Cody Heiner
dc0b4fc9e9
Allow twoshay → systemui_app binder call for zuma devices (2)
...
Splitting system_app (b/264266705) caused the avc denial below,
causing b/269981541. This change allows the denied binder call
and fixes the bug.
Denial message:
avc: denied { call } for scontext=u:r:twoshay:s0 tcontext=u:r:systemui_app:s0:c230,c256,c512,c768 tclass=binder permissive=0
Note: this is a re-submit of ag/21529713, after sorting out the
SEPolicy issues described in b/270444888.
Test: flash P23 and Bluejay devices with this change plus ag/21591673,
run `adb shell device_config put twoshay_native test_flag_name test_flag_value`,
→ TouchContextService.java logs corresponding property changed message.
Bug: 270444888
Change-Id: I40d70cf19930eb334ba3250d58a0cbc39b50764b
2023-02-24 18:19:09 -08:00
Wilson Sung
546b787a40
Add SSR property access and remove obsolete denials
...
Bug: 268572164
Change-Id: I5756510b2eb2696aade93dd6b15a111f5dca58ef
2023-02-24 10:33:45 +00:00
Amy Hsu
ae4c77ebda
Merge "Revise sepolicy because of refactor HbmSvManager" into udc-dev
2023-02-24 08:14:49 +00:00
Suki Liu
e476047167
Merge "Update SELinux error" into udc-dev
2023-02-24 04:59:32 +00:00
Adam Shih
9675dc064a
Merge "Move HWC dump to gs-common" into udc-dev
2023-02-24 03:17:38 +00:00
Amy Hsu
c186dbd6db
Revise sepolicy because of refactor HbmSvManager
...
1. Set sepolicy correctly, make it the same as gs201.
2. Rename hbmsvmanager to pixeldisplayservice due to refactor.
3. Add arm_mali_platform_service for pixeldisplayservcice
Bug: 241498235
Bug: 262794939
Bug: 263185136
Bug: 264489797
Test: Verify LBE and shadow compensation functions.
Make sure there is no avc denied.
Change-Id: I2a4bb5d6b863edc00b789fd6df8d46f90164d9f2
2023-02-24 02:06:35 +00:00
sukiliu
362a8ac82c
Update SELinux error
...
Test: SELinuxUncheckedDenialBootTest
Bug: 270633329
Change-Id: Ia7af3ec3ee9c8b80e22a8eb55fd61d58b6c73980
2023-02-24 09:59:58 +08:00
TreeHugger Robot
3d1d5e0b15
Merge "Partially revert commit e70b98af09." into udc-dev
2023-02-23 16:13:11 +00:00
Richard Chang
d207b85ab3
Merge "sepolicy: clean up tracking_denials for zram" into udc-dev
2023-02-23 07:37:28 +00:00
Ian Kasprzak
1b1fe4d3cc
Partially revert commit e70b98af09.
...
Remove twoshay references, with commit 9019c55645
2023-02-23 05:45:07 +00:00
Richard Chang
e6f6cca02a
sepolicy: clean up tracking_denials for zram
...
The zram SELinux errors didn't exist in recent build
(9633105, 9642683).
Remove the record in tracking_denials/init.te.
Bug: 269221861
Test: Check log
Change-Id: I4057aaf960aef885d4d894ae5dc51f93e71afd83
2023-02-23 03:57:57 +00:00
Wilson Sung
fb2e376d26
Add chre policy
...
Bug: 260522435
Bug: 261105224
Test: boot-to-home
Change-Id: Icd8f1ad497357bbbcb9e34509c736f3976ff0ac7
2023-02-23 11:05:15 +08:00
Wilson Sung
6f141a6526
Remove camera dontaudit
...
Bug: 267843409
Bug: 268226491
Change-Id: Idce5518072fc266b45c2fbc5269915b19ceb19e8
2023-02-23 11:04:47 +08:00
Ian Kasprzak
e3af6770ab
Merge "Revert "Allow twoshay → systemui_app binder call for zuma devices"" into udc-dev
2023-02-22 22:28:43 +00:00
Ian Kasprzak
cbf2b3fdb2
Revert "Allow twoshay → systemui_app binder call for zuma devices"
...
