Since production devices(with user builds) must not mount debugfs,
provide dumpstate HAL permission to access debugfs only in userdebug/eng
builds.
Also, delete dumpstate domain's access to
vendor_dmabuf_debugfs(/d/dma_buf/bufinfo) since dumpstate now obtains
the same information from /sys/kernel/dmabuf.
Test: build
Bug: 186500818
Change-Id: I17007d495fba6332bbf17dc7d030e5c6e4d5248b
A few debugfs files are labelled as belonging to both debugfs_type and
sysfs_type. Hence, any client that is provided access to sysfs_type will
automatically be provided access to these files. This patch corrects the
labelling for these files to prevent this.
Test: build
Bug: 186500818
Change-Id: I364a73a960824cc9051610032179fd5caeca09de
This is to pass system/netd/tests/netd_test.cpp:
TEST(NetdSELinuxTest, CheckProperMTULabels) {
// Since we expect the egrep regexp to filter everything out,
// we thus expect no matches and thus a return code of 1
ASSERT_EQ(W_EXITCODE(1, 0), system("ls -Z /sys/class/net/*/mtu | egrep -q -v "
"'^u:object_r:sysfs_net:s0 /sys/class/net/'"));
}
Test: atest, TreeHugger, manual observation of labeling
Bug: 185962988
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: Ib4f8aa6cc2e0f5a5bd432bcfe473e550f5c68132
These are the SELinux policies for the DebugFS files of the SJTAG
kernel interface.
Bug: 184768605
Signed-off-by: Peter Csaszar <pcsaszar@google.com>
Change-Id: I36996d6fd5fe09adb7a36be573cf57f15ea35756
Bug: 173330981
Bug: 187014717
Test: no avc denials for twoshay was found.
Signed-off-by: Tai Kuo <taikuo@google.com>
Change-Id: Idcf38e0921fb4d6d617e7cd443425193aea3fe91
We are collecting Suez metrics from TPU related services. This includes
NNAPI HAL, edgetput logging service, and edgetpu service.
This change allows them all to find stats_service.
Bug: 151063663
Test: Pushed selinx module to device and successfully logged Stats
service.
Change-Id: I80774485ae7c2a5f994d48a71b6406fac753a9f8
To comply with the GSI compliance test, this change
splits the compiler part of the edgetpu_service into a
separate edgetpu_vendor_service under vendor.
The edgetpu_service locates under /system_ext/ and used
to be connected by both applications and vendor clients.
With this change, vendor clients could talk to the vendor
part of this service directly without having to cross
the system and vendor boundary.
Applications will still talk to the system_ext one, which
will forward the requests to the vendor service.
Bug: 185432427
Test: tested on Oriole + GCA.
Change-Id: I1ee47946f1fc3694d5f8b5325c192d6bd720a76e
Bug: 183467815
Test: 1. Enable tcpdump_logger always-on function
2. Dump bugreport
3. Pull dumpstate_board.bin and chagne it to zip
4. Unzip dumpstate_board.zip and check if tcpdump files
are there.
Change-Id: I178aca40d94602994eef619f05a26ceb78eeff1f
Vendor kernel modules were moved to /vendor_dlkm/lib/modules. Let's
remove the old directory /vendor/lib/modules from file_contexts.
Bug: 185184472
Bug: 186777291
Change-Id: I38f1b25cb2d73a804f1cdb113edc9b11f8e516f7
Provide necessary permissions to run usf_reg_edit from bugreport.
Bug: 187081112
Test: Run "adb bugreport <zip>" and verify it contains the output
from "usf_reg_edit save -".
Change-Id: Iade132d93105d461d51273d19fe570d48cce46fe
This reverts commit a346a7fa34.
Let's move back to wildcards for kernel modules. This better supports
kernel pre-submit testing and local kernel development where the script
build.sh from the kernel repo is used to create the vendor_dlkm parition
image. With build.sh, the path to a .ko file includes the kernel
version as well as additional directory components like "extra/" that
describe where in the kernel source key the module is located. Example:
/vendor_dlkm/lib/modules/5.10.33-g2f01cf4c7282-dirty/extra/ftm5.ko
Bug: 185184472
Bug: 186777291
Change-Id: I32f85dae7ca60d9063ad6c63f21ffdaecbb66039
