Commit graph

644 commits

Author SHA1 Message Date
Badhri Jagan Sridharan
775523d1eb android.hardware.usb.IUsb AIDL migration
android.hardware.usb.IUsb is migrated to AIDL and runs in
its own process. android.hardware.usb.gadget.IUsbGadget
is now published in its own exclusive process
(android.hardware.usb.gadget-service). Creating
file_context and moving the selinux linux rules
for IUsbGadget implementation.

[   37.177042] type=1400 audit(1645536157.528:3): avc: denied { wake_alarm } for comm="android.hardwar" capability=35 scontext=u:r:hal_usb_impl:s0 tcontext=u:r:hal_usb_impl:s0 tclass=capability2 permissive=1
[   37.177139] type=1400 audit(1645536157.528:4): avc: denied { block_suspend } for comm="android.hardwar" capability=36 scontext=u:r:hal_usb_impl:s0 tcontext=u:r:hal_usb_impl:s0 tclass=capability2 permissive=1
[   39.936357] type=1400 audit(1645536160.292:5): avc: denied { call } for comm="HwBinder:875_1" scontext=u:r:hal_usb_impl:s0 tcontext=u:r:hal_thermal_default:s0 tclass=binder permissive=1
[   39.936403] type=1400 audit(1645536160.292:6): avc: denied { transfer } for comm="HwBinder:875_1" scontext=u:r:hal_usb_impl:s0 tcontext=u:r:hal_thermal_default:s0 tclass=binder permissive=1
...
[   42.845054] type=1400 audit(1645550991.268:8): avc: denied { read } for comm="HwBinder:860_1" name="u:object_r:vendor_usb_config_prop:s0" dev="tmpfs" ino=351 scontext=u:r:hal_usb_gadget_impl:s0 tcontext=u:object_r:vendor_usb_config_prop:s0 tclass=file permissive=1
[   42.877781] type=1400 audit(1645550991.268:9): avc: denied { open } for comm="HwBinder:860_1" path="/dev/__properties__/u:object_r:vendor_usb_config_prop:s0" dev="tmpfs" ino=351 scontext=u:r:hal_usb_gadget_impl:s0 tcontext=u:object_r:vendor_usb_config_prop:s0 tclass=file permissive=1
[   42.915532] type=1400 audit(1645550991.268:10): avc: denied { getattr } for comm="HwBinder:860_1" path="/dev/__properties__/u:object_r:vendor_usb_config_prop:s0" dev="tmpfs" ino=351 scontext=u:r:hal_usb_gadget_impl:s0 tcontext=u:object_r:vendor_usb_config_prop:s0 tclass=file permissive=1
[   42.962130] type=1400 audit(1645550991.268:11): avc: denied { map } for comm="HwBinder:860_1" path="/dev/__properties__/u:object_r:vendor_usb_config_prop:s0" dev="tmpfs" ino=351 scontext=u:r:hal_usb_gadget_impl:s0 tcontext=u:object_r:vendor_usb_config_prop:s0 tclass=file permissive=1
[   43.003097] type=1400 audit(1645550991.268:12): avc: denied { watch watch_reads } for comm="HwBinder:860_1" path="/dev/usb-ffs/adb" dev="functionfs" ino=40814 scontext=u:r:hal_usb_gadget_impl:s0 tcontext=u:object_r:functionfs:s0 tclass=dir permissive=1
[   43.024529] type=1400 audit(1645550991.268:13): avc: denied { write } for comm="HwBinder:860_1" name="property_service" dev="tmpfs" ino=376 scontext=u:r:hal_usb_gadget_impl:s0 tcontext=u:object_r:property_socket:s0 tclass=sock_file permissive=1
[   43.057605] type=1400 audit(1645550991.268:14): avc: denied { connectto } for comm="HwBinder:860_1" path="/dev/socket/property_service" scontext=u:r:hal_usb_gadget_impl:s0 tcontext=u:r:init:s0 tclass=unix_stream_socket permissive=1
[   43.084549] type=1107 audit(1645550991.268:15): uid=0 auid=4294967295 ses=4294967295 subj=u:r:init:s0 msg='avc: denied { set } for property=vendor.usb.dwc3_irq pid=860 uid=0 gid=0 scontext=u:r:hal_usb_gadget_impl:s0 tcontext=u:object_r:vendor_usb_config_prop:s0 tclass=property_service permissive=1'

