diff --git a/tracking_denials/bug_map b/tracking_denials/bug_map new file mode 100644 index 00000000..e69de29b diff --git a/tracking_denials/con_monitor_app.te b/tracking_denials/con_monitor_app.te index f0e7a439..e22d3c6d 100644 --- a/tracking_denials/con_monitor_app.te +++ b/tracking_denials/con_monitor_app.te @@ -15,3 +15,10 @@ dontaudit con_monitor_app tmpfs:file { execute }; dontaudit con_monitor_app tmpfs:file { map }; dontaudit con_monitor_app tmpfs:file { read }; dontaudit con_monitor_app tmpfs:file { write }; +# b/261933171 +dontaudit con_monitor_app dumpstate:fd { use }; +dontaudit con_monitor_app dumpstate:fifo_file { append }; +dontaudit con_monitor_app dumpstate:fifo_file { write }; +dontaudit con_monitor_app system_server:fifo_file { write }; +dontaudit con_monitor_app tombstoned:unix_stream_socket { connectto }; +dontaudit con_monitor_app tombstoned_java_trace_socket:sock_file { write }; diff --git a/tracking_denials/dumpstate.te b/tracking_denials/dumpstate.te new file mode 100644 index 00000000..04820cc0 --- /dev/null +++ b/tracking_denials/dumpstate.te @@ -0,0 +1,20 @@ +# b/261933169 +dontaudit dumpstate con_monitor_app:process { signal }; +dontaudit dumpstate default_android_service:service_manager { find }; +dontaudit dumpstate euiccpixel_app:process { signal }; +dontaudit dumpstate fuse:dir { search }; +dontaudit dumpstate hal_audio_default:binder { call }; +dontaudit dumpstate hal_confirmationui_default:binder { call }; +dontaudit dumpstate hal_graphics_composer_default:binder { call }; +dontaudit dumpstate hal_health_default:binder { call }; +dontaudit dumpstate modem_efs_file:dir { getattr }; +dontaudit dumpstate modem_img_file:dir { getattr }; +dontaudit dumpstate modem_img_file:filesystem { getattr }; +dontaudit dumpstate modem_userdata_file:dir { getattr }; +dontaudit dumpstate persist_file:dir { getattr }; +dontaudit dumpstate sysfs_scsi_devices_0000:file { getattr }; +dontaudit dumpstate sysfs_scsi_devices_0000:file { open }; +dontaudit dumpstate sysfs_scsi_devices_0000:file { read }; +dontaudit dumpstate system_data_file:dir { open }; +dontaudit dumpstate system_data_file:dir { read }; +dontaudit dumpstate vold:binder { call }; diff --git a/tracking_denials/euiccpixel_app.te b/tracking_denials/euiccpixel_app.te index d83c6a06..cb4a9f6d 100644 --- a/tracking_denials/euiccpixel_app.te +++ b/tracking_denials/euiccpixel_app.te @@ -54,3 +54,10 @@ dontaudit euiccpixel_app dck_prop:file { read }; dontaudit euiccpixel_app vendor_secure_element_prop:property_service { set }; # b/261651113 dontaudit euiccpixel_app dck_prop:file { map }; +# b/261933311 +dontaudit euiccpixel_app dumpstate:fd { use }; +dontaudit euiccpixel_app dumpstate:fifo_file { append }; +dontaudit euiccpixel_app dumpstate:fifo_file { write }; +dontaudit euiccpixel_app system_server:fifo_file { write }; +dontaudit euiccpixel_app tombstoned:unix_stream_socket { connectto }; +dontaudit euiccpixel_app tombstoned_java_trace_socket:sock_file { write }; diff --git a/tracking_denials/google_camera_app.te b/tracking_denials/google_camera_app.te new file mode 100644 index 00000000..51e2d710 --- /dev/null +++ b/tracking_denials/google_camera_app.te @@ -0,0 +1,5 @@ +# b/261933249 +dontaudit google_camera_app vendor_file:file { getattr }; +dontaudit google_camera_app vendor_file:file { map }; +dontaudit google_camera_app