Evolution-X-Tensor/device_google_gs101
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
283 commits 1 branch 0 tags 494 MiB
Commit graph

48 commits

Author SHA1 Message Date
Eddie Tashjian
5bbdd82a4e Merge "Add TCP dump permissions." into sc-dev 2021-04-08 18:25:30 +00:00
Craig Dooley
cd888e847f Merge "Fix SELinux errors with aocd" into sc-dev 2021-04-08 17:27:56 +00:00
Craig Dooley
3d4d9159c9 Fix SELinux errors with aocd 
Add inotify support for /dev
Fix the aoc vendor property

Bug: 184173298
Change-Id: I40a71edd56b2d51f848085c43ae1d10a4c2c0c4b
 2021-04-08 03:59:23 +00:00
Eddie Tashjian
b2fb9cdace Add TCP dump permissions. 
Copy selinux policy for tcp dump binary from previous Pixel to support
TCP logging on P21 through PixelLogger.

Bug: 184777243
Test: Check PixelLogger TCP dump works.
Change-Id: Id958c8a3e6375a7aae569d6fc94deb9f8072b57b
 2021-04-08 03:13:55 +00:00
Adam Shih
a346a7fa34 remove wildcard on kernel modules 
Bug: 170786122
Test: Boot with all kernal modules loaded
Change-Id: I0d1d861af290181231223630497788c051c83ecb
 2021-04-07 14:10:00 +08:00
Cheng Gu
72011a8a87 gs101-sepolicy: Allow rlsservice to access range sensor 
Fix: 184295618
Test: rlsservice_test
Change-Id: Iee4cc5376e0eb67e75ae94cd15b5211a7ec819ef
 2021-04-02 22:27:48 +00:00
Krzysztof Kosiński
8a1f0bed01 Mark libGralloc4Wrapper.so as same-process HAL. 
Updating the library name after upgrade to gralloc version 4.

Bug: 178656396
Test: GCA on oriole
Change-Id: I638b3cd0d7f4759f89a62a1d102cc98d9a3db622
 2021-04-01 22:21:44 -07:00
Charlie Chen
5602dfde45 SELinux error coming from mediacodec when using GCA and secure playback 
Fixes the following denials:

avc: denied { read } for name="name" dev="sysfs" ino=63727 \
scontext=u:r:mediacodec:s0 tcontext=u:object_r:sysfs:s0 tclass=file \
permissive=0

avc: denied { read } for name="name" dev="sysfs" ino=63743 \
scontext=u:r:mediacodec:s0 tcontext=u:object_r:sysfs:s0 tclass=file \
permissive=0

avc: denied { read } for name="name" dev="sysfs" ino=64010 \
scontext=u:r:mediacodec:s0 tcontext=u:object_r:sysfs:s0 tclass=file \
permissive=0

avc: denied { search } for name="video6" dev="sysfs" ino=64587 \
scontext=u:r:mediacodec:s0 tcontext=u:object_r:sysfs_video:s0 \
tclass=dir permissive=0

Bug: 182525521
Bug: 184145552
Test: GCA recording works properly, \
      Netflix and ExoPlayer can play videos
Change-Id: Ib7220feedc5031fb0e5c05a2b487da2ddf8b98cd
 2021-04-01 02:53:24 +00:00
Ilya Matyukhin
52a4f701c1 Merge "Add sepolicy for Goodix AIDL HAL" into sc-dev 2021-03-31 21:57:29 +00:00
Zhijun He
a7d3992396 Merge "Revert "Allow Exoplayer access to the vstream-secure heap for secure playback"" into sc-dev 2021-03-31 15:38:31 +00:00
Charlie Chen
ac3d49d41d Revert "Allow Exoplayer access to the vstream-secure heap for secure playback" 
This reverts commit 7c92613185.

Reason for revert: This commit breaks camera recording

Bug: 184154831
Change-Id: Ia4286dab9c5d44c59a3b224e0e24c191eb2be84b
 2021-03-31 15:37:48 +00:00
Yu-Chi Cheng
53982a4372 Merge "Labelled EdgeTPU service libraries as SP-HAL." into sc-dev 2021-03-31 14:24:54 +00:00
Charlie Chen
7c92613185 Allow Exoplayer access to the vstream-secure heap for secure playback 
Fixes the following denials:

avc: denied { read } for name="name" dev="sysfs" ino=63727 \
scontext=u:r:mediacodec:s0 tcontext=u:object_r:sysfs:s0 tclass=file \
permissive=0

avc: denied { read } for name="name" dev="sysfs" ino=63743 \
scontext=u:r:mediacodec:s0 tcontext=u:object_r:sysfs:s0 tclass=file \
permissive=0

avc: denied { read } for name="name" dev="sysfs" ino=64010 \
scontext=u:r:mediacodec:s0 tcontext=u:object_r:sysfs:s0 tclass=file \
permissive=0

