Darren Hsu
24b4d1b601
Allow hal_power_stats to read sysfs_aoc_dumpstate am: f11f53a3ae
am: a0592e36d2
...
Original change: https://android-review.googlesource.com/c/device/google/gs101-sepolicy/+/2044864
Change-Id: I1ae4b99a9fa4fc95f96ee1f36dc500f453653ca7
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
2022-03-28 08:17:33 +00:00
Darren Hsu
f11f53a3ae
Allow hal_power_stats to read sysfs_aoc_dumpstate
...
avc: denied { read } for comm="android.hardwar" name="restart_count"
dev="sysfs" ino=72823 scontext=u:r:hal_power_stats_default:s0
tcontext=u:object_r:sysfs_aoc_dumpstate:s0 tclass=file permissive=0
Bug: 226173008
Test: check bugreport without avc denials
Change-Id: Ife3a7e00a1ffbcbed7fd8b744f2ac8910931a5fb
Signed-off-by: Darren Hsu <darrenhsu@google.com>
2022-03-25 11:19:20 +08:00
Stephane Lee
620e6038e2
Fix off-mode (charger) sepolicy for the health interface am: 84a06151a3
am: c35357078d
...
Original change: https://android-review.googlesource.com/c/device/google/gs101-sepolicy/+/2039624
Change-Id: Ia59f2cdb6b014a802edad3b76f135a69c21002e9
2022-03-24 04:37:58 +00:00
Jack Wu
d43cfef11c
sepolicy: gs101: fix charger_vendor permission denied am: b67138e8ae
am: 28efee70de
...
Original change: https://android-review.googlesource.com/c/device/google/gs101-sepolicy/+/2039623
Change-Id: I1802a01e50797f41a63ba0073f5f032a8d49939b
2022-03-24 04:37:57 +00:00
Stephane Lee
84a06151a3
Fix off-mode (charger) sepolicy for the health interface
...
Bug: 223537397
Test: Ensure that there are no selinux errors for sysfs_batteryinfo in
off-mode charging
Change-Id: I46fa1b7552eb0655d0545538142131465a337f23
Merged-In: I46fa1b7552eb0655d0545538142131465a337f23
2022-03-23 11:30:31 -07:00
Jack Wu
b67138e8ae
sepolicy: gs101: fix charger_vendor permission denied
...
[ 27.025458][ T443] type=1400 audit(1644391560.640:11): avc: denied { search } for comm="android.hardwar" name="vendor" dev="tmpfs" ino=2 scontext=u:r:charger_vendor:s0 tcontext=u:object_r:mnt_vendor_file:s0 tclass=dir permissive=0
[ 26.563658][ T447] type=1400 audit(1644397622.588:5): avc: denied { search } for comm="android.hardwar" name="/" dev="sda1" ino=2 scontext=u:r:charger_vendor:s0 tcontext=u:object_r:persist_file:s0 tclass=dir permissive=0
[ 27.198144][ T442] type=1400 audit(1644398156.152:5): avc: denied { search } for comm="android.hardwar" name="battery" dev="sda1" ino=12 scontext=u:r:charger_vendor:s0 tcontext=u:object_r:persist_battery_file:s0 tclass=dir permissive=0
[ 27.327035][ T443] type=1400 audit(1644398785.276:5): avc: denied { read } for comm="android.hardwar" name="defender_active_time" dev="sda1" ino=17 scontext=u:r:charger_vendor:s0 tcontext=u:object_r:persist_battery_file:s0 tclass=file permissive=0
[ 27.355009][ T443] type=1400 audit(1644398785.276:6): avc: denied { write } for comm="android.hardwar" name="defender_charger_time" dev="sda1" ino=16 scontext=u:r:charger_vendor:s0 tcontext=u:object_r:persist_battery_file:s0 tclass=file permissive=0