vendor_file:file { open }; +dontaudit google_camera_app vendor_file:file { read }; diff --git a/tracking_denials/hal_confirmationui_default.te b/tracking_denials/hal_confirmationui_default.te new file mode 100644 index 00000000..03253db1 --- /dev/null +++ b/tracking_denials/hal_confirmationui_default.te @@ -0,0 +1,3 @@ +# b/261933368 +dontaudit hal_confirmationui_default dumpstate:fd { use }; +dontaudit hal_confirmationui_default dumpstate:fifo_file { write }; diff --git a/tracking_denials/hal_dumpstate_default.te b/tracking_denials/hal_dumpstate_default.te index 09969df7..d52cf42f 100644 --- a/tracking_denials/hal_dumpstate_default.te +++ b/tracking_denials/hal_dumpstate_default.te @@ -4,3 +4,13 @@ dontaudit hal_dumpstate_default fs_type:file *; dontaudit hal_dumpstate_default file_type:dir *; dontaudit hal_dumpstate_default fs_type:dir *; dontaudit hal_dumpstate_default property_type:file *; +# b/261933251 +dontaudit hal_dumpstate_default hal_dumpstate_default:lockdown { integrity }; +dontaudit hal_dumpstate_default logbuffer_device:chr_file { getattr }; +dontaudit hal_dumpstate_default logbuffer_device:chr_file { open }; +dontaudit hal_dumpstate_default logbuffer_device:chr_file { read }; +dontaudit hal_dumpstate_default vndbinder_device:chr_file { ioctl }; +dontaudit hal_dumpstate_default vndbinder_device:chr_file { map }; +dontaudit hal_dumpstate_default vndbinder_device:chr_file { open }; +dontaudit hal_dumpstate_default vndbinder_device:chr_file { read }; +dontaudit hal_dumpstate_default vndbinder_device:chr_file { write }; diff --git a/tracking_denials/hal_graphics_composer_default.te b/tracking_denials/hal_graphics_composer_default.te index 628a9665..7aee4b35 100644 --- a/tracking_denials/hal_graphics_composer_default.te +++ b/tracking_denials/hal_graphics_composer_default.te @@ -52,3 +52,6 @@ dontaudit hal_graphics_composer_default vndbinder_device:chr_file { read }; dontaudit hal_graphics_composer_default vndbinder_device:chr_file { write }; dontaudit hal_graphics_composer_default vndservicemanager:binder { call }; dontaudit hal_graphics_composer_default vndservicemanager:binder { transfer }; +# b/261933075 +dontaudit hal_graphics_composer_default dumpstate:fd { use }; +dontaudit hal_graphics_composer_default dumpstate:fifo_file { write }; diff --git a/tracking_denials/hal_health_default.te b/tracking_denials/hal_health_default.te index d52efb4b..0405d7d1 100644 --- a/tracking_denials/hal_health_default.te +++ b/tracking_denials/hal_health_default.te @@ -17,3 +17,5 @@ dontaudit hal_health_default vendor_battery_defender_prop:file { map }; dontaudit hal_health_default vendor_battery_defender_prop:file { open }; dontaudit hal_health_default vendor_battery_defender_prop:file { read }; dontaudit hal_health_default vendor_battery_defender_prop:property_service { set }; +# b/261933135 +dontaudit hal_health_default dumpstate:fd { use }; diff --git a/tracking_denials/incidentd.te b/tracking_denials/incidentd.te index 6ca548f8..df9eb6b4 100644 --- a/tracking_denials/incidentd.te +++ b/tracking_denials/incidentd.te @@ -1,2 +1,5 @@ # b/259302023 dontaudit incidentd property_type:file *; +# b/261933310 +dontaudit incidentd debugfs_wakeup_sources:file { open }; +dontaudit incidentd debugfs_wakeup_sources:file { read }; diff --git a/tracking_denials/isolated_app.te b/tracking_denials/isolated_app.te new