Merge "Define sepolicy for locale filter property"
diff --git a/private/bug_map b/private/bug_map
index eaa1593..c2670ef 100644
--- a/private/bug_map
+++ b/private/bug_map
@@ -1,5 +1,6 @@
dnsmasq netd fifo_file b/77868789
dnsmasq netd unix_stream_socket b/77868789
+gmscore_app ashmem_device chr_file b/160984921
gmscore_app system_data_file dir b/146166941
init app_data_file file b/77873135
init cache_file blk_file b/77873135
diff --git a/private/compat/27.0/27.0.ignore.cil b/private/compat/27.0/27.0.ignore.cil
index a42538f..6351c40 100644
--- a/private/compat/27.0/27.0.ignore.cil
+++ b/private/compat/27.0/27.0.ignore.cil
@@ -185,6 +185,7 @@
test_boot_reason_prop
time_prop
timedetector_service
+ tombstone_config_prop
tombstone_wifi_data_file
trace_data_file
traced
diff --git a/private/compat/30.0/30.0.cil b/private/compat/30.0/30.0.cil
index c99cecd..273a210 100644
--- a/private/compat/30.0/30.0.cil
+++ b/private/compat/30.0/30.0.cil
@@ -1368,6 +1368,7 @@
packagemanager_config_prop
recovery_config_prop
telephony_config_prop
+ tombstone_config_prop
zram_config_prop))
(typeattributeset exported3_radio_prop_30_0 (exported3_radio_prop))
(typeattributeset exported3_system_prop_30_0
diff --git a/private/property_contexts b/private/property_contexts
index 9979fae..f3eb647 100644
--- a/private/property_contexts
+++ b/private/property_contexts
@@ -484,7 +484,7 @@
sys.usb.ffs.ready u:object_r:ffs_control_prop:s0 exact bool
sys.usb.ffs.mtp.ready u:object_r:ffs_control_prop:s0 exact bool
-tombstoned.max_tombstone_count u:object_r:exported3_default_prop:s0 exact int
+tombstoned.max_tombstone_count u:object_r:tombstone_config_prop:s0 exact int
vold.post_fs_data_done u:object_r:vold_config_prop:s0 exact int
diff --git a/private/tombstoned.te b/private/tombstoned.te
index 305f9d0..ca9a0aa 100644
--- a/private/tombstoned.te
+++ b/private/tombstoned.te
@@ -1,3 +1,12 @@
typeattribute tombstoned coredomain;
init_daemon_domain(tombstoned)
+
+get_prop(tombstoned, tombstone_config_prop)
+
+neverallow {
+ -init
+ -vendor_init
+ -dumpstate
+ -tombstoned
+} tombstone_config_prop:file no_rw_file_perms;
diff --git a/public/netd.te b/public/netd.te
index a020a57..ceb1a27 100644
--- a/public/netd.te
+++ b/public/netd.te
@@ -36,8 +36,10 @@
not_full_treble(`allow netd vendor_file:file x_file_perms;')
allow netd devpts:chr_file rw_file_perms;
-# Acquire advisory lock on /system/etc/xtables.lock
+# Acquire advisory lock on /system/etc/xtables.lock. If this file doesn't
+# exist, suppress the denial.
allow netd system_file:file lock;
+dontaudit netd system_file:dir write;
# Allow netd to write to qtaguid ctrl file.
# TODO: Add proper rules to prevent other process to access qtaguid_proc file
diff --git a/public/property.te b/public/property.te
index 4d002a6..71cd5b4 100644
--- a/public/property.te
+++ b/public/property.te
@@ -130,6 +130,7 @@
system_vendor_config_prop(surfaceflinger_prop)
system_vendor_config_prop(systemsound_config_prop)
system_vendor_config_prop(telephony_config_prop)
+system_vendor_config_prop(tombstone_config_prop)
system_vendor_config_prop(usb_config_prop)
system_vendor_config_prop(userspace_reboot_config_prop)
system_vendor_config_prop(vehicle_hal_prop)