Commit graph

152 commits

Author SHA1 Message Date
Treehugger Robot
cd06811f33 Merge "Update sepolicy for nfc antenna selftest values" into main 2024-09-24 07:34:38 +00:00
Tej Singh
f03cc7ce1c Make android.framework.stats-v2-ndk app reachable
For libedgetpu

Test: TH
Bug: 354763040
Flag: EXEMPT bugfix
Change-Id: I1c2fb12e09ffe8083d6b14b0ee5aa957e031ddf3
2024-09-20 21:39:59 -07:00
Nattharat Jariyanuntanaet
1492b4913a Update sepolicy for nfc antenna selftest values
Allow persist.vendor.nfc.antenna. to be vendor public values for NFC
companion app to access from userdebug or eng builds

avc:  denied  { read } for  name="u:object_r:vendor_nfc_antenna_prop:s0" dev="tmpfs" ino=414 scontext=u:r:untrusted_app:s0:c79,c257,c512,c768 tcontext=u:object_r:vendor_nfc_antenna_prop:s0 tclass=file permissive=0 app=com.google.android.apps.internal.nfcassistancetool

Bug: 361050657
Test: m selinux_policy
Flag: NONE add permission
Change-Id: I47c54642dbc801dfcaee8330e75a29d11030337c
2024-09-12 20:17:39 +00:00
Daniel Chapin
6d6f71b74a Revert "trusty: storageproxy: add fs_ready_rw property context"
Revert submission 28318041-rw_storage

Reason for revert: Droidfood blocking bug b/355163562

Reverted changes: /q/submissionid:28318041-rw_storage

Change-Id: I0fa3edda88677966d42576d76616b837a4bbe70b
2024-07-24 20:17:33 +00:00
Mike McTernan
49c9c8c3d7 trusty: storageproxy: add fs_ready_rw property context
Flag: EXEMPT bug fix
Bug: 350362101
Test: ABTD
Change-Id: I397a89ceb5a6a832043abb3792b0101ad89c97a7
2024-07-15 10:13:47 +01:00
Kelvin Zhang
c1341de4c3 Add necessary sepolicy for ro.vendor.persist.status
This prop will be set to "mounted" after /mnt/vendor/persist mounts.
Need this prop to synchronize different actions in init.rc script.

Test: th
Bug: 319335586
Change-Id: I9e8bd5e875956393d610b7def6be713565543d05
2024-04-22 10:14:12 -07:00
Krzysztof Kosiński
d4f04d19cc Remove rlsservice sepolicy. am: 41c22587a2
Original change: https://googleplex-android-review.googlesource.com/c/device/google/zuma-sepolicy/+/26948256

Change-Id: I60d0c43786dc869f9d69ce7c95e2199652efda3a
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
2024-04-15 21:58:31 +00:00
Krzysztof Kosiński
41c22587a2 Remove rlsservice sepolicy.
rlsservice is not included on zuma and later, only gs101/gs201.
Relevant code search link:
https://source.corp.google.com/h/googleplex-android/platform/superproject/main/+/main:vendor/google/services/LyricCameraHAL/src/apex/Android.bp;l=26;drc=e4b49a6d945df6d5210c35251de8046b162d799d

Bug: 278627483
Test: presubmit
Change-Id: I15398ddeea8c0a10920c987e55789ba4a8322774
2024-04-12 22:03:22 +00:00
Yabin Cui
3694b1a7f1 Add SOC specific ETE sysfs paths
Also remove deprecated ETE sysfs paths.

Bug: 321061072
Test: run profcollectd on device
Change-Id: If56e9c4c51dc0e5f3f36e8c80671d67e910510c9
2024-03-07 19:53:47 +00:00
Thiébaud Weksteen
97a16aff57 Revert^2 "Remove persist.bootanim.color property definitions"
7b238e3659

Change-Id: I56143303453cce01d812997ed4a06d815f2a6859
2024-02-25 23:59:26 +00:00
Rubin Xu
7b238e3659 Revert "Remove persist.bootanim.color property definitions"
Revert submission 26301396-bootanim_prop

Reason for revert: DroidMonitor-triggered revert due to breakage https://android-build.corp.google.com/quarterdeck/?branch=git_main&target=sdk_goog3_x86_64-trunk_staging-userdebug&lkgb=11487950&lkbb=11488141&fkbb=11488141

Bug: 326521604

Reverted changes: /q/submissionid:26301396-bootanim_prop

Change-Id: Icad6e80687cd7cd2085018bca226b5f38f25db25
2024-02-23 12:25:54 +00:00
Thiébaud Weksteen
f75e76f913 Remove persist.bootanim.color property definitions
These now belong to the platform policy.

