Commit Graph

1085 Commits

Author SHA1 Message Date
Tao Bao
81cec4011b Merge "Grant update_verifier sysfs access." into oc-dr1-dev 2017-07-07 17:28:35 +00:00
TreeHugger Robot
8014ac1c9a Merge changes from topic 'elabel' into oc-dr1-dev
* changes:
  Add copy from /persist/elabel to /data/misc/elabel
  Add permissions for elabel data access
2017-07-07 15:39:47 +00:00
Patrick Tjin
4402ccfb27 Add copy from /persist/elabel to /data/misc/elabel
Bug: 62837579
Test: place test files in /persist/elabel, check that they are copied to /data/misc/elabel on boot
Change-Id: Id29e7c7c01ed54bf4d2f488cfa6dba51046bc5bf
Merged-In: Id29e7c7c01ed54bf4d2f488cfa6dba51046bc5bf
2017-07-07 03:04:46 +00:00
Jeff Vander Stoep
0e1346c32c Add permissions for elabel data access
Allow init to copy elabel data from /persist/elabel to
/data/misc/elabel. Allow settings app to access elabel data
from /data/misc/elabel.

Bug: 62837579
Change-Id: Ie2241abe8c2384a537b001a90830a3f42c566748
Merged-In: Ie2241abe8c2384a537b001a90830a3f42c566748
2017-07-07 03:03:52 +00:00
TreeHugger Robot
f00d7ba646 Merge "Enable ramdump on debug.htc.ramdump.crash" into oc-dr1-dev 2017-07-07 02:39:23 +00:00
TreeHugger Robot
92f59e7bf0 Merge "add rmt_storage to "shutdown critical"" into oc-dr1-dev 2017-07-07 02:11:43 +00:00
TreeHugger Robot
271fd0c603 Merge "Wahoo sepolicy changes" into oc-dr1-dev 2017-07-07 02:09:47 +00:00
Andrew Chant
dceb04a94f Enable ramdump on debug.htc.ramdump.crash
Enable ramdump on a live system by enabling the
property debug.htc.ramdump.crash.

This property is protected by selinux policy
with the label ramdump_prop.

Bug: 62437259
Test: forced ramdump from Ramdump Uploader app.
Change-Id: Ifa9b7cf22749c0686e7d01ca2a4fc10dbd4b729c
2017-07-06 17:43:43 -07:00
Keun-young Park
fca9e0cc79 add rmt_storage to "shutdown critical"
- should be kept to write modem data befure shutdown.

bug: 37626581
Test: build only

Change-Id: I8ce1c590a84fb0ad04a93c135c1b1f86bc59a69f
2017-07-06 22:58:41 +00:00
TreeHugger Robot
c0622b2134 Merge "libnfc-brcm.conf changes for NCI2.0" into oc-dr1-dev 2017-07-06 22:39:45 +00:00
Wei Wang
ac6bf2845b Merge "init.hardware.rc: shutdown ssr_setup early to avoid subsystem restart" into oc-dr1-dev 2017-07-06 22:36:46 +00:00
Siddharth Ray
078daa1c8b Wahoo sepolicy changes
Wahoo's sepolicy is changed merged to add Marlin permissions
based on compliance test needs. Marlin's sepolicy can be
found at device/google/marlin/sepolicy/hal_gnss_default.te

Bug: 37409476
Test: Boots with no avc denials or crashes. GNSS incl. post XTRA
delete runs well with no denials.

Change-Id: Id51197120d142850fe0d7c97f747818e23c178f8
2017-07-06 12:30:04 -07:00
Tao Bao
13c6400e11 Grant update_verifier sysfs access.
avc: denied { read } for pid=694 comm="update_verifier" name="block" dev="sysfs" ino=27770 scontext=u:r:update_verifier:s0 tcontext=u:object_r:sysfs:s0 tclass=dir
avc: denied { read } for pid=719 comm="update_verifier" name="name" dev="sysfs" ino=51336 scontext=u:r:update_verifier:s0 tcontext=u:object_r:sysfs:s0 tclass=file

update_verifier reads /sys/block/dm-X/dm/name to find the device-mapper
entries for system and vendor partitions.

