Merge "Add file contexts for com.android.neuralnetworks APEX package."
diff --git a/private/compat/26.0/26.0.cil b/private/compat/26.0/26.0.cil
index 3b3dae1..2d1a612 100644
--- a/private/compat/26.0/26.0.cil
+++ b/private/compat/26.0/26.0.cil
@@ -432,9 +432,6 @@
(typeattributeset pdx_performance_dir_26_0 (pdx_performance_dir))
(typeattributeset performanced_26_0 (performanced))
(typeattributeset performanced_exec_26_0 (performanced_exec))
-(typeattributeset perfprofd_26_0 (perfprofd))
-(typeattributeset perfprofd_data_file_26_0 (perfprofd_data_file))
-(typeattributeset perfprofd_exec_26_0 (perfprofd_exec))
(typeattributeset permission_service_26_0 (permission_service))
(typeattributeset persist_debug_prop_26_0 (persist_debug_prop))
(typeattributeset persistent_data_block_service_26_0 (persistent_data_block_service))
diff --git a/private/compat/26.0/26.0.ignore.cil b/private/compat/26.0/26.0.ignore.cil
index c005a14..9ab631a 100644
--- a/private/compat/26.0/26.0.ignore.cil
+++ b/private/compat/26.0/26.0.ignore.cil
@@ -132,7 +132,6 @@
perfetto_exec
perfetto_tmpfs
perfetto_traces_data_file
- perfprofd_service
property_info
recovery_socket
role_service
diff --git a/private/compat/27.0/27.0.cil b/private/compat/27.0/27.0.cil
index e539d3b..ab56f4e 100644
--- a/private/compat/27.0/27.0.cil
+++ b/private/compat/27.0/27.0.cil
@@ -430,9 +430,6 @@
(expandtypeattribute (pdx_performance_dir_27_0) true)
(expandtypeattribute (performanced_27_0) true)
(expandtypeattribute (performanced_exec_27_0) true)
-(expandtypeattribute (perfprofd_27_0) true)
-(expandtypeattribute (perfprofd_data_file_27_0) true)
-(expandtypeattribute (perfprofd_exec_27_0) true)
(expandtypeattribute (permission_service_27_0) true)
(expandtypeattribute (persist_debug_prop_27_0) true)
(expandtypeattribute (persistent_data_block_service_27_0) true)
@@ -1147,9 +1144,6 @@
(typeattributeset pdx_performance_dir_27_0 (pdx_performance_dir))
(typeattributeset performanced_27_0 (performanced))
(typeattributeset performanced_exec_27_0 (performanced_exec))
-(typeattributeset perfprofd_27_0 (perfprofd))
-(typeattributeset perfprofd_data_file_27_0 (perfprofd_data_file))
-(typeattributeset perfprofd_exec_27_0 (perfprofd_exec))
(typeattributeset permission_service_27_0 (permission_service))
(typeattributeset persist_debug_prop_27_0 (persist_debug_prop))
(typeattributeset persistent_data_block_service_27_0 (persistent_data_block_service))
diff --git a/private/compat/27.0/27.0.ignore.cil b/private/compat/27.0/27.0.ignore.cil
index 7d2f8dd..a3f30d4 100644
--- a/private/compat/27.0/27.0.ignore.cil
+++ b/private/compat/27.0/27.0.ignore.cil
@@ -119,7 +119,6 @@
perfetto_exec
perfetto_tmpfs
perfetto_traces_data_file
- perfprofd_service
property_info
recovery_socket
role_service
diff --git a/private/compat/28.0/28.0.cil b/private/compat/28.0/28.0.cil
index fbe8588..1a2bd43 100644
--- a/private/compat/28.0/28.0.cil
+++ b/private/compat/28.0/28.0.cil
@@ -501,10 +501,6 @@
(expandtypeattribute (pdx_performance_dir_28_0) true)
(expandtypeattribute (performanced_28_0) true)
(expandtypeattribute (performanced_exec_28_0) true)
-(expandtypeattribute (perfprofd_28_0) true)
-(expandtypeattribute (perfprofd_data_file_28_0) true)
-(expandtypeattribute (perfprofd_exec_28_0) true)
