Evolution-X-Tensor/device_google_gs101
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
4550 commits 1 branch 0 tags 494 MiB
Commit graph

4550 commits

This branch
This branch
All branches
Author SHA1 Message Date
Yu-Chi Cheng
755a1de452 Allowed EdgeTPU service and the EdgeTPU NNAPI hal to read /proc/version. 
Both services invoke InitGoogle in order to use google utilities (e.g.
file).  Since InitGoogle reads the kernel info from /proc/version,
this change added the corresponding selinux rules to allow that.

Bug: 183935416
Test: tested on Oriole.
Change-Id: Icb8f3a57e249774b5fad3284413661b04ff7dae6
 2021-03-30 10:07:43 -07:00
TreeHugger Robot
948fc1d359 Merge "vendor_init: allow set_prop for vendor_ro_config_default_prop" into sc-dev am: fd3d8c0467 
Original change: https://googleplex-android-review.googlesource.com/c/device/google/gs101-sepolicy/+/14025026

Change-Id: Ic26319bc3be5f80b249825f7b1f3abc0e04f63fe
 2021-03-30 17:00:17 +00:00
Ankit Goyal
4097aa96ab Merge "Fix SELinux denials for arm.graphics AIDL interface" into sc-dev 2021-03-30 16:27:55 +00:00
TreeHugger Robot
fd3d8c0467 Merge "vendor_init: allow set_prop for vendor_ro_config_default_prop" into sc-dev 2021-03-30 16:06:04 +00:00
Oleg Matcovschi
de30c53177 gs101-sepolicy: add sscoredump 
Bug: 183995288
Change-Id: I5363d0c45c183d809c03fe755835c1fc95a33159
 2021-03-30 15:31:10 +00:00
Ankit Goyal
b07d84f087 Fix SELinux denials for arm.graphics AIDL interface 
Denial example:
03-30 05:44:44.468   490   490 W RenderEngine: type=1400 audit(0.0:4): avc: denied { read } for name="arm.graphics-V1-ndk_platform.so" dev="dm-9" ino=1923 scontext=u:r:surfaceflinger:s0 tcontext=u:object_r:vendor_file:s0 tclass=file permissive=0

Bug: 143246001
Test: Build and boot to home
Change-Id: Id7c2bd98aa634f852a21812fb2421a2e96ef7636
 2021-03-30 22:22:22 +08:00
Erik Cheng
5f6e263527 Grant permission for more camera device nodes 
Bug: 184004655
Test: aosp camera
Change-Id: I52fdb3f7f3d37537461c94b139e72add1a300bb2
 2021-03-30 17:34:38 +08:00
Yu-Chi Cheng
93bf9b613b Labelled EdgeTPU service libraries as SP-HAL. 
The EdgeTPU service libraries (libedgetpu_client.google.so and
com.google.edgetpu-V1-ndk.so) provide both the system_ext and
vendor variants.  Since these need to be linked by pre-built
applications from /product/, this change labelled them as
the same_process_hal_file in order to allow the applications
to link with the vendor variant.

Bug: 184008444
Test: tested on local Oriole with GCA.
Change-Id: I8c510f51ccc1a76d14978962d72fd91f15bf7a90
 2021-03-29 23:22:33 -07:00
Krzysztof Kosiński
946ea5bebc Improve camera HAL SELinux policy. am: dffdeca76d 
Original change: https://googleplex-android-review.googlesource.com/c/device/google/gs101-sepolicy/+/13986903

Change-Id: Id5e9c98002a9be4293a1e5a381864c35abf3fc2f
 2021-03-30 05:36:52 +00:00
Krzysztof Kosiński
dffdeca76d Improve camera HAL SELinux policy. 
- Grant access to DMA system heap for Tuscany.
- Reorder statements for more logical grouping.
- Allow access to isolated tmpfs for google3 prebuilts.
- Remove fixed denials.

Bug: 181913550
Bug: 182705901
Test: Inspected logcat, no denials from hal_camera_default
Change-Id: I9bf1ce207c3bcae1b9f9ab0f0072bb7501201451
 2021-03-29 20:42:50 -07:00
Aaron Tsai
181f1d3cd0 vendor_init: allow set_prop for vendor_ro_config_default_prop 
03-29 15:18:56.425  root     1     1 E init    : Do not have permissions to set 'ro.vendor.config.build_carrier' to 'europen' in property file '/vendor/build.prop': SELinux permission check failed

Bug: 183919837
Test: verified with the forrest ROM and error log gone
Change-Id: I87cc05306f9c038df779040514a879fc2b8ab929
 2021-03-30 11:38:19 +08:00
John Tsai
d51c2f2533 Merge "Allowed Camera hal to create debug files" into sc-dev am: f06c0a9f38 
Original change: https://googleplex-android-review.googlesource.com/c/device/google/gs101-sepolicy/+/14016760

