Commit graph

417 commits

Author SHA1 Message Date
Zixuan Lan
76b53940a9 remove 280706211 from bug map
Bug: 280706211
Test: adb log
Change-Id: I167041363a27c294a3c8d2d2fb145ce751a34db7
2023-06-06 08:30:25 +08:00
Wilson Sung
d73217d81f Update SELinux error
Test: SELinuxUncheckedDenialBootTest
Bug: 283725554
Test: scanBugreport
Bug: 283725554
Bug: 283725302
Test: scanAvcDeniedLogRightAfterReboot
Bug: 283725554
Change-Id: Ie482a46311c1dc1153ef04889e82971a09361e49
2023-05-22 15:01:49 +08:00
Grace Chen
e151f78f5a Remove selinux error bug reference after fixing
Bug: 264483151
Test: None, simple bug removal
Change-Id: Id93085566c772e6b434777955b62b1ccaba64ae2
2023-05-18 17:54:20 -07:00
Wilson Sung
2e511cf418 Remove fixed SELinux bug from bug_map
Fix: 280706292
Bug: 280522410
Change-Id: I5b35759d2b89246e65683fbbc3ca877af04ef25b
2023-05-11 14:10:41 +08:00
Wilson Sung
17a784cf97 Update SELinux error
Test: SELinuxUncheckedDenialBootTest
Bug: 281815594
Test: scanBugreport
Bug: 281815594
Bug: 281815537
Test: scanAvcDeniedLogRightAfterReboot
Bug: 281815594
Fix: 281645191
Change-Id: Ia1e72cdee3ca535eb978ad8becad94c9c4d8c2cd
2023-05-11 04:06:31 +00:00
Zixuan Lan
288623d4d4 remove fixed selinux bug from bug map.
TPU permission was fixed to avoid error in hal_camera_defaul.The corresponding bug for tracking should be removed from the bug map. Please see bug for more details.
Bug: 275001641
Test: logcat grep for selinux error

Change-Id: I3622a1877f94b41d03d1bcb1c16a404db4b3ea8d
2023-05-09 16:38:38 -07:00
Zheng Pan
705cc4abf8 Merge "Allow systemui to find adbd" into udc-d1-dev 2023-05-09 20:21:14 +00:00
Wilson Sung
fd60d077ad Allow systemui to find adbd
Bug: 276415118
Fix: 272628396
Test: connect to adb with no avc error
Change-Id: I07496d663628f62ed975785d794854d1cdc77040
2023-05-09 05:22:16 +00:00
Wilson Sung
e7a70d62b5 Update SELinux error
Test: SELinuxUncheckedDenialBootTest
Bug: 280706211
Bug: 280706292
Test: scanBugreport
Bug: 280706211
Bug: 280706610
Bug: 280705998
Test: scanAvcDeniedLogRightAfterReboot
Bug: 280706211
Change-Id: I67e0d2ec15b3ea057688644ba5c41c8fb5755128
2023-05-04 12:40:51 +08:00
Kyle Tso
649f19fc94 Allow accessing dumpstate from hal_usb_impl
Fix SELinux errors.

Bug: 267261163
Change-Id: I73a311d796eb520ede3849edc6384c965ec5c915
Signed-off-by: Kyle Tso <kyletso@google.com>
2023-05-03 11:23:52 +08:00
Treehugger Robot
11ea9b76d6 Merge "Remove obsolete tracking entry" into udc-d1-dev 2023-05-02 07:12:52 +00:00
Treehugger Robot
470eda92e4 Merge "Enforce fastbootd" into udc-d1-dev 2023-05-02 04:54:37 +00:00
Wilson Sung
8080b95d06 Enforce fastbootd
Fix: 264489957
Test: flash and no related avc error
Change-Id: Ibf616a98e9341310e18db6dda27d86adbf24deac
2023-05-02 11:42:59 +08:00
Krzysztof Kosiński
9f7dec1023 Merge "Enforce sepolicy for Google Camera App." into udc-d1-dev 2023-04-28 22:18:37 +00:00
Krzysztof Kosiński
5b2134d5c5 Enforce sepolicy for Google Camera App.
Added missing statement allowing GXP firmware access.

