Merge "sepolicy change for NetworkStack signature"
diff --git a/private/bug_map b/private/bug_map
index 60a7337..ae7b695 100644
--- a/private/bug_map
+++ b/private/bug_map
@@ -1,4 +1,5 @@
cppreopts cppreopts capability 79414024
+crash_dump gpu_device chr_file 124468495
dnsmasq netd fifo_file 77868789
dnsmasq netd unix_stream_socket 77868789
init app_data_file file 77873135
@@ -27,6 +28,7 @@
system_server sdcardfs file 77856826
system_server storage_stub_file dir 112609936
system_server zygote process 77856826
+untrusted_app_27 mnt_user_file dir 118185801
usbd usbd capability 72472544
vrcore_app mnt_user_file dir 118185801
webview_zygote system_data_file lnk_file 123246126
diff --git a/private/file_contexts b/private/file_contexts
index 233d5f4..97352a5 100644
--- a/private/file_contexts
+++ b/private/file_contexts
@@ -489,6 +489,7 @@
/data/misc/stats-service(/.*)? u:object_r:stats_data_file:s0
/data/misc/systemkeys(/.*)? u:object_r:systemkeys_data_file:s0
/data/misc/textclassifier(/.*)? u:object_r:textclassifier_data_file:s0
+/data/misc/train-info(/.*)? u:object_r:stats_data_file:s0
/data/misc/user(/.*)? u:object_r:misc_user_data_file:s0
/data/misc/vpn(/.*)? u:object_r:vpn_data_file:s0
/data/misc/wifi(/.*)? u:object_r:wifi_data_file:s0
diff --git a/private/platform_app.te b/private/platform_app.te
index da3303b..bbba1d9 100644
--- a/private/platform_app.te
+++ b/private/platform_app.te
@@ -68,10 +68,14 @@
allow platform_app system_api_service:service_manager find;
allow platform_app vr_manager_service:service_manager find;
allow platform_app gpu_service:service_manager find;
+allow platform_app stats_service:service_manager find;
# Allow platform apps to interact with gpuservice
binder_call(platform_app, gpuservice)
+# Allow platform apps to log via statsd.
+allow platform_app statsd:binder call;
+
# Access to /data/preloads
allow platform_app preloads_data_file:file r_file_perms;
allow platform_app preloads_data_file:dir r_dir_perms;
diff --git a/private/stats.te b/private/stats.te
index 2c7199d..81ec1cf 100644
--- a/private/stats.te
+++ b/private/stats.te
@@ -41,6 +41,7 @@
domain
-dumpstate
-incidentd
+ -platform_app
-priv_app
-shell
-stats
diff --git a/private/zygote.te b/private/zygote.te
index c8bd87e..29d61b4 100644
--- a/private/zygote.te
+++ b/private/zygote.te
@@ -96,11 +96,13 @@
allow zygote mnt_user_file:file create_file_perms;
# Allowed to mount user-specific storage into place
allow zygote storage_file:dir { search mounton };
-# Allow mounting on sdcardfs dirs
+
+# Allow mounting and creating files, dirs on sdcardfs.
# TODO: reduce this back to only sdcardfs once b/123533205 is root-caused
# (Technically "sdcardfs" and "media_rw_data_file" are equivalent, since
# sdcardfs simply wraps files stored under /data/media.)
-allow zygote { sdcardfs media_rw_data_file vfat }:dir { create_dir_perms mounton };
+allow zygote { sdcard_type media_rw_data_file }:dir { create_dir_perms mounton };
+allow zygote { sdcard_type media_rw_data_file }:file { create_file_perms };
# Handle --invoke-with command when launching Zygote with a wrapper command.
allow zygote zygote_exec:file rx_file_perms;
diff --git a/public/domain.te b/public/domain.te
index e8baabc..2621d81 100644
--- a/public/domain.te
+++ b/public/domain.te
@@ -355,6 +355,7 @@
-healthd
-uncrypt
-tee
+ -hal_bootctl
} self:global_capability_class_set sys_rawio;
