The original fs-verity implementation requires CAP_SYS_ADMIN and thus
the actual setup is proxied through installd. Instead, upstream
FS_IOC_ENABLE_VERITY ioctl checks write permission to inode, and thus
can happen in system_server.
Also, replace the old measure ioctl with FS_IOC_SET_VERITY_MEASUREMENT.
Note that although the number is name, they work differently.
Test: set ro.apk_verity.mode=2, in-progress CTS passed without denial
Bug: 112037636
Change-Id: I3e8d14321df8904dfed68b83aae8b3dd99c211ac
There are multiple trusted system components which may be responsible
for creating executable code within an application's home directory.
Renderscript is just one of those trusted components.
Generalize rs_data_file to app_exec_data_file. This label is intended to
be used for any executable code created by trusted components placed
into an application's home directory.
Introduce a typealias statement to ensure files with the previous label
continue to be understood by policy.
This change is effectively a no-op, as it just renames a type, but
neither adds or removes any rules.
Bug: 121375718
Bug: 112357170
Test: cts-tradefed run cts-dev -m CtsRenderscriptTestCases
Change-Id: I17dca5e3e8a1237eb236761862174744fb2196c0
Test: Adding a camera.provider@2.5 to a device works correctly
Merged-In: I516698afedad1294c0af3f4efedb0aed0a141780
Change-Id: I516698afedad1294c0af3f4efedb0aed0a141780
update_engine no longer needs a standalone bspatch executable since [1]
(which first landed into O). And we don't ship /system/bin/bspatch on
device by default.
[1] https://android-review.googlesource.com/c/platform/system/update_engine/+/327365
Test: Verify that /system/bin/bspatch doesn't exist on device.
Test: Trigger an A/B OTA install for aosp_walleye-userdebug:
`m dist`;
`system/update_engine/scripts/update_device.py out/dist/aosp_walleye-ota.zip`.
No update_engine related denial.
Change-Id: Iff578bdb0b1909092dd19feff069755a44d29398
This was a regression in Q, and the file is an implementation of
liblog.
Bug: 113083310
Test: use tags from vendor and see no denials
Change-Id: I726cc1fcfad39afc197b21e431a687a3e4c8ee4a
Add the required permissions for the InputClassifier HAL.
Bug: 62940136
Test: no selinux denials in logcat when HAL is used inside input flinger.
Change-Id: Ibc9b115a83719421d56ecb4bca2fd196ec71fd76
When recording hour-long traces, logcat messages help
to interpret the trace, giving human readable context on what
is happening on the system.
Furthermore this is particularly helpful for startup
debugging thanks to activity manager instrumentation events
(am_on_create_called, am_on_start, ...).
This is only allowed on userdebug/eng builds.
Bug: 122243384
Change-Id: I4dfaebf21107e9853b0bf42403fbab6c3b4d5141
Create the system property ro.gfx.angle.supported that indicates if the
device supports ANGLE. The current planned use of this property is to
allow CTS to validate ANGLE functionality if the device indicates ANGLE
is supported.
Bug: 80239516
Test: Flash the build and verify the property is 'false' for marlin.
Test: Flash the build and verify the property is 'true' for walleye.
Change-Id: I00387db9ade34152f79d75453ea17d5ea7b063cd
The way we build and run CTS expects full_treble_only and
compatible_property_only macros to be applied to whole rules and not be
nested inside other rules.
Fixes: 122601363
Test: corresponding neverallow rule in auto-generated
SELinuxNeverallowRulesTest.java is parsed correctly.
Change-Id: Ibf5187cedca72510fe74c6dc55a75a54a86c02ff
runas_app domain is used by lldb/ndk-gdb/simpleperf to debug/profile
debuggable apps. But it misses permissions to ptrace app processes and
read /proc/<app_pid> directory.
Bug: none
Test: build and boot marlin.
Test: run lldb and simpleperf on apps with target sdk version 24-29.
Change-Id: I9e6f940ec81a8285eae8db3b77fb1251a25dedd0
In order to use the bionic libs and the dynamic linker from the runtime
APEX for all processes that are started after the APEX is activated, the
paths /system/lib/{libc.so|libm.so|libdl.so} and /system/bin/linker are
bind-mounted to the corresponding bionic libs and the dynamic linker
in the runtime APEX.
This bind mount allows us to keep other part of the platform and the
tests having implicit assumption that bionic libs are located at
/system/lib and loaded from the default linker namespace.
Bug: 120266448
Test: device boots
Change-Id: Ied611b267d187ee3d75a139c378ee12242d5b8d8
Recent change in netd and bpfloader switched the creater of bpf maps
from netd to bpfloader. Change the rules related to it to make sure it
doesn't fail.
Test: dumpsys netd trafficcontroller
Bug: 112334572
Change-Id: I016ff68b58ef7b12bdfdebc2fd178be1d0206a62
For consistency with APKs, signature verification is performed
in the system_server. This includes checking that the signature of
an updated install matches the signature of the active package that
it updates. For this, it requires search access to /data/apex and
read access to the files under that directory.
Test: m
Change-Id: Ia073adb8892886e4767fa5529e95c110b9cbff1b
Test: basic workflow between apexd and PackageManager tested with
changes being developed.
Bug: 118865310
Change-Id: I1ae866f33e9b22493585e108c4fd45400493c7ac
This prevents denials while taking a bugreport.
Bug: 116711254
Test: cts-tradefed run cts -m CtsSecurityHostTestCases -t
android.security.cts.SELinuxHostTest#testNoBugreportDenials
Change-Id: I64f441eb66c355d03eaf7755f2e9d3e970305ecd
This was originally implemented in commit
890414725f and reverted in commit
fa3eb773ce. This effectively reverts the
revert, with minimal changes to cope with the subsequent reversion of
commit b362474374.
Auditing is only enabled for apps targeting API <= 28.
Test: Compiles, audit messages are seen.
Bug: 121333210
Bug: 111338677
Change-Id: Ie38498a2b61f4b567902117f9ef293faa0e689dd
In order to boot into GSI, we need init's first-stage block-device
machinery to find userdata. This will create its symlink before sepolicy
is loaded, leading to denials in the second stage.
Bug: 121209697
Test: device boots
Change-Id: Ibf3398c811016e09747116cf17393e8d22541bb2
e2bc9fe9d5ac82457bc6050bf705ff43a1b05cbf in platform/art project added
the dynamic linker to the runtime APEX. Since the dynamic linker has
been labeled as 'system_linker_exec' so does the linker in the APEX.
Bug: 120266448
Test: ls -Z /apex/com.android.runtime/bin/linker
u:object_r:system_linker_exec:s0 /apex/com.android.runtime/bin/linker
Change-Id: I243b86a74d94058b3283830c32232c6584639ff3