-(expandtypeattribute (perfprofd_service_28_0) true)
(expandtypeattribute (permission_service_28_0) true)
(expandtypeattribute (persist_debug_prop_28_0) true)
(expandtypeattribute (persistent_data_block_service_28_0) true)
@@ -1346,10 +1342,6 @@
(typeattributeset pdx_performance_dir_28_0 (pdx_performance_dir))
(typeattributeset performanced_28_0 (performanced))
(typeattributeset performanced_exec_28_0 (performanced_exec))
-(typeattributeset perfprofd_28_0 (perfprofd))
-(typeattributeset perfprofd_data_file_28_0 (perfprofd_data_file))
-(typeattributeset perfprofd_exec_28_0 (perfprofd_exec))
-(typeattributeset perfprofd_service_28_0 (perfprofd_service))
(typeattributeset permission_service_28_0 (permission_service))
(typeattributeset persist_debug_prop_28_0 (persist_debug_prop))
(typeattributeset persistent_data_block_service_28_0 (persistent_data_block_service))
diff --git a/private/compat/29.0/29.0.cil b/private/compat/29.0/29.0.cil
index dd52e0e..01e8605 100644
--- a/private/compat/29.0/29.0.cil
+++ b/private/compat/29.0/29.0.cil
@@ -1,5 +1,7 @@
;; types removed from current policy
(type hal_wifi_offload_hwservice)
+(type perfprofd_data_file)
+(type perfprofd_service)
(expandtypeattribute (accessibility_service_29_0) true)
(expandtypeattribute (account_service_29_0) true)
@@ -553,10 +555,6 @@
(expandtypeattribute (perfetto_29_0) true)
(expandtypeattribute (performanced_29_0) true)
(expandtypeattribute (performanced_exec_29_0) true)
-(expandtypeattribute (perfprofd_29_0) true)
-(expandtypeattribute (perfprofd_data_file_29_0) true)
-(expandtypeattribute (perfprofd_exec_29_0) true)
-(expandtypeattribute (perfprofd_service_29_0) true)
(expandtypeattribute (permissionmgr_service_29_0) true)
(expandtypeattribute (permission_service_29_0) true)
(expandtypeattribute (persist_debug_prop_29_0) true)
@@ -1531,10 +1529,6 @@
(typeattributeset perfetto_29_0 (perfetto))
(typeattributeset performanced_29_0 (performanced))
(typeattributeset performanced_exec_29_0 (performanced_exec))
-(typeattributeset perfprofd_29_0 (perfprofd))
-(typeattributeset perfprofd_data_file_29_0 (perfprofd_data_file))
-(typeattributeset perfprofd_exec_29_0 (perfprofd_exec))
-(typeattributeset perfprofd_service_29_0 (perfprofd_service))
(typeattributeset permissionmgr_service_29_0 (permissionmgr_service))
(typeattributeset permission_service_29_0 (permission_service))
(typeattributeset persist_debug_prop_29_0 (persist_debug_prop))
diff --git a/private/compat/29.0/29.0.ignore.cil b/private/compat/29.0/29.0.ignore.cil
index 30437ee..c3f4b29 100644
--- a/private/compat/29.0/29.0.ignore.cil
+++ b/private/compat/29.0/29.0.ignore.cil
@@ -6,10 +6,14 @@
(typeattributeset new_objects
( new_objects
cold_boot_done_prop
+ platform_compat_service
ctl_apexd_prop
device_config_sys_traced_prop
+ ota_metadata_file
runtime_apex_dir
system_ashmem_hwservice
+ system_group_file
+ system_passwd_file
vendor_apex_file
wifi_stack
wifi_stack_service
diff --git a/private/coredomain.te b/private/coredomain.te
index 169f6b2..7ad5856 100644
--- a/private/coredomain.te
+++ b/private/coredomain.te
@@ -25,7 +25,6 @@
-idmap
-init
-installd
- userdebug_or_eng(`-perfprofd')
userdebug_or_eng(`-heapprofd')
-postinstall_dexopt
-rs # spawned by appdomain, so carryover the exception above
