Merge "Refactor apex data file types."
diff --git a/prebuilts/api/31.0/private/keystore.te b/prebuilts/api/31.0/private/keystore.te
index 3fccf59..8842224 100644
--- a/prebuilts/api/31.0/private/keystore.te
+++ b/prebuilts/api/31.0/private/keystore.te
@@ -20,10 +20,6 @@
# Allow keystore to write to statsd.
unix_socket_send(keystore, statsdw, statsd)
-# Allow keystore to register callbacks with statsd.
-allow keystore stats_service:service_manager find;
-binder_call(keystore, statsd);
-
# Keystore need access to the keystore_key context files to load the keystore key backend.
allow keystore keystore2_key_contexts_file:file r_file_perms;
@@ -33,3 +29,8 @@
# can call keystore methods on those references.
allow keystore vold:binder transfer;
allow keystore wait_for_keymaster:binder transfer;
+
+# Only keystore can set keystore.crash_count system property. Since init is allowed to set any
+# system property, an exception is added for init as well.
+set_prop(keystore, keystore_crash_prop)
+neverallow { domain -keystore -init } keystore_crash_prop:property_service set;
diff --git a/prebuilts/api/31.0/private/property.te b/prebuilts/api/31.0/private/property.te
index 01d4fd9..4f67251 100644
--- a/prebuilts/api/31.0/private/property.te
+++ b/prebuilts/api/31.0/private/property.te
@@ -15,6 +15,7 @@
system_internal_prop(init_perf_lsm_hooks_prop)
system_internal_prop(init_service_status_private_prop)
system_internal_prop(init_svc_debug_prop)
+system_internal_prop(keystore_crash_prop)
system_internal_prop(keystore_listen_prop)
system_internal_prop(last_boot_reason_prop)
system_internal_prop(localization_prop)
diff --git a/prebuilts/api/31.0/private/property_contexts b/prebuilts/api/31.0/private/property_contexts
index 0799e57..5ecb87f 100644
--- a/prebuilts/api/31.0/private/property_contexts
+++ b/prebuilts/api/31.0/private/property_contexts
@@ -1146,6 +1146,9 @@
# Broadcast boot stages, which keystore listens to
keystore.boot_level u:object_r:keystore_listen_prop:s0 exact int
+# Property that tracks keystore crash counts during a boot cycle.
+keystore.crash_count u:object_r:keystore_crash_prop:s0 exact int
+
partition.system.verified u:object_r:verity_status_prop:s0 exact string
partition.system_ext.verified u:object_r:verity_status_prop:s0 exact string
partition.product.verified u:object_r:verity_status_prop:s0 exact string
diff --git a/private/keystore.te b/private/keystore.te
index 0e57045..838712f 100644
--- a/private/keystore.te
+++ b/private/keystore.te
@@ -20,10 +20,6 @@
# Allow keystore to write to statsd.
unix_socket_send(keystore, statsdw, statsd)
-# Allow keystore to register callbacks with statsd.
-allow keystore stats_service:service_manager find;
-binder_call(keystore, statsd);
-
# Keystore need access to the keystore_key context files to load the keystore key backend.
allow keystore keystore2_key_contexts_file:file r_file_perms;
@@ -32,3 +28,8 @@
# Keystore needs to transfer binder references to vold so that it
# can call keystore methods on those references.
allow keystore vold:binder transfer;
+
+# Only keystore can set keystore.crash_count system property. Since init is allowed to set any
+# system property, an exception is added for init as well.
+set_prop(keystore, keystore_crash_prop)
+neverallow { domain -keystore -init } keystore_crash_prop:property_service set;
diff --git a/private/property.te b/private/property.te
index d6ddbdf..49d18ee 100644
--- a/private/property.te
+++ b/private/property.te
@@ -16,6 +16,7 @@
system_internal_prop(init_perf_lsm_hooks_prop)
system_internal_prop(init_service_status_private_prop)
system_internal_prop(init_svc_debug_prop)
+system_internal_prop(keystore_crash_prop)
system_internal_prop(keystore_listen_prop)
system_internal_prop(last_boot_reason_prop)
system_internal_prop(localization_prop)
diff --git a/private/property_contexts b/private/property_contexts
index 593274f..8741fbe 100644
--- a/private/property_contexts
+++ b/private/property_contexts
@@ -1153,6 +1153,9 @@
# Broadcast boot stages, which keystore listens to
keystore.boot_level u:object_r:keystore_listen_prop:s0 exact int
+# Property that tracks keystore crash counts during a boot cycle.
+keystore.crash_count u:object_r:keystore_crash_prop:s0 exact int
+
partition.system.verified u:object_r:verity_status_prop:s0 exact string
partition.system_ext.verified u:object_r:verity_status_prop:s0 exact string
partition.product.verified u:object_r:verity_status_prop:s0 exact string
diff --git a/private/shell.te b/private/shell.te
index 40b19fd..2f983f2 100644
--- a/private/shell.te
+++ b/private/shell.te
@@ -205,3 +205,7 @@
# Allow shell read access to /apex/apex-info-list.xml for CTS.
allow shell apex_info_file:file r_file_perms;
+
+# Allow shell (the vm tool) the access to vsock created by virtualization
+# service
+allow shell virtualizationservice:vsock_socket { read write };
diff --git a/private/virtualizationservice.te b/private/virtualizationservice.te
index 9b82e01..1bf14d8 100644
--- a/private/virtualizationservice.te
+++ b/private/virtualizationservice.te
@@ -41,3 +41,6 @@
allow virtualizationservice app_data_file:file { getattr read write };
# shell_data_file is used for automated tests and manual debugging.
allow virtualizationservice shell_data_file:file { getattr read write };
+
+# Let virtualizationservice to accept vsock connection from the guest VMs
+allow virtualizationservice self:vsock_socket { create_socket_perms_no_ioctl listen accept };
diff --git a/vendor/file_contexts b/vendor/file_contexts
index 12e5d9f..3f7c8f9 100644
--- a/vendor/file_contexts
+++ b/vendor/file_contexts
@@ -9,7 +9,7 @@
/(vendor|system/vendor)/bin/hw/android\.hardware\.automotive\.audiocontrol-service.example u:object_r:hal_audiocontrol_default_exec:s0
/(vendor|system/vendor)/bin/hw/android\.hardware\.automotive\.can@1\.0-service u:object_r:hal_can_socketcan_exec:s0
/(vendor|system/vendor)/bin/hw/android\.hardware\.automotive\.evs@1\.[0-9]-service u:object_r:hal_evs_default_exec:s0
-/(vendor|system/vendor)/bin/hw/android\.hardware\.automotive\.vehicle@2\.0-(service|protocan-service) u:object_r:hal_vehicle_default_exec:s0
+/(vendor|system/vendor)/bin/hw/android\.hardware\.automotive\.vehicle@2\.0-((default|emulator)-)*(service|protocan-service) u:object_r:hal_vehicle_default_exec:s0
/(vendor|system/vendor)/bin/hw/android\.hardware\.bluetooth@1\.[0-9]+-service u:object_r:hal_bluetooth_default_exec:s0
/(vendor|system/vendor)/bin/hw/android\.hardware\.bluetooth@1\.[0-9]+-service\.btlinux u:object_r:hal_bluetooth_btlinux_exec:s0
/(vendor|system/vendor)/bin/hw/android\.hardware\.biometrics\.face@1\.[0-9]+-service\.example u:object_r:hal_face_default_exec:s0