Bug: 182525521
Test: no more denials and able to play video via ExoPlayer App
Change-Id: I21033bc78858fd407c16d2cd2df4549f97273221
 2021-03-31 05:41:26 +00:00
Erik Cheng
90ed4cc72e Merge "Grant permission for more camera device nodes" into sc-dev 2021-03-31 03:09:15 +00:00
Ankit Goyal
b07d84f087 Fix SELinux denials for arm.graphics AIDL interface 
Denial example:
03-30 05:44:44.468   490   490 W RenderEngine: type=1400 audit(0.0:4): avc: denied { read } for name="arm.graphics-V1-ndk_platform.so" dev="dm-9" ino=1923 scontext=u:r:surfaceflinger:s0 tcontext=u:object_r:vendor_file:s0 tclass=file permissive=0

Bug: 143246001
Test: Build and boot to home
Change-Id: Id7c2bd98aa634f852a21812fb2421a2e96ef7636
 2021-03-30 22:22:22 +08:00
Erik Cheng
5f6e263527 Grant permission for more camera device nodes 
Bug: 184004655
Test: aosp camera
Change-Id: I52fdb3f7f3d37537461c94b139e72add1a300bb2
 2021-03-30 17:34:38 +08:00
Yu-Chi Cheng
93bf9b613b Labelled EdgeTPU service libraries as SP-HAL. 
The EdgeTPU service libraries (libedgetpu_client.google.so and
com.google.edgetpu-V1-ndk.so) provide both the system_ext and
vendor variants.  Since these need to be linked by pre-built
applications from /product/, this change labelled them as
the same_process_hal_file in order to allow the applications
to link with the vendor variant.

Bug: 184008444
Test: tested on local Oriole with GCA.
Change-Id: I8c510f51ccc1a76d14978962d72fd91f15bf7a90
 2021-03-29 23:22:33 -07:00
Oleg Matcovschi
6862b8e239 vendor: remove sscoredump policies 
Bug: 180760068
Signed-off-by: Oleg Matcovschi <omatcovschi@google.com>
Change-Id: Ib8d360b227286bdea7de00125ef2ed6ad7978e67
 2021-03-28 21:26:34 -07:00
Krzysztof Kosiński
74bc4bf947 Merge "Mark libGrallocWrapper.so as same-process HAL." into sc-dev 2021-03-25 16:34:28 +00:00
Steven Liu
acf218cb51 Merge "Add sepolicy for the wifi firmware config OTA feature" into sc-dev 2021-03-25 14:40:18 +00:00
Ilya Matyukhin
3233492f78 Add sepolicy for Goodix AIDL HAL 
Bug: 183054007
Test: adb logcat | grep "avc: denied"
Change-Id: Iea9a652dbc78c488a72600b4226140ccf123b004
 2021-03-24 21:00:41 -07:00
Krzysztof Kosiński
1314a15cb9 Merge "Revert "Add lazy service binary to hal_camera_default domain."" into sc-dev 2021-03-24 20:57:35 +00:00
Krzysztof Kosiński
9818e25500 Revert "Add lazy service binary to hal_camera_default domain." 
This reverts commit d02e73b966.

Reason for revert: This HAL is actually not intended to be present
on GS101 devices. The denial logs come from people who did "adb sync"
after building binaries that are not included in the device image.
SELinux should not allow access to this HAL.

Change-Id: Id179023eeb79d749a0bde13e1d83af41fc42780e
 2021-03-24 15:59:55 +00:00
Steven Liu
c6eca53b9e Add sepolicy for the wifi firmware config OTA feature 
Bug: 177083009
Test: the OTA updated files can be updated and applied.
Change-Id: I2f269dbc146aae41cab57abd568af7e26fd23876
 2021-03-24 06:59:08 -07:00
Krzysztof Kosiński
7e469b9941 Mark libGrallocWrapper.so as same-process HAL. 
This library is indirectly loaded by lib_aion_buffer.so, which
is an ABI-stable wrapper for some vendor-specific APIs used by
GCA (the Pixel camera app)

