Merge "Tuner Hal 1.0 Enable ITuner service"
diff --git a/apex/com.android.i18n-file_contexts b/apex/com.android.i18n-file_contexts
new file mode 100644
index 0000000..c8b6ba1
--- /dev/null
+++ b/apex/com.android.i18n-file_contexts
@@ -0,0 +1,4 @@
+#############################
+# System files
+#
+(/.*)? u:object_r:system_file:s0
diff --git a/mac_permissions.mk b/mac_permissions.mk
index 7cb1b98..3a28197 100644
--- a/mac_permissions.mk
+++ b/mac_permissions.mk
@@ -27,6 +27,7 @@
$(all_plat_mac_perms_files) $(all_plat_keys)
@mkdir -p $(dir $@)
$(hide) DEFAULT_SYSTEM_DEV_CERTIFICATE="$(dir $(DEFAULT_SYSTEM_DEV_CERTIFICATE))" \
+ MAINLINE_SEPOLICY_DEV_CERTIFICATES="$(MAINLINE_SEPOLICY_DEV_CERTIFICATES)" \
$(HOST_OUT_EXECUTABLES)/insertkeys.py -t $(TARGET_BUILD_VARIANT) -c $(TOP) $< -o $@ $(PRIVATE_MAC_PERMS_FILES)
all_plat_keys :=
diff --git a/prebuilts/api/29.0/private/genfs_contexts b/prebuilts/api/29.0/private/genfs_contexts
index 202d1b3..d2819b1 100644
--- a/prebuilts/api/29.0/private/genfs_contexts
+++ b/prebuilts/api/29.0/private/genfs_contexts
@@ -213,6 +213,7 @@
genfscon tracefs /events/power/clock_set_rate/ u:object_r:debugfs_tracing:s0
genfscon tracefs /events/power/cpu_frequency_limits/ u:object_r:debugfs_tracing:s0
genfscon tracefs /events/power/gpu_frequency/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/power/suspend_resume/ u:object_r:debugfs_tracing:s0
genfscon tracefs /events/cpufreq_interactive/ u:object_r:debugfs_tracing:s0
genfscon tracefs /events/vmscan/mm_vmscan_direct_reclaim_begin/ u:object_r:debugfs_tracing:s0
genfscon tracefs /events/vmscan/mm_vmscan_direct_reclaim_end/ u:object_r:debugfs_tracing:s0
@@ -255,6 +256,7 @@
genfscon debugfs /tracing/events/power/clock_set_rate/ u:object_r:debugfs_tracing:s0
genfscon debugfs /tracing/events/power/cpu_frequency_limits/ u:object_r:debugfs_tracing:s0
genfscon debugfs /tracing/events/power/gpu_frequency/ u:object_r:debugfs_tracing:s0
+genfscon debugfs /tracing/events/power/suspend_resume/ u:object_r:debugfs_tracing:s0
genfscon debugfs /tracing/events/cpufreq_interactive/ u:object_r:debugfs_tracing:s0
genfscon debugfs /tracing/events/vmscan/mm_vmscan_direct_reclaim_begin/ u:object_r:debugfs_tracing:s0
genfscon debugfs /tracing/events/vmscan/mm_vmscan_direct_reclaim_end/ u:object_r:debugfs_tracing:s0
diff --git a/private/app_neverallows.te b/private/app_neverallows.te
index be0a598..d496e90 100644
--- a/private/app_neverallows.te
+++ b/private/app_neverallows.te
@@ -137,8 +137,8 @@
')
}:dir_file_class_set { create unlink };
-# No untrusted component should be touching /dev/fuse
-neverallow all_untrusted_apps fuse_device:chr_file *;
+# No untrusted component except mediaprovider should be touching /dev/fuse
+neverallow { all_untrusted_apps -mediaprovider } fuse_device:chr_file *;
# Do not allow untrusted apps to directly open the tun_device
neverallow all_untrusted_apps tun_device:chr_file open;
diff --git a/private/compat/29.0/29.0.ignore.cil b/private/compat/29.0/29.0.ignore.cil
index 54b5b17..24c733b 100644
--- a/private/compat/29.0/29.0.ignore.cil
+++ b/private/compat/29.0/29.0.ignore.cil
@@ -14,12 +14,14 @@
hal_can_controller_hwservice
hal_tv_tuner_hwservice
init_svc_debug_prop
+ linker_prop
ota_metadata_file
runtime_apex_dir
system_ashmem_hwservice
system_group_file
system_passwd_file
vendor_apex_file
+ virtual_ab_prop
wifi_stack
wifi_stack_service
wifi_stack_tmpfs))
diff --git a/private/dexoptanalyzer.te b/private/dexoptanalyzer.te
index 59554c8..a978af6 100644
--- a/private/dexoptanalyzer.te
+++ b/private/dexoptanalyzer.te
@@ -19,6 +19,9 @@
allow dexoptanalyzer installd:fd use;
allow dexoptanalyzer installd:fifo_file { getattr write };
+# Acquire advisory lock on /system/framework/arm/*
+allow dexoptanalyzer system_file:file lock;
