Commit graph

319 commits

Author SHA1 Message Date
Adam Shih
38e55f2331 update error on ROM 7225160
Bug: 183338483
Bug: 183338543
Bug: 183338421
Test: pts-tradefed run pts -m PtsSELinuxTest
Change-Id: I16548c00f2a2c38b190664a5cc20ae67d04a8454
2021-03-22 09:52:45 +08:00
Christine Franks
a334f079cc Add uhid access for exo
This is required to write input events to /dev/uinput.

Bug: 182854143
Test: n/a
Change-Id: Icd9714a61be62d40d1b3e5e9d7dcb33ce5f0bf6b
2021-03-19 23:31:08 +00:00
Alex Hong
b640326154 Add the sepolicy for UWB hal
Bug: 182727934
Test: $ make selinux_policy
      Push SELinux modules and check the denials during boot
Change-Id: I630e6e353897a85d1b90c7d8a4250703a4c3a245
2021-03-19 21:42:07 +08:00
TreeHugger Robot
9225f4e5d0 Merge "remove workaround as vendor_init is ready" into sc-dev 2021-03-19 06:43:54 +00:00
Adam Shih
3f6e2bba41 Merge "label missing vibrator sys nodes" into sc-dev 2021-03-19 05:32:27 +00:00
TreeHugger Robot
fc6b81d188 Merge "Add sepolicy rules for fingerprint hal" into sc-dev 2021-03-19 04:37:58 +00:00
Adam Shih
ac6b1273e4 remove workaround as vendor_init is ready
Bug: 171942789
Test: boot under enforcing ROM
Change-Id: If4bb070ecf2272dd927ceaeda1882d2fad62b4c3
2021-03-19 11:58:39 +08:00
TreeHugger Robot
4eba688673 Merge "update error on ROM 7219510" into sc-dev 2021-03-19 03:51:31 +00:00
Kris Chen
09996bc810 Add sepolicy rules for fingerprint hal
Fixes the following avc denials:
03-18 11:23:15.692   956   956 I android.hardwar: type=1400 audit(0.0:7): avc: denied { read write } for name="trusty-ipc-dev0" dev="tmpfs" ino=691 scontext=u:r:hal_fingerprint_default:s0 tcontext=u:object_r:tee_device:s0 tclass=chr_file permissive=1
03-18 11:23:15.692   956   956 I android.hardwar: type=1400 audit(0.0:8): avc: denied { open } for path="/dev/trusty-ipc-dev0" dev="tmpfs" ino=691 scontext=u:r:hal_fingerprint_default:s0 tcontext=u:object_r:tee_device:s0 tclass=chr_file permissive=1
03-18 11:23:15.692   956   956 I android.hardwar: type=1400 audit(0.0:9): avc: denied { ioctl } for path="/dev/trusty-ipc-dev0" dev="tmpfs" ino=691 ioctlcmd=0x7280 scontext=u:r:hal_fingerprint_default:s0 tcontext=u:object_r:tee_device:s0 tclass=chr_file permissive=1
03-18 11:40:56.072   973   973 I fingerprint@2.1: type=1400 audit(0.0:39): avc: denied { search } for name="battery" dev="sysfs" ino=66502 scontext=u:r:hal_fingerprint_default:s0 tcontext=u:object_r:sysfs_batteryinfo:s0 tclass=dir permissive=1
03-18 11:40:56.072   973   973 I fingerprint@2.1: type=1400 audit(0.0:40): avc: denied { read } for name="temp" dev="sysfs" ino=66520 scontext=u:r:hal_fingerprint_default:s0 tcontext=u:object_r:sysfs_batteryinfo:s0 tclass=file permissive=1
03-18 11:40:56.072   973   973 I fingerprint@2.1: type=1400 audit(0.0:41): avc: denied { open } for path="/sys/devices/platform/google,battery/power_supply/battery/temp" dev="sysfs" ino=66520 scontext=u:r:hal_fingerprint_default:s0 tcontext=u:object_r:sysfs_batteryinfo:s0 tclass=file permissive=1
03-18 14:11:23.476   979   979 I fingerprint@2.1: type=1400 audit(0.0:13): avc: denied { search } for name="battery" dev="sysfs" ino=66502 scontext=u:r:hal_fingerprint_default:s0 tcontext=u:object_r:sysfs_batteryinfo:s0 tclass=dir permissive=1
03-18 12:03:08.248   978   978 I android.hardwar: type=1400 audit(0.0:9): avc: denied { create } for scontext=u:r:hal_fingerprint_default:s0 tcontext=u:r:hal_fingerprint_default:s0 tclass=netlink_socket permissive=1
03-18 12:03:08.248   978   978 I android.hardwar: type=1400 audit(0.0:10): avc: denied { bind } for scontext=u:r:hal_fingerprint_default:s0 tcontext=u:r:hal_fingerprint_default:s0 tclass=netlink_socket permissive=1
03-18 12:03:08.248   978   978 I android.hardwar: type=1400 audit(0.0:11): avc: denied { write } for scontext=u:r:hal_fingerprint_default:s0 tcontext=u:r:hal_fingerprint_default:s0 tclass=netlink_socket permissive=1
03-18 12:03:08.248   978   978 I android.hardwar: type=1400 audit(0.0:12): avc: denied { read } for scontext=u:r:hal_fingerprint_default:s0 tcontext=u:r:hal_fingerprint_default:s0 tclass=netlink_socket permissive=1
03-18 12:56:30.446   404   404 E SELinux : avc:  denied  { add } for interface=vendor.goodix.hardware.biometrics.fingerprint::IGoodixFingerprintDaemon sid=u:r:hal_fingerprint_default:s0 pid=967 scontext=u:r:hal_fingerprint_default:s0 tcontext=u:object_r:default_android_hwservice:s0 tclass=hwservice_manager permissive=1

