Merge "Allow binder calls between virtual_camera / mediaserver & codecs." into main
diff --git a/Android.bp b/Android.bp
index fe755d4..88107cc 100644
--- a/Android.bp
+++ b/Android.bp
@@ -337,36 +337,6 @@
product_specific: true,
}
-// HACK to support pre-vFRC vendor blobs
-// TODO(b/314010177): remove after new ToT (1000000.0) fully propagates
-se_versioned_policy {
- name: "plat_mapping_file_10000.0",
- base: ":plat_pub_policy.cil",
- mapping: true,
- version: "10000.0",
- relative_install_path: "mapping", // install to /system/etc/selinux/mapping
-}
-
-se_versioned_policy {
- name: "system_ext_mapping_file_10000.0",
- base: ":system_ext_pub_policy.cil",
- mapping: true,
- version: "10000.0",
- filter_out: [":plat_mapping_file"],
- relative_install_path: "mapping", // install to /system_ext/etc/selinux/mapping
- system_ext_specific: true,
-}
-
-se_versioned_policy {
- name: "product_mapping_file_10000.0",
- base: ":pub_policy.cil",
- mapping: true,
- version: "10000.0",
- filter_out: [":plat_mapping_file", ":system_ext_mapping_file"],
- relative_install_path: "mapping", // install to /product/etc/selinux/mapping
- product_specific: true,
-}
-
//////////////////////////////////
// vendor/odm sepolicy
//////////////////////////////////
diff --git a/Android.mk b/Android.mk
index 8cdedbe..63b74aa 100644
--- a/Android.mk
+++ b/Android.mk
@@ -210,12 +210,6 @@
plat_sepolicy.cil \
secilc \
-# HACK to support pre-vFRC vendor blobs
-# TODO(b/314010177): remove after new ToT (1000000.0) fully propagates
-ifneq (true,$(BOARD_API_LEVEL_FROZEN))
-LOCAL_REQUIRED_MODULES += plat_mapping_file_10000.0
-endif
-
ifneq ($(PRODUCT_PRECOMPILED_SEPOLICY),false)
LOCAL_REQUIRED_MODULES += plat_sepolicy_and_mapping.sha256
endif
@@ -284,12 +278,6 @@
LOCAL_REQUIRED_MODULES += \
system_ext_mapping_file
-# HACK to support pre-vFRC vendor blobs
-# TODO(b/314010177): remove after new ToT (1000000.0) fully propagates
-ifneq (true,$(BOARD_API_LEVEL_FROZEN))
-LOCAL_REQUIRED_MODULES += system_ext_mapping_file_10000.0
-endif
-
system_ext_compat_files := $(call build_policy, $(sepolicy_compat_files), $(SYSTEM_EXT_PRIVATE_POLICY))
LOCAL_REQUIRED_MODULES += $(addprefix system_ext_, $(notdir $(system_ext_compat_files)))
@@ -338,12 +326,6 @@
LOCAL_REQUIRED_MODULES += \
product_mapping_file
-# HACK to support pre-vFRC vendor blobs
-# TODO(b/314010177): remove after new ToT (1000000.0) fully propagates
-ifneq (true,$(BOARD_API_LEVEL_FROZEN))
-LOCAL_REQUIRED_MODULES += product_mapping_file_10000.0
-endif
-
product_compat_files := $(call build_policy, $(sepolicy_compat_files), $(PRODUCT_PRIVATE_POLICY))
LOCAL_REQUIRED_MODULES += $(addprefix product_, $(notdir $(product_compat_files)))
diff --git a/contexts/plat_file_contexts_test b/contexts/plat_file_contexts_test
index 9558425..64b2f2d 100644
--- a/contexts/plat_file_contexts_test
+++ b/contexts/plat_file_contexts_test
@@ -915,8 +915,10 @@
/data/misc/apexdata/com.android.permission/test apex_system_server_data_file
/data/misc/apexdata/com.android.scheduling apex_system_server_data_file
/data/misc/apexdata/com.android.scheduling/test apex_system_server_data_file
-/data/misc/apexdata/com.android.tethering apex_system_server_data_file
-/data/misc/apexdata/com.android.tethering/test apex_system_server_data_file
+/data/misc/apexdata/com.android.tethering apex_tethering_data_file
+/data/misc/apexdata/com.android.tethering/test apex_tethering_data_file
+/data/misc/apexdata/com.android.tethering/threadnetwork apex_tethering_data_file
+/data/misc/apexdata/com.android.tethering/threadnetwork/test apex_tethering_data_file
/data/misc/apexdata/com.android.uwb apex_system_server_data_file
/data/misc/apexdata/com.android.uwb/test apex_system_server_data_file
/data/misc/apexdata/com.android.wifi apex_system_server_data_file
@@ -1017,8 +1019,6 @@
/data/misc/systemkeys/test systemkeys_data_file
/data/misc/textclassifier textclassifier_data_file
/data/misc/textclassifier/test textclassifier_data_file
-/data/misc/threadnetwork threadnetwork_data_file
-/data/misc/threadnetwork/test threadnetwork_data_file
/data/misc/train-info stats_data_file
/data/misc/train-info/test stats_data_file
/data/misc/user misc_user_data_file
diff --git a/microdroid/system/private/init.te b/microdroid/system/private/init.te
