Adam Shih
47b4ca882d
init: change overlayfs_file rule to dontaudit
...
Workaround for modem_img being unlabeled after disable-verity.
Bug: 193113005
Bug: 221384981
Test: remount with no avc error
Change-Id: Ie2479470c095f4ee2a9508714565b1088a8d7dce
2022-03-07 21:39:11 +00:00
Ruofei Ma
67e8f968b2
Allow mediacodec_google to access secure dma heap
...
The change is for following error:
HwBinder:867_1: type=1400 audit(0.0:9): avc: denied { read } for
name="vframe-secure" dev="tmpfs" ino=425 scontext=u:r:mediacodec_google:s0
tcontext=u:object_r:dmabuf_system_secure_heap_device:s0
tclass=chr_file permissive=0
Bug:221500257
Change-Id: I03e8c9b4f1d2099e6d7cd6d56f8d7f0834fd0009
(cherry picked from commit e239561061
2022-03-07 19:13:35 +00:00
Ray Chi
455c3c1653
Allow hal_usb_gadget_impl to access proc_irq
...
Bug: 220996010
Test: build pass
Change-Id: Id9a9adbdc921629b6e89d0850dd8acaf76b1a891
2022-03-07 11:18:28 +08:00
Tommy Chiu
94995cd0d3
sepolicy: add permissions to let recovery wipe citadel
...
This gives recovery the ability to remove user data from citadel in the
same manner as issuing a `fastboot -w` does. This doesn't allow for
resetting FRP data, just user data.
audit: type=1400 audit(1646379959.016:9): avc: denied { getattr } for
pid=348 comm="recovery" path="/dev/gsc0" dev="tmpfs" ino=754
scontext=u:r:recovery:s0 tcontext=u:object_r:citadel_device:s0
tclass=chr_file permissive=0
Bug: 222005928
Change-Id: Ia6113999aecacbbbb31d7a8659a45c0e5a0db2c9
2022-03-07 00:24:55 +00:00
Tri Vo
9fe6aa97af
Don't audit storageproxyd unlabeled access
...
Test: m sepolicy
Bug: 197502330
Change-Id: Ibe7292dc659dd454d3c842f6c48d2d90bc77117d
2022-03-04 17:45:38 +00:00
Adam Shih
9ba4c9120d
remove obsolete code after SELinux is enforced
...
Bug: 207720645
Bug: 208527900
Bug: 208721673
Bug: 205072922
Test: boot with no relevant errors
Change-Id: I68931cc24c55beea52c246a06f268ea2be7d1ecf
2022-03-04 08:47:59 +00:00
Midas Chien
bef935f43d
Allow composer to read panel_idle_handle_exit sysfs node
...
Change panel_idle_exit_handle selinux type to sysfs_display to allow
composer to access it.
Bug: 202182467
Test: ls -Z to check selinux type
Test: composer can access it in enforce mode
Change-Id: I5e6c5036a946417c782f1389f4423cce69c4df77
2022-03-04 06:55:04 +00:00
millerliang
801b87fe71
Fix AAudio avc denied
...
I auditd : type=1400 audit(0.0:35): avc:
denied { map } for comm="binder:896_4" path="/dev/snd/pcmC0D0p"
dev="tmpfs" ino=1138 scontext=u:r:audioserver:s0
tcontext=u:object_r:audio_device:s0 tclass=chr_file permissive=0
E SELinux : avc: denied { find } for pid=887 uid=1041 name=audio
scontext=u:r:audioserver:s0 tcontext=u:object_r:audio_service:s0
tclass=service_manager permissive=0
Bug: 222191260
Test: Flash TH ROM and test it by the following command
Test: test_steal_exclusive -c0
Signed-off-by: millerliang <millerliang@google.com>
Change-Id: I8ea6741f3682b568de089d040d511b68938374ab
2022-03-04 06:14:55 +00:00
Adam Shih
1616b97465
grant bugreport access to camera debug system property
...
