Merge "init: support /dev/input"
diff --git a/Android.bp b/Android.bp
index 1785342..26102c9 100644
--- a/Android.bp
+++ b/Android.bp
@@ -1,4 +1,41 @@
-subdirs = [
- "tests",
- "build",
-]
+// Copyright (C) 2018 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+se_filegroup {
+ name: "26.0.board.compat.map",
+ srcs: [
+ "compat/26.0/26.0.cil",
+ ],
+}
+
+se_filegroup {
+ name: "27.0.board.compat.map",
+ srcs: [
+ "compat/27.0/27.0.cil",
+ ],
+}
+
+se_cil_compat_map {
+ name: "26.0.cil",
+ srcs: [
+ ":26.0.board.compat.map",
+ ],
+}
+
+se_cil_compat_map {
+ name: "27.0.cil",
+ srcs: [
+ ":27.0.board.compat.map",
+ ],
+}
diff --git a/Android.mk b/Android.mk
index e155177..ffdc5c4 100644
--- a/Android.mk
+++ b/Android.mk
@@ -476,26 +476,6 @@
#################################
include $(CLEAR_VARS)
-LOCAL_MODULE := 27.0.cil
-LOCAL_SRC_FILES := private/compat/27.0/27.0.cil
-LOCAL_MODULE_CLASS := ETC
-LOCAL_MODULE_TAGS := optional
-LOCAL_MODULE_PATH := $(TARGET_OUT)/etc/selinux/mapping
-
-include $(BUILD_PREBUILT)
-#################################
-include $(CLEAR_VARS)
-
-LOCAL_MODULE := 26.0.cil
-LOCAL_SRC_FILES := private/compat/26.0/26.0.cil
-LOCAL_MODULE_CLASS := ETC
-LOCAL_MODULE_TAGS := optional
-LOCAL_MODULE_PATH := $(TARGET_OUT)/etc/selinux/mapping
-
-include $(BUILD_PREBUILT)
-#################################
-include $(CLEAR_VARS)
-
LOCAL_MODULE := plat_and_mapping_sepolicy.cil.sha256
LOCAL_MODULE_CLASS := ETC
LOCAL_MODULE_TAGS := optional
diff --git a/build/soong/Android.bp b/build/soong/Android.bp
new file mode 100644
index 0000000..bcd33b3
--- /dev/null
+++ b/build/soong/Android.bp
@@ -0,0 +1,29 @@
+// Copyright (C) 2018 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+bootstrap_go_package {
+ name: "soong-selinux",
+ pkgPath: "android/soong/selinux",
+ deps: [
+ "blueprint",
+ "soong",
+ "soong-android",
+ "soong-genrule",
+ ],
+ srcs: [
+ "cil_compat_map.go",
+ "filegroup.go"
+ ],
+ pluginFor: ["soong_build"],
+}
diff --git a/build/soong/cil_compat_map.go b/build/soong/cil_compat_map.go
new file mode 100644
index 0000000..8f55797
--- /dev/null
+++ b/build/soong/cil_compat_map.go
@@ -0,0 +1,113 @@
+// Copyright (C) 2018 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package selinux
+
+// This file contains "se_cil_compat_map" module type used to build and install
+// sepolicy backwards compatibility mapping files.
+
+import (
+ "android/soong/android"
+ "fmt"
+ "io"
+)
+
+var (
+ pctx = android.NewPackageContext("android/soong/selinux")
+)
+
+func init() {
+ android.RegisterModuleType("se_cil_compat_map", cilCompatMapFactory)
+ pctx.Import("android/soong/common")
+}
+
+func cilCompatMapFactory() android.Module {
+ c := &cilCompatMap{}
+ c.AddProperties(&c.properties)
+ android.InitAndroidModule(c)
+ return c
+}
+
+type cilCompatMapProperties struct {
+ // list of source (.cil) files used to build an sepolicy compatibility mapping
+ // file. srcs may reference the outputs of other modules that produce source
+ // files like genrule or filegroup using the syntax ":module". srcs has to be
+ // non-empty.
+ Srcs []string
+}
+
+type cilCompatMap struct {
+ android.ModuleBase
+ properties cilCompatMapProperties
+ // (.intermediate) module output path as installation source.
+ installSource android.OptionalPath
+}
+
+func expandSeSources(ctx android.ModuleContext, srcFiles []string) android.Paths {
+ expandedSrcFiles := make(android.Paths, 0, len(srcFiles))
+ for _, s := range srcFiles {
+ if m := android.SrcIsModule(s); m != "" {
+ module := ctx.GetDirectDepWithTag(m, android.SourceDepTag)
+ if module == nil {
+ // Error will have been handled by ExtractSourcesDeps
+ continue
+ }
+ if fg, ok := module.(*fileGroup); ok {
+ // Core compatibility mapping files are under system/sepolicy/private.