@@ -41,7 +40,6 @@
-idmap
-init
-installd
- userdebug_or_eng(`-perfprofd')
userdebug_or_eng(`-heapprofd')
-postinstall_dexopt
-rs # spawned by appdomain, so carryover the exception above
@@ -126,7 +124,6 @@
-atrace
-dumpstate
-init
- userdebug_or_eng(`-perfprofd')
-traced_probes
-shell
-traceur_app
@@ -196,12 +193,10 @@
coredomain
-init
-iorapd
- -perfprofd
} ashmem_device_service:service_manager find;
binder_call({
coredomain
-init
-iorapd
- -perfprofd
}, ashmemd)
diff --git a/private/domain.te b/private/domain.te
index 670e353..8f7a1e0 100644
--- a/private/domain.te
+++ b/private/domain.te
@@ -95,7 +95,6 @@
userdebug_or_eng(`-incidentd')
-storaged
-system_server
- userdebug_or_eng(`-perfprofd')
} self:global_capability_class_set sys_ptrace;
# Limit ability to generate hardware unique device ID attestations to priv_apps
@@ -130,7 +129,6 @@
-app_zygote
-dexoptanalyzer
-installd
- userdebug_or_eng(`-perfprofd')
-profman
-rs # spawned by appdomain, so carryover the exception above
-runas
@@ -152,7 +150,6 @@
-appdomain
-app_zygote
-installd
- userdebug_or_eng(`-perfprofd')
-rs # spawned by appdomain, so carryover the exception above
} { privapp_data_file app_data_file }:file_class_set open;
@@ -261,7 +258,6 @@
userdebug_or_eng(`llkd')
lmkd
netd
- perfprofd
postinstall_dexopt
recovery
rss_hwm_reset
diff --git a/private/dumpstate.te b/private/dumpstate.te
index 4f6d96a..1b0832e 100644
--- a/private/dumpstate.te
+++ b/private/dumpstate.te
@@ -44,7 +44,6 @@
allow dumpstate debugfs_wakeup_sources:file r_file_perms;
allow dumpstate dev_type:blk_file getattr;
allow dumpstate webview_zygote:process signal;
-dontaudit dumpstate perfprofd:binder call;
dontaudit dumpstate update_engine:binder call;
allow dumpstate proc_net_tcp_udp:file r_file_perms;
diff --git a/private/file_contexts b/private/file_contexts
index 60b569d..79c3043 100644
--- a/private/file_contexts
+++ b/private/file_contexts
@@ -257,7 +257,6 @@
/system/bin/pppd u:object_r:ppp_exec:s0
/system/bin/racoon u:object_r:racoon_exec:s0
/system/xbin/su u:object_r:su_exec:s0
-/system/bin/perfprofd u:object_r:perfprofd_exec:s0
/system/bin/dnsmasq u:object_r:dnsmasq_exec:s0
/system/bin/healthd u:object_r:healthd_exec:s0
/system/bin/clatd u:object_r:clatd_exec:s0
@@ -304,7 +303,9 @@
/system/bin/hw/android\.system\.suspend@1\.0-service u:object_r:system_suspend_exec:s0
/system/etc/cgroups\.json u:object_r:cgroup_desc_file:s0
/system/etc/event-log-tags u:object_r:system_event_log_tags_file:s0
+/system/etc/group u:object_r:system_group_file:s0
/system/etc/ld\.config.* u:object_r:system_linker_config_file:s0
+/system/etc/passwd u:object_r:system_passwd_file:s0
/system/etc/seccomp_policy(/.*)? u:object_r:system_seccomp_policy_file:s0
/system/etc/security/cacerts(/.*)? u:object_r:system_security_cacerts_file:s0
/system/etc/selinux/mapping/[0-9]+\.[0-9]+\.cil u:object_r:sepolicy_file:s0
@@ -398,6 +399,8 @@
# Product files
#
/(product|system/product)(/.*)? u:object_r:system_file:s0
+/(product|system/product)/etc/group u:object_r:system_group_file:s0
+/(product|system/product)/etc/passwd u:object_r:system_passwd_file:s0
/(product|system/product)/overlay(/.*)? u:object_r:vendor_overlay_file:s0
/(product|system/product)/etc/selinux/product_file_contexts u:object_r:file_contexts_file:s0
