Merge "Allow surfaceflinger to read and write app Unix sockets" into main
diff --git a/apex/com.android.art-file_contexts b/apex/com.android.art-file_contexts
index 14b68ad..ed12f10 100644
--- a/apex/com.android.art-file_contexts
+++ b/apex/com.android.art-file_contexts
@@ -10,5 +10,4 @@
/bin/dexoptanalyzer u:object_r:dexoptanalyzer_exec:s0
/bin/odrefresh u:object_r:odrefresh_exec:s0
/bin/profman u:object_r:profman_exec:s0
-/bin/oatdump u:object_r:oatdump_exec:s0
/lib(64)?(/.*)? u:object_r:system_lib_file:s0
diff --git a/build/soong/compat_cil.go b/build/soong/compat_cil.go
index 3b9d5e2..fef2e69 100644
--- a/build/soong/compat_cil.go
+++ b/build/soong/compat_cil.go
@@ -136,46 +136,6 @@
compatTestTimestamp android.ModuleOutPath
}
-func (f *compatTestModule) createPlatPubVersionedModule(ctx android.LoadHookContext, ver string) {
- confName := fmt.Sprintf("pub_policy_%s.conf", ver)
- cilName := fmt.Sprintf("pub_policy_%s.cil", ver)
- platPubVersionedName := fmt.Sprintf("plat_pub_versioned_%s.cil", ver)
-
- ctx.CreateModule(policyConfFactory, &nameProperties{
- Name: proptools.StringPtr(confName),
- }, &policyConfProperties{
- Srcs: []string{
- fmt.Sprintf(":se_build_files{.plat_public_%s}", ver),
- fmt.Sprintf(":se_build_files{.system_ext_public_%s}", ver),
- fmt.Sprintf(":se_build_files{.product_public_%s}", ver),
- ":se_build_files{.reqd_mask}",
- },
- Installable: proptools.BoolPtr(false),
- }, &struct {
- Defaults []string
- }{
- Defaults: f.properties.Defaults,
- })
-
- ctx.CreateModule(policyCilFactory, &nameProperties{
- Name: proptools.StringPtr(cilName),
- }, &policyCilProperties{
- Src: proptools.StringPtr(":" + confName),
- Filter_out: []string{":reqd_policy_mask.cil"},
- Secilc_check: proptools.BoolPtr(false),
- Installable: proptools.BoolPtr(false),
- })
-
- ctx.CreateModule(versionedPolicyFactory, &nameProperties{
- Name: proptools.StringPtr(platPubVersionedName),
- }, &versionedPolicyProperties{
- Base: proptools.StringPtr(":" + cilName),
- Target_policy: proptools.StringPtr(":" + cilName),
- Version: proptools.StringPtr(ver),
- Installable: proptools.BoolPtr(false),
- })
-}
-
func (f *compatTestModule) createCompatTestModule(ctx android.LoadHookContext, ver string) {
srcs := []string{
":plat_sepolicy.cil",
@@ -195,7 +155,7 @@
":odm_sepolicy.cil",
)
} else {
- srcs = append(srcs, fmt.Sprintf(":plat_pub_versioned_%s.cil", ver))
+ srcs = append(srcs, fmt.Sprintf(":%s_plat_pub_versioned.cil", ver))
}
compatTestName := fmt.Sprintf("%s_compat_test", ver)
@@ -210,7 +170,6 @@
func (f *compatTestModule) loadHook(ctx android.LoadHookContext) {
for _, ver := range ctx.DeviceConfig().PlatformSepolicyCompatVersions() {
- f.createPlatPubVersionedModule(ctx, ver)
f.createCompatTestModule(ctx, ver)
}
}
diff --git a/build/soong/policy.go b/build/soong/policy.go
index 7b2122c..4476f94 100644
--- a/build/soong/policy.go
+++ b/build/soong/policy.go
@@ -33,6 +33,7 @@
// This order should be kept. checkpolicy syntax requires it.
