Merge "Allow permissions needed for gdb debugging"
diff --git a/private/compat/28.0/28.0.ignore.cil b/private/compat/28.0/28.0.ignore.cil
index bc49c99..42f18a0 100644
--- a/private/compat/28.0/28.0.ignore.cil
+++ b/private/compat/28.0/28.0.ignore.cil
@@ -34,6 +34,7 @@
device_config_reset_performed_prop
device_config_runtime_native_prop
device_config_service
+ dynamic_android_service
face_service
face_vendor_data_file
fastbootd
diff --git a/private/coredomain.te b/private/coredomain.te
index db62cb9..9899d02 100644
--- a/private/coredomain.te
+++ b/private/coredomain.te
@@ -90,6 +90,7 @@
# /proc
neverallow {
coredomain
+ -init
-vold
} proc:file no_rw_file_perms;
diff --git a/private/file_contexts b/private/file_contexts
index eb45401..d206f2d 100644
--- a/private/file_contexts
+++ b/private/file_contexts
@@ -40,6 +40,10 @@
/etc u:object_r:rootfs:s0
/sdcard u:object_r:rootfs:s0
+/bionic(/.*)? u:object_r:system_file:s0
+/bionic/lib(64)?(/.*)? u:object_r:system_lib_file:s0
+/bionic/bin/linker(64)? u:object_r:system_linker_exec:s0
+
# SELinux policy files
/vendor_file_contexts u:object_r:file_contexts_file:s0
/nonplat_file_contexts u:object_r:file_contexts_file:s0
@@ -251,6 +255,7 @@
/system/bin/healthd u:object_r:healthd_exec:s0
/system/bin/clatd u:object_r:clatd_exec:s0
/system/bin/linker(64)? u:object_r:system_linker_exec:s0
+/system/bin/bootstrap/linker(64)? u:object_r:system_linker_exec:s0
/system/bin/llkd u:object_r:llkd_exec:s0
/system/bin/lmkd u:object_r:lmkd_exec:s0
/system/bin/usbd u:object_r:usbd_exec:s0
diff --git a/private/platform_app.te b/private/platform_app.te
index 1ee65d3..7e190c9 100644
--- a/private/platform_app.te
+++ b/private/platform_app.te
@@ -84,6 +84,9 @@
# allow platform apps to connect to the property service
set_prop(platform_app, test_boot_reason_prop)
+# allow platform apps to create symbolic link
+allow platform_app app_data_file:lnk_file create_file_perms;
+
###
### Neverallow rules
###
diff --git a/private/service.te b/private/service.te
index 84e524d..89664e4 100644
--- a/private/service.te
+++ b/private/service.te
@@ -1,3 +1,4 @@
+type dynamic_android_service, system_api_service, system_server_service, service_manager_type;
type gsi_service, service_manager_type;
type incidentcompanion_service, system_api_service, system_server_service, service_manager_type;
type stats_service, service_manager_type;
diff --git a/private/service_contexts b/private/service_contexts
index 82abfbc..965304c 100644
--- a/private/service_contexts
+++ b/private/service_contexts
@@ -57,6 +57,7 @@
drm.drmManager u:object_r:drmserver_service:s0
dropbox u:object_r:dropbox_service:s0
dumpstate u:object_r:dumpstate_service:s0
+dynamic_android u:object_r:dynamic_android_service:s0
econtroller u:object_r:radio_service:s0
euicc_card_controller u:object_r:radio_service:s0
external_vibrator_service u:object_r:external_vibrator_service:s0
diff --git a/private/system_server.te b/private/system_server.te
index f91461c..2a79460 100644
--- a/private/system_server.te
+++ b/private/system_server.te
@@ -682,9 +682,10 @@
allow system_server drmserver_service:service_manager find;
allow system_server dumpstate_service:service_manager find;
allow system_server fingerprintd_service:service_manager find;
-allow system_server hal_fingerprint_service:service_manager find;
allow system_server gatekeeper_service:service_manager find;
allow system_server gpu_service:service_manager find;
+allow system_server gsi_service:service_manager find;
+allow system_server hal_fingerprint_service:service_manager find;
allow system_server idmap_service:service_manager find;
allow system_server incident_service:service_manager find;
allow system_server installd_service:service_manager find;
diff --git a/public/domain.te b/public/domain.te
index 1816c81..03e745c 100644
--- a/public/domain.te
+++ b/public/domain.te
@@ -125,6 +125,9 @@
allow domain system_linker_exec:file { execute read open getattr map };
allow domain system_linker_config_file:file r_file_perms;
allow domain system_lib_file:file { execute read open getattr map };
+# To allow following symlinks at /system/bin/linker, /system/lib/libc.so, etc.
+allow domain system_linker_exec:lnk_file { read open getattr };
+allow domain system_lib_file:lnk_file { read open getattr };
allow domain system_event_log_tags_file:file r_file_perms;
@@ -1253,6 +1256,7 @@
-dumpstate
-init
-installd
+ -simpleperf_app_runner
-system_server # why?
userdebug_or_eng(`-uncrypt')
} shell_data_file:dir { open search };
diff --git a/public/init.te b/public/init.te
index 63edb20..a089c8c 100644
--- a/public/init.te
+++ b/public/init.te
@@ -70,6 +70,9 @@
# Call mount(2).
allow init self:global_capability_class_set sys_admin;
+# Call setns(2).
+allow init self:global_capability_class_set sys_chroot;
+
# Create and mount on directories in /.
allow init rootfs:dir create_dir_perms;
allow init { rootfs cache_file cgroup storage_file system_data_file system_file vendor_file postinstall_mnt_dir }:dir mounton;
@@ -84,8 +87,14 @@
# Mount tmpfs on /apex
allow init apex_mnt_dir:dir mounton;
+# Mount Bionic libraries and dynamic linkers
allow init system_lib_file:file mounton;
allow init system_linker_exec:file mounton;
+# The mount points under /bionic are rootfs in recovery mode. Init should
+# be able to bind-mount the bootstrap Bionic to the mount points.
+recovery_only(`
+ allow init rootfs:file mounton;
+')
# Create and remove symlinks in /.
allow init rootfs:lnk_file { create unlink };
@@ -304,6 +313,7 @@
')
allow init {
+ proc # b/67049235 processes /proc/<pid>/* files are mislabeled.
proc_cmdline
proc_diskstats
proc_kmsg # Open /proc/kmsg for logd service.
diff --git a/public/simpleperf_app_runner.te b/public/simpleperf_app_runner.te
index cabf04b..9f8e6e4 100644
--- a/public/simpleperf_app_runner.te
+++ b/public/simpleperf_app_runner.te
@@ -25,6 +25,14 @@
# determine which domain to transition to.
allow simpleperf_app_runner seapp_contexts_file:file r_file_perms;
+# simpleperf_app_runner passes pipe fds.
+allow simpleperf_app_runner shell:fifo_file read;
+
+# simpleperf_app_runner checks shell data paths.
+# simpleperf_app_runner passes shell data fds.
+allow simpleperf_app_runner shell_data_file:dir { getattr search };
+allow simpleperf_app_runner shell_data_file:file { getattr write };
+
###
### neverallow rules
###