Commit Graph

209 Commits

Author SHA1 Message Date
Ivailo Karamanolev
254d757289 Add rules for Lights AIDL HAL
Test: manual; yukawa and cuttlefish; adb logcat | grep -i avc
Bug: 142230898
Change-Id: I9f576511d1fc77c5f0ad3cf1b96b038b301773d7
2020-01-22 20:33:42 +01:00
Treehugger Robot
13722174b7 Merge "Add selinux contexts for system_config_service" 2020-01-16 22:41:42 +00:00
Wei Wang
32b24c0f0b stable aidl Power HAL policy
Test: boot and dumpsys -l
Change-Id: I58022c9e0c24ba4e2d695acf63375c9f74c51b22
2020-01-15 16:53:40 -08:00
Hall Liu
719bf1b8ca Add selinux contexts for system_config_service
Add selinux contexts for the new system config service.

Test: atest -it -w SystemConfigTest
Bug: 143112379
Change-Id: Ibe67acb404b6951e1fda9ce28bd50a0efdd44c5f
2020-01-15 11:15:29 -08:00
Jon Spivack
ae2df6b5de Add aidl_lazy_test_server
This is a test service for testing dynamic start/stop of AIDL services. In order to test realistic use cases with SELinux enabled, it requires the same permissions as a regular service.

Bug: 147153962
Test: aidl_lazy_test aidl_lazy_test_1 aidl_lazy_test_2
Change-Id: Ifc3b2eaefba9c06c94f9cf24b4474107d4e26563
2020-01-07 15:11:03 -08:00
Victor Hsieh
48a7b5a580 sepolicy: new file_integrity_service
Test: didn't see denials in dmesg during boot or API calls.
Bug: 142573505
Change-Id: Ifa271956bc51bf47d781cd9c9f95afb99c5f940f
2019-12-19 09:25:35 -08:00
Jeffrey Huang
cfe10227fc Merge "system_server: create StatsManagerService" 2019-12-17 23:22:25 +00:00
Songchun Fan
024bc59798 [incremental] allow system server to read /proc/filesystems
Also allow binder service "incremental_service" to be found by service
manager.

Test: boots
BUG: 136132412
Change-Id: I3584a9b69a7e1909f096e3c4579c1834bdfba22e
2019-12-17 09:57:42 -08:00
Jeffrey Huang
215dd2aa9b system_server: create StatsManagerService
Refactor to split the logic within statscompanion_service
The goal of the refactor is to simplify the binder calls to statsd

This service will talk to statsd.

At the end of the refactor, this service should be the only
service that talks to statsd.

Bug: 146074223
Test: Manual by creating the service with empty implementation
Change-Id: Ib9c2e10ec195d41062f1001e5a82b374696de939
2019-12-16 11:50:16 -08:00
Treehugger Robot
a48a2f185e Merge "selinux config for Incremental service" 2019-12-13 19:41:39 +00:00
Songchun Fan
f3380b151d selinux config for Incremental service
BUG: 136132412
Test: boots
Change-Id: I0bff222af54d617b7c849bbed6fa52b96d945e32
2019-12-12 22:01:00 +00:00
Ytai Ben-tsvi
8f7a81ef5d Merge changes I7620902b,Ia7cb4f84,Iff95982d
* changes:
  Allow audio_server to access soundtrigger_middleware service
  Allow soundtrigger_middleware system service
  Allow system service to access audio HAL (for soundtrigger)
2019-12-12 21:42:23 +00:00
Songchun Fan
7a9f01d159 Merge "selinux config for data loader manager service" 2019-12-12 19:50:40 +00:00
Ytai Ben-Tsvi
29c819c015 Allow soundtrigger_middleware system service
New system service, intended to replace all of the soundtrigger
middleware.

Change-Id: Ia7cb4f8436719ca3bf71ea4c2bc32995568ff01d
Bug: 142070343
2019-12-12 10:56:35 -08:00
Songchun Fan
c111e5a9b3 selinux config for data loader manager service
Test: boots
Change-Id: If489054a51838d4215202b5768d46c6278ed1aa2
2019-12-11 17:09:44 -08:00
Kenny Root
6a9f7b265a Merge "Support Resume on Reboot" 2019-12-10 12:59:35 +00:00
Kenny Root
76ea325a3d Support Resume on Reboot
When an OTA is downloaded, the RecoverySystem can be triggered to store
the user's lock screen knowledge factor in a secure way using the
IRebootEscrow HAL. This will allow the credential encrypted (CE)
storage, keymaster credentials, and possibly others to be unlocked when
the device reboots after an OTA.