+
# Allow reading secondary dex files that were reported by the app to the
# package manager.
allow dexoptanalyzer { privapp_data_file app_data_file }:dir { getattr search };
diff --git a/private/domain.te b/private/domain.te
index 8f7a1e0..ee0ef6e 100644
--- a/private/domain.te
+++ b/private/domain.te
@@ -42,6 +42,9 @@
# if memfd support can be used if device supports it
get_prop(domain, use_memfd_prop);
+# Allow to read properties for linker
+get_prop(domain, linker_prop);
+
# For now, everyone can access core property files
# Device specific properties are not granted by default
not_compatible_property(`
@@ -83,6 +86,7 @@
')
# Allow access to linkerconfig file
+allow domain linkerconfig_file:dir search;
allow domain linkerconfig_file:file r_file_perms;
# Limit ability to ptrace or read sensitive /proc/pid files of processes
diff --git a/private/genfs_contexts b/private/genfs_contexts
index 3ad0edb..6be0ba6 100644
--- a/private/genfs_contexts
+++ b/private/genfs_contexts
@@ -215,6 +215,7 @@
genfscon tracefs /events/power/clock_set_rate/ u:object_r:debugfs_tracing:s0
genfscon tracefs /events/power/cpu_frequency_limits/ u:object_r:debugfs_tracing:s0
genfscon tracefs /events/power/gpu_frequency/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/power/suspend_resume/ u:object_r:debugfs_tracing:s0
genfscon tracefs /events/cpufreq_interactive/ u:object_r:debugfs_tracing:s0
genfscon tracefs /events/vmscan/mm_vmscan_direct_reclaim_begin/ u:object_r:debugfs_tracing:s0
genfscon tracefs /events/vmscan/mm_vmscan_direct_reclaim_end/ u:object_r:debugfs_tracing:s0
@@ -257,6 +258,7 @@
genfscon debugfs /tracing/events/power/clock_set_rate/ u:object_r:debugfs_tracing:s0
genfscon debugfs /tracing/events/power/cpu_frequency_limits/ u:object_r:debugfs_tracing:s0
genfscon debugfs /tracing/events/power/gpu_frequency/ u:object_r:debugfs_tracing:s0
+genfscon debugfs /tracing/events/power/suspend_resume/ u:object_r:debugfs_tracing:s0
genfscon debugfs /tracing/events/cpufreq_interactive/ u:object_r:debugfs_tracing:s0
genfscon debugfs /tracing/events/vmscan/mm_vmscan_direct_reclaim_begin/ u:object_r:debugfs_tracing:s0
genfscon debugfs /tracing/events/vmscan/mm_vmscan_direct_reclaim_end/ u:object_r:debugfs_tracing:s0
diff --git a/private/keys.conf b/private/keys.conf
index f517b67..362e73d 100644
--- a/private/keys.conf
+++ b/private/keys.conf
@@ -15,7 +15,7 @@
ALL : $DEFAULT_SYSTEM_DEV_CERTIFICATE/media.x509.pem
[@NETWORK_STACK]
-ALL : $DEFAULT_SYSTEM_DEV_CERTIFICATE/networkstack.x509.pem
+ALL : $MAINLINE_SEPOLICY_DEV_CERTIFICATES/networkstack.x509.pem
[@SHARED]
ALL : $DEFAULT_SYSTEM_DEV_CERTIFICATE/shared.x509.pem
diff --git a/private/mediaprovider.te b/private/mediaprovider.te
index 30d3fe0..6926412 100644
--- a/private/mediaprovider.te
+++ b/private/mediaprovider.te
@@ -34,6 +34,9 @@
# MtpServer uses /dev/mtp_usb
allow mediaprovider mtp_device:chr_file rw_file_perms;
+# Fuse daemon
+allow mediaprovider fuse_device:chr_file { read write ioctl getattr };
+
# MtpServer uses /dev/usb-ffs/mtp
allow mediaprovider functionfs:dir search;
allow mediaprovider functionfs:file rw_file_perms;
diff --git a/private/property_contexts b/private/property_contexts
index 254c55a..55445ec 100644
--- a/private/property_contexts
+++ b/private/property_contexts
@@ -23,6 +23,7 @@
ro.hw. u:object_r:system_prop:s0
sys. u:object_r:system_prop:s0
sys.cppreopt u:object_r:cppreopt_prop:s0
+sys.linker. u:object_r:linker_prop:s0
sys.lpdumpd u:object_r:lpdumpd_prop:s0
sys.powerctl u:object_r:powerctl_prop:s0
sys.usb.ffs. u:object_r:ffs_prop:s0
@@ -212,3 +213,7 @@
# Charger properties
ro.charger. u:object_r:charger_prop:s0
+
+# Virtual A/B properties
+ro.virtual_ab.enabled u:object_r:virtual_ab_prop:s0
+ro.virtual_ab.retrofit u:object_r:virtual_ab_prop:s0
diff --git a/private/servicemanager.te b/private/servicemanager.te
index 9f675a2..6294452 100644
--- a/private/servicemanager.te
+++ b/private/servicemanager.te
@@ -3,3 +3,5 @@
init_daemon_domain(servicemanager)
read_runtime_log_tags(servicemanager)
+
+set_prop(servicemanager, ctl_interface_start_prop)
