Merge "charger: reads /sys/power/state"
diff --git a/private/compat/26.0/26.0.cil b/private/compat/26.0/26.0.cil
index 4ebb66e..00b68d2 100644
--- a/private/compat/26.0/26.0.cil
+++ b/private/compat/26.0/26.0.cil
@@ -134,7 +134,8 @@
(typeattributeset default_android_hwservice_26_0 (default_android_hwservice))
(typeattributeset default_android_service_26_0 (default_android_service))
(typeattributeset default_android_vndservice_26_0 (default_android_vndservice))
-(typeattributeset default_prop_26_0 (default_prop))
+(typeattributeset default_prop_26_0
+ ( default_prop pm_prop))
(typeattributeset device_26_0 (device))
(typeattributeset device_identifiers_service_26_0 (device_identifiers_service))
(typeattributeset deviceidle_service_26_0 (deviceidle_service))
@@ -455,6 +456,7 @@
proc_kmsg
proc_loadavg
proc_mounts
+ proc_overflowuid
proc_page_cluster
proc_pagetypeinfo
proc_random
diff --git a/private/dexoptanalyzer.te b/private/dexoptanalyzer.te
index 1c23f57..dfc81b8 100644
--- a/private/dexoptanalyzer.te
+++ b/private/dexoptanalyzer.te
@@ -20,7 +20,7 @@
# Allow reading secondary dex files that were reported by the app to the
# package manager.
allow dexoptanalyzer app_data_file:dir { getattr search };
-allow dexoptanalyzer app_data_file:file r_file_perms;
+allow dexoptanalyzer app_data_file:file { getattr read };
# dexoptanalyzer calls access(2) with W_OK flag on app data. We can use the
# "dontaudit...audit_access" policy line to suppress the audit access without
# suppressing denial on actual access.
diff --git a/private/domain.te b/private/domain.te
index d37a0bd..6be5082 100644
--- a/private/domain.te
+++ b/private/domain.te
@@ -16,3 +16,116 @@
# Limit ability to generate hardware unique device ID attestations to priv_apps
neverallow { domain -priv_app } *:keystore_key gen_unique_id;
+
+# Core domains are not permitted to use kernel interfaces which are not
+# explicitly labeled.
+# TODO(b/65643247): Apply these neverallow rules to all coredomain.
+full_treble_only(`
+ # /proc
+ neverallow {
+ coredomain
+ -dumpstate
+ -init
+ -platform_app
+ -priv_app
+ -shell
+ -system_app
+ -vold
+ -vendor_init
+ } proc:file no_rw_file_perms;
+
+ # /sys
+ neverallow {
+ coredomain
+ -charger
+ -dumpstate
+ -healthd
+ -init
+ -mediaserver
+ -priv_app
+ -storaged
+ -system_app
+ -ueventd
+ -update_verifier
+ -vold
+ -vendor_init
+ } sysfs:file no_rw_file_perms;
+
+ # /dev
+ neverallow {
+ coredomain
+ -fsck
+ -init
+ -shell
+ -ueventd
+ -vendor_init
+ } device:{ blk_file file } no_rw_file_perms;
+
+ # debugfs
+ neverallow {
+ coredomain
+ -dumpstate
+ -init
+ -system_server
+ -vendor_init
+ } debugfs:file no_rw_file_perms;
+
+ # tracefs
+ neverallow {
+ coredomain
+ userdebug_or_eng(`-atrace')
+ -dumpstate
+ -init
+ -perfprofd
+ -shell
+ -vendor_init
+ } debugfs_tracing:file no_rw_file_perms;
+
+ # inotifyfs
+ neverallow {
+ coredomain
+ -init
+ -vendor_init
+ } inotify:file no_rw_file_perms;
+
+ # pstorefs
+ neverallow {
+ coredomain
+ -bootstat
+ -charger
+ -dumpstate
+ -healthd
+ -init
+ -logd
+ -logpersist
+ -recovery_persist
+ -recovery_refresh
+ -shell
+ -system_server
+ -vendor_init
+ } pstorefs:file no_rw_file_perms;
+
+ # configfs
+ neverallow {
+ coredomain
+ -init
+ -system_server
+ -vendor_init
+ } configfs:file no_rw_file_perms;
+
+ # functionfs
+ neverallow {
+ coredomain
+ -adbd
+ -init
+ -mediaprovider
+ -vendor_init
+ }functionfs:file no_rw_file_perms;
+
+ # usbfs and binfmt_miscfs
+ neverallow {
+ coredomain
+ -init
+ -vendor_init
+ }{ usbfs binfmt_miscfs }:file no_rw_file_perms;
+')
diff --git a/private/file.te b/private/file.te
index 7bd83f2..6994202 100644
--- a/private/file.te
+++ b/private/file.te
@@ -1,8 +1,3 @@
-# Compatibility with type names used in vanilla Android 4.3 and 4.4.
