Commit Graph

528 Commits

Author SHA1 Message Date
Max Bires
d3ca10d532 Putting folio_daemon into enforcing mode.
Bug: 34784662
Test: folio_daemon continues to function while in enforcing
Change-Id: I9aefd2a8e95883a3782e63b8c4a3ed1ee5ca5435
2017-05-10 19:04:26 -07:00
Max Bires
bed4cb170b Merge "Fixing the following denials" 2017-05-10 18:01:00 +00:00
Pawin Vongmasa
3122f21f85 Merge "Update media_profiles.xml, add version, and move to vendor/etc" 2017-05-10 11:58:54 +00:00
Max Bires
687d2a7434 Merge "Fixing Taimen OTAs for enforcing before turning it on globally" 2017-05-10 02:17:53 +00:00
Thierry Strudel
a36f7d963e Merge changes from topic 'fstab-wahoo'
* changes:
  fstab.hardware: disable metadata encryption
  move fstab and BOARD_AVB_ENABLE to wahoo
2017-05-09 22:02:53 +00:00
Max Bires
30326ba8bf Fixing the following denials
denied  { write } for  pid=520 comm="ueventd" name="uevent" dev="sysfs"
ino=35415 scontext=u:r:ueventd:s0 tcontext=u:object_r:sysfs_graphics:s0
tclass=file

denied { search } for pid=763 comm="perfd" name="fb0" dev="sysfs"
ino=35414 scontext=u:r:perfd:s0 tcontext=u:object_r:sysfs_graphics:s0
tclass=dir

denied { read } for pid=763 comm="perfd" name="modes" dev="sysfs"
ino=35431 scontext=u:r:perfd:s0 tcontext=u:object_r:sysfs_graphics:s0
tclass=file

denied { search } for pid=666 comm="light@2.0-servi"
name="800f000.qcom,spmi" dev="sysfs" ino=19444
scontext=u:r:hal_light_default:s0
tcontext=u:object_r:sysfs_msm_subsys:s0 tclass=dir

denied { create } for pid=771 comm="Loc_hal"
scontext=u:r:hal_gnss_qti:s0 tcontext=u:r:hal_gnss_qti:s0
tclass=udp_socket

denied { ioctl } for pid=755 comm="Loc_hal" path="socket:[64279]"
dev="sockfs" ino=64279 ioctlcmd=89fd scontext=u:r:hal_gnss_qti:s0
tcontext=u:r:hal_gnss_qti:s0 tclass=udp_socket

denied { ioctl } for pid=771 comm="Loc_hal" path="socket:[54210]"
dev="sockfs" ino=54210 ioctlcmd=c304 scontext=u:r:hal_gnss_qti:s0
tcontext=u:r:hal_gnss_qti:s0 tclass=socket

denied { create } for pid=771 comm="Loc_hal" name="xtra"
scontext=u:r:hal_gnss_qti:s0 tcontext=u:object_r:location_data_file:s0
tclass=dir

denied { create read getattr lock unlink } for pid=771 comm="Loc_hal"
name="xtra.sqlite" scontext=u:r:hal_gnss_qti:s0
tcontext=u:object_r:location_data_file:s0 tclass=file

denied { ioctl } for pid=798 comm="Loc_hal" path="socket:[64664]"
dev="sockfs" ino=64664 ioctlcmd=c302 scontext=u:r:hal_gnss_qti:s0
tcontext=u:r:hal_gnss_qti:s0 tclass=socket

denied { connectto } for pid=755 comm="NtpDown"
path="/dev/socket/dnsproxyd" scontext=u:r:hal_gnss_qti:s0
tcontext=u:r:netd:s0 tclass=unix_stream_socket

denied { create bind } for pid=755 comm="Loc_hal"
scontext=u:r:hal_gnss_qti:s0 tcontext=u:r:hal_gnss_qti:s0
tclass=netlink_generic_socket

denied  { find } for interface=android.hardware.graphics.mapper::IMapper
pid=564 scontext=u:r:hal_graphics_composer_default:s0
tcontext=u:object_r:hal_graphics_mapper_hwservice:s0
tclass=hwservice_manager

denied { search } for pid=428 comm="kworker/6:2" name="firmware"
dev="sde14" ino=229 scontext=u:r:kernel:s0
tcontext=u:object_r:vendor_firmware_file:s0 tclass=dir

denied { ioctl } for pid=798 comm="Loc_hal" path="/dev/binder"
dev="tmpfs" ino=10125 ioctlcmd=6201 scontext=u:r:hal_gnss_qti:s0
tcontext=u:object_r:binder_device:s0 tclass=chr_file

denied { call } for pid=798 comm="Loc_hal" scontext=u:r:hal_gnss_qti:s0
tcontext=u:r:servicemanager:s0 tclass=binder

denied  { write } for  pid=1 comm="init" name="debug_suspend"
dev="debugfs" ino=997 scontext=u:r:init:s0
tcontext=u:object_r:debugfs:s0 tclass=file