Bug: 264489778
Test: GCA smoke test in setenforce mode.
Change-Id: Ied2f675a2e11f7aebcf4e1e6ac49fc2e39dd2ecf
2023-04-27 19:53:25 +00:00
martinwu
09aaf3dfbc [TSV2] Add sepolicy for dumpstate to zip tcpdump into bugreport
Bug: 264490014
Test: 1. Enable tcpdump_logger always-on function
      2. Dump bugreport
      3. Pull dumpstate_board.bin and chagne it to zip
      4. Unzip dumpstate_board.zip and check if tcpdump files
         are there.
Change-Id: I45c894fa9378a7878bc853f7723162ebd6141115
2023-04-27 13:47:34 +00:00
Carol Cheng
bb1f0f25bb Merge "Revert "Add sepolicy for dumpstate to zip tcpdump into bugreport"" into udc-d1-dev 2023-04-27 06:36:48 +00:00
Martin Wu
4e2023c263 Revert "Add sepolicy for dumpstate to zip tcpdump into bugreport"
Revert submission 22814097-Fix-tcpdump-sepolicy

Reason for revert: build break

Reverted changes: /q/submissionid:22814097-Fix-tcpdump-sepolicy

Change-Id: I795de89a17c5ccee702fa3a59af03d48d89fbaf2
2023-04-27 02:21:00 +00:00
Treehugger Robot
fe27339606 Merge "Add sepolicy for dumpstate to zip tcpdump into bugreport" into udc-d1-dev 2023-04-27 01:43:58 +00:00
martinwu
da1f9ffa79 Add sepolicy for dumpstate to zip tcpdump into bugreport
Bug: 264490014
Test: 1. Enable tcpdump_logger always-on function
      2. Dump bugreport
      3. Pull dumpstate_board.bin and chagne it to zip
      4. Unzip dumpstate_board.zip and check if tcpdump files
         are there.
Change-Id: I04ca96860c78baf24afd7deecff7dd4d470d9539
2023-04-26 14:17:56 +00:00
Salmax Chang
5ddf0079c6 Remove obsolete tracking entry
Bug: 264489567
Bug: 261651131
Change-Id: Ibf1116ea7b393f3c1e6eec0794e492b5dc2fd1ad
2023-04-26 17:15:36 +08:00
Wilson Sung
74494540d6 Update SELinux error
Test: SELinuxUncheckedDenialBootTest
Bug: 279680070
Test: scanBugreport
Bug: 279680070
Bug: 279680213
Bug: 279680264
Test: scanAvcDeniedLogRightAfterReboot
Bug: 279680070
Change-Id: I0a5aadfed90377aeee60a15aaab212c7709d091a
2023-04-26 15:10:44 +08:00
Treehugger Robot
8ebffeef84 Merge "Remove 'hal_neuralnetworks_armnn' '/data' access exception" into udc-d1-dev 2023-04-26 05:07:41 +00:00
Treehugger Robot
8f8f545307 Merge "Remove hal_power_default bug from bug_map" into udc-d1-dev 2023-04-26 04:59:43 +00:00
Bruno BELANYI
f9d70ef1b2 Remove 'hal_neuralnetworks_armnn' '/data' access exception
The mali driver has been configured not to look there anymore.

Fix: 205779871
Test: manual - reboot device and check the absence of AVC denials
Change-Id: I7bf68036522553a2919076fc6243a577086ffb3a
Merged-In: I7bf68036522553a2919076fc6243a577086ffb3a
(cherry picked from commit deec8fec9d)
2023-04-26 03:35:52 +00:00
Nicolas Geoffray
42b382da0c Remove old debug map entries.
Fix: 264483352
Change-Id: Ie47107328f58dc4f1d4070e93c0cd09e88cee021
Merged-In: Ie47107328f58dc4f1d4070e93c0cd09e88cee021
(cherry picked from commit af3702bffd)
2023-04-26 03:33:31 +00:00
Chungkai Mei
c01d4b7d9b Remove hal_power_default bug from bug_map
SELinux errors are fixed and hence removing from bug map

