Commit graph

1146 commits

Author SHA1 Message Date
Wilson Sung
599f4f5382 Update SELinux error
Test: SELinuxUncheckedDenialBootTest
Bug: 275001641
Test: scanBugreport
Bug: 268566481
Test: scanAvcDeniedLogRightAfterReboot
Bug: 268566481
Change-Id: I5a7ea66483985b6ca99162666d155fef69d65360
2023-03-24 11:11:17 +08:00
Automerger Merge Worker
5333bed98e Merge "Merge "Allow fingerprint hal to read sysfs_leds" into udc-dev am: dba88b81d3 am: 4f15bf412d" 2023-03-24 03:09:25 +00:00
KRIS CHEN
30adddd3c0 Merge "Allow fingerprint hal to read sysfs_leds" into udc-dev am: dba88b81d3 am: 4f15bf412d
Original change: https://googleplex-android-review.googlesource.com/c/device/google/zuma-sepolicy/+/22178643

Change-Id: Ic65859abe754b1340d414fe471d74f959745e1ac
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
2023-03-24 03:09:06 +00:00
KRIS CHEN
355457bf9d Merge "Allow fingerprint hal to read sysfs_leds" into udc-dev am: dba88b81d3 am: 24b32ddd4c
Original change: https://googleplex-android-review.googlesource.com/c/device/google/zuma-sepolicy/+/22178643

Change-Id: I0b1312780a03417859f9203ee8e1d34bca1ec2a4
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
2023-03-24 03:09:02 +00:00
Adam Shih
8538fd33da Move pixel dumpstate to gs-common
Bug: 240530709
Test: adb bugreport
Change-Id: I10f98673ea507f841d9d3f33d737c4e73c1b5b19
Merged-In: I4c46a2495ea07b9e44f56c4c6be726621e0ebf65
2023-03-24 02:55:51 +00:00
KRIS CHEN
24b32ddd4c Merge "Allow fingerprint hal to read sysfs_leds" into udc-dev am: dba88b81d3
Original change: https://googleplex-android-review.googlesource.com/c/device/google/zuma-sepolicy/+/22178643

Change-Id: I6fce057e9a6aef6d370bbf820818761fee8e615b
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
2023-03-24 02:41:38 +00:00
KRIS CHEN
4f15bf412d Merge "Allow fingerprint hal to read sysfs_leds" into udc-dev am: dba88b81d3
Original change: https://googleplex-android-review.googlesource.com/c/device/google/zuma-sepolicy/+/22178643

Change-Id: Ic8a12d3e5a4d79ef5edbe17fc340c54760cf8998
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
2023-03-24 02:41:26 +00:00
KRIS CHEN
dba88b81d3 Merge "Allow fingerprint hal to read sysfs_leds" into udc-dev 2023-03-24 02:06:37 +00:00
Darren Hsu
1e254e01b3 Merge "Revert "Enforce system ui app"" into udc-d1-dev am: 128550da69
Original change: https://googleplex-android-review.googlesource.com/c/device/google/zuma-sepolicy/+/22225579

Change-Id: Ica4b4787254f02f8c7fa361b238197918d1b4404
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
2023-03-24 01:30:58 +00:00
Darren Hsu
128550da69 Merge "Revert "Enforce system ui app"" into udc-d1-dev 2023-03-24 00:48:36 +00:00
Dave Mankoff
eeeae0265a Revert "Enforce system ui app"
This reverts commit ba953cdb9a.

Reason for revert: http://b/274366326#comment22. We can check this back in once we know what's going on.

Bug: 274366326
Bug: 264266705

Change-Id: I879cdec377e71af9142c82078bd3c022295c98c5
2023-03-23 19:44:22 +00:00
neoyu
44ee5a2fb2 sepolicy: allow hal_radioext_default binder call with servicemanager
avc: denied { call } for comm="binder:795_2" scontext=u:r:hal_radioext_default:s0 tcontext=u:r:servicemanager:s0 tclass=binder permissive=0

Bug: 274374768
Test: verify by test rom
Change-Id: I31cfbd234756fdc41663cec766f6b3bf23063bc7
2023-03-24 02:30:44 +08:00
TreeHugger Robot
8aa4f265eb [automerger skipped] Merge "Revert "Move pixel dumpstate to gs-common"" into udc-dev am: 3fae47e04b am: e12572cc98 -s ours
am skip reason: Merged-In I4c46a2495ea07b9e44f56c4c6be726621e0ebf65 with SHA-1 9844033c0a is already in history. Merged-In was found from reverted change.

