Merge "Fix running simpleperf_app_runner on user device."
diff --git a/Android.mk b/Android.mk
index 7b39fc1..df4a004 100644
--- a/Android.mk
+++ b/Android.mk
@@ -173,6 +173,19 @@
SHAREDLIB_EXT=so
endif
+# Convert a file_context file for a non-flattened APEX into a file for
+# flattened APEX. /system/apex/<apex_name> path is prepended to the original paths
+# $(1): path to the input file_contexts file for non-flattened APEX
+# $(2): name of the APEX
+# $(3): path to the generated file_contexs file for flattened APEX
+# $(4): variable where $(3) is added to
+define build_flattened_apex_file_contexts
+$(4) += $(3)
+$(3): PRIVATE_APEX_PATH := /system/apex/$(subst .,\\.,$(2))
+$(3): $(1)
+ $(hide) awk '/object_r/{printf("$$(PRIVATE_APEX_PATH)%s\n",$$$$0)}' $$< > $$@
+endef
+
#################################
include $(CLEAR_VARS)
@@ -1029,6 +1042,14 @@
ifneq (,$(filter userdebug eng,$(TARGET_BUILD_VARIANT)))
local_fc_files += $(wildcard $(addsuffix /file_contexts_overlayfs, $(PLAT_PRIVATE_POLICY)))
endif
+ifeq ($(TARGET_FLATTEN_APEX),true)
+ apex_fc_files := $(wildcard $(LOCAL_PATH)/apex/*-file_contexts)
+ $(foreach _input,$(apex_fc_files),\
+ $(eval _output := $(intermediates)/$(notdir $(_input))-flattened)\
+ $(eval _apex_name := $(patsubst %-file_contexts,%,$(notdir $(_input))))\
+ $(eval $(call build_flattened_apex_file_contexts,$(_input),$(_apex_name),$(_output),local_fc_files))\
+ )
+endif
local_fcfiles_with_nl := $(call add_nl, $(local_fc_files), $(built_nl))
file_contexts.local.tmp := $(intermediates)/file_contexts.local.tmp
diff --git a/file_contexts.mk b/file_contexts.mk
index 58ecd87..267b68f 100644
--- a/file_contexts.mk
+++ b/file_contexts.mk
@@ -14,6 +14,14 @@
ifneq (,$(filter userdebug eng,$(TARGET_BUILD_VARIANT)))
local_fc_files += $(wildcard $(addsuffix /file_contexts_overlayfs, $(PLAT_PRIVATE_POLICY)))
endif
+ifeq ($(TARGET_FLATTEN_APEX),true)
+ apex_fc_files := $(wildcard $(LOCAL_PATH)/apex/*-file_contexts)
+ $(foreach _input,$(apex_fc_files),\
+ $(eval _output := $(intermediates)/$(notdir $(_input))-flattened)\
+ $(eval _apex_name := $(patsubst %-file_contexts,%,$(notdir $(_input))))\
+ $(eval $(call build_flattened_apex_file_contexts,$(_input),$(_apex_name),$(_output),local_fc_files))\
+ )
+endif
local_fcfiles_with_nl := $(call add_nl, $(local_fc_files), $(built_nl))
$(LOCAL_BUILT_MODULE): PRIVATE_FC_FILES := $(local_fcfiles_with_nl)
diff --git a/private/app.te b/private/app.te
index 4e433eb..1ef415a 100644
--- a/private/app.te
+++ b/private/app.te
@@ -1,15 +1,3 @@
-# TODO: deal with tmpfs_domain pub/priv split properly
-# Read system properties managed by zygote.
-allow appdomain zygote_tmpfs:file read;
-
-# Read from (but not create) system_server buffers transferred through
-# ashmem, e.g. battery stats.
-allow appdomain system_server_tmpfs:file read;
-
-# Get info from priv_app through ashmem, such as contact
-# info etc.