Bug: 321088135
Test: build
Change-Id: Ie7fcd37eeb176334e36a86d6ad3d66f42c1b841e
2024-02-21 13:47:43 +11:00
Randall Huang
60b467ac40 Move sg_device related policy
Bug: 312582937
Test: make selinux_policy
Change-Id: Ic6e1f6228764cd2ddc96d574a10838ca4bc05332
Signed-off-by: Randall Huang <huangrandall@google.com>
2023-11-22 14:21:06 +08:00
Rick Chen
587903f7c4 sensors: Move USF related sepolicy to gs-common.
Bug: 305120274
Test: Compile pass. Flash the build to ZUMA devices and no sensor
      related avc denied log.
Change-Id: I6911992b59802b62ffd206fd53e678da65ef1363
Signed-off-by: Rick Chen <rickctchen@google.com>
2023-11-06 23:20:16 +08:00
Treehugger Robot
64c085cfab Merge "Add required sepolicy rule for Camera" into udc-qpr-dev 2023-09-14 03:20:33 +00:00
Pointer Kung
be9c098a46 Add required sepolicy rule for Camera
Grant access for TNR max_freq to let libperfmgr can control it via powerhint.

Bug: 298595475
Test: adb shell cat cur_freq, GCA, CTS
Change-Id: Ibea9d8b60a41802ba7d685daa591471a9e8cbd91
2023-09-12 09:16:01 +00:00
Tai Kuo
1a65e5d5e4 Allow regmap debugfs for drivers probed by insmod
auditd  : type=1400 audit(0.0:731): avc:  denied  { search } for
comm="modprobe" name="regmap" dev="debugfs" ino=2057
scontext=u:r:insmod-sh:s0 tcontext=u:object_r:vendor_regmap_debugfs:s0
tclass=dir permissive=1 bug=b/274727542

vendor_kernel_boot and vendor_dlkm modules probe by insmod need this.
Move regmap debugfs from legacy/whitechapel_pro/ to vendor/.

Bug: 274727542
Bug: 289012421
Test: ls -d /sys/kernel/debug/regmap/*-0043
Change-Id: I2bd35a6bc942536505f62d4122f0de892f243802
2023-09-12 16:45:09 +08:00
Hasan Awais
14b2c135bb uwb: add permissions for factory uwb calib file
needed for copying the factory calib file from persist to
/data/vendor/uwb, along with converting the file to a valid format
for uwb HAL

Bug: 274513871
Bug: 279820265
Test: local build passed
Change-Id: I4c4286cd5c200475cac3b9d58a81724d631c49e0
Signed-off-by: Hasan Awais <hasanawais@google.com>
2023-05-09 00:27:47 +00:00
Tom Huang
dd5df5791f Merge "Add hidraw device sepolicy for headtracking" into udc-d1-dev 2023-05-02 04:07:15 +00:00
martinwu
09aaf3dfbc [TSV2] Add sepolicy for dumpstate to zip tcpdump into bugreport
Bug: 264490014
Test: 1. Enable tcpdump_logger always-on function
      2. Dump bugreport
      3. Pull dumpstate_board.bin and chagne it to zip
      4. Unzip dumpstate_board.zip and check if tcpdump files
         are there.
Change-Id: I45c894fa9378a7878bc853f7723162ebd6141115
2023-04-27 13:47:34 +00:00
Carol Cheng
bb1f0f25bb Merge "Revert "Add sepolicy for dumpstate to zip tcpdump into bugreport"" into udc-d1-dev 2023-04-27 06:36:48 +00:00
Martin Wu
4e2023c263 Revert "Add sepolicy for dumpstate to zip tcpdump into bugreport"
Revert submission 22814097-Fix-tcpdump-sepolicy

Reason for revert: build break

Reverted changes: /q/submissionid:22814097-Fix-tcpdump-sepolicy

Change-Id: I795de89a17c5ccee702fa3a59af03d48d89fbaf2
2023-04-27 02:21:00 +00:00
Treehugger Robot
fe27339606 Merge "Add sepolicy for dumpstate to zip tcpdump into bugreport" into udc-d1-dev 2023-04-27 01:43:58 +00:00
martinwu
da1f9ffa79 Add sepolicy for dumpstate to zip tcpdump into bugreport
Bug: 264490014
Test: 1. Enable tcpdump_logger always-on function
      2. Dump bugreport
      3. Pull dumpstate_board.bin and chagne it to zip
      4. Unzip dumpstate_board.zip and check if tcpdump files
         are there.
Change-Id: I04ca96860c78baf24afd7deecff7dd4d470d9539
2023-04-26 14:17:56 +00:00
kuanyuhuang
477d58d695 Add hidraw device sepolicy for headtracking
Test: make and incoming HID data from Pixel Buds Pro
Bug: 276163506
Change-Id: I10833e215962ad007ad32a0d713e9b37ae888fdb
2023-04-26 09:20:11 +00:00
Andrew Chant
55ef8a9026 Allow InputProcessor HAL to read display resolution
Cherry-pick of Change I23285c21a82748c63fbe20988af42884b9261b66
from Siarhei Vishniakou <svv@google.com>:

Currently, there's no API to read the resolution from the system domain,
so the HAL has to read this from the sysprop provided by the display
code.

Allow the HAL to do so in this CL.

Bug: 236200710
Bug: 279510160
Change-Id: I449232d91533b6b9a40f2a6c4a91c511f5b38e3c
2023-04-24 16:59:04 -07:00
Bruno BELANYI
cd905228d1 Move ARM runtime option SELinux rules out of 'legacy/'
Addressing some review feedback on ag/22381542 about this folder being
removed in the future.

Bug: b/272740524
Test: CtsDeqpTestCases (dEQP-VK.protected_memory.stack.stacksize_*)
Change-Id: I8506da9b80fe060cd5093acafd58594e4db3341b
2023-04-14 09:20:40 +00:00
Bruno BELANYI
1337c54005 Use restricted vendor property for ARM runtime options
They need to be read by everything that links with libmali, but we don't
expect anybody to actually write to them.

Bug: b/272740524
Test: CtsDeqpTestCases (dEQP-VK.protected_memory.stack.stacksize_*)
Change-Id: I7f6f021378467484544cc3dbbe71a8e9e037cf98
2023-04-14 08:33:48 +00:00
Yixuan Wang
1095231e38 Add hal_contexthub_default to zuma sepolicy; Remove dontaudit rules for
chre

[ 7.760870] type=1400 audit(1669944054.440:61): avc: denied { write } for comm="android.hardwar" name="chre" dev="tmpfs" ino=1099 scontext=u:r:hal_contexthub_default:s0 tcontext=u:object_r:chre_socket:s0 tclass=sock_file permissive=1
[ 12.519414] type=1400 audit(1669944059.196:138): avc: denied {connectto } for comm="android.hardwar" path="/dev/socket/chre"scontext=u:r:hal_contexthub_default:s0 tcontext=u:r:chre:s0 tclass=unix_stream_socket permissive=1

Bug: 264489794
Bug: 261105224
Test: atest scanAvcDeniedLogRightAfterReboot
Change-Id: I7bf13913188deedc987f82e54626a18357ab84c5
2023-04-13 06:43:41 +00:00
Wilson Sung
c2eedff70c Add recovery related policy
Fix: 275143841
Fix: 264490092
Test: adb sideload and no avc error
Change-Id: I52003c9417560a6c5dab815a6929681710f0b0a4
2023-04-12 03:46:54 +08:00
Wilson Sung
6acea9d647 Move OTA context out of legacy folder
Bug: 275143841
Test: OTA
Change-Id: I4774b7c48c075afc1b02d8c34fded212cd0efffb
2023-03-27 11:44:51 +08:00
Dinesh Yadav
84aa699ac8 Add certificate & label for GCA-ENG & GCA-Next
This commit makes following changes:
- Add selinux policies for GCA-Eng & GCA-Next to access GXP device &
edgetpu services.
- Refactor code to push policies for Google Camera app from
legacy/whitechapel_pro/* to vendor/*

Tested:
- flashed both GCA-Eng & GCA-Next apps and observed no crashes due to gxp or edgetpu.
- scontext changed from "untrusted_app_32" to "debug_camera_app" in both cases.

Bug: 264490031
Change-Id: I51f69168eebd6c7e54e512b7abde8dd6bbe7c443
Signed-off-by: Dinesh Yadav <dkyadav@google.com>
2023-03-24 12:56:53 +00:00
TreeHugger Robot
03d439f0e1 Merge "change device type for /dev/stmvl53l1_ranging" into udc-d1-dev 2023-03-22 02:36:37 +00:00
Joerg Wagner
6351914802 Merge "Update Mali DDK to r40 : Additional SELinux settings" into udc-d1-dev 2023-03-21 14:36:16 +00:00
JimiChen
ee1df407be change device type for /dev/stmvl53l1_ranging
It was a rls_device. Move to lwis_device now.