[ 26.771705][ T444] type=1400 audit(1644379988.804:4): avc: denied { read } for comm="android.hardwar" name="specification_version" dev="sysfs" ino=56257 scontext=u:r:charger_vendor:s0 tcontext=u:object_r:sysfs_scsi_devices_0000:s0 tclass=file permissive=0
[ 27.898684][ T445] type=1400 audit(1644392754.928:8): avc: denied { read } for comm="android.hardwar" name="thermal_zone6" dev="sysfs" ino=15901 scontext=u:r:charger_vendor:s0 tcontext=u:object_r:sysfs_thermal:s0 tclass=lnk_file permissive=0
[ 29.180076][ T447] type=1400 audit(1644397625.200:9): avc: denied { write } for comm="android.hardwar" name="mode" dev="sysfs" ino=15915 scontext=u:r:charger_vendor:s0 tcontext=u:object_r:sysfs_thermal:s0 tclass=file permissive=0
[ 27.043845][ T444] type=1400 audit(1644379988.808:9): avc: denied { search } for comm="android.hardwar" name="thermal" dev="tmpfs" ino=899 scontext=u:r:charger_vendor:s0 tcontext=u:object_r:thermal_link_device:s0 tclass=dir permissive=0
[ 27.064916][ T444] type=1400 audit(1644379988.808:10): avc: denied { read } for comm="android.hardwar" name="u:object_r:vendor_battery_defender_prop:s0" dev="tmpfs" ino=306 scontext=u:r:charger_vendor:s0 tcontext=u:object_r:vendor_battery_defender_prop:s0 tclass=file permissive=0
[ 27.356266][ T444] type=1107 audit(1644404450.376:4): uid=0 auid=4294967295 ses=4294967295 subj=u:r:init:s0 msg='avc: denied { set } for property=vendor.battery.defender.state pid=457 uid=1000 gid=1000 scontext=u:r:charger_vendor:s0 tcontext=u:object_r:vendor_battery_defender_prop:s0 tclass=property_service permissive=0'
Bug: 218485039
Test: manually test, no avc: denied
Signed-off-by: Jack Wu <wjack@google.com>
Change-Id: I091dbbca35fb833e59fdbc234d74b90bfe74014c
Merged-In: I091dbbca35fb833e59fdbc234d74b90bfe74014c
2022-03-23 11:27:45 -07:00
Darren Hsu
186f2306d7
sepolicy: reorder genfs labels for system suspend am: 2018f942a7
am: 83e88065fc
...
Original change: https://android-review.googlesource.com/c/device/google/gs101-sepolicy/+/2026063
Change-Id: I732b1d982c15846e2b9ae1365894b4d0ea0f424f
2022-03-17 03:55:26 +00:00
Darren Hsu
2018f942a7
sepolicy: reorder genfs labels for system suspend
...
Bug: 223683748
Test: check bugreport without relevant avc denials
Change-Id: I66ede69d94bb3cb1a446e1cd5f3250b6f9b7f7e9
Signed-off-by: Darren Hsu <darrenhsu@google.com>
2022-03-15 11:48:39 +08:00
TeYuan Wang
faec59da79
Move libperfmgr thermal rules to pixel-sepolicy am: f7aba10674
am: fe826745b3
...
Original change: https://android-review.googlesource.com/c/device/google/gs101-sepolicy/+/2020535
Change-Id: I919c688388bcd8cc320068f6139432b58b3f0ea4
2022-03-14 06:02:51 +00:00
TeYuan Wang
f7aba10674
Move libperfmgr thermal rules to pixel-sepolicy
...
Bug: 213257759
Bug: 188579571
Test: build
Change-Id: I9893d53055594bfb4e4dba3d68b53f0fe132617d
2022-03-10 21:28:33 +08:00
Michael Eastwood
ada03db5e0
Merge "Update SELinux policy to allow camera HAL to send Perfetto trace packets" am: 82a110ba3b
am: a45d075fd0
...