@@ -411,6 +414,8 @@
# SystemExt files
#
/(system_ext|system/system_ext)(/.*)? u:object_r:system_file:s0
+/(system_ext|system/system_ext)/etc/group u:object_r:system_group_file:s0
+/(system_ext|system/system_ext)/etc/passwd u:object_r:system_passwd_file:s0
/(system_ext|system/system_ext)/overlay(/.*)? u:object_r:vendor_overlay_file:s0
#############################
@@ -513,7 +518,6 @@
/data/misc/zoneinfo(/.*)? u:object_r:zoneinfo_data_file:s0
/data/misc/vold(/.*)? u:object_r:vold_data_file:s0
/data/misc/iorapd(/.*)? u:object_r:iorapd_data_file:s0
-/data/misc/perfprofd(/.*)? u:object_r:perfprofd_data_file:s0
/data/misc/update_engine(/.*)? u:object_r:update_engine_data_file:s0
/data/misc/update_engine_log(/.*)? u:object_r:update_engine_log_data_file:s0
/data/system/dropbox(/.*)? u:object_r:dropbox_data_file:s0
@@ -632,6 +636,7 @@
/metadata/vold(/.*)? u:object_r:vold_metadata_file:s0
/metadata/gsi(/.*)? u:object_r:gsi_metadata_file:s0
/metadata/password_slots(/.*)? u:object_r:password_slot_metadata_file:s0
+/metadata/ota(/.*)? u:object_r:ota_metadata_file:s0
#############################
# asec containers
diff --git a/private/file_contexts_asan b/private/file_contexts_asan
index bd841a3..b37f086 100644
--- a/private/file_contexts_asan
+++ b/private/file_contexts_asan
@@ -4,6 +4,8 @@
/data/asan/vendor/lib64(/.*)? u:object_r:system_lib_file:s0
/data/asan/odm/lib(/.*)? u:object_r:system_lib_file:s0
/data/asan/odm/lib64(/.*)? u:object_r:system_lib_file:s0
+/data/asan/product/lib(/.*)? u:object_r:system_lib_file:s0
+/data/asan/product/lib64(/.*)? u:object_r:system_lib_file:s0
/system/asan.options u:object_r:system_asan_options_file:s0
/system/bin/asan_extract u:object_r:asan_extract_exec:s0
/system/bin/asanwrapper u:object_r:asanwrapper_exec:s0
diff --git a/private/gsid.te b/private/gsid.te
index 73b93fc..305b1c2 100644
--- a/private/gsid.te
+++ b/private/gsid.te
@@ -17,6 +17,20 @@
allow gsid self:global_capability_class_set sys_admin;
dontaudit gsid self:global_capability_class_set dac_override;
+# On FBE devices (not using dm-default-key), gsid will use loop devices to map
+# images rather than device-mapper.
+allow gsid loop_control_device:chr_file rw_file_perms;
+allow gsid loop_device:blk_file rw_file_perms;
+allowxperm gsid loop_device:blk_file ioctl {
+ LOOP_GET_STATUS64
+ LOOP_SET_STATUS64
+ LOOP_SET_FD
+ LOOP_SET_BLOCK_SIZE
+ LOOP_SET_DIRECT_IO
+ LOOP_CLR_FD
+ BLKFLSBUF
+};
+
# libfiemap_writer uses sysfs to derive the bottom of a device-mapper stacking.
# This requires traversing /sys/block/dm-N/slaves/* and reading the list of
# file names.
@@ -83,7 +97,7 @@
# booted - An empty file that, if exists, indicates that a GSI is
# currently running.
#
-allow gsid metadata_file:dir search;
+allow gsid metadata_file:dir { search getattr };
allow gsid gsi_metadata_file:dir rw_dir_perms;
allow gsid gsi_metadata_file:file create_file_perms;
diff --git a/private/linkerconfig.te b/private/linkerconfig.te
index 8acd734..01a9fbf 100644
--- a/private/linkerconfig.te
+++ b/private/linkerconfig.te
@@ -7,4 +7,7 @@
allow linkerconfig linkerconfig_file:dir rw_dir_perms;
allow linkerconfig linkerconfig_file:file create_file_perms;
+# Allow linkerconfig to log to the kernel.