Bug: 221384770
Test: do bugreport without seeing relevant error
Change-Id: Ie27ac5f2c6e13ec31ccec2adb11762dacab1fbdf
2022-03-04 05:58:20 +00:00
Jack Yu
450f61d51b
Allow platform_app to access Nfc service
...
Fix selinux denial below.
avc: denied { find } for pid=11183 uid=10224 name=nfc
scontext=u:r:platform_app:s0:c512,c768
tcontext=u:object_r:nfc_service:s0 tclass=service_manager
permissive=0
Bug: 222387662
Test: build pass
Change-Id: If97d8141acab23b4e13ea65ce28589195ef7ad9e
2022-03-04 02:46:29 +00:00
Jinting Lin
c3612c7097
Allow modem diagnostic app to access default prop
...
log:
avc: denied { read } for name="u:object_r:default_prop:s0" dev="tmpfs" ino=154 scontext=u:r:modem_diagnostic_app:s0:c512,c768 tcontext=u:object_r:default_prop:s0 tclass=file permissive=0 app=com.google.mds
Bug: 222509956
Change-Id: I50302b38f074e3f1a078ee48896154353e0937b6
2022-03-04 01:35:39 +00:00
Devin Moore
ac44b340d3
Add the init_boot partition sepolicy
...
Tagging the partition as a boot_block_device so everything that had
permission to read/write to the boot partition now also has permissions
for this new init_boot partition.
This is required for update_engine to be able to write to init_boot on
builds that are enforcing sepolicy.
Bug: 222052598
Test: adb shell setenforce 1 && update_device.py ota.zip
Merged-In: Ic991fa314c8a6fdb848199a626852a68a57d1df5
Change-Id: Ic991fa314c8a6fdb848199a626852a68a57d1df5
2022-03-03 20:01:09 +00:00
Robb Glasser
990294708f
Add hal_graphics_composer_default to sensors sepolicy.
...
Bug: 221396170
Test: No avc denial.
Change-Id: I23299524dec50d8c589c6acc9da8b3c8c3399f97
2022-03-03 18:42:58 +00:00
Nishok Kumar S
e95f5edafe
Allow camera HAL and GCA to access Aurora GXP device.
...
The camera HAL and Google Camera App
need selinux permission to run workloads on Aurora DSP. This
change adds the selinux rules too allow these clients to
access the GXP device and load firmware onto DSP cores
in order to execute workloads on DSP.
Bug: 220086991
Test: Verified that the camera HAL service and GCA app is able to access the GXP device and load GXP firmware.
Change-Id: I1bd327cfbe5b37c88154acda54bf6c396e939289
2022-03-03 04:02:33 +00:00
Robert Lee
129ef29bc8
Fix selinux error for aocd
...
allow write permission to fix following error
auditd : type=1400 audit(0.0:4): avc: denied { write } for comm="aocd" name="aoc" dev="tmpfs" ino=497 scontext=u:r:aocd:s0 tcontext=u:object_r:aoc_device:s0 tclass=chr_file permissive=0
Bug: 198490099
Test: no avc deny when enable no_ap_restart
Change-Id: I06dc99f1a5859589b33f89ce435745d15e2e5749
Signed-off-by: Robert Lee <lerobert@google.com>
2022-03-03 02:22:53 +00:00
Siddharth Kapoor
2d43200489
Add libgpudataproducer as sphal
...
Bug: 222042714
Test: CtsGpuProfilingDataTestCases passes on User build
Signed-off-by: Siddharth Kapoor <ksiddharth@google.com>
Change-Id: I1997f3e66327486f15b1aa742aa8e82855b07e05
2022-03-03 01:08:52 +00:00
Jinting Lin
94d7f6cce6
Fix avc denied for slsi engineermode app
...
