio scontext=u:r:debug_camera_app:s0:c33,c257,c512,c768 tcontext=u:object_r:audio_service:s0 tclass=service_manager permissive=1
09-06 11:17:01.306   328   328 E SELinux : avc:  denied  { find } for pid=17252 uid=10289 name=package_native scontext=u:r:debug_camera_app:s0:c33,c257,c512,c768 tcontext=u:object_r:package_native_service:s0 tclass=service_manager permissive=1
09-06 11:17:01.495   328   328 E SELinux : avc:  denied  { find } for pid=17252 uid=10289 name=package_native scontext=u:r:debug_camera_app:s0:c33,c257,c512,c768 tcontext=u:object_r:package_native_service:s0 tclass=service_manager permissive=1
09-06 11:17:02.330   328   328 E SELinux : avc:  denied  { find } for pid=17252 uid=10289 name=audio scontext=u:r:debug_camera_app:s0:c33,c257,c512,c768 tcontext=u:object_r:audio_service:s0 tclass=service_manager permissive=1
09-06 11:17:05.916   328   328 E SELinux : avc:  denied  { find } for pid=17252 uid=10289 name=audio scontext=u:r:debug_camera_app:s0:c33,c257,c512,c768 tcontext=u:object_r:audio_service:s0 tclass=service_manager permissive=1
09-06 11:17:07.826   328   328 E SELinux : avc:  denied  { find } for pid=17252 uid=10289 name=audio scontext=u:r:debug_camera_app:s0:c33,c257,c512,c768 tcontext=u:object_r:audio_service:s0 tclass=service_manager permissive=1
09-06 11:17:09.579   328   328 E SELinux : avc:  denied  { find } for pid=17252 uid=10289 name=audio scontext=u:r:debug_camera_app:s0:c33,c257,c512,c768 tcontext=u:object_r:audio_service:s0 tclass=service_manager permissive=1
09-06 11:17:10.580 17252 17252 I FinishThread: type=1400 audit(0.0:1164): avc:  denied  { read } for  name="gxp" dev="tmpfs" ino=1511 scontext=u:r:debug_camera_app:s0:c33,c257,c512,c768 tcontext=u:object_r:gxp_device:s0 tclass=chr_file permissive=1 app=com.google.android.GoogleCameraEng
09-06 11:17:10.580 17252 17252 I FinishThread: type=1400 audit(0.0:1165): avc:  denied  { open } for  path="/dev/gxp" dev="tmpfs" ino=1511 scontext=u:r:debug_camera_app:s0:c33,c257,c512,c768 tcontext=u:object_r:gxp_device:s0 tclass=chr_file permissive=1 app=com.google.android.GoogleCameraEng
09-06 11:17:10.580 17252 17252 I FinishThread: type=1400 audit(0.0:1166): avc:  denied  { ioctl } for  path="/dev/gxp" dev="tmpfs" ino=1511 ioctlcmd=0xee1a scontext=u:r:debug_camera_app:s0:c33,c257,c512,c768 tcontext=u:object_r:gxp_device:s0 tclass=chr_file permissive=1 app=com.google.android.GoogleCameraEng
09-06 11:17:10.580 17252 17252 I FinishThread: type=1400 audit(0.0:1167): avc:  denied  { write } for  name="gxp" dev="tmpfs" ino=1511 scontext=u:r:debug_camera_app:s0:c33,c257,c512,c768 tcontext=u:object_r:gxp_device:s0 tclass=chr_file permissive=1 app=com.google.android.GoogleCameraEng
09-06 11:17:11.692   328   328 E SELinux : avc:  denied  { find } for pid=17252 uid=10289 name=audio scontext=u:r:debug_camera_app:s0:c33,c257,c512,c768 tcontext=u:object_r:audio_service:s0 tclass=service_manager permissive=1
09-06 11:17:13.696 17252 17252 I FinishThread: type=1400 audit(0.0:1177): avc:  denied  { ioctl } for  path="/dev/gxp" dev="tmpfs" ino=1511 ioctlcmd=0xee00 scontext=u:r:debug_camera_app:s0:c33,c257,c512,c768 tcontext=u:object_r:gxp_device:s0 tclass=chr_file permissive=1 app=com.google.android.GoogleCameraEng
09-06 11:17:15.443   328   328 E SELinux : avc:  denied  { find } for pid=17252 uid=10289 name=audio scontext=u:r:debug_camera_app:s0:c33,c257,c512,c768 tcontext=u:object_r:audio_service:s0 tclass=service_manager permissive=1
09-06 11:17:20.159   328   328 E SELinux : avc:  denied  { find } for pid=17252 uid=10289 name=uimode scontext=u:r:debug_camera_app:s0:c33,c257,c512,c768 tcontext=u:object_r:uimode_service:s0 tclass=service_manager permissive=1
09-06 11:17:21.816 17252 17252 I FinishThread: type=1400 audit(0.0:1185): avc:  denied  { ioctl } for  path="/dev/gxp" dev="tmpfs" ino=1511 ioctlcmd=0xee00 scontext=u:r:debug_camera_app:s0:c33,c257,c512,c768 tcontext=u:object_r:gxp_device:s0 tclass=chr_file permissive=1 app=com.google.android.GoogleCameraEng
09-06 11:17:36.508 17252 17252 I FinishThread: type=1400 audit(0.0:1189): avc:  denied  { ioctl } for  path="/dev/gxp" dev="tmpfs" ino=1511 ioctlcmd=0xee00 scontext=u:r:debug_camera_app:s0:c33,c257,c512,c768 tcontext=u:object_r:gxp_device:s0 tclass=chr_file permissive=1 app=com.google.android.GoogleCameraEng
09-06 11:17:54.854   328   328 E SELinux : avc:  denied  { find } for pid=17252 uid=10289 name=audio scontext=u:r:debug_camera_app:s0:c33,c257,c512,c768 tcontext=u:object_r:audio_service:s0 tclass=service_manager permissive=1