Change-Id: Ifff513d0434a7c17fd9e079b8a2ade7be4d34541
 2021-03-30 03:24:52 +00:00
John Tsai
f06c0a9f38 Merge "Allowed Camera hal to create debug files" into sc-dev 2021-03-30 02:51:28 +00:00
Oleg Matcovschi
ef2a28f9a9 Merge "vendor_init: allow set_prop for vendor_ssrdump_prop" into sc-dev am: 5a504a1708 
Original change: https://googleplex-android-review.googlesource.com/c/device/google/gs101-sepolicy/+/13999606

Change-Id: I0f61d009637a57ade59a591f31aa15008727ed5a
 2021-03-30 01:13:37 +00:00
Oleg Matcovschi
5a504a1708 Merge "vendor_init: allow set_prop for vendor_ssrdump_prop" into sc-dev 2021-03-30 00:39:12 +00:00
Oleg Matcovschi
a91ba31808 vendor_init: allow set_prop for vendor_ssrdump_prop 
Bug: 183686188
Change-Id: I6a22419909cd85c55bd1c7e500b06f0420d0ec86
Signed-off-by: Oleg Matcovschi <omatcovschi@google.com>
 2021-03-30 00:28:04 +00:00
Oleg Matcovschi
cf08b32308 Merge changes from topic "b180760068" into sc-dev am: 3872f8015f 
Original change: https://googleplex-android-review.googlesource.com/c/device/google/gs101-sepolicy/+/14017040

Change-Id: I9b89eea1dfd61d9789f396232d744d9db5da4ddf
 2021-03-29 22:50:27 +00:00
Oleg Matcovschi
994f5fc31e vendor: remove sscoredump policies am: 6862b8e239 
Original change: https://googleplex-android-review.googlesource.com/c/device/google/gs101-sepolicy/+/14006443

Change-Id: Icd0bba0cb154fc525d261f73c2f2ef24ef24bc79
 2021-03-29 22:50:25 +00:00
Oleg Matcovschi
3872f8015f Merge changes from topic "b180760068" into sc-dev 
* changes:
  genfs_contexts: add sscoredump per-subsystem policies
  vendor: remove sscoredump policies
 2021-03-29 22:05:23 +00:00
Eddie Tashjian
ffd2cf4eb7 Allow radioext to access bluetooth coex hal. 
Allow radio extension hal to forward coexistence message from modem to
bluetooth hal.

Bug: 183978772
Test: Check selinux denials
Change-Id: Idc288ce2a1fdcf380301e2d7c10ea03af520e4d0
 2021-03-29 15:03:40 -07:00
Alex Hong
f8f1b8498c Merge "update error on ROM 7242124" into sc-dev am: 122849026f 
Original change: https://googleplex-android-review.googlesource.com/c/device/google/gs101-sepolicy/+/14018649

Change-Id: Id86ffa0c2c73356efa4412bc4809cffc91d6d4a7
 2021-03-29 17:19:51 +00:00
Oleg Matcovschi
005fafff5b genfs_contexts: add sscoredump per-subsystem policies 
Bug: 180760068
Signed-off-by: Oleg Matcovschi <omatcovschi@google.com>
Change-Id: I448dd8d5ea1e11eb774c62e129eb4c7896a5bd15
 2021-03-29 10:04:57 -07:00
Alex Hong
122849026f Merge "update error on ROM 7242124" into sc-dev 2021-03-29 16:37:47 +00:00
Alex Hong
68569d8fe3 update error on ROM 7242124 
Bug: 183935416
Bug: 183935302
Bug: 183935382
Bug: 183935443
Test: pts-tradefed run pts -m PtsSELinuxTest
Change-Id: Iccdfc8a9eea3e8d52bebc89ca1eafcd2ec26e3c6
 2021-03-29 22:18:39 +08:00
Hsiaoan Hsu
3a4feeb1b9 Fix netutils_wrapper avc denied am: c9f580b083 
Original change: https://googleplex-android-review.googlesource.com/c/device/google/gs101-sepolicy/+/14011940

Change-Id: If6d570e2278ec3a4da2f308e5e2c5e1a780528c0
 2021-03-29 11:30:53 +00:00
JohnCH Tsai
522c283dee Allowed Camera hal to create debug files 
For steadiface and eis, they needs to create debug folders and files
under /data/vendor/camera.