log:
avc: denied { find } for interface=vendor.samsung_slsi.telephony.hardware.radioExternal::IOemSlsiRadioExternal sid=u:r:platform_app:s0:c512,c768 pid=5111 scontext=u:r:platform_app:s0:c512,c768 tcontext=u:object_r:hal_exynos_rild_hwservice:s0 tclass=hwservice_manager permissive=0
avc: denied { call } for comm="si.engineermode" scontext=u:r:platform_app:s0:c512,c768 tcontext=u:r:rild:s0 tclass=binder permissive=0 app=com.samsung.slsi.engineermode
avc: denied { call } for comm="HwBinder:1016_1" scontext=u:r:rild:s0 tcontext=u:r:platform_app:s0:c512,c768 tclass=binder permissive=0
avc: denied { read } for name="u:object_r:default_prop:s0" dev="tmpfs" ino=154 scontext=u:r:vendor_engineermode_app:s0:c225,c256,c512,c768 tcontext=u:object_r:default_prop:s0 tclass=file permissive=0 app=com.samsung.slsi.engineermode
Test: side load the trail build sepolicy, then check the app
Bug: 221482792
Change-Id: I84768ed128a2b8c57d6a3e0a0f0aa8c4d4b91857
2022-03-03 01:01:08 +00:00
sukiliu
b1c5fcff3d
update error on ROM 8223177
...
Bug: 221384981
Bug: 221384939
Bug: 221384996
Bug: 221384768
Bug: 221384770
Bug: 221384860
Test: PtsSELinuxTestCases
Change-Id: I50916dca7548bce0e77d90a36ad8f9ba1ca7c711
2022-03-02 06:30:05 +00:00
Roshan Pius
a1f0d2aa9a
gs-sepolicy: Fix legacy UWB stack sepolicy rules
...
This rule was present on previous devices.
Denial logs:
02-24 09:22:08.214 427 427 E SELinux : avc: denied { find } for
pid=1479 uid=1000 name=uwb_vendor scontext=u:r:system_server:s0
tcontext=u:object_r:uwb_vendor_service:s0 tclass=service_manager permissive=0
Bug: 221292100
Test: Compiles
Change-Id: I6de4000a9cebf46a0d94032aade7b2d40b94ca16
2022-03-01 18:25:00 +00:00
Tommy Chiu
b7790aa7a8
RKP: Add IRemotelyProvisionedComponent service
...
Bug: 212643050
Bug: 221503025
Change-Id: I7932ba96d0d7dd603d360cd7319997a7c108500a
2022-03-01 06:10:23 +00:00
Badhri Jagan Sridharan
fc08341bd6
android.hardware.usb.IUsb AIDL migration
...
Cherry-pick of <775523d1eb
2022-03-01 03:32:23 +00:00
YiHo Cheng
be92764669
thermal: Label tmu register dump sysfs
...
Allow dumpstate to access tmu register dump sysfs
[ 174.114566] type=1400 audit(1645790696.920:13): avc: denied { read }
for comm="dumpstate@1.1-s" name="tmu_reg_dump_state" dev="sysfs"
ino=65178
scontext=u:r:hal_dumpstate_default:s0 tcontext=u:object_r:sysfs:s0
tclass=file permissive=0
[ 174.115092] type=1400 audit(1645790696.920:14): avc: denied { read }
for comm="dumpstate@1.1-s" name="tmu_reg_dump_current_temp" dev="sysfs"
in
o=65179 scontext=u:r:hal_dumpstate_default:s0
tcontext=u:object_r:sysfs:s0 tclass=file permissive=0
[ 174.115208] type=1400 audit(1645790696.920:15): avc: denied { read }
for comm="dumpstate@1.1-s" name="tmu_top_reg_dump_rise_thres"
dev="sysfs"
ino=65180 scontext=u:r:hal_dumpstate_default:s0
tcontext=u:object_r:sysfs:s0 tclass=file permissive=0
[ 174.115398] type=1400 audit(1645790696.920:16): avc: denied { read }
for comm="dumpstate@1.1-s" name="tmu_top_reg_dump_fall_thres"
dev="sysfs"
ino=65182 scontext=u:r:hal_dumpstate_default:s0
tcontext=u:object_r:sysfs:s0 tclass=file permissive=0
[ 174.115498] type=1400 audit(1645790696.920:17): avc: denied { read }
for comm="dumpstate@1.1-s" name="tmu_sub_reg_dump_rise_thres"
dev="sysfs"
ino=65181 scontext=u:r:hal_dumpstate_default:s0
tcontext=u:object_r:sysfs:s0 tclass=file permissive=0
Bug: 215040856
Test: check tmu register dump sysfs output in dumpstate
Change-Id: Ica48e37344a69264d4b4367af7856ec20b566a9e
2022-03-01 01:24:00 +00:00
Yu-Chi Cheng
172271fdbc
Allowed GCA to access EdgeTPU for P22 devices.