var policyConfOrder = []string{
+ "flagging_macros",
"security_classes",
"initial_sids",
"access_vectors",
@@ -90,8 +91,9 @@
// Desired number of MLS categories. Defaults to 1024
Mls_cats *int64
- // Whether to turn on board_api_level guard or not. Defaults to false
- Board_api_level_guard *bool
+ // Board api level of policy files. Set "vendor" for RELEASE_BOARD_API_LEVEL, "system" for
+ // turning off the guard, or a direct version string (e.g. "202404"). Defaults to "system"
+ Board_api_level *string
}
type policyConf struct {
@@ -223,11 +225,17 @@
}
func (c *policyConf) boardApiLevel(ctx android.ModuleContext) string {
- if proptools.Bool(c.properties.Board_api_level_guard) {
+ level := proptools.StringDefault(c.properties.Board_api_level, "system")
+
+ if level == "system" {
+ // aribtrary value greater than any other vendor API levels
+ return "1000000"
+ } else if level == "vendor" {
return ctx.Config().VendorApiLevel()
+ } else {
+ return level
}
- // aribtrary value greater than any other vendor API levels
- return "1000000"
+
}
func findPolicyConfOrder(name string) int {
diff --git a/flagging/Android.bp b/flagging/Android.bp
index 26e8989..ce20323 100644
--- a/flagging/Android.bp
+++ b/flagging/Android.bp
@@ -43,7 +43,7 @@
name: "se_policy_conf_public_flags_defaults",
srcs: [":sepolicy_flagging_macros"],
build_flags: ["all_selinux_flags"],
- board_api_level_guard: true,
+ board_api_level: "vendor",
}
contexts_defaults {
@@ -55,5 +55,5 @@
filegroup {
name: "sepolicy_flagging_macros",
- srcs: ["te_macros"],
+ srcs: ["flagging_macros"],
}
diff --git a/flagging/te_macros b/flagging/flagging_macros
similarity index 100%
rename from flagging/te_macros
rename to flagging/flagging_macros
diff --git a/microdroid/Android.bp b/microdroid/Android.bp
index dce4898..e9b4b1e 100644
--- a/microdroid/Android.bp
+++ b/microdroid/Android.bp
@@ -107,6 +107,7 @@
se_policy_conf {
name: "microdroid_reqd_policy_mask.conf",
+ defaults: ["se_policy_conf_flags_defaults"],
srcs: reqd_mask_files,
installable: false,
mls_cats: 1,
@@ -121,6 +122,7 @@
se_policy_conf {
name: "microdroid_plat_sepolicy.conf",
+ defaults: ["se_policy_conf_flags_defaults"],
srcs: system_policy_files,
installable: false,
mls_cats: 1,
@@ -135,6 +137,7 @@
se_policy_conf {
name: "microdroid_plat_pub_policy.conf",
+ defaults: ["se_policy_conf_flags_defaults"],
srcs: system_public_policy_files,
installable: false,
mls_cats: 1,
@@ -172,6 +175,7 @@
se_policy_conf {
name: "microdroid_vendor_sepolicy.conf",
+ defaults: ["se_policy_conf_flags_defaults"],
srcs: vendor_policy_files,
installable: false,
mls_cats: 1,
diff --git a/prebuilts/api/202404/Android.bp b/prebuilts/api/202404/Android.bp
index c0fb5a2..bca377e 100644
--- a/prebuilts/api/202404/Android.bp
+++ b/prebuilts/api/202404/Android.bp
@@ -1,4 +1,33 @@
-// Automatically generated file, do not edit!