Bug: 171943101
Test: No above avc denials in logcat.
Change-Id: I67b397f86c39625b77ebe6d32d37e42cd87b3f93
2021-03-19 03:41:18 +00:00
TreeHugger Robot
46b51cd204 Merge "power: Add policy to access sysfs_bcl" into sc-dev 2021-03-19 03:39:32 +00:00
Adam Shih
8d2feed7ed label missing vibrator sys nodes
Bug: 182954060
Test: boot with no avc error found
Change-Id: I1ffd97c6646d106c88efe36bfb4483ae44415eaa
2021-03-19 11:14:36 +08:00
George Lee
9c3d77d088 power: Add policy to access sysfs_bcl
Bug: 180620276
Test: adb bugreport
dumpstate_board.txt shows:
------ BCL (/sys/devices/virtual/pmic/mitigation/triggered_stats) ------
Source    	Count	Last Triggered	Last SOC	Last Voltage
smpl_warn      	0	0		0		0
ocp_cpu1       	0	0		0		0
ocp_cpu2       	0	0		0		0
soft_ocp_cpu1  	0	0		0		0
soft_ocp_cpu2  	0	0		0		0
ocp_tpu        	0	0		0		0
soft_ocp_tpu   	0	0		0		0
pmic_120c      	0	0		0		0
pmic_140c      	0	0		0		0
pmic_overheat  	0	0		0		0
ocp_gpu        	0	0		0		0
soft_ocp_gpu   	0	0		0		0

------ IF PMIC (/sys/devices/virtual/pmic/max77759-mitigation/triggered_stats) ------
Source    	Count	Last Triggered	Last SOC	Last Voltage
VDROOP1        	0	0		0		0
VDROOP2        	0	0		0		0
BATOILO        	0	0		0		0

Signed-off-by: George Lee <geolee@google.com>
Change-Id: If7874e19b8202175071d474502e77748168565ce
2021-03-19 02:56:32 +00:00
Adam Shih
857ea2e064 update error on ROM 7219510
Bug: 183161715
Test: pts-tradefed run pts -m PtsSELinuxTest
Change-Id: Id5c7856e7b77600f47df652a95ac342f11c924f5
2021-03-19 10:52:09 +08:00
TreeHugger Robot
9a865e84c7 Merge "Allow fingerprint hal to access fingerprint device" into sc-dev 2021-03-19 02:19:59 +00:00
David Li
fa11af6a07 audio: add /dev/acd-audio_dcdoff_ref for audio effect visualizer
Set /dev/acd-audio_dcdoff_ref as u:object_r:aoc_device:s0
crw-rw---- 1 system audio u:object_r:aoc_device:s0  500,  29 2021-03-18 22:19 /dev/acd-audio_dcdoff_ref