Bug: 200993386
Change-Id: Ia8c24610244856490c8271433710afb57d3da157
2022-02-25 00:51:26 +00:00
SalmaxChang
d355e26031 Add missing vendor_logger_prop rule am: 7cb9cc182b am: 711eb4d39e
Original change: https://googleplex-android-review.googlesource.com/c/device/google/gs201-sepolicy/+/16996081

Change-Id: I898d40f04b1d92ba70d1a473b78142882f7f1c57
2022-02-24 14:29:19 +00:00
SalmaxChang
6e50b6c086 Add missing vendor_logger_prop rule am: 7cb9cc182b
Original change: https://googleplex-android-review.googlesource.com/c/device/google/gs201-sepolicy/+/16996081

Change-Id: I7a0bbf078bf056c35c03f4438020a165d0eb1866
2022-02-24 13:29:32 +00:00
SalmaxChang
711eb4d39e Add missing vendor_logger_prop rule am: 7cb9cc182b
Original change: https://googleplex-android-review.googlesource.com/c/device/google/gs201-sepolicy/+/16996081

Change-Id: If4364de5ee9fd24dcdbbd881550596456907f4eb
2022-02-24 13:06:15 +00:00
SalmaxChang
7cb9cc182b Add missing vendor_logger_prop rule
init    : Do not have permissions to set 'persist.vendor.verbose_logging_enabled' to 'true' in property file '/vendor/build.prop': SELinux permission check failed

Bug: 221173724
Bug: 221154649
Change-Id: Ic35e6f1d40f15efefead4530f8d320b72d7366e4
2022-02-24 07:45:39 +00:00
Zachary Iqbal
cbd2301c12 Give gralloc access to the faceauth_heap_device. am: 4bbc6969e5 am: 0dca35958b
Original change: https://googleplex-android-review.googlesource.com/c/device/google/gs201-sepolicy/+/16995763

Change-Id: I821a83023676a3bffeb0d4dc4eda84ff3bc2418a
2022-02-24 07:16:53 +00:00
Zachary Iqbal
d5591c285c Give gralloc access to the faceauth_heap_device. am: 4bbc6969e5
Original change: https://googleplex-android-review.googlesource.com/c/device/google/gs201-sepolicy/+/16995763

Change-Id: I4f7125f019a79f981bcdbabdf937f702705a56ab
2022-02-24 07:09:17 +00:00
Alex Hong
b98a993585 [automerger skipped] Remove the sepolicy for tetheroffload service am: 4443c79bbb am: 1ca456915b -s ours
am skip reason: Merged-In I5ecec46512ff4e1ae6c52147cfa0179e5fc93420 with SHA-1 4443c79bbb is already in history

Original change: https://googleplex-android-review.googlesource.com/c/device/google/gs201-sepolicy/+/16972946

Change-Id: Ibdaef3f7222496386d8b4c59f8b2bc7bdcb46955
2022-02-24 06:54:51 +00:00
Joseph Jang
6478f87461 identity: Add sepolicy permission for hal_identity_citadel to find hal_remotelyprovisionedcomponent_service am: 5fb066e143 am: 5523e01f2c
Original change: https://googleplex-android-review.googlesource.com/c/device/google/gs201-sepolicy/+/16984428

Change-Id: I00ffa527ead4c916ed209fed35ffb653bb77fd73
2022-02-24 06:54:40 +00:00
Jack Yu
e6fff8063a [automerger skipped] uwb: permissions for factory uwb calibration file am: 97a25bf259 am: 769645d0c1 -s ours
am skip reason: Merged-In I33093231577b71c24d5bf6f980c7021cc546fa98 with SHA-1 97a25bf259 is already in history

Original change: https://googleplex-android-review.googlesource.com/c/device/google/gs201-sepolicy/+/16986452

Change-Id: Ic7d5107dcebc73e2278a8239cacab2d223677c17
2022-02-24 06:54:23 +00:00
Zachary Iqbal
0dca35958b Give gralloc access to the faceauth_heap_device. am: 4bbc6969e5
Original change: https://googleplex-android-review.googlesource.com/c/device/google/gs201-sepolicy/+/16995763

Change-Id: I68667c239af8739e332082286f6004bacc0f328d
2022-02-24 05:45:18 +00:00
Zachary Iqbal
4bbc6969e5 Give gralloc access to the faceauth_heap_device.
Notes:
- This is required for face authentication.