This reverts commit 9019c55645
2023-02-22 22:28:33 +00:00
Adam Shih
90d9b97221
Move HWC dump to gs-common
...
Bug: 269212897
Test: adb bugreport
Change-Id: I616f0af4d9ba466d62d87e7fc912c8c3201f7f65
2023-02-22 13:55:50 +08:00
Wilson Sung
2dc224c7b9
Merge "Add hal_bootctl_default write permission to devinfo_block_device" into udc-dev
2023-02-22 04:49:33 +00:00
Wilson Sung
dfd3296451
Merge "Remove touch_context_service to avoid compile error" into udc-dev
2023-02-22 04:32:18 +00:00
Wilson Sung
ca241fa76c
Add hal_bootctl_default write permission to devinfo_block_device
...
Bug: 270236357
Change-Id: I40219dbd726ddebb277e592353bd9f0b249dd01f
2023-02-22 11:23:32 +08:00
Wilson Sung
328cbaaa41
Remove touch_context_service to avoid compile error
...
Bug: 270157082
Change-Id: I1d5d573ddb1d7323e7c66386928074fd06cfc484
2023-02-22 11:16:15 +08:00
Cody Heiner
9019c55645
Allow twoshay → systemui_app binder call for zuma devices
...
Splitting system_app (b/264266705) caused the avc denial below,
causing b/269981541. This change allows the denied binder call
and fixes the bug.
Denial message:
avc: denied { call } for scontext=u:r:twoshay:s0 tcontext=u:r:systemui_app:s0:c230,c256,c512,c768 tclass=binder permissive=0
Test: flash P23 device with ag/21526491 along with this change
→ twoshay runs normally.
Fixes: 269981541
Change-Id: Ib3cf6f44b6288ed5c7c773e2ad670d2fd0aeee96
2023-02-21 23:58:05 +00:00
Wilson Sung
bab5b72f86
Add hal_bootctl related policy
...
Bug: 260522436
Bug: 264489609
Bug: 264483787
Change-Id: Iaa22899bb21ff41c1fa259830e5f49623ff8429b
2023-02-21 19:59:04 +08:00
Wilson Sung
da09093d88
Enforce kernel domain
...
Bug: 264490052
Test: boot-to-home
Change-Id: I383b689b5c26c08d66307b677e36b28f2ab6f7dd
2023-02-21 19:29:15 +08:00
Wilson Sung
9457e5260e
Temporary allow kernel access same_process_hal
...
Add the access to unblock user build boot-to-home
Bug: 260522245
Change-Id: I98f77b2de4961120be9c6073afc18e12e2637e81
2023-02-21 19:28:25 +08:00
Wilson Sung
86931fb2ea
Remove vendor_fw_file related dontaudit
...
Bug: 262794429
Bug: 261933155
Change-Id: I62b4037835a462b46b82df4059cdebf679c295b2
2023-02-21 15:00:58 +08:00
leochuang
6747816919
Update SELinux error
...
Test: SELinuxUncheckedDenialBootTest
Bug: 269964558
Bug: 267714573
Bug: 269964574
Bug: 269812912
Change-Id: I61a274c01c6921b9b7e3df8814cf83f43bba342a
2023-02-21 02:16:40 +00:00
Wilson Sung
e70b98af09
Revert "Revert "Update error on ROM 9624328""
...
This reverts commit d8572861e3
2023-02-20 11:06:17 +00:00
Ken Yang
58a6a1e772
WLC: cleanup the unused hal_wlc policies
...
Bug: 264489562
Bug: 262455719
Bug: 260366297
Bug: 260363384
Signed-off-by: Ken Yang <yangken@google.com>
(cherry picked from commit 6f9844d137
2023-02-20 11:05:53 +00:00
Ken Yang
670b22c2c7
WLC: cleanup WLC trakcing_denials
...