+allow linkerconfig kmsg_device:chr_file w_file_perms;
+
neverallow { domain -init -linkerconfig } linkerconfig_exec:file no_x_file_perms;
diff --git a/private/perfprofd.te b/private/perfprofd.te
deleted file mode 100644
index 94a7c1d..0000000
--- a/private/perfprofd.te
+++ /dev/null
@@ -1,29 +0,0 @@
-typeattribute perfprofd coredomain;
-
-userdebug_or_eng(`
- init_daemon_domain(perfprofd)
-')
-
-neverallow {
- domain
- userdebug_or_eng(`
- -statsd
- -system_server
- -system_suspend_server
- -hal_health_server
- -hwservicemanager
- ')
-} perfprofd:binder call;
-
-neverallow perfprofd {
- domain
- userdebug_or_eng(`
- -servicemanager
- -statsd
- -su
- -system_server
- -system_suspend_server
- -hal_health_server
- -hwservicemanager
- ')
-}:binder call;
diff --git a/private/priv_app.te b/private/priv_app.te
index 35ad8c2..5768f00 100644
--- a/private/priv_app.te
+++ b/private/priv_app.te
@@ -83,14 +83,6 @@
# b/18504118: Allow reads from /data/anr/traces.txt
allow priv_app anr_data_file:file r_file_perms;
-# Allow GMS core to access perfprofd output, which is stored
-# in /data/misc/perfprofd/. GMS core will need to list all
-# data stored in that directory to process them one by one.
-userdebug_or_eng(`
- allow priv_app perfprofd_data_file:file r_file_perms;
- allow priv_app perfprofd_data_file:dir r_dir_perms;
-')
-
# For AppFuse.
allow priv_app vold:fd use;
allow priv_app fuse_device:chr_file { read write };
diff --git a/private/property_contexts b/private/property_contexts
index 520383d..14fe3de 100644
--- a/private/property_contexts
+++ b/private/property_contexts
@@ -107,7 +107,6 @@
# ctl properties
ctl.bootanim u:object_r:ctl_bootanim_prop:s0
-ctl.android.hardware.dumpstate u:object_r:ctl_dumpstate_prop:s0
ctl.dumpstate u:object_r:ctl_dumpstate_prop:s0
ctl.fuse_ u:object_r:ctl_fuse_prop:s0
ctl.mdnsd u:object_r:ctl_mdnsd_prop:s0
@@ -139,6 +138,9 @@
# Restrict access to stopping apexd.
ctl.stop$apexd u:object_r:ctl_apexd_prop:s0
+# Restrict access to restart dumpstate
+ctl.interface_restart$android.hardware.dumpstate u:object_r:ctl_dumpstate_prop:s0
+
# NFC properties
nfc. u:object_r:nfc_prop:s0
diff --git a/private/service_contexts b/private/service_contexts
index 49bdb29..8dc3fc2 100644
--- a/private/service_contexts
+++ b/private/service_contexts
@@ -32,6 +32,7 @@
clipboard u:object_r:clipboard_service:s0
com.android.net.IProxyService u:object_r:IProxyService_service:s0
companiondevice u:object_r:companion_device_service:s0
+platform_compat u:object_r:platform_compat_service:s0
connectivity u:object_r:connectivity_service:s0
connmetrics u:object_r:connmetrics_service:s0
consumer_ir u:object_r:consumer_ir_service:s0
@@ -139,7 +140,6 @@
overlay u:object_r:overlay_service:s0
package u:object_r:package_service:s0
package_native u:object_r:package_native_service:s0
-perfprofd u:object_r:perfprofd_service:s0
permission u:object_r:permission_service:s0
permissionmgr u:object_r:permissionmgr_service:s0
persistent_data_block u:object_r:persistent_data_block_service:s0
diff --git a/private/system_server.te b/private/system_server.te
index df87794..1f8945b 100644
--- a/private/system_server.te
+++ b/private/system_server.te
@@ -202,9 +202,6 @@
binder_call(system_server, vold)
binder_call(system_server, wificond)
binder_call(system_server, wpantund)
-userdebug_or_eng(`
- binder_call(system_server, perfprofd)
-')
binder_service(system_server)
# Use HALs
@@ -432,12 +429,6 @@
allow system_server perfetto_traces_data_file:file read;
allow system_server perfetto:fd use;
-# Allow dropbox to read /data/misc/perfprofd. Only the fd is sent over binder.