Original change: https://android-review.googlesource.com/c/device/google/gs101-sepolicy/+/2016899
Change-Id: I2b73c3f4576a4f42f76afbf7b8e75fd3be838107
2022-03-09 18:32:59 +00:00
Michael Eastwood
82a110ba3b
Merge "Update SELinux policy to allow camera HAL to send Perfetto trace packets"
2022-03-09 17:31:28 +00:00
Michael Eastwood
f648f3c989
Update SELinux policy to allow camera HAL to send Perfetto trace packets
...
Example denials:
03-04 04:25:37.524 823 823 I TracingMuxer: type=1400 audit(0.0:31): avc: denied { use } for path=2F6D656D66643A706572666574746F5F73686D656D202864656C6574656429 dev="tmpfs" ino=20229 scontext=u:r:hal_camera_default:s0 tcontext=u:r:tr
aced:s0 tclass=fd permissive=1
03-04 04:25:37.524 823 823 I TracingMuxer: type=1400 audit(0.0:32): avc: denied { read write } for path=2F6D656D66643A706572666574746F5F73686D656D202864656C6574656429 dev="tmpfs" ino=20229 scontext=u:r:hal_camera_default:s0 tcontext
=u:object_r:traced_tmpfs:s0 tclass=file permissive=1
03-04 04:25:37.524 823 823 I TracingMuxer: type=1400 audit(0.0:33): avc: denied { getattr } for path=2F6D656D66643A706572666574746F5F73686D656D202864656C6574656429 dev="tmpfs" ino=20229 scontext=u:r:hal_camera_default:s0 tcontext=u:
object_r:traced_tmpfs:s0 tclass=file permissive=1
03-04 04:25:37.524 823 823 I TracingMuxer: type=1400 audit(0.0:34): avc: denied { map } for path=2F6D656D66643A706572666574746F5F73686D656D202864656C6574656429 dev="tmpfs" ino=20229 scontext=u:r:hal_camera_default:s0 tcontext=u:object_r:traced_tmpfs:s0 tclass=file permissive=1
Bug: 222684359
Test: Build and push new SELinux policy. Verify that trace packets are received by Perfetto.
Change-Id: I0180c6bccf8cb65f444b8fb687ab48422c211bac
2022-03-08 13:54:34 -08:00
Tri Vo
a5ccc7efa8
Merge "Don't audit storageproxyd unlabeled access" am: fbf92e2ada
am: 22f2ffcbee
...
Original change: https://android-review.googlesource.com/c/device/google/gs101-sepolicy/+/2007441
Change-Id: Ie2af054a900f32cbde1352ba9f708e163f76d86c
2022-03-04 18:29:27 +00:00
Tri Vo
22f2ffcbee
Merge "Don't audit storageproxyd unlabeled access" am: fbf92e2ada
...
Original change: https://android-review.googlesource.com/c/device/google/gs101-sepolicy/+/2007441
Change-Id: I7b9186af0cb135241e23504fa9d6f7c3d6718c7c
2022-03-04 18:06:53 +00:00
Tri Vo
fbf92e2ada
Merge "Don't audit storageproxyd unlabeled access"
2022-03-04 17:45:37 +00:00
Midas Chien
0e1e0e2830
[Do Not Merge] Allow composer to read panel_idle_handle_exit sysfs node
...
Change panel_idle_exit_handle selinux type to sysfs_display to allow
composer to access it.
Bug: 202182467
Test: ls -Z to check selinux type
Test: composer can access it in enforce mode
Merged-In: I5ca811f9500dc452fe6832dd772376da51f675a8
Change-Id: I5ca811f9500dc452fe6832dd772376da51f675a8
2022-03-04 10:48:08 +00:00
Tri Vo
03fef48542
Don't audit storageproxyd unlabeled access
...
Test: m sepolicy
Bug: 197502330
Change-Id: I794dac85e475434aaf024027c43c98dde60bee27
2022-03-03 13:12:17 -08:00
Aaron Tsai
84bacff9ab
Fix selinux error for system_app am: 05565c1f14
am: d2d83c8e2d
...