09-06 15:38:05.817   343   343 E SELinux : avc:  denied  { find } for pid=12740 uid=10289 name=netstats scontext=u:r:debug_camera_app:s0:c33,c257,c512,c768 tcontext=u:object_r:netstats_service:s0 tclass=service_manager permissive=1
09-06 15:38:06.000   343   343 E SELinux : avc:  denied  { find } for pid=12740 uid=10289 name=shortcut scontext=u:r:debug_camera_app:s0:c33,c257,c512,c768 tcontext=u:object_r:shortcut_service:s0 tclass=service_manager permissive=1
09-06 15:38:06.627   343   343 E SELinux : avc:  denied  { find } for pid=12740 uid=10289 name=content_capture scontext=u:r:debug_camera_app:s0:c33,c257,c512,c768 tcontext=u:object_r:content_capture_service:s0 tclass=service_manager permissive=1
09-06 15:38:06.634   343   343 E SELinux : avc:  denied  { find } for pid=12740 uid=10289 name=gpu scontext=u:r:debug_camera_app:s0:c33,c257,c512,c768 tcontext=u:object_r:gpu_service:s0 tclass=service_manager permissive=1
09-06 15:38:06.640   343   343 E SELinux : avc:  denied  { find } for pid=12740 uid=10289 name=activity_task scontext=u:r:debug_camera_app:s0:c33,c257,c512,c768 tcontext=u:object_r:activity_task_service:s0 tclass=service_manager permissive=1
09-06 15:38:06.694   343   343 E SELinux : avc:  denied  { find } for pid=12740 uid=10289 name=sensorservice scontext=u:r:debug_camera_app:s0:c33,c257,c512,c768 tcontext=u:object_r:sensorservice_service:s0 tclass=service_manager permissive=1
09-06 15:38:06.695   343   343 E SELinux : avc:  denied  { find } for pid=12740 uid=10289 name=virtualdevice_native scontext=u:r:debug_camera_app:s0:c33,c257,c512,c768 tcontext=u:object_r:virtual_device_native_service:s0 tclass=service_manager permissive=1
09-06 15:38:06.728   343   343 E SELinux : avc:  denied  { find } for pid=12740 uid=10289 name=device_policy scontext=u:r:debug_camera_app:s0:c33,c257,c512,c768 tcontext=u:object_r:device_policy_service:s0 tclass=service_manager permissive=1
09-06 15:38:06.730   343   343 E SELinux : avc:  denied  { find } for pid=12740 uid=10289 name=batterystats scontext=u:r:debug_camera_app:s0:c33,c257,c512,c768 tcontext=u:object_r:batterystats_service:s0 tclass=service_manager permissive=1
09-06 15:38:06.731   343   343 E SELinux : avc:  denied  { find } for pid=12740 uid=10289 name=powerstats scontext=u:r:debug_camera_app:s0:c33,c257,c512,c768 tcontext=u:object_r:powerstats_service:s0 tclass=service_manager permissive=1
09-06 15:38:06.788   343   343 E SELinux : avc:  denied  { find } for pid=12740 uid=10289 name=trust scontext=u:r:debug_camera_app:s0:c33,c257,c512,c768 tcontext=u:object_r:trust_service:s0 tclass=service_manager permissive=1
09-06 15:38:06.869   343   343 E SELinux : avc:  denied  { find } for pid=12740 uid=10289 name=device_state scontext=u:r:debug_camera_app:s0:c33,c257,c512,c768 tcontext=u:object_r:device_state_service:s0 tclass=service_manager permissive=1
09-06 15:38:07.052   343   343 E SELinux : avc:  denied  { find } for pid=12740 uid=10289 name=vibrator_manager scontext=u:r:debug_camera_app:s0:c33,c257,c512,c768 tcontext=u:object_r:vibrator_manager_service:s0 tclass=service_manager permissive=1
09-06 15:38:07.135   343   343 E SELinux : avc:  denied  { find } for pid=12740 uid=10289 name=thermalservice scontext=u:r:debug_camera_app:s0:c33,c257,c512,c768 tcontext=u:object_r:thermal_service:s0 tclass=service_manager permissive=1
09-06 15:38:07.380   343   343 E SELinux : avc:  denied  { find } for pid=12740 uid=10289 name=voiceinteraction scontext=u:r:debug_camera_app:s0:c33,c257,c512,c768 tcontext=u:object_r:voiceinteraction_service:s0 tclass=service_manager permissive=1
09-06 15:38:07.384   343   343 E SELinux : avc:  denied  { find } for pid=12740 uid=10289 name=autofill scontext=u:r:debug_camera_app:s0:c33,c257,c512,c768 tcontext=u:object_r:autofill_service:s0 tclass=service_manager permissive=1
09-06 15:38:07.399   343   343 E SELinux : avc:  denied  { find } for pid=12740 uid=10289 name=sensitive_content_protection_service scontext=u:r:debug_camera_app:s0:c33,c257,c512,c768 tcontext=u:object_r:sensitive_content_protection_service:s0 tclass=service_manager permissive=1
09-06 15:38:07.406   343   343 E SELinux : avc:  denied  { find } for pid=12740 uid=10289 name=performance_hint scontext=u:r:debug_camera_app:s0:c33,c257,c512,c768 tcontext=u:object_r:hint_service:s0 tclass=service_manager permissive=1
09-06 15:38:07.542   343   343 E SELinux : avc:  denied  { find } for pid=12740 uid=10289 name=clipboard scontext=u:r:debug_camera_app:s0:c33,c257,c512,c768 tcontext=u:object_r:clipboard_service:s0 tclass=service_manager permissive=1
09-06 15:38:10.834   343   343 E SELinux : avc:  denied  { find } for pid=12740 uid=10289 name=backup scontext=u:r:debug_camera_app:s0:c33,c257,c512,c768 tcontext=u:object_r:backup_service:s0 tclass=service_manager permissive=1
09-06 15:38:10.899   343   343 E SELinux : avc:  denied  { find } for pid=12740 uid=10289 name=com.google.edgetpu.IEdgeTpuAppService/default scontext=u:r:debug_camera_app:s0:c33,c257,c512,c768 tcontext=u:object_r:edgetpu_app_service:s0 tclass=service_manager permissive=1
09-06 15:38:10.913   343   343 E SELinux : avc:  denied  { find } for pid=12740 uid=10289 name=android.frameworks.stats.IStats/default scontext=u:r:debug_camera_app:s0:c33,c257,c512,c768 tcontext=u:object_r:fwk_stats_service:s0 tclass=service_manager permissive=1
09-06 15:38:27.247   343   343 E SELinux : avc:  denied  { find } for pid=12740 uid=10289 name=android.hardware.neuralnetworks.IDevice/google-edgetpu scontext=u:r:debug_camera_app:s0:c33,c257,c512,c768 tcontext=u:object_r:edgetpu_nnapi_service:s0 tclass=service_manager permissive=1
09-06 15:38:27.612   343   343 E SELinux : avc:  denied  { find } for pid=12740 uid=10289 name=audio scontext=u:r:debug_camera_app:s0:c33,c257,c512,c768 tcontext=u:object_r:audio_service:s0 tclass=service_manager permissive=1
09-06 15:38:27.866   343   343 E SELinux : avc:  denied  { find } for pid=12740 uid=10289 name=package_native scontext=u:r:debug_camera_app:s0:c33,c257,c512,c768 tcontext=u:object_r:package_native_service:s0 tclass=service_manager permissive=1
09-06 15:38:58.145   343   343 E SELinux : avc:  denied  { find } for pid=12740 uid=10289 name=uimode scontext=u:r:debug_camera_app:s0:c33,c257,c512,c768 tcontext=u:object_r:uimode_service:s0 tclass=service_manager permissive=1
09-06 15:38:59.592 12740 12740 I SEnhWorker: type=1400 audit(0.0:430): avc:  denied  { ioctl } for  path="/dev/edgetpu-soc" dev="tmpfs" ino=1511 ioctlcmd=0xed1a scontext=u:r:debug_camera_app:s0:c33,c257,c512,c768 tcontext=u:object_r:edgetpu_device:s0 tclass=chr_file permissive=1 app=com.google.android.GoogleCameraEng
09-06 15:39:03.375   343   343 E SELinux : avc:  denied  { find } for pid=12740 uid=10289 name=storagestats scontext=u:r:debug_camera_app:s0:c33,c257,c512,c768 tcontext=u:object_r:storagestats_service:s0 tclass=service_manager permissive=1
09-06 15:41:04.632 12740 12740 I RenderThread: type=1400 audit(0.0:470): avc:  denied  { read } for  name="uevent" dev="sysfs" ino=45203 scontext=u:r:debug_camera_app:s0:c33,c257,c512,c768 tcontext=u:object_r:sysfs:s0 tclass=file permissive=1 app=com.google.android.GoogleCameraEng
09-06 15:41:04.632 12740 12740 I RenderThread: type=1400 audit(0.0:471): avc:  denied  { open } for  path="/sys/devices/platform/34f00000.gpu0/uevent" dev="sysfs" ino=45203 scontext=u:r:debug_camera_app:s0:c33,c257,c512,c768 tcontext=u:object_r:sysfs:s0 tclass=file permissive=1 app=com.google.android.GoogleCameraEng
09-06 15:41:04.632 12740 12740 I RenderThread: type=1400 audit(0.0:472): avc:  denied  { getattr } for  path="/sys/devices/platform/34f00000.gpu0/uevent" dev="sysfs" ino=45203 scontext=u:r:debug_camera_app:s0:c33,c257,c512,c768 tcontext=u:object_r:sysfs:s0 tclass=file permissive=1 app=com.google.android.GoogleCameraEng
09-06 15:41:04.769   343   343 E SELinux : avc:  denied  { find } for pid=12740 uid=10289 name=autofill scontext=u:r:debug_camera_app:s0:c33,c257,c512,c768 tcontext=u:object_r:autofill_service:s0 tclass=service_manager permissive=1
09-06 15:41:05.188 12740 12740 I MicrovideoQShar: type=1400 audit(0.0:474): avc:  denied  { ioctl } for  path="/dev/edgetpu-soc" dev="tmpfs" ino=1511 ioctlcmd=0xed1a scontext=u:r:debug_camera_app:s0:c33,c257,c512,c768 tcontext=u:object_r:edgetpu_device:s0 tclass=chr_file permissive=1 app=com.google.android.GoogleCameraEng
09-06 15:41:17.532   343   343 E SELinux : avc:  denied  { find } for pid=12740 uid=10289 name=legacy_permission scontext=u:r:debug_camera_app:s0:c33,c257,c512,c768 tcontext=u:object_r:legacy_permission_service:s0 tclass=service_manager permissive=1
