Commit graph

894 commits

Author SHA1 Message Date
TreeHugger Robot
23b7621849 Merge "Add vendor SELinux denial to allowlist" into sc-dev am: 4720a91c52
Original change: https://googleplex-android-review.googlesource.com/c/device/google/gs101-sepolicy/+/15422669

Change-Id: Id95206a386275893599d7be18c15e48274f4a140
2021-07-30 13:25:13 +00:00
TreeHugger Robot
4720a91c52 Merge "Add vendor SELinux denial to allowlist" into sc-dev 2021-07-30 13:12:12 +00:00
Rick Yiu
5168b7a0f3 Merge "gs101: Remove vendor_sched" into sc-dev am: dba7013033
Original change: https://googleplex-android-review.googlesource.com/c/device/google/gs101-sepolicy/+/15402045

Change-Id: I80c3982fd8f5565ad1f4a7fb9f1fa993c7e233dc
2021-07-30 07:05:37 +00:00
Rick Yiu
dba7013033 Merge "gs101: Remove vendor_sched" into sc-dev 2021-07-30 06:52:10 +00:00
Rick Yiu
7de8a5d4a7 gs101: Remove vendor_sched
Moved to system/sepolicy.

Bug: 194656257
Test: build pass
Change-Id: Ia5ea1bbc05bdc52b43cb403d99994bad70613e08
Merged-In: Ia5ea1bbc05bdc52b43cb403d99994bad70613e08
2021-07-30 03:13:39 +00:00
Jaineel Mehta
0474bcf10e Add vendor SELinux denial to allowlist
Change-Id: If7435e9c62811ef3c9757f22f06018c32a8d3597
Test: None
Bug: 194281028
2021-07-29 21:23:34 +00:00
TreeHugger Robot
8ab71529ce Merge "gs101: Allow camera hal to create file in persist camera folder" into sc-dev am: 750888bc5b
Original change: https://googleplex-android-review.googlesource.com/c/device/google/gs101-sepolicy/+/15354010

Change-Id: Ia321b3fa069583efadda94caab9b72a484f5631b
2021-07-29 09:14:51 +00:00
TreeHugger Robot
750888bc5b Merge "gs101: Allow camera hal to create file in persist camera folder" into sc-dev 2021-07-29 08:40:36 +00:00
Michael Eastwood
8cda72b001 Merge "Allow hal_dumpstate_default to access vendor_camera_debug_prop" into sc-dev am: 9bfbb3c0d4
Original change: https://googleplex-android-review.googlesource.com/c/device/google/gs101-sepolicy/+/15406130

Change-Id: Ida4fbd33da5d2ded18be388f989e27936b3bd955
2021-07-28 21:55:14 +00:00
Michael Eastwood
9bfbb3c0d4 Merge "Allow hal_dumpstate_default to access vendor_camera_debug_prop" into sc-dev 2021-07-28 21:36:38 +00:00
Michael Eastwood
30bd5e8ed6 Allow hal_dumpstate_default to access vendor_camera_debug_prop
Bug: 193365129
Test: atest com.google.android.selinux.pts.SELinuxTest#scanBugreport
Change-Id: I43e389d46e8116844bb9ca4259e5ea28e86c50f4
2021-07-27 17:22:47 -07:00
TreeHugger Robot
a96235b57b Merge "Add AoC wakeup stats to dump state" into sc-dev am: fead41d573
Original change: https://googleplex-android-review.googlesource.com/c/device/google/gs101-sepolicy/+/15393321

Change-Id: Ia4cb5725b748fcccd901a28ca2e3dbb354c3e44e
2021-07-27 19:44:07 +00:00
TreeHugger Robot
fead41d573 Merge "Add AoC wakeup stats to dump state" into sc-dev 2021-07-27 19:23:06 +00:00
Jack Wu
2c79c75768 sepolicy: gs101: allows pixelstat to access pca file nodes am: d6c1a50bba
Original change: https://googleplex-android-review.googlesource.com/c/device/google/gs101-sepolicy/+/15360184

Change-Id: Ic3efb76715139aa335995b95e7756f23b5de226c
2021-07-27 02:29:16 +00:00
Max Kogan
5374497df5 Add AoC wakeup stats to dump state
Need add support for wakeup stats to track AoC to AP messages
resulting in frequent wake-ups.