-userdebug_or_eng(`
- allow system_server perfprofd_data_file:file { getattr read };
- allow system_server perfprofd:fd use;
-')
-
# Manage /data/backup.
allow system_server backup_data_file:dir create_dir_perms;
allow system_server backup_data_file:file create_file_perms;
@@ -736,9 +727,6 @@
allow system_server update_engine_service:service_manager find;
allow system_server vold_service:service_manager find;
allow system_server wificond_service:service_manager find;
-userdebug_or_eng(`
- allow system_server perfprofd_service:service_manager find;
-')
add_service(system_server, batteryproperties_service)
diff --git a/private/untrusted_app_all.te b/private/untrusted_app_all.te
index 3c20c08..de047da 100644
--- a/private/untrusted_app_all.te
+++ b/private/untrusted_app_all.te
@@ -104,14 +104,6 @@
# Allow untrusted apps to interact with gpuservice
binder_call(untrusted_app_all, gpuservice)
-# Allow GMS core to access perfprofd output, which is stored
-# in /data/misc/perfprofd/. GMS core will need to list all
-# data stored in that directory to process them one by one.
-userdebug_or_eng(`
- allow untrusted_app_all perfprofd_data_file:file r_file_perms;
- allow untrusted_app_all perfprofd_data_file:dir r_dir_perms;
-')
-
# gdbserver for ndk-gdb ptrace attaches to app process.
allow untrusted_app_all self:process ptrace;
diff --git a/public/domain.te b/public/domain.te
index b620ec1..e12c224 100644
--- a/public/domain.te
+++ b/public/domain.te
@@ -141,10 +141,12 @@
allow domain system_file:lnk_file { getattr read };
# Global access to /system/etc/security/cacerts/*, /system/etc/seccomp_policy/*, /system/lib[64]/*,
-# linker and its config.
+# /(system|product|system_ext)/etc/(group|passwd), linker and its config.
allow domain system_seccomp_policy_file:file r_file_perms;
# cacerts are accessible from public Java API.
allow domain system_security_cacerts_file:file r_file_perms;
+allow domain system_group_file:file r_file_perms;
+allow domain system_passwd_file:file r_file_perms;
allow domain system_linker_exec:file { execute read open getattr map };
allow domain system_linker_config_file:file r_file_perms;
allow domain system_lib_file:file { execute read open getattr map };
@@ -998,7 +1000,6 @@
-crash_dump
-init # starts vendor executables
-kernel # loads /vendor/firmware
- userdebug_or_eng(`-perfprofd')
userdebug_or_eng(`-heapprofd')
-shell
-system_executes_vendor_violators
@@ -1038,10 +1039,12 @@
-netutils_wrapper_exec
-property_contexts_file
-system_event_log_tags_file
+ -system_group_file
-system_lib_file
with_asan(`-system_asan_options_file')
-system_linker_exec
-system_linker_config_file
+ -system_passwd_file
-system_seccomp_policy_file
-system_security_cacerts_file
-system_zoneinfo_file
@@ -1323,7 +1326,6 @@
-crash_dump
-init
-kernel
- -perfprofd
-heapprofd
-ueventd
} vendor_file:file { no_w_file_perms no_x_file_perms open };
diff --git a/public/file.te b/public/file.te
index c78ddd5..1fd00a4 100644
--- a/public/file.te
+++ b/public/file.te
@@ -152,10 +152,14 @@
type system_lib_file, system_file_type, file_type;
# system libraries that are available only to bootstrap processes
type system_bootstrap_lib_file, system_file_type, file_type;
+# Default type for the group file /system/etc/group.
+type system_group_file, system_file_type, file_type;
# Default type for linker executable /system/bin/linker[64].
type system_linker_exec, system_file_type, file_type;
# Default type for linker config /system/etc/ld.config.*.
type system_linker_config_file, system_file_type, file_type;
+# Default type for the passwd file /system/etc/passwd.
+type system_passwd_file, system_file_type, file_type;
# Default type for linker config /system/etc/seccomp_policy/*.
type system_seccomp_policy_file, system_file_type, file_type;