09-06 15:41:45.676 12740 12740 I MicrovideoQShar: type=1400 audit(0.0:535): avc:  denied  { ioctl } for  path="/dev/edgetpu-soc" dev="tmpfs" ino=1511 ioctlcmd=0xed1a scontext=u:r:debug_camera_app:s0:c33,c257,c512,c768 tcontext=u:object_r:edgetpu_device:s0 tclass=chr_file permissive=1 app=com.google.android.GoogleCameraEng
09-06 15:41:46.684 12740 12740 I GcaGeneric-4: type=1400 audit(0.0:540): avc:  denied  { ioctl } for  path="/dev/edgetpu-soc" dev="tmpfs" ino=1511 ioctlcmd=0xed19 scontext=u:r:debug_camera_app:s0:c33,c257,c512,c768 tcontext=u:object_r:edgetpu_device:s0 tclass=chr_file permissive=1 app=com.google.android.GoogleCameraEng
09-06 15:41:48.288 12740 12740 I FinishThread: type=1400 audit(0.0:544): avc:  denied  { ioctl } for  path="/dev/edgetpu-soc" dev="tmpfs" ino=1511 ioctlcmd=0xed11 scontext=u:r:debug_camera_app:s0:c33,c257,c512,c768 tcontext=u:object_r:edgetpu_device:s0 tclass=chr_file permissive=1 app=com.google.android.GoogleCameraEng
09-06 15:42:02.482   343   343 E SELinux : avc:  denied  { find } for pid=12740 uid=10289 name=audio scontext=u:r:debug_camera_app:s0:c33,c257,c512,c768 tcontext=u:object_r:audio_service:s0 tclass=service_manager permissive=1
09-06 15:42:03.576 12740 12740 I GcaGeneric-4: type=1400 audit(0.0:565): avc:  denied  { ioctl } for  path="/dev/edgetpu-soc" dev="tmpfs" ino=1511 ioctlcmd=0xed19 scontext=u:r:debug_camera_app:s0:c33,c257,c512,c768 tcontext=u:object_r:edgetpu_device:s0 tclass=chr_file permissive=1 app=com.google.android.GoogleCameraEng
09-06 15:42:06.947   343   343 E SELinux : avc:  denied  { find } for pid=12740 uid=10289 name=voiceinteraction scontext=u:r:debug_camera_app:s0:c33,c257,c512,c768 tcontext=u:object_r:voiceinteraction_service:s0 tclass=service_manager permissive=1
09-06 15:42:06.955   343   343 E SELinux : avc:  denied  { find } for pid=12740 uid=10289 name=sensitive_content_protection_service scontext=u:r:debug_camera_app:s0:c33,c257,c512,c768 tcontext=u:object_r:sensitive_content_protection_service:s0 tclass=service_manager permissive=1
09-06 15:42:07.652 12740 12740 I GcaGeneric-4: type=1400 audit(0.0:568): avc:  denied  { ioctl } for  path="/dev/edgetpu-soc" dev="tmpfs" ino=1511 ioctlcmd=0xed12 scontext=u:r:debug_camera_app:s0:c33,c257,c512,c768 tcontext=u:object_r:edgetpu_device:s0 tclass=chr_file permissive=1 app=com.google.android.GoogleCameraEng
09-06 15:42:08.903   343   343 E SELinux : avc:  denied  { find } for pid=12740 uid=10289 name=audio scontext=u:r:debug_camera_app:s0:c33,c257,c512,c768 tcontext=u:object_r:audio_service:s0 tclass=service_manager permissive=1
09-06 16:58:35.741   338   338 E SELinux : avc:  denied  { find } for pid=6263 uid=10289 name=gpu scontext=u:r:debug_camera_app:s0:c33,c257,c512,c768 tcontext=u:object_r:gpu_service:s0 tclass=service_manager permissive=1
09-06 16:58:35.759   338   338 E SELinux : avc:  denied  { find } for pid=6263 uid=10289 name=activity_task scontext=u:r:debug_camera_app:s0:c33,c257,c512,c768 tcontext=u:object_r:activity_task_service:s0 tclass=service_manager permissive=1
09-06 16:58:36.142   338   338 E SELinux : avc:  denied  { find } for pid=6263 uid=10289 name=sensorservice scontext=u:r:debug_camera_app:s0:c33,c257,c512,c768 tcontext=u:object_r:sensorservice_service:s0 tclass=service_manager permissive=1
09-06 16:58:36.142   338   338 E SELinux : avc:  denied  { find } for pid=6263 uid=10289 name=virtualdevice_native scontext=u:r:debug_camera_app:s0:c33,c257,c512,c768 tcontext=u:object_r:virtual_device_native_service:s0 tclass=service_manager permissive=1
09-06 16:58:36.265   338   338 E SELinux : avc:  denied  { find } for pid=6263 uid=10289 name=device_policy scontext=u:r:debug_camera_app:s0:c33,c257,c512,c768 tcontext=u:object_r:device_policy_service:s0 tclass=service_manager permissive=1
09-06 16:58:36.344   338   338 E SELinux : avc:  denied  { find } for pid=6263 uid=10289 name=batterystats scontext=u:r:debug_camera_app:s0:c33,c257,c512,c768 tcontext=u:object_r:batterystats_service:s0 tclass=service_manager permissive=1
09-06 16:58:36.344   338   338 E SELinux : avc:  denied  { find } for pid=6263 uid=10289 name=trust scontext=u:r:debug_camera_app:s0:c33,c257,c512,c768 tcontext=u:object_r:trust_service:s0 tclass=service_manager permissive=1
09-06 16:58:36.345   338   338 E SELinux : avc:  denied  { find } for pid=6263 uid=10289 name=powerstats scontext=u:r:debug_camera_app:s0:c33,c257,c512,c768 tcontext=u:object_r:powerstats_service:s0 tclass=service_manager permissive=1
09-06 16:58:36.436   338   338 E SELinux : avc:  denied  { find } for pid=6263 uid=10289 name=device_state scontext=u:r:debug_camera_app:s0:c33,c257,c512,c768 tcontext=u:object_r:device_state_service:s0 tclass=service_manager permissive=1
09-06 16:58:36.610   338   338 E SELinux : avc:  denied  { find } for pid=6263 uid=10289 name=vibrator_manager scontext=u:r:debug_camera_app:s0:c33,c257,c512,c768 tcontext=u:object_r:vibrator_manager_service:s0 tclass=service_manager permissive=1
09-06 16:58:36.640   338   338 E SELinux : avc:  denied  { find } for pid=6263 uid=10289 name=thermalservice scontext=u:r:debug_camera_app:s0:c33,c257,c512,c768 tcontext=u:object_r:thermal_service:s0 tclass=service_manager permissive=1
09-06 16:58:36.785   338   338 E SELinux : avc:  denied  { find } for pid=6263 uid=10289 name=android.hardware.neuralnetworks.IDevice/google-edgetpu scontext=u:r:debug_camera_app:s0:c33,c257,c512,c768 tcontext=u:object_r:edgetpu_nnapi_service:s0 tclass=service_manager permissive=1
09-06 16:58:36.944   338   338 E SELinux : avc:  denied  { find } for pid=6263 uid=10289 name=voiceinteraction scontext=u:r:debug_camera_app:s0:c33,c257,c512,c768 tcontext=u:object_r:voiceinteraction_service:s0 tclass=service_manager permissive=1
09-06 16:58:36.946   338   338 E SELinux : avc:  denied  { find } for pid=6263 uid=10289 name=autofill scontext=u:r:debug_camera_app:s0:c33,c257,c512,c768 tcontext=u:object_r:autofill_service:s0 tclass=service_manager permissive=1
09-06 16:58:36.955   338   338 E SELinux : avc:  denied  { find } for pid=6263 uid=10289 name=sensitive_content_protection_service scontext=u:r:debug_camera_app:s0:c33,c257,c512,c768 tcontext=u:object_r:sensitive_content_protection_service:s0 tclass=service_manager permissive=1
09-06 16:58:36.962   338   338 E SELinux : avc:  denied  { find } for pid=6263 uid=10289 name=performance_hint scontext=u:r:debug_camera_app:s0:c33,c257,c512,c768 tcontext=u:object_r:hint_service:s0 tclass=service_manager permissive=1
09-06 16:58:37.147   338   338 E SELinux : avc:  denied  { find } for pid=6263 uid=10289 name=clipboard scontext=u:r:debug_camera_app:s0:c33,c257,c512,c768 tcontext=u:object_r:clipboard_service:s0 tclass=service_manager permissive=1
09-06 16:58:37.374  6263  6263 I binder:6263_6: type=1400 audit(0.0:2483): avc:  denied  { open } for  path="/dev/__properties__/u:object_r:vendor_default_prop:s0" dev="tmpfs" ino=392 scontext=u:r:debug_camera_app:s0:c33,c257,c512,c768 tcontext=u:object_r:vendor_default_prop:s0 tclass=file permissive=1 app=com.google.android.GoogleCameraEng
09-06 16:58:37.374  6263  6263 I binder:6263_6: type=1400 audit(0.0:2484): avc:  denied  { getattr } for  path="/dev/__properties__/u:object_r:vendor_default_prop:s0" dev="tmpfs" ino=392 scontext=u:r:debug_camera_app:s0:c33,c257,c512,c768 tcontext=u:object_r:vendor_default_prop:s0 tclass=file permissive=1 app=com.google.android.GoogleCameraEng
09-06 16:58:37.374  6263  6263 I binder:6263_6: type=1400 audit(0.0:2485): avc:  denied  { map } for  path="/dev/__properties__/u:object_r:vendor_default_prop:s0" dev="tmpfs" ino=392 scontext=u:r:debug_camera_app:s0:c33,c257,c512,c768 tcontext=u:object_r:vendor_default_prop:s0 tclass=file permissive=1 app=com.google.android.GoogleCameraEng
09-06 16:58:37.547   338   338 E SELinux : avc:  denied  { find } for pid=6263 uid=10289 name=audio scontext=u:r:debug_camera_app:s0:c33,c257,c512,c768 tcontext=u:object_r:audio_service:s0 tclass=service_manager permissive=1
09-06 16:58:37.949   338   338 E SELinux : avc:  denied  { find } for pid=6263 uid=10289 name=backup scontext=u:r:debug_camera_app:s0:c33,c257,c512,c768 tcontext=u:object_r:backup_service:s0 tclass=service_manager permissive=1
09-06 16:58:38.733   338   338 E SELinux : avc:  denied  { find } for pid=6263 uid=10289 name=android.frameworks.stats.IStats/default scontext=u:r:debug_camera_app:s0:c33,c257,c512,c768 tcontext=u:object_r:fwk_stats_service:s0 tclass=service_manager permissive=1
09-06 16:58:38.737   338   338 E SELinux : avc:  denied  { find } for pid=6263 uid=10289 name=package_native scontext=u:r:debug_camera_app:s0:c33,c257,c512,c768 tcontext=u:object_r:package_native_service:s0 tclass=service_manager permissive=1

