Commit graph

1053 commits

Author SHA1 Message Date
Wasb Liu
d90c1c4c22 hal_health_default: updated sepolicy am: daeff5e18c am: 88e9fb512d am: 271a845885
Original change: https://googleplex-android-review.googlesource.com/c/device/google/gs201-sepolicy/+/20610808

Change-Id: Ifca6b7ec1ade7be5d28d619c18af27d537699eda
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
2022-12-05 05:34:08 +00:00
Wasb Liu
271a845885 hal_health_default: updated sepolicy am: daeff5e18c am: 88e9fb512d
Original change: https://googleplex-android-review.googlesource.com/c/device/google/gs201-sepolicy/+/20610808

Change-Id: I4f4cc732f46d00a7c18dc1fb691436aa826e441a
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
2022-12-05 04:56:13 +00:00
Wasb Liu
88e9fb512d hal_health_default: updated sepolicy am: daeff5e18c
Original change: https://googleplex-android-review.googlesource.com/c/device/google/gs201-sepolicy/+/20610808

Change-Id: Idb7b4ffa9a74638247fc9bbaa4f697c9945e4c2e
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
2022-12-05 03:51:20 +00:00
George Lee
cd346126ec Battery Mitigation: Use Brownout Reason - sepolicy am: 0237351f52
Original change: https://googleplex-android-review.googlesource.com/c/device/google/gs201-sepolicy/+/20614653

Change-Id: I0bd44a43a191724cb3a882e87ae988545e207154
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
2022-12-02 07:05:12 +00:00
George Lee
0237351f52 Battery Mitigation: Use Brownout Reason - sepolicy
Brownout Reason replaces startup_bugreport_requested.  Battery
Mitigation needs to be updated.

Bug: 237287659
Test: Ensure lastmeal.txt is properly generated.
Merged-In: Ia03da290f5cb90ebbc7616d46e90064e346a402c
Change-Id: Ic123d704e37aa6d1dcd7377c291b537069ede829
Signed-off-by: George Lee <geolee@google.com>
2022-12-02 05:13:57 +00:00
Wasb Liu
daeff5e18c hal_health_default: updated sepolicy
allow android.hardware.health service to access persist_battery_file

11-14 13:53:39.242   872   872 W android.hardwar: type=1400 audit(0.0:17): avc: denied { search } for name="battery" dev="sda1" ino=84 scontext=u:r:hal_health_default:s0 tcontext=u:object_r:persist_battery_file:s0 tclass=dir permissive=0

Bug: 258535661
Bug: 260878511
Test: check for no avc denied on persist_battery_file
Change-Id: I7564b03339e17f9eea4aa5a8feda31bcfdd6100c
Signed-off-by: Wasb Liu <wasbliu@google.com>
Signed-off-by: Ken Tsou <kentsou@google.com>
(cherry picked from commit 24cfe388c5)
2022-12-02 02:01:24 +00:00
Ziyi Cui
71d22f91d6 [ DO NOT MERGE ] gs201-sepolicy: pixelstats: enable pixelstats access to perf-metrics am: 30e01ffb8c
Original change: https://googleplex-android-review.googlesource.com/c/device/google/gs201-sepolicy/+/20133843

Change-Id: I4a4b1d228816a46749ce0d125d86c29c272e4a57
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
2022-12-01 07:03:11 +00:00
Ziyi Cui
1f90d9e929 gs201-sepolicy:dumpstate: allow dumpstate access sysfs_vendor_metrics am: 521334a366
Original change: https://googleplex-android-review.googlesource.com/c/device/google/gs201-sepolicy/+/20475259

Change-Id: Ibf21ea0b6647865f38d04930ff1ccf6dc5377b29
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
2022-12-01 06:59:41 +00:00
Ziyi Cui
8d2a5bdcf7 [ DO NOT MERGE ] gs201-sepolicy: pixelstats: enable pixelstats access to temp-residency-metrics am: 2d4a9c02fc
Original change: https://googleplex-android-review.googlesource.com/c/device/google/gs201-sepolicy/+/20431038

Change-Id: I68342b66f1c1588f0b924531a9a23f8cce47c922
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
2022-12-01 06:59:37 +00:00
Ziyi Cui
30e01ffb8c [ DO NOT MERGE ] gs201-sepolicy: pixelstats: enable pixelstats access to perf-metrics
enable pixelstats access to sysfs path, define sysfs_perfmetrics

Bug: 227809911
Bug: 232541623
Test: Verified the existence of atom and correctness of resume latency, irq stats
Signed-off-by: Ziyi Cui <ziyic@google.com>
Change-Id: If1b95148b59a6816c6795921018dfae68d80550b
2022-12-01 06:31:22 +00:00
Ziyi Cui
521334a366 gs201-sepolicy:dumpstate: allow dumpstate access sysfs_vendor_metrics
Test: "adb bugreport" includes metrics capture.

