Commit graph

586 commits

Author SHA1 Message Date
George Lee
f283938d32 bcl: Add Mitigation Logger - sepolicy am: bc2cf5c153
Original change: https://googleplex-android-review.googlesource.com/c/device/google/gs201-sepolicy/+/18527859

Change-Id: I1910b2fe519ce9e6706f827a310a8bc5996840d9
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
2022-05-27 18:06:00 +00:00
George Lee
bc2cf5c153 bcl: Add Mitigation Logger - sepolicy
Mitigation Logger logs battery related information for 1 second when it
is triggered by under voltage or over current interrupts.  Information
collected is to help debug system brownout.

Bug: 228383769
Test: Boot and Test
Signed-off-by: George Lee <geolee@google.com>
Change-Id: I9ac873d03d57d9a6db8d9233f25c8fabdfc399a5
2022-05-26 21:39:25 -07:00
eddielan
6d8175033d sepolicy: Add SW35 HIDL factory service into sepolicy am: 36a6b23804
Original change: https://googleplex-android-review.googlesource.com/c/device/google/gs201-sepolicy/+/18626554

Change-Id: Ib754baafed214f6d794a0646661e202af9534717
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
2022-05-27 04:33:14 +00:00
eddielan
36a6b23804 sepolicy: Add SW35 HIDL factory service into sepolicy
Bug: 231549391
Test: Build Pass
Change-Id: If5c1bc5ddf6a1fa753ac65b6b4c5983775f2f704
(cherry picked from commit aeb9bd0406)
Merged-In: If5c1bc5ddf6a1fa753ac65b6b4c5983775f2f704
2022-05-27 01:29:31 +00:00
Jaegeuk Kim
81d01513de Allow sysfs_devices_block to f2fs-tools
The fsck.f2fs checks the sysfs entries of block devices to get disk
information. Note that, the block device entries are device-specific.

1. fsck.f2fs
avc: denied { search } for comm="fsck.f2fs" name="0:0:0:0" dev="sysfs" ino=59803 scontext=u:r:fsck:s0 tcontext=u:object_r:sysfs_scsi_devices_0000:s0 tclass=dir permissive=0
avc: denied { getattr } for comm="fsck.f2fs" path="/sys/devices/platform/14700000.ufs/host0/target0:0:0/0:0:0:0/block/sda/sda7/partition" dev="sysfs" ino=60672 scontext=u:r:fsck:s0 tcontext=u:object_r:sysfs_scsi_devices_0000:s0 tclass=file permissive=0

2. mkfs.f2fs
avc: denied { search } for comm="make_f2fs" name="0:0:0:0" dev="sysfs" ino=59803 scontext=u:r:e2fs:s0 tcontext=u:object_r:sysfs_scsi_devices_0000:s0 tclass=dir permissive=0
avc: denied { getattr } for comm="make_f2fs" path="/sys/devices/platform/14700000.ufs/host0/target0:0:0/0:0:0:0/block/sda/sda8/partition" dev="sysfs" ino=61046 scontext=u:r:e2fs:s0 tcontext=u:object_r:sysfs_scsi_devices_0000:s0 tclass=file permissive=0

Bug: 233835698
Bug: 172377740
Signed-off-by: Jaegeuk Kim <jaegeuk@google.com>
Change-Id: I409feec84565f965baa96b06a5b08bcfc1a8db02
2022-05-25 15:32:42 +00:00
Yichi Chen
a97b993989 RRS: Apply the default config from persist prop am: 8b2c6f8187
Original change: https://googleplex-android-review.googlesource.com/c/device/google/gs201-sepolicy/+/18401056

Change-Id: Ib8c99b725dba0f61071398c8310ed4cf3a29163b
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
2022-05-24 13:46:18 +00:00
Yichi Chen
8b2c6f8187 RRS: Apply the default config from persist prop
vendor_config plays as another role to control the display config during
the boot time. To change the default configuration of the user selected
mode, we use persist config to store the value.