+ expandedSrcFiles = append(expandedSrcFiles, fg.SystemPrivateSrcs()...)
+ // Partner extensions to the compatibility mapping in must be located in
+ // BOARD_PLAT_PRIVATE_SEPOLICY_DIR
+ expandedSrcFiles = append(expandedSrcFiles, fg.SystemExtPrivateSrcs()...)
+ } else {
+ ctx.ModuleErrorf("srcs dependency %q is not an selinux filegroup", m)
+ }
+ } else {
+ p := android.PathForModuleSrc(ctx, s)
+ expandedSrcFiles = append(expandedSrcFiles, p)
+ }
+ }
+ return expandedSrcFiles
+}
+
+func (c *cilCompatMap) GenerateAndroidBuildActions(ctx android.ModuleContext) {
+ srcFiles := expandSeSources(ctx, c.properties.Srcs)
+ for _, src := range srcFiles {
+ if src.Ext() != ".cil" {
+ ctx.PropertyErrorf("srcs", "%s has to be a .cil file.", src.String())
+ }
+ }
+
+ out := android.PathForModuleGen(ctx, c.Name())
+ ctx.Build(pctx, android.BuildParams{
+ Rule: android.Cat,
+ Output: out,
+ Inputs: srcFiles,
+ })
+ c.installSource = android.OptionalPathForPath(out)
+}
+
+func (c *cilCompatMap) DepsMutator(ctx android.BottomUpMutatorContext) {
+ android.ExtractSourcesDeps(ctx, c.properties.Srcs)
+}
+
+func (c *cilCompatMap) AndroidMk() android.AndroidMkData {
+ ret := android.AndroidMkData{
+ OutputFile: c.installSource,
+ Class: "ETC",
+ }
+ ret.Extra = append(ret.Extra, func(w io.Writer, outputFile android.Path) {
+ fmt.Fprintln(w, "LOCAL_MODULE_PATH := $(TARGET_OUT)/etc/selinux/mapping")
+ })
+ return ret
+}
diff --git a/build/soong/filegroup.go b/build/soong/filegroup.go
new file mode 100644
index 0000000..7441834
--- /dev/null
+++ b/build/soong/filegroup.go
@@ -0,0 +1,130 @@
+// Copyright 2018 Google Inc. All rights reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package selinux
+
+import (
+ "android/soong/android"
+ "path/filepath"
+)
+
+func init() {
+ android.RegisterModuleType("se_filegroup", FileGroupFactory)
+}
+
+func FileGroupFactory() android.Module {
+ module := &fileGroup{}
+ module.AddProperties(&module.properties)
+ android.InitAndroidModule(module)
+ return module
+}
+
+type fileGroupProperties struct {
+ // list of source file suffixes used to collect selinux policy files.
+ // Source files will be looked up in the following local directories:
+ // system/sepolicy/{public, private, vendor, reqd_mask}
+ // and directories specified by following config variables:
+ // BOARD_SEPOLICY_DIRS, BOARD_ODM_SEPOLICY_DIRS
+ // BOARD_PLAT_PUBLIC_SEPOLICY_DIR, BOARD_PLAT_PRIVATE_SEPOLICY_DIR
+ Srcs []string
+}
+
+type fileGroup struct {
+ android.ModuleBase
+ properties fileGroupProperties
+
+ systemPublicSrcs android.Paths
+ systemPrivateSrcs android.Paths
+ systemVendorSrcs android.Paths
+ systemReqdMaskSrcs android.Paths
+
+ systemExtPublicSrcs android.Paths
+ systemExtPrivateSrcs android.Paths
+
+ vendorSrcs android.Paths
+ odmSrcs android.Paths
+}
+
+// Source files from system/sepolicy/public
+func (fg *fileGroup) SystemPublicSrcs() android.Paths {
+ return fg.systemPublicSrcs
+}
+
+// Source files from system/sepolicy/private
+func (fg *fileGroup) SystemPrivateSrcs() android.Paths {
+ return fg.systemPrivateSrcs
+}
+
+// Source files from system/sepolicy/vendor
+func (fg *fileGroup) SystemVendorSrcs() android.Paths {
+ return fg.systemVendorSrcs
+}
+
+// Source files from system/sepolicy/reqd_mask
+func (fg *fileGroup) SystemReqdMaskSrcs() android.Paths {
+ return fg.systemReqdMaskSrcs
+}
+
+// Source files from BOARD_PLAT_PUBLIC_SEPOLICY_DIR
+func (fg *fileGroup) SystemExtPublicSrcs() android.Paths {
+ return fg.systemExtPublicSrcs