-allow appdomain priv_app_tmpfs:file read;
-
# Allow apps to read the Test Harness Mode property. This property is used in
# the implementation of ActivityManager.isDeviceInTestHarnessMode()
get_prop(appdomain, test_harness_prop)
diff --git a/private/cameraserver.te b/private/cameraserver.te
index c16c132..ef44bfa 100644
--- a/private/cameraserver.te
+++ b/private/cameraserver.te
@@ -1,3 +1,4 @@
typeattribute cameraserver coredomain;
init_daemon_domain(cameraserver)
+tmpfs_domain(cameraserver)
diff --git a/private/compat/28.0/28.0.ignore.cil b/private/compat/28.0/28.0.ignore.cil
index 31b89b8..bc49c99 100644
--- a/private/compat/28.0/28.0.ignore.cil
+++ b/private/compat/28.0/28.0.ignore.cil
@@ -7,8 +7,6 @@
( new_objects
activity_task_service
adb_service
- app_binding_service
- app_prediction_service
apex_data_file
apex_mnt_dir
apex_key_file
@@ -17,12 +15,14 @@
apexd_exec
apexd_prop
apexd_tmpfs
+ appdomain_tmpfs
+ app_binding_service
+ app_prediction_service
app_zygote
app_zygote_tmpfs
biometric_service
bpf_progs_loaded_prop
bugreport_service
- cameraserver_data_file
content_capture_service
content_suggestions_service
cpu_variant_prop
@@ -48,6 +48,7 @@
external_vibrator_service
hal_atrace_hwservice
hal_face_hwservice
+ hal_graphics_composer_server_tmpfs
hal_health_storage_hwservice
hal_input_classifier_hwservice
hal_power_stats_hwservice
diff --git a/private/file_contexts b/private/file_contexts
index 89c11bd..eb45401 100644
--- a/private/file_contexts
+++ b/private/file_contexts
@@ -457,7 +457,6 @@
/data/misc/bluedroid/\.a2dp_ctrl u:object_r:bluetooth_socket:s0
/data/misc/bluedroid/\.a2dp_data u:object_r:bluetooth_socket:s0
/data/misc/camera(/.*)? u:object_r:camera_data_file:s0
-/data/misc/cameraserver(/.*)? u:object_r:cameraserver_data_file:s0
/data/misc/carrierid(/.*)? u:object_r:radio_data_file:s0
/data/misc/dhcp(/.*)? u:object_r:dhcp_data_file:s0
/data/misc/dhcp-6\.8\.2(/.*)? u:object_r:dhcp_data_file:s0
diff --git a/private/mediaextractor.te b/private/mediaextractor.te
index eb90cdc..2e654d6 100644
--- a/private/mediaextractor.te
+++ b/private/mediaextractor.te
@@ -2,3 +2,6 @@
init_daemon_domain(mediaextractor)
tmpfs_domain(mediaextractor)
+allow mediaextractor appdomain_tmpfs:file { getattr map read write };
+allow mediaextractor mediaserver_tmpfs:file { getattr map read write };
+allow mediaextractor system_server_tmpfs:file { getattr map read write };
diff --git a/private/mls b/private/mls
index 421b046..9690440 100644
--- a/private/mls
+++ b/private/mls
@@ -57,14 +57,14 @@
mlsconstrain dir { open search setattr rename add_name remove_name reparent rmdir }
( (t2 != app_data_file and t2 != privapp_data_file ) or l1 dom l2 or t1 == mlstrustedsubject);
mlsconstrain { file sock_file } { open setattr unlink link rename }
- ( (t2 != app_data_file and t2 != privapp_data_file and t2 != priv_app_tmpfs) or l1 dom l2 or t1 == mlstrustedsubject);
+ ( (t2 != app_data_file and t2 != privapp_data_file and t2 != appdomain_tmpfs) or l1 dom l2 or t1 == mlstrustedsubject);
# For symlinks in app_data_file, require equivalence in order to manipulate or follow (read).
mlsconstrain { lnk_file } { open setattr unlink link rename read }
( (t2 != app_data_file) or l1 eq l2 or t1 == mlstrustedsubject);
# For priv_app_data_file, continue to use dominance for symlinks because dynamite relies on this.
# TODO: Migrate to equivalence when it's no longer needed.
mlsconstrain { lnk_file } { open setattr unlink link rename read }
- ( (t2 != privapp_data_file and t2 != priv_app_tmpfs) or l1 dom l2 or t1 == mlstrustedsubject);
+ ( (t2 != privapp_data_file and t2 != appdomain_tmpfs) or l1 dom l2 or t1 == mlstrustedsubject);