Bug: 192668026
Change-Id: I073406cc101e114135c863b0e0b86357e93c0415
2021-07-26 22:45:16 +00:00
Jack Wu
d6c1a50bba sepolicy: gs101: allows pixelstat to access pca file nodes
07-23 14:24:45.512  1000  3001  3001 I pixelstats-vend: type=1400 audit(0.0:10): avc: denied { open } for path="/sys/devices/platform/10d50000.hsi2c/i2c-5/5-0057/chg_stats" dev="sysfs" ino=72245 scontext=u:r:pixelstats_vendor:s0 tcontext=u:object_r:sysfs:s0 tclass=file permissive=1
07-23 14:24:45.512  1000  3001  3001 I pixelstats-vend: type=1400 audit(0.0:11): avc: denied { getattr } for path="/sys/devices/platform/10d50000.hsi2c/i2c-5/5-0057/chg_stats" dev="sysfs" ino=72245 scontext=u:r:pixelstats_vendor:s0 tcontext=u:object_r:sysfs:s0 tclass=file permissive=1
07-23 14:24:57.536  1000  3001  3001 I pixelstats-vend: type=1400 audit(0.0:12): avc: denied { read } for name="chg_stats" dev="sysfs" ino=72245 scontext=u:r:pixelstats_vendor:s0 tcontext=u:object_r:sysfs:s0 tclass=file permissive=1
07-23 14:24:57.536  1000  3001  3001 I pixelstats-vend: type=1400 audit(0.0:13): avc: denied { open } for path="/sys/devices/platform/10d50000.hsi2c/i2c-5/5-0057/chg_stats" dev="sysfs" ino=72245 scontext=u:r:pixelstats_vendor:s0 tcontext=u:object_r:sysfs:s0 tclass=file permissive=1
07-23 14:24:57.536  1000  3001  3001 I pixelstats-vend: type=1400 audit(0.0:14): avc: denied { getattr } for path="/sys/devices/platform/10d50000.hsi2c/i2c-5/5-0057/chg_stats" dev="sysfs" ino=72245 scontext=u:r:pixelstats_vendor:s0 tcontext=u:object_r:sysfs:s0 tclass=file permissive=1
07-23 14:24:57.536  1000  3001  3001 I pixelstats-vend: type=1400 audit(0.0:15): avc: denied { write } for name="chg_stats" dev="sysfs" ino=72245 scontext=u:r:pixelstats_vendor:s0 tcontext=u:object_r:sysfs:s0 tclass=file permissive=1

Bug: 194386750
Test: manually test, no avc: denied
Signed-off-by: Jack Wu <wjack@google.com>
Change-Id: I1a16edb5bb7820f62b3ce598aa50eba2d9455927
2021-07-24 06:42:39 +00:00
TreeHugger Robot
cd16e38ab2 Merge "Add SE policies for memtrack HAL" into sc-dev am: b3225f0f6c
Original change: https://googleplex-android-review.googlesource.com/c/device/google/gs101-sepolicy/+/15283133

Change-Id: I552351e0eac65c20d795b1682852896943f948c8
2021-07-23 21:24:50 +00:00
TreeHugger Robot
b3225f0f6c Merge "Add SE policies for memtrack HAL" into sc-dev 2021-07-23 20:52:52 +00:00
Ankit Goyal
0f9820830c Add SE policies for memtrack HAL
Bug: 191966412
Test: adb shell dumpsys meminfo
Change-Id: Ia7ec64840d2bb7c3ae0d61304e109d2ceb9e5f78
2021-07-24 02:18:36 +08:00
Max Shi
50486c63f3 Allow USF sensor HAL to read camera persist files. am: 0bd50d1eb5
Original change: https://googleplex-android-review.googlesource.com/c/device/google/gs101-sepolicy/+/15352099

Change-Id: Id31975a653e79362c0dea9a86b52944d340f2fee
2021-07-22 23:46:11 +00:00
Max Shi
0bd50d1eb5 Allow USF sensor HAL to read camera persist files.
USF sensor HAL requires access to camera persist files to determine if
the camera module has been replaced (e.g. via repair), which may affect
calibration of the magnetometer.

Bug: 193727762
Test: Verify sensor HAL can open and read files under
Test: /mnt/vendor/persist/camera/
Change-Id: Icb9d7a46bf8465e1a72054ac9c8493ba18445ef3
2021-07-22 21:11:44 +00:00
Badhri Jagan Sridharan
31b15ff2bb Merge "Update Usb hal permissions to allow pushing overheat suez events" into sc-dev am: 49804d8d6f
Original change: https://googleplex-android-review.googlesource.com/c/device/google/gs101-sepolicy/+/15283349

Change-Id: I6fc802f74aaf7e1f7a7b8574ed5ace1886b9623c
2021-07-22 20:52:11 +00:00
Badhri Jagan Sridharan
49804d8d6f Merge "Update Usb hal permissions to allow pushing overheat suez events" into sc-dev 2021-07-22 20:31:13 +00:00
George Lee
ef556f7fee Merge "pixelstats: add bcl directory permission" into sc-dev am: 79a15eed2a
Original change: https://googleplex-android-review.googlesource.com/c/device/google/gs101-sepolicy/+/15145257