# No process can map low memory (< CONFIG_LSM_MMAP_MIN_ADDR).
@@ -607,6 +608,8 @@
neverallow {
domain
-fastbootd
+ userdebug_or_eng(`-fsck')
+ userdebug_or_eng(`-init')
-recovery
-update_engine
} system_block_device:blk_file { write append };
diff --git a/public/flags_heatlh_check.te b/public/flags_health_check.te
similarity index 100%
rename from public/flags_heatlh_check.te
rename to public/flags_health_check.te
diff --git a/public/fsck.te b/public/fsck.te
index dbbe34c..7a9fbee 100644
--- a/public/fsck.te
+++ b/public/fsck.te
@@ -18,6 +18,9 @@
allow fsck userdata_block_device:blk_file rw_file_perms;
allow fsck cache_block_device:blk_file rw_file_perms;
allow fsck dm_device:blk_file rw_file_perms;
+userdebug_or_eng(`
+allow fsck system_block_device:blk_file rw_file_perms;
+')
# For the block devices where we have ioctl access,
# allow at a minimum the following common fsck ioctls.
@@ -55,6 +58,7 @@
root_block_device
swap_block_device
system_block_device
+ userdebug_or_eng(`-system_block_device')
vold_device
}:blk_file no_rw_file_perms;
diff --git a/public/hal_bootctl.te b/public/hal_bootctl.te
index 2491734..be9975f 100644
--- a/public/hal_bootctl.te
+++ b/public/hal_bootctl.te
@@ -3,5 +3,3 @@
binder_call(hal_bootctl_server, hal_bootctl_client)
hal_attribute_hwservice(hal_bootctl, hal_bootctl_hwservice)
-
-dontaudit hal_bootctl self:global_capability_class_set sys_rawio;
diff --git a/public/init.te b/public/init.te
index 02302b2..7f5b3fc 100644
--- a/public/init.te
+++ b/public/init.te
@@ -317,6 +317,8 @@
userdebug_or_eng(`
# Overlayfs workdir write access check during mount to permit remount,rw
allow init overlayfs_file:dir { relabelfrom mounton write };
+ allow init overlayfs_file:file { append };
+ allow init system_block_device:blk_file { write };
')
allow init {
diff --git a/public/property_contexts b/public/property_contexts
index b636b34..836b2a4 100644
--- a/public/property_contexts
+++ b/public/property_contexts
@@ -80,6 +80,7 @@
persist.sys.dalvik.vm.lib.2 u:object_r:exported2_system_prop:s0 exact string
persist.sys.media.avsync u:object_r:exported2_system_prop:s0 exact bool
persist.sys.hdmi.keep_awake u:object_r:exported2_system_prop:s0 exact bool
+persist.sys.sf.color_mode u:object_r:exported2_system_prop:s0 exact int
persist.sys.sf.color_saturation u:object_r:exported2_system_prop:s0 exact string
persist.sys.sf.native_mode u:object_r:exported2_system_prop:s0 exact int
pm.dexopt.ab-ota u:object_r:exported_pm_prop:s0 exact string
diff --git a/public/radio.te b/public/radio.te
index dcafd93..4527707 100644
--- a/public/radio.te
+++ b/public/radio.te
@@ -39,3 +39,6 @@
# Perform HwBinder IPC.
hwbinder_use(radio)
hal_client_domain(radio, hal_telephony)
+
+# Used by TelephonyManager
+allow radio proc_cmdline:file r_file_perms;
diff --git a/public/update_engine_common.te b/public/update_engine_common.te
index 078a41b..b55f4bc 100644
--- a/public/update_engine_common.te
+++ b/public/update_engine_common.te
@@ -73,3 +73,6 @@
# get physical block device to map logical partitions on device mapper
allow update_engine_common block_device:dir r_dir_perms;
+
+# Allow update_engine_common to write to statsd socket.
+unix_socket_send(update_engine_common, statsdw, statsd)
diff --git a/public/vold.te b/public/vold.te
index 801c2de..d201257 100644
--- a/public/vold.te
+++ b/public/vold.te
@@ -248,7 +248,7 @@
domain
-vold
-vold_prepare_subdirs
-} vold_data_file:dir ~{ open create read getattr setattr search relabelto ioctl };
+} vold_data_file:dir ~{ open create read getattr setattr search relabelfrom relabelto ioctl };
neverallow {
domain