Also remove the unneeded "block_device:dir r_dir_perms" permission.

Bug: 63146601
Test: As follows.
  a) Set up /data/ota_package/care_map.txt.
  b) Reset the slot boot-successful flag with fastboot set_active.
  c) Boot the device and check update_verifier successfully verifies
     the blocks.
Change-Id: I581136249e93ec2d4bd9ceda316590ee31148643
2017-07-06 12:04:45 -07:00
TreeHugger Robot
f5ed4d3d87 Merge changes I45a49628,Icf764bf3 into oc-dr1-dev
* changes:
  Fix netmgrd crash recovery denials
  sepolicy: Separate system partition sepolicy and hal macros from vendor partition
2017-07-06 16:11:19 +00:00
Lorenzo Colitti
7b9577e9b0 Merge "Device specific wakeup packet mark/mask" into oc-dr1-dev 2017-07-06 15:19:11 +00:00
TreeHugger Robot
e7d2b88004 Merge "sepolicy for mke2fs tools" into oc-dr1-dev 2017-07-06 14:24:05 +00:00
Jayachandran C
06f2fdfb7e Fix netmgrd crash recovery denials
This change fixes the following denials

auditd  : type=1400 audit(0.0:30032): avc: denied { unlink } for
comm="netmgrd" name="netmgr_connect_socket" dev="tmpfs" ino=31621
scontext=u:r:netmgrd:s0 tcontext=u:object_r:netmgrd_socket:s0
tclass=sock_file permissive=0

auditd  : type=1400 audit(0.0:35887): avc: denied { search } for
comm="netmgrd" name="diagchar" dev="sysfs" ino=26926
scontext=u:r:netmgrd:s0 tcontext=u:object_r:sysfs_diag:s0 tclass=dir
permissive=0

Test: Force crashed netmgrd and validated data working

Bug: 63360347
Change-Id: I45a49628b486cb264e07037cfa8397e381f72a00
2017-07-05 18:52:15 -07:00
Sunmeet Gill
28511cb3df sepolicy: Separate system partition sepolicy and hal macros from vendor partition
Test: VoLTE, VT & VoWiFi on Vzw and T-Mobile SIM cards

Bug: 62574674

Change-Id: Icf764bf353bbdfb7831f5ea8528414a271525c63
2017-07-05 16:24:33 -07:00
TreeHugger Robot
4e86a6c446 Merge "vndk: add ro.vendor.vndk.version" into oc-dr1-dev 2017-07-05 23:21:19 +00:00
TreeHugger Robot
555d3c7910 Merge "Disable snapshat timer" into oc-dr1-dev 2017-07-05 20:12:36 +00:00
TreeHugger Robot
7bfa327827 Merge "Revert "Copy libz.so to vndk-sp"" into oc-dr1-dev 2017-07-05 13:11:35 +00:00
Logan Chien
1b65c6d094 Revert "Copy libz.so to vndk-sp"
This reverts commit b5f9e31877.  This
commit removes libz.so from /system/lib[64]/vndk-sp.

We have to remove libz.so from vndk-sp because we don't have a good
mechanism to stop "classloader" linker namespace from loading
/system/lib[64]/vndk-sp/libz.so.  Other alternatives require significant
changes to dynamic linker or CTS test cases.

Let's temporarily revert the commit to fix b/62195853 for oc-dr1-dev.
The long-term solution will be discussed in b/37617391.