09-06 17:18:32.828   697   697 I binder:697_2: type=1400 audit(0.0:1275): avc:  denied  { read write } for  path="/dev/edgetpu-soc" dev="tmpfs" ino=1511 scontext=u:r:debug_camera_app:s0:c33,c257,c512,c768 tcontext=u:object_r:edgetpu_device:s0 tclass=chr_file permissive=1

Change-Id: I243f6242968fdc24478e923e8d30e529939b8a57
 2024-09-07 01:16:23 +00:00
Kiwon Park
d3977c94ad Merge "Add eSIM directory and disable bootstrap when bootloader is unlocked in user build" into main 2024-09-04 16:55:20 +00:00
Devika Krishnadas
76ca89b967 Add GPU team owners for mk files am: 1d82070ee9 am: 9747c1bb8d 
Original change: https://android-review.googlesource.com/c/device/google/gs-common/+/3252915

Change-Id: Ifdcf32d2555f28851739c53019e9bec4dfc13167
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
 2024-09-04 16:49:25 +00:00
Devika Krishnadas
9747c1bb8d Add GPU team owners for mk files am: 1d82070ee9 
Original change: https://android-review.googlesource.com/c/device/google/gs-common/+/3252915

Change-Id: I12c5349ad38ca36302996f139dac08114cbea42a
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
 2024-09-04 16:39:39 +00:00
Treehugger Robot
52f7c66ea0 Merge "gs-common: nfc: st21nfc: Add rules for android.hardware.nfc-service.st" into main 2024-09-04 08:54:32 +00:00
Snehal Koukuntla
13e34cc96a Merge "Add widevine SELinux permissions" into main 2024-09-04 08:42:49 +00:00
Kyle Hsiao
a0681a7b7a gs-common: nfc: st21nfc: Add rules for android.hardware.nfc-service.st 
sepolicy for android.hardware.nfc-service.st

Flag: EXEMPT NDK
Bug: 361093394
Test: manual
Change-Id: Ibe90555a6ec9b13fb2cd8eae4131216d3240ec3a
 2024-09-04 06:20:49 +00:00
Randall Huang
6ec23c152f storage: move storage related device type to common folder 
Bug: 364225000
Test: forrest build
Change-Id: Ica102c5a1ec45560939ac32c3ec22e721659c3cf
Signed-off-by: Randall Huang <huangrandall@google.com>
 2024-09-04 10:43:47 +08:00
Devika Krishnadas
1d82070ee9 Add GPU team owners for mk files 
Bug: 275906497
Flag: EXEMPT only changing OWNERS
Change-Id: Ife6cdfd5097c6c50e0276ea3a70552e9feeb76a8
Signed-off-by: Devika Krishnadas <kdevika@google.com>
 2024-09-03 22:49:19 +00:00
Snehal
bd3767ae16 Add widevine SELinux permissions 
15992 15992 I exoplayer2.demo: type=1400 audit(0.0:1934): avc:  denied  { call } for  scontext=u:r:untrusted_app_29:s0:c36,c257,c512,c768 tcontext=u:r:hal_drm_clearkey:s0 tclass=binder permissive=1 app=com.google.android.exoplayer2.demo

15992 15992 I exoplayer2.demo: type=1400 audit(0.0:1935): avc:  denied  { call } for  scontext=u:r:untrusted_app_29:s0:c36,c257,c512,c768 tcontext=u:r:hal_drm_widevine:s0 tclass=binder permissive=1 app=com.google.android.exoplayer2.demo

860   860 I android.hardwar: type=1400 audit(0.0:4302): avc:  denied  { write } for  name="mediadrm" dev="dm-57" ino=2565 scontext=u:r:hal_drm_widevine:s0 tcontext=u:object_r:mediadrm_vendor_data_file:s0 tclass=dir permissive=1

860   860 I android.hardwar: type=1400 audit(0.0:4304): avc:  denied  { create } for  name="IDM1013" scontext=u:r:hal_drm_widevine:s0 tcontext=u:object_r:mediadrm_vendor_data_file:s0 tclass=dir permissive=1

Bug: 363182767
Bug: 363181505

Flag: EXEMPT bugfix

Change-Id: Ia8c3ba3d7fe9f09ceb40fd2b6ae88bbbcf5ac6f6
 2024-09-03 13:40:57 +00:00
George Chang
019cc571f4 Merge "gs-common: nfc: st54spi: Add rules for hal_secure_element_st54spi_aidl" into main 2024-09-03 11:33:00 +00:00
Treehugger Robot
90f357aa8d Merge "Storage: add selinux for ufs firmware upgrade event" into main 2024-09-03 03:36:51 +00:00
Randall Huang
0f4a0bb8a2 Storage: add selinux for ufs firmware upgrade event 
avc:  denied  { execute_no_trans } for  comm="ufs_firmware_up" path="/vendor/bin/toybox_vendor" dev="dm-11" ino=380 scontext=u:r:ufs_firmware_update:s0 tcontext=u:object_r:vendor_toolbox_exec:s0 tclass=file permissive=1
avc:  denied  { read } for  comm="cat" name="vendor" dev="sysfs" ino=63193 scontext=u:r:ufs_firmware_update:s0 tcontext=u:object_r:sysfs_scsi_devices_0000:s0 tclass=file permissive=1
avc:  denied  { open } for  comm="cat" path="/sys/devices/platform/13200000.ufs/vendor" dev="sysfs" ino=63193 scontext=u:r:ufs_firmware_update:s0 tcontext=u:object_r:sysfs_scsi_devices_0000:s0 tclass=file permissive=1
avc:  denied  { search } for  comm="dd" name="block" dev="tmpfs" ino=12 scontext=u:r:ufs_firmware_update:s0 tcontext=u:object_r:block_device:s0 tclass=dir permissive=1
avc:  denied  { write } for  comm="dd" name="sda12" dev="tmpfs" ino=1139 scontext=u:r:ufs_firmware_update:s0 tcontext=u:object_r:ufs_internal_block_device:s0 tclass=blk_file permissive=1

Bug: 361093041
Test: NA
Change-Id: I54445d4543a733baae85cd408b433033dd93ec6b
Signed-off-by: Randall Huang <huangrandall@google.com>
 2024-09-02 22:33:03 +00:00
Cheng Chang
4c672d13c9 Merge "gps: Allow gnss hal access vendor_gps_prop" into main 2024-09-02 07:38:45 +00:00
George Chang
cf2d68668f gs-common: nfc: st54spi: Add rules for hal_secure_element_st54spi_aidl 
sepolicy for android.hardware.secure_element-service.thales

08-26 12:49:43.959   343   343 E SELinux : avc:  denied  { add } for pid=706 uid=1068 name=android.hardware.secure_element.ISecureElement/eSE1 scontext=u:r:hal_secure_element_st54spi_aidl:s0 tcontext=u:object_r:hal_secure_element_service:s0 tclass=service_manager permissive=1
08-26 12:49:43.936   706   706 I android.hardwar: type=1400 audit(0.0:9): avc:  denied  { call } for  scontext=u:r:hal_secure_element_st54spi_aidl:s0 tcontext=u:r:servicemanager:s0 tclass=binder permissive=1
08-26 12:49:43.936   706   706 I android.hardwar: type=1400 audit(0.0:10): avc:  denied  { transfer } for  scontext=u:r:hal_secure_element_st54spi_aidl:s0 tcontext=u:r:servicemanager:s0 tclass=binder permissive=1
08-26 12:49:59.904     1     1 I /system/bin/init: type=1107 audit(0.0:139): uid=0 auid=4294967295 ses=4294967295 subj=u:r:init:s0 msg='avc:  denied  { set } for property=persist.vendor.se.reset pid=706 uid=1068 gid=1068 scontext=u:r:hal_secure_element_st54spi_aidl:s0 tcontext=u:object_r:vendor_default_prop:s0 tclass=property_service permissive=1'
08-26 12:50:12.124   706   706 I android.hardwar: type=1400 audit(0.0:461): avc:  denied  { read write } for  name="st54spi" dev="tmpfs" ino=1552 scontext=u:r:hal_secure_element_st54spi_aidl:s0 tcontext=u:object_r:st54spi_device:s0 tclass=chr_file permissive=1
08-26 12:50:12.124   706   706 I android.hardwar: type=1400 audit(0.0:462): avc:  denied  { open } for  path="/dev/st54spi" dev="tmpfs" ino=1552 scontext=u:r:hal_secure_element_st54spi_aidl:s0 tcontext=u:object_r:st54spi_device:s0 tclass=chr_file permissive=1
08-26 16:33:44.332   737   737 I android.hardwar: type=1400 audit(0.0:959): avc:  denied  { read write } for  name="st21nfc" dev="tmpfs" ino=1550 scontext=u:r:hal_secure_element_st54spi_aidl:s0 tcontext=u:object_r:nfc_device:s0 tclass=chr_file permissive=1
08-26 16:33:44.332   737   737 I android.hardwar: type=1400 audit(0.0:960): avc:  denied  { open } for  path="/dev/st21nfc" dev="tmpfs" ino=1550 scontext=u:r:hal_secure_element_st54spi_aidl:s0 tcontext=u:object_r:nfc_device:s0 tclass=chr_file permissive=1
08-26 16:33:44.332   737   737 I android.hardwar: type=1400 audit(0.0:961): avc:  denied  { ioctl } for  path="/dev/st21nfc" dev="tmpfs" ino=1550 ioctlcmd=0xea05 scontext=u:r:hal_secure_element_st54spi_aidl:s0 tcontext=u:object_r:nfc_device:s0 tclass=chr_file permissive=1