...
This change includes the google_camera_app domain
into the EdgeTPU selinux rules. With it the GCA
is now able to access EdgeTPU.
Bug: 221020793
Test: verified GCA to work on P22.
Change-Id: I69010e2a8cca1429df402ae587b939d38e20a287
2022-02-25 23:36:01 +00:00
Jinting Lin
e44f3c867c
Fix avc denied for vendor silent logging app
...
log:
avc: denied { getattr } for comm="y.silentlogging" path="/data/user/0/com.samsung.slsi.telephony.silentlogging" dev="dm-42" ino=6793 scontext=u:r:vendor_telephony_silentlogging_app:s0:c232,c259,c512,c768 tcontext=u:object_r:system_app_data_file:s0 tclass=dir permissive=0
avc: denied { search } for comm="y.silentlogging" name="com.samsung.slsi.telephony.silentlogging" dev="dm-42" ino=6793 scontext=u:r:vendor_telephony_silentlogging_app:s0:c232,c259,c512,c768 tcontext=u:object_r:system_app_data_file:s0 tclass=dir permissive=0
denied { read } for comm="y.silentlogging" name="u:object_r:vendor_slog_prop:s0" dev="tmpfs" ino=338 scontext=u:r:vendor_telephony_silentlogging_app:s0:c232,c259,c512,c768 tcontext=u:object_r:vendor_slog_prop:s0 tclass=file permissive=0
avc: denied { search } for comm="y.silentlogging" name="slog" dev="dm-42" ino=314 scontext=u:r:vendor_telephony_silentlogging_app:s0:c232,c259,c512,c768 tcontext=u:object_r:vendor_slog_file:s0 tclass=dir permissive=0
avc: denied { read } for comm="y.silentlogging" name="u:object_r:default_prop:s0" dev="tmpfs" ino=150 scontext=u:r:vendor_telephony_silentlogging_app:s0:c232,c259,c512,c768 tcontext=u:object_r:default_prop:s0 tclass=file permissive=0
avc: denied { find } for interface=vendor.samsung_slsi.telephony.hardware.oemservice::IOemService sid=u:r:vendor_telephony_silentlogging_app:s0:c232,c259,c512,c768 pid=7322 scontext=u:r:vendor_telephony_silentlogging_app:s0:c232,c259,c512,c768 tcontext=u:object_r:hal_vendor_oem_hwservice:s0 tclass=hwservice_manager permissive=0
avc: denied { call } for comm="y.silentlogging" scontext=u:r:vendor_telephony_silentlogging_app:s0:c232,c259,c512,c768 tcontext=u:r:dmd:s0 tclass=binder permissive=0
avc: denied { call } for comm="y.silentlogging" scontext=u:r:vendor_telephony_silentlogging_app:s0:c232,c259,c512,c768 tcontext=u:r:sced:s0 tclass=binder permissive=0
avc: denied { read } for comm="getenforce" name="enforce" dev="selinuxfs" ino=4 scontext=u:r:vendor_telephony_silentlogging_app:s0:c232,c259,c512,c768 tcontext=u:object_r:selinuxfs:s0 tclass=file permissive=0
avc: denied { set } for property=persist.vendor.modem.logging.shannon_app pid=7279 uid=1000 gid=1000 scontext=u:r:vendor_telephony_silentlogging_app:s0:c232,c259,c512,c768 tcontext=u:object_r:vendor_modem_prop:s0 tclass=property_service permissive=0'
avc: denied { call } for comm="HwBinder:1001_1" scontext=u:r:sced:s0 tcontext=u:r:vendor_telephony_silentlogging_app:s0:c232,c259,c512,c768 tclass=binder permissive=0