# Default type for cacerts in /system/etc/security/cacerts/*.
@@ -212,6 +216,8 @@
type password_slot_metadata_file, file_type;
# APEX files within /metadata
type apex_metadata_file, file_type;
+# libsnapshot files within /metadata
+type ota_metadata_file, file_type;
# Type for /dev/cpu_variant:.*.
type dev_cpu_variant, file_type;
@@ -351,7 +357,6 @@
type zoneinfo_data_file, file_type, data_file_type, core_data_file_type;
type vold_data_file, file_type, data_file_type, core_data_file_type;
type iorapd_data_file, file_type, data_file_type, core_data_file_type;
-type perfprofd_data_file, file_type, data_file_type, core_data_file_type, mlstrustedobject;
type tee_data_file, file_type, data_file_type;
type update_engine_data_file, file_type, data_file_type, core_data_file_type;
type update_engine_log_data_file, file_type, data_file_type, core_data_file_type;
diff --git a/public/perfprofd.te b/public/perfprofd.te
deleted file mode 100644
index 47dfbf2..0000000
--- a/public/perfprofd.te
+++ /dev/null
@@ -1,121 +0,0 @@
-# perfprofd - perf profile collection daemon
-type perfprofd, domain;
-type perfprofd_exec, system_file_type, exec_type, file_type;
-
-userdebug_or_eng(`
-
- typeattribute perfprofd coredomain;
- typeattribute perfprofd mlstrustedsubject;
-
- # perfprofd access to sysfs directory structure.
- allow perfprofd sysfs_type:dir search;
-
- # perfprofd needs to control CPU hot-plug in order to avoid kernel
- # perfevents problems in cases where CPU goes on/off during measurement;
- # this means read access to /sys/devices/system/cpu/possible
- # and read/write access to /sys/devices/system/cpu/cpu*/online
- allow perfprofd sysfs_devices_system_cpu:file rw_file_perms;
-
- # perfprofd checks for the existence of and then invokes simpleperf;
- # simpleperf retains perfprofd domain after exec
- allow perfprofd system_file:file rx_file_perms;
-
- # perfprofd reads a config file from /data/data/com.google.android.gms/files
- allow perfprofd { privapp_data_file app_data_file }:file r_file_perms;
- allow perfprofd { privapp_data_file app_data_file }:dir search;
- allow perfprofd self:global_capability_class_set { dac_override dac_read_search };
-
- # perfprofd opens a file for writing in /data/misc/perfprofd
- allow perfprofd perfprofd_data_file:file create_file_perms;
- allow perfprofd perfprofd_data_file:dir rw_dir_perms;
-
- # perfprofd uses the system log
- read_logd(perfprofd);
- write_logd(perfprofd);
-
- # perfprofd inspects /sys/power/wake_unlock
- wakelock_use(perfprofd);
-
- # perfprofd looks at thermals.
- allow perfprofd sysfs_thermal:dir r_dir_perms;
-
- # perfprofd gets charging status.
- hal_client_domain(perfprofd, hal_health)
-
- # simpleperf reads kernel notes.
- allow perfprofd sysfs_kernel_notes:file r_file_perms;
-
- # Simpleperf & perfprofd query a range of proc stats.
- allow perfprofd proc_loadavg:file r_file_perms;
- allow perfprofd proc_stat:file r_file_perms;
- allow perfprofd proc_modules:file r_file_perms;
-
- # simpleperf writes to perf_event_paranoid under /proc.
- allow perfprofd proc_perf:file write;
-
- # Simpleperf: kptr_restrict. This would be required to dump kernel symbols.
- dontaudit perfprofd proc_security:file *;
-
- # simpleperf uses ioctl() to turn on kernel perf events measurements
- allow perfprofd self:global_capability_class_set sys_admin;
-
- # simpleperf needs to examine /proc to collect task/thread info
- r_dir_file(perfprofd, domain)
-
- # simpleperf needs to access /proc/<pid>/exec
- allow perfprofd self:global_capability_class_set { sys_resource sys_ptrace };
- neverallow perfprofd domain:process ptrace;
-
- # simpleperf needs open/read any file that turns up in a profile
- # to see whether it has a build ID
- allow perfprofd exec_type:file r_file_perms;
- # App & ART artifacts.
- r_dir_file(perfprofd, apk_data_file)
- r_dir_file(perfprofd, dalvikcache_data_file)
- # Vendor libraries.
- r_dir_file(perfprofd, vendor_file)
- # Vendor apps.
- r_dir_file(perfprofd, vendor_app_file)
- # SP HAL files.