Flag: EXEMPT NDK
Bug: 361093024
Test: manual
Change-Id: I1f3aebc9894de9f3410f2031e2b99e07d4060fa5
 2024-09-02 06:37:19 +00:00
Attis Chen
e5c668587d Merge "Add dump of panel power_mode." into main 2024-09-02 04:54:18 +00:00
Martin Liu
a13a1663fd [automerger skipped] Move compaction_proactiveness to vendor sepolicy am: d1adbe0cb2 -s ours 
am skip reason: Merged-In I14cff8dfe4e143995b9011cd34a1e7d74613ae33 with SHA-1 d6d4a779e5 is already in history

Original change: https://googleplex-android-review.googlesource.com/c/device/google/gs-common/+/29091424

Change-Id: Ied82c7da10415424f42bd7101bbe7c6ece892f0b
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
 2024-09-01 15:28:58 +00:00
Martin Liu
d1adbe0cb2 Move compaction_proactiveness to vendor sepolicy 
Move compaction_proactiveness sepolicy from the system
to vendor since it breaks other vendors.

Bug: 361985704
Test: check knob value
Flag: NONE sepolicy doesn't support flag
Change-Id: I14cff8dfe4e143995b9011cd34a1e7d74613ae33
Merged-In: I14cff8dfe4e143995b9011cd34a1e7d74613ae33
Signed-off-by: Martin Liu <liumartin@google.com>
 2024-09-01 08:06:04 +00:00
Kiwon Park
69797e03ca Add eSIM directory and disable bootstrap when bootloader is unlocked in user build 
Allow vendor_init to set setupwizard prop
Allow priv_app and gmscore_app to get setupwizard prop
<11>[    7.276992][  T329] init: Unable to set property 'setupwizard.feature.provisioning_profile_mode' from uid:0 gid:0 pid:330: SELinux permission check failed

08-28 15:35:42.536 10156  5884  5884 W oid.setupwizard: type=1400 audit(0.0:63): avc:  denied  { read } for  name="u:object_r:setupwizard_feature_prop:s0" dev="tmpfs" ino=335 scontext=u:r:priv_app:s0:c512,c768 tcontext=u:object_r:setupwizard_feature_prop:s0 tclass=file permissive=0 app=com.google.android.setupwizard

08-28 15:11:52.015 10185  6915  6915 W highpool[8]: type=1400 audit(0.0:17): avc:  denied  { read } for  name="u:object_r:setupwizard_feature_prop:s0" dev="tmpfs" ino=339 scontext=u:r:gmscore_app:s0:c512,c768 tcontext=u:object_r:setupwizard_feature_prop:s0 tclass=file permissive=0 app=com.google.android.gms

Bug: 349592724
Test: m
Change-Id: I8330c9f6f9efd215ec4ea1f7d3d6ff5596773e21
Flag: NONE disabling a feature just in factory
 2024-08-30 10:28:16 -07:00
Treehugger Robot
d1dfe55442 Merge "Move compaction_proactiveness to vendor sepolicy" into main 2024-08-30 10:50:43 +00:00
Dennis Song
c9fb05a230 [automerger skipped] Explicitly set user root for the gs_watchdogd service. am: f25cb6895f am: 6c82faf70b -s ours 
am skip reason: Merged-In I36a3a67dc357f608b33a131a4e5f6fd6defb91e5 with SHA-1 c0b820e056 is already in history

Original change: https://android-review.googlesource.com/c/device/google/gs-common/+/3250951

Change-Id: I0e5a8cbb986a06a2e55ab58ee1c80b53fca96f2b
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
 2024-08-30 09:58:38 +00:00
Dennis Song
6c82faf70b Explicitly set user root for the gs_watchdogd service. am: f25cb6895f 
Original change: https://android-review.googlesource.com/c/device/google/gs-common/+/3250951

Change-Id: I58b8abe45d82b6ea620d6e623c4716785a992c76
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
 2024-08-30 09:29:18 +00:00
Dennis Song
f25cb6895f Explicitly set user root for the gs_watchdogd service. 
Otherwise host_init_verifier would fail.

Bug: 362447627
Test: Treehugger
Merged-In: I36a3a67dc357f608b33a131a4e5f6fd6defb91e5
Change-Id: I36a3a67dc357f608b33a131a4e5f6fd6defb91e5
 2024-08-30 08:27:36 +00:00
Dennis Song
37238f4cff Merge "Explicitly set user root for the gs_watchdogd service." into main 2024-08-30 08:24:56 +00:00
Martin Liu
d6d4a779e5 Move compaction_proactiveness to vendor sepolicy 
Move compaction_proactiveness sepolicy from the system
to vendor since it breaks other vendors.

Bug: 361985704
Test: check knob value
Flag: NONE sepolicy doesn't support flag
Change-Id: I14cff8dfe4e143995b9011cd34a1e7d74613ae33
Signed-off-by: Martin Liu <liumartin@google.com>
 2024-08-30 07:21:16 +00:00
Cheng Chang
f71ff2ba7c gps: Allow gnss hal access vendor_gps_prop 
avc:  denied  { read } for  name="u:object_r:vendor_gps_prop:s0" dev="tmpfs" ino=421 scontext=u:r:hal_gnss_pixel:s0 tcontext=u:object_r:vendor_gps_prop:s0 tclass=file permissive=0

Bug: 335354369
Test: Check avc logcat.
Change-Id: Idfc885c6d54a9a5160643ff53f3e278ee067b286
 2024-08-30 06:05:32 +00:00
Tommy Chiu
15ed5c639e Move PRODUCT_COPY_FILES from each board>device-vendor.mk here 
We used to put the firmware copy logic in dedicated device-vendor.mk
files for each platform. This approach is difficult to maintain and
unnecessary since we always want to deploy the latest firmware.
Propose a better approach for handling firmware copy logic.

Flag: EXEMPT refactor
Bug: 359071523
Test: Build pass
Change-Id: I4169353b9f8f16b82eb0e4ebf2a884f46e1a5f8b
 2024-08-30 04:28:47 +00:00
Dennis Song
c0b820e056 Explicitly set user root for the gs_watchdogd service. 
Otherwise host_init_verifier would fail.