+}
+
+// Source files from BOARD_PLAT_PRIVATE_SEPOLICY_DIR
+func (fg *fileGroup) SystemExtPrivateSrcs() android.Paths {
+ return fg.systemExtPrivateSrcs
+}
+
+// Source files from BOARD_SEPOLICY_DIRS
+func (fg *fileGroup) VendorSrcs() android.Paths {
+ return fg.vendorSrcs
+}
+
+// Source files from BOARD_ODM_SEPOLICY_DIRS
+func (fg *fileGroup) OdmSrcs() android.Paths {
+ return fg.odmSrcs
+}
+
+func (fg *fileGroup) findSrcsInDirs(ctx android.ModuleContext, dirs []string) android.Paths {
+ result := android.Paths{}
+ for _, f := range fg.properties.Srcs {
+ for _, d := range dirs {
+ path := filepath.Join(d, f)
+ files, _ := ctx.GlobWithDeps(path, nil)
+ for _, f := range files {
+ result = append(result, android.PathForSource(ctx, f))
+ }
+ }
+ }
+ return result
+}
+
+func (fg *fileGroup) findSrcsInDir(ctx android.ModuleContext, dir string) android.Paths {
+ return fg.findSrcsInDirs(ctx, []string{dir})
+}
+
+func (fg *fileGroup) DepsMutator(ctx android.BottomUpMutatorContext) {}
+
+func (fg *fileGroup) GenerateAndroidBuildActions(ctx android.ModuleContext) {
+ fg.systemPublicSrcs = fg.findSrcsInDir(ctx, filepath.Join(ctx.ModuleDir(), "public"))
+ fg.systemPrivateSrcs = fg.findSrcsInDir(ctx, filepath.Join(ctx.ModuleDir(), "private"))
+ fg.systemVendorSrcs = fg.findSrcsInDir(ctx, filepath.Join(ctx.ModuleDir(), "vendor"))
+ fg.systemReqdMaskSrcs = fg.findSrcsInDir(ctx, filepath.Join(ctx.ModuleDir(), "reqd_mask"))
+
+ fg.systemExtPublicSrcs = fg.findSrcsInDir(ctx, ctx.DeviceConfig().PlatPublicSepolicyDir())
+ fg.systemExtPrivateSrcs = fg.findSrcsInDir(ctx, ctx.DeviceConfig().PlatPrivateSepolicyDir())
+
+ fg.vendorSrcs = fg.findSrcsInDirs(ctx, ctx.DeviceConfig().VendorSepolicyDirs())
+ fg.odmSrcs = fg.findSrcsInDirs(ctx, ctx.DeviceConfig().OdmSepolicyDirs())
+}
diff --git a/private/audioserver.te b/private/audioserver.te
index a82cfec..1d4223f 100644
--- a/private/audioserver.te
+++ b/private/audioserver.te
@@ -35,6 +35,7 @@
allow audioserver permission_service:service_manager find;
allow audioserver power_service:service_manager find;
allow audioserver scheduling_policy_service:service_manager find;
+allow audioserver mediametrics_service:service_manager find;
# Allow read/write access to bluetooth-specific properties
set_prop(audioserver, bluetooth_a2dp_offload_prop)
diff --git a/private/bug_map b/private/bug_map
index 8d23622..5c551c8 100644
--- a/private/bug_map
+++ b/private/bug_map
@@ -1,3 +1,4 @@
+cppreopts cppreopts capability 79414024
dexoptanalyzer apk_data_file file 77853712
dexoptanalyzer app_data_file file 77853712
dexoptanalyzer app_data_file lnk_file 77853712
diff --git a/public/mediaextractor.te b/public/mediaextractor.te
index 44387fd..b055462 100644
--- a/public/mediaextractor.te
+++ b/public/mediaextractor.te
@@ -22,10 +22,8 @@
crash_dump_fallback(mediaextractor)
-# Suppress denials from sdcardfs (b/67454004)
-dontaudit mediaextractor sdcardfs:file read;
-
# allow mediaextractor read permissions for file sources
+allow mediaextractor sdcardfs:file { getattr read };
allow mediaextractor media_rw_data_file:file { getattr read };
allow mediaextractor app_data_file:file { getattr read };
diff --git a/tools/Android.bp b/tools/Android.bp
new file mode 100644
index 0000000..2809c9d
--- /dev/null
+++ b/tools/Android.bp
@@ -0,0 +1,58 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+cc_defaults {
+ name: "sepolicy_tools_defaults",
+ cflags: [
+ "-Wall",
+ "-Werror",
+ ],
+ static_libs: ["libsepol"],
+ stl: "none",