Bug: 182962346
Test: ran GCA on oriole
Change-Id: Ida5171110081cac0ac13ea769f9d434499faebe6
 2021-03-24 06:42:05 -07:00
TreeHugger Robot
40df476219 Merge "Add the sepolicy for UWB hal" into sc-dev 2021-03-24 02:13:43 +00:00
Hridya Valsaraju
fb862c0888 Allow Exoplayer access to the vstream-secure heap for secure playback 
Fixes the following denials:

avc: denied { read } for name="vstream-secure" dev="tmpfs"
ino=736 scontext=u:r:untrusted_app_25:s0:c512,c768
tcontext=u:object_r:dmabuf_heap_device:s0 tclass=chr_file permissive=0
app=com.google.android.exoplayer.demo
avc: denied { read } for name="vstream-secure" dev="tmpfs" ino=736
scontext=u:r:untrusted_app_25:s0:c512,c768
tcontext=u:object_r:dmabuf_heap_device:s0
tclass=chr_file permissive=0 app=com.google.android.exoplayer.demo
avc: denied { read } for name="vstream-secure" dev="tmpfs" ino=736
scontext=u:r:untrusted_app_25:s0:c512,c768
tcontext=u:object_r:dmabuf_heap_device:s0
tclass=chr_file permissive=0 app=com.google.android.exoplayer.demo

Bug: 178865267
Test: no more denials
Change-Id: I6612bd56c49558b13e2ae72cfbf3552715729e7a
Signed-off-by: Hridya Valsaraju <hridya@google.com>
 2021-03-23 14:37:01 -07:00
Krzysztof Kosiński
61e515e4ce Merge "Add lazy service binary to hal_camera_default domain." into sc-dev 2021-03-23 01:31:50 +00:00
Krzysztof Kosiński
d02e73b966 Add lazy service binary to hal_camera_default domain. 
Avoids denial logs from init on service (re)start. See bug for
details.

Bug: 183441948
Test: Restarted the service
Change-Id: I9ee9b8099d2ffae4d6a115552800fa844c192132
 2021-03-22 16:25:57 -07:00
David Li
6dce033807 Merge "audio: add /dev/acd-audio_dcdoff_ref for audio effect visualizer" into sc-dev 2021-03-22 02:07:33 +00:00
Alex Hong
b640326154 Add the sepolicy for UWB hal 
Bug: 182727934
Test: $ make selinux_policy
      Push SELinux modules and check the denials during boot
Change-Id: I630e6e353897a85d1b90c7d8a4250703a4c3a245
 2021-03-19 21:42:07 +08:00
TreeHugger Robot
9a865e84c7 Merge "Allow fingerprint hal to access fingerprint device" into sc-dev 2021-03-19 02:19:59 +00:00
David Li
fa11af6a07 audio: add /dev/acd-audio_dcdoff_ref for audio effect visualizer 
Set /dev/acd-audio_dcdoff_ref as u:object_r:aoc_device:s0
crw-rw---- 1 system audio u:object_r:aoc_device:s0  500,  29 2021-03-18 22:19 /dev/acd-audio_dcdoff_ref

Bug: 180984363
Bug: 165719427
Test: make -j128
Test: ls -alZ /dev/acd-audio_dcdoff_ref
Change-Id: If7cd3ef99885730287648afebb222d4f925d325e
 2021-03-19 10:10:49 +08:00
Kris Chen
10fda56cd1 Allow fingerprint hal to access fingerprint device 
Fixes the following avc denials:
03-18 10:57:10.612   947   947 I android.hardwar: type=1400 audit(0.0:8): avc: denied { open } for path="/dev/goodix_fp" dev="tmpfs" ino=482 scontext=u:r:hal_fingerprint_default:s0 tcontext=u:object_r:device:s0 tclass=chr_file permissive=1
03-18 10:57:10.632   947   947 I android.hardwar: type=1400 audit(0.0:9): avc: denied { ioctl } for path="/dev/goodix_fp" dev="tmpfs" ino=482 ioctlcmd=0x6707 scontext=u:r:hal_fingerprint_default:s0 tcontext=u:object_r:device:s0 tclass=chr_file permissive=1
03-18 10:57:13.672   947   947 I android.hardwar: type=1400 audit(0.0:14): avc: denied { ioctl } for path="/dev/goodix_fp" dev="tmpfs" ino=482 ioctlcmd=0x6706 scontext=u:r:hal_fingerprint_default:s0 tcontext=u:object_r:device:s0 tclass=chr_file permissive=1
03-18 10:57:32.704   947   947 I HwBinder:947_1: type=1400 audit(0.0:26): avc: denied { ioctl } for path="/dev/goodix_fp" dev="tmpfs" ino=482 ioctlcmd=0x6705 scontext=u:r:hal_fingerprint_default:s0 tcontext=u:object_r:device:s0 tclass=chr_file permissive=1