Bug: 183708219
Test: GCA and check debug files
Change-Id: I5b87120702278199ac4f98cfa9114be47c760433
 2021-03-29 15:26:44 +08:00
Hsiaoan Hsu
c9f580b083 Fix netutils_wrapper avc denied 
avc denied log:
03-25 22:30:40.226  root 22962 22962 W iptables-wrappe: type=1400 audit(0.0:2269): avc: denied { read write } for path="/dev/umts_wfc1" dev="tmpfs" ino=748 scontext=u:r:netutils_wrapper:s0 tcontext=u:object_r:pktrouter_device:s0 tclass=chr_file permissive=0

03-25 22:30:40.226  root 22962 22962 W iptables-wrappe: type=1400 audit(0.0:2270): avc: denied { read write } for path="socket:[1017]" dev="sockfs" ino=1017 scontext=u:r:netutils_wrapper:s0 tcontext=u:r:pktrouter:s0 tclass=netlink_route_socket permissive=0

03-25 22:30:40.226  root 22962 22962 W iptables-wrappe: type=1400 audit(0.0:2274): avc: denied { read write } for path="socket:[655847]" dev="sockfs" ino=655847 scontext=u:r:netutils_wrapper:s0 tcontext=u:r:pktrouter:s0 tclass=udp_socket permissive=0

Bug: 183713618
Test: WFC/WFC handover

Change-Id: I363bf009c3b05ac2ceccb5580e786fcebf0f5631
 2021-03-29 05:22:41 +00:00
Oleg Matcovschi
6862b8e239 vendor: remove sscoredump policies 
Bug: 180760068
Signed-off-by: Oleg Matcovschi <omatcovschi@google.com>
Change-Id: Ib8d360b227286bdea7de00125ef2ed6ad7978e67
 2021-03-28 21:26:34 -07:00
TreeHugger Robot
a6b062f1e7 Merge "SELinux: Grant camera HAL TEE access" into sc-dev am: 6d56fb7391 
Original change: https://googleplex-android-review.googlesource.com/c/device/google/gs101-sepolicy/+/13997191

Change-Id: I4aaa68feccc12ff6ee9a335b26558663b5b00e48
 2021-03-26 06:39:36 +00:00
TreeHugger Robot
6d56fb7391 Merge "SELinux: Grant camera HAL TEE access" into sc-dev 2021-03-26 06:21:05 +00:00
Kevin DuBois
25b3b67b30 Merge "hal_neuralnetworks_armnn: allow GPU access" into sc-dev am: 978b3b4e9b 
Original change: https://googleplex-android-review.googlesource.com/c/device/google/gs101-sepolicy/+/13994637

Change-Id: I82f36fd0432c06f3575130f0d183f94e4039a176
 2021-03-25 22:36:09 +00:00
Kevin DuBois
978b3b4e9b Merge "hal_neuralnetworks_armnn: allow GPU access" into sc-dev 2021-03-25 22:01:42 +00:00
Jidong Sun
eda148cd47 SELinux: Grant camera HAL TEE access 
Bug: 183714594
Signed-off-by: Jidong Sun <jidong@google.com>
Change-Id: I84fd3a7cf18bc3b574632b665be86c0fcb505704
 2021-03-25 20:01:12 +00:00
Kevin DuBois
9c8327de8d hal_neuralnetworks_armnn: allow GPU access 
Neuralnetworks for armnn driver needs GPU access in order to issue
OpenCL commands to GPU. Add rule that allows this.

Fixes: 183673130
Test: setenforce 1, stop and start hal, see that hal started.
Change-Id: I9be0ee4326e5e128a37f2c4df0878f8fbbea7f8d
 2021-03-25 11:10:40 -07:00
Krzysztof Kosiński
4650213e1e Merge "Mark libGrallocWrapper.so as same-process HAL." into sc-dev am: 74bc4bf947 
Original change: https://googleplex-android-review.googlesource.com/c/device/google/gs101-sepolicy/+/13986904

Change-Id: I8839372f0a5f181089cb56192f52b51d660f7731
 2021-03-25 17:18:23 +00:00
Krzysztof Kosiński
74bc4bf947 Merge "Mark libGrallocWrapper.so as same-process HAL." into sc-dev 2021-03-25 16:34:28 +00:00
Terry Huang
d426c1dd4f Merge "Fix VT issue avc denied" into sc-dev am: bea1d217b5 
Original change: https://googleplex-android-review.googlesource.com/c/device/google/gs101-sepolicy/+/13992794

Change-Id: I6b8750edc7d4de209133c1a9a10a5fe5e547bd7e
 2021-03-25 16:02:47 +00:00
Terry Huang
bea1d217b5 Merge "Fix VT issue avc denied" into sc-dev 2021-03-25 15:21:53 +00:00
Steven Liu
3dee8cecad Merge "Add sepolicy for the wifi firmware config OTA feature" into sc-dev am: acf218cb51 
Original change: https://googleplex-android-review.googlesource.com/c/device/google/gs101-sepolicy/+/13983837