-typealias audio_data_file alias audio_firmware_file;
-typealias app_data_file alias platform_app_data_file;
-typealias app_data_file alias download_file;
-
# /proc/config.gz
type config_gz, fs_type;
diff --git a/private/genfs_contexts b/private/genfs_contexts
index a6de59a..ee17d49 100644
--- a/private/genfs_contexts
+++ b/private/genfs_contexts
@@ -31,6 +31,7 @@
genfscon proc /sys/kernel/kptr_restrict u:object_r:proc_security:s0
genfscon proc /sys/kernel/modprobe u:object_r:usermodehelper:s0
genfscon proc /sys/kernel/modules_disabled u:object_r:proc_security:s0
+genfscon proc /sys/kernel/overflowuid u:object_r:proc_overflowuid:s0
genfscon proc /sys/kernel/perf_event_max_sample_rate u:object_r:proc_perf:s0
genfscon proc /sys/kernel/poweroff_cmd u:object_r:usermodehelper:s0
genfscon proc /sys/kernel/random u:object_r:proc_random:s0
diff --git a/private/property_contexts b/private/property_contexts
index 55974c0..1706224 100644
--- a/private/property_contexts
+++ b/private/property_contexts
@@ -68,6 +68,7 @@
ro.boot.bootreason u:object_r:bootloader_boot_reason_prop:s0
persist.sys.boot.reason u:object_r:last_boot_reason_prop:s0
sys.boot.reason u:object_r:system_boot_reason_prop:s0
+pm. u:object_r:pm_prop:s0
# Boolean property set by system server upon boot indicating
# if device owner is provisioned.
diff --git a/private/system_server.te b/private/system_server.te
index b38509c..93c6a57 100644
--- a/private/system_server.te
+++ b/private/system_server.te
@@ -481,6 +481,7 @@
set_prop(system_server, device_logging_prop)
set_prop(system_server, dumpstate_options_prop)
set_prop(system_server, overlay_prop)
+set_prop(system_server, pm_prop)
userdebug_or_eng(`set_prop(system_server, wifi_log_prop)')
# ctl interface
diff --git a/public/file.te b/public/file.te
index cd0a452..37ebde4 100644
--- a/public/file.te
+++ b/public/file.te
@@ -26,6 +26,7 @@
type proc_modules, fs_type;
type proc_mounts, fs_type;
type proc_net, fs_type;
+type proc_overflowuid, fs_type;
type proc_page_cluster, fs_type;
type proc_pagetypeinfo, fs_type;
type proc_perf, fs_type;
@@ -238,13 +239,13 @@
type system_app_data_file, file_type, data_file_type, core_data_file_type, mlstrustedobject;
# Compatibility with type name used in Android 4.3 and 4.4.
# Default type for anything under /cache
-type cache_file, file_type, data_file_type, mlstrustedobject;
+type cache_file, file_type, data_file_type, core_data_file_type, mlstrustedobject;
# Type for /cache/backup_stage/* (fd interchange with apps)
-type cache_backup_file, file_type, data_file_type, mlstrustedobject;
+type cache_backup_file, file_type, data_file_type, core_data_file_type, mlstrustedobject;
# type for anything under /cache/backup (local transport storage)
-type cache_private_backup_file, file_type, data_file_type;
+type cache_private_backup_file, file_type, data_file_type, core_data_file_type;
# Type for anything under /cache/recovery
-type cache_recovery_file, file_type, data_file_type, mlstrustedobject;
+type cache_recovery_file, file_type, data_file_type, core_data_file_type, mlstrustedobject;
# Default type for anything under /efs
type efs_file, file_type;