diff --git a/private/shell.te b/private/shell.te
index 02b01f5..8a933a5 100644
--- a/private/shell.te
+++ b/private/shell.te
@@ -74,3 +74,8 @@
# Allow shell to start and comminicate with lpdumpd.
set_prop(shell, lpdumpd_prop);
binder_call(shell, lpdumpd)
+
+# Allow shell to set linker property
+userdebug_or_eng(`
+ set_prop(shell, linker_prop)
+')
diff --git a/public/property.te b/public/property.te
index 1bac613..4f4adec 100644
--- a/public/property.te
+++ b/public/property.te
@@ -58,6 +58,7 @@
type init_svc_debug_prop, property_type;
type last_boot_reason_prop, property_type;
type system_lmk_prop, property_type;
+type linker_prop, property_type;
type llkd_prop, property_type;
type logd_prop, property_type, core_property_type;
type logpersistd_logging_prop, property_type;
@@ -93,6 +94,7 @@
type traced_enabled_prop, property_type;
type traced_lazy_prop, property_type;
type use_memfd_prop, property_type;
+type virtual_ab_prop, property_type;
type vold_prop, property_type, core_property_type;
type wifi_log_prop, property_type, log_property_type;
type wifi_prop, property_type;
@@ -191,6 +193,13 @@
ctl_rildaemon_prop
}:property_service set;
+# Do now allow to modify linker properties except shell and init
+neverallow {
+ domain
+ -init
+ userdebug_or_eng(`-shell')
+} linker_prop:property_service set;
+
neverallow {
domain
-init
@@ -450,6 +459,7 @@
-hwservicemanager_prop
-last_boot_reason_prop
-system_lmk_prop
+ -linker_prop
-log_prop
-log_tag_prop
-logd_prop
diff --git a/public/update_engine_common.te b/public/update_engine_common.te
index e53f78e..87e3b43 100644
--- a/public/update_engine_common.te
+++ b/public/update_engine_common.te
@@ -76,3 +76,6 @@
# Allow update_engine_common to write to statsd socket.
unix_socket_send(update_engine_common, statsdw, statsd)
+
+# Allow to read Virtual A/B feature flags.
+get_prop(update_engine_common, virtual_ab_prop)
diff --git a/public/vendor_init.te b/public/vendor_init.te
index da3651d..f458d77 100644
--- a/public/vendor_init.te
+++ b/public/vendor_init.te
@@ -218,6 +218,7 @@
-gsid_prop
-nnapi_ext_deny_product_prop
-init_svc_debug_prop
+ -linker_prop
})
')
diff --git a/tests/treble_sepolicy_tests.py b/tests/treble_sepolicy_tests.py
index 0851d3b..cf1e856 100644
--- a/tests/treble_sepolicy_tests.py
+++ b/tests/treble_sepolicy_tests.py
@@ -244,8 +244,8 @@
ret += "latest API level.\n"
ret += " ".join(str(x) for x in sorted(violators)) + "\n\n"
ret += "See examples of how to fix this:\n"
- ret += "https://android-review.git.corp.google.com/c/platform/system/sepolicy/+/781036\n"
- ret += "https://android-review.git.corp.google.com/c/platform/system/sepolicy/+/852612\n"
+ ret += "https://android-review.googlesource.com/c/platform/system/sepolicy/+/781036\n"
+ ret += "https://android-review.googlesource.com/c/platform/system/sepolicy/+/852612\n"
return ret
###
@@ -270,7 +270,7 @@
ret += "latest API level.\n"
ret += " ".join(str(x) for x in sorted(violators)) + "\n\n"
ret += "See examples of how to fix this:\n"
- ret += "https://android-review.git.corp.google.com/c/platform/system/sepolicy/+/822743\n"
+ ret += "https://android-review.googlesource.com/c/platform/system/sepolicy/+/822743\n"
return ret
def TestTrebleCompatMapping():