Reverted change: https://googleplex-android-review.googlesource.com/c/device/google/zuma-sepolicy/+/22188471

Original change: https://googleplex-android-review.googlesource.com/c/device/google/zuma-sepolicy/+/22215371

Change-Id: I90e20e3eb64f6fca00fd5818f923a9cc5fdf2a11
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
2023-03-23 09:01:05 +00:00
Mark Chang
75f77b7bc6 Merge "Add IScreenProtectorDetectorService policy for systemui_app." into udc-d1-dev am: 3c027fdc6e
Original change: https://googleplex-android-review.googlesource.com/c/device/google/zuma-sepolicy/+/22197842

Change-Id: I084554e9af7107be6c13aace51cab06c4bf614b0
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
2023-03-23 09:00:24 +00:00
TreeHugger Robot
e646905a73 [automerger skipped] Merge "Revert "Move pixel dumpstate to gs-common"" into udc-dev am: 3fae47e04b am: 24536aa24c -s ours
am skip reason: Merged-In I4c46a2495ea07b9e44f56c4c6be726621e0ebf65 with SHA-1 9844033c0a is already in history. Merged-In was found from reverted change.

Reverted change: https://googleplex-android-review.googlesource.com/c/device/google/zuma-sepolicy/+/22188471

Original change: https://googleplex-android-review.googlesource.com/c/device/google/zuma-sepolicy/+/22215371

Change-Id: I95db412852e139f1ddc4f3790d1ce65adcf87eab
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
2023-03-23 08:59:54 +00:00
Mark Chang
3c027fdc6e Merge "Add IScreenProtectorDetectorService policy for systemui_app." into udc-d1-dev 2023-03-23 08:30:24 +00:00
TreeHugger Robot
e12572cc98 Merge "Revert "Move pixel dumpstate to gs-common"" into udc-dev am: 3fae47e04b
Original change: https://googleplex-android-review.googlesource.com/c/device/google/zuma-sepolicy/+/22215371

Change-Id: Ie6930def51520969754a9f2235b02c8142b808aa
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
2023-03-23 08:08:01 +00:00
TreeHugger Robot
24536aa24c Merge "Revert "Move pixel dumpstate to gs-common"" into udc-dev am: 3fae47e04b
Original change: https://googleplex-android-review.googlesource.com/c/device/google/zuma-sepolicy/+/22215371

Change-Id: I3b6ed885d80985c85846b1ec6627c093ba94431f
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
2023-03-23 08:07:36 +00:00
TreeHugger Robot
48b6856587 Merge "sepolicy: label odpm paths for system suspend" into udc-d1-dev am: b76a3b6257
Original change: https://googleplex-android-review.googlesource.com/c/device/google/zuma-sepolicy/+/22189946

Change-Id: I16131bd8b5cde5325378a6f22bca3042dd1fdf05
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
2023-03-23 07:46:35 +00:00
Andy Hsu
88d801e092 Merge "Add SELinux policy to allow GCARelease and GCADogfood to access PowerHAL." into udc-d1-dev am: 93e86449e5
Original change: https://googleplex-android-review.googlesource.com/c/device/google/zuma-sepolicy/+/22215364

Change-Id: Ic14bcd44370d4dc064537b2ac888677985d5cf12
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
2023-03-23 07:43:50 +00:00
TreeHugger Robot
3fae47e04b Merge "Revert "Move pixel dumpstate to gs-common"" into udc-dev 2023-03-23 07:24:01 +00:00
TreeHugger Robot
b76a3b6257 Merge "sepolicy: label odpm paths for system suspend" into udc-d1-dev 2023-03-23 07:19:55 +00:00
Andy Hsu
93e86449e5 Merge "Add SELinux policy to allow GCARelease and GCADogfood to access PowerHAL." into udc-d1-dev 2023-03-23 07:01:32 +00:00
Adam Shih
7a621bab25 [automerger skipped] Merge "Move pixel dumpstate to gs-common" into udc-dev am: 0c17644417 am: cad969da74 -s ours
am skip reason: Merged-In I4c46a2495ea07b9e44f56c4c6be726621e0ebf65 with SHA-1 ee45cfea78 is already in history

Original change: https://googleplex-android-review.googlesource.com/c/device/google/zuma-sepolicy/+/22188471

Change-Id: I35b1da6dec44db016dc45bb659f5cff7e99dd935
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
2023-03-23 06:48:47 +00:00
Andy Hsu
9c91ba1a2f Add SELinux policy to allow GCARelease and GCADogfood to access PowerHAL.
Note that this only adds permission to GCARelease and GCADogfood, while GCANext and GCAEng are still untrusted app on zuma now and after this change GCANext and GCAEng will still be denied.