avc: denied { call } for scontext=u:r:dmd:s0 tcontext=u:r:vendor_telephony_silentlogging_app:s0:c232,c259,c512,c768 tclass=binder permissive=0
avc: denied { getattr } for comm="tlogging:remote" path="/data/user/0/com.samsung.slsi.telephony.silentlogging" dev="dm-42" ino=6793 scontext=u:r:vendor_silentlogging_remote_app:s0:c232,c259,c512,c768 tcontext=u:object_r:system_app_data_file:s0 tclass=dir permissive=0
avc: denied { read } for name="slog" dev="dm-42" ino=314 scontext=u:r:vendor_silentlogging_remote_app:s0:c232,c259,c512,c768 tcontext=u:object_r:vendor_slog_file:s0 tclass=dir permissive=0
Test: flash TH build then run basic test of silent logging app
Bug: 220847487
Change-Id: Ib5ac1e796e8e816d024cebc584b5699ab8ed1162
2022-02-25 05:35:06 +00:00
SalmaxChang
7cb9cc182b
Add missing vendor_logger_prop rule
...
init : Do not have permissions to set 'persist.vendor.verbose_logging_enabled' to 'true' in property file '/vendor/build.prop': SELinux permission check failed
Bug: 221173724
Bug: 221154649
Change-Id: Ic35e6f1d40f15efefead4530f8d320b72d7366e4
2022-02-24 07:45:39 +00:00
Zachary Iqbal
4bbc6969e5
Give gralloc access to the faceauth_heap_device.
...
Notes:
- This is required for face authentication.
Fixes: 221098313
Test: Built locally.
Change-Id: I6292c76c0809f091108ac73bef2d9e2db430a680
2022-02-24 05:20:30 +00:00
Alex Hong
4443c79bbb
Remove the sepolicy for tetheroffload service
...
Test: m checkvintf
run vts -m VtsHalTetheroffloadControlV1_0TargetTest
Bug: 207076973
Bug: 214494717
Change-Id: I5ecec46512ff4e1ae6c52147cfa0179e5fc93420
Merged-In: I5ecec46512ff4e1ae6c52147cfa0179e5fc93420
2022-02-24 04:03:32 +00:00
Joseph Jang
5fb066e143
identity: Add sepolicy permission for hal_identity_citadel to find hal_remotelyprovisionedcomponent_service
...
log:
SELinux : avc: denied { find } for pid=885 uid=9999
name=android.hardware.security.keymint.IRemotelyProvisionedComponent/strongbox
scontext=u:r:hal_identity_citadel:s0
tcontext=u:object_r:hal_remotelyprovisionedcomponent_service:s0
tclass=service_manager permissive=0
Bug: 218613398
Change-Id: I124ea5898609a3f68bee13b6db931878252d4081
2022-02-24 02:20:37 +00:00
Jack Yu
97a25bf259
uwb: permissions for factory uwb calibration file
...
Allow nfc hal accessing /data/vendor/uwb.
Bug: 220167093
Test: build pass
Merged-In: I33093231577b71c24d5bf6f980c7021cc546fa98
Change-Id: I33093231577b71c24d5bf6f980c7021cc546fa98
2022-02-24 01:02:52 +00:00
Darren Hsu
8f90cf5408
Allow hal_power_stats to read UWB sysfs nodes
...
Bug: 219369324
Test: Dump power stats and see no avc denials
Change-Id: Ib1ac15867f51069bef3f68e91bf65b842b7c0734
Signed-off-by: Darren Hsu <darrenhsu@google.com>
2022-02-24 01:02:11 +00:00
Jinting Lin
e6af74a6c4
Adds mnt file and batt info permissions for modem app
...