Bug: 362447627
Test: Treehugger
Flag: EXEMPT bugfix
Change-Id: I36a3a67dc357f608b33a131a4e5f6fd6defb91e5
 2024-08-30 03:42:06 +00:00
Randall Huang
1ae1d53973 Merge "storage: fix idle-maint avc denials." into main 2024-08-29 02:51:57 +00:00
Treehugger Robot
d9667c65f6 Merge "storage: allow mkfs/fsck for vendor partitons" into main 2024-08-29 02:51:23 +00:00
Frank Yu
d03036bdef Merge "Move hal_radio_ext_service related policy of grilservice_app to gs-common." into main 2024-08-29 01:52:23 +00:00
Randall Huang
df4a5f7b48 storage: allow mkfs/fsck for vendor partitons 
avc:  denied  { read } for  name="sda7" dev="tmpfs" ino=1173 scontext=u:r:fsck:s0 tcontext=u:object_r:modem_userdata_block_device:s0 tclass=blk_file permissive=1
avc:  denied  { open } for  path="/dev/block/sda7" dev="tmpfs" ino=1173 scontext=u:r:fsck:s0 tcontext=u:object_r:modem_userdata_block_device:s0 tclass=blk_file permissive=1
avc:  denied  { write } for  name="sda7" dev="tmpfs" ino=1173 scontext=u:r:fsck:s0 tcontext=u:object_r:modem_userdata_block_device:s0 tclass=blk_file permissive=1
avc:  denied  { ioctl } for  path="/dev/block/sda7" dev="tmpfs" ino=1173 ioctlcmd=0x1268 scontext=u:r:fsck:s0 tcontext=u:object_r:modem_userdata_block_device:s0 tclass=blk_file permissive=1
avc:  denied  { read } for  name="sda5" dev="tmpfs" ino=1010 scontext=u:r:fsck:s0 tcontext=u:object_r:efs_block_device:s0 tclass=blk_file permissive=1
avc:  denied  { open } for  path="/dev/block/sda5" dev="tmpfs" ino=1010 scontext=u:r:fsck:s0 tcontext=u:object_r:efs_block_device:s0 tclass=blk_file permissive=1
avc:  denied  { open } for  path="/sys/devices/platform/3c400000.ufs/host0/target0:0:0/0:0:0:0/block/sda/queue/zoned" dev="sysfs" ino=100275 scontext=u:r:fsck:s0 tcontext=u:object_r:sysfs:s0 tclass=file permissive=1
avc:  denied  { write } for  name="sda5" dev="tmpfs" ino=1010 scontext=u:r:fsck:s0 tcontext=u:object_r:efs_block_device:s0 tclass=blk_file permissive=1
avc:  denied  { ioctl } for  path="/dev/block/sda5" dev="tmpfs" ino=1010 ioctlcmd=0x1268 scontext=u:r:fsck:s0 tcontext=u:object_r:efs_block_device:s0 tclass=blk_file permissive=1
avc:  denied  { search } for  name="0:0:0:0" dev="sysfs" ino=100048 scontext=u:r:fsck:s0 tcontext=u:object_r:sysfs_scsi_devices_0000:s0 tclass=dir permissive=1
avc:  denied  { getattr } for  path="/sys/devices/platform/3c400000.ufs/host0/target0:0:0/0:0:0:0/block/sda/sda5/partition" dev="sysfs" ino=101272 scontext=u:r:fsck:s0 tcontext=u:object_r:sysfs_scsi_devices_0000:s0 tclass=file permissive=1
avc:  denied  { read } for  name="zoned" dev="sysfs" ino=100308 scontext=u:r:fsck:s0 tcontext=u:object_r:sysfs_scsi_devices_0000:s0 tclass=file permissive=1
avc:  denied  { open } for  path="/sys/devices/platform/3c400000.ufs/host0/target0:0:0/0:0:0:0/block/sda/queue/zoned" dev="sysfs" ino=100308 scontext=u:r:fsck:s0 tcontext=u:object_r:sysfs_scsi_devices_0000:s0 tclass=file permissive=1

avc:  denied  { search } for  name="0:0:0:0" dev="sysfs" ino=100048 scontext=u:r:e2fs:s0 tcontext=u:object_r:sysfs_scsi_devices_0000:s0 tclass=dir permissive=1
avc:  denied  { getattr } for  path="/sys/devices/platform/3c400000.ufs/host0/target0:0:0/0:0:0:0/block/sda/sda10/partition" dev="sysfs" ino=102003 scontext=u:r:e2fs:s0 tcontext=u:object_r:sysfs_scsi_devices_0000:s0 tclass=file permissive=1
avc:  denied  { read } for  name="zoned" dev="sysfs" ino=100308 scontext=u:r:e2fs:s0 tcontext=u:object_r:sysfs_scsi_devices_0000:s0 tclass=file permissive=1
avc:  denied  { open } for  path="/sys/devices/platform/3c400000.ufs/host0/target0:0:0/0:0:0:0/block/sda/queue/zoned" dev="sysfs" ino=100308 scontext=u:r:e2fs:s0 tcontext=u:object_r:sysfs_scsi_devices_0000:s0 tclass=file permissive=1
avc:  denied  { read } for  name="sda5" dev="tmpfs" ino=1004 scontext=u:r:e2fs:s0 tcontext=u:object_r:efs_block_device:s0 tclass=blk_file permissive=1
avc:  denied  { open } for  path="/dev/block/sda5" dev="tmpfs" ino=1004 scontext=u:r:e2fs:s0 tcontext=u:object_r:efs_block_device:s0 tclass=blk_file permissive=1
avc:  denied  { write } for  name="sda5" dev="tmpfs" ino=1004 scontext=u:r:e2fs:s0 tcontext=u:object_r:efs_block_device:s0 tclass=blk_file permissive=1
avc:  denied  { ioctl } for  path="/dev/block/sda5" dev="tmpfs" ino=1004 ioctlcmd=0x1268 scontext=u:r:e2fs:s0 tcontext=u:object_r:efs_block_device:s0 tclass=blk_file permissive=1
avc:  denied  { read } for  name="sda7" dev="tmpfs" ino=1199 scontext=u:r:e2fs:s0 tcontext=u:object_r:modem_userdata_block_device:s0 tclass=blk_file permissive=1
avc:  denied  { open } for  path="/dev/block/sda7" dev="tmpfs" ino=1199 scontext=u:r:e2fs:s0 tcontext=u:object_r:modem_userdata_block_device:s0 tclass=blk_file permissive=1
avc:  denied  { write } for  name="sda7" dev="tmpfs" ino=1199 scontext=u:r:e2fs:s0 tcontext=u:object_r:modem_userdata_block_device:s0 tclass=blk_file permissive=1
avc:  denied  { ioctl } for  path="/dev/block/sda7" dev="tmpfs" ino=1199 ioctlcmd=0x1268 scontext=u:r:e2fs:s0 tcontext=u:object_r:modem_userdata_block_device:s0 tclass=blk_file permissive=1


Bug: 361093041
Test: build pass
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:0cf7210eb1b5ba1d22fb8dcb59f40cb74b98dd37)
Change-Id: I0d89d360e75335784116a4e4769d0b60699917eb
Signed-off-by: Randall Huang <huangrandall@google.com>
 2024-08-29 01:10:11 +00:00
Randall Huang
d6ba7fad68 storage: fix idle-maint avc denials. 
avc: denied { getattr } for path="/dev/block/sda5" dev="tmpfs" ino=1039 scontext=u:r:vold:s0 tcontext=u:object_r:efs_block_device:s0 tclass=blk_file permissive=1
avc: denied { getattr } for path="/dev/block/sda7" dev="tmpfs" ino=1199 scontext=u:r:vold:s0 tcontext=u:object_r:modem_userdata_block_device:s0 tclass=blk_file permissive=1

Bug: 361093041
Test: run idle-maint run
Change-Id: Ie92ffa8b576c74e3a1cb127b265059ec76c14667
Signed-off-by: Randall Huang <huangrandall@google.com>
 2024-08-29 00:00:09 +00:00
Ernie Hsu
714dc8abf8 Merge "mediacodec: fix perfetto trace permission" into main 2024-08-28 23:33:40 +00:00
Prochin Wang
a8910cb36b Merge "Label touch_property_type to associate with vendor_gti_prop" into main 2024-08-28 23:21:38 +00:00
Prochin Wang
956edf0d26 Label touch_property_type to associate with vendor_gti_prop 
Pass ROM build of all git_main targets:
https://android-build.googleplex.com/builds/abtd/run/L52500030006128092/
https://android-build.corp.google.com/abtd/run/L93900030006078492/
https://android-build.corp.google.com/abtd/run/L15800030006086232/
https://android-build.corp.google.com/abtd/run/L27700030006086619/

Bug: 361237875
Test: mm and flash rom
Flag: build.RELEASE_PIXEL_BOOST_DATALAYER_PSA_ENABLED
Change-Id: I518ff7c05fc1fa279cd7300cb77673a86ff3e35b
 2024-08-28 23:20:52 +00:00
Bryan Bong Gyoune Kim
d1f646d258 Merge "bootctrl: fixed OOB read in BootControl" into main 2024-08-28 20:59:25 +00:00
bgkim
b584b9c7e0 bootctrl: fixed OOB read in BootControl 
Fixed OOB read in BootControl::isSlotMarkedSuccessful() by checking
if "in_slot" is negative

Flag: EXEMPT bugfix
Test: tested on Husky device
Bug: 353516777
Change-Id: I634c32a8c12403008fe5a724bc447f82931ae9c5
Signed-off-by: bgkim <bgkim@google.com>
 2024-08-28 12:44:34 -07:00
Ernie Hsu
d35b61f390 mediacodec: fix perfetto trace permission 
08-28 16:33:56.280  1046   720   720 I auditd  : type=1400 audit(0.0:469): avc:  denied  { write } for  comm="TracingMuxer" name="traced_producer" dev="tmpfs" ino=1604 scontext=u:r:mediacodec_google:s0 tcontext=u:object_r:traced_producer_socket:s0 tclass=sock_file permissive=0