Bug: 34784662
Test: The above denials no longer appear during operation
Change-Id: I4c713ea9147fe613564ed39d874005cfa7b928a5
2017-05-09 13:19:13 -07:00
Max Bires
0a4f88cbd3 Fixing Taimen OTAs for enforcing before turning it on globally
denied { ioctl } for pid=570 comm="boot@1.0-servic"
path="/dev/block/sde" dev="tmpfs" ino=19779 ioctlcmd=1268
scontext=u:r:hal_bootctl_default:s0 tcontext=u:object_r:block_device:s0
tclass=blk_file

denied { open } for pid=570 comm="boot@1.0-servic" path="/dev/block/sde"
dev="tmpfs" ino=19779 scontext=u:r:hal_bootctl_default:s0
tcontext=u:object_r:block_device:s0 tclass=blk_file

denied { read write } for pid=570 comm="boot@1.0-servic" name="sde"
dev="tmpfs" ino=19779 scontext=u:r:hal_bootctl_default:s0
tcontext=u:object_r:block_device:s0 tclass=blk_file

denied { getattr } for pid=570 comm="boot@1.0-servic"
path="/dev/block/sde13" dev="tmpfs" ino=19819
scontext=u:r:hal_bootctl_default:s0 tcontext=u:object_r:block_device:s0
tclass=blk_file

Bug: 34784662
Test: OTAs work
Change-Id: Idd78395353c54f5d81220f7c8073ab90ee22af2f
2017-05-09 13:17:44 -07:00
Thierry Strudel
a8ed387f1c fstab.hardware: disable metadata encryption
Bug: 38137299
Bug: 38133157
Change-Id: I4bae0df21238126fcadce48697ecba91b05ef057
Signed-off-by: Thierry Strudel <tstrudel@google.com>
2017-05-09 12:20:47 -07:00
Thierry Strudel
36d09bf13f move fstab and BOARD_AVB_ENABLE to wahoo
Change-Id: I057403bb22241cc756f714019f4c2d2efeb4cd3e
Signed-off-by: Thierry Strudel <tstrudel@google.com>
2017-05-09 12:20:01 -07:00
Wei Wang
cb8982e861 Merge "whaoo: enable low persist_mode for VR" 2017-05-09 18:15:23 +00:00
TreeHugger Robot
658dd78713 Merge "Use hardware feature definition to indicate Passpoint support" 2017-05-09 17:21:36 +00:00
Wei Wang
42fd4ba288 whaoo: enable low persist_mode for VR
Access to /sys/class/graphics/fb0/msm_fb_persist_mode is needed for light HAL.

Bug: 36660424
Test: display is going into low persistence mode in daydream
Change-Id: Ie54120ee70b2b3e4acb4d9d5f1ec1c0d75d93a81
2017-05-09 16:14:08 +00:00
Roshan Pius
c311fcaa79 Merge "wahoo: Add wifi HAL's to vintf" 2017-05-09 15:26:08 +00:00
TreeHugger Robot
78cc5b001c Merge "Allow rild permissions to connect to time-daemon" 2017-05-09 00:03:44 +00:00
TreeHugger Robot
b7f1991e17 Merge "Create debug folder for camera." 2017-05-08 23:33:23 +00:00
TreeHugger Robot
88cd3de342 Merge "Fixing the following permissions for userdebug/eng builds" 2017-05-08 23:16:27 +00:00
TreeHugger Robot
5b08e0cc0e Merge "DTAG: Correct APN settings." 2017-05-08 23:15:33 +00:00
Naveen Kalla
7a309b9218 Allow rild permissions to connect to time-daemon
Fix denial below seen when eMBMS app is started

 rild    : type=1400 audit(0.0:4912): avc: denied { connectto } for
 path=0074696D655F67656E6F6666 scontext=u:r:rild:s0
 tcontext=u:r:time_daemon:s0 tclass=unix_stream_socket permissive=0

Bug: 38101466
Test: Open eMBMS app on the device and ensure that Registration
      works.

Change-Id: I3ef51be29032c3a69c6aa1184d89fc320165059d
2017-05-08 15:13:34 -07:00
Chia-Kai Liang
1461f0e029 Create debug folder for camera.
Bug: 38048356
Test: Build/run locally.