# Type for wallpaper file.
@@ -272,7 +273,7 @@
# Socket types
type adbd_socket, file_type, coredomain_socket;
-type bluetooth_socket, file_type, data_file_type, coredomain_socket;
+type bluetooth_socket, file_type, data_file_type, core_data_file_type, coredomain_socket;
type dnsproxyd_socket, file_type, coredomain_socket, mlstrustedobject;
type dumpstate_socket, file_type, coredomain_socket;
type fwmarkd_socket, file_type, coredomain_socket, mlstrustedobject;
@@ -282,7 +283,7 @@
type logdw_socket, file_type, coredomain_socket, mlstrustedobject;
type mdns_socket, file_type, coredomain_socket;
type mdnsd_socket, file_type, coredomain_socket, mlstrustedobject;
-type misc_logd_file, coredomain_socket, file_type, data_file_type;
+type misc_logd_file, coredomain_socket, file_type, data_file_type, core_data_file_type;
type mtpd_socket, file_type, coredomain_socket;
type netd_socket, file_type, coredomain_socket;
type property_socket, file_type, coredomain_socket, mlstrustedobject;
@@ -290,7 +291,7 @@
type rild_socket, file_type;
type rild_debug_socket, file_type;
type system_wpa_socket, file_type, data_file_type, coredomain_socket;
-type system_ndebug_socket, file_type, data_file_type, coredomain_socket, mlstrustedobject;
+type system_ndebug_socket, file_type, data_file_type, core_data_file_type, coredomain_socket, mlstrustedobject;
type tombstoned_crash_socket, file_type, coredomain_socket, mlstrustedobject;
type tombstoned_java_trace_socket, file_type, mlstrustedobject;
type tombstoned_intercept_socket, file_type, coredomain_socket;
diff --git a/public/hal_usb.te b/public/hal_usb.te
index 9cfd516..e2e3449 100644
--- a/public/hal_usb.te
+++ b/public/hal_usb.te
@@ -15,4 +15,5 @@
allow hal_usb sysfs:file open;
allow hal_usb sysfs:file write;
allow hal_usb sysfs:file getattr;
+allow hal_usb proc_overflowuid:file r_file_perms;
diff --git a/public/healthd.te b/public/healthd.te
index c0a7bec..e7c92c4 100644
--- a/public/healthd.te
+++ b/public/healthd.te
@@ -55,6 +55,7 @@
allow healthd ashmem_device:chr_file execute;
allow healthd self:process execmem;
allow healthd proc_sysrq:file rw_file_perms;
+allow healthd proc_overflowuid:file r_file_perms;
add_service(healthd, batteryproperties_service)
diff --git a/public/init.te b/public/init.te
index 2d55aba..bc10a82 100644
--- a/public/init.te
+++ b/public/init.te
@@ -280,6 +280,9 @@
# Write to /proc/sys/vm/page-cluster
allow init proc_page_cluster:file w_file_perms;
+# Read /proc/sys/kernel/overflowuid
+allow init proc_overflowuid:file r_file_perms;
+
# Reboot.
allow init self:capability sys_boot;
diff --git a/public/netd.te b/public/netd.te
index a1917b3..17f60b5 100644
--- a/public/netd.te
+++ b/public/netd.te
@@ -37,6 +37,9 @@
# For /proc/sys/net/ipv[46]/route/flush.
allow netd proc_net:file rw_file_perms;
+# Access for /proc/sys/kernel/overflowuid.
+allow netd proc_overflowuid:file r_file_perms;
+
# Enables PppController and interface enumeration (among others)
allow netd sysfs:dir r_dir_perms;
r_dir_file(netd, sysfs_net)
diff --git a/public/property.te b/public/property.te
index 713dc83..be84d4a 100644
--- a/public/property.te
+++ b/public/property.te
@@ -39,6 +39,7 @@
type pan_result_prop, property_type, core_property_type;
type persist_debug_prop, property_type, core_property_type;
type persistent_properties_ready_prop, property_type;
+type pm_prop, property_type;
type powerctl_prop, property_type, core_property_type;
type radio_prop, property_type, core_property_type;
type restorecon_prop, property_type, core_property_type;
diff --git a/public/te_macros b/public/te_macros
index 5a8ea5a..f3aa583 100644
--- a/public/te_macros
+++ b/public/te_macros
@@ -77,7 +77,7 @@
define(`tmpfs_domain', `
type $1_tmpfs, file_type;
type_transition $1 tmpfs:file $1_tmpfs;
-allow $1 $1_tmpfs:file { read write getattr };
+allow $1 $1_tmpfs:file { read write getattr map };
allow $1 tmpfs:dir { getattr search };
')
diff --git a/public/ueventd.te b/public/ueventd.te
index 212087e..7e1f3fd 100644
--- a/public/ueventd.te
+++ b/public/ueventd.te
@@ -36,6 +36,9 @@
# Use setfscreatecon() to label /dev directories and files.
allow ueventd self:process setfscreate;
+# Access for /proc/sys/kernel/overflowuid.
+allow ueventd proc_overflowuid:file r_file_perms;
+
#####
##### neverallow rules
#####
diff --git a/public/vold.te b/public/vold.te
index 2c2f147..148f4b5 100644
--- a/public/vold.te
+++ b/public/vold.te
@@ -24,6 +24,7 @@
proc_filesystems
proc_meminfo
proc_mounts
+ proc_overflowuid
}:file r_file_perms;
#Get file contexts