Bug: 180984363
Bug: 165719427
Test: make -j128
Test: ls -alZ /dev/acd-audio_dcdoff_ref
Change-Id: If7cd3ef99885730287648afebb222d4f925d325e
2021-03-19 10:10:49 +08:00
Kris Chen
10fda56cd1 Allow fingerprint hal to access fingerprint device
Fixes the following avc denials:
03-18 10:57:10.612   947   947 I android.hardwar: type=1400 audit(0.0:8): avc: denied { open } for path="/dev/goodix_fp" dev="tmpfs" ino=482 scontext=u:r:hal_fingerprint_default:s0 tcontext=u:object_r:device:s0 tclass=chr_file permissive=1
03-18 10:57:10.632   947   947 I android.hardwar: type=1400 audit(0.0:9): avc: denied { ioctl } for path="/dev/goodix_fp" dev="tmpfs" ino=482 ioctlcmd=0x6707 scontext=u:r:hal_fingerprint_default:s0 tcontext=u:object_r:device:s0 tclass=chr_file permissive=1
03-18 10:57:13.672   947   947 I android.hardwar: type=1400 audit(0.0:14): avc: denied { ioctl } for path="/dev/goodix_fp" dev="tmpfs" ino=482 ioctlcmd=0x6706 scontext=u:r:hal_fingerprint_default:s0 tcontext=u:object_r:device:s0 tclass=chr_file permissive=1
03-18 10:57:32.704   947   947 I HwBinder:947_1: type=1400 audit(0.0:26): avc: denied { ioctl } for path="/dev/goodix_fp" dev="tmpfs" ino=482 ioctlcmd=0x6705 scontext=u:r:hal_fingerprint_default:s0 tcontext=u:object_r:device:s0 tclass=chr_file permissive=1

Bug: 171943101
Test: No above avc denials in logcat.
Change-Id: I254a01a2c11fcaba9ad3f387862a8d0ddafffd38
2021-03-18 19:23:54 +08:00
TreeHugger Robot
2433a82427 Merge "sepolicy: fix usb hal selinux permission" into sc-dev 2021-03-18 05:47:52 +00:00
SalmaxChang
2797490192 Update vendor_modem_prop and add rules for mds
Bug: 181185131
Change-Id: Ie709e08152d23428a687c949359316206843b9fa
2021-03-18 04:48:19 +00:00
TreeHugger Robot
8a191daf92 Merge changes I15473321,Id60bb2e8 into sc-dev
* changes:
  remove obsolete entries
  update error on ROM 7216638
2021-03-18 04:02:01 +00:00
Ines Ayara
338d324e5a Merge "Add "libedgetpu_darwinn2.so" library duplicate to be used for external launch." into sc-dev 2021-03-18 02:54:19 +00:00
Adam Shih
c36661eb0b remove obsolete entries
Bug: 177389198
Bug: 177860960
Bug: 178752576
Bug: 178753472
Bug: 179310892
Bug: 179437292
Bug: 179437988
Bug: 180656125
Bug: 180960879
Bug: 182705863
Test: boot and grab bugreport with no gmscore error found
Change-Id: I154733215aeca58a76add8d346cc0016a5f0dff7
2021-03-18 10:15:43 +08:00
Adam Shih
15a0c61432 update error on ROM 7216638
Bug: 183055762
Test: pts-tradefed run pts -m PtsSELinuxTest
Change-Id: Id60bb2e822734e23803b8f937b71dc59a325c27b
2021-03-18 10:03:37 +08:00
Albert Wang
beb4f82d32 sepolicy: fix usb hal selinux permission
avc: denied { read } for name="port0-partner" dev="sysfs" ino=98412 scontext=u:r:hal_usb_impl:s0 tcontext=u:object_r:sysfs_batteryinfo:s0 tclass=dir permissive=1
avc: denied { open } for path="/sys/devices/platform/10d50000.hsi2c/i2c-6/6-0025/typec/port0/port0-partner" dev="sysfs" ino=98412 scontext=u:r:hal_usb_impl:s0 tcontext=u:object_r:sysfs_batteryinfo:s0 tclass=dir permissive=1
avc: denied { getattr } for path="/sys/devices/platform/10d50000.hsi2c/i2c-5/5-0025/typec/port0/power_role" dev="sysfs" ino=67861 scontext=u:r:hal_usb_impl:s0 tcontext=u:object_r:sysfs_batteryinfo:s0 tclass=file permissive=1
avc: denied { open } for path="/sys/devices/platform/10d50000.hsi2c/i2c-5/5-0025/typec/port0/power_role" dev="sysfs" ino=67861 scontext=u:r:hal_usb_impl:s0 tcontext=u:object_r:sysfs_batteryinfo:s0 tclass=file permissive=1
avc: denied { write } for name="port_type" dev="sysfs" ino=71778 scontext=u:r:hal_usb_impl:s0 tcontext=u:object_r:sysfs_batteryinfo:s0 tclass=file permissive=1