file mode 100644 index 00000000..b4b36a30 --- /dev/null +++ b/tracking_denials/isolated_app.te @@ -0,0 +1,5 @@ +# b/261933226 +dontaudit isolated_app vendor_file:file { getattr }; +dontaudit isolated_app vendor_file:file { map }; +dontaudit isolated_app vendor_file:file { open }; +dontaudit isolated_app vendor_file:file { read }; diff --git a/tracking_denials/kernel.te b/tracking_denials/kernel.te index 349f76fc..2a401319 100644 --- a/tracking_denials/kernel.te +++ b/tracking_denials/kernel.te @@ -8,3 +8,5 @@ dontaudit kernel vendor_fw_file:file { read }; dontaudit kernel vendor_regmap_debugfs:dir { search }; # b/261650972 dontaudit kernel vendor_battery_debugfs:dir { search }; +# b/261933155 +dontaudit kernel vendor_fw_file:file { getattr }; diff --git a/tracking_denials/logger_app.te b/tracking_denials/logger_app.te index 05167629..b2209713 100644 --- a/tracking_denials/logger_app.te +++ b/tracking_denials/logger_app.te @@ -32,3 +32,11 @@ dontaudit logger_app vendor_gps_prop:property_service { set }; dontaudit logger_app vendor_logger_prop:property_service { set }; # b/261783031 dontaudit logger_app vendor_gps_file:dir { open }; +# b/261933367 +dontaudit logger_app vendor_gps_file:dir { add_name }; +dontaudit logger_app vendor_gps_file:dir { write }; +dontaudit logger_app vendor_gps_file:file { append }; +dontaudit logger_app vendor_gps_file:file { create }; +dontaudit logger_app vendor_gps_file:file { getattr }; +dontaudit logger_app vendor_gps_file:file { read write open }; +dontaudit logger_app vendor_gps_file:file { setattr }; diff --git a/tracking_denials/mediaprovider_app.te b/tracking_denials/mediaprovider_app.te new file mode 100644 index 00000000..eba32571 --- /dev/null +++ b/tracking_denials/mediaprovider_app.te @@ -0,0 +1,3 @@ +# b/261933250 +#dontaudit mediaprovider_app vendor_file:file { open }; +#dontaudit mediaprovider_app vendor_file:file { read }; diff --git a/tracking_denials/priv_app.te b/tracking_denials/priv_app.te index 85b3527b..19f9af87 100644 --- a/tracking_denials/priv_app.te +++ b/tracking_denials/priv_app.te @@ -13,3 +13,8 @@ dontaudit priv_app euiccpixel_app:binder { transfer }; # b/260922442 dontaudit priv_app default_android_service:service_manager { find }; dontaudit priv_app euiccpixel_app:binder { transfer }; +# b/261933097 +dontaudit priv_app vendor_file:file { getattr }; +dontaudit priv_app vendor_file:file { map }; +dontaudit priv_app vendor_file:file { open }; +dontaudit priv_app vendor_file:file { read }; diff --git a/tracking_denials/untrusted_app.te b/tracking_denials/untrusted_app.te new file mode 100644 index 00000000..7f589d68 --- /dev/null +++ b/tracking_denials/untrusted_app.te @@ -0,0 +1,5 @@ +# b/261933428 +dontaudit untrusted_app vendor_file:file { getattr }; +dontaudit untrusted_app vendor_file:file { map }; +dontaudit untrusted_app vendor_file:file { open }; +dontaudit untrusted_app vendor_file:file { read }; diff --git a/tracking_denials/untrusted_app_30.te b/tracking_denials/untrusted_app_30.te new file mode 100644 index 00000000..7d9ac4b2 --- /dev/null +++ b/tracking_denials/untrusted_app_30.te @@ -0,0 +1,5 @@ +# b/261933227 +dontaudit untrusted_app_30 vendor_file:file { getattr }; +dontaudit untrusted_app_30 vendor_file:file { map }; +dontaudit untrusted_app_30 vendor_file:file { open }; +dontaudit untrusted_app_30 vendor_file:file { read };