Bug: 268566583
Signed-off-by: Ken Yang <yangken@google.com>
(cherry picked from commit da69d2a494
2023-02-20 11:05:25 +00:00
Kah Xuan Lim
4e270f1615
modem_svc_sit: grant modem property access
...
Log message gotten before adding the policy:
avc: denied { connectto } for comm="modem_svc_sit" path="/dev/socket/property_service" scontext=u:r:modem_svc_sit:s0 tcontext=u:r:init:s0 tclass=unix_stream_socket permissive=1
Bug: 247669574
(cherry picked from commit 77ce224141
2023-02-20 11:04:11 +00:00
Wilson Sung
931ea0d342
allow bootctl to read devinfo
...
Bug: 260522436
(cherry picked from commit 967da5da4f
2023-02-20 11:02:28 +00:00
Wilson Sung
676c7a674c
Remove proc_vendor_sched obsolete denials
...
Bug: 264490054
(cherry picked from commit 6545bc156a
2023-02-20 11:01:42 +00:00
Nicole Lee
7706be6c71
logger_app: don't audit default_prop and fix errors
...
avc: denied { read } for comm="oid.pixellogger" name="u:object_r:default_prop:s0" dev="tmpfs" ino=153 scontext=u:r:logger_app:s0:c8,c257,c512,c768 tcontext=u:object_r:default_prop:s0 tclass=file permissive=0 app=com.android.pixellogger
avc: denied { search } for name="ssrdump" dev="dm-44" ino=377 scontext=u:r:logger_app:s0:c8,c257,c512,c768 tcontext=u:object_r:sscoredump_vendor_data_crashinfo_file:s0 tclass=dir permissive=0 app=com.android.pixellogger
avc: denied { search } for name="coredump" dev="dm-44" ino=378 scontext=u:r:logger_app:s0:c8,c257,c512,c768 tcontext=u:object_r:sscoredump_vendor_data_coredump_file:s0 tclass=dir permissive=0 app=com.android.pixellogger
Bug: 264489961
Bug: 269383459
Test: Make sure no avc denied for logger_app when using Pixel Logger
(cherry picked from commit ef1d13d86d
2023-02-20 11:00:59 +00:00
Sean.JS Tsai
8838f4e286
Merge "Revert "Update error on ROM 9624328"" into udc-dev
2023-02-20 05:59:29 +00:00
Sean.JS Tsai
d8572861e3
Revert "Update error on ROM 9624328"
...
This reverts commit cf747f40d6
2023-02-20 04:29:33 +00:00
TreeHugger Robot
ea203448fd
Merge "Update error on ROM 9624328" into udc-dev
2023-02-20 03:28:27 +00:00
sukiliu
cf747f40d6
Update error on ROM 9624328
...
Bug: 269813282
Bug: 269813059
Bug: 268566481
Bug: 269812912
Test: SELinuxUncheckedDenialBootTest
Change-Id: Id8cbfb7c55f2acdc3102b20cdbd2702b594992ba
2023-02-20 10:28:33 +08:00
TreeHugger Robot
c012a8a10a
Merge "hal_health_default: allow to access persist.vendor.shutdown.*" into udc-dev
2023-02-18 13:46:15 +00:00
Kuen-Han Tsai
d0ac5bffa3
SEPolicy: remove tracking denials for hal_usb
...
Remove tracking denials since there is no avc denials related to hal_usb
found in the bug report.