Bug: 246799997
Signed-off-by: Ziyi Cui <ziyic@google.com>
Change-Id: I1c2f4aaf1cd875a37497ca8beacb555d39eeb51e
2022-12-01 06:27:22 +00:00
Ziyi Cui
2d4a9c02fc [ DO NOT MERGE ] gs201-sepolicy: pixelstats: enable pixelstats access to temp-residency-metrics
enable pixelstats access to sysfs path
Bug: 246799997
Test: Verified the existence of atom and correctness of atom stats
Signed-off-by: Ziyi Cui <ziyic@google.com>
Change-Id: I4a731d40a586e01c484cf95c57fb16a03f5e6ceb
2022-12-01 06:27:22 +00:00
Wasb Liu
c7f12f5aa9 hal_health_default: updated sepolicy am: 24cfe388c5
Original change: https://googleplex-android-review.googlesource.com/c/device/google/gs201-sepolicy/+/20476525

Change-Id: I31449984e30724ba883a04c16b179641f6d92cbc
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
2022-11-30 09:59:32 +00:00
Wasb Liu
24cfe388c5 hal_health_default: updated sepolicy
allow android.hardware.health service to access persist_battery_file

11-14 13:53:39.242   872   872 W android.hardwar: type=1400 audit(0.0:17): avc: denied { search } for name="battery" dev="sda1" ino=84 scontext=u:r:hal_health_default:s0 tcontext=u:object_r:persist_battery_file:s0 tclass=dir permissive=0

Bug: 258535661
Test: check for no avc denied on persist_battery_file
Change-Id: I7564b03339e17f9eea4aa5a8feda31bcfdd6100c
Signed-off-by: Wasb Liu <wasbliu@google.com>
2022-11-30 09:44:34 +00:00
Stephen Crane
9fb7618e6b Allow Trusty storageproxy property am: 5cd114d3a0
Original change: https://googleplex-android-review.googlesource.com/c/device/google/gs201-sepolicy/+/20545996

Change-Id: I76672b0e56c352e1991811bcaddac660fe05d0b7
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
2022-11-30 01:15:18 +00:00
Nicolas Geoffray
b84e18b8ae Merge "Allow ssr_detector_app writes to system_app_data_file." am: 073de4fba6 am: 0590da44cf
Original change: https://android-review.googlesource.com/c/device/google/gs201-sepolicy/+/2319817

Change-Id: I5c11172d6fb7b167500633ebba07c48281cd5296
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
2022-11-29 10:11:54 +00:00
Nicolas Geoffray
0590da44cf Merge "Allow ssr_detector_app writes to system_app_data_file." am: 073de4fba6
Original change: https://android-review.googlesource.com/c/device/google/gs201-sepolicy/+/2319817

Change-Id: I0e29c8a6435b71ff567d03572606cbcba3f76c1b
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
2022-11-29 09:43:15 +00:00
Nicolas Geoffray
073de4fba6 Merge "Allow ssr_detector_app writes to system_app_data_file." 2022-11-29 09:00:12 +00:00
Sandeep Dhavale
537b43c395 Add fastboot sepolicy changes to allow wiping of device am: 89f5fff668 am: 6f2812426a
Original change: https://android-review.googlesource.com/c/device/google/gs201-sepolicy/+/2316638

Change-Id: I129d2a7ab2effbcb93b15a21b539da1e11b8861f
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
2022-11-28 23:36:23 +00:00
Sandeep Dhavale
6f2812426a Add fastboot sepolicy changes to allow wiping of device am: 89f5fff668
Original change: https://android-review.googlesource.com/c/device/google/gs201-sepolicy/+/2316638

Change-Id: Ib362d72f41b9955e46350e45250c077c703a0734
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
2022-11-28 23:09:09 +00:00
Stephen Crane
5cd114d3a0 Allow Trusty storageproxy property
Allows the Trusty storageproxyd to set ro.vendor.trusty.storage.fs_ready
when the data filesystems are ready for use, and allows vendor init to
query and wait on this property.

