PWN-Hunter/android_system_sepolicy
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
ce15e5e510
android_system_sepolicy/private
History
Jiyong Park ce15e5e510 Allow apexd to label apk_tmp_file to apex_data_file 
Currently, when an APEX is staged, apexd moves the file from
/data/app/vmdl*.tmp directory to /data/apex. However, the original file
is labeled with apk_tmp_file and is not readable from apexd.

We plan to resolve this issue by moving the file content via file
descriptor in between the package manager and apexd.

However, until the plan is implemented, temporarily allow apexd to
relabel the file to apex_data_file that is readable to it. This unblocks
the end-to-end test for APEX.

Bug: 112669193
Test: adb install --apex system/apex/apexd/apexd_testdata/test.apex
adb reboot; adb root; adb shell; cmd apexservice getActivePackages
The test APEX is activated

Change-Id: Ib9d4f5c699261f1fa1e6d557731767ee4d7168f9
2018-12-03 22:05:24 +09:00
..
compat Add placeholder iris and face policy for vold data directory 2018-11-30 11:37:19 -08:00
access_vectors Update access_vectors 2018-11-01 19:53:50 -07:00
adbd.te [SEPolicy] Configure policy for gpu service. 2018-11-08 12:31:11 -08:00
apexd.te Allow apexd to label apk_tmp_file to apex_data_file 2018-12-03 22:05:24 +09:00
app_neverallows.te SEPolicy changes to allow kcov access in userdebug. 2018-11-30 10:56:29 -08:00
app.te Move some rules around 2018-11-28 17:55:21 -08:00
asan_extract.te Sepolicy: Add ASAN-Extract 2017-04-05 13:09:29 -07:00
atrace.te sepolicy: add rules for traced_probes to capture stderr and kill atrace on timeout 2018-11-16 14:47:19 +00:00
audioserver.te Allow audioserver to access persist.log.tag 2018-11-08 19:01:47 +09:00
binder_in_vendor_violators.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
binderservicedomain.te Move binderservicedomain policy to private 2017-02-08 09:09:39 -08:00
blank_screen.te Introduce system_file_type 2018-09-27 12:52:09 -07:00
blkid_untrusted.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
blkid.te Introduce system_file_type 2018-09-27 12:52:09 -07:00
bluetooth.te bluetooth: allow TUNGETIFF TUNSETIFF 2018-11-10 09:03:10 -08:00
bluetoothdomain.te Move bluetoothdomain policy to private 2017-02-06 15:32:08 -08:00
bootanim.te Dontaudit denials caused by race with labeling. 2018-02-14 17:07:13 -08:00
bootstat.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
bpfloader.te Introduce system_file_type 2018-09-27 12:52:09 -07:00
bufferhubd.te Update SELinux Policy for bufferhubd 2018-09-24 12:29:43 -07:00
bug_map Track isolated_app SELinux denial. 2018-11-29 07:07:55 +00:00
cameraserver.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
charger.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
clatd.te domain_deprecated is dead 2017-07-28 22:01:46 +00:00
coredomain.te Wider neverallow rules for coredomain /dev access. 2018-11-29 19:01:48 -08:00
cppreopts.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
crash_dump.te Add policy for apexd. 2018-10-04 07:06:45 +00:00
dex2oat.te domain_deprecated is dead 2017-07-28 22:01:46 +00:00
dexoptanalyzer.te Introduce system_file_type 2018-09-27 12:52:09 -07:00
dhcp.te domain_deprecated is dead 2017-07-28 22:01:46 +00:00
dnsmasq.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
domain.te Move some rules around 2018-11-28 17:55:21 -08:00
drmserver.te Tighten restrictions on core <-> vendor socket comms 2017-03-31 09:17:54 -07:00
dumpstate.te Allow dumpstate to call gpuservice over binder 2018-11-13 12:36:30 -08:00
ephemeral_app.te Revert "auditallow app_data_file execute" 2018-08-13 11:23:02 -07:00
fastbootd.te Add sepolicy for fastbootd 2018-08-15 08:45:22 -07:00
file_contexts Add placeholder iris and face policy for vold data directory 2018-11-30 11:37:19 -08:00
file_contexts_asan Label /data/asan/* libs as system_lib_file. 2018-10-10 11:23:00 -07:00
file_contexts_overlayfs fs_mgr: add /mnt/scratch to possible overlayfs support directories 2018-10-08 14:23:01 +00:00
file.te SEPolicy changes to allow kcov access in userdebug. 2018-11-30 10:56:29 -08:00
fingerprintd.te domain_deprecated is dead 2017-07-28 22:01:46 +00:00
flags_health_check.te sepolicy for server configurable flags 2018-11-01 03:28:56 +00:00
fs_use fs_mgr: add overlayfs handling for squashfs system filesystems 2018-08-08 07:33:10 -07:00
fsck_untrusted.te domain_deprecated is dead 2017-07-28 22:01:46 +00:00
fsck.te Allow access to the metadata partition for metadata encryption. 2018-01-19 14:45:08 -08:00
fwk_bufferhub.te Allow bufferhub service to allocate buffer 2018-11-07 13:57:55 -08:00
gatekeeperd.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
genfs_contexts SEPolicy changes to allow kcov access in userdebug. 2018-11-30 10:56:29 -08:00