Bug: 62195853
Bug: 37617391
Test: Boot sailfish to home screen.
Change-Id: I8591c153a1159ccfce6591b6cdc75722364e564b
2017-07-05 11:17:31 +08:00
Erik Kline
924d8f36c6 Place non-mobile tethering upstream types first
Test: as follows
    - built
    - flashed
    - booted
    - "runtest frameworks-net" passes
    - started USB tethering and switched upstreams between mobile and wifi
Bug: 63282480

Change-Id: I2b8cd7d56cfe5131df017ec0a437be01bab2b2d8
2017-07-04 20:06:19 +09:00
Jiyong Park
e332929400 vndk: add ro.vendor.vndk.version
The version of VNDK that the vendor is built against is recorded in the
vendor partition. The version will be used by the dynamic linker to load
the correct version of ld.config.txt to use.

Bug: 63130475
Test: taimen build and boots
Change-Id: Iee9a87340b90bf618c2d241820820f45f114b9f7
2017-07-04 10:02:25 +09:00
Sunny Kapdi
f128f5c538 Enable bt wcnss_filter to collect crash dumps
Bug: 37298084
Change-Id: Id67e4faf27ea6d59fdbcc2affcd1f2e6eb2ba3dd
2017-07-01 00:39:26 -07:00
Thierry Strudel
2af5bf9c49 Merge "system.prop: prefix QCOM properties with vendor." into oc-dr1-dev 2017-07-01 06:07:29 +00:00
TreeHugger Robot
9d015bae3b Merge "Move chmod of /dev/diag earlier for sensors access" into oc-dr1-dev 2017-07-01 01:19:36 +00:00
TreeHugger Robot
867145cecc Merge "Don't create /data/misc/sensors" into oc-dr1-dev 2017-07-01 01:13:27 +00:00
TreeHugger Robot
570b61e066 Merge "Add SPN override: Telstra 505-01" into oc-dr1-dev 2017-06-30 23:51:44 +00:00
Roopesh Rajashekharaiah Nataraja
739f448717 Add policies to remove System UID from time service
Bug: 62785008
Change-Id: I85cdaa618da7beddce88d4b67bd1b9d08c0a9c00
2017-06-30 23:16:39 +00:00
Wei Wang
454fc3e786 wahoo: time_daemon: use /persist to store offset to RTC
Also cleanup sepolicy files that was using /data/vendor as they are not
needed and /data is not ready by the time we start time_daemon

Bug: 62184939
Test: walleye boot with correct time in airplane mode
Change-Id: Ic7b025a8c795092a1dd4b1ab1d7497d1440c0a4b
2017-06-30 23:15:48 +00:00
Mikhail Naganov
e5216684d4 Merge "Remove Broadcast Radio HAL impl library" into oc-dr1-dev 2017-06-30 22:46:42 +00:00
Thierry Strudel
8b09662508 system.prop: prefix QCOM properties with vendor.
Change-Id: Iee87c702cc6eaf832373f128ff3b6e395f5031f0
Signed-off-by: Thierry Strudel <tstrudel@google.com>
2017-06-30 15:41:15 -07:00
TreeHugger Robot
51bb8f9e19 Merge "AOD: Enable binned brightness sensor" into oc-dr1-dev 2017-06-30 21:37:38 +00:00
Jayachandran C
7765618ee4 Disable snapshat timer
Test: Changed the mode using hidden menu multiple times and verified
      the device doesn't report roaming.

Bug: 62622461
Change-Id: I51aefef9d574faf3c46e19e07f8c4fe187bf29d2
2017-06-30 21:27:41 +00:00
Mikhail Naganov
4f3f9535d4 Remove Broadcast Radio HAL impl library
There is no support for FM radio on this line of devices.
Having this HAL impl in place was confusing VTS tests runner
as broadcast radio HAL was present in the output of 'lshal'.