Bug: 273638876
Test: Build and boot on device
Change-Id: I4ca6180ad286970d36ce204cd4c44e75962b26e0
Merged-In: I4ca6180ad286970d36ce204cd4c44e75962b26e0
Signed-off-by: Chungkai Mei <chungkai@google.com>
(cherry picked from commit 8051a8759a)
2023-04-26 03:32:21 +00:00
Chungkai Mei
97f5b3c87a Remove dontaudit since read early_wakeup completed
The display file node, early_wakeup, just for trigger the worker for
display and it doesn't have meaningful read function. But PowerHAL read
all nodes and try to dump their valuesi while triggering bugreport. As
the read operation has been completed, so we can remove the clause.

07-02 00:53:56.888   522   522 W android.hardwar: type=1400 audit(0.0:8): avc: denied { dac_read_search } for capability=2 scontext=u:r:hal_power_default:s0 tcontext=u:r:hal_power_default:s0 tclass=capability permissive=0
07-02 00:53:56.888   522   522 W android.hardwar: type=1400 audit(0.0:9): avc: denied { dac_override } for capability=1 scontext=u:r:hal_power_default:s0 tcontext=u:r:hal_power_default:s0 tclass=capability permissive=0

Bug: 267261305
Test: Boot to home
Change-Id: I6c058a1a85ada7e5d6eb1f8acafaac8231ae5329
Merged-In: I6c058a1a85ada7e5d6eb1f8acafaac8231ae5329
Signed-off-by: Chungkai Mei <chungkai@google.com>
(cherry picked from commit 55d41f1a3e89b1f4d2525d9925e3319ef59e2705)
(cherry picked from commit 1d966a0db9)
2023-04-24 17:21:53 +00:00
Treehugger Robot
c84559a813 Merge changes from topic "260522202" into udc-d1-dev
* changes:
  Remove untraceable rules
  Enforce installd
2023-04-21 03:45:54 +00:00
Treehugger Robot
a8fe91bc3c Merge "Remove hal_uwb_default bug from bug_map" into udc-d1-dev 2023-04-21 03:08:00 +00:00
Wilson Sung
dc75da30a1 Revert^2 "Enforce priv_app"
This reverts commit 61a95fc71a.

Fix: 260522282
Change-Id: I0d5dd994d3acacfee854ae27669358cfc2c249fc
2023-04-20 00:14:18 +08:00
Rex Lin
814652dc6d Remove hal_uwb_default bug from bug_map
SELinux errors are fixed and hence removing from bug map

Bug: 273639365
Test: Build and boot on device
Change-Id: I3a1ad3066840b507553b9365239673f6126b8ec6
Signed-off-by: Rex Lin <rexcylin@google.com>
2023-04-19 14:54:11 +08:00
Wilson Sung
7ebc1ab0d5 Enforce installd
Fix: 260522202
Fix: 264490035
Test: Boot-to-home, no avc error
Change-Id: I2ec5a2771c53dcc520a2ea229f093d354b5c80fd
2023-04-19 12:41:35 +08:00
Alan Chen
c1f8b7a872 Merge "Remove dontaudit for hal_radioext_default to service_manager." into udc-d1-dev 2023-04-19 03:04:57 +00:00
Treehugger Robot
16f461a2cf Merge "Enforce sepolicy for camera HAL." into udc-d1-dev 2023-04-18 23:18:00 +00:00
Dave Mankoff
633f19376e Merge "Give SystemUI access to necessary selinux properties." into udc-d1-dev 2023-04-18 17:50:42 +00:00
Jonglin Lee
8da235e022 Merge "Revert "Enforce priv_app"" into udc-d1-dev 2023-04-18 17:50:13 +00:00
Jonglin Lee
61a95fc71a Revert "Enforce priv_app"
This reverts commit af0ad04c3c.