Fixes: 221098313
Test: Built locally.
Change-Id: I6292c76c0809f091108ac73bef2d9e2db430a680
2022-02-24 05:20:30 +00:00
Darren Hsu
b06dbbfdbc Allow hal_power_stats to read UWB sysfs nodes am: 8f90cf5408 am: 7306a159f7
Original change: https://googleplex-android-review.googlesource.com/c/device/google/gs201-sepolicy/+/16986443

Change-Id: I1a7332a9eb0db6285209536d6c347739dda89438
2022-02-24 04:58:13 +00:00
Jinting Lin
634a200efe [automerger skipped] Adds mnt file and batt info permissions for modem app am: e6af74a6c4 am: b9b03f61f8 -s ours
am skip reason: Merged-In Icd02d4f8757719afed020c27a90812921d5f37ec with SHA-1 e6af74a6c4 is already in history

Original change: https://googleplex-android-review.googlesource.com/c/device/google/gs201-sepolicy/+/16984429

Change-Id: Ia2c32d7d844bd19c3cbcd86a61b0f8b0077aab69
2022-02-24 04:35:25 +00:00
Alex Hong
a44591db67 [automerger skipped] Remove the sepolicy for tetheroffload service am: 4443c79bbb -s ours
am skip reason: Merged-In I5ecec46512ff4e1ae6c52147cfa0179e5fc93420 with SHA-1 453b37ebdc is already in history

Original change: https://googleplex-android-review.googlesource.com/c/device/google/gs201-sepolicy/+/16972946

Change-Id: I4ae413cd29ada17b91a2023027f7157b42821de9
2022-02-24 04:34:33 +00:00
Jinting Lin
fdd73ecdd3 [automerger skipped] Adds logging related properties for logger app am: 7ba8b12bb8 am: 43dd982131 -s ours
am skip reason: Merged-In I3917ce13f51a5ccb3304eb2db860f4da8424438b with SHA-1 7ba8b12bb8 is already in history

Original change: https://googleplex-android-review.googlesource.com/c/device/google/gs201-sepolicy/+/16983456

Change-Id: Ie53a001f9de3e6fa44e8151a6e3e8af9691a55d7
2022-02-24 04:24:54 +00:00
Alex Hong
1ca456915b Remove the sepolicy for tetheroffload service am: 4443c79bbb
Original change: https://googleplex-android-review.googlesource.com/c/device/google/gs201-sepolicy/+/16972946

Change-Id: I8ef64c6cfeb59e985cdff44fc31bd8d7f20a62d7
2022-02-24 04:13:56 +00:00
Joseph Jang
083d19df94 identity: Add sepolicy permission for hal_identity_citadel to find hal_remotelyprovisionedcomponent_service am: 5fb066e143
Original change: https://googleplex-android-review.googlesource.com/c/device/google/gs201-sepolicy/+/16984428

Change-Id: Id4f363c69b621d0090f02630c2fdc0d207b1e92a
2022-02-24 04:09:44 +00:00
Jack Yu
5dce5312f8 [automerger skipped] uwb: permissions for factory uwb calibration file am: 97a25bf259 -s ours
am skip reason: Merged-In I33093231577b71c24d5bf6f980c7021cc546fa98 with SHA-1 62d5b40d35 is already in history

Original change: https://googleplex-android-review.googlesource.com/c/device/google/gs201-sepolicy/+/16986452

Change-Id: I1a412c0ca108b8f4135a862810682c46e8ee8265
2022-02-24 04:08:05 +00:00
Darren Hsu
9b1d657510 Allow hal_power_stats to read UWB sysfs nodes am: 8f90cf5408
Original change: https://googleplex-android-review.googlesource.com/c/device/google/gs201-sepolicy/+/16986443