+// Copyright (C) 2024 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+se_policy_conf {
+ name: "202404_reqd_policy_mask.conf",
+ defaults: ["se_policy_conf_flags_defaults"],
+ srcs: reqd_mask_policy,
+ installable: false,
+ build_variant: "user",
+ board_api_level: "202404",
+}
+
+se_policy_cil {
+ name: "202404_reqd_policy_mask.cil",
+ src: ":202404_reqd_policy_mask.conf",
+ secilc_check: false,
+ installable: false,
+}
+
se_policy_conf {
name: "202404_plat_pub_policy.conf",
defaults: ["se_policy_conf_flags_defaults"],
@@ -8,12 +37,13 @@
],
installable: false,
build_variant: "user",
+ board_api_level: "202404",
}
se_policy_cil {
name: "202404_plat_pub_policy.cil",
src: ":202404_plat_pub_policy.conf",
- filter_out: [":reqd_policy_mask.cil"],
+ filter_out: [":202404_reqd_policy_mask.cil"],
secilc_check: false,
installable: false,
}
@@ -29,16 +59,25 @@
],
installable: false,
build_variant: "user",
+ board_api_level: "202404",
}
se_policy_cil {
name: "202404_product_pub_policy.cil",
src: ":202404_product_pub_policy.conf",
- filter_out: [":reqd_policy_mask.cil"],
+ filter_out: [":202404_reqd_policy_mask.cil"],
secilc_check: false,
installable: false,
}
+se_versioned_policy {
+ name: "202404_plat_pub_versioned.cil",
+ base: ":202404_product_pub_policy.cil",
+ target_policy: ":202404_product_pub_policy.cil",
+ version: "202404",
+ installable: false,
+}
+
se_policy_conf {
name: "202404_plat_policy.conf",
defaults: ["se_policy_conf_flags_defaults"],
@@ -52,6 +91,7 @@
],
installable: false,
build_variant: "user",
+ board_api_level: "202404",
}
se_policy_cil {
diff --git a/prebuilts/api/29.0/Android.bp b/prebuilts/api/29.0/Android.bp
index 8acca29..e835288 100644
--- a/prebuilts/api/29.0/Android.bp
+++ b/prebuilts/api/29.0/Android.bp
@@ -13,25 +13,44 @@
// limitations under the License.
se_policy_conf {
+ name: "29.0_reqd_policy_mask.conf",
+ defaults: ["se_policy_conf_flags_defaults"],
+ srcs: reqd_mask_policy,
+ installable: false,
+ build_variant: "user",
+ board_api_level: "29",
+}
+
+se_policy_cil {
+ name: "29.0_reqd_policy_mask.cil",
+ src: ":29.0_reqd_policy_mask.conf",
+ secilc_check: false,
+ installable: false,
+}
+
+se_policy_conf {
name: "29.0_plat_pub_policy.conf",
+ defaults: ["se_policy_conf_flags_defaults"],
srcs: [
":se_build_files{.plat_public_29.0}",
":se_build_files{.reqd_mask}",
],
installable: false,
build_variant: "user",
+ board_api_level: "29",
}
se_policy_cil {
name: "29.0_plat_pub_policy.cil",
src: ":29.0_plat_pub_policy.conf",
- filter_out: [":reqd_policy_mask.cil"],
+ filter_out: [":29.0_reqd_policy_mask.cil"],
secilc_check: false,
installable: false,
}
se_policy_conf {
name: "29.0_product_pub_policy.conf",
+ defaults: ["se_policy_conf_flags_defaults"],
srcs: [
":se_build_files{.plat_public_29.0}",
":se_build_files{.system_ext_public_29.0}",
@@ -40,18 +59,28 @@
],
installable: false,
build_variant: "user",
+ board_api_level: "29",
}
se_policy_cil {
name: "29.0_product_pub_policy.cil",
src: ":29.0_product_pub_policy.conf",
- filter_out: [":reqd_policy_mask.cil"],
+ filter_out: [":29.0_reqd_policy_mask.cil"],
secilc_check: false,
installable: false,
}
+se_versioned_policy {
+ name: "29.0_plat_pub_versioned.cil",
+ base: ":29.0_product_pub_policy.cil",
+ target_policy: ":29.0_product_pub_policy.cil",
+ version: "29.0",
+ installable: false,
+}
+
se_policy_conf {
name: "29.0_plat_policy.conf",
+ defaults: ["se_policy_conf_flags_defaults"],
srcs: [
":se_build_files{.plat_public_29.0}",
":se_build_files{.plat_private_29.0}",
@@ -62,6 +91,7 @@
],
installable: false,
build_variant: "user",
+ board_api_level: "29",
}
se_policy_cil {
diff --git a/prebuilts/api/30.0/Android.bp b/prebuilts/api/30.0/Android.bp
index 6f3254d..df13756 100644
--- a/prebuilts/api/30.0/Android.bp
+++ b/prebuilts/api/30.0/Android.bp
@@ -13,25 +13,44 @@
// limitations under the License.