Change-Id: I4d0c92d3074ef8e3112b6dade853b6b53dbb3cfe
2021-07-22 17:26:15 +00:00
George Lee
79a15eed2a Merge "pixelstats: add bcl directory permission" into sc-dev 2021-07-22 17:03:33 +00:00
Gary Jian
11d8a4eb7e Merge "Allow to set vendor_rild_prop for oemrilservice_app" into sc-dev am: 9b5a97d65e
Original change: https://googleplex-android-review.googlesource.com/c/device/google/gs101-sepolicy/+/15327671

Change-Id: I8e2e152f7ca71a0e5aa462093ebc10604d408814
2021-07-22 08:27:53 +00:00
Gary Jian
9b5a97d65e Merge "Allow to set vendor_rild_prop for oemrilservice_app" into sc-dev 2021-07-22 08:16:42 +00:00
chened
561ce13d59 gs101: Allow camera hal to create file in persist camera folder
Test: build pass, no cts regression
Bug: 189844464
Change-Id: If150a94f184424f21c509a44001192e36b6ee24a
2021-07-22 07:11:05 +00:00
Petri Gynther
adee4062ad Add vbmeta_vendor_[ab] to file_contexts am: d12714ccc0
Original change: https://googleplex-android-review.googlesource.com/c/device/google/gs101-sepolicy/+/15276573

Change-Id: Ie5f417c81373d599403646c90ddeda78b84c0b7a
2021-07-21 23:50:44 +00:00
Badhri Jagan Sridharan
1ebd84703b Update Usb hal permissions to allow pushing overheat suez events
Usb hal now pushes the Usb port overheat event through statsd.
Usb hal also accesses usbc-throttling stats to gather info.

Bug: 193615568
Signed-off-by: Badhri Jagan Sridharan <badhri@google.com>
Change-Id: I4918458bc7a8a25d7655b66d1fe40eafc7ccb070
2021-07-21 14:38:55 -07:00
Sungwoo choi
b47cdf282a Allow to set vendor_rild_prop for oemrilservice_app
Bug: 193367138
Test: make sure no denied logs in oemrilservice_app when access the
radio property

Signed-off-by: Sungwoo choi <sungwoo48.choi@samsung.com>
Change-Id: I9014002476df7b4e650f7a5a2f153e4eca47d23d
2021-07-21 08:01:44 +00:00
Petri Gynther
d12714ccc0 Add vbmeta_vendor_[ab] to file_contexts
Bug: 181909612
Test: build + install + boot to home
Change-Id: Ibb7bd8e5a61d86de1b51a3780a5bfa8cf4caf59b
2021-07-20 23:41:31 -07:00
sukiliu
d1f198d5eb Update avc error on ROM 7566803 am: 411aa59779
Original change: https://googleplex-android-review.googlesource.com/c/device/google/gs101-sepolicy/+/15343071

Change-Id: I71dbe7cfb4ff8f409e9565e4a636ca8c4a3844ce
2021-07-21 06:02:08 +00:00
sukiliu
411aa59779 Update avc error on ROM 7566803
avc: denied { read } for name="platform:1cc40000.sysmmu--platform:1ce00000.abrolhos" dev="sysfs" ino=21006 scontext=u:r:hal_neuralnetworks_darwinn:s0 tcontext=u:object_r:sysfs:s0 tclass=dir permissive=0

Bug: 194241380
Test: PtsSELinuxTestCases
Change-Id: If7ee99a36bca88fffc37c12dc306e0453afb1395
2021-07-21 09:36:05 +08:00
TreeHugger Robot
0c411447d7 Merge "ims: allow finding mediametrics_service for vendor_ims_app" into sc-dev am: b3cc71258b
Original change: https://googleplex-android-review.googlesource.com/c/device/google/gs101-sepolicy/+/15302265

Change-Id: Ie50b322dca7fc0292a200a721870c6679456c5b5
2021-07-20 13:13:02 +00:00
Alex Hong
5cc647e87d Allow suspend_control to access the AOC wakeup node am: f0589d11df
Original change: https://googleplex-android-review.googlesource.com/c/device/google/gs101-sepolicy/+/15334275

Change-Id: Ibfbe41ba694a27408dbd3ff6bdb5632d55a9a05e
2021-07-20 13:12:56 +00:00
TreeHugger Robot
b3cc71258b Merge "ims: allow finding mediametrics_service for vendor_ims_app" into sc-dev 2021-07-20 13:00:25 +00:00
Sungjun Park
0612b5aa85 ims: allow finding mediametrics_service for vendor_ims_app
For generate dtmf tone, ImsService find mediametrics_service.
So, added the seplicy rule for finding mediametrics_service.