#
# Constraints for file types other than app data files.
@@ -76,7 +76,7 @@
(t2 == app_data_file or t2 == privapp_data_file or l1 dom l2 or t1 == mlstrustedsubject or t2 == mlstrustedobject);
mlsconstrain { file lnk_file sock_file chr_file blk_file } { read getattr execute }
- (t2 == app_data_file or t2 == privapp_data_file or t2 == priv_app_tmpfs or l1 dom l2 or t1 == mlstrustedsubject or t2 == mlstrustedobject);
+ (t2 == app_data_file or t2 == privapp_data_file or t2 == appdomain_tmpfs or l1 dom l2 or t1 == mlstrustedsubject or t2 == mlstrustedobject);
# Write operations: Subject must be equivalent to the object unless the
# subject or the object is trusted.
@@ -84,7 +84,7 @@
(t2 == app_data_file or t2 == privapp_data_file or l1 eq l2 or t1 == mlstrustedsubject or t2 == mlstrustedobject);
mlsconstrain { file lnk_file sock_file chr_file blk_file } { write setattr append unlink link rename }
- (t2 == app_data_file or t2 == privapp_data_file or t2 == priv_app_tmpfs or l1 eq l2 or t1 == mlstrustedsubject or t2 == mlstrustedobject);
+ (t2 == app_data_file or t2 == privapp_data_file or t2 == appdomain_tmpfs or l1 eq l2 or t1 == mlstrustedsubject or t2 == mlstrustedobject);
# Special case for FIFOs.
# These can be unnamed pipes, in which case they will be labeled with the
diff --git a/private/surfaceflinger.te b/private/surfaceflinger.te
index 36e784f..b1aa775 100644
--- a/private/surfaceflinger.te
+++ b/private/surfaceflinger.te
@@ -4,6 +4,7 @@
type surfaceflinger_exec, system_file_type, exec_type, file_type;
init_daemon_domain(surfaceflinger)
+tmpfs_domain(surfaceflinger)
typeattribute surfaceflinger mlstrustedsubject;
typeattribute surfaceflinger display_service_server;
@@ -13,6 +14,7 @@
# Perform HwBinder IPC.
hal_client_domain(surfaceflinger, hal_graphics_allocator)
hal_client_domain(surfaceflinger, hal_graphics_composer)
+typeattribute surfaceflinger_tmpfs hal_graphics_composer_client_tmpfs;
hal_client_domain(surfaceflinger, hal_omx)
hal_client_domain(surfaceflinger, hal_configstore)
hal_client_domain(surfaceflinger, hal_power)
diff --git a/private/system_server.te b/private/system_server.te
index 1003994..f91461c 100644
--- a/private/system_server.te
+++ b/private/system_server.te
@@ -13,6 +13,7 @@
type_transition system_server system_data_file:sock_file system_ndebug_socket "ndebugsocket";
allow system_server zygote_tmpfs:file read;
+allow system_server appdomain_tmpfs:file { getattr map read write };
# For art.
allow system_server dalvikcache_data_file:dir r_dir_perms;
diff --git a/public/app.te b/public/app.te
index 18603b6..75f521e 100644
--- a/public/app.te
+++ b/public/app.te
@@ -6,6 +6,7 @@
### extend from this policy. Only policies which should apply to ALL
### zygote spawned apps should be added here.
###
+type appdomain_tmpfs, file_type;
# WebView and other application-specific JIT compilers
allow appdomain self:process execmem;
@@ -351,6 +352,12 @@
# Read access to FDs from the DropboxManagerService.
allow appdomain dropbox_data_file:file { getattr read };
+# Read tmpfs types from these processes.
