PWN-Hunter/android_system_sepolicy
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add userspace_reboot_log_prop

Browse Source 
This properties are used to compute UserspaceRebootAtom and are going to
be written by system_server. Also removed now unused
userspace_reboot_prop.

Test: builds
Bug: 148767783
Change-Id: Iee44b4ca9f5d3913ac71b2ac6959c232f060f0ed
This commit is contained in:
Nikita Ioffe 2020-02-07 00:10:29 +00:00
parent c79be18ddd
commit 44f5ffca15
6 changed files with 17 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
private/compat/29.0/29.0.ignore.cil
View File

@ -83,9 +83,9 @@
timezonedetector_service
untrusted_app_29
usb_serial_device
userspace_reboot_prop
userspace_reboot_config_prop
userspace_reboot_exported_prop
userspace_reboot_log_prop
vehicle_hal_prop
vendor_apex_file
vendor_boringssl_self_test

2
private/domain.te
View File

@ -98,7 +98,7 @@ compatible_property_only(`
get_prop({coredomain appdomain shell}, exported_camera_prop)
get_prop({coredomain appdomain shell}, userspace_reboot_config_prop)
get_prop({coredomain shell}, userspace_reboot_exported_prop)
get_prop({coredomain shell}, userspace_reboot_prop)
get_prop({coredomain shell}, userspace_reboot_log_prop)
get_prop({domain -coredomain -appdomain}, vendor_default_prop)
')

2
private/init.te
View File

@ -41,9 +41,7 @@ allow init sysfs_dm:file read;
set_prop(init, powerctl_prop)
# Only init is allowed to set userspace reboot related properties.
set_prop(init, userspace_reboot_prop)
set_prop(init, userspace_reboot_exported_prop)
neverallow { domain -init } userspace_reboot_prop:property_service set;
neverallow { domain -init } userspace_reboot_exported_prop:property_service set;
# Second-stage init performs a test for whether the kernel has SELinux hooks

5
private/property_contexts
View File

@ -22,7 +22,6 @@ ro.runtime.firstboot u:object_r:firstboot_prop:s0
hw. u:object_r:system_prop:s0
ro.hw. u:object_r:system_prop:s0
sys. u:object_r:system_prop:s0
sys.init.userspace_reboot u:object_r:userspace_reboot_prop:s0
sys.init.perf_lsm_hooks u:object_r:init_perf_lsm_hooks_prop:s0
sys.cppreopt u:object_r:cppreopt_prop:s0
sys.linker. u:object_r:linker_prop:s0
@ -232,3 +231,7 @@ ota.warm_reset u:object_r:ota_prop:s0
# Module properties
com.android.sdkext. u:object_r:module_sdkextensions_prop:s0
persist.com.android.sdkext. u:object_r:module_sdkextensions_prop:s0
# Userspace reboot properties
sys.userspace_reboot.log. u:object_r:userspace_reboot_log_prop:s0
persist.sys.userspace_reboot.log. u:object_r:userspace_reboot_log_prop:s0

3
private/system_server.te
View File

@ -1091,6 +1091,9 @@ allow system_server metadata_file:dir search;
allow system_server password_slot_metadata_file:dir rw_dir_perms;
allow system_server password_slot_metadata_file:file create_file_perms;
# Allow init to set sysprop used to compute stats about userspace reboot.
set_prop(system_server, userspace_reboot_log_prop)
# JVMTI agent settings are only readable from the system server.
neverallow {
domain

9
public/property.te
View File

@ -19,7 +19,7 @@ system_internal_prop(init_svc_debug_prop)
system_internal_prop(last_boot_reason_prop)
system_internal_prop(netd_stable_secret_prop)
system_internal_prop(pm_prop)
system_internal_prop(userspace_reboot_prop)
system_internal_prop(userspace_reboot_log_prop)
compatible_property_only(`
# DO NOT ADD ANY PROPERTIES HERE
@ -562,3 +562,10 @@ compatible_property_only(`
-extended_core_property_type
}:property_service set;
')
neverallow {
-init
-system_server
} {
userspace_reboot_log_prop
}:property_service set;