Reason for revert: RescueParty crash due to com.shannon.rcsservice crash

Bug: 278735899
Change-Id: I5bf91b077c23c63de728657bd9adb5623b708d95
2023-04-18 17:41:27 +00:00
Alan Chen
63f54f0a3a Remove dontaudit for hal_radioext_default to service_manager.
The fix has been merged in the topic of ag/21956466 so this dontaudit line can be removed.

Test: manual
Bug: b/275646098

Change-Id: I95c25ffc926e48e589b7636beca1bef9583861d0
2023-04-18 17:47:09 +08:00
Krzysztof Kosiński
3f0d2fc09d Enforce sepolicy for camera HAL.
Bug: 264489778
Test: GCA smoke test on Zuma device
Change-Id: Icaa7c94ab264d496840d33d970e5a87123b31c36
2023-04-18 09:02:32 +00:00
Treehugger Robot
4d7b687f9d Merge "Enforce priv_app" into udc-d1-dev 2023-04-17 16:56:56 +00:00
Dave Mankoff
78b9dcdb69 Give SystemUI access to necessary selinux properties.
Other errors mentioned in the bugs are already absent.

Fixes: 269964574
Fixes: 272628396
Fixes: 272628174
Test: built and flash device. No selinux errors printed.
Change-Id: Ic285b1f5a2ce6973899011a7c6a596e807c3e933
2023-04-17 14:28:59 +00:00
Treehugger Robot
9ea22dde19 Merge "Enforce servicemanager" into udc-d1-dev 2023-04-14 03:53:11 +00:00
Wilson Sung
af0ad04c3c Enforce priv_app
Fix: 260366281
Fix: 260522282
Fix: 260768358
Fix: 260922442
Fix: 263185432
Fix: 264490074
Fix: 268572216
Change-Id: I2efbb1971c09506a7b1e0e5e0e3d22eda91018c1
2023-04-14 03:34:46 +00:00
TreeHugger Robot
89d4a4df13 Merge "Suppress bootanim behavior meant for Android Wear devices" into udc-d1-dev 2023-04-14 03:19:53 +00:00
Treehugger Robot
2ac0374b22 Merge changes Ie20be0af,Id9a80c47 into udc-d1-dev
* changes:
  Enforce rebalance_interrupts_vendor
  Enforce hwservicemanager
2023-04-14 03:18:10 +00:00
Yixuan Wang
1095231e38 Add hal_contexthub_default to zuma sepolicy; Remove dontaudit rules for
chre

[ 7.760870] type=1400 audit(1669944054.440:61): avc: denied { write } for comm="android.hardwar" name="chre" dev="tmpfs" ino=1099 scontext=u:r:hal_contexthub_default:s0 tcontext=u:object_r:chre_socket:s0 tclass=sock_file permissive=1
[ 12.519414] type=1400 audit(1669944059.196:138): avc: denied {connectto } for comm="android.hardwar" path="/dev/socket/chre"scontext=u:r:hal_contexthub_default:s0 tcontext=u:r:chre:s0 tclass=unix_stream_socket permissive=1

Bug: 264489794
Bug: 261105224
Test: atest scanAvcDeniedLogRightAfterReboot
Change-Id: I7bf13913188deedc987f82e54626a18357ab84c5
2023-04-13 06:43:41 +00:00
Wilson Sung
3df3008917 Suppress bootanim behavior meant for Android Wear devices
Fix: 260522279
Test: boot-to-home and no bootanim avc error
Change-Id: I29d4168720887bc2f90d5f7ad20367887f9cae51
2023-04-13 00:00:38 +00:00
Wilson Sung
5468e420e3 Enforce rebalance_interrupts_vendor
Fix: 264489565
Test: boot-to-home
Change-Id: Ie20be0afe1a95b8cb512b57019539eb52948a155
2023-04-12 22:58:13 +08:00
Wilson Sung
90f838f16f Enforce hwservicemanager
Test: boot-to-home and no avc error
Fix: 264489781
Change-Id: Id9a80c478a2eae8472023f3bbcc514f30f5bfbab
2023-04-12 22:32:46 +08:00