Bug: 182122983
Test: atest VtsHalUsbV1_0TargetTest
      atest HalUsbGadgetV1_0HostTest
Signed-off-by: Albert Wang <albertccwang@google.com>
Change-Id: Ia2cf9061dd5eaa7af582331477afd34db56531e8
2021-03-18 09:51:14 +08:00
TreeHugger Robot
57ec723c5e Merge "Fix selinux error for vendor_init" into sc-dev 2021-03-18 00:49:15 +00:00
iayara
adeaaead76 Add "libedgetpu_darwinn2.so" library duplicate to be used for external
launch.

This change is intended to keep naming consistency with previous
Darwinn external launch. In the future, all "libedgetpu_darwinn2.so"
instances should be replaced by "libedgetpu_util.so".

Bug: 182303547
Change-Id: I99e83f5f2e317b195b2061c781cb23544e547c55
2021-03-17 23:47:07 +00:00
Hridya Valsaraju
2f772dd166 Merge "Add a label for Pixel DMA-BUF heap tracepoints" into sc-dev 2021-03-17 21:58:55 +00:00
Yu-Chi Cheng
a802ac3b05 Merge "Allowed Camera hal to access EdgeTPU service for on-device compilation." into sc-dev 2021-03-17 20:37:44 +00:00
Yu-Chi Cheng
86aa156202 Allowed Camera hal to access EdgeTPU service for on-device compilation.
Camera hal DarwiNN pipelines are switching to use the on-device
compilation, which achieves by talking to the EdgeTPU service.
This change added the required selinux policies to allow accessing
the service, as well as allowing file descriptors to be shared
between them for passing the compilation info around.

Bug: 182423730
Bug: 182706078
Test: verified on Oriole running camera.
Change-Id: I5d3bc84fd54d4618f505f37d9773894261061d7f
2021-03-17 08:18:55 -07:00
Aaron Tsai
185dbee4eb Fix selinux error for vendor_init
03-12 18:15:16.240  root     1     1 I /system/bin/init: type=1107 audit(0.0:19): uid=0 auid=4294967295 ses=4294967295 subj=u:r:init:s0 msg='avc: denied { set } for property=vendor.sys.modem_reset pid=354 uid=0 gid=0 scontext=u:r:vendor_init:s0 tcontext=u:object_r:vendor_sys_default_prop:s0 tclass=property_service permissive=1'

Bug: 182715587
Test: verified with the forrest ROM and error log gone
Change-Id: Icfea06220c491d414f6bdbf04ceda4c46299fb29
2021-03-17 10:14:31 +00:00
TreeHugger Robot
64c726720b Merge "label uwb service to prevent reset after unplugging USB" into sc-dev 2021-03-17 08:35:08 +00:00
Jenny Ho
208d1aed01 Merge "genfs_contexts: add sepolicy for dumping eeprom data" into sc-dev 2021-03-17 08:07:45 +00:00
Adam Shih
ebeae6abc3 label uwb service to prevent reset after unplugging USB
Bug: 182953824
Test: unplug USB under enforcing mode
Change-Id: Ib4bdf9b9339fc631d045bde57f78a46ce3ca8b6e
2021-03-17 15:25:27 +08:00
TreeHugger Robot
b8ec327d5c Merge "sensors: Add sensor related rule to chre." into sc-dev 2021-03-17 06:28:41 +00:00
Hridya Valsaraju
a570dc6991 Add a label for Pixel DMA-BUF heap tracepoints
These tracepoint are the DMA-BUF equivalents to the ION tracepoints.
They expose the size of the DMA-BUF, unique inode number of the DMA-BUF
and total size of all DMA-BUFs exported from the DMA-BUF heap framework.