Change-Id: Iba1a0e7a804473c04b0ec9df05b5286dc316a68d
2022-02-24 04:06:34 +00:00
Alex Hong
4443c79bbb Remove the sepolicy for tetheroffload service
Test: m checkvintf
      run vts -m VtsHalTetheroffloadControlV1_0TargetTest
Bug: 207076973
Bug: 214494717
Change-Id: I5ecec46512ff4e1ae6c52147cfa0179e5fc93420
Merged-In: I5ecec46512ff4e1ae6c52147cfa0179e5fc93420
2022-02-24 04:03:32 +00:00
Jinting Lin
4859443fe4 [automerger skipped] Adds mnt file and batt info permissions for modem app am: e6af74a6c4 -s ours
am skip reason: Merged-In Icd02d4f8757719afed020c27a90812921d5f37ec with SHA-1 2c914cd02c is already in history

Original change: https://googleplex-android-review.googlesource.com/c/device/google/gs201-sepolicy/+/16984429

Change-Id: I104197e4346c57a6bd8ea7acc0245c025841c42f
2022-02-24 04:03:03 +00:00
Krzysztof Kosiński
62f0ad72b9 Camera: re-add TEE access. am: 3884738538 am: 084defd392
Original change: https://googleplex-android-review.googlesource.com/c/device/google/gs201-sepolicy/+/16980638

Change-Id: Idbc0156037e4583d366664547d79d03ada12c3b1
2022-02-24 03:06:26 +00:00
Joseph Jang
5523e01f2c identity: Add sepolicy permission for hal_identity_citadel to find hal_remotelyprovisionedcomponent_service am: 5fb066e143
Original change: https://googleplex-android-review.googlesource.com/c/device/google/gs201-sepolicy/+/16984428

Change-Id: I7e43e5ece9d6f552a69905ceeb271a6e0d319a5e
2022-02-24 02:52:40 +00:00
Joseph Jang
5fb066e143 identity: Add sepolicy permission for hal_identity_citadel to find hal_remotelyprovisionedcomponent_service
log:
SELinux : avc:  denied  { find } for pid=885 uid=9999
name=android.hardware.security.keymint.IRemotelyProvisionedComponent/strongbox
scontext=u:r:hal_identity_citadel:s0
tcontext=u:object_r:hal_remotelyprovisionedcomponent_service:s0
tclass=service_manager permissive=0

Bug: 218613398
Change-Id: I124ea5898609a3f68bee13b6db931878252d4081
2022-02-24 02:20:37 +00:00
Jinting Lin
0022390c95 [automerger skipped] Adds logging related properties for logger app am: 7ba8b12bb8 -s ours
am skip reason: Merged-In I3917ce13f51a5ccb3304eb2db860f4da8424438b with SHA-1 e65363450c is already in history

Original change: https://googleplex-android-review.googlesource.com/c/device/google/gs201-sepolicy/+/16983456

Change-Id: Ife58cc0ac85ee0154c335950c161ae5008cfaa65
2022-02-24 02:08:25 +00:00
Krzysztof Kosiński
5eae12b451 Camera: re-add TEE access. am: 3884738538
Original change: https://googleplex-android-review.googlesource.com/c/device/google/gs201-sepolicy/+/16980638

Change-Id: Idfdd081b47c1a747f11352a8b2beaa0bdc6ba2df
2022-02-24 01:56:26 +00:00
Adam Shih
a7bd615bd6 [automerger skipped] avoid pixellogger from crashing am: b158d7b088 am: 79481cc1b3 -s ours
am skip reason: skipped by user adamshih

Original change: https://googleplex-android-review.googlesource.com/c/device/google/gs201-sepolicy/+/16983453

Change-Id: Id3fe0b0c2910f9555e6ca50476276b522e34b428
2022-02-24 01:46:20 +00:00
Jack Yu
769645d0c1 uwb: permissions for factory uwb calibration file am: 97a25bf259
Original change: https://googleplex-android-review.googlesource.com/c/device/google/gs201-sepolicy/+/16986452

Change-Id: Ie1aba2e1a2bb3c9d79caa04f454df271a531a9b0
2022-02-24 01:34:13 +00:00
Darren Hsu
7306a159f7 Allow hal_power_stats to read UWB sysfs nodes am: 8f90cf5408
Original change: https://googleplex-android-review.googlesource.com/c/device/google/gs201-sepolicy/+/16986443