Bug: 232721840
Test: Boot w/ and w/o user selected configs and check the resolution
Change-Id: Ideed75f0a29368ff95916fb1fa87f21482c17613
2022-05-24 13:06:41 +00:00
Badhri Jagan Sridharan
d602aeb132 Allow gadget hal to search i2c dir and write to usb_limit_accessory_enable am: 91a1f49a8a am: 3cd3ddeefb
Original change: https://googleplex-android-review.googlesource.com/c/device/google/gs201-sepolicy/+/18553772

Change-Id: I5626582f7b17fa0e54d0805fe37e013523f44a78
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
2022-05-24 04:09:18 +00:00
Badhri Jagan Sridharan
e2e17adce5 Allow gadget hal to search i2c dir and write to usb_limit_accessory_enable am: 91a1f49a8a am: 08ccaeb6ab
Original change: https://googleplex-android-review.googlesource.com/c/device/google/gs201-sepolicy/+/18553772

Change-Id: I47ec625754070e8c70beb9d90e4824b23c42610d
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
2022-05-24 01:24:30 +00:00
Badhri Jagan Sridharan
08ccaeb6ab Allow gadget hal to search i2c dir and write to usb_limit_accessory_enable am: 91a1f49a8a
Original change: https://googleplex-android-review.googlesource.com/c/device/google/gs201-sepolicy/+/18553772

Change-Id: I31d103ab14fb4cf3e2eafc14d88196a9309bcb72
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
2022-05-24 01:01:25 +00:00
Badhri Jagan Sridharan
3cd3ddeefb Allow gadget hal to search i2c dir and write to usb_limit_accessory_enable am: 91a1f49a8a
Original change: https://googleplex-android-review.googlesource.com/c/device/google/gs201-sepolicy/+/18553772

Change-Id: I1291a53be19b8e1e355aad50e0e4c84344a7443c
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
2022-05-24 00:56:03 +00:00
Badhri Jagan Sridharan
91a1f49a8a Allow gadget hal to search i2c dir and write to usb_limit_accessory_enable
auditd  : type=1400 audit(0.0:4): avc: denied { search } for comm="HwBinder:879_1"
name="10d60000.hsi2c" dev="sysfs" ino=23606 scontext=u:r:hal_usb_gadget_impl:s0
tcontext=u:object_r:sysfs_batteryinfo:s0 tclass=dir permissive=0

Bug: 206635552
Signed-off-by: Badhri Jagan Sridharan <badhri@google.com>
Change-Id: Ibc4ec27ad7d1b7a26c9935aa0c4aff5f03a8d59c
2022-05-23 23:59:44 +00:00
Dinesh Yadav
9e2930ae12 Add SEPolicy for gxp_metrics_logger.so logging to stats service am: 6513479fe8
Original change: https://googleplex-android-review.googlesource.com/c/device/google/gs201-sepolicy/+/18482687

Change-Id: I172bb36fa05aa7bff9baf2c864c134a6b942519e
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
2022-05-20 17:24:21 +00:00
Dinesh Yadav
6513479fe8 Add SEPolicy for gxp_metrics_logger.so logging to stats service
In order to access the gxp metrics library from the google camera
app (product partition), we need to create an SELinux exception for
the related shared library (in vendor) it uses.
This CL adds the same_process_hal_file tag to allow this exception.

Bug: 177236353

Test: App can load the .so and creates a VLOG message after this change.
Before: No permission to access namespace.
After: GCA able to access the gxp_metrics_logger.so
Change-Id: I453b66b30eb51ebd22fda750d272cf35574301f6
Signed-off-by: Dinesh Yadav <dkyadav@google.com>
2022-05-20 17:05:23 +00:00
Jacqueline Wong
431dadf5fd be able to dump coredump am: c169cd75ce
Original change: https://googleplex-android-review.googlesource.com/c/device/google/gs201-sepolicy/+/18485733

Change-Id: Ia515d657c4a626f0722cc4cfa991e06e2bfe5fd1
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
2022-05-19 23:31:57 +00:00
Dinesh Yadav
d668e27252 Add SEPolicy settings for android logging/tracing service for GXP am: e40cd2ac42
Original change: https://googleplex-android-review.googlesource.com/c/device/google/gs201-sepolicy/+/18155927

Change-Id: I05d7ceee3b7e7c08098e9ea62531b60928a7d711
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
2022-05-19 07:57:36 +00:00
Nishok Kumar S
e828f4b81f Add label for GCA fishfood app built with debug keys - label as am: 43e827c01a
Original change: https://googleplex-android-review.googlesource.com/c/device/google/gs201-sepolicy/+/18403423

Change-Id: Idaf0347c250257220eccdd80d923c322fba0e85c
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
2022-05-19 07:57:02 +00:00
Jacqueline Wong
c169cd75ce be able to dump coredump
Bug: 218358165
Test: adb root; adb remount -R; adb bugreport
Signed-off-by: Jacqueline Wong <jacqwong@google.com>
Change-Id: I42c2db7902064e1508676ad93def2e0e4f5c2b28
2022-05-19 05:37:50 +00:00
Dinesh Yadav
e40cd2ac42 Add SEPolicy settings for android logging/tracing service for GXP
This change also adds support for SEPolicy to access perfetto which was
missing in ag/17818623.