Bug: 63928581
Test: make
Test: boot emulator with default implementation
Test: boot Pixel 4 with default implementation
Change-Id: I1f02e7a502478715fd642049da01eb0c01d112f6
2019-12-09 14:25:04 -08:00
Treehugger Robot
09ecf475e9 Merge "Add sepolicy for AppIntegrityService." 2019-12-06 18:37:02 +00:00
Treehugger Robot
b1e670c24c Merge "[Tether15] Allow system app to find TetheringManager" 2019-12-06 03:32:50 +00:00
Song Pan
8be46bf2e0 Add sepolicy for AppIntegrityService.
CL that adds the service: http://ag/9554748

BUG:145674997
Test: Manually flash the device. Without this change, the devices goes into a
bootloop (http://gpaste/5033431010377728) if I uncommit the guard in
http://ag/c/platform/frameworks/base/+/9652133/21/services/core/java/com/android/server/integrity/AppIntegrityManagerService.java

Change-Id: Ib2daf9191900d94abeae207e18a77a5914d14783
2019-12-05 12:22:51 +00:00
Hangyu Kuang
ee3a8ea798 MediaTranscodingService: Add sepolicy for MediaTranscodingService.
Bug:145233472
Test: Build and flash the phone.
"adb shell dumpsys -l | grep media" shows media.transcoding service.

Change-Id: I48a42e7b595754989c92a8469eb91360ab6db7c6
2019-12-02 13:57:28 -08:00
Mark Chien
9dfaa7dcc6 [Tether15] Allow system app to find TetheringManager
Bug: 144320246
Test: -build, flash, boot
      -OFF/ON hotspot

Change-Id: I8ce7ac5eb8198f0df4a2da426e3c56e8915e746a
2019-12-02 18:01:33 +08:00
Roshan Pius
d804a76d03 Revert "sepolicy: Permission changes for new wifi mainline module"
This reverts commit 3aa1c1725e.

Reason for revert: Wifi services no longer plan to be a separate
APK/process for mainline. Will instead become a jar loaded from Apex.

Bug: 144722612
Test: Device boots up & connects to wifi networks
Change-Id: Ifa33dae971dccfd5d14991727e2f27d2398fdc74
2019-11-22 09:49:32 -08:00
Terry Wang
9a2296252f Add a new system service for app search management.
This change app-search-service to sepolicy system service.

Bug: 142567528
Test: Manual
Change-Id: Ife7b09365d667da0ad370e586af828f8f4423660
2019-11-18 16:06:58 -08:00
Ilya Matyukhin
517fee8781 Merge "Add AuthService to sepolicy" 2019-11-18 20:45:38 +00:00
Ilya Matyukhin
d2309dafcb Add AuthService to sepolicy
AuthService is introduced in ag/9700446.

Bug: 141025588
Test: can successfully publish AuthService with publishBinderService(...)
Change-Id: I0f9fceac0c555d05a29467e4ab1380f389b60af4
2019-11-16 02:24:30 +00:00
Neil Fuller
dcda8d0bb7 Add new time zone detection service
Add entries necessary for the new time zone detection service.

Bug:140712361
Test: See related frameworks/base change
Change-Id: Ide4244104e2add843c1d699d528328dd71a6b525
2019-11-15 13:33:23 +00:00
Sudheer Shanka
426f2e77c0 Merge "Add a new system service "blob_store"." 2019-11-07 18:04:24 +00:00
James.cf Lin
b5a0c1c0a2 [RCS] Add service context of sepolicy of Context.TELEPHONY_IMS_SERVICE
Bug: 139260938
Test: Manual
Change-Id: I335a955ee7cc2b8e82acd2987c93076fc50dc20a
2019-11-06 21:17:23 +08:00
Steven Moreland
d87649c645 stable aidl vibrator policy
Bug: 141828236
Test: boot, dumpsys -l
Change-Id: Id3fc8724238883116e840794309efbf6c91226c9
2019-10-29 16:39:55 -07:00
Sudheer Shanka
c9d3f222e7 Add a new system service "blob_store".
Bug: 143559646
Test: manual
Change-Id: Id13566e9efc815f4a6ebb7228a1145aa91d6d526
2019-10-29 15:34:11 -07:00
Steven Moreland
3057643aef Merge "Service context for servicemanager." 2019-10-23 17:02:08 +00:00
Steven Moreland
48fbbbeae2 Service context for servicemanager.
Create a service context for manager itself and allow servicemanager to
register itself. This is so that tools like dumpsys can reference
servicemanager the same way they would reference other services.

That things can still get ahold of the servicemanager directly via
libbinder APIs since it is a context manager.

Bug: 136027762
Test: dumpsys -l
Change-Id: If3d7aa5d5284c82840ed1877b969572ce0561d2e
2019-10-16 16:31:42 -07:00
atrost
17a18faf63 Add rule for platform_compat_native service.
Bug: 138275545
Test: Call the service from dumpsys.cpp (http://aosp/1142055)
Change-Id: I259ceb5092d2f1d3e2130ea678ee7fb59cf9e6be
2019-10-14 16:22:55 +01:00
Tri Vo
bfcddbe25e sepolicy: remove ashmemd
Bug: 139855428
Test: m selinux_policy
Change-Id: I8d7f66b16be025f7cb9c5269fae6fd7540c2fdc9
2019-09-27 17:43:53 +00:00
Steven Moreland
d181bc2c16 Remove mediacodec_service.
Since this service no longer exists.

