Fix attribute plurals for isolated_compute_allowed am: 27a8f43fde am: 82c81a216a
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/2552770
Change-Id: I4352aa3bec7b6e48b61caa751a15d7ead1a98210
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
diff --git a/prebuilts/api/33.0/private/app.te b/prebuilts/api/33.0/private/app.te
index 86180b0..9a2e02a 100644
--- a/prebuilts/api/33.0/private/app.te
+++ b/prebuilts/api/33.0/private/app.te
@@ -54,6 +54,9 @@
userdebug_or_eng(`perfetto_producer({ appdomain })')
+# Allow the heap dump ART plugin to the count of sessions waiting for OOME
+get_prop(appdomain, traced_oome_heap_session_count_prop)
+
# Prevent apps from causing presubmit failures.
# Apps can cause selinux denials by accessing CE storage
# and/or external storage. In either case, the selinux denial is
diff --git a/prebuilts/api/33.0/private/compat/32.0/32.0.ignore.cil b/prebuilts/api/33.0/private/compat/32.0/32.0.ignore.cil
index 7294656..d2d247b 100644
--- a/prebuilts/api/33.0/private/compat/32.0/32.0.ignore.cil
+++ b/prebuilts/api/33.0/private/compat/32.0/32.0.ignore.cil
@@ -75,6 +75,7 @@
sysfs_lru_gen_enabled
system_dlkm_file
tare_service
+ traced_oome_heap_session_count_prop
tv_iapp_service
untrusted_app_30
vendor_uuid_mapping_config_file
diff --git a/prebuilts/api/33.0/private/platform_app.te b/prebuilts/api/33.0/private/platform_app.te
index b40f6b9..91149f4 100644
--- a/prebuilts/api/33.0/private/platform_app.te
+++ b/prebuilts/api/33.0/private/platform_app.te
@@ -119,6 +119,10 @@
# Allow platform apps to act as Perfetto producers.
perfetto_producer(platform_app)
+# Allow performance profiling if the app opts in.
+can_profile_heap(platform_app)
+can_profile_perf(platform_app)
+
# Allow platform apps to create VMs
virtualizationservice_use(platform_app)
diff --git a/prebuilts/api/33.0/private/property_contexts b/prebuilts/api/33.0/private/property_contexts
index 8f193fb..c653445 100644
--- a/prebuilts/api/33.0/private/property_contexts
+++ b/prebuilts/api/33.0/private/property_contexts
@@ -218,6 +218,9 @@
# heapprofd properties
heapprofd. u:object_r:heapprofd_prop:s0
+# traced properties
+traced.oome_heap_session.count u:object_r:traced_oome_heap_session_count_prop:s0 exact uint
+
# hwservicemanager properties
hwservicemanager. u:object_r:hwservicemanager_prop:s0
diff --git a/prebuilts/api/33.0/private/system_app.te b/prebuilts/api/33.0/private/system_app.te
index 76e5f7d..d82cff7 100644
--- a/prebuilts/api/33.0/private/system_app.te
+++ b/prebuilts/api/33.0/private/system_app.te
@@ -177,6 +177,10 @@
# Allow system apps to act as Perfetto producers.
perfetto_producer(system_app)
+# Allow performance profiling by the platform itself.
+can_profile_heap(system_app)
+can_profile_perf(system_app)
+
###
### Neverallow rules
###
diff --git a/prebuilts/api/33.0/private/system_server.te b/prebuilts/api/33.0/private/system_server.te
index 6d3bc78..5e826bf 100644
--- a/prebuilts/api/33.0/private/system_server.te
+++ b/prebuilts/api/33.0/private/system_server.te
@@ -418,7 +418,14 @@
allow system_server mediadrmserver:tcp_socket rw_socket_perms;
allow system_server mediadrmserver:udp_socket rw_socket_perms;
-userdebug_or_eng(`perfetto_producer({ system_server })')
+# Allow writing performance tracing data to the Perfetto traced daemon. This
+# requires connecting to its producer socket and obtaining a (per-process)
+# tmpfs fd.
+perfetto_producer(system_server)
+
+# Allow performance profiling by the platform itself.