Bug: 264490031

Test: Portrait processing in GCARelease didn't get denial message when accessing PowerHAL after this change  (https://cnsviewer-static.corp.google.com/cns/md-d/home/pixel-camera-data-readers/acat/hwandy/ag/22215364?user=pixel-camera-data-readers).

Change-Id: Ia4a4c2f24215b9da9db7985cf67112997df355fa
2023-03-23 06:41:13 +00:00
Adam Shih
095b07bfab [automerger skipped] Merge "Move pixel dumpstate to gs-common" into udc-dev am: 0c17644417 am: ac0bb620df -s ours
am skip reason: Merged-In I4c46a2495ea07b9e44f56c4c6be726621e0ebf65 with SHA-1 9844033c0a is already in history

Original change: https://googleplex-android-review.googlesource.com/c/device/google/zuma-sepolicy/+/22188471

Change-Id: Id7f5cca3a18ffad1364468aab16c456cff2c2086
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
2023-03-23 06:27:48 +00:00
Darren Hsu
8e028f0a03 sepolicy: label odpm paths for system suspend
Bug: 272166423
Test: run singleCommand pts -m PtsSELinuxTestCases
Change-Id: I0295cc09cd8eb46b19edcec0d74440e497440423
Signed-off-by: Darren Hsu <darrenhsu@google.com>
2023-03-23 14:13:43 +08:00
Wilson Sung
3e68836e43 Revert "Move pixel dumpstate to gs-common"
Revert submission 22188471-dumpstate aidl

Reason for revert: Build break

Reverted changes: /q/submissionid:22188471-dumpstate+aidl
Bug: 274858145

Change-Id: I757111541257eecd4936572376fe42a4c866a1d6
2023-03-23 05:58:12 +00:00
Adam Shih
ac0bb620df Merge "Move pixel dumpstate to gs-common" into udc-dev am: 0c17644417
Original change: https://googleplex-android-review.googlesource.com/c/device/google/zuma-sepolicy/+/22188471

Change-Id: I254abc02ecf38455c75258888fd3b9c948cbcee5
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
2023-03-23 05:53:01 +00:00
Adam Shih
cad969da74 Merge "Move pixel dumpstate to gs-common" into udc-dev am: 0c17644417
Original change: https://googleplex-android-review.googlesource.com/c/device/google/zuma-sepolicy/+/22188471

Change-Id: I58ded180038a8aa507095d31a069547b7f02efea
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
2023-03-23 05:52:55 +00:00
Adam Shih
0c17644417 Merge "Move pixel dumpstate to gs-common" into udc-dev 2023-03-23 04:39:46 +00:00
TreeHugger Robot
9cd5fd2ec8 Merge "Enforce bootdevice_sysdev" into udc-d1-dev am: 0b1499354d
Original change: https://googleplex-android-review.googlesource.com/c/device/google/zuma-sepolicy/+/22185173

Change-Id: I0765dc38aa14480ba01e067290629b2be5d392a6
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
2023-03-23 04:19:31 +00:00
TreeHugger Robot
943e5e1ba8 Merge "Enforce systesm_app" into udc-d1-dev am: 75b82f7092
Original change: https://googleplex-android-review.googlesource.com/c/device/google/zuma-sepolicy/+/22185176

Change-Id: I5792118ba1f994613c334c8ecd056c896598d116
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
2023-03-23 04:17:55 +00:00
TreeHugger Robot
ee84f470bf Merge "Update SELinux error" into udc-d1-dev am: a8dfe1fd3c
Original change: https://googleplex-android-review.googlesource.com/c/device/google/zuma-sepolicy/+/22185174

Change-Id: I0d15f92b5a035915d37de6a750f53d3c5351af64
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
2023-03-23 04:16:47 +00:00
Miranda Kephart
04ac3ce7f5 Fix screenshot shutter sound on P23 devices am: 8cc50336c8
Original change: https://googleplex-android-review.googlesource.com/c/device/google/zuma-sepolicy/+/22200827