Bug: 33050893
Test: audio works, no impl lib in /vendor/lib[64]/hw,
      no broadcastradio in lshal output

Change-Id: I35b4d6329de8b04032b456fb048b0b8728024a64
2017-06-30 10:36:21 -07:00
Jeff Vander Stoep
b06c4b445b Move chmod of /dev/diag earlier for sensors access
openat(AT_FDCWD, "/dev/diag", O_RDWR)   = -1 EACCES (Permission denied)

denied { dac_override } for pid=772 comm="sensors.qcom" capability=1
scontext=u:r:sensors:s0 tcontext=u:r:sensors:s0 tclass=capability

Bug: 62955057
Test: build and flash. Denial no longer occurs
Change-Id: I960ff4eeb5afe194751541958a4af33f487e3d3c
2017-06-30 09:50:35 -07:00
Jeff Vander Stoep
aaaafebf1c Allow qseecomd to write to persist_data
Needed for drm.
avc: denied { read } for comm="qseecomd" name="/" dev="sdd3" ino=2
scontext=u:r:tee:s0 tcontext=u:object_r:persist_file:s0 tclass=dir
avc: denied { open } for comm="qseecomd" path="/persist" dev="sdd3"
scontext=u:r:tee:s0 tcontext=u:object_r:persist_file:s0 tclass=dir
avc: denied { write } for comm="qseecomd" name="widevine" dev="sdd3"
ino=97 scontext=u:r:tee:s0 tcontext=u:object_r:persist_data_file:s0
tclass=dir
avc: denied { add_name } for comm="qseecomd" scontext=u:r:tee:s0
tcontext=u:object_r:persist_data_file:s0 tclass=dir permissive=1
avc: denied { create } for comm="qseecomd scontext=u:r:tee:s0
tcontext=u:object_r:persist_data_file:s0 tclass=file permissive=1
avc: denied { write } for comm="qseecomd" scontext=u:r:tee:s0
tcontext=u:object_r:persist_data_file:s0
tclass=file permissive=1:persist_file:s0 tclass=dir permissive=1
avc: denied { open } scontext=u:r:tee:s0
tcontext=u:object_r:persist_file:s0 tclass=dir permissive=1
avc: denied { write } for comm="qseecomd" name="widevine"
scontext=u:r:tee:s0 tcontext=u:object_r:persist_data_file:s0
tclass=dir permissive=1
avc: denied { add_name } for comm="qseecomd" scontext=u:r:tee:s0
tcontext=u:object_r:persist_data_file:s0 tclass=dir permissive=1
avc: denied { create } for comm="qseecomd" scontext=u:r:tee:s0
tcontext=u:object_r:persist_data_file:s0 tclass=file permissive=1
avc: denied { write } scontext=u:r:tee:s0
tcontext=u:object_r:persist_data_file:s0 tclass=file permissive=1

Bug: 63051358
Test: build
Change-Id: I28bd0cd816720a85fc840890a74929939366de6d
2017-06-30 14:07:37 +00:00
Adrian Roos
f31e1ea587 AOD: Enable binned brightness sensor
Change-Id: Ib7e80cd8887652984275f51101c6863fb528685d
Fixes: 38354633
Test: Enable AOD, expose to various light conditions, observe that AOD adjusts brightness
2017-06-30 15:06:40 +02:00
Ruchi Kandoi
1222584436 libnfc-brcm.conf changes for NCI2.0
Test: tag read, payments and Android beam
Bug: 63146248
Change-Id: I20e044f77a2857a2aea219a67858a459958eb8e8
2017-06-30 01:33:36 +00:00
Meng Wang
8683217c90 Add SPN override: Telstra 505-01
Bug: 63051322
Test: make
Change-Id: I3b8f16026c3fbbc978e9d518d3709832f1386f6f
2017-06-29 18:18:19 -07:00
Brian Duddie
fba8eebc74 Don't create /data/misc/sensors
This folder is used for storing QC slang scripts, which are not used on
this device.