Bug: 220076340
Merged-In: Icd02d4f8757719afed020c27a90812921d5f37ec
Change-Id: Icd02d4f8757719afed020c27a90812921d5f37ec
(cherry picked from commit 2c914cd02c
2022-02-23 05:55:57 +00:00
Jinting Lin
7ba8b12bb8
Adds logging related properties for logger app
...
Bug: 220073302
Merged-In: I3917ce13f51a5ccb3304eb2db860f4da8424438b
Change-Id: I3917ce13f51a5ccb3304eb2db860f4da8424438b
(cherry picked from commit e65363450c
2022-02-23 03:16:00 +00:00
Krzysztof Kosiński
3884738538
Camera: re-add TEE access.
...
Face auth is being investigated for Android T, so this access
is still needed. It was initially omitted from ag/16719985 because
it did not launch in Android S.
Bug: 220886644
Test: build for P10
Change-Id: I61ecc685397fcab6f356e98abfc88e8cb34254f4
2022-02-23 02:51:40 +00:00
Adam Shih
b158d7b088
avoid pixellogger from crashing
...
Bug: 220935985
Test: pixellogger stays alive for 2 minutes
Change-Id: I9f70f1a936731332ada3abfa945e60f8aff58279
2022-02-23 09:58:37 +08:00
Robb Glasser
727d070b13
Fix sensors_hal selinux denials.
...
Bug: 214473093
Bug: 218930975
Bug: 210067282
Test: com.google.android.selinux.pts.SELinuxTest#scanAvcDeniedLogRightAfterReboot
Change-Id: Ifd865efd0544f246d1c188f3edce9f05f27313d2
2022-02-22 19:25:50 +00:00
Krzysztof Kosiński
7997d6a8a0
Camera: add setsched capability.
...
The camera HAL needs to increase the priority of some threads
to reduce frame drops.
Bug: 205072921
Test: Inspected logcat on P10
Change-Id: Ife5194c780a91f32d718f8db38e41f2f47fb929f
2022-02-22 08:12:57 +00:00
Adam Shih
b322df9960
Let GPU reload
...
02-22 12:59:47.955 15 15 I mali 28000000.mali: reloading firmware
02-22 12:59:47.955 15 15 W mali 28000000.mali: loading /vendor/firmware/mali_csffw.bin failed with error -13
02-22 12:59:47.955 15 15 W mali 28000000.mali: Direct firmware load for mali_csffw.bin failed with error -2
02-22 12:59:47.955 15 15 E mali 28000000.mali: Failed to reload firmware image 'mali_csffw.bin'
02-22 12:59:47.920 15 15 W kworker/0:1: type=1400 audit(0.0:10): avc: denied { read } for name="mali_csffw.bin" dev="dm-4" ino=5689716 scontext=u:r:kernel:s0 tcontext=u:object_r:same_process_hal_file:s0 tclass=file permissive=0
Bug: 220801802
Test: device can resume after an hour of suspend.
Change-Id: Ib252d6b1ac50ba7578a2ebf8cd8745004c385378
2022-02-22 07:05:54 +00:00
neoyu
9d12b77b67
Fix SELinux errors for ims
...
Sync different parts from P21 to P22
Bug: 220244357
Test: manual
Change-Id: Idf8e5e612b46370812be0907e75e9ae43f37ab7b
2022-02-22 01:43:29 +00:00
neoyu
7a34798ea4
Fix SELinux errors for vendor_init
...