Bug: 217289052

Change-Id: Ic5599d0be783b65102b3b0ffef27e66f1f6904da
2022-05-19 03:31:32 +00:00
Nishok Kumar S
43e827c01a Add label for GCA fishfood app built with debug keys - label as
debug_camera_app.

Test: Build GCA-Next manually and install on device. Test with selinux
on.
Bug: 230773733

Change-Id: Ifc2fd29a74bf66444501327feac391ddf812c867
2022-05-17 02:42:05 +00:00
George Lee
654a7cdf85 dumpstate: Add BCL mitigation info to user build am: b6971e353f
Original change: https://googleplex-android-review.googlesource.com/c/device/google/gs201-sepolicy/+/18408238

Change-Id: Ice2833b22caf809ce7139b90b223a6ebf4bee756
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
2022-05-17 01:38:02 +00:00
George Lee
b6971e353f dumpstate: Add BCL mitigation info to user build
Bug: 232793927
Test: Confirm user build bugreport has mitigation info
Signed-off-by: George Lee <geolee@google.com>
Change-Id: I9945a0f005bee6e25580c122df4c8932607fa51a
2022-05-17 00:42:57 +00:00
Austin Wang
f2336f95c4 Add P22 reverse wireless charging selinux policy am: e5f8377849 am: 46d2740350
Original change: https://googleplex-android-review.googlesource.com/c/device/google/gs201-sepolicy/+/18350566

Change-Id: Ic2fed4e290d198298ad28a7a74112df4b73e1c89
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
2022-05-13 10:40:14 +00:00
Austin Wang
eb52e384fc Add P22 reverse wireless charging selinux policy am: e5f8377849 am: 53a167fcf0
Original change: https://googleplex-android-review.googlesource.com/c/device/google/gs201-sepolicy/+/18350566

Change-Id: I950f1f224cd77942d3718d040f3dce41dfc157b9
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
2022-05-13 10:39:59 +00:00
Automerger Merge Worker
032ce42cd3 Merge "Allow mediacodec to access vendor_data_file am: 95845654bf am: 65993e19e8" into tm-d1-dev-plus-aosp 2022-05-13 10:39:55 +00:00
Jerry Huang
b9d25e06d8 Allow mediacodec to access vendor_data_file am: 95845654bf am: dafeb57668
Original change: https://googleplex-android-review.googlesource.com/c/device/google/gs201-sepolicy/+/18188091

Change-Id: Id370dfbcc5081e085db3844edd7893ab1aa8b031
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
2022-05-13 10:39:52 +00:00
Jerry Huang
d217f9119f Allow mediacodec to access vendor_data_file am: 95845654bf am: 65993e19e8
Original change: https://googleplex-android-review.googlesource.com/c/device/google/gs201-sepolicy/+/18188091

Change-Id: I783c7a21ff21f490367777f05db80ea23fe4228a
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
2022-05-13 10:39:51 +00:00
Austin Wang
53a167fcf0 Add P22 reverse wireless charging selinux policy am: e5f8377849
Original change: https://googleplex-android-review.googlesource.com/c/device/google/gs201-sepolicy/+/18350566

Change-Id: I92b12dd3c05b50244e3c67667ba2296fcf62fd1a
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
2022-05-13 09:49:54 +00:00
Jerry Huang
dafeb57668 Allow mediacodec to access vendor_data_file am: 95845654bf
Original change: https://googleplex-android-review.googlesource.com/c/device/google/gs201-sepolicy/+/18188091

Change-Id: I4fd8e3a631a441dfedf06300f5f619706f7b75c8
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
2022-05-13 09:49:28 +00:00
Austin Wang
46d2740350 Add P22 reverse wireless charging selinux policy am: e5f8377849
Original change: https://googleplex-android-review.googlesource.com/c/device/google/gs201-sepolicy/+/18350566

Change-Id: Ic38aa173a3363c726149086343ea53903e04c235
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
2022-05-13 09:48:22 +00:00
Jerry Huang
65993e19e8 Allow mediacodec to access vendor_data_file am: 95845654bf
Original change: https://googleplex-android-review.googlesource.com/c/device/google/gs201-sepolicy/+/18188091