Flag: EXEMPT bugfix
Test: atest-dev com.google.android.selinux.pts.SELinuxTest#scanAvcDeniedLogRightAfterReboot
Bug: 361093311
Change-Id: I0aad9d771069cd0d660708e41c29c79d83e04704
 2024-08-28 10:27:52 +00:00
Ernie Hsu
13883d9a54 mediacodec: fix permission for vendor_media_data and ecoservice 
vendor_media_data:
08-27 12:07:01.540   747   747 I /vendor/bin/hw/google.hardware.media.c2@3.0-service: type=1400 audit(0.0:1785): avc:  denied  { search } for  comm=436F646563322E30204C6F6F706572 name="media" dev="dm-57" ino=399 scontext=u:r:mediacodec_google:s0 tcontext=u:object_r:vendor_media_data_file:s0 tclass=dir permissive=1
08-27 12:07:01.540   747   747 I /vendor/bin/hw/google.hardware.media.c2@3.0-service: type=1400 audit(0.0:1786): avc:  denied  { write } for  comm=436F646563322E30204C6F6F706572 name="media" dev="dm-57" ino=399 scontext=u:r:mediacodec_google:s0 tcontext=u:object_r:vendor_media_data_file:s0 tclass=dir permissive=1
08-27 12:07:01.540   747   747 I /vendor/bin/hw/google.hardware.media.c2@3.0-service: type=1400 audit(0.0:1787): avc:  denied  { add_name } for  comm=436F646563322E30204C6F6F706572 name="input_7335.bin" scontext=u:r:mediacodec_google:s0 tcontext=u:object_r:vendor_media_data_file:s0 tclass=dir permissive=1
08-27 12:07:01.540   747   747 I /vendor/bin/hw/google.hardware.media.c2@3.0-service: type=1400 audit(0.0:1788): avc:  denied  { create } for  comm=436F646563322E30204C6F6F706572 name="input_7335.bin" scontext=u:r:mediacodec_google:s0 tcontext=u:object_r:vendor_media_data_file:s0 tclass=file permissive=1
08-27 12:07:01.540   747   747 I /vendor/bin/hw/google.hardware.media.c2@3.0-service: type=1400 audit(0.0:1789): avc:  denied  { append open } for  comm=436F646563322E30204C6F6F706572 path="/data/vendor/media/input_7335.bin" dev="dm-57" ino=26749 scontext=u:r:mediacodec_google:s0 tcontext=u:object_r:vendor_media_data_file:s0 tclass=file permissive=1

ecoservice:
08-27 13:07:44.686   358   358 E SELinux : avc:  denied  { find } for pid=743 uid=1046 name=media.ecoservice scontext=u:r:mediacodec_google:s0 tcontext=u:object_r:eco_service:s0 tclass=service_manager permissive=1

Flag: EXEMPT bugfix
Test: video playback and screen record
Bug: 361093311
Change-Id: I37d5081061bad2917b24e320f4e4a9c8116db6fa
 2024-08-28 07:16:06 +00:00
Treehugger Robot
e341a7fc8f Merge "switch waves prebuilt version" into main 2024-08-28 03:14:32 +00:00
Frank Yu
e6358c91de Move hal_radio_ext_service related policy of grilservice_app to gs-common. 
Related avc error:

avc:  denied  { find } for pid=2227 uid=10259 name=vendor.google.radio_ext.IRadioExt/default scontext=u:r:grilservice_app:s0:c3,c257,c512,c768 tcontext=u:object_r:hal_radio_ext_service:s0 tclass=service_manager permissive=0

avc:  denied  { call } for  comm="oid.grilservice" scontext=u:r:grilservice_app:s0:c3,c257,c512,c768 tcontext=u:r:hal_radioext_default:s0 tclass=binder permissive=0 app=com.google.android.grilservice

Bug: 361210953
Change-Id: Ibb8a341847b0772668b52bc01f2d087bf1874fe9
Test: Verify with test ROM
Flag: EXEMPT sepolicy refactor
 2024-08-27 12:10:52 +00:00
Ernie Hsu
a01bc1d315 mediacodec: fix vpu device sepolicy for video playback 
08-27 11:30:17.500   734   734 I binder:734_4: type=1400 audit(0.0:1288): avc:  denied  { read write } for  name="vpu" dev="tmpfs" ino=1585 scontext=u:r:mediacodec_google:s0 tcontext=u:object_r:video_device:s0 tclass=chr_file permissive=1
08-27 11:30:17.500   734   734 I binder:734_4: type=1400 audit(0.0:1289): avc:  denied  { open } for  path="/dev/vpu" dev="tmpfs" ino=1585 scontext=u:r:mediacodec_google:s0 tcontext=u:object_r:video_device:s0 tclass=chr_file permissive=1
08-27 11:30:17.500   734   734 I binder:734_4: type=1400 audit(0.0:1290): avc:  denied  { ioctl } for  path="/dev/vpu" dev="tmpfs" ino=1585 ioctlcmd=0x4200 scontext=u:r:mediacodec_google:s0 tcontext=u:object_r:video_device:s0 tclass=chr_file permissive=1
08-27 11:30:17.500   734   734 I binder:734_4: type=1400 audit(0.0:1291): avc:  denied  { map } for  path="/dev/vpu" dev="tmpfs" ino=1585 scontext=u:r:mediacodec_google:s0 tcontext=u:object_r:video_device:s0 tclass=chr_file permissive=1
08-27 11:30:18.944   734   734 I FetchThread: type=1400 audit(0.0:1292): avc:  denied  { ioctl } for  path="/dev/vpu" dev="tmpfs" ino=1585 ioctlcmd=0x4207 scontext=u:r:mediacodec_google:s0 tcontext=u:object_r:video_device:s0 tclass=chr_file permissive=1

Bug: 353638738
Flag: EXEMPT bugfix
Test: video playback
Change-Id: I8ad4507693a4a0fbbd2709bd79d25b1ef4109904
 2024-08-27 05:29:18 +00:00
attis
44f21d0c43 Add dump of panel power_mode. 
Add the power_mode sysfs node to dump_second_display.cpp and
dump_display.cpp.

Bug: 358505990
Flag: EXEMPT bugfix
Test: adb bugreport.
Change-Id: I875b9a3ef416c188376eb2f9226996b6645ccdb9
Signed-off-by: attis <attis@google.com>
 2024-08-26 12:13:48 +00:00
Randall Huang
e4506b0159 storage: extend cmd_logging sepolicy to new ufshc 
Bug: 361093041
Test: check ls -Zl
Change-Id: Ia461f47562932a7dad1c114f7b3e11e5fa0d312c
Signed-off-by: Randall Huang <huangrandall@google.com>
 2024-08-26 09:53:10 +08:00
Jasmine Cha
3d6169d30b switch waves prebuilt version 
Flag: EXEMPT bringup waves
Bug: 352461861
Test: manual test