Bug: 171943101
Test: No above avc denials in logcat.
Change-Id: I254a01a2c11fcaba9ad3f387862a8d0ddafffd38
 2021-03-18 19:23:54 +08:00
iayara
adeaaead76 Add "libedgetpu_darwinn2.so" library duplicate to be used for external 
launch.

This change is intended to keep naming consistency with previous
Darwinn external launch. In the future, all "libedgetpu_darwinn2.so"
instances should be replaced by "libedgetpu_util.so".

Bug: 182303547
Change-Id: I99e83f5f2e317b195b2061c781cb23544e547c55
 2021-03-17 23:47:07 +00:00
Wen Chang Liu
e72c30346f Merge changes Ie0ed96d7,Id7f43fe1 into sc-dev 
* changes:
  Add sepolicy for BigOcean device
  Add sepolicy for MFC device
 2021-03-12 05:41:08 +00:00
Sung-fang Tsai
1bcf7d412a Merge "Mark lib_aion_buffer and related library as same_process_hal_file" into sc-dev 2021-03-12 04:18:59 +00:00
wenchangliu
f98706e87b Add sepolicy for BigOcean device 
add /dev/bigocean to video_device

avc: denied { read write } for name="bigocean" dev="tmpfs" ino=629 \
scontext=u:r:mediacodec:s0 tcontext=u:object_r:device:s0 \
tclass=chr_file permissive=1
avc: denied { open } for path="/dev/bigocean" dev="tmpfs" ino=629 \
scontext=u:r:mediacodec:s0 tcontext=u:object_r:device:s0 \
tclass=chr_file permissive=1
avc: denied { ioctl } for path="/dev/bigocean" dev="tmpfs" ino=629 \
ioctlcmd=0x4202 scontext=u:r:mediacodec:s0 tcontext=u:object_r:device:s0 \
tclass=chr_file permissive=1
avc: denied { ioctl } for comm=436F646563322E30204C6F6F706572 path="/dev/bigocean" \
dev="tmpfs" ino=629 ioctlcmd=0x4202 scontext=u:r:mediacodec:s0 \
tcontext=u:object_r:device:s0 tclass=chr_file permissive=1

Bug: 172173484
Test: Play AV1 clips in enforcing mode
Change-Id: Ie0ed96d7bf4324bd38a9c42500f4f747f092bfd9
 2021-03-12 10:54:10 +08:00
wenchangliu
b52121a259 Add sepolicy for MFC device 
- Add sysfs_video type for mfc device
- Allow mediacode to access sysfs_video

avc: denied { read } for name="name" dev="sysfs" ino=62278 \
scontext=u:r:mediacodec:s0 tcontext=u:object_r:sysfs:s0 \
tclass=file permissive=1

avc: denied { open } for path="/sys/devices/platform/mfc/video4linux/video7/name" \
dev="sysfs" ino=62278 scontext=u:r:mediacodec:s0 tcontext=u:object_r:sysfs:s0 \
tclass=file permissive=1

avc: denied { getattr } for path="/sys/devices/platform/mfc/video4linux/video7/name" \
dev="sysfs" ino=62278 scontext=u:r:mediacodec:s0 tcontext=u:object_r:sysfs:s0 \
tclass=file permissive=1

avc: denied { read } for name="name" dev="sysfs" ino=62230 \
scontext=u:r:mediacodec:s0 tcontext=u:object_r:sysfs:s0 \
tclass=file permissive=1

avc: denied { open } for path="/sys/devices/platform/mfc/video4linux/video6/name" \
dev="sysfs" ino=62230 scontext=u:r:mediacodec:s0 tcontext=u:object_r:sysfs:s0 \
tclass=file permissive=1

avc: denied { getattr } for path="/sys/devices/platform/mfc/video4linux/video6/name" \
dev="sysfs" ino=62230 scontext=u:r:mediacodec:s0 tcontext=u:object_r:sysfs:s0 \
tclass=file permissive=1

Bug: 172173484
Test: video playback / camera recording with enforcing mode
Change-Id: Id7f43fe11c9ed089067f43a50d7f765df873d6c6
 2021-03-12 10:51:41 +08:00
Pat Tjin
854db479bb Merge "Move wireless charger HAL to 1.3" into sc-dev 2021-03-11 19:57:54 +00:00
Sung-fang Tsai
82376e2d49 Mark lib_aion_buffer and related library as same_process_hal_file 
To allow access by Google Camera App, which needs this for vendor-specific
buffer management functionality to enable zero-copy camera RAW->GPU buffer
handling.