Original change: https://android-review.googlesource.com/c/device/google/gs101-sepolicy/+/1992670
Change-Id: Ibdbeeee937e4c856adfebad71a956a343b820dfa
2022-02-22 01:56:28 +00:00
Aaron Tsai
d2d83c8e2d
Fix selinux error for system_app am: 05565c1f14
...
Original change: https://android-review.googlesource.com/c/device/google/gs101-sepolicy/+/1992670
Change-Id: Ia3c6c0aae82c19a5d1c019cce2700c5e64c8bb11
2022-02-22 01:35:41 +00:00
Aaron Tsai
05565c1f14
Fix selinux error for system_app
...
01-26 05:04:53.364 440 440 I auditd : avc: denied { find } for interface=vendor.samsung_slsi.telephony.hardware.radioExternal::IOemSlsiRadioExternal sid=u:r:system_app:s0 pid=3063 scontext=u:r:system_app:s0 tcontext=u:object_r:hal_exynos_rild_hwservice:s0 tclass=hwservice_manager permissive=0
Bug: 216531913
Test: verified with the forrest ROM and error log gone
Change-Id: I73d45f3cf1fe0bd918bb4856ce554e81702e4ff9
Merged-In: I73d45f3cf1fe0bd918bb4856ce554e81702e4ff9
2022-02-21 12:16:45 +08:00
Junkyu Kang
86d20c2552
Add persist.vendor.gps to sepolicy am: 9244051b35
am: a5b052c132
...
Original change: https://android-review.googlesource.com/c/device/google/gs101-sepolicy/+/1989989
Change-Id: I0844fbc02141fc6efa77d0cd47d00fd56a15f3e2
2022-02-18 07:12:19 +00:00
Junkyu Kang
a5b052c132
Add persist.vendor.gps to sepolicy am: 9244051b35
...
Original change: https://android-review.googlesource.com/c/device/google/gs101-sepolicy/+/1989989
Change-Id: Ibb1a3b4cca8fa3549eeef548d0939829413e8af1
2022-02-18 06:50:19 +00:00
Junkyu Kang
9244051b35
Add persist.vendor.gps to sepolicy
...
Bug: 196002632
Test: PixelLogger can modify persist.vendor.gps.*
Change-Id: I3fdaf564eacec340003eed0b5845a2c08922362c
Merged-In: I3fdaf564eacec340003eed0b5845a2c08922362c
2022-02-17 08:55:49 +00:00
Xin Li
81caef24ad
Merge sc-v2-dev-plus-aosp-without-vendor@8084891
...
Bug: 214455710
Merged-In: Icecca9f69ee9b57d43aa2864864951bf66c4905f
Change-Id: Ibf8d551c16f8f941cfc8072a29ef5c57e8bef170
2022-02-11 07:12:06 +00:00
TeYuan Wang
9ad50b3952
move vendor_thermal_prop rules to pixel-sepolicy am: c292dd65ba
am: aeebc898cb
am: 912673f8ce
...
Original change: https://android-review.googlesource.com/c/device/google/gs101-sepolicy/+/1960120
Change-Id: Iaf7721a2b7a2f4def1a302c71d6f293b371b7661
2022-02-08 11:51:56 +00:00
TeYuan Wang
912673f8ce
move vendor_thermal_prop rules to pixel-sepolicy am: c292dd65ba
am: aeebc898cb
...
Original change: https://android-review.googlesource.com/c/device/google/gs101-sepolicy/+/1960120
Change-Id: Ib49a0a78843456c9b170dd968259e9e1d51e6317
2022-02-08 11:40:52 +00:00
TeYuan Wang
c292dd65ba
move vendor_thermal_prop rules to pixel-sepolicy
...
Bug: 213257759
Test: no denied log after "setprop persist.vendor.disable.thermal.control 1"
Change-Id: Ic150959bc6084034d9afcc70bf446692fbe22d11
2022-02-08 08:10:32 +00:00
Treehugger Robot
674aa657fb
Merge "genfs_contexts: add paths for unnamed cs40l25a i2c devices" am: 2c1750e537
am: 02e7ad9fb5
am: d70a957518
...