Change-Id: Ic7a826d98a77ccb579594a9fb7db1df5d62e99aa
Signed-off-by: Jasmine Cha <chajasmine@google.com>
 2024-08-26 01:28:12 +00:00
Sam Ou
81654643af Merge "sepolicy: allow dumpstate to execute dump_power" into main 2024-08-23 10:58:34 +00:00
samou
c078a870cb sepolicy: allow dumpstate to execute dump_power 
08-22 09:10:30.200  7202  7202 I dump_power: type=1400 audit(0.0:830): avc:  denied  { read } for  name="acpm_stats" dev="sysfs" ino=24831 scontext=u:r:hal_dumpstate_default:s0 tcontext=u:object_r:sysfs_acpm_stats:s0 tclass=dir permissive=1
08-22 09:10:30.200  7202  7202 I dump_power: type=1400 audit(0.0:831): avc:  denied  { open } for  path="/sys/devices/platform/acpm_stats" dev="sysfs" ino=24831 scontext=u:r:hal_dumpstate_default:s0 tcontext=u:object_r:sysfs_acpm_stats:s0 tclass=dir permissive=1
08-22 09:10:30.200  7202  7202 I dump_power: type=1400 audit(0.0:832): avc:  denied  { search } for  name="acpm_stats" dev="sysfs" ino=24831 scontext=u:r:hal_dumpstate_default:s0 tcontext=u:object_r:sysfs_acpm_stats:s0 tclass=dir permissive=1
08-22 09:10:30.200  7202  7202 I dump_power: type=1400 audit(0.0:833): avc:  denied  { read } for  name="core_stats" dev="sysfs" ino=50367 scontext=u:r:hal_dumpstate_default:s0 tcontext=u:object_r:sysfs_acpm_stats:s0 tclass=file permissive=1
08-22 09:10:30.200  7202  7202 I dump_power: type=1400 audit(0.0:834): avc:  denied  { open } for  path="/sys/devices/platform/acpm_stats/core_stats" dev="sysfs" ino=50367 scontext=u:r:hal_dumpstate_default:s0 tcontext=u:object_r:sysfs_acpm_stats:s0 tclass=file permissive=1
08-22 09:10:30.200  7202  7202 I dump_power: type=1400 audit(0.0:835): avc:  denied  { getattr } for  path="/sys/devices/platform/acpm_stats/core_stats" dev="sysfs" ino=50367 scontext=u:r:hal_dumpstate_default:s0 tcontext=u:object_r:sysfs_acpm_stats:s0 tclass=file permissive=1
08-22 09:26:58.572 10656 10656 I dump_power: type=1400 audit(0.0:844): avc:  denied  { read } for  name="time_in_state" dev="sysfs" ino=46007 scontext=u:r:hal_dumpstate_default:s0 tcontext=u:object_r:sysfs_cpu:s0 tclass=file permissive=1
08-22 09:26:58.572 10656 10656 I dump_power: type=1400 audit(0.0:845): avc:  denied  { open } for  path="/sys/devices/platform/cpupm/cpupm/time_in_state" dev="sysfs" ino=46007 scontext=u:r:hal_dumpstate_default:s0 tcontext=u:object_r:sysfs_cpu:s0 tclass=file permissive=1
08-22 09:26:58.572 10656 10656 I dump_power: type=1400 audit(0.0:846): avc:  denied  { getattr } for  path="/sys/devices/platform/cpupm/cpupm/time_in_state" dev="sysfs" ino=46007 scontext=u:r:hal_dumpstate_default:s0 tcontext=u:object_r:sysfs_cpu:s0 tclass=file permissive=1
08-22 09:26:58.572 10656 10656 I dump_power: type=1400 audit(0.0:847): avc:  denied  { read } for  name="pm_genpd_summary" dev="debugfs" ino=1889 scontext=u:r:hal_dumpstate_default:s0 tcontext=u:object_r:vendor_pm_genpd_debugfs:s0 tclass=file permissive=1
08-22 09:26:58.572 10656 10656 I dump_power: type=1400 audit(0.0:848): avc:  denied  { open } for  path="/sys/kernel/debug/pm_genpd/pm_genpd_summary" dev="debugfs" ino=1889 scontext=u:r:hal_dumpstate_default:s0 tcontext=u:object_r:vendor_pm_genpd_debugfs:s0 tclass=file permissive=1
08-22 09:26:58.572 10656 10656 I dump_power: type=1400 audit(0.0:849): avc:  denied  { getattr } for  path="/sys/kernel/debug/pm_genpd/pm_genpd_summary" dev="debugfs" ino=1889 scontext=u:r:hal_dumpstate_default:s0 tcontext=u:object_r:vendor_pm_genpd_debugfs:s0 tclass=file permissive=1
08-22 09:46:48.580  7468  7468 I dump_power: type=1400 audit(0.0:832): avc:  denied  { search } for  name="battery" dev="sysfs" ino=78091 scontext=u:r:hal_dumpstate_default:s0 tcontext=u:object_r:sysfs_batteryinfo:s0 tclass=dir permissive=1
08-22 09:46:48.580  7468  7468 I dump_power: type=1400 audit(0.0:833): avc:  denied  { read } for  name="uevent" dev="sysfs" ino=78092 scontext=u:r:hal_dumpstate_default:s0 tcontext=u:object_r:sysfs_batteryinfo:s0 tclass=file permissive=1
08-22 09:46:48.580  7468  7468 I dump_power: type=1400 audit(0.0:834): avc:  denied  { open } for  path="/sys/devices/platform/google,battery/power_supply/battery/uevent" dev="sysfs" ino=78092 scontext=u:r:hal_dumpstate_default:s0 tcontext=u:object_r:sysfs_batteryinfo:s0 tclass=file permissive=1
08-22 09:46:48.580  7468  7468 I dump_power: type=1400 audit(0.0:835): avc:  denied  { getattr } for  path="/sys/devices/platform/google,battery/power_supply/battery/uevent" dev="sysfs" ino=78092 scontext=u:r:hal_dumpstate_default:s0 tcontext=u:object_r:sysfs_batteryinfo:s0 tclass=file permissive=1
08-22 09:46:48.600  7468  7468 I dump_power: type=1400 audit(0.0:836): avc:  denied  { read } for  name="maxfg" dev="sysfs" ino=76330 scontext=u:r:hal_dumpstate_default:s0 tcontext=u:object_r:sysfs_batteryinfo:s0 tclass=dir permissive=1
08-22 09:46:48.600  7468  7468 I dump_power: type=1400 audit(0.0:837): avc:  denied  { read } for  name="logbuffer_tcpm" dev="tmpfs" ino=924 scontext=u:r:hal_dumpstate_default:s0 tcontext=u:object_r:logbuffer_device:s0 tclass=chr_file permissive=1
08-22 09:54:11.732  7062  7062 I dump_power: type=1400 audit(0.0:836): avc:  denied  { search } for  name="mitigation" dev="dm-50" ino=3646 scontext=u:r:hal_dumpstate_default:s0 tcontext=u:object_r:mitigation_vendor_data_file:s0 tclass=dir permissive=1
08-22 09:54:11.732  7062  7062 I dump_power: type=1400 audit(0.0:837): avc:  denied  { search } for  name="mitigation" dev="sysfs" ino=77466 scontext=u:r:hal_dumpstate_default:s0 tcontext=u:object_r:sysfs_bcl:s0 tclass=dir permissive=1
08-22 09:54:11.732  7062  7062 I dump_power: type=1400 audit(0.0:838): avc:  denied  { read } for  name="last_triggered_count" dev="sysfs" ino=77519 scontext=u:r:hal_dumpstate_default:s0 tcontext=u:object_r:sysfs_bcl:s0 tclass=dir permissive=1
08-22 09:54:11.732  7062  7062 I dump_power: type=1400 audit(0.0:839): avc:  denied  { open } for  path="/sys/devices/virtual/pmic/mitigation/last_triggered_count" dev="sysfs" ino=77519 scontext=u:r:hal_dumpstate_default:s0 tcontext=u:object_r:sysfs_bcl:s0 tclass=dir permissive=1
08-22 09:54:11.732  7062  7062 I dump_power: type=1400 audit(0.0:840): avc:  denied  { read } for  name="batoilo_count" dev="sysfs" ino=77531 scontext=u:r:hal_dumpstate_default:s0 tcontext=u:object_r:sysfs_bcl:s0 tclass=file permissive=1
08-22 09:54:11.732  7062  7062 I dump_power: type=1400 audit(0.0:841): avc:  denied  { open } for  path="/sys/devices/virtual/pmic/mitigation/last_triggered_count/batoilo_count" dev="sysfs" ino=77531 scontext=u:r:hal_dumpstate_default:s0 tcontext=u:object_r:sysfs_bcl:s0 tclass=file permissive=1
08-22 10:30:19.904  7230  7230 I android.hardwar: type=1400 audit(0.0:838): avc:  denied  { execute_no_trans } for  path="/vendor/bin/dump/dump_power" dev="overlay" ino=92 scontext=u:r:hal_dumpstate_default:s0 tcontext=u:object_r:vendor_file:s0 tclass=file permissive=1
08-23 08:45:09.392 10793 10793 I dump_power: type=1400 audit(0.0:999): avc:  denied  { read } for  name="maxfg_history" dev="tmpfs" ino=1179 scontext=u:r:hal_dumpstate_default:s0 tcontext=u:object_r:battery_history_device:s0 tclass=chr_file permissive=1
08-23 08:45:09.392 10793 10793 I dump_power: type=1400 audit(0.0:1000): avc:  denied  { open } for  path="/dev/logbuffer_tcpm" dev="tmpfs" ino=948 scontext=u:r:hal_dumpstate_default:s0 tcontext=u:object_r:logbuffer_device:s0 tclass=chr_file permissive=1
08-23 08:45:09.392 10793 10793 I dump_power: type=1400 audit(0.0:1001): avc:  denied  { getattr } for  path="/dev/logbuffer_tcpm" dev="tmpfs" ino=948 scontext=u:r:hal_dumpstate_default:s0 tcontext=u:object_r:logbuffer_device:s0 tclass=chr_file permissive=1
08-23 08:45:09.392 10793 10793 I dump_power: type=1400 audit(0.0:1002): avc:  denied  { open } for  path="/sys/devices/platform/10d60000.hsi2c" dev="sysfs" ino=22941 scontext=u:r:hal_dumpstate_default:s0 tcontext=u:object_r:sysfs_batteryinfo:s0 tclass=dir permissive=1
08-23 08:45:09.512 10793 10793 I dump_power: type=1400 audit(0.0:1003): avc:  denied  { getattr } for  path="/sys/devices/virtual/pmic/mitigation/last_triggered_count/batoilo_count" dev="sysfs" ino=85543 scontext=u:r:hal_dumpstate_default:s0 tcontext=u:object_r:sysfs_bcl:s0 tclass=file permissive=1

Flag: EXEMPT refactor
Bug: 349935208
Change-Id: Ic4040da7ef299c029e6e893f5f14da07751c2ebc
Signed-off-by: samou <samou@google.com>
 2024-08-23 08:30:38 +00:00
Roy Luo
e7d8589878 Export build flag to selinux policy for sysfs_udc fscontext 
sysfs_udc context is introduced in aosp/3163782.
Build-time flag RELEASE_USB_UDC_SYSFS_SELINUX_POLICY_ENABLED guards
the access to the new fscontext.
This change exports the flag to selinux policy to make it visible.

Bug: 339241080
Test: build
Flag: RELEASE_USB_UDC_SYSFS_SELINUX_POLICY_ENABLED
Change-Id: I442c5cb16ee40e0a54bddd7c1550dbb4a69557c9
 2024-08-21 01:12:43 +00:00
Rios Kao
7cf82126a0 Merge "aidl: audio: update external service version" into main 2024-08-21 00:34:00 +00:00