se_policy_conf {
+ name: "30.0_reqd_policy_mask.conf",
+ defaults: ["se_policy_conf_flags_defaults"],
+ srcs: reqd_mask_policy,
+ installable: false,
+ build_variant: "user",
+ board_api_level: "30",
+}
+
+se_policy_cil {
+ name: "30.0_reqd_policy_mask.cil",
+ src: ":30.0_reqd_policy_mask.conf",
+ secilc_check: false,
+ installable: false,
+}
+
+se_policy_conf {
name: "30.0_plat_pub_policy.conf",
+ defaults: ["se_policy_conf_flags_defaults"],
srcs: [
":se_build_files{.plat_public_30.0}",
":se_build_files{.reqd_mask}",
],
installable: false,
build_variant: "user",
+ board_api_level: "30",
}
se_policy_cil {
name: "30.0_plat_pub_policy.cil",
src: ":30.0_plat_pub_policy.conf",
- filter_out: [":reqd_policy_mask.cil"],
+ filter_out: [":30.0_reqd_policy_mask.cil"],
secilc_check: false,
installable: false,
}
se_policy_conf {
name: "30.0_product_pub_policy.conf",
+ defaults: ["se_policy_conf_flags_defaults"],
srcs: [
":se_build_files{.plat_public_30.0}",
":se_build_files{.system_ext_public_30.0}",
@@ -40,18 +59,28 @@
],
installable: false,
build_variant: "user",
+ board_api_level: "30",
}
se_policy_cil {
name: "30.0_product_pub_policy.cil",
src: ":30.0_product_pub_policy.conf",
- filter_out: [":reqd_policy_mask.cil"],
+ filter_out: [":30.0_reqd_policy_mask.cil"],
secilc_check: false,
installable: false,
}
+se_versioned_policy {
+ name: "30.0_plat_pub_versioned.cil",
+ base: ":30.0_product_pub_policy.cil",
+ target_policy: ":30.0_product_pub_policy.cil",
+ version: "30.0",
+ installable: false,
+}
+
se_policy_conf {
name: "30.0_plat_policy.conf",
+ defaults: ["se_policy_conf_flags_defaults"],
srcs: [
":se_build_files{.plat_public_30.0}",
":se_build_files{.plat_private_30.0}",
@@ -62,6 +91,7 @@
],
installable: false,
build_variant: "user",
+ board_api_level: "30",
}
se_policy_cil {
diff --git a/prebuilts/api/31.0/Android.bp b/prebuilts/api/31.0/Android.bp
index caf1c10..ba8d67c 100644
--- a/prebuilts/api/31.0/Android.bp
+++ b/prebuilts/api/31.0/Android.bp
@@ -13,25 +13,44 @@
// limitations under the License.