Test: build, flash, test app loading
Bug: 258018785
Change-Id: I0b4f80371385bf0ddb0c44e81b1893bb80c7a63d
Merged-In: I0b4f80371385bf0ddb0c44e81b1893bb80c7a63d
2022-11-28 19:48:56 +00:00
Sandeep Dhavale
89f5fff668 Add fastboot sepolicy changes to allow wiping of device
With new AIDL fastboot service, wiping permissions need to be added
for hal_fastboot_default.

Bug: 260140380
Test: fastboot -w

Change-Id: I08e98461d0697d7539e14435acdacc3cc64eab3d
Signed-off-by: Sandeep Dhavale <dhavale@google.com>
2022-11-28 17:53:51 +00:00
Nicolas Geoffray
4293206c86 Allow ssr_detector_app writes to system_app_data_file.
Bug: 260557058
Test: m
Change-Id: Ibd028690a9d8661be8769d1b8f0c4e3a1f0fe985
2022-11-28 17:27:46 +00:00
Steve Pfetsch
f85b2edd47 gs201-sepolicy: provide permission for TouchInspector app [DO NOT MERGE] am: a2e6c51431
Original change: https://googleplex-android-review.googlesource.com/c/device/google/gs201-sepolicy/+/20521667

Change-Id: I60d8fcd79b4620a20b6c06d27a7286cd585676ce
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
2022-11-23 20:59:08 +00:00
Steve Pfetsch
a2e6c51431 gs201-sepolicy: provide permission for TouchInspector app [DO NOT MERGE]
Resolve these access violations:
avc: denied { write } for name="driver_test" dev="proc" ino=4026535572
scontext=u:r:platform_app:s0:c512,c768 tcontext=u:object_r:proc_touch:s0
tclass=file permissive=1 app=com.google.touch.touchinspector
avc: denied { open } for path="/proc/fts/driver_test" dev="proc"
ino=4026535572 scontext=u:r:platform_app:s0:c512,c768
tcontext=u:object_r:proc_touch:s0 tclass=file permissive=1
app=com.google.touch.touchinspector
avc: denied { getattr } for path="/proc/fts/driver_test" dev="proc"
ino=4026535572 scontext=u:r:platform_app:s0:c512,c768
tcontext=u:object_r:proc_touch:s0 tclass=file permissive=1
app=com.google.touch.touchinspector
avc: denied { read } for name="driver_test" dev="proc" ino=4026535572
scontext=u:r:platform_app:s0:c512,c768 tcontext=u:object_r:proc_touch:s0
tclass=file permissive=1 app=com.google.touch.touchinspector

avc: denied { open } for path="/proc/fts_ext/driver_test" dev="proc"
ino=4026535574 scontext=u:r:platform_app:s0:c512,c768
tcontext=u:object_r:proc_touch:s0 tclass=file permissive=1
app=com.google.touch.touchinspector
avc: denied { getattr } for path="/proc/fts_ext/driver_test" dev="proc"
ino=4026535574 scontext=u:r:platform_app:s0:c512,c768
tcontext=u:object_r:proc_touch:s0 tclass=file permissive=1
app=com.google.touch.touchinspector

Bug: 182118395
Signed-off-by: Steve Pfetsch <spfetsch@google.com>
Change-Id: Ia3bd2323b77134b8e47d858f36756780dec98c19
2022-11-22 23:48:19 +00:00
George Lee
0aa587a6e8 gs201-sepolicy: Add BrownoutDetection app [DO NOT MERGE] am: d59612c409
Original change: https://googleplex-android-review.googlesource.com/c/device/google/gs201-sepolicy/+/20468124

Change-Id: I453ce49a6e5794baba7a84b0ecc691ec8884b07f
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
2022-11-16 18:34:54 +00:00
George Lee
d59612c409 gs201-sepolicy: Add BrownoutDetection app [DO NOT MERGE]
This app files bugreport for user-debug build with reboot reason = ocp
or uvlo.  Removed the dependency on BetterBug.

Bug: 237287659
Test: Ensure bugreport is generated under user-debug build with reboot
reason = ocp or uvlo.
Signed-off-by: George Lee <geolee@google.com>
Change-Id: Ib8fceb62e66e9d561a6597687ea3cbe5ac9a832d
2022-11-16 18:20:57 +00:00
Minchan Kim
b16dcce743 dumpstate: allow dumpstate access pixel specific trace events am: 4baa8bea9c
Original change: https://googleplex-android-review.googlesource.com/c/device/google/gs201-sepolicy/+/20414645

Change-Id: Iee880e55f465d0a5e885778c3b5b055e43e98ba5
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
2022-11-14 19:20:40 +00:00
Minchan Kim
4baa8bea9c dumpstate: allow dumpstate access pixel specific trace events
At bugreport, it's useful to debug problems with having trace events.
Allow dumpstate access pixel trace event directory and files.