Change-Id: Ic89464492e54f91925fabebeaf3458c259e9d957
2017-05-08 14:22:55 -07:00
Max Bires
a25607c7ed Fixing the following permissions for userdebug/eng builds
denied { add_name } for name="eis_log_012916_640563.txt"
scontext=u:r:hal_camera_default:s0
tcontext=u:object_r:system_data_file:s0 tclass=dir

denied { create } for name="eis_log_012916_640563.txt"
scontext=u:r:hal_camera_default:s0
tcontext=u:object_r:system_data_file:s0 tclass=file

denied { write open } for path="/data/eis/eis_log_012916_640563.txt"
dev="dm-0" ino=2195458 scontext=u:r:hal_camera_default:s0
tcontext=u:object_r:system_data_file:s0 tclass=file

denied { getattr } for path="/data/eis/gyro_log_012916_640563.txt"
dev="dm-0" ino=2195459 scontext=u:r:hal_camera_default:s0
tcontext=u:object_r:system_data_file:s0 tclass=file

Bug: 38048356
Test: Camera debug information is properly written out
Change-Id: I0066d745ac4598905e6b23e2b958d71a4d53e9fe
2017-05-08 13:18:39 -07:00
Max Bires
491b6ca95b Merge "Fixing the following startup denials" 2017-05-08 19:51:59 +00:00
TreeHugger Robot
1eacb86367 Merge "Keep sys.usb.state in sync with sys.usb.config" 2017-05-08 19:23:04 +00:00
Max Bires
c7e3c64341 Merge "Fixing folio_daemon's dac_override request." 2017-05-08 18:10:02 +00:00
Roshan Pius
d1459e1d82 wahoo: Add wifi HAL's to vintf
Bug: 36097884
Test: Device boots up and connects to wifi networks.
Change-Id: I1707d0e68cd3a389e86dcbfd0b650e4c9f5b1b7c
2017-05-08 11:07:10 -07:00
Badhri Jagan Sridharan
c595b65d20 Keep sys.usb.state in sync with sys.usb.config
Userspace code expects the same value to be set on sys.usb.state
as sys.usb.config.

Bug: 37491031
Test: verified that the same props are set.
Change-Id: I62246df765d96a3da5529a40fa4a4cff7a5a56ce
2017-05-08 18:04:03 +00:00
Peng Xu
7fc605a415 Merge "Disable uneccesary sensor from qcom sensor hal" 2017-05-08 17:57:24 +00:00
Max Bires
793c4d4fff Fixing the following startup denials
denied { read } for pid=9993 comm="imsrcsd"
name="u:object_r:hwservicemanager_prop:s0" dev="tmpfs" ino=18098
scontext=u:r:hal_rcsservice:s0
tcontext=u:object_r:hwservicemanager_prop:s0 tclass=file

denied { ioctl } for pid=702 comm="Loc_hal" path="socket:[59758]"
dev="sockfs" ino=59758 ioctlcmd=c304 scontext=u:r:hal_gnss_qti:s0
tcontext=u:r:hal_gnss_qti:s0 tclass=socket

Bug: 34784662
Test: These denials no longer seen at startup
Change-Id: Ia10fc44b60806054d1c67bf001201cb550145922
2017-05-08 10:18:50 -07:00
TreeHugger Robot
99dbd94e0d Merge "Add configstore to device manfiest." 2017-05-08 17:09:02 +00:00
Max Bires
ee5998fbad Fixing folio_daemon's dac_override request.
Moving folio_daemon out of group/user of root and into group/user of
system to fix the dac_override selinux denial it was generating when
trying to access /dev/uinput

Bug: 38031432
Test: The phone boots and folio daemon encounters no denials
Change-Id: I48feab07eeffc90b73fabce46394c53a2278e5ca
2017-05-08 08:41:43 -07:00
Peng Xu
f25275079d Disable uneccesary sensor from qcom sensor hal
Disable uneccesary wakeup secondary sensors and unused algorithm.

Test: device boot ok
Bug: 36617405
Change-Id: Ib95f735eed3ef3ae5501f916fae6ace93e963e8d
2017-05-07 19:10:22 -07:00
TreeHugger Robot
e935caf46a Merge "Add sensor qdsp access" 2017-05-07 06:43:21 +00:00
Jiyong Park
59b2c5a0b9 wahoo: move vndk-sp libs to /system/lib/vndk-sp and RS libs
With this CL, wahoo devices have the same status with marlin/sailfish
in terms of vndk-sp libs.