index 896590d..c83bcdb 100644
--- a/microdroid/system/private/init.te
+++ b/microdroid/system/private/init.te
@@ -435,3 +435,8 @@
# PRNG seeder daemon socket is created and listened on by init before forking.
allow init prng_seeder:unix_stream_socket { create bind listen };
+
+# Allow init to load vendor modules
+r_dir_file(init, vendor_kernel_modules)
+allow init self:capability sys_module;
+allow init vendor_kernel_modules:system module_load;
diff --git a/microdroid/system/public/file.te b/microdroid/system/public/file.te
index d53de79..57852c2 100644
--- a/microdroid/system/public/file.te
+++ b/microdroid/system/public/file.te
@@ -37,6 +37,7 @@
type vendor_configs_file, file_type, vendor_file_type;
type vendor_data_file, file_type, data_file_type;
type vendor_file, file_type, vendor_file_type;
+type vendor_kernel_modules, vendor_file_type, file_type;
type vendor_service_contexts_file, vendor_file_type, file_type;
type vm_payload_service_socket, file_type, coredomain_socket;
type traced_consumer_socket, file_type, coredomain_socket;
diff --git a/private/file.te b/private/file.te
index de2581d..d289f43 100644
--- a/private/file.te
+++ b/private/file.te
@@ -77,12 +77,14 @@
# /data/misc/apexdata/com.android.virt
type apex_virt_data_file, file_type, data_file_type, core_data_file_type, apex_data_file_type;
+# /data/misc/apexdata/com.android.tethering
+type apex_tethering_data_file, file_type, data_file_type, core_data_file_type, apex_data_file_type;
+
# legacy labels for various /data/misc[_ce|_de]/*/apexdata directories - retained
# for backward compatibility b/217581286
type apex_appsearch_data_file, file_type, data_file_type, core_data_file_type, apex_data_file_type;
type apex_permission_data_file, file_type, data_file_type, core_data_file_type, apex_data_file_type;
type apex_scheduling_data_file, file_type, data_file_type, core_data_file_type, apex_data_file_type;
-type apex_tethering_data_file, file_type, data_file_type, core_data_file_type, apex_data_file_type;
type apex_wifi_data_file, file_type, data_file_type, core_data_file_type, apex_data_file_type;
# /data/font/files
@@ -134,9 +136,6 @@
# in to satisfy MLS constraints for trusted domains.
type prng_seeder_socket, file_type, coredomain_socket, mlstrustedobject;
-# /data/misc/threadnetwork
-type threadnetwork_data_file, file_type, data_file_type, core_data_file_type;
-
# /sys/firmware/devicetree/base/avf
type sysfs_dt_avf, fs_type, sysfs_type;
diff --git a/private/file_contexts b/private/file_contexts
index a1bc85f..7fbc580 100644
--- a/private/file_contexts
+++ b/private/file_contexts
@@ -625,7 +625,7 @@
/data/misc/apexdata/com\.android\.virt(/.*)? u:object_r:apex_virt_data_file:s0
/data/misc/apexdata/com\.android\.permission(/.*)? u:object_r:apex_system_server_data_file:s0
/data/misc/apexdata/com\.android\.scheduling(/.*)? u:object_r:apex_system_server_data_file:s0
-/data/misc/apexdata/com\.android\.tethering(/.*)? u:object_r:apex_system_server_data_file:s0
+/data/misc/apexdata/com\.android\.tethering(/.*)? u:object_r:apex_tethering_data_file:s0
/data/misc/apexdata/com\.android\.uwb(/.*)? u:object_r:apex_system_server_data_file:s0
/data/misc/apexdata/com\.android\.wifi(/.*)? u:object_r:apex_system_server_data_file:s0
/data/misc/apexrollback(/.*)? u:object_r:apex_rollback_data_file:s0
@@ -678,7 +678,6 @@
/data/misc/stats-metadata(/.*)? u:object_r:stats_data_file:s0
/data/misc/systemkeys(/.*)? u:object_r:systemkeys_data_file:s0
/data/misc/textclassifier(/.*)? u:object_r:textclassifier_data_file:s0
-/data/misc/threadnetwork(/.*)? u:object_r:threadnetwork_data_file:s0
/data/misc/train-info(/.*)? u:object_r:stats_data_file:s0
/data/misc/user(/.*)? u:object_r:misc_user_data_file:s0
/data/misc/virtualizationservice(/.*)? u:object_r:virtualizationservice_data_file:s0
diff --git a/private/ot_daemon.te b/private/ot_daemon.te
index 457e1bf..495947f 100644
--- a/private/ot_daemon.te
+++ b/private/ot_daemon.te
@@ -12,10 +12,14 @@
# Allow the ot_daemon to use the net domain.
net_domain(ot_daemon)
-# Allow the ot_daemon to access the folder "/data/misc/threadnetwork".