Original change: https://android-review.googlesource.com/c/device/google/gs101-sepolicy/+/1972966
Change-Id: I109245e668ffa38851ced506270ec6d6d1d29fd1
2022-02-08 01:49:40 +00:00
Treehugger Robot
d70a957518
Merge "genfs_contexts: add paths for unnamed cs40l25a i2c devices" am: 2c1750e537
am: 02e7ad9fb5
...
Original change: https://android-review.googlesource.com/c/device/google/gs101-sepolicy/+/1972966
Change-Id: I1da16035bcc4af82e8c671398b76daf7cc8efd28
2022-02-08 01:26:58 +00:00
Treehugger Robot
2c1750e537
Merge "genfs_contexts: add paths for unnamed cs40l25a i2c devices"
2022-02-08 00:53:08 +00:00
Will McVicker
5a88ee6af1
genfs_contexts: add paths for unnamed cs40l25a i2c devices
...
In the 5.10 kernel, the i2c paths are named using an out-of-tree patch
[1]. For kernels that don't support that, let's add the unnamed sysfs
paths as well to the selinux policy.
[1] https://android-review.googlesource.com/c/kernel/common/+/1646148
Bug: 217774013
Change-Id: I3a1f279270d22bf82144ce60a08c215308764be3
2022-02-04 11:54:06 -08:00
Marco Nelissen
a9004241c2
Allow logd to read the Trusty log am: 7df1fa1574
am: 983f5f2d96
am: 6072583f8a
...
Original change: https://android-review.googlesource.com/c/device/google/gs101-sepolicy/+/1971381
Change-Id: I599f4256ea82b4917eceafeced56aef1214de588
2022-02-04 02:15:43 +00:00
Marco Nelissen
6072583f8a
Allow logd to read the Trusty log am: 7df1fa1574
am: 983f5f2d96
...
Original change: https://android-review.googlesource.com/c/device/google/gs101-sepolicy/+/1971381
Change-Id: I3ef810bd7a3ecddf60a0b13f1262abce14a5ece1
2022-02-04 01:59:53 +00:00
Marco Nelissen
7df1fa1574
Allow logd to read the Trusty log
...
Bug: 190050919
Test: build
Change-Id: I8a42cd90b1581272f4dafc37d6eb29a98e1fa2e3
2022-02-03 10:37:13 -08:00
Treehugger Robot
35d7efaf11
Merge "Allow storageproxyd to create directories in its data location" am: 423a9a467b
am: 0e4789159c
am: 26f020fc70
...
Original change: https://android-review.googlesource.com/c/device/google/gs101-sepolicy/+/1960462
Change-Id: I91b0e8f0033c4736516f9341a5b6166f14f7894f
2022-01-26 21:26:26 +00:00
Treehugger Robot
26f020fc70
Merge "Allow storageproxyd to create directories in its data location" am: 423a9a467b
am: 0e4789159c
...
Original change: https://android-review.googlesource.com/c/device/google/gs101-sepolicy/+/1960462
Change-Id: Ie20d1e1d6037a42acba87ab92007657f4f6be83d
2022-01-26 21:07:28 +00:00
Treehugger Robot
423a9a467b
Merge "Allow storageproxyd to create directories in its data location"
2022-01-26 20:29:27 +00:00
Stephen Crane
45850f812e
Allow storageproxyd to create directories in its data location
...
storageproxyd already has rw_dir_perms for tee_data_file from
vendor/tee.te in platform. We need create_dir_perms to make the
"alternate/" directory for handling DSU correctly.
Test: m dist, flash, and test DSU
Bug: 203719297
Change-Id: Ifcc3e5f82b68a506ff99469d2f3df6ab1440b42a
2022-01-25 17:54:22 -08:00
TeYuan Wang
e925f85169
Move thermal netlink socket sepolicy rules to pixel sepolicy am: 66f1d74123
am: 8cb5857dac
am: 0fe33df6c0
...
