Merge "Update seapp_contexts precedence documentation" into main
diff --git a/private/dex2oat.te b/private/dex2oat.te
index 379e32c..18600d8 100644
--- a/private/dex2oat.te
+++ b/private/dex2oat.te
@@ -84,7 +84,7 @@
# Allow dex2oat access to /postinstall/apex.
allow dex2oat postinstall_apex_mnt_dir:dir { getattr search };
-allow dex2oat postinstall_apex_mnt_dir:file r_file_perms;
+allow dex2oat postinstall_apex_mnt_dir:{ file lnk_file } r_file_perms;
# Allow dex2oat access to files in /data/ota.
allow dex2oat ota_data_file:dir ra_dir_perms;
diff --git a/private/domain.te b/private/domain.te
index 692c962..662cdd6 100644
--- a/private/domain.te
+++ b/private/domain.te
@@ -156,10 +156,18 @@
get_prop(domain, binder_cache_system_server_prop)
get_prop(domain, binder_cache_telephony_server_prop)
-# Allow access to fsverity keyring.
+# Allow searching the ".fs-verity" keyring.
+#
+# Note: Android no longer uses fsverity builtin signatures, which makes this
+# rule mostly unnecessary. This rule can potentially still be invoked when
+# opening a file with an fsverity builtin signature that exists on-disk from
+# Android 13 or earlier, if the kernel hasn't updated to disable fsverity
+# builtin signature support. Though, opening such a file fails regardless of
+# whether SELinux allows the keyring lookup, as the keyring is now always empty.
+# At the same time, some totally unrelated dependencies on this rule have crept
+# in as well, for example init needs it to create the session keyring on Linux
+# v5.3 and later. TODO(b/290064770) Replace this with more specific rules.
allow domain kernel:key search;
-# Allow access to keys in the fsverity keyring that were installed at boot.
-allow domain fsverity_init:key search;
# For testing purposes, allow access to keys installed with su.
userdebug_or_eng(`
allow domain su:key search;
diff --git a/private/file_contexts b/private/file_contexts
index 123e4ed..9344953 100644
--- a/private/file_contexts
+++ b/private/file_contexts
@@ -238,7 +238,6 @@
/system/bin/init u:object_r:init_exec:s0
# TODO(/123600489): merge mini-keyctl into toybox
/system/bin/mini-keyctl -- u:object_r:toolbox_exec:s0
-/system/bin/fsverity_init u:object_r:fsverity_init_exec:s0
/system/bin/sload_f2fs -- u:object_r:e2fs_exec:s0
/system/bin/make_f2fs -- u:object_r:e2fs_exec:s0
/system/bin/fsck_msdos -- u:object_r:fsck_exec:s0
diff --git a/private/fsverity_init.te b/private/fsverity_init.te
deleted file mode 100644
index 2e5089c..0000000
--- a/private/fsverity_init.te
+++ /dev/null
@@ -1,21 +0,0 @@
-type fsverity_init, domain, coredomain;
-type fsverity_init_exec, exec_type, file_type, system_file_type;
-
-init_daemon_domain(fsverity_init)
-
-# Allow to read /proc/keys for searching key id.
-allow fsverity_init proc_keys:file r_file_perms;
-
-# Ignore denials to access irrelevant keys, as a side effect to access /proc/keys.
-dontaudit fsverity_init domain:key view;
-allow fsverity_init kernel:key { view search write setattr };
-allow fsverity_init fsverity_init:key { view search write };
-
-# Read the on-device signing certificate, to be able to add it to the keyring
-allow fsverity_init odsign:fd use;
-allow fsverity_init odsign_data_file:file { getattr read };
-
-# When kernel requests an algorithm, the crypto API first looks for an
-# already registered algorithm with that name. If it fails, the kernel creates
-# an implementation of the algorithm from templates.
-dontaudit fsverity_init kernel:system module_request;
diff --git a/private/odsign.te b/private/odsign.te
index f06795c..da1d9d6 100644
--- a/private/odsign.te
+++ b/private/odsign.te
@@ -51,9 +51,6 @@
# Run odrefresh to refresh ART artifacts
domain_auto_trans(odsign, odrefresh_exec, odrefresh)
-# Run fsverity_init to add key to fsverity keyring
-domain_auto_trans(odsign, fsverity_init_exec, fsverity_init)
-
# Run compos_verify to verify CompOs signatures
domain_auto_trans(odsign, compos_verify_exec, compos_verify)
@@ -65,5 +62,5 @@
set_prop(odsign, ctl_odsign_prop)
# Neverallows
-neverallow { domain -odsign -init -fsverity_init} odsign_data_file:dir ~search;
-neverallow { domain -odsign -init -fsverity_init} odsign_data_file:file *;
+neverallow { domain -odsign -init } odsign_data_file:dir ~search;
+neverallow { domain -odsign -init } odsign_data_file:file *;
diff --git a/private/property.te b/private/property.te
index 66c9cea..8cf7c2a 100644
--- a/private/property.te
+++ b/private/property.te
@@ -51,6 +51,8 @@
system_internal_prop(virtualizationservice_prop)
system_internal_prop(ctl_apex_load_prop)
+system_internal_prop(sensors_config_prop)
+
# Properties which can't be written outside system
system_restricted_prop(device_config_virtualization_framework_native_prop)
system_restricted_prop(log_file_logger_prop)
diff --git a/private/property_contexts b/private/property_contexts
index 5c08328..b8a2d89 100644
--- a/private/property_contexts
+++ b/private/property_contexts
@@ -1567,3 +1567,6 @@
# Properties for Quick Start setup.
ro.quick_start.oem_id u:object_r:quick_start_prop:s0 exact string
ro.quick_start.device_id u:object_r:quick_start_prop:s0 exact string
+
+# Properties for sensor service
+sensors.aosp_low_power_sensor_fusion.maximum_rate u:object_r:sensors_config_prop:s0 exact uint
diff --git a/private/system_server.te b/private/system_server.te
index e78a734..9719e09 100644
--- a/private/system_server.te
+++ b/private/system_server.te
@@ -854,6 +854,10 @@
# Allow the heap dump ART plugin to the count of sessions waiting for OOME
get_prop(system_server, traced_oome_heap_session_count_prop)
+# Allow the sensor service (running in the system service) to read sensor
+# configuration properties
+get_prop(system_server, sensors_config_prop)
+
# Create a socket for connections from debuggerd.
allow system_server system_ndebug_socket:sock_file create_file_perms;