Change-Id: If507662ac99de839314da9d03df7f3b7eb44bafb
2022-02-24 01:33:49 +00:00
Jinting Lin
b9b03f61f8 Adds mnt file and batt info permissions for modem app am: e6af74a6c4
Original change: https://googleplex-android-review.googlesource.com/c/device/google/gs201-sepolicy/+/16984429

Change-Id: Ie7d2cfab67eaf4ec2477f4dbaccc056b42b9df3a
2022-02-24 01:32:56 +00:00
Jack Yu
97a25bf259 uwb: permissions for factory uwb calibration file
Allow nfc hal accessing /data/vendor/uwb.

Bug: 220167093
Test: build pass
Merged-In: I33093231577b71c24d5bf6f980c7021cc546fa98
Change-Id: I33093231577b71c24d5bf6f980c7021cc546fa98
2022-02-24 01:02:52 +00:00
Darren Hsu
8f90cf5408 Allow hal_power_stats to read UWB sysfs nodes
Bug: 219369324
Test: Dump power stats and see no avc denials
Change-Id: Ib1ac15867f51069bef3f68e91bf65b842b7c0734
Signed-off-by: Darren Hsu <darrenhsu@google.com>
2022-02-24 01:02:11 +00:00
Jinting Lin
43dd982131 Adds logging related properties for logger app am: 7ba8b12bb8
Original change: https://googleplex-android-review.googlesource.com/c/device/google/gs201-sepolicy/+/16983456

Change-Id: I4de5106dddc7252b298fd12496afae00f2464ca3
2022-02-23 17:29:05 +00:00
Krzysztof Kosiński
084defd392 Camera: re-add TEE access. am: 3884738538
Original change: https://googleplex-android-review.googlesource.com/c/device/google/gs201-sepolicy/+/16980638

Change-Id: I6f455d8b6bb2d558ce9fbf5a1aaea66674fc43be
2022-02-23 17:24:31 +00:00
Adam Shih
79481cc1b3 avoid pixellogger from crashing am: b158d7b088
Original change: https://googleplex-android-review.googlesource.com/c/device/google/gs201-sepolicy/+/16983453

Change-Id: I15f04a00b6e2ac537bf565423f3b190b1869e3ab
2022-02-23 17:18:06 +00:00
Jinting Lin
e6af74a6c4 Adds mnt file and batt info permissions for modem app
Bug: 220076340
Merged-In: Icd02d4f8757719afed020c27a90812921d5f37ec
Change-Id: Icd02d4f8757719afed020c27a90812921d5f37ec
(cherry picked from commit 2c914cd02c)
2022-02-23 05:55:57 +00:00
Jinting Lin
7ba8b12bb8 Adds logging related properties for logger app
Bug: 220073302
Merged-In: I3917ce13f51a5ccb3304eb2db860f4da8424438b
Change-Id: I3917ce13f51a5ccb3304eb2db860f4da8424438b
(cherry picked from commit e65363450c)
2022-02-23 03:16:00 +00:00
Krzysztof Kosiński
3884738538 Camera: re-add TEE access.
Face auth is being investigated for Android T, so this access
is still needed. It was initially omitted from ag/16719985 because
it did not launch in Android S.

Bug: 220886644
Test: build for P10
Change-Id: I61ecc685397fcab6f356e98abfc88e8cb34254f4
2022-02-23 02:51:40 +00:00
Adam Shih
b158d7b088 avoid pixellogger from crashing
Bug: 220935985
Test: pixellogger stays alive for 2 minutes
Change-Id: I9f70f1a936731332ada3abfa945e60f8aff58279
2022-02-23 09:58:37 +08:00
Robb Glasser
340ceb1bfb Fix sensors_hal selinux denials. am: 727d070b13 am: b273426e98
Original change: https://googleplex-android-review.googlesource.com/c/device/google/gs201-sepolicy/+/16945897

Change-Id: I2dd11ffcf9de7efd0f58fd809dca79c92687846f
2022-02-22 20:39:55 +00:00
Robb Glasser
b273426e98 Fix sensors_hal selinux denials. am: 727d070b13
Original change: https://googleplex-android-review.googlesource.com/c/device/google/gs201-sepolicy/+/16945897