Original change: https://android-review.googlesource.com/c/device/google/gs101-sepolicy/+/1958926
Change-Id: I86642d387feb6f99939ffb52341e26ba4faef082
2022-01-25 12:05:36 +00:00
TeYuan Wang
0fe33df6c0
Move thermal netlink socket sepolicy rules to pixel sepolicy am: 66f1d74123
am: 8cb5857dac
...
Original change: https://android-review.googlesource.com/c/device/google/gs101-sepolicy/+/1958926
Change-Id: I08f70c5940c8d7f8d40fb97791b762a935ac5dfa
2022-01-25 11:47:21 +00:00
TeYuan Wang
66f1d74123
Move thermal netlink socket sepolicy rules to pixel sepolicy
...
Bug: 213257759
Test: verified genlink function with emul_temp under enforcing mode
Change-Id: I8f5518e5f866ed0813be1e6630c6a9aefaf06e63
2022-01-25 11:59:06 +08:00
Treehugger Robot
b0ecddbd4e
Merge "Allow TEE storageproxyd permissions needed for DSU handling" am: 05ca30173e
am: 3cde81c794
am: 5dd5b0dd29
...
Original change: https://android-review.googlesource.com/c/device/google/gs101-sepolicy/+/1923363
Change-Id: I0190a5a7017d8cfa34932ecdbe9c85587408af85
2022-01-21 22:47:37 +00:00
TeYuan Wang
5c9ca15d60
Label TMU as sysfs_thermal am: 32458cdc49
am: a76533f48b
am: 27eae23a3f
...
Original change: https://android-review.googlesource.com/c/device/google/gs101-sepolicy/+/1937119
Change-Id: I78fdf05253972c617a124165a6d880083e7c0310
2022-01-21 22:47:28 +00:00
Yabin Cui
b48e33f29f
Merge "Add SOC specific ETM sysfs paths" am: 9ee70a3d7f
am: 1a59c0625f
am: c581535e5c
...
Original change: https://android-review.googlesource.com/c/device/google/gs101-sepolicy/+/1943866
Change-Id: I391bab4a982ec03d1904d59aa2376a3d3c816c40
2022-01-21 22:47:19 +00:00
Jasmine Cha
0bfc811257
audio: add sepolicy for getting thermal event am: 2abecb1519
am: 54e84e9978
am: d57668f3cc
...
Original change: https://android-review.googlesource.com/c/device/google/gs101-sepolicy/+/1944690
Change-Id: Idb58719a8511be2f750c8e4a11421d147801b57c
2022-01-21 22:47:00 +00:00
David Anderson
9e40c2e027
Fix sepolicy denial in update_engine. am: 2fe229352b
am: e999b85d07
am: b7b8477e12
...
Original change: https://android-review.googlesource.com/c/device/google/gs101-sepolicy/+/1934897
Change-Id: I8f97a3527ec13132ddbba7a0981619f55e0e0f9d
2022-01-21 22:46:11 +00:00
Treehugger Robot
5dd5b0dd29
Merge "Allow TEE storageproxyd permissions needed for DSU handling" am: 05ca30173e
am: 3cde81c794
...
Original change: https://android-review.googlesource.com/c/device/google/gs101-sepolicy/+/1923363
Change-Id: I5e75aabf2f88f5611f8c4406d7bb81de77d3800f
2022-01-21 22:30:24 +00:00
TeYuan Wang
27eae23a3f
Label TMU as sysfs_thermal am: 32458cdc49
am: a76533f48b
...
Original change: https://android-review.googlesource.com/c/device/google/gs101-sepolicy/+/1937119
Change-Id: Ica3d0e3c016616052f18b880cd22e9da8ca1515e
2022-01-21 22:30:16 +00:00
Yabin Cui
c581535e5c
Merge "Add SOC specific ETM sysfs paths" am: 9ee70a3d7f
am: 1a59c0625f
...
Original change: https://android-review.googlesource.com/c/device/google/gs101-sepolicy/+/1943866
Change-Id: If31d085e00b660262575ab11decb61b372597ceb
2022-01-21 22:29:59 +00:00