avc: denied { set } for property=logd.logpersistd pid=1 uid=0 gid=0 scontext=u:r:vendor_init:s0 tcontext=u:object_r:logpersistd_logging_prop:s0 tclass=property_service permissive=0'
avc: denied { set } for property=logd.logpersistd.size pid=1 uid=0 gid=0 scontext=u:r:vendor_init:s0 tcontext=u:object_r:logpersistd_logging_prop:s0 tclass=property_service permissive=0'
avc: denied { set } for property=persist.vendor.ril.use.iccid_to_plmn pid=1 uid=0 gid=0 scontext=u:r:vendor_init:s0 tcontext=u:object_r:vendor_rild_prop:s0 tclass=property_service permissive=0'
avc: denied { set } for property=persist.vendor.ril.emergencynumber.mode pid=1 uid=0 gid=0 scontext=u:r:vendor_init:s0 tcontext=u:object_r:vendor_rild_prop:s0 tclass=property_service permissive=0'
avc: denied { set } for property=persist.vendor.ril.log_mask pid=1 uid=0 gid=0 scontext=u:r:vendor_init:s0 tcontext=u:object_r:vendor_rild_prop:s0 tclass=property_service permissive=0'
avc: denied { set } for property=persist.vendor.ril.log.base_dir pid=1 uid=0 gid=0 scontext=u:r:vendor_init:s0 tcontext=u:object_r:vendor_rild_prop:s0 tclass=property_service permissive=0'
avc: denied { set } for property=persist.vendor.ril.log.chunk_size pid=1 uid=0 gid=0 scontext=u:r:vendor_init:s0 tcontext=u:object_r:vendor_rild_prop:s0 tclass=property_service permissive=0'
Bug: 220261262
Test: manual
Change-Id: Ieb6673234f913af25e275e61404098a0deccbed2
2022-02-21 14:58:29 +08:00
neoyu
26aa7c150e
Fix SELinux errors for rild
...
avc: denied { set } for property=vendor.sys.modem_reset pid=990 uid=1001 gid=1001 scontext=u:r:rild:s0 tcontext=u:object_r:vendor_default_prop:s0 tclass=property_service permissive=0'
Bug: 220261262
Test: manual
Change-Id: I2bd616345f665c0cffd1ee73db790708f9cbca06
2022-02-21 06:38:42 +00:00
Tai Kuo
bc3924f61d
Remove hal_vibrator_default avc tracking denials
...
Bug: 204718450
Bug: 207062207
Bug: 208721729
Test: pts-tradefed run pts -m PtsSELinuxTest -t
com.google.android.selinux.pts.SELinuxTest#scanAvcDeniedLogRightAfterReboot
Change-Id: Icb3d6a48fc9fbb6e6644d1d65150436f7c0c8c3f
2022-02-21 06:37:00 +00:00
wenchangliu
84d53775e1
Allow hal_graphics_allocator to access vscaler_heap_device
...
avc: denied { read } for name="vscaler-secure" dev="tmpfs" \
ino=458 scontext=u:r:hal_graphics_allocator_default:s0 \
tcontext=u:object_r:vscaler_heap_device:s0 \
tclass=chr_file permissive=0
Bug: 199467922
Test: ExoPlayer secure playback
Change-Id: I2b3be9f4f038317eb456a20b33e555e8d5db2678
2022-02-21 06:36:34 +00:00
wenchangliu
ad0a033f97
Allow hal_graphics_allocator to access dmabuf_system_secure_heap_device
...
avc: denied { ioctl } for path="/dev/dma_heap/vframe-secure" dev="tmpfs" \
ino=801 ioctlcmd=0x4800 scontext=u:r:hal_graphics_allocator_default:s0 \
tcontext=u:object_r:dmabuf_system_secure_heap_device:s0 \
tclass=chr_file permissive=0
Bug: 199467922
Test: ExoPlayer secure playback
Change-Id: I9e6e1bba6d01c1a416a440e8ad425a5cf2ac19c5
2022-02-21 06:36:34 +00:00
neoyu
e909ddabea
Fix SELinux errors for ims
...
avc: denied { write } for name="property_service" dev="tmpfs" ino=362 scontext=u:r:vendor_ims_app:s0:c208,c256,c512,c768 tcontext=u:object_r:property_socket:s0 tclass=sock_file permissive=0 app=com.shannon.imsservice
avc: denied { set } for property=persist.radio.call.audio.output pid=1920 uid=10216 gid=10216 scontext=u:r:vendor_ims_app:s0:c216,c256,c512,c768 tcontext=u:object_r:radio_prop:s0 tclass=property_service permissive=0'
Bug: 219954530
Test: manual
Change-Id: I3e7f6781718c3967f7842b074b0ef91818508af2
(cherry picked from commit 0d22c86fef
2022-02-21 05:44:38 +00:00
Adam Shih
2b6835e404
update error on ROM 8205122
...