gpuservice.te [gpuservice] allow "adb shell cmd gpu vkjson" 2018-11-27 15:58:20 -08:00
hal_allocator_default.te Introduce system_file_type 2018-09-27 12:52:09 -07:00
hal_system_suspend_default.te Introduce system_file_type 2018-09-27 12:52:09 -07:00
halclientdomain.te Restrict access to hwservicemanager 2017-04-21 09:54:53 -07:00
halserverdomain.te Allow hals to read hwservicemanager prop. 2017-03-23 01:50:50 +00:00
healthd.te healthd provides health@2.0 service. 2017-10-17 13:48:42 -07:00
heapprofd.te Property to enable heap profile from process startup. 2018-11-19 21:52:43 +00:00
hwservice_contexts Add public Codec2 HIDL interfaces 2018-11-30 05:11:21 -08:00
hwservicemanager.te Finer grained permissions for ctl. properties 2018-05-22 13:47:16 -07:00
idmap.te Add idmap2 and idmap2d 2018-11-15 14:42:10 +00:00
incident_helper.te Introduce system_file_type 2018-09-27 12:52:09 -07:00
incident.te Introduce system_file_type 2018-09-27 12:52:09 -07:00
incidentd.te Add rules to dump health traces 2018-11-27 17:36:07 -08:00
init.te Allow init to set powerctl property 2018-11-27 15:47:12 -08:00
initial_sid_contexts Split general policy into public and private components. 2016-10-06 13:09:06 -07:00
initial_sids Split general policy into public and private components. 2016-10-06 13:09:06 -07:00
inputflinger.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
install_recovery.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
installd.te Ensure taking a bugreport generates no denials. 2018-03-08 02:25:18 +00:00
iorapd.te iorapd: Add new binder service iorapd. 2018-10-08 15:00:34 -07:00
isolated_app.te Tighten up handling of new classes 2018-11-16 03:10:14 -08:00
iw.te Allow iw to be run at init phase. 2018-11-14 19:10:12 +00:00
kernel.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
keys.conf Split general policy into public and private components. 2016-10-06 13:09:06 -07:00
keystore.te Allow Keystore to check security logging property. 2018-01-24 19:49:18 +00:00
llkd.te Add policy for apexd. 2018-10-04 07:06:45 +00:00
lmkd.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
logd.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
logpersist.te sepolicy: Add rules for non-init namespaces 2017-11-21 08:34:32 -07:00
mac_permissions.xml Move MediaProvider to its own domain, add new MtpServer permissions 2016-12-12 11:05:33 -08:00
mdnsd.te Introduce system_file_type 2018-09-27 12:52:09 -07:00
mediadrmserver.te update sepolicy for gralloc HAL 2017-03-30 14:43:35 -07:00
mediaextractor.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
mediametrics.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
mediaprovider.te mediaprovider: add functionfs ioctl 2018-10-17 10:14:40 -07:00
mediaserver.te mediacodec->mediacodec+hal_omx{,_server,_client} 2018-05-30 18:12:32 +00:00
mediaswcodec.te add mediaswcodec service 2018-10-11 15:10:17 -07:00
mls sepolicy: Allow apps to get info from priv_app by ashmem 2018-10-23 12:37:03 +08:00
mls_decl sepolicy: add version_policy tool and version non-platform policy. 2016-12-06 08:56:02 -08:00
mls_macros Split general policy into public and private components. 2016-10-06 13:09:06 -07:00
modprobe.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
mtp.te domain_deprecated is dead 2017-07-28 22:01:46 +00:00
net.te Update socket ioctl restrictions 2018-06-22 05:35:07 +00:00
netd.te Allow netd to setup xt_bpf iptable rules 2018-03-21 14:37:37 -07:00
netutils_wrapper.te Start the process of locking down proc/net 2018-05-04 21:36:33 +00:00
nfc.te SE Policy for Secure Element app and Secure Element HAL 2018-01-29 21:31:42 +00:00
otapreopt_chroot.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
otapreopt_slot.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
perfetto.te Allow adb root to send config to perfetto 2018-11-20 10:05:45 +00:00
performanced.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
perfprofd.te Sepolicy for system suspend HAL. 2018-08-13 17:26:34 -07:00
platform_app.te app: Allow all apps to read dropbox FDs 2018-09-04 20:23:43 +00:00
policy_capabilities Add nnp_nosuid_transition policycap and related class/perm definitions. 2018-09-07 10:52:31 -07:00
port_contexts Split general policy into public and private components. 2016-10-06 13:09:06 -07:00
postinstall_dexopt.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
postinstall.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
ppp.te domain_deprecated is dead 2017-07-28 22:01:46 +00:00
preloads_copy.te Add sepolicy for preloads_copy script 2018-10-23 17:11:36 +01:00
preopt2cachename.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
priv_app.te drop priv_app app_data_file:file execute; 2018-10-27 15:20:38 -07:00