Test: build
Bug: 182328989
Change-Id: I311b68275ebd668f73d0ccff0fcaa01d251250bc
2021-03-16 23:00:41 -07:00
Jenny Ho
2dc4d2d61f genfs_contexts: add sepolicy for dumping eeprom data
I auditd  : type=1400 audit(0.0:53): avc: denied { getattr } for comm="sh" path="/sys/devices/platform/10970000.hsi2c/i2c-5/5-0050/eeprom" dev="sysfs" ino=59692 scontext=u:r:shell:s0 tcontext=u:object_r:sysfs:s0 tclass=file permissive=1
I sh      : type=1400 audit(0.0:53): avc: denied { getattr } for path="/sys/devices/platform/10970000.hsi2c/i2c-5/5-0050/eeprom" dev="sysfs" ino=59692 scontext=u:r:shell:s0 tcontext=u:object_r:sysfs:s0 tclass=file permissive=1
I auditd  : type=1400 audit(0.0:57): avc: denied { getattr } for comm="ls" path="/sys/devices/platform/10970000.hsi2c/i2c-5/5-0050/eeprom" dev="sysfs" ino=59692 scontext=u:r:shell:s0 tcontext=u:object_r:sysfs:s0 tclass=file permissive=1
I ls      : type=1400 audit(0.0:57): avc: denied { getattr } for path="/sys/devices/platform/10970000.hsi2c/i2c-5/5-0050/eeprom" dev="sysfs" ino=59692 scontext=u:r:shell:s0 tcontext=u:object_r:sysfs:s0 tclass=file permissive=1

Bug: 182531832
Signed-off-by: Jenny Ho <hsiufangho@google.com>
Change-Id: If189575c6db8b43b59c6009378ec724bd075c0d1
2021-03-17 13:07:55 +08:00
Adam Shih
63143cdf96 Merge changes I33cd99d5,I8417d4eb into sc-dev
* changes:
  label missing power sys nodes
  update error on ROM 7213588
2021-03-17 05:03:29 +00:00
TreeHugger Robot
0aef3b56c5 Merge "Add Sepolicy rule for connectivity monitor app" into sc-dev 2021-03-17 03:12:31 +00:00
Adam Shih
74052118a8 label missing power sys nodes
Bug: 182954169
Test: boot with no avc error found
Change-Id: I33cd99d5748dd9fc40301c460a050b6e969f30f4
2021-03-17 10:49:24 +08:00
Rick Chen
78047fa17b sensors: Add sensor related rule to chre.
[    8.417813] type=1400 audit(1615518074.988:4): avc: denied { write } for comm="sensors@2.0-ser" name="chre" dev="tmpfs" ino=908 scontext=u:r:hal_sensors_default:s0 tcontext=u:object_r:chre_socket:s0 tclass=sock_file permissive=1
[    8.418075] type=1400 audit(1615518074.988:5): avc: denied { connectto } for comm="sensors@2.0-ser" path="/dev/socket/chre" scontext=u:r:hal_sensors_default:s0 tcontext=u:r:chre:s0 tclass=unix_stream_socket permissive=1
03-12 11:01:14.988   694   694 I sensors@2.0-ser: type=1400 audit(0.0:5): avc: denied { connectto } for path="/dev/socket/chre" scontext=u:r:hal_sensors_default:s0 tcontext=u:r:chre:s0 tclass=unix_stream_socket permissive=1

Also merge two sensor_hal related files into single file.