Fix: 80317992
Test: TH, codesearch.
Change-Id: I257c8cc3dba657d98f19eb61b36aae147afea393
2019-08-21 01:19:20 +00:00
Steven Moreland
92f72cd22d Add uce service to core policy.
This service is requested by AOSP framework, but there is no context for
it defined.

Bug: 136023468
Test: N/A
Change-Id: Ibc5b048aaa1c9eda7b9180caca92cb876c3f6b28
Merged-In: Ibc5b048aaa1c9eda7b9180caca92cb876c3f6b28
(cherry picked from commit 67cb30fabf)
2019-08-19 12:29:39 -07:00
Elliott Hughes
509135ac69 Merge "Remove perfprofd references."
am: c807b3fd8a

Change-Id: I90501f397c29847e2e497f10515571fa10f9d992
2019-07-23 17:10:33 -07:00
Elliott Hughes
c807b3fd8a Merge "Remove perfprofd references." 2019-07-23 23:23:15 +00:00
Andrei-Valentin Onea
6863758a7b Merge "Add rule for platform_compat service"
am: 72211e36ad

Change-Id: I6eca69732654e27a9192b4bdca27908539ff0b1e
2019-07-23 08:01:19 -07:00
Elliott Hughes
132b081ee3 Remove perfprofd references.
perfprofd was never finished, and has been removed.

Test: treehugger
Change-Id: I4fc8aa9b737360a66d89c5be39651284ee2d6ffd
2019-07-19 11:15:12 -07:00
Andrei Onea
2bbcc9db89 Add rule for platform_compat service
Bug: 137769727
Test: m
Change-Id: Ib6160a82597198f4a120592293f90ffe1ffb123b
2019-07-19 18:57:11 +01:00
Roshan Pius
3754b4b007 sepolicy: Permission changes for new wifi mainline module
am: 3aa1c1725e

Change-Id: Ia9e876cdd12f1305dacb2961f398c492cc03dadb
2019-07-16 17:20:00 -07:00
Roshan Pius
3aa1c1725e sepolicy: Permission changes for new wifi mainline module
Move wifi services out of system_server into a separate APK/process.

Changes:
a) Created sepolicy for the new wifi apk.
b) The new APK will run with network_stack uid (eventually will be moved
to the same process).

Used 'audit2allow' tool to gather list of permissions required.

Note: The existing wifi related permissions in system_server is left
behind to allow the module to be loaded into system_server or
network_stack process depending on device configuration.

Bug: 113174748
Test: Device boots up and able to make wifi connection.
Test: Tested hotspot functionality.
Test: Ran WifiManagerTest & WifiSoftApTest ACTS tests locally.
Test: Will send for wifi regression tests.
Change-Id: Id19643a235bf0c28238f2729926b893ac2025b97
(cherry-picked from c7aa90091e6bec70a31a643cc4519a9a86fb0b38)
2019-07-16 13:30:15 -07:00
Brad Ebinger
7d8594ab5c Rename service from ircs to ircsmessage
am: 243ef72edb

Change-Id: If9a5c2ce85d4d58bcbaa09cb4da58f6a9cd9009a
2019-07-12 14:54:19 -07:00
Brad Ebinger
243ef72edb Rename service from ircs to ircsmessage
ircs is not specific enough. There will be multiple services in the
future with ircsmessage used specificially for  message store.

Test: compile, tests
Change-Id: Ia7d57e6900c733408be26d6520aa46c512229248
2019-07-11 14:09:51 -07:00
Marco Nelissen
ba258f0ec0 Remove unneeded permissions
Media component update service is removed, so selinux
permissions for it are no longer needed.

Bug: 123250010
Test: boot, play video
Change-Id: I0fec6839f5caf53d16399cb72dcdd6df327efc95
2019-05-09 22:19:33 +00:00
Xiao Ma
7703c2726c Merge "revert ipmemorystore selinux policy." am: f99aa3cb66 am: a2d7ab7f4b
am: ddabaebdec

Change-Id: Iaad8edaaa6a31a3fb23e57555fc4c5e1a4eaa332
2019-04-01 21:19:40 -07:00
Xiao Ma
e2876a3d11 revert ipmemorystore selinux policy.
Since ipmemorystore service has been moved to network stack from
system service, also should revert the relevant sepolicy which is
corresponding to the previous configuration.

Bug: 128392280
Test: atest FrameworksNetTests NetworkStackTests
Change-Id: I1ae09696e620b246f817db71e7b71c32aae9be05
2019-04-01 16:37:25 +09:00
Yifan Hong
b9182b37a5 Merge changes from topic "lpdumpd" am: 40f1682ba6 am: 7f891f414f
am: 75117c19c9

Change-Id: I43b884e08059e242830b56e7ddee62c17e6af422
2019-03-26 16:36:36 -07:00