Bug: 264483531
Bug: 264483531
Bug: 264482981
Bug: 264600052
Bug: 264482981
Bug: 264600052
Bug: 261651112
Test: Capture bugreport and check any denials related to hal_usb
Change-Id: I535c94c1112fc51f80b80c99562b43afee32ddd6
2023-02-18 02:41:51 +00:00
neoyu
c0da946f48
Fix avc denied for hal_radioext_default
...
avc: denied { call } for comm="HwBinder:782_1" scontext=u:r:hal_radioext_default:s0 tcontext=u:r:hal_bluetooth_btlinux:s0 tclass=binder permissive=0
Bug: 269684065
Test: manual
Change-Id: I5ebf280feafabf4688718197c79bd6c4cac6e8fe
2023-02-17 08:39:47 +00:00
Ken Tsou
10e84d8327
hal_health_default: allow to access persist.vendor.shutdown.*
...
msg='avc: denied { set } for property=persist.vendor.shutdown.voltage_avg pid=908 uid=1000 gid=1000 scontext=u:r:hal_health_default:s0 tcontext=u:object_r:vendor_default_prop:s0 tclass=property_service permissive=0'
Bug: 266181615
Change-Id: Ia87610f0363bbfbe4fe446244b44818c273841f4
Signed-off-by: Ken Tsou <kentsou@google.com>
2023-02-17 07:00:37 +00:00
Wilson Sung
3432cc6b0b
Enforce system_server and remove obsolete denials
...
Bug: 261519050
Bug: 262455682
Bug: 264489786
Test: boot to home and avc gone
Change-Id: I0a51e029a85af0a77faebfdcfe0b4dc26b71cca6
2023-02-16 05:35:19 +00:00
Wilson Sung
c43a6186bf
Add app_domain to con_monitor_app
...
Bug: 261782930
Bug: 264490077
Test: boot to home and avc gone
Change-Id: I86a0793c93549172ee60397b9735ddcfe0d20bac
2023-02-16 13:00:39 +08:00
TreeHugger Robot
061a2d7f82
Merge "Remove shell related denied"
2023-02-16 04:01:25 +00:00
Jayachandran C
b85f29bb54
Merge "Revert "Add selinux rules for platform_apps to access vendor_ims_app udp socket for read/write of RTP packets.""
2023-02-16 02:59:18 +00:00
Jayachandran C
75fc4f2051
Merge "Allow radio to access IMS stack's socket for sending/receiving RTP packets and aoc_device for codec encoding/decoding"
2023-02-16 02:59:18 +00:00
Wilson Sung
ae2403dca7
Remove shell related denied
...
Bug: 260366321
Bug: 264489784
Change-Id: I21c5011358862ea911a3240aa0ff650d503514e9
2023-02-16 02:21:56 +00:00
Neo Yu
a5eb63a4ca
Merge "Fix avc denied for hal_radioext_default"
2023-02-16 00:34:33 +00:00
Jayachandran C
f54ab444ac
Allow radio to access IMS stack's socket for sending/receiving RTP packets and aoc_device for codec encoding/decoding
...
This fixes the follow denials
Vendor ImsStack denials
================
type=1400 audit(0.0:9): avc: denied { read write } for comm="pool-28-thread-" path="socket:[109431]" dev="sockfs" ino=109431 scontext=u:r:radio:s0 tcontext=u:r:vendor_ims_app:s0:c7,c257,c512,c768 tclass=udp_socket permissive=0 app=com.shannon.imsservice
AOC denials
===========
type=1400 audit(0.0:11): avc: denied { write } for name="acd-audio_rtp_tx" dev="tmpfs" ino=1185 scontext=u:r:radio:s0 tcontext=u:object_r:device:s0 tclass=chr_file permissive=0
type=1400 audit(0.0:12): avc: denied { read } for name="acd-audio_rtp_rx" dev="tmpfs" ino=1186 scontext=u:r:radio:s0 tcontext=u:object_r:device:s0 tclass=chr_file permissive=0
Bug: 259178236
Test: Manually verified on the device with AOC
Change-Id: I000c0c72d8a37ab5680caddd499977db66939bfa
2023-02-15 22:20:56 +00:00
Jayachandran C
8a51382598
Revert "Add selinux rules for platform_apps to access vendor_ims_app udp socket for read/write of RTP packets."
...
This reverts commit ebe77e31f4
2023-02-15 21:31:26 +00:00