Change-Id: Ic2597d188b9f5b4fd8d779d22ec8bc57ab02d16a
2022-02-22 19:46:30 +00:00
Robb Glasser
727d070b13 Fix sensors_hal selinux denials.
Bug: 214473093
Bug: 218930975
Bug: 210067282
Test: com.google.android.selinux.pts.SELinuxTest#scanAvcDeniedLogRightAfterReboot
Change-Id: Ifd865efd0544f246d1c188f3edce9f05f27313d2
2022-02-22 19:25:50 +00:00
Krzysztof Kosiński
9257cd2a09 Camera: add setsched capability. am: 7997d6a8a0 am: 5975dd89c8
Original change: https://googleplex-android-review.googlesource.com/c/device/google/gs201-sepolicy/+/16943772

Change-Id: I18ad1039c0bd0d91d42d6acb27f6e1da412f7c6b
2022-02-22 10:26:21 +00:00
Ted Lin
5b6a5292c3 hal_health_default: Fix avc denials
12-02 11:15:45.224   756   756 I health@2.1-serv: type=1400 audit(0.0:2270): avc: denied { search } for name="thermal" dev="tmpfs" ino=1028 scontext=u:r:hal_health_default:s0 tcontext=u:object_r:thermal_link_device:s0 tclass=dir permissive=1
12-02 11:15:45.224   756   756 I health@2.1-serv: type=1400 audit(0.0:2271): avc: denied { search } for name="thermal" dev="sysfs" ino=16790 scontext=u:r:hal_health_default:s0 tcontext=u:object_r:sysfs_thermal:s0 tclass=dir permissive=1
12-02 11:15:45.224   756   756 I health@2.1-serv: type=1400 audit(0.0:2273): avc: denied { open } for path="/sys/devices/virtual/thermal/thermal_zone13/mode" dev="sysfs" ino=17285 scontext=u:r:hal_health_default:s0 tcontext=u:object_r:sysfs_thermal:s0 tclass=file permissive=1
12-02 11:15:45.224   756   756 I health@2.1-serv: type=1400 audit(0.0:2272): avc: denied { write } for name="mode" dev="sysfs" ino=17285 scontext=u:r:hal_health_default:s0 tcontext=u:object_r:sysfs_thermal:s0 tclass=file permissive=1

Bug:208721638
Test: adb bugreport
Change-Id: I4d9491862ff1bcc88f89b1478497ac569e3d1df1
Signed-off-by: Ted Lin <tedlin@google.com>
2022-02-22 09:11:43 +00:00
Krzysztof Kosiński
7fa1b979e3 Camera: add setsched capability. am: 7997d6a8a0
Original change: https://googleplex-android-review.googlesource.com/c/device/google/gs201-sepolicy/+/16943772

Change-Id: I3cf5fac31683c37c05f427d8226e013f11e3f5a2
2022-02-22 08:51:22 +00:00
Adam Shih
f3a6247154 Let GPU reload am: b322df9960 am: 37c001e736
Original change: https://googleplex-android-review.googlesource.com/c/device/google/gs201-sepolicy/+/16972944

Change-Id: I23b27fef19cd8bbfdd81c23f72562cc48ffc6ab9
2022-02-22 08:49:00 +00:00
Krzysztof Kosiński
5975dd89c8 Camera: add setsched capability. am: 7997d6a8a0
Original change: https://googleplex-android-review.googlesource.com/c/device/google/gs201-sepolicy/+/16943772

Change-Id: I0dd3ce7386c49db308618ceb5b75c04e1c58c5fe
2022-02-22 08:48:23 +00:00
Krzysztof Kosiński
7997d6a8a0 Camera: add setsched capability.
The camera HAL needs to increase the priority of some threads
to reduce frame drops.

Bug: 205072921
Test: Inspected logcat on P10
Change-Id: Ife5194c780a91f32d718f8db38e41f2f47fb929f
2022-02-22 08:12:57 +00:00
Adam Shih
37c001e736 Let GPU reload am: b322df9960
Original change: https://googleplex-android-review.googlesource.com/c/device/google/gs201-sepolicy/+/16972944

Change-Id: I378151b91d62b5c0eca3f876a82a5d73886dbe18
2022-02-22 07:43:55 +00:00