Change-Id: Ieb6ddf76f46e735e1a89c85c7221863bbe61bef9
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
2022-05-13 09:47:44 +00:00
Nishok Kumar S
ebb393aac0 Use google_camera_app label for GCA-Next fishfood app. am: 145f7b5b93
Original change: https://googleplex-android-review.googlesource.com/c/device/google/gs201-sepolicy/+/18344645

Change-Id: I72867e1f8262f1868e231ef5bbd43fc154853360
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
2022-05-13 09:39:37 +00:00
Nishok Kumar S
f021ddaf55 Label GCA-Eng app am: 4a6cfb5a9c
Original change: https://googleplex-android-review.googlesource.com/c/device/google/gs201-sepolicy/+/18331264

Change-Id: I22f1a5efcc4263ae03165effa7f69e0f09f196a5
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
2022-05-13 09:39:36 +00:00
Austin Wang
e5f8377849 Add P22 reverse wireless charging selinux policy
Allow Settings to call hal_wlc

Error:

05-13 09:28:20.508  1000  7293  7293 W ndroid.settings: type=1400 audit(0.0:29): avc: denied { call } for scontext=u:r:system_app:s0 tcontext=u:r:hal_wlc:s0 tclass=binder permissive=0

Bug: 231420451
Test: Enable battery share from settings and charge another device.
Change-Id: Ic761bee47ea41f6db8b1838fb3fc2a9f7ef7bb5c
2022-05-13 09:28:03 +00:00
Jerry Huang
95845654bf Allow mediacodec to access vendor_data_file
For dumping output buffer of HDR to SDR fliter.

This patch fixes the following denial:

05-10 21:42:49.427   890   890 W HwBinder:890_4: type=1400 audit(0.0:2944): avc: denied { search } for name="data" dev="dm-41" ino=105 scontext=u:r:mediacodec_samsung:s0 tcontext=u:object_r:system_data_file:s0:c512,c768 tclass=dir permissive=0

05-10 21:42:49.499   890   890 W HwBinder:890_4: type=1400 audit(0.0:2946): avc: denied { getattr } for name="/" dev="dmabuf" ino=1 scontext=u:r:mediacodec_samsung:s0 tcontext=u:object_r:unlabeled:s0 tclass=filesystem permissive=0

05-10 21:46:27.735   885   885 W google.hardware: type=1400 audit(0.0:3198): avc: denied { search } for name="data" dev="dm-41" ino=105 scontext=u:r:mediacodec_google:s0 tcontext=u:object_r:system_data_file:s0:c512,c768 tclass=dir permissive=0

05-10 21:46:27.795   885   885 W google.hardware: type=1400 audit(0.0:3200): avc: denied { getattr } for name="/" dev="dmabuf" ino=1 scontext=u:r:mediacodec_google:s0 tcontext=u:object_r:unlabeled:s0 tclass=filesystem permissive=0

Bug: 229360116
Test: atest android.media.decoder.cts.DecoderTest
Change-Id: I11403b20e8608f50907db561b8232b1b64bea298
2022-05-13 09:24:38 +00:00
Nishok Kumar S
145f7b5b93 Use google_camera_app label for GCA-Next fishfood app.
Bug: 230773733
Test: Build selinux and test with GCA-Next on device.
Change-Id: I757e7de2293e25bd027262a5fbf4ece2a44f10d1
2022-05-13 05:31:34 +00:00
Nishok Kumar S
4a6cfb5a9c Label GCA-Eng app
- Add policies for GCA-Eng to access GXP device.
 - Allow GCA-Eng to access edgetpu service.

Test: Build selinux and test GCA-Eng on device with
      adb shell setprop camera.artemis_dsp TRUE

Bug: 230773733
Change-Id: I8d04f6e1aef0899b3862ddbb80174cd086156d92
2022-05-13 05:18:09 +00:00
Kris Chen
2f711e875f Allow hal_fingerprint_default to access hal_pixel_display_service am: 3162407210
Original change: https://googleplex-android-review.googlesource.com/c/device/google/gs201-sepolicy/+/18013067