Change-Id: I00b8c3c91c9373168d80a7fda2268add40375310
 2021-03-25 15:05:44 +00:00
Steven Liu
acf218cb51 Merge "Add sepolicy for the wifi firmware config OTA feature" into sc-dev 2021-03-25 14:40:18 +00:00
terrycrhuang
3316a7135d Fix VT issue avc denied 
03-25 19:59:12.604 E SELinux : avc:  denied  { find } for pid=3822
uid=10264 name=media.camera
scontext=u:r:vendor_ims_app:s0:c8,c257,c512,c768
tcontext=u:object_r:cameraserver_service:s0 tclass=service_manager
permissive=0

03-25 19:59:19.283 E SELinux : avc:  denied  { find } for pid=3822
uid=10264 name=media.player
scontext=u:r:vendor_ims_app:s0:c8,c257,c512,c768
tcontext=u:object_r:mediaserver_service:s0 tclass=service_manager
permissive=0

Bug: 183698793
Test: Manual

Change-Id: I5ccff82df99b6bcb3883b880ef1fbfe8710b2e99
 2021-03-25 21:22:33 +08:00
terrycrhuang
79d2510748 Fix pktrouter avc denied am: dbef5fe678 
Original change: https://googleplex-android-review.googlesource.com/c/device/google/gs101-sepolicy/+/13992789

Change-Id: I42fde09a926575d0c2cff90463e4eeccea436b55
 2021-03-25 10:26:22 +00:00
terrycrhuang
b80a40f7bc Fix vendor.pktrouter avc denied am: 986fe49987 
Original change: https://googleplex-android-review.googlesource.com/c/device/google/gs101-sepolicy/+/13992787

Change-Id: I99535459516df8cfc6289585e0211ccc80fbbbca
 2021-03-25 09:23:59 +00:00
terrycrhuang
dbef5fe678 Fix pktrouter avc denied 
03-25 15:28:05.656 I auditd  : type=1400 audit(0.0:48): avc: denied {
net_raw } for comm="wfc-pkt-router" capability=13
scontext=u:r:pktrouter:s0 tcontext=u:r:pktrouter:s0 tclass=capability
permissive=0

Bug: 183664765
Test: Manual

Change-Id: I378b2c0ed8af9e4ba1accfdcc5380a1f9f066b81
 2021-03-25 15:56:35 +08:00
terrycrhuang
986fe49987 Fix vendor.pktrouter avc denied 
03-24 19:45:17.324 E init : Do not have permissions to set
'vendor.pktrouter' to '1' in property file '/vendor/build.prop': SELinux
permission check failed

Bug: 183664765
Test: Manual

Change-Id: Ibf0f764c905c4797b179dff2cdd1faa98fae5bc0
 2021-03-25 14:36:05 +08:00
TreeHugger Robot
80df40415d Merge "Fix avc denied for vendor_ims_app" into sc-dev am: f112196d64 
Original change: https://googleplex-android-review.googlesource.com/c/device/google/gs101-sepolicy/+/13987992

Change-Id: Id635d595a0551821b794690f990325fcc486db48
 2021-03-25 05:06:18 +00:00
Aaron Tsai
239310d8a6 Fix selinux errors for rild am: d135bde241 
Original change: https://googleplex-android-review.googlesource.com/c/device/google/gs101-sepolicy/+/13975653

Change-Id: I595e55a3db7bb5c5570b7c25f3aa1519b97cb061
 2021-03-25 05:04:39 +00:00
TreeHugger Robot
f112196d64 Merge "Fix avc denied for vendor_ims_app" into sc-dev 2021-03-25 04:59:51 +00:00
Ilya Matyukhin
3233492f78 Add sepolicy for Goodix AIDL HAL 
Bug: 183054007
Test: adb logcat | grep "avc: denied"
Change-Id: Iea9a652dbc78c488a72600b4226140ccf123b004
 2021-03-24 21:00:41 -07:00
terrycrhuang
9778af3cef Fix avc denied for vendor_ims_app 
03-25 09:24:16.810 E SELinux : avc:  denied  { find } for pid=3681
uid=10272 name=media.audio_flinger
scontext=u:r:vendor_ims_app:s0:c16,c257,c512,c768
tcontext=u:object_r:audioserver_service:s0 tclass=service_manager
permissive=0

Bug: 183593669
Test: Manual

Change-Id: I9d659b475d5d19ae5dd1642974f9064c152ee4b0
 2021-03-25 10:57:57 +08:00