Merge changes from topic "tim-service" into main
* changes:
Add ITradeInMode service sepolicy.
Add tradeinmode sepolicy.
diff --git a/Android.bp b/Android.bp
index 6a123ae..9905e73 100644
--- a/Android.bp
+++ b/Android.bp
@@ -1004,6 +1004,7 @@
"system_ext_202404.compat.cil",
],
}),
+ system_ext_specific: true,
}
phony {
diff --git a/build/soong/service_fuzzer_bindings.go b/build/soong/service_fuzzer_bindings.go
index aa47a85..e81e8c8 100644
--- a/build/soong/service_fuzzer_bindings.go
+++ b/build/soong/service_fuzzer_bindings.go
@@ -350,6 +350,7 @@
"media_communication": EXCEPTION_NO_FUZZER,
"media_metrics": EXCEPTION_NO_FUZZER,
"media_projection": EXCEPTION_NO_FUZZER,
+ "media_quality": EXCEPTION_NO_FUZZER,
"media_resource_monitor": EXCEPTION_NO_FUZZER,
"media_router": EXCEPTION_NO_FUZZER,
"media_session": EXCEPTION_NO_FUZZER,
diff --git a/private/compat/202404/202404.ignore.cil b/private/compat/202404/202404.ignore.cil
index 9ac4963..8bb0a2d 100644
--- a/private/compat/202404/202404.ignore.cil
+++ b/private/compat/202404/202404.ignore.cil
@@ -19,6 +19,7 @@
virtual_fingerprint_exec
virtual_face
virtual_face_exec
+ media_quality_service
advanced_protection_service
sysfs_firmware_acpi_tables
))
diff --git a/private/compat/34.0/34.0.ignore.cil b/private/compat/34.0/34.0.ignore.cil
index 6c52dba..3132c5a 100644
--- a/private/compat/34.0/34.0.ignore.cil
+++ b/private/compat/34.0/34.0.ignore.cil
@@ -52,4 +52,5 @@
aconfigd_socket
enable_16k_pages_prop
proc_cgroups
+ media_quality_service
))
diff --git a/private/crash_dump.te b/private/crash_dump.te
index b2d3bd5..a9a802c 100644
--- a/private/crash_dump.te
+++ b/private/crash_dump.te
@@ -19,13 +19,7 @@
}:process { ptrace signal sigchld sigstop sigkill };
userdebug_or_eng(`
- allow crash_dump {
- apexd
- keystore
- llkd
- logd
- vold
- }:process { ptrace signal sigchld sigstop sigkill };
+ allow crash_dump { apexd llkd logd vold }:process { ptrace signal sigchld sigstop sigkill };
')
# Read ART APEX data directory
@@ -135,7 +129,6 @@
init
kernel
keystore
- userdebug_or_eng(`-keystore')
llkd
userdebug_or_eng(`-llkd')
logd
diff --git a/private/keystore.te b/private/keystore.te
index 3a1c242..50542b0 100644
--- a/private/keystore.te
+++ b/private/keystore.te
@@ -93,8 +93,7 @@
neverallow { domain -keystore -init } keystore_data_file:dir *;
neverallow { domain -keystore -init } keystore_data_file:notdevfile_class_set *;
-# TODO(b/186868271): Remove the crash dump exception soon-ish (maybe by May 14, 2021?)
-neverallow { domain userdebug_or_eng(`-crash_dump') } keystore:process ptrace;
+neverallow * keystore:process ptrace;
# Only keystore can set keystore.crash_count system property. Since init is allowed to set any
# system property, an exception is added for init as well.
diff --git a/private/property.te b/private/property.te
index 8199b4f..c746cb3 100644
--- a/private/property.te
+++ b/private/property.te
@@ -21,7 +21,6 @@
system_internal_prop(device_config_tethering_u_or_later_native_prop)
system_internal_prop(dmesgd_start_prop)
system_internal_prop(bert_collector_start_prop)
-system_internal_prop(desktop_ec_crash_collector_start_prop)
system_internal_prop(fastbootd_protocol_prop)
system_internal_prop(gsid_prop)
system_internal_prop(init_perf_lsm_hooks_prop)
diff --git a/private/property_contexts b/private/property_contexts
index fc5162e..ea2df66 100644
--- a/private/property_contexts
+++ b/private/property_contexts
@@ -873,8 +873,6 @@
acpi.bert_collector.start u:object_r:bert_collector_start_prop:s0 exact bool
-desktop.ec.crash_collector.start u:object_r:desktop_ec_crash_collector_start_prop:s0 exact bool
-
odsign.key.done u:object_r:odsign_prop:s0 exact bool
odsign.verification.done u:object_r:odsign_prop:s0 exact bool
odsign.verification.success u:object_r:odsign_prop:s0 exact bool
diff --git a/private/service.te b/private/service.te
index 69f1b77..08a032a 100644
--- a/private/service.te
+++ b/private/service.te
@@ -28,6 +28,9 @@
type statsbootstrap_service, system_server_service, service_manager_type;
type statscompanion_service, system_server_service, service_manager_type;
type statsmanager_service, system_api_service, system_server_service, service_manager_type;
+until_board_api(202504, `
+ type media_quality_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+')
is_flag_enabled(RELEASE_SUPERVISION_SERVICE, `
type supervision_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
diff --git a/private/service_contexts b/private/service_contexts
index 8e537b9..8cab6ea 100644
--- a/private/service_contexts
+++ b/private/service_contexts
@@ -337,6 +337,7 @@
media_communication u:object_r:media_communication_service:s0
media_metrics u:object_r:media_metrics_service:s0
media_projection u:object_r:media_projection_service:s0
+media_quality u:object_r:media_quality_service:s0
media_resource_monitor u:object_r:media_session_service:s0
media_router u:object_r:media_router_service:s0
media_session u:object_r:media_session_service:s0
diff --git a/private/surfaceflinger.te b/private/surfaceflinger.te
index f6f1d9b..547cc7c 100644
--- a/private/surfaceflinger.te
+++ b/private/surfaceflinger.te
@@ -135,6 +135,8 @@
allow surfaceflinger statsmanager_service:service_manager find;
# TODO(146461633): remove this once native pullers talk to StatsManagerService
binder_call(surfaceflinger, statsd);
+# Allow pushing atoms to the stats bootstrap atom service
+allow surfaceflinger statsbootstrap_service:service_manager find;
# Allow to use files supplied by hal_evs
allow surfaceflinger hal_evs:fd use;
@@ -142,10 +144,6 @@
# Allow to use release fence fds supplied by hal_camera
allow surfaceflinger hal_camera:fd use;
-# Allow pushing jank event atoms to statsd
-userdebug_or_eng(`
- unix_socket_send(surfaceflinger, statsdw, statsd)
-')
# Surfaceflinger should not be reading default vendor-defined properties.
dontaudit surfaceflinger vendor_default_prop:file read;
diff --git a/public/service.te b/public/service.te
index 9d77fb9..cc9b1ab 100644
--- a/public/service.te
+++ b/public/service.te
@@ -176,6 +176,9 @@
type media_communication_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
type media_metrics_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
type media_projection_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+starting_at_board_api(202504, `
+ type media_quality_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+')
type media_router_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
type media_session_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
type meminfo_service, system_api_service, system_server_service, service_manager_type;