Test: "adb bugreport" includes trace event capture.
Bug: 238728493
Change-Id: Ia3fe7c149bfa0d0d192070ff28513384898af917
Signed-off-by: Minchan Kim <minchan@google.com>
2022-11-14 19:00:39 +00:00
Sandeep Dhavale
5eca847f64 Add sepolicy rules for fastboot AIDL service am: 25ea0f418a am: e1f3eb7802
Original change: https://android-review.googlesource.com/c/device/google/gs201-sepolicy/+/2293977

Change-Id: I0277ceac1dffc7fda32db324b68d14de6074b0ae
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
2022-11-10 19:24:35 +00:00
Sandeep Dhavale
e1f3eb7802 Add sepolicy rules for fastboot AIDL service am: 25ea0f418a
Original change: https://android-review.googlesource.com/c/device/google/gs201-sepolicy/+/2293977

Change-Id: I6b2c167429aa887acb2785b3bcbc7ef93852354d
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
2022-11-10 18:55:35 +00:00
Rick Chen
be24daebb8 Allow CHRE to use EPOLLWAKEUP [DO NOT MERGE] am: 8140a50845
Original change: https://googleplex-android-review.googlesource.com/c/device/google/gs201-sepolicy/+/20412548

Change-Id: I58f30ccee5a329ca8e523ab141a8c26b53eefed8
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
2022-11-09 16:09:12 +00:00
Rick Chen
8140a50845 Allow CHRE to use EPOLLWAKEUP [DO NOT MERGE]
avc: denied { block_suspend } for comm="UsfTransport" capability=36 scontext=u:r:chre:s0 tcontext=u:r:chre:s0 tclass=capability2 permissive=0

Bug: 238666865
Test: Check no chre avc denied.
Change-Id: Ie936055550c6221beae394c264d664c1e76f946b
Signed-off-by: Rick Chen <rickctchen@google.com>
2022-11-09 15:06:39 +00:00
Sandeep Dhavale
25ea0f418a Add sepolicy rules for fastboot AIDL service
Bug: 205760652
Test: Build & Flash

Change-Id: I02fe5ca6c0276fd08cf5127b7d8b7313374f0cfe
Signed-off-by: Sandeep Dhavale <dhavale@google.com>
2022-11-09 00:36:48 +00:00
George Lee
62ad032605 betterbug: Fixed sepolicy related to File [DO NOT MERGE] am: 8427e1db8d
Original change: https://googleplex-android-review.googlesource.com/c/device/google/gs201-sepolicy/+/20408115

Change-Id: I9f393278644f6f8075514c9ed0183e49dc23a30c
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
2022-11-08 15:37:55 +00:00
George Lee
8427e1db8d betterbug: Fixed sepolicy related to File [DO NOT MERGE]
Added File Attachment sepolicy for betterbug

Bug: 237287659
Test: Attach files from local directory and confirm it can be attached.
Signed-off-by: George Lee <geolee@google.com>
Change-Id: Ie2ee163794a4b955915a1b62b12d5aa625931034
2022-11-08 15:11:18 +00:00
Roger Fang
2cbcb987d0 [DO NOT MERGE] sepolicy: add permission for CCA rate of pixelstats-vend am: 35112bba62
Original change: https://googleplex-android-review.googlesource.com/c/device/google/gs201-sepolicy/+/20349111

Change-Id: Iec3b93d49714f78853a9b389a508e17673c2e764
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
2022-11-08 10:17:32 +00:00
Roger Fang
35112bba62 [DO NOT MERGE] sepolicy: add permission for CCA rate of pixelstats-vend
pixelstats-vend: type=1400 audit(0.0:7): avc: denied { read } for name="cca_rate_read_once" dev="sysfs" ino=100809 scontext=u:r:pixelstats_vendor:s0 tcontext=u:object_r:sysfs:s0 tclass=file permissive=0

Bug: 249225148
Test: Manually test passed

Change-Id: I802b79417cd9ce23386bb62eccb151610bfb8ac1
Signed-off-by: Roger Fang <rogerfang@google.com>
2022-11-08 09:53:37 +00:00
George Lee
0cdf1cfe9b betterbug: Fixed sepolicy related to mediaserver [DO NOT MERGE] am: 40be3818e1
Original change: https://googleplex-android-review.googlesource.com/c/device/google/gs201-sepolicy/+/20395514