Bug: 274552433
Test: launch GCA
Change-Id: Id920583cc06b09063de85b160c12a5c3a5468c11
2023-03-21 20:00:00 +08:00
Shashank Sharma
3d765451c5 Remove firmware as same_process_hal_file
Bug: 260522245
Bug: 262794429

Change-Id: I7d49ee7c76fbf2cdf87a2a7de4a406c356f50444
2023-03-07 05:01:16 +00:00
Adam Shih
5dd0fffa9a Merge "move camera dump to gs-common" into udc-dev 2023-03-06 23:29:45 +00:00
Adam Shih
51bd259bbf Move common display dump to gs-common
Bug: 269212897
Test: adb bugreport
Change-Id: I71ad4e2e08ba19c36dc633732ce39e8086a94d6e
2023-03-06 06:33:53 +00:00
Adam Shih
7b84f2fc56 move camera dump to gs-common
Bug: 240530709
Test: adb bugreport
Create empty files starting with the following prefix
/data/vendor/camera/profiler/session-ended-
/data/vendor/camera/profiler/high-drop-rate-
/data/vendor/camera/profiler/watchdog-
/data/vendor/camera/profiler/camera-ended-
and do adb bugreport and make sure they end up in dumpstate_board.bin

Change-Id: I90e6d5142e7d512dafa6b8712d7fb252327359a5
2023-03-06 02:34:48 +00:00
Jörg Wagner
d8c6712f5b Update Mali DDK to r40 : Additional SELinux settings
Expose DDK's dynamic configuration options through the Android Sysprop
interface, following recommendations from Arm's Android Integration
Manual.

Bug: 261718474

(cherry picked from commit 6834d6f59f)
Merged-In: I785106b6d2d05e21bf60fcd6da3d716b32e1bc1d
Change-Id: I0469e2f24abe7a9458305d5752ae655cf4f42547
2023-03-03 15:23:39 +00:00
Ernie Hsu
899ad9c1ab Merge "move mediacodec_samsung build config and sepolicy to gs-common" into udc-dev 2023-03-02 08:38:54 +00:00
Wilson Sung
d0105abe01 Add sensor boot-to-home required policy
Test: boot-to-home
Fix: 261105336
Change-Id: I772ff7a294cc5d2448361c164d4e671a41c92c8d
2023-03-02 02:39:15 +00:00
Ernie Hsu
4d90089d25 move mediacodec_samsung build config and sepolicy to gs-common
Bug: 263444717
Test: build pass, camera record, youtube
Change-Id: I8fa4d79495b3971429b977a63aed811ef8d62ddb
2023-03-01 10:12:22 +00:00
Armelle Laine
d27961dc1b Define selinux properties for /dev/block/by-name/trusty_persist
Bug: 247013568
Test: - Verify that this change is a NOP for devices with TDP already
        created on top of the legacy f2fs partition /mnt/vendor/persist/ss
      - Verify that this change creates a valid symlink on a manually
        migrated block device
Change-Id: I226f365c6afbb5fa91ec1c9c1943f8dddac8183a
2023-02-27 22:42:08 +00:00
Adam Shih
90d9b97221 Move HWC dump to gs-common
Bug: 269212897
Test: adb bugreport
Change-Id: I616f0af4d9ba466d62d87e7fc912c8c3201f7f65
2023-02-22 13:55:50 +08:00
Ken Yang
58a6a1e772 WLC: cleanup the unused hal_wlc policies
Bug: 264489562
Bug: 262455719
Bug: 260366297
Bug: 260363384
Signed-off-by: Ken Yang <yangken@google.com>
(cherry picked from commit 6f9844d137)
Merged-In: I90b9e442082b8e03e76ce63aaee56e5882933449
Change-Id: I90b9e442082b8e03e76ce63aaee56e5882933449
2023-02-20 11:05:53 +00:00
Adam Shih
efa506d012 move devfreq dump to gs-common
Bug: 240530709
Test: adb bugreport
Change-Id: Ica18fa60ed1da44eb587ffe59370e87b393e69fb
2023-02-15 11:11:44 +08:00
TreeHugger Robot
bf60294e77 Merge "Map AIDL Gatekeeper to same policy as HIDL version" 2023-02-14 18:55:51 +00:00
Adam Shih
176bdd647d Move memory dump to gs-common
Bug: 240530709
Test: adb bugreport
Change-Id: Ie860adb97d7bcebf87cd4280e1d5601163d06074
2023-02-13 14:58:08 +08:00
David Drysdale
b385a8a253 Map AIDL Gatekeeper to same policy as HIDL version
Bug: 268342724
Test: VtsHalGatekeeperTargetTest
Change-Id: I2857f6dabad71d13971829c89fa7055b50793ea7
2023-02-08 18:43:03 +00:00