Merge "Thread: allow ot-rcp to bind a specific netif" into main
diff --git a/private/audioserver.te b/private/audioserver.te
index 54e0208..5aa8dde 100644
--- a/private/audioserver.te
+++ b/private/audioserver.te
@@ -43,6 +43,7 @@
allow audioserver sensor_privacy_service:service_manager find;
allow audioserver soundtrigger_middleware_service:service_manager find;
allow audioserver audio_service:service_manager find;
+allow audioserver virtual_device_native_service:service_manager find;
# Allow read/write access to bluetooth-specific properties
set_prop(audioserver, bluetooth_a2dp_offload_prop)
diff --git a/private/bpfloader.te b/private/bpfloader.te
index de7e8a4..33d3783 100644
--- a/private/bpfloader.te
+++ b/private/bpfloader.te
@@ -47,8 +47,8 @@
neverallow { domain -bpfloader } bpffs_type:lnk_file ~read;
neverallow { domain -bpfdomain } bpffs_type:lnk_file read;
-neverallow { domain -bpfloader } *:bpf { map_create prog_load };
-neverallow { domain -bpfdomain } *:bpf { map_read map_write prog_run };
+neverallow { domain -bpfloader } *:bpf prog_load;
+neverallow { domain -bpfdomain } *:bpf { map_create map_read map_write prog_run };
# 'fs_bpf_loader' is for internal use of the BpfLoader oneshot boot time process.
neverallow { domain -bpfloader } fs_bpf_loader:bpf *;
diff --git a/private/compos_verify.te b/private/compos_verify.te
index 5b3615e..99d645e 100644
--- a/private/compos_verify.te
+++ b/private/compos_verify.te
@@ -15,9 +15,10 @@
allow compos_verify apex_art_data_file:dir search;
allow compos_verify apex_art_data_file:file r_file_perms;
-# Allow odsign to redirect our stdout/stderr to log
-allow compos_verify odsign:fd use;
-allow compos_verify odsign_devpts:chr_file { read write };
+# odsign runs us with its console as our stdin/stdout/stderr.
+# But we never use them; logs go to logcat. Suppress the useless denials.
+dontaudit compos_verify odsign:fd use;
+dontaudit compos_verify odsign_devpts:chr_file { read write };
# Only odsign can enter the domain via exec
neverallow { domain -odsign } compos_verify:process transition;
diff --git a/private/crash_dump.te b/private/crash_dump.te
index 9bc7cf6..45d5722 100644
--- a/private/crash_dump.te
+++ b/private/crash_dump.te
@@ -109,6 +109,8 @@
dontaudit crash_dump system_data_file:{ lnk_file file } read;
dontaudit crash_dump property_type:file read;
+get_prop(crash_dump, misctrl_prop)
+
###
### neverallow assertions
###
diff --git a/private/dexopt_chroot_setup.te b/private/dexopt_chroot_setup.te
index c34a30b..5dd0e5d 100644
--- a/private/dexopt_chroot_setup.te
+++ b/private/dexopt_chroot_setup.te
@@ -50,6 +50,7 @@
device
devpts
fs_bpf
+ functionfs
fusectlfs
linkerconfig_file
metadata_file
@@ -76,6 +77,7 @@
debugfs_tracing_debug
devpts
fs_bpf
+ functionfs
fusectlfs
labeledfs
proc
diff --git a/private/dumpstate.te b/private/dumpstate.te
index bccbafd..2d7a1c9 100644
--- a/private/dumpstate.te
+++ b/private/dumpstate.te
@@ -195,7 +195,7 @@
allow dumpstate system_data_file:file r_file_perms;