Bug: 37550338
Bug: 37483222
Test: RenderScript apps work (e.g. CameraScript)
Test: boot successful without following message:
failed to load /vendor/lib64/egl/libEGL_adreno.so from sphal namespace:
dlopen failed: library "libcutils.so" not found

Change-Id: I4a2159395904c2597ed74785b00dca4487aea715
2017-05-07 03:13:04 +00:00
Pawin Vongmasa
b8baad990f Update media_profiles.xml, add version, and move to vendor/etc
- Replace the dtd part of media_profiles.xml with a reference to
/system/etc/media_profiles_V1_0.dtd
- Rename media_profiles.xml to media_profiles_V1_0.xml
- Change the target output directory from system/etc to vendor/etc

Test: Small CtsMediaTestCases

Bug: 36430270
Change-Id: Ife191ed2efdff5db7af589d4700a1c6665e95873
2017-05-05 20:20:56 -07:00
Thierry Strudel
fad17c05c2 Merge "init: move some of the permission settings to early-boot" 2017-05-06 02:41:47 +00:00
TreeHugger Robot
4a3cab4a6b Merge "security permissions for CNE and UCE service" 2017-05-06 02:37:42 +00:00
TreeHugger Robot
c28c74b1bc Merge "Add IOmx and IOmxStore to vintf manifest" 2017-05-06 02:11:08 +00:00
TreeHugger Robot
742dc749d5 Merge "Remove <impl> from manifest" 2017-05-06 02:02:59 +00:00
TreeHugger Robot
da4edea6d2 Merge "Fix the name and interface of UCE Hal" 2017-05-06 01:22:39 +00:00
Yifan Hong
5f5b11391c Add configstore to device manfiest.
Test: boots

Bug: 36097717
Bug: 38001671
Change-Id: I6f2fe251816d6758dd4acd35c7de561e13d6625c
2017-05-05 17:33:58 -07:00
TreeHugger Robot
94a9883628 Merge "Allow non-ramdump perms on user build" 2017-05-06 00:25:26 +00:00
TreeHugger Robot
d6c8d292b6 Merge "device.mk: SSRestartDetector is included elsewhere" 2017-05-06 00:25:26 +00:00
Pawin Vongmasa
3258c390b4 Add IOmx and IOmxStore to vintf manifest
Test: Boots

Bug: 36097717
Change-Id: I92e49c5e4895473022d77fd0493e8c42a82273f8
2017-05-05 17:10:02 -07:00
David Lin
515ec3f053 init: move some of the permission settings to early-boot
Permission settings that are required by HAL services need to be moved
to early-boot to avoid race.

Bug: 38043660
Bug: 36571736
Change-Id: I1397816a162e8ef4ed557e6eea3539201dc57e3b
Signed-off-by: David Lin <dtwlin@google.com>
2017-05-05 17:01:13 -07:00
Sunmeet Gill
2052d84827 security permissions for CNE and UCE service
Bug: 37994408
Test: Ensure SELinux denials are not seen in logs for IMS
Change-Id: I4910d422d768c1c0b0f348156ac0a2c17b3ddad6
2017-05-05 16:58:31 -07:00
Pawin Vongmasa
0b4fa928dd Remove <impl> from manifest
Test: Boots

Bug: 36602724
Change-Id: Ib7678b50165030e5ffd4e8c41e3948df9caff443
2017-05-05 16:54:46 -07:00
Jeff Vander Stoep
15df5d8ddf Allow non-ramdump perms on user build
Addresses:
Abort message: 'jni_internal.cc:508] JNI FatalError called:
frameworks/base/core/jni/com_android_internal_os_Zygote.cpp:640:
selinux_android_setcontext failed'

avc: denied { open } scontext=u:r:ssr_detector_app:s0
tcontext=u:object_r:sysfs_msm_subsys:s0 tclass=file
avc: denied { read } scontext=u:r:ssr_detector_app:s0
tcontext=u:object_r:sysfs_msm_subsys:s0 tclass=file
avc: denied { getattr } scontext=u:r:ssr_detector_app:s0
tcontext=u:object_r:sysfs_msm_subsys:s0 tclass=file
avc: denied { search } scontext=u:r:ssr_detector_app:s0
tcontext=u:object_r:sysfs_msm_subsys:s0 tclass=dir

Bug: 34784662
Test: build and boot user-build
Change-Id: I3e879222038b6b2742c6d8c8e4f3a15dcf4f43dc
2017-05-05 15:35:47 -07:00
Peter Qiu
dc878246fe Use hardware feature definition to indicate Passpoint support
Bug: 36886243
Test: Manual test
Change-Id: I92ffbe929c8ba971de5b090ddec679bd343bcb62
2017-05-05 15:35:14 -07:00
Tajinder Gadh
3a7ceff650 Merge "Add activity zen to dnd overlay" 2017-05-05 22:26:15 +00:00
TreeHugger Robot
c4ca00b7ab Merge "Enable metadata encryption" 2017-05-05 22:19:02 +00:00
Naveen Kalla
ccae8ba222 Fix the name and interface of UCE Hal
Change the name and interface of UCE HAL to IUceService/uceservice0

Test: Ensure imsrcsd comes up and connects to UceShimService
      lshal should show the proper HAL

Change-Id: Ic6c1fdbbd44411519fa3313d5d03075616c8f6ce
2017-05-05 14:39:57 -07:00