It has been added into core policy through
https://android-review.googlesource.com/c/platform/system/sepolicy/+/503421.
Bug: 63440407
Test: update_verifier successfully triggers blocks verification and
marks a sucessful boot;
Test: No sysfs_dm related denials on walleye.
Change-Id: I5605af8b10d890489c25f16f82274f828e10e751
(cherry picked from commit e2c0c287fb)
It´s an runtime check now so we don´t need the build time variable anymore.
The behaviour changed with this commit:
391ab069b1
Change-Id: I41f88455a9a303a6a07cb5bce33b43578c25a5d0
Signed-off-by: Lennart Wieboldt <lennart.1997@gmx.de>
Sharing data folders by path will be disallowed because it violates
the approved API between platform and vendor components tested by
VTS. Move all violating permissions from core selinux policy to
device specific policy so that we can exempt existing devices from
the ban and enforce it on new devices.
Bug: 34980020
Test: Move permissions. Build and test wifi, wifi AP, nfc, fingerprint
and Play movies on Marlin.
Test: build Taimen
Change-Id: I1c2f2acac02266f8d07ff1fc3c69329af0aa2f3d
This driver is not safe for general use, particularly for third party
apps, even on debug builds.
Adding OWNERS file in a subsequent commit to prevent security violations
like this from getting checked in.
Test: build
Change-Id: I245244e924ae247b6fbd48aa033bb71cca6067de
Merged-In: I245244e924ae247b6fbd48aa033bb71cca6067de
(cherry picked from commit 23ea15a12a)
Annotate processes that violate the ban including fingerprint and
widevine HALs.
Bug: 34980020
Test: build
Change-Id: I4afa03841e1648d4624e66bbd5ed21d09d357547
Merged-In: I4afa03841e1648d4624e66bbd5ed21d09d357547
(cherry picked from commit 458d1f6a6e)
This separates the data of audioserver from the data of the
hal_audio.
Bug: 35042759
Test: no SELinux denials for hal_audio
Change-Id: I2eafed4d8a620507e27cab3a9b84d829d003bcec
Merged-In: I1815c5debaa6d6d2076cebf8beb5acd36c6fe891
On taimen some of the files under /sys/class/power_supply are symlinks
to these dirs.
Addresses these denials on taimen:
avc: denied { read } for comm="android.hardwar" name="type" dev="sysfs"
ino=50110 scontext=u:r:hal_health_default:s0
tcontext=u:object_r:sysfs:s0 tclass=file permissive=0
avc: denied { read } for comm="android.hardwar" name="type" dev="sysfs"
ino=48182 scontext=u:r:hal_health_default:s0
tcontext=u:object_r:sysfs:s0 tclass=file permissive=0
Bug: 68962942
Test: builds, boots, files are correctly labeled.
Change-Id: I2b972f4f471b54097354d3e490a02300182a8e9a
Instead give obdm_app read access to /proc/stat.
Bug: 65643247
Test: can login to obdm app without selinux denials
Merged-In: I368c018f883610364cd026da68085935aefd69c1
Change-Id: I368c018f883610364cd026da68085935aefd69c1
(cherry picked from commit 036ef1ebc2)
These were moved from vendor to fwk policy:
1. sysfs_net type declaration
2. labeling of /sys/devices/virtual/net with sysfs_net
3. netd access to sysfs_net
Bug: 65643247
Test: can browse internet without netd denials
Test: netd_unit_test, netd_integration_test without netd denials
Merged-In: I9e6ec7ab24039bc74a7e47f423222334fed8bf3a
Change-Id: I9e6ec7ab24039bc74a7e47f423222334fed8bf3a
(cherry picked from commit 661dbb6d30)
This was picked up transitively previously, but that transitive
include is removed, so we include it explicitly here.
Test: build
Change-Id: I023831d0fbe474d363201f792bbfb3f7ea38cd9b
(cherry picked from commit c2b4ce4e0a)
This policy belongs in global policy.
(cherry-pick of commit: e498eb7ee2)
Bug: 62102757
Test: Builds and boots.
Change-Id: I099e1fbed6e1c648d0d5f1570ba3207c197f3233
/dev/input(/.*)? u:object_r:input_device:s0
Is now in core policy. Remove from device specific policy.
(cherry-pick of commit: 1fa31288a0)
Bug: 64954704
Test: build
Change-Id: Id16dccff58843e619e5197661f7ffabc22c3e213