Change-Id: Idff494bb1f32381d8a1db0dd137d5abe06f2a77e
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
2022-11-07 04:50:02 +00:00
George Lee
40be3818e1 betterbug: Fixed sepolicy related to mediaserver [DO NOT MERGE]
Added mediaserver sepolicy for betterbug

Bug: 237287659
Test: Run same video capture on Betterbug to confirm video can be
captured.
Signed-off-by: George Lee <geolee@google.com>
Change-Id: I5226bdbf9d4fccb991161bbe6ac4edf8fd3b15a7
2022-11-05 18:45:08 +00:00
Star Chang
f7f9aa1304 Add sepolicy for TWT to dumpstate am: f9552297fa
Original change: https://googleplex-android-review.googlesource.com/c/device/google/gs201-sepolicy/+/20118653

Change-Id: I7bb658e06b8e95be2933ac4ae45bd2e0208a851e
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
2022-11-04 02:10:03 +00:00
Star Chang
f9552297fa Add sepolicy for TWT to dumpstate
Bug: 253348062
Test: dump bugreport ok
Signed-off-by: Star Chang <starchang@google.com>
Change-Id: I0958fef496302df3f5e6e188f15117de78988a62
2022-11-04 01:31:19 +00:00
Puma Hsu
ea1be0c069 Add xhci-hcd-exynos.6 wakeup path for suspend_control am: 9877742035
Original change: https://googleplex-android-review.googlesource.com/c/device/google/gs201-sepolicy/+/20288288

Change-Id: I2083d21b860b0c6179427cd9972eafe47f292db1
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
2022-11-02 15:09:41 +00:00
Puma Hsu
9877742035 Add xhci-hcd-exynos.6 wakeup path for suspend_control
Bug: 255270480
Test: verified with forrest test build
Change-Id: I5e2eed4d5e20361d86f6d6be8c92ca337e4ee004
Signed-off-by: Puma Hsu <pumahsu@google.com>
2022-11-02 07:39:53 +00:00
Amith Dsouza
7fa80e3581 Fix untracked SELinux denials on boot am: be2e1b2ede am: 5653e43b44
Original change: https://android-review.googlesource.com/c/device/google/gs201-sepolicy/+/2280310

Change-Id: I6300bd318ffdfad334caa60b5e0ea286d0d503c7
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
2022-11-02 04:49:26 +00:00
Amith Dsouza
5653e43b44 Fix untracked SELinux denials on boot am: be2e1b2ede
Original change: https://android-review.googlesource.com/c/device/google/gs201-sepolicy/+/2280310

Change-Id: Ic521a8ea94ec22b17bf4a327c8244d0d04c269e5
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
2022-11-02 04:07:20 +00:00
Amith Dsouza
be2e1b2ede Fix untracked SELinux denials on boot
Error:
avc:  denied  { find } for interface=vendor.samsung_slsi.telephony.hardware.radioExternal::IOemSlsiRadioExternal sid=u:r:platform_app:s0:c512,c768 pid=2641 scontext=u:r:platform_app:s0:c512,c768 tcontext=u:object_r:hal_exynos_rild_hwservice:s0 tclass=hwservice_manager permissive=0

Bug: 254453654
Test: Flash device, rebuild driver blobs, check logs after boot

Change-Id: I43d524f781c1dda1d3d5291f661bc549fdbb99d6
2022-11-02 00:55:45 +00:00
pointerkung
4d803ef7d6 Add required sepolicy rule for Camera am: 0810814b49
Original change: https://googleplex-android-review.googlesource.com/c/device/google/gs201-sepolicy/+/20137924

Change-Id: I520c8b5c9321a87009f430bc673eb84fb9e3a9bf
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
2022-11-01 12:18:53 +00:00
pointerkung
0810814b49 Add required sepolicy rule for Camera
Grant access for TNR max_freq to let libperfmgr can control it via powerhint.

Bug: 243729855
Test: Build pass, GCA, Control TNR max_freq via powerhint
Change-Id: I8f8faa360d9908afe3fe0de3c322a2be356b86c8
2022-11-01 11:33:43 +00:00
Jenny Ho
fbec30a349 Add permission for logbuffer_bd am: 441a3ad3ef
Original change: https://googleplex-android-review.googlesource.com/c/device/google/gs201-sepolicy/+/20089144

Change-Id: I627644e45a2c28d6af8dd6e9493de8577bbcaee8
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
2022-11-01 06:08:54 +00:00