+can_profile_heap(system_server)
+can_profile_perf(system_server)
# Get file context
allow system_server file_contexts_file:file r_file_perms;
@@ -695,6 +702,7 @@
# Property Service write
set_prop(system_server, system_prop)
set_prop(system_server, bootanim_system_prop)
+set_prop(system_server, bluetooth_prop)
set_prop(system_server, exported_system_prop)
set_prop(system_server, exported3_system_prop)
set_prop(system_server, safemode_prop)
@@ -822,6 +830,9 @@
# Read persist.wm.debug. properties
get_prop(system_server, persist_wm_debug_prop)
+# Allow the heap dump ART plugin to the count of sessions waiting for OOME
+get_prop(system_server, traced_oome_heap_session_count_prop)
+
# Create a socket for connections from debuggerd.
allow system_server system_ndebug_socket:sock_file create_file_perms;
diff --git a/prebuilts/api/33.0/private/traced.te b/prebuilts/api/33.0/private/traced.te
index a6e200e..0a4afed 100644
--- a/prebuilts/api/33.0/private/traced.te
+++ b/prebuilts/api/33.0/private/traced.te
@@ -68,6 +68,11 @@
set_prop(traced, system_trace_prop)
# Allow to lazily start producers.
set_prop(traced, traced_lazy_prop)
+# Allow tracking the count of sessions intercepting Java OutOfMemoryError
+# If there are such tracing sessions and an OutOfMemoryError is thrown by ART,
+# the hprof plugin intercepts the error, lazily registers a data source to
+# traced and collects a heap dump.
+set_prop(traced, traced_oome_heap_session_count_prop)
# Allow traced to talk to statsd for logging metrics.
unix_socket_send(traced, statsdw, statsd)
diff --git a/prebuilts/api/33.0/public/ioctl_defines b/prebuilts/api/33.0/public/ioctl_defines
index 0e22670..a3afba7 100644
--- a/prebuilts/api/33.0/public/ioctl_defines
+++ b/prebuilts/api/33.0/public/ioctl_defines
@@ -822,6 +822,7 @@
define(`FS_IOC_FIEMAP', `0xc020660b')
define(`FS_IOC_FSGETXATTR', `0x801c581f')
define(`FS_IOC_FSSETXATTR', `0x401c5820')
+define(`FS_IOC_GET_ENCRYPTION_KEY_STATUS', `0xc080661a')
define(`FS_IOC_GET_ENCRYPTION_POLICY', `0x400c6615')
define(`FS_IOC_GET_ENCRYPTION_POLICY_EX', `0xc0096616')
define(`FS_IOC_GET_ENCRYPTION_PWSALT', `0x40106614')
diff --git a/prebuilts/api/33.0/public/property.te b/prebuilts/api/33.0/public/property.te
index 763a80a..b8e111b 100644
--- a/prebuilts/api/33.0/public/property.te
+++ b/prebuilts/api/33.0/public/property.te
@@ -90,6 +90,7 @@
system_restricted_prop(surfaceflinger_display_prop)
system_restricted_prop(system_boot_reason_prop)
system_restricted_prop(system_jvmti_agent_prop)
+system_restricted_prop(traced_oome_heap_session_count_prop)
system_restricted_prop(ab_update_gki_prop)
system_restricted_prop(usb_prop)
system_restricted_prop(userspace_reboot_exported_prop)
diff --git a/prebuilts/api/33.0/public/vold.te b/prebuilts/api/33.0/public/vold.te
index b0fb6d0..53b2c49 100644
--- a/prebuilts/api/33.0/public/vold.te
+++ b/prebuilts/api/33.0/public/vold.te
@@ -51,6 +51,7 @@
FS_IOC_SET_ENCRYPTION_POLICY
FS_IOC_ADD_ENCRYPTION_KEY
FS_IOC_REMOVE_ENCRYPTION_KEY
+ FS_IOC_GET_ENCRYPTION_KEY_STATUS
};
# Only vold and init should ever set file-based encryption policies.
@@ -65,7 +66,7 @@
neverallowxperm {
domain
-vold
-} data_file_type:dir ioctl { FS_IOC_ADD_ENCRYPTION_KEY FS_IOC_REMOVE_ENCRYPTION_KEY };
+} data_file_type:dir ioctl { FS_IOC_ADD_ENCRYPTION_KEY FS_IOC_REMOVE_ENCRYPTION_KEY FS_IOC_GET_ENCRYPTION_KEY_STATUS };
# Allow securely erasing crypto key files. F2FS_IOC_SEC_TRIM_FILE is
# tried first. Otherwise, FS_IOC_FIEMAP is needed to get the