Change-Id: I1bc148a562bc22bdab4be3984f1394ecf0da364f
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
2023-03-23 04:13:55 +00:00
TreeHugger Robot
0b1499354d Merge "Enforce bootdevice_sysdev" into udc-d1-dev 2023-03-23 03:36:47 +00:00
TreeHugger Robot
75b82f7092 Merge "Enforce systesm_app" into udc-d1-dev 2023-03-23 03:32:48 +00:00
TreeHugger Robot
a8dfe1fd3c Merge "Update SELinux error" into udc-d1-dev 2023-03-23 03:27:12 +00:00
Adam Shih
4154c957c5 Merge "Move pixel dumpstate to gs-common" 2023-03-23 02:29:30 +00:00
Miranda Kephart
8cc50336c8 Fix screenshot shutter sound on P23 devices
SystemUI didn't have permission to access media server or the audio
server. Looks like both are required (and sufficient).

Bug: 273688513
Bug: 272628174
Fix: 273688513
Test: manual; take a screenshot with ringer on and verify it
makes a sound

Change-Id: Ibbe54db8cbf78ed199cb329804221709a2822242
2023-03-22 18:40:47 +00:00
Welly Hsu
7f8e10c54a Remove euiccpixel_app dontaudit from gmscore_app am: a133586e4e am: cccbbb12e4
Original change: https://googleplex-android-review.googlesource.com/c/device/google/zuma-sepolicy/+/22188469

Change-Id: Ibf39c45ff3c91e32fa257587bf5f73708cce421e
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
2023-03-22 15:15:50 +00:00
Welly Hsu
a6c5340c93 Remove euiccpixel_app dontaudit from gmscore_app am: a133586e4e am: e0adad9eb0
Original change: https://googleplex-android-review.googlesource.com/c/device/google/zuma-sepolicy/+/22188469

Change-Id: I738eb4c90dbefcbe3fc78aba980b96206ee9ddb5
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
2023-03-22 15:15:22 +00:00
Welly Hsu
cccbbb12e4 Remove euiccpixel_app dontaudit from gmscore_app am: a133586e4e
Original change: https://googleplex-android-review.googlesource.com/c/device/google/zuma-sepolicy/+/22188469

Change-Id: If322b434699549b08e6a081207662a4ca4717e85
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
2023-03-22 14:47:47 +00:00
Welly Hsu
e0adad9eb0 Remove euiccpixel_app dontaudit from gmscore_app am: a133586e4e
Original change: https://googleplex-android-review.googlesource.com/c/device/google/zuma-sepolicy/+/22188469

Change-Id: I48f0e1eb633c44a4c6445c6423d10e500be6f6c7
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
2023-03-22 14:41:23 +00:00
Mark Chang
9e2ce3d5c0 Add IScreenProtectorDetectorService policy for systemui_app.
Bug: 260302317
Test: system ui app successfully started.
Change-Id: Ibbeab03e738fbbd4103bb5bf4e9f6bbd2998cd29
Signed-off-by: Mark Chang <changmark@google.com>
2023-03-22 11:53:18 +00:00
Wilson Sung
6bf3029916 Enforce systesm_app
Fix: 260768379
Fix: 260922048
Fix: 264490076
Test: boot-to-home, no related avc error
Change-Id: If9ead09340f5d810ec549f4c83015f3301f1113c
2023-03-22 16:01:09 +08:00
Wilson Sung
a1739828f2 Update SELinux error
Test: SELinuxUncheckedDenialBootTest
Bug: 274727372
Bug: 274727542
Test: scanBugreport
Bug: 274727542
Bug: 268566481
Test: scanAvcDeniedLogRightAfterReboot
Bug: 274727542
Bug: 268566481
Change-Id: Ie846f2f7146e52c4e094d9fd7cfa1fa68e3e21df
2023-03-22 15:38:52 +08:00
Wilson Sung
503ae703df Enforce bootdevice_sysdev
Fix: 264489743
Test: boot-to-home and no avc errors
Change-Id: I14648c8d7b1b334c3d02971ffbf20b1f9b5a9354
2023-03-22 15:35:45 +08:00
TreeHugger Robot
ab7303cbfd Merge "[SELinux] remove uwb remaining tracking denials" into udc-d1-dev am: a112b65748
Original change: https://googleplex-android-review.googlesource.com/c/device/google/zuma-sepolicy/+/22188470

Change-Id: Ie921139dc13515d60f00eec16150035c53d13596
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
2023-03-22 06:14:17 +00:00
TreeHugger Robot
a112b65748 Merge "[SELinux] remove uwb remaining tracking denials" into udc-d1-dev 2023-03-22 05:30:57 +00:00