- r_dir_file(perfprofd, same_process_hal_file)
-
- # simpleperf will set security.perf_harden to enable access to perf_event_open()
- set_prop(perfprofd, shell_prop)
-
- # simpleperf examines debugfs on startup to collect tracepoint event types
- r_dir_file(perfprofd, debugfs_tracing)
- r_dir_file(perfprofd, debugfs_tracing_debug)
-
- # simpleperf is going to execute "sleep"
- allow perfprofd toolbox_exec:file rx_file_perms;
- # simpleperf is going to execute "mv" on a temp file
- allow perfprofd shell_exec:file rx_file_perms;
-
- # needed for simpleperf on some kernels
- allow perfprofd self:global_capability_class_set ipc_lock;
-
- # simpleperf attempts to put a temp file into /data/local/tmp. Do not allow,
- # use the fallback cwd code, do not spam the log. But ensure this is correctly
- # removed at some point. b/70232908.
- dontaudit perfprofd shell_data_file:dir *;
- dontaudit perfprofd shell_data_file:file *;
-
- # Allow perfprofd to publish a binder service and make binder calls.
- binder_use(perfprofd)
- add_service(perfprofd, perfprofd_service)
-
- # Use devpts for streams from cmd.
- #
- # This is normally granted to binderservicedomain, but this service
- # has tighter restrictions on the callers (see below), so must enable
- # this manually.
- allow perfprofd devpts:chr_file rw_file_perms;
-
- # Use socket & pipe supplied by su, for cmd perfprofd dump.
- allow perfprofd su:unix_stream_socket { read write getattr sendto };
- allow perfprofd su:fifo_file r_file_perms;
-
- # Allow perfprofd to submit to dropbox.
- allow perfprofd dropbox_service:service_manager find;
- binder_call(perfprofd, system_server)
-')
diff --git a/public/service.te b/public/service.te
index 0a50eb7..c195b69 100644
--- a/public/service.te
+++ b/public/service.te
@@ -25,7 +25,6 @@
type mediadrmserver_service, service_manager_type;
type netd_service, service_manager_type;
type nfc_service, service_manager_type;
-type perfprofd_service, service_manager_type;
type radio_service, service_manager_type;
type secure_element_service, service_manager_type;
type storaged_service, service_manager_type;
@@ -96,6 +95,7 @@
type ethernet_service, app_api_service, system_server_service, service_manager_type;
type biometric_service, app_api_service, system_server_service, service_manager_type;
type bugreport_service, system_api_service, system_server_service, service_manager_type;
+type platform_compat_service, system_server_service, service_manager_type;
type face_service, app_api_service, system_server_service, service_manager_type;
type fingerprint_service, app_api_service, system_server_service, service_manager_type;
type gfxinfo_service, system_api_service, system_server_service, service_manager_type;
diff --git a/public/statsd.te b/public/statsd.te
index 089cae9..435bbdf 100644
--- a/public/statsd.te
+++ b/public/statsd.te
@@ -27,9 +27,6 @@
binder_call(statsd, appdomain)
binder_call(statsd, healthd)
binder_call(statsd, incidentd)
-userdebug_or_eng(`
- binder_call(statsd, perfprofd)
-')
binder_call(statsd, system_server)
# Allow statsd to interact with gpuservice
@@ -44,9 +41,6 @@
allow statsd {
app_api_service
incident_service
- userdebug_or_eng(`
- perfprofd_service
- ')
system_api_service
}:service_manager find;
diff --git a/public/vendor_init.te b/public/vendor_init.te
index c439ffd..3312ff8 100644
--- a/public/vendor_init.te
+++ b/public/vendor_init.te
@@ -51,6 +51,7 @@
-system_file_type
-mnt_product_file
-password_slot_metadata_file
+ -ota_metadata_file
-unlabeled
-vendor_file_type
-vold_metadata_file
@@ -65,6 +66,7 @@
-core_data_file_type
-exec_type
-password_slot_metadata_file
+ -ota_metadata_file
-runtime_event_log_tags_file
-system_file_type
-unlabeled
@@ -79,6 +81,7 @@
-core_data_file_type
-exec_type
-password_slot_metadata_file
+ -ota_metadata_file
-system_file_type
-unlabeled
-vendor_file_type
@@ -93,6 +96,7 @@
-core_data_file_type
-exec_type
-password_slot_metadata_file
+ -ota_metadata_file
-system_file_type
-unlabeled
-vendor_file_type
@@ -107,6 +111,7 @@
-exec_type
-mnt_product_file
-password_slot_metadata_file
+ -ota_metadata_file
-system_file_type
-vendor_file_type
-vold_metadata_file