+allow appdomain audioserver_tmpfs:file { getattr map read write };
+allow appdomain system_server_tmpfs:file { getattr map read write };
+allow appdomain zygote_tmpfs:file { map read };
+
+
###
### Neverallow rules
###
diff --git a/public/cameraserver.te b/public/cameraserver.te
index fee4bdb..f4eed48 100644
--- a/public/cameraserver.te
+++ b/public/cameraserver.te
@@ -1,6 +1,7 @@
# cameraserver - camera daemon
type cameraserver, domain;
type cameraserver_exec, system_file_type, exec_type, file_type;
+type cameraserver_tmpfs, file_type;
binder_use(cameraserver)
binder_call(cameraserver, binderservicedomain)
@@ -62,11 +63,6 @@
hal_client_domain(cameraserver, hal_omx)
hal_client_domain(cameraserver, hal_allocator)
-userdebug_or_eng(`
- allow cameraserver cameraserver_data_file:dir { add_name write search remove_name };
- allow cameraserver cameraserver_data_file:file { create write open read unlink };
-')
-
# Allow shell commands from ADB for CTS testing/dumping
userdebug_or_eng(`
allow cameraserver su:fd use;
diff --git a/public/file.te b/public/file.te
index a9f4523..a264c91 100644
--- a/public/file.te
+++ b/public/file.te
@@ -293,7 +293,6 @@
type bootstat_data_file, file_type, data_file_type, core_data_file_type;
type boottrace_data_file, file_type, data_file_type, core_data_file_type;
type camera_data_file, file_type, data_file_type, core_data_file_type;
-type cameraserver_data_file, file_type, data_file_type, core_data_file_type;
type gatekeeper_data_file, file_type, data_file_type, core_data_file_type;
type incident_data_file, file_type, data_file_type, core_data_file_type;
type keychain_data_file, file_type, data_file_type, core_data_file_type;
diff --git a/public/hal_graphics_composer.te b/public/hal_graphics_composer.te
index e10daf9..cb4a130 100644
--- a/public/hal_graphics_composer.te
+++ b/public/hal_graphics_composer.te
@@ -1,6 +1,12 @@
+type hal_graphics_composer_server_tmpfs, file_type;
+attribute hal_graphics_composer_client_tmpfs;
+expandattribute hal_graphics_composer_client_tmpfs true;
+
# HwBinder IPC from client to server, and callbacks
binder_call(hal_graphics_composer_client, hal_graphics_composer_server)
binder_call(hal_graphics_composer_server, hal_graphics_composer_client)
+allow hal_graphics_composer_client hal_graphics_composer_server_tmpfs:file { getattr map read write };
+allow hal_graphics_composer_server hal_graphics_composer_client_tmpfs:file { getattr map read write };
hal_attribute_hwservice(hal_graphics_composer, hal_graphics_composer_hwservice)
diff --git a/public/surfaceflinger.te b/public/surfaceflinger.te
index ae00287..c1e4844 100644
--- a/public/surfaceflinger.te
+++ b/public/surfaceflinger.te
@@ -1,2 +1,3 @@
# surfaceflinger - display compositor service
type surfaceflinger, domain;
+type surfaceflinger_tmpfs, file_type;
diff --git a/public/system_server.te b/public/system_server.te
index aa9c6c1..ff18bdf 100644
--- a/public/system_server.te
+++ b/public/system_server.te
@@ -3,4 +3,4 @@
# Most of the framework services run in this process.
#
type system_server, domain;
-type system_server_tmpfs, file_type;
+type system_server_tmpfs, file_type, mlstrustedobject;
diff --git a/public/te_macros b/public/te_macros
index 4195b88..6541525 100644
--- a/public/te_macros
+++ b/public/te_macros
@@ -168,10 +168,9 @@
# Allow a base set of permissions required for all apps.
define(`app_domain', `
typeattribute $1 appdomain;
-# Label ashmem objects with our own unique type.
-tmpfs_domain($1)
-# Map with PROT_EXEC.
-allow $1 $1_tmpfs:file execute;
+# Label tmpfs objects for all apps.
+type_transition $1 tmpfs:file appdomain_tmpfs;
+allow $1 appdomain_tmpfs:file { execute getattr map read write };
neverallow { $1 -runas_app -shell } { domain -$1 }:file no_rw_file_perms;
neverallow { appdomain -runas_app -shell -$1 } $1:file no_rw_file_perms;
# The Android security model guarantees the confidentiality and integrity
diff --git a/vendor/hal_graphics_composer_default.te b/vendor/hal_graphics_composer_default.te
index 72d781d..7dcd2b2 100644
--- a/vendor/hal_graphics_composer_default.te
+++ b/vendor/hal_graphics_composer_default.te
@@ -3,6 +3,8 @@
type hal_graphics_composer_default_exec, exec_type, vendor_file_type, file_type;
init_daemon_domain(hal_graphics_composer_default)
+type_transition hal_graphics_composer_default tmpfs:file hal_graphics_composer_server_tmpfs;
+allow hal_graphics_composer_default hal_graphics_composer_server_tmpfs:file { getattr map read write };
# b/68864350
dontaudit hal_graphics_composer_default unlabeled:dir search;