profman.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
property_contexts Property to enable heap profile from process startup. 2018-11-19 21:52:43 +00:00
racoon.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
radio.te Add label for time (zone) system properties 2018-06-25 17:59:56 +01:00
recovery_persist.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
recovery_refresh.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
recovery.te domain_deprecated is dead 2017-07-28 22:01:46 +00:00
roles_decl sepolicy: add version_policy tool and version non-platform policy. 2016-12-06 08:56:02 -08:00
runas_app.te Add runas_app domain to allow running app data file via run-as. 2018-11-07 18:11:40 +00:00
runas.te domain_deprecated is dead 2017-07-28 22:01:46 +00:00
sdcardd.te domain_deprecated is dead 2017-07-28 22:01:46 +00:00
seapp_contexts Add runas_app domain to allow running app data file via run-as. 2018-11-07 18:11:40 +00:00
secure_element.te SE Policy for Secure Element app and Secure Element HAL 2018-01-29 21:31:42 +00:00
security_classes Update access_vectors 2018-11-01 19:53:50 -07:00
service_contexts [SEPolicy] Name GPU service back to "gpu" 2018-11-16 12:58:35 -08:00
service.te Update SELinux Policy for bufferhubd 2018-09-24 12:29:43 -07:00
servicemanager.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
sgdisk.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
shared_relro.te domain_deprecated is dead 2017-07-28 22:01:46 +00:00
shell.te [gpuservice] allow "adb shell cmd gpu vkjson" 2018-11-27 15:58:20 -08:00
slideshow.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
stats.te Incidentd gets statsd incident section 2018-11-13 09:18:34 -08:00
statsd.te Incidentd gets statsd incident section 2018-11-13 09:18:34 -08:00
storaged.te Introduce system_file_type 2018-09-27 12:52:09 -07:00
su.te SELinux policies for Perfetto cmdline client (/system/bin/perfetto) 2018-01-29 11:06:00 +00:00
surfaceflinger.te Remove coredomain /dev access no longer needed after Treble 2018-11-29 04:56:18 +00:00
system_app.te remove system_app proc_net_type access 2018-10-11 10:20:19 -07:00
system_server_startup.te Transient SELinux domain for system_server JIT 2018-10-31 12:32:01 +00:00
system_server.te system_server: Allow binder connections to iorapd 2018-11-29 15:37:22 -08:00
technical_debt.cil Rename untrusted_app_visible_*' to include 'violators'. 2018-08-21 21:32:41 +00:00
thermalserviced.te Sync internal master and AOSP sepolicy. 2017-09-26 14:38:47 -07:00
tombstoned.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
toolbox.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
traced_probes.te sepolicy: add rules for traced_probes to capture stderr and kill atrace on timeout 2018-11-16 14:47:19 +00:00
traced.te Introduce system_file_type 2018-09-27 12:52:09 -07:00
traceur_app.te Allow Traceur app to remove trace files. 2018-02-20 17:03:08 -08:00
tzdatacheck.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
ueventd.te domain_deprecated is dead 2017-07-28 22:01:46 +00:00
uncrypt.te domain_deprecated is dead 2017-07-28 22:01:46 +00:00
untrusted_app_25.te place dex2oat auditallow statements in userdebug_or_eng blocks 2018-11-20 10:50:22 -08:00
untrusted_app_27.te place dex2oat auditallow statements in userdebug_or_eng blocks 2018-11-20 10:50:22 -08:00
untrusted_app_all.te SEPolicy changes to allow kcov access in userdebug. 2018-11-30 10:56:29 -08:00
untrusted_app.te Add untrusted_app_27 2018-04-03 12:25:51 -07:00
update_engine_common.te Split general policy into public and private components. 2016-10-06 13:09:06 -07:00
update_engine.te domain_deprecated is dead 2017-07-28 22:01:46 +00:00
update_verifier.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
usbd.te usbd sepolicy 2018-01-20 03:41:21 +00:00
users Split general policy into public and private components. 2016-10-06 13:09:06 -07:00
vdc.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
vendor_init.te Remove vendor_init from coredomain 2018-01-29 18:07:41 +00:00
virtual_touchpad.te Vendor domains must not use Binder 2017-03-24 07:54:00 -07:00
vold_prepare_subdirs.te Add placeholder iris and face policy for vold data directory 2018-11-30 11:37:19 -08:00
vold.te domain_deprecated is dead 2017-07-28 22:01:46 +00:00
vr_hwc.te Restrict access to hwservicemanager 2017-04-21 09:54:53 -07:00
wait_for_keymaster.te Introduce system_file_type 2018-09-27 12:52:09 -07:00
watchdogd.te Move watchdogd out of init and into its own domain 2018-08-03 19:28:05 +00:00
webview_zygote.te Allow webview_zygote to JIT. 2018-11-20 13:31:49 +00:00
wificond.te SE Policy for Wifi Offload HAL 2017-05-18 09:49:55 -07:00
wpantund.te lowpan: Add wpantund to SEPolicy 2017-10-16 14:10:40 -07:00
zygote.te Allow zygote to JIT. 2018-11-17 19:46:11 +00:00