# Allow dumpstate to append into apps' private files.
-allow dumpstate { privapp_data_file app_data_file }:file append;
+allow dumpstate app_data_file_type:file append;
# Read dmesg
allow dumpstate self:global_capability2_class_set syslog;
diff --git a/private/netd.te b/private/netd.te
index a466ef1..37581a6 100644
--- a/private/netd.te
+++ b/private/netd.te
@@ -10,12 +10,14 @@
allow netd { fs_bpf fs_bpf_netd_readonly fs_bpf_netd_shared fs_bpf_vendor }:file { getattr read };
allow netd { fs_bpf fs_bpf_netd_shared }:file write;
-# give netd permission to setup iptables rule with xt_bpf, attach program to cgroup, and read/write
-# the map created by bpfloader
-allow netd bpfloader:bpf { prog_run map_read map_write };
+# give netd permission to setup iptables rule with xt_bpf, attach program to cgroup,
+# create maps, and read/write maps created by bpfloader, itself and NS/SS mainline networking
+allow netd bpfloader:bpf prog_run;
+allow netd self:bpf map_create;
+allow netd { bpfloader netd network_stack system_server }:bpf { map_read map_write };
# in order to invoke side effect of close() on such a socket calling synchronize_rcu()
-# TODO: Remove this permission when 4.9 kernel is deprecated.
+# TODO: Still needed as of kernel 6.6-rc1 - see BpfUtils.h synchronizeKernelRCU()
# TODO: Remove this after we remove all bpf interactions from netd.
allow netd self:key_socket create;
diff --git a/private/network_stack.te b/private/network_stack.te
index 7587c1f..4450e02 100644
--- a/private/network_stack.te
+++ b/private/network_stack.te
@@ -45,6 +45,7 @@
binder_call(network_stack, netd);
# in order to invoke side effect of close() on such a socket calling synchronize_rcu()
+# TODO: Still needed as of kernel 6.6-rc1 - see BpfUtils.h synchronizeKernelRCU()
allow network_stack self:key_socket create;
# Java's Os.close() in libcore/luni/src/main/java/libcore/io/BlockGuardOs.java;l=100
# calls if (fd.isSocket$()) if (isLingerSocket(fd)) ...
@@ -63,7 +64,10 @@
# allow Tethering(network_stack process) to run/update/read the eBPF maps to offload tethering traffic by eBPF.
allow network_stack { fs_bpf_net_private fs_bpf_net_shared fs_bpf_netd_readonly fs_bpf_netd_shared fs_bpf_tethering }:dir search;
allow network_stack { fs_bpf_net_private fs_bpf_net_shared fs_bpf_netd_readonly fs_bpf_netd_shared fs_bpf_tethering }:file { getattr read write };
-allow network_stack bpfloader:bpf { map_read map_write prog_run };
+allow network_stack bpfloader:bpf prog_run;
+allow network_stack self:bpf map_create;
+allow network_stack { bpfloader netd network_stack system_server }:bpf { map_read map_write };
+
# allow Tethering(network_stack process) to read flag value in tethering_u_or_later_native namespace
get_prop(network_stack, device_config_tethering_u_or_later_native_prop)
diff --git a/private/property.te b/private/property.te
index 994594d..4ce2d54 100644
--- a/private/property.te
+++ b/private/property.te
@@ -231,6 +231,7 @@
-init
-dumpstate
-misctrl
+ -crash_dump
userdebug_or_eng(`-su')
} misctrl_prop:file no_rw_file_perms;
neverallow {
diff --git a/private/property_contexts b/private/property_contexts
index 8ade1b7..81370c0 100644
--- a/private/property_contexts
+++ b/private/property_contexts
@@ -532,6 +532,7 @@
dalvik.vm.image-dex2oat-threads u:object_r:dalvik_dynamic_config_prop:s0 exact int
dalvik.vm.restore-dex2oat-cpu-set u:object_r:dalvik_dynamic_config_prop:s0 exact string
dalvik.vm.restore-dex2oat-threads u:object_r:dalvik_dynamic_config_prop:s0 exact int
+dalvik.vm.pre-reboot. u:object_r:dalvik_dynamic_config_prop:s0 prefix
