From 44f5ffca15bf7601b0a1601f9af18b14ba1f34ee Mon Sep 17 00:00:00 2001 From: Nikita Ioffe Date: Fri, 7 Feb 2020 00:10:29 +0000 Subject: [PATCH] Add userspace_reboot_log_prop This properties are used to compute UserspaceRebootAtom and are going to be written by system_server. Also removed now unused userspace_reboot_prop. Test: builds Bug: 148767783 Change-Id: Iee44b4ca9f5d3913ac71b2ac6959c232f060f0ed --- private/compat/29.0/29.0.ignore.cil | 2 +- private/domain.te | 2 +- private/init.te | 2 -- private/property_contexts | 5 ++++- private/system_server.te | 3 +++ public/property.te | 9 ++++++++- 6 files changed, 17 insertions(+), 6 deletions(-) diff --git a/private/compat/29.0/29.0.ignore.cil b/private/compat/29.0/29.0.ignore.cil index 376c0a599..961ca4b24 100644 --- a/private/compat/29.0/29.0.ignore.cil +++ b/private/compat/29.0/29.0.ignore.cil @@ -83,9 +83,9 @@ timezonedetector_service untrusted_app_29 usb_serial_device - userspace_reboot_prop userspace_reboot_config_prop userspace_reboot_exported_prop + userspace_reboot_log_prop vehicle_hal_prop vendor_apex_file vendor_boringssl_self_test diff --git a/private/domain.te b/private/domain.te index 3725e13e3..1f31cea4b 100644 --- a/private/domain.te +++ b/private/domain.te @@ -98,7 +98,7 @@ compatible_property_only(` get_prop({coredomain appdomain shell}, exported_camera_prop) get_prop({coredomain appdomain shell}, userspace_reboot_config_prop) get_prop({coredomain shell}, userspace_reboot_exported_prop) - get_prop({coredomain shell}, userspace_reboot_prop) + get_prop({coredomain shell}, userspace_reboot_log_prop) get_prop({domain -coredomain -appdomain}, vendor_default_prop) ') diff --git a/private/init.te b/private/init.te index 42ec0f36f..b0e7f809a 100644 --- a/private/init.te +++ b/private/init.te @@ -41,9 +41,7 @@ allow init sysfs_dm:file read; set_prop(init, powerctl_prop) # Only init is allowed to set userspace reboot related properties. -set_prop(init, userspace_reboot_prop) set_prop(init, userspace_reboot_exported_prop) -neverallow { domain -init } userspace_reboot_prop:property_service set; neverallow { domain -init } userspace_reboot_exported_prop:property_service set; # Second-stage init performs a test for whether the kernel has SELinux hooks diff --git a/private/property_contexts b/private/property_contexts index 07fbe7a96..1197de352 100644 --- a/private/property_contexts +++ b/private/property_contexts @@ -22,7 +22,6 @@ ro.runtime.firstboot u:object_r:firstboot_prop:s0 hw. u:object_r:system_prop:s0 ro.hw. u:object_r:system_prop:s0 sys. u:object_r:system_prop:s0 -sys.init.userspace_reboot u:object_r:userspace_reboot_prop:s0 sys.init.perf_lsm_hooks u:object_r:init_perf_lsm_hooks_prop:s0 sys.cppreopt u:object_r:cppreopt_prop:s0 sys.linker. u:object_r:linker_prop:s0 @@ -232,3 +231,7 @@ ota.warm_reset u:object_r:ota_prop:s0 # Module properties com.android.sdkext. u:object_r:module_sdkextensions_prop:s0 persist.com.android.sdkext. u:object_r:module_sdkextensions_prop:s0 + +# Userspace reboot properties +sys.userspace_reboot.log. u:object_r:userspace_reboot_log_prop:s0 +persist.sys.userspace_reboot.log. u:object_r:userspace_reboot_log_prop:s0 diff --git a/private/system_server.te b/private/system_server.te index f2f17078b..7b24f4baa 100644 --- a/private/system_server.te +++ b/private/system_server.te @@ -1091,6 +1091,9 @@ allow system_server metadata_file:dir search; allow system_server password_slot_metadata_file:dir rw_dir_perms; allow system_server password_slot_metadata_file:file create_file_perms; +# Allow init to set sysprop used to compute stats about userspace reboot. +set_prop(system_server, userspace_reboot_log_prop) + # JVMTI agent settings are only readable from the system server. neverallow { domain diff --git a/public/property.te b/public/property.te index f30663ae1..ed9cb4b2e 100644 --- a/public/property.te +++ b/public/property.te @@ -19,7 +19,7 @@ system_internal_prop(init_svc_debug_prop) system_internal_prop(last_boot_reason_prop) system_internal_prop(netd_stable_secret_prop) system_internal_prop(pm_prop) -system_internal_prop(userspace_reboot_prop) +system_internal_prop(userspace_reboot_log_prop) compatible_property_only(` # DO NOT ADD ANY PROPERTIES HERE @@ -562,3 +562,10 @@ compatible_property_only(` -extended_core_property_type }:property_service set; ') + +neverallow { + -init + -system_server +} { + userspace_reboot_log_prop +}:property_service set;