Merge "O MR1 is API 27" into oc-mr1-dev
diff --git a/private/file_contexts b/private/file_contexts
index 49d954b..8804352 100644
--- a/private/file_contexts
+++ b/private/file_contexts
@@ -89,7 +89,7 @@
/dev/hw_random u:object_r:hw_random_device:s0
/dev/hwbinder u:object_r:hwbinder_device:s0
/dev/i2c-[0-9]+ u:object_r:i2c_device:s0
-/dev/input(/.*) u:object_r:input_device:s0
+/dev/input(/.*)? u:object_r:input_device:s0
/dev/iio:device[0-9]+ u:object_r:iio_device:s0
/dev/ion u:object_r:ion_device:s0
/dev/keychord u:object_r:keychord_device:s0
diff --git a/public/domain.te b/public/domain.te
index e550485..c143315 100644
--- a/public/domain.te
+++ b/public/domain.te
@@ -106,7 +106,7 @@
# devices
not_full_treble(`
allow domain vendor_file_type:dir { search getattr };
- allow domain vendor_file_type:file { execute read open getattr };
+ allow domain vendor_file_type:file { execute read open getattr map };
allow domain vendor_file_type:lnk_file { getattr read };
')
@@ -117,12 +117,12 @@
# Everyone can read and execute all same process HALs
allow domain same_process_hal_file:dir r_dir_perms;
-allow domain same_process_hal_file:file { execute read open getattr };
+allow domain same_process_hal_file:file { execute read open getattr map };
# Any process can load vndk-sp libraries, which are system libraries
# used by same process HALs
allow domain vndk_sp_file:dir r_dir_perms;
-allow domain vndk_sp_file:file { execute read open getattr };
+allow domain vndk_sp_file:file { execute read open getattr map };
# All domains get access to /vendor/etc
allow domain vendor_configs_file:dir r_dir_perms;
@@ -139,7 +139,7 @@
# Allow reading and executing out of /vendor to all vendor domains
allow { domain -coredomain } vendor_file_type:dir r_dir_perms;
- allow { domain -coredomain } vendor_file_type:file { read open getattr execute };
+ allow { domain -coredomain } vendor_file_type:file { read open getattr execute map };
allow { domain -coredomain } vendor_file_type:lnk_file { getattr read };
')
@@ -775,13 +775,6 @@
-mediaextractor
} tombstoned_crash_socket:unix_stream_socket connectto;
-neverallow {
- domain
- -crash_dump
- -mediacodec
- -mediaextractor
-} tombstoned_crash_socket:sock_file write;
-
# Never allow anyone except dumpstate or the system server to connect or write to
# the tombstoned intercept socket.
neverallow { domain -dumpstate -system_server } tombstoned_intercept_socket:sock_file write;
diff --git a/public/hal_configstore.te b/public/hal_configstore.te
index 795592f..d5f2ef6 100644
--- a/public/hal_configstore.te
+++ b/public/hal_configstore.te
@@ -8,6 +8,10 @@
# this HAL should be restricted to different clients. Thus, the allow rules for
# clients are defined in the .te files of the clients.
+# hal_configstore runs with a strict seccomp filter. Use crash_dump's
+# fallback path to collect crash data.
+crash_dump_fallback(hal_configstore_server)
+
###
### neverallow rules
###
@@ -33,11 +37,14 @@
-hal_configstore_server
-logd
userdebug_or_eng(`-su')
+ -tombstoned
}:{ unix_dgram_socket unix_stream_socket } *;
# Should never need access to anything on /data
neverallow hal_configstore_server {
data_file_type
+ -anr_data_file # for crash dump collection
+ -tombstone_data_file # for crash dump collection
-zoneinfo_data_file # granted to domain
}:{ file fifo_file sock_file } *;
diff --git a/public/te_macros b/public/te_macros
index c7802d5..e8c667d 100644
--- a/public/te_macros
+++ b/public/te_macros
@@ -234,7 +234,7 @@
# Find passthrough HAL implementations
allow $2 system_file:dir r_dir_perms;
allow $2 vendor_file:dir r_dir_perms;
-allow $2 vendor_file:file { read open getattr execute };
+allow $2 vendor_file:file { read open getattr execute map };
')
')
@@ -253,7 +253,7 @@
# Find passthrough HAL implementations
allow $2 system_file:dir r_dir_perms;
allow $2 vendor_file:dir r_dir_perms;
-allow $2 vendor_file:file { read open getattr execute };
+allow $2 vendor_file:file { read open getattr execute map };
')
#####################################