+}
+
+cc_binary_host {
+ name: "checkseapp",
+ defaults: ["sepolicy_tools_defaults"],
+ srcs: ["check_seapp.c"],
+ whole_static_libs: ["libpcre2"],
+ cflags: ["-DLINK_SEPOL_STATIC"],
+}
+
+cc_binary_host {
+ name: "checkfc",
+ defaults: ["sepolicy_tools_defaults"],
+ srcs: ["checkfc.c"],
+ static_libs: ["libselinux"],
+}
+
+cc_binary_host {
+ name: "sepolicy-check",
+ defaults: ["sepolicy_tools_defaults"],
+ srcs: ["sepolicy-check.c"],
+}
+
+cc_binary_host {
+ name: "version_policy",
+ defaults: ["sepolicy_tools_defaults"],
+ srcs: ["version_policy.c"],
+}
+
+cc_prebuilt_binary {
+ name: "insertkeys.py",
+ srcs: ["insertkeys.py"],
+ host_supported: true,
+}
diff --git a/tools/Android.mk b/tools/Android.mk
index 1948b7a..34f4385 100644
--- a/tools/Android.mk
+++ b/tools/Android.mk
@@ -1,62 +1,3 @@
LOCAL_PATH:= $(call my-dir)
-include $(CLEAR_VARS)
-
-LOCAL_MODULE := checkseapp
-LOCAL_MODULE_TAGS := optional
-LOCAL_CFLAGS := -DLINK_SEPOL_STATIC -Wall -Werror
-LOCAL_SRC_FILES := check_seapp.c
-LOCAL_STATIC_LIBRARIES := libsepol
-LOCAL_WHOLE_STATIC_LIBRARIES := libpcre2
-LOCAL_CXX_STL := none
-
-include $(BUILD_HOST_EXECUTABLE)
-
-###################################
-include $(CLEAR_VARS)
-
-LOCAL_MODULE := checkfc
-LOCAL_MODULE_TAGS := optional
-LOCAL_CFLAGS := -Wall -Werror
-LOCAL_SRC_FILES := checkfc.c
-LOCAL_STATIC_LIBRARIES := libsepol libselinux
-LOCAL_CXX_STL := none
-
-include $(BUILD_HOST_EXECUTABLE)
-
-##################################
-include $(CLEAR_VARS)
-
-LOCAL_MODULE := insertkeys.py
-LOCAL_SRC_FILES := insertkeys.py
-LOCAL_MODULE_CLASS := EXECUTABLES
-LOCAL_IS_HOST_MODULE := true
-LOCAL_MODULE_TAGS := optional
-
-include $(BUILD_PREBUILT)
-###################################
-include $(CLEAR_VARS)
-
-LOCAL_MODULE := sepolicy-check
-LOCAL_MODULE_TAGS := optional
-LOCAL_CFLAGS := -Wall -Werror
-LOCAL_SRC_FILES := sepolicy-check.c
-LOCAL_STATIC_LIBRARIES := libsepol
-LOCAL_CXX_STL := none
-
-include $(BUILD_HOST_EXECUTABLE)
-
-###################################
-include $(CLEAR_VARS)
-
-LOCAL_MODULE := version_policy
-LOCAL_MODULE_TAGS := optional
-LOCAL_CFLAGS := -Wall -Werror
-LOCAL_SRC_FILES := version_policy.c
-LOCAL_SHARED_LIBRARIES := libsepol
-LOCAL_CXX_STL := none
-
-include $(BUILD_HOST_EXECUTABLE)
-
-
include $(call all-makefiles-under,$(LOCAL_PATH))
diff --git a/tools/fc_sort/Android.bp b/tools/fc_sort/Android.bp
new file mode 100644
index 0000000..d0a391b
--- /dev/null
+++ b/tools/fc_sort/Android.bp
@@ -0,0 +1,25 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+cc_binary_host {
+ name: "fc_sort",
+ srcs: ["fc_sort.c"],
+ stl: "none",
+ cflags: [
+ "-Wall",
+ "-Werror",
+ ],
+}
diff --git a/tools/fc_sort/Android.mk b/tools/fc_sort/Android.mk
deleted file mode 100644
index 6b4ed23..0000000
--- a/tools/fc_sort/Android.mk
+++ /dev/null
@@ -1,13 +0,0 @@
-LOCAL_PATH:= $(call my-dir)
-
-include $(CLEAR_VARS)
-
-LOCAL_MODULE := fc_sort
-LOCAL_MODULE_TAGS := optional
-LOCAL_SRC_FILES := fc_sort.c
-LOCAL_CFLAGS := -Wall -Werror
-LOCAL_CXX_STL := none
-
-include $(BUILD_HOST_EXECUTABLE)
-
-###################################
diff --git a/vendor/hal_keymaster_default.te b/vendor/hal_keymaster_default.te
index 82a5a20..6f0d82a 100644
--- a/vendor/hal_keymaster_default.te
+++ b/vendor/hal_keymaster_default.te
@@ -3,3 +3,5 @@
type hal_keymaster_default_exec, exec_type, vendor_file_type, file_type;
init_daemon_domain(hal_keymaster_default)
+
+get_prop(hal_keymaster_default, vendor_security_patch_level_prop);