Test: GCA works with forrest build P20546991.
Bug: 159839616
Change-Id: I71bdcd12f17013881d7a5da2f11e444f0d3b4f94
 2021-03-11 12:02:04 +00:00
TreeHugger Robot
ef6e91692a Merge changes I68aace66,Idf510e4a into sc-dev 
* changes:
  gs101-sepolicy: Add twoshay permissions
  Add touch procfs and sysfs sepolicy
 2021-03-11 09:16:51 +00:00
yihsiangpeng
cc8429cc0d Move wireless charger HAL to 1.3 
Bug: 179464598
Signed-off-by: yihsiangpeng <yihsiangpeng@google.com>
Change-Id: I73d1d811f2483bbe80e7d4aea1f6e9f143bc2836
 2021-03-11 14:47:49 +08:00
Tai Kuo
8cac55487b gs101-sepolicy: Add twoshay permissions 
Add twoshay and touch input context library permissions

Bug: 173330899
Bug: 173330981
Test: check boot-time twoshay startup and no denials.
Signed-off-by: Steve Pfetsch <spfetsch@google.com>
Change-Id: I68aace66f49c2af1ebfd4bde7082039f9caf3f64
Signed-off-by: Tai Kuo <taikuo@google.com>
 2021-03-10 22:23:49 +08:00
Adam Shih
58b3344c7a label kernel modules and grant bt permission 
Bug: 182320300
Bug: 182320258
Test: boot to home and connect to bluetooth headset under enforcing mode
Change-Id: I6f6e8359d03eb4205268d56a1fcd50ce1445f442
 2021-03-10 10:36:45 +08:00
Taehwan Kim
7d77820127 Add missing permission to dmabuf_video_system_heap 
Bug: 153786620
Bug: 182086551
Bug: 182086552
Bug: 182086686
Bug: 182086482
Bug: 182086481
Bug: 182086550
Test: atest VtsHalMediaC2V1_0TargetVideoDecTest
Signed-off-by: Taehwan Kim <t_h.kim@samsung.com>
Change-Id: I2bc6057d16bbcc32ef8891f89c0440618d174982
 2021-03-09 02:19:06 +00:00
SalmaxChang
4d87bc0f2a cbd: Fix avc errors 
avc: denied { write } for comm="cbd" name="ssrdump" dev="dm-9" ino=284 scontext=u:r:cbd:s0 tcontext=u:object_r:sscoredump_vendor_data_crashinfo_file:s0 tclass=dir
avc: denied { add_name } for comm="cbd" name="crashinfo_modem_2021-03-02_10-57-06.txt" scontext=u:r:cbd:s0 tcontext=u:object_r:sscoredump_vendor_data_crashinfo_file:s0 tclass=dir
avc: denied { write } for comm="sh" name="image" dev="dm-9" ino=231 scontext=u:r:cbd:s0 tcontext=u:object_r:radio_vendor_data_file:s0 tclass=dir
avc: denied { read } for comm="cbd" name="u:object_r:radio_prop:s0" dev="tmpfs" ino=206 scontext=u:r:cbd:s0 tcontext=u:object_r:radio_prop:s0 tclass=file
avc: denied { search } for comm="cbd" name="/" dev="sda15" ino=2 scontext=u:r:cbd:s0 tcontext=u:object_r:persist_file:s0 tclass=dir
avc: denied { syslog_read } for comm="cbd" scontext=u:r:cbd:s0 tcontext=u:r:kernel:s0 tclass=system

Bug: 179198083
Bug: 178331928
Bug: 171267363
Change-Id: I8a89e360e6d614ad76ed2eb78467fcbedf1ea0ce
 2021-03-08 06:00:45 +00:00
Robin Peng
5009efa776 Move slider-sepolicy into gs101-sepolicy 
from: 71e609c24c97fc8d44843af30527cbeb90d5dcdf

Bug: 167996145
Change-Id: Ie00e7e0983a3ca695bbd5140c929d07a80144301
 2021-03-06 16:15:39 +08:00