<Related log>
07-14 15:37:21.391   411   411 E SELinux : avc:  denied  { find } for
pid=2263 uid=10217 name=media.metrics scontext=u:r:vendor_ims_app:s0:
c217,c256,c512,c768 tcontext=u:object_r:mediametrics_service:s0 tclass
=service_manager permissive=0

Bug: 192543653
Signed-off-by: Sungjun Park <sj19385.park@samsung.com>
Change-Id: Ia0f6610ecc454533d9584367694228245afe46e4
2021-07-20 09:35:23 +00:00
Alex Hong
f0589d11df Allow suspend_control to access the AOC wakeup node
Test: Check avc denials during boot
      $ adb shell su 0 dumpsys suspend_control
Bug: 194164089

Change-Id: I9edcf6398f61daec6fdde0f7ac69ddd5d275f753
2021-07-20 09:29:15 +00:00
TreeHugger Robot
8be9d35300 Merge "ssr_detector_app: Add additional vendor dir and crgroup allow for debug" into sc-dev am: fa62e602fc
Original change: https://googleplex-android-review.googlesource.com/c/device/google/gs101-sepolicy/+/15132550

Change-Id: Ifdd759f02d516efa1691833b84e9129ed7136fe8
2021-07-20 06:23:08 +00:00
TreeHugger Robot
fa62e602fc Merge "ssr_detector_app: Add additional vendor dir and crgroup allow for debug" into sc-dev 2021-07-20 06:09:35 +00:00
sukiliu
909d2db713 Update avc error on ROM 7562467 am: d9309ef34d
Original change: https://googleplex-android-review.googlesource.com/c/device/google/gs101-sepolicy/+/15328118

Change-Id: Ida52f53a71258077d8163be3984c006e1d905f00
2021-07-20 04:37:32 +00:00
sukiliu
d9309ef34d Update avc error on ROM 7562467
avc: denied { read } for name="u:object_r:odsign_prop:s0" dev="tmpfs" ino=229 scontext=u:r:postinstall_dexopt:s0 tcontext=u:object_r:odsign_prop:s0 tclass=file permissive=0
avc: denied { read } for comm="otapreopt" name="u:object_r:odsign_prop:s0" dev="tmpfs" ino=229 scontext=u:r:postinstall_dexopt:s0 tcontext=u:object_r:odsign_prop:s0 tclass=file permissive=0

Bug: 194142604
Bug: 194065991
Test: PtsSELinuxTestCases
Change-Id: Ic3bb544f05ffff0df42f820d2f9cf6cd7cb24879
2021-07-20 10:03:30 +08:00
TreeHugger Robot
dd0acb63a4 Merge "Add cpm/pca9468 logbuffer directories so that bugreports can take a snapshot" into sc-dev am: f8b8e0cb53
Original change: https://googleplex-android-review.googlesource.com/c/device/google/gs101-sepolicy/+/15316269

Change-Id: Ia0bf59df027d801313955161d53139b7176c8b19
2021-07-19 21:10:22 +00:00
TreeHugger Robot
f8b8e0cb53 Merge "Add cpm/pca9468 logbuffer directories so that bugreports can take a snapshot" into sc-dev 2021-07-19 20:54:38 +00:00
TreeHugger Robot
299745791f Merge "Allow HAL to access sysfs." into sc-dev am: fc321aabe2
Original change: https://googleplex-android-review.googlesource.com/c/device/google/gs101-sepolicy/+/15308771

Change-Id: If129d2a57a6d94ef42cc187b7d53eb5c5a536d80
2021-07-19 18:39:57 +00:00
TreeHugger Robot
fc321aabe2 Merge "Allow HAL to access sysfs." into sc-dev 2021-07-19 18:22:13 +00:00
Andrew LeCain
d297941975 Merge "sepolicy allow fingerprint hal to read mfg_data" into sc-dev am: ff13d1adee
Original change: https://googleplex-android-review.googlesource.com/c/device/google/gs101-sepolicy/+/15292860

Change-Id: I53ca776b64edda2d1cabf505445f2f7768f04dc6
2021-07-19 18:06:19 +00:00
Andrew LeCain
ff13d1adee Merge "sepolicy allow fingerprint hal to read mfg_data" into sc-dev 2021-07-19 17:46:18 +00:00
Stephane Lee
022b61751e Add cpm/pca9468 logbuffer directories so that bugreports can take a snapshot
Test: adb bugreport; check "dumpstate_board.txt"
Bug: 193894298
Change-Id: I222405ab6d78bd4367a91cc0f13b8d8a0f1ca578
2021-07-16 16:27:42 -07:00