Change-Id: I43f89e4465035e5f5aa2797007d419ae1d2040c2
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
2022-05-05 02:35:13 +00:00
Kris Chen
3162407210 Allow hal_fingerprint_default to access hal_pixel_display_service
Fix the following avc denial:
avc: denied { find } for pid=1158 uid=1000 name=com.google.hardware.pixel.display.IDisplay/default scontext=u:r:hal_fingerprint_default:s0 tcontext=u:object_r:hal_pixel_display_service:s0 tclass=service_manager permissive=0
avc: denied { call } for scontext=u:r:hal_fingerprint_default:s0 tcontext=u:r:hal_graphics_composer_default:s0 tclass=binder permissive=0

Bug: 229716695
Bug: 224573604
Test: build and test fingerprint on device
Change-Id: I104af7f50715090fe0c2aa6845848bf77ab3e3ae
2022-05-05 02:03:43 +00:00
Jenny Ho
ff33c561a8 sepolicy: allow access debugfs charger register dump am: 5e426a95d0
Original change: https://googleplex-android-review.googlesource.com/c/device/google/gs201-sepolicy/+/18013064

Change-Id: Ie517da7264b8a3fdc7652f80f07c7a0584718cdc
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
2022-05-03 07:17:46 +00:00
Jenny Ho
5e426a95d0 sepolicy: allow access debugfs charger register dump
Bug: 230360103
Signed-off-by: Jenny Ho <hsiufangho@google.com>
Change-Id: Ieedff4d6475706d4d932913e6d647ca401e56966
2022-05-03 06:54:05 +00:00
Labib
22388f50f5 Give RadioExt permission to write to sysfs node am: 4c8dbb65b8 am: 177a3796e8
Original change: https://googleplex-android-review.googlesource.com/c/device/google/gs201-sepolicy/+/17981512

Change-Id: Iae1bb5c50d3c31c55620b5d1460260142404e1ce
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
2022-05-03 05:42:07 +00:00
Labib
9a185b7f49 Give RadioExt permission to write to sysfs node am: 4c8dbb65b8 am: 7f89bf6be8
Original change: https://googleplex-android-review.googlesource.com/c/device/google/gs201-sepolicy/+/17981512

Change-Id: I6033a5d87e2849d39198ba58b9889c9f07fa4895
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
2022-05-03 05:30:50 +00:00
Labib
177a3796e8 Give RadioExt permission to write to sysfs node am: 4c8dbb65b8
Original change: https://googleplex-android-review.googlesource.com/c/device/google/gs201-sepolicy/+/17981512

Change-Id: Iec721cea68d7eae8715537b887911c0f848e1e6d
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
2022-05-03 05:07:36 +00:00
Labib
7f89bf6be8 Give RadioExt permission to write to sysfs node am: 4c8dbb65b8
Original change: https://googleplex-android-review.googlesource.com/c/device/google/gs201-sepolicy/+/17981512

Change-Id: Ia21d71094878ef44659873ecb813e7c4dffafb8b
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
2022-05-03 05:05:01 +00:00
Labib
4c8dbb65b8 Give RadioExt permission to write to sysfs node
Bug: 212601547
Test: Manual
Change-Id: I8c7341833aeacebfedba6e8e05d2696012043d32
2022-04-28 16:58:34 +08:00
Wei Wang
8b0b46b1c3 allow udfps hal to access trusty am: d85f93ec30
Original change: https://googleplex-android-review.googlesource.com/c/device/google/gs201-sepolicy/+/17992165

Change-Id: Ic4125cc7f4b34be8562db31019be2ee8d7e27b14
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
2022-04-28 01:15:51 +00:00
Wei Wang
d85f93ec30 allow udfps hal to access trusty
Bug: 229350721
Bug: 230492593
Test: UDFPS with stress
Signed-off-by: Wei Wang <wvw@google.com>
Change-Id: Ib1abe0e0318689528a6658f3597f1c11ad9fa1c3
2022-04-27 13:20:02 -07:00
Stephane Lee
3237df5318 Fix permissions for ODPM permanently by adding all buses am: 85e5caf85e
Original change: https://googleplex-android-review.googlesource.com/c/device/google/gs201-sepolicy/+/17966244

Change-Id: I58f62d4a9949a0c518b1f1b5f79889eda7fbcaf2
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
2022-04-27 01:27:33 +00:00
Stephane Lee
28bb996e11 Allow hal_thermal_default to read iio/odpm sysfs nodes am: a492311ba4
Original change: https://googleplex-android-review.googlesource.com/c/device/google/gs201-sepolicy/+/17966242

Change-Id: Iddd9e9e9500f5ac43d06f460b08632d9a66bd85e
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
2022-04-27 01:27:32 +00:00