Bug: 220636850
Test: pts-tradefed run pts -m PtsSELinuxTest
Change-Id: I201f9e84eca676b9f7aa5d09356bce384df1fa4b
2022-02-21 03:20:59 +00:00
wenchangliu
28817da2a3
Allow mediacodec_samsung to access gpu device
...
avc: denied { getattr } for path="/dev/mali0" dev="tmpfs" \
ino=1042 scontext=u:r:mediacodec_samsung:s0 \
tcontext=u:object_r:gpu_device:s0 tclass=chr_file permissive=1
avc: denied { read write } for name="mali0" dev="tmpfs" \
ino=1042 scontext=u:r:mediacodec_samsung:s0 \
tcontext=u:object_r:gpu_device:s0 tclass=chr_file permissive=1
avc: denied { open } for path="/dev/mali0" dev="tmpfs" \
ino=1042 scontext=u:r:mediacodec_samsung:s0 \
tcontext=u:object_r:gpu_device:s0 tclass=chr_file permissive=1
avc: denied { ioctl } for path="/dev/mali0" dev="tmpfs" \
ino=1042 ioctlcmd=0x8034 scontext=u:r:mediacodec_samsung:s0 \
tcontext=u:object_r:gpu_device:s0 tclass=chr_file permissive=1
avc: denied { map } for path="/dev/mali0" dev="tmpfs" \
ino=1042 scontext=u:r:mediacodec_samsung:s0 \
tcontext=u:object_r:gpu_device:s0 tclass=chr_file permissive=1
Bug: 205772037
Test: demo-transformer HDR editing
Change-Id: Ib5d075bfd1247112c803f01db430d93259fd9e7f
2022-02-18 13:50:13 +00:00
Midas Chien
c8c1f766d2
Allow composer to read panel_idle sysfs node
...
Change panel_idle selinux type to sysfs_display to allow composer can
access it.
Bug: 198808492
Test: ls -Z to check selinux type
Test: make sure composer can access it
Change-Id: Ic2bd697c79b398b8093dd00598b1076e3ea3aec2
2022-02-17 09:17:42 +00:00
Denny cy Lee
efbd9fa0b2
sepolicy: hwinfo: Add battery fuel gauge permission
...
Bug: 208909060
Bug: 219660742
Bug: 219660741
Test: check dmeg and search "avc: denied { search } for
comm="id.hardwareinfo" vendor_maxfg_debugfs avc gone after apply patch
Change-Id: I3399e696b59218e62c4d1adcc2a12f5d6ee5c8cc
Signed-off-by: Denny cy Lee <dennycylee@google.com>
2022-02-17 09:04:23 +00:00
Junkyu Kang
064c6a86e0
Add persist.vendor.gps to sepolicy
...
Bug: 196002632
Test: PixelLogger can modify persist.vendor.gps.*
Change-Id: I17f16d1f147287abf86b18452743842594be7531
2022-02-16 08:16:03 +00:00
Adam Shih
b2c284177a
label sysfs_fabric to target_load
...
[ 11.149987] type=1400 audit(1644984050.124:9): avc: denied { open } for comm="NodeLooperThrea" path="/sys/devices/platform/17000010.devfreq_mif/devfreq/17000010.devfreq_mif/interactive/target_load" dev="sysfs" ino=48615 scontext=u:r:hal_power_default:s0 tcontext=u:object_r:sysfs:s0 tclass=file permissive=1
Bug: 218500026
Test: boot with no error loop under enforcing mode
Change-Id: Ie2f78f8ee39233e0c1f83fc2ba654f4a116e12a4
2022-02-16 13:01:30 +08:00