Bug: 182523946
Test: make selinux_policy -j128 and push to device.
      No hal_sensors_default related avc deined log during boot.
Signed-off-by: Rick Chen <rickctchen@google.com>
Change-Id: I49ce71ba4703528fb2e26dd8956c4ed741337ffc
2021-03-17 10:34:14 +08:00
Adam Shih
7c0fd2a413 update error on ROM 7213588
Bug: 182954169
Bug: 182954060
Bug: 182954138
Bug: 182954062
Bug: 182953824
Bug: 182953825
Bug: 182954248
Test: pts-tradefed run pts -m PtsSELinuxTest
Change-Id: I8417d4ebacefa691838e25131749b0e4fd152a2f
2021-03-17 10:15:02 +08:00
Benjamin Schwartz
fe980b935b Merge "Give power stats HAL permission to read ufs stats" into sc-dev 2021-03-17 02:09:54 +00:00
TreeHugger Robot
23017e956d Merge "allow df to collect partition info" into sc-dev 2021-03-17 01:52:43 +00:00
Benjamin Schwartz
ed8fdc9997 Fix sepolicies for hal_power_stats_default
Bug: 182320246
Test: No more avc denied log messages for hal_power_stats_default
Change-Id: I1cd801bb4823e80bd5ea112fb0b7bdfaeabbdef5
2021-03-16 10:37:09 -07:00
TreeHugger Robot
96d0c28dc4 Merge "display: add sepolicy for hal_graphics_composer" into sc-dev 2021-03-16 12:05:50 +00:00
Hsiaoan Hsu
46fedc2148 Add Sepolicy rule for connectivity monitor app
sync sepolicy from previous projects.

Bug: 182715920
Test: build pass. connetivity monitor service running successfully.
Change-Id: Id5606b5db74fbf672ac41549862a83557734ac57
2021-03-16 15:48:53 +08:00
raylinhsu
031fe80418 display: add sepolicy for hal_graphics_composer
Allow HWC to access vendor_log_file and also allow hwc to access
power hal

Bug: 181712799
Test: pts -m PtsSELinuxTest -t
com.google.android.selinux.pts.SELinuxTest#scanAvcDeniedLogRightAfterReboot

Change-Id: I403a528f651b9ee5755d11525f2a33c39628ecee
2021-03-16 13:50:48 +08:00
SalmaxChang
b70e0bebdd MDS: Fix avc errors
avc: denied { search } for name="vendor" dev="tmpfs" ino=2 scontext=u:r:modem_diagnostic_app:s0:c512,c768 tcontext=u:object_r:mnt_vendor_file:s0 tclass=dir permissive=1 app=com.google.mds
avc: denied { search } for name="vendor" dev="tmpfs" ino=2 scontext=u:r:priv_app:s0:c512,c768 tcontext=u:object_r:mnt_vendor_file:s0 tclass=dir permissive=1 app=com.google.mds
avc: denied { search } for comm=4173796E635461736B202332 name="radio" dev="dm-9" ino=242 scontext=u:r:priv_app:s0:c512,c768 tcontext=u:object_r:radio_vendor_data_file:s0 tclass=dir permissive=1 app=com.google.mds
avc: denied { call } for comm=4173796E635461736B202331 scontext=u:r:priv_app:s0:c512,c768 tcontext=u:r:dmd:s0 tclass=binder permissive=1 app=com.google.mds
avc: denied { write } for name="property_service" dev="tmpfs" ino=316 scontext=u:r:priv_app:s0:c512,c768 tcontext=u:object_r:property_socket:s0 tclass=sock_file permissive=1 app=com.google.mds
avc: denied { read } for name="u:object_r:vendor_modem_prop:s0" dev="tmpfs" ino=289 scontext=u:r:modem_diagnostic_app:s0:c512,c768 tcontext=u:object_r:vendor_modem_prop:s0 tclass=file permissive=1 app=com.google.mds
avc: denied { search } for comm=4173796E635461736B202331 name="chosen" dev="sysfs" ino=9330 scontext=u:r:modem_diagnostic_app:s0:c512,c768 tcontext=u:object_r:sysfs_chosen:s0 tclass=dir permissive=1 app=com.google.mds

Bug: 181185131
Bug: 179110848

Change-Id: I1ac00b68e2db44cc86f6b5c70001cda78264ff6e
2021-03-16 02:27:54 +00:00
Adam Shih
dd7f31a99f Merge "label power.stats-vendor properly" into sc-dev 2021-03-16 01:16:20 +00:00
Benjamin Schwartz
a1f92cdd90 Give power stats HAL permission to read ufs stats
Bug: 140217385
Test: dumpsys android.hardware.power.stats.IPowerStats/default
Change-Id: Ib3fa9440982bc5846053e9ddf56d3ed178599c0c
2021-03-15 17:37:29 -07:00
Adam Shih
3887fc2628 Merge "Allow bluetooth hal to get boot status" into sc-dev 2021-03-16 00:35:59 +00:00