-allow ot_daemon threadnetwork_data_file:dir rw_dir_perms;
-allow ot_daemon threadnetwork_data_file:file create_file_perms;
-allow ot_daemon threadnetwork_data_file:sock_file {create unlink};
+# Allow ot_daemon to find /data/misc/apexdata/com.android.tethering
+allow ot_daemon apex_module_data_file:dir search;
+
+# Allow the ot_daemon to access files and subdirectories under
+# /data/misc/apexdata/com\.android\.tethering
+allow ot_daemon apex_tethering_data_file:dir {create rw_dir_perms};
+allow ot_daemon apex_tethering_data_file:file create_file_perms;
+allow ot_daemon apex_tethering_data_file:sock_file {create unlink};
# Allow OT daemon to read/write the Thread tunnel interface
allow ot_daemon tun_device:chr_file {read write};
diff --git a/private/snapuserd.te b/private/snapuserd.te
index 8cd9e63..3752e01 100644
--- a/private/snapuserd.te
+++ b/private/snapuserd.te
@@ -33,6 +33,9 @@
allow snapuserd snapuserd_socket:unix_stream_socket { accept listen getattr read write };
allow snapuserd snapuserd_proxy_socket:sock_file write;
+# Required for setting GID to system while calling SetTaskProfile() API
+allow snapuserd self:global_capability_class_set { setgid };
+
# This arises due to first-stage init opening /dev/null without F_CLOEXEC
# (see SetStdioToDevNull in init). When we fork() and execveat() snapuserd
# again, the descriptor leaks into the new process.
diff --git a/private/system_app.te b/private/system_app.te
index 31e10bb..e08941d 100644
--- a/private/system_app.te
+++ b/private/system_app.te
@@ -187,3 +187,5 @@
# system_app should be the only domain writing the adaptive haptics prop
neverallow { domain -init -system_app } adaptive_haptics_prop:property_service set;
+# system_app should be the only domain writing the force l3 prop
+neverallow { domain -init -system_app } drm_forcel3_prop:property_service set;
diff --git a/private/system_server.te b/private/system_server.te
index 62430b1..decabe1 100644
--- a/private/system_server.te
+++ b/private/system_server.te
@@ -1418,19 +1418,19 @@
# These are modules where the code runs in system_server, so we need full access.
allow system_server apex_system_server_data_file:dir create_dir_perms;
allow system_server apex_system_server_data_file:file create_file_perms;
+allow system_server apex_tethering_data_file:dir create_dir_perms;
+allow system_server apex_tethering_data_file:file create_file_perms;
# Legacy labels that we still need to support (b/217581286)
allow system_server {
apex_appsearch_data_file
apex_permission_data_file
apex_scheduling_data_file
- apex_tethering_data_file
apex_wifi_data_file
}:dir create_dir_perms;
allow system_server {
apex_appsearch_data_file
apex_permission_data_file
apex_scheduling_data_file
- apex_tethering_data_file
apex_wifi_data_file
}:file create_file_perms;
diff --git a/private/virtualizationmanager.te b/private/virtualizationmanager.te
index bbae070..d0fe571 100644
--- a/private/virtualizationmanager.te
+++ b/private/virtualizationmanager.te
@@ -111,3 +111,8 @@
# For debug purposes we try to get the canonical path from /proc/self/fd/N. That triggers
# a harmless denial for CompOS log files, so ignore that.
dontaudit virtualizationmanager apex_module_data_file:dir search;
+
+is_flag_enabled(RELEASE_AVF_ENABLE_DEVICE_ASSIGNMENT, `
+ # virtualizationmanager holds references to bound devices, returned from vfio_handler
+ binder_call(virtualizationmanager, vfio_handler)
+')
diff --git a/private/virtualizationservice.te b/private/virtualizationservice.te
index e17797e..4d8ac6b 100644
--- a/private/virtualizationservice.te
+++ b/private/virtualizationservice.te
@@ -104,6 +104,6 @@
}:process setrlimit;
is_flag_enabled(RELEASE_AVF_ENABLE_DEVICE_ASSIGNMENT, `
- # Only virtualizationservice can communicate to vfio_handler
- neverallow { domain -virtualizationservice -servicemanager } vfio_handler:binder call;
+ # Only virtualizationservice and virtualizationmanager can communicate to vfio_handler
+ neverallow { domain -virtualizationmanager -virtualizationservice -servicemanager } vfio_handler:binder call;
')
diff --git a/public/service.te b/public/service.te
index acbaf4d..1c7605e 100644
--- a/public/service.te
+++ b/public/service.te
@@ -213,7 +213,7 @@
type search_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
type search_ui_service, app_api_service, system_server_service, service_manager_type;
type sec_key_att_app_id_provider_service, app_api_service, system_server_service, service_manager_type;
-type security_state_service, app_api_service, system_server_service, service_manager_type;
+type security_state_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
type selection_toolbar_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
type sensorservice_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
type sensor_privacy_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;