persist.sys.dalvik.vm.lib.2 u:object_r:dalvik_runtime_prop:s0 exact string
diff --git a/private/system_server.te b/private/system_server.te
index 1ddb48a..d05798d 100644
--- a/private/system_server.te
+++ b/private/system_server.te
@@ -1224,7 +1224,9 @@
# time in state accounting
allow system_server { fs_bpf fs_bpf_net_shared fs_bpf_netd_readonly fs_bpf_netd_shared }:dir search;
allow system_server { fs_bpf fs_bpf_net_shared fs_bpf_netd_readonly fs_bpf_netd_shared }:file { getattr read write };
-allow system_server bpfloader:bpf { map_read map_write prog_run };
+allow system_server bpfloader:bpf prog_run;
+allow system_server self:bpf map_create;
+allow system_server { bpfloader netd network_stack system_server }:bpf { map_read map_write };
# in order to invoke side effect of close() on such a socket calling synchronize_rcu()
allow system_server self:key_socket create;
# Java's Os.close() in libcore/luni/src/main/java/libcore/io/BlockGuardOs.java;l=100
diff --git a/private/virtualizationservice.te b/private/virtualizationservice.te
index f096e89..99c2a3b 100644
--- a/private/virtualizationservice.te
+++ b/private/virtualizationservice.te
@@ -33,7 +33,7 @@
allow virtualizationservice permission_service:service_manager find;
# Allow virtualizationservice to retrieve the remotely provisioned keys from rkpd.
-binder_call(virtualizationservice, remote_provisioning_service)
+binder_call(virtualizationservice, remote_provisioning_service_server)
allow virtualizationservice remote_provisioning_service:service_manager find;
# Allow virtualizationservice to manage VM secrets via Secretkeeper.
diff --git a/public/service.te b/public/service.te
index e055b4e..6ba1dcc 100644
--- a/public/service.te
+++ b/public/service.te
@@ -273,7 +273,7 @@
type wallpaper_effects_generation_service, app_api_service, system_server_service, service_manager_type;
type webviewupdate_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
type wifip2p_service, app_api_service, system_server_service, service_manager_type;
-type wifiscanner_service, system_api_service, system_server_service, service_manager_type;
+type wifiscanner_service, app_api_service, system_server_service, service_manager_type;
type wifi_service, app_api_service, system_server_service, service_manager_type;
type wifinl80211_service, service_manager_type;
type wifiaware_service, app_api_service, system_server_service, service_manager_type;
diff --git a/tests/sepolicy_tests.py b/tests/sepolicy_tests.py
index 1df8231..af47938 100644
--- a/tests/sepolicy_tests.py
+++ b/tests/sepolicy_tests.py
@@ -299,24 +299,7 @@
else:
Option.take_action(self, action, dest, opt, value, values, parser)
-Tests = [
- "TestBpffsTypeViolations",
- "TestDataTypeViolators",
- "TestProcTypeViolations",
- "TestSysfsTypeViolations",
- "TestSystemTypeViolators",
- "TestDebugfsTypeViolations",
- "TestTracefsTypeViolations",
- "TestVendorTypeViolations",
- "TestCoreDataTypeViolations",
- "TestPropertyTypeViolations",
- "TestAppDataTypeViolations",
- "TestDmaHeapDevTypeViolations",
- "TestCoredomainViolations",
- "TestViolatorAttributes",
- "TestIsolatedAttributeConsistency",
- "TestDevTypeViolations",
-]
+TEST_NAMES = [ name for name in dir() if name.startswith('Test') ]
def do_main(libpath):
"""
@@ -330,7 +313,7 @@
metavar="FILE", action="extend", type="string")
parser.add_option("-p", "--policy", dest="policy", metavar="FILE")
parser.add_option("-t", "--test", dest="test", action="extend",
- help="Test options include "+str(Tests))
+ help="Test options include "+str(TEST_NAMES))
(options, args) = parser.parse_args()