Bug: 38425697
Test: load, sanity check sensors
Change-Id: Ie40e356c57e98355117833df05f59e26c4754e74
2017-06-29 16:36:38 -07:00
Brian Duddie
ee8cd6b127 Allow sensors daemon to create vendor data files
Add an entry to init.hardware.rc to create /data/vendor/sensors at
startup, and sepolicy entries that allow the sensors daemon to create
files in that directory. These will be used to persist runtime
calibration across reboot, but not across factory reset.

denied { getattr } for pid=14080 comm="sensors.qcom"
path="/data/vendor/sensors/cal.txt" dev="sda45" ino=2179116
scontext=u:r:sensors:s0 tcontext=u:object_r:system_data_file:s0
tclass=file permissive=1
denied { write } for pid=14113 comm="sensors.qcom" name="vendor"
dev="sda45" ino=2179073 scontext=u:r:sensors:s0
tcontext=u:object_r:system_data_file:s0 tclass=dir permissive=1
denied { add_name } for pid=14113 comm="sensors.qcom" name="sensors"
scontext=u:r:sensors:s0 tcontext=u:object_r:system_data_file:s0
tclass=dir permissive=1
denied { create } for pid=14113 comm="sensors.qcom" name="sensors"
scontext=u:r:sensors:s0 tcontext=u:object_r:system_data_file:s0
tclass=dir permissive=1
denied { create } for pid=14113 comm="sensors.qcom" name="cal.bin"
scontext=u:r:sensors:s0 tcontext=u:object_r:system_data_file:s0
tclass=file permissive=1
denied { write open } for pid=14113 comm="sensors.qcom"
path="/data/vendor/sensors/cal.bin" dev="sda45" ino=2179115
scontext=u:r:sensors:s0 tcontext=u:object_r:system_data_file:s0
tclass=file permissive=1
denied { read } for pid=14113 comm="sensors.qcom"
path="/data/vendor/sensors/cal.txt" dev="sda45" ino=2179116
scontext=u:r:sensors:s0 tcontext=u:object_r:system_data_file:s0
tclass=file permissive=1
denied { getattr } for pid=14113 comm="sensors.qcom"
path="/data/vendor/sensors/cal.txt" dev="sda45" ino=2179116
scontext=u:r:sensors:s0 tcontext=u:object_r:system_data_file:s0
tclass=file permissive=1

Bug: 38425697
Test: confirm folder is created on boot, and calibration files are
created, updated, and read successfully by sensors daemon
Change-Id: Ie23cafe4f43b3335e07cf0d13dde0c5d06b69f80
2017-06-29 16:36:38 -07:00
Ecco Park
53c92f3bb8 Merge "Remove vendor_executes_system_violator attribute" into oc-dr1-dev 2017-06-29 23:18:04 +00:00
Subhani Shaik
c272f35b8b Remove vendor_executes_system_violator attribute
Bug: 62385687
Test: No svc denial error, wifi is working fine.
Change-Id: I47cad9cab9b2e60ccf4b692daae7042b44804b05
2017-06-29 20:26:18 +00:00
Thierry Strudel
0d721f2f62 Merge "init.hardware.rc: enforce system UID/GID on tftp-server files" into oc-dr1-dev 2017-06-29 15:32:41 +00:00
Ed Tam
1fe3fbbda7 Merge "Revert "Wahoo sepolicy changes"" into oc-dr1-dev 2017-06-29 09:29:00 +00:00
Ed Tam
7d05a3ba89 Revert "Wahoo sepolicy changes"
This reverts commit eb6f000bff.

Reason for revert: Causing runtime restarts

Bug: 63123125
Change-Id: I3f4752c7ff29f52957f28b0f0c84de2c11a06f40
2017-06-29 08:49:47 +00:00
Thierry Strudel
777768fbf0 init.hardware.rc: enforce system UID/GID on tftp-server files
Enforce correct system as UID/GID on tftp-server used files

Bug: 62544362
Change-Id: I92a346576c4e0af2187317281acc7e53599787eb
Signed-off-by: Thierry Strudel <tstrudel@google.com>
2017-06-28 21:36:21 -07:00
TreeHugger Robot
730070f3d2 Merge "declare ipacm as the tetheroffload HAL" into oc-dr1-dev 2017-06-29 04:26:10 +00:00