se_policy_conf {
+ name: "31.0_reqd_policy_mask.conf",
+ defaults: ["se_policy_conf_flags_defaults"],
+ srcs: reqd_mask_policy,
+ installable: false,
+ build_variant: "user",
+ board_api_level: "31",
+}
+
+se_policy_cil {
+ name: "31.0_reqd_policy_mask.cil",
+ src: ":31.0_reqd_policy_mask.conf",
+ secilc_check: false,
+ installable: false,
+}
+
+se_policy_conf {
name: "31.0_plat_pub_policy.conf",
+ defaults: ["se_policy_conf_flags_defaults"],
srcs: [
":se_build_files{.plat_public_31.0}",
":se_build_files{.reqd_mask}",
],
installable: false,
build_variant: "user",
+ board_api_level: "31",
}
se_policy_cil {
name: "31.0_plat_pub_policy.cil",
src: ":31.0_plat_pub_policy.conf",
- filter_out: [":reqd_policy_mask.cil"],
+ filter_out: [":31.0_reqd_policy_mask.cil"],
secilc_check: false,
installable: false,
}
se_policy_conf {
name: "31.0_product_pub_policy.conf",
+ defaults: ["se_policy_conf_flags_defaults"],
srcs: [
":se_build_files{.plat_public_31.0}",
":se_build_files{.system_ext_public_31.0}",
@@ -40,18 +59,28 @@
],
installable: false,
build_variant: "user",
+ board_api_level: "31",
}
se_policy_cil {
name: "31.0_product_pub_policy.cil",
src: ":31.0_product_pub_policy.conf",
- filter_out: [":reqd_policy_mask.cil"],
+ filter_out: [":31.0_reqd_policy_mask.cil"],
secilc_check: false,
installable: false,
}
+se_versioned_policy {
+ name: "31.0_plat_pub_versioned.cil",
+ base: ":31.0_product_pub_policy.cil",
+ target_policy: ":31.0_product_pub_policy.cil",
+ version: "31.0",
+ installable: false,
+}
+
se_policy_conf {
name: "31.0_plat_policy.conf",
+ defaults: ["se_policy_conf_flags_defaults"],
srcs: [
":se_build_files{.plat_public_31.0}",
":se_build_files{.plat_private_31.0}",
@@ -62,6 +91,7 @@
],
installable: false,
build_variant: "user",
+ board_api_level: "31",
}
se_policy_cil {
diff --git a/prebuilts/api/32.0/Android.bp b/prebuilts/api/32.0/Android.bp
index 9a2b4e2..053e094 100644
--- a/prebuilts/api/32.0/Android.bp
+++ b/prebuilts/api/32.0/Android.bp
@@ -13,25 +13,44 @@
// limitations under the License.
se_policy_conf {
+ name: "32.0_reqd_policy_mask.conf",
+ defaults: ["se_policy_conf_flags_defaults"],
+ srcs: reqd_mask_policy,
+ installable: false,
+ build_variant: "user",
+ board_api_level: "32",
+}
+
+se_policy_cil {
+ name: "32.0_reqd_policy_mask.cil",
+ src: ":32.0_reqd_policy_mask.conf",
+ secilc_check: false,
+ installable: false,
+}
+
+se_policy_conf {
name: "32.0_plat_pub_policy.conf",
+ defaults: ["se_policy_conf_flags_defaults"],
srcs: [
":se_build_files{.plat_public_32.0}",
":se_build_files{.reqd_mask}",
],
installable: false,
build_variant: "user",
+ board_api_level: "32",
}
se_policy_cil {
name: "32.0_plat_pub_policy.cil",
src: ":32.0_plat_pub_policy.conf",
- filter_out: [":reqd_policy_mask.cil"],
+ filter_out: [":32.0_reqd_policy_mask.cil"],
secilc_check: false,
installable: false,
}
se_policy_conf {
name: "32.0_product_pub_policy.conf",
+ defaults: ["se_policy_conf_flags_defaults"],
srcs: [
":se_build_files{.plat_public_32.0}",
":se_build_files{.system_ext_public_32.0}",
@@ -40,18 +59,28 @@
],
installable: false,
build_variant: "user",
+ board_api_level: "32",
}
se_policy_cil {
name: "32.0_product_pub_policy.cil",
src: ":32.0_product_pub_policy.conf",
- filter_out: [":reqd_policy_mask.cil"],
+ filter_out: [":32.0_reqd_policy_mask.cil"],
secilc_check: false,
installable: false,
}
+se_versioned_policy {
+ name: "32.0_plat_pub_versioned.cil",
+ base: ":32.0_product_pub_policy.cil",
+ target_policy: ":32.0_product_pub_policy.cil",
+ version: "32.0",
+ installable: false,
+}
+
se_policy_conf {
name: "32.0_plat_policy.conf",
+ defaults: ["se_policy_conf_flags_defaults"],
srcs: [
":se_build_files{.plat_public_32.0}",
":se_build_files{.plat_private_32.0}",
@@ -62,6 +91,7 @@
],
installable: false,
build_variant: "user",
+ board_api_level: "32",
}
se_policy_cil {
diff --git a/prebuilts/api/33.0/Android.bp b/prebuilts/api/33.0/Android.bp
index 0a01a44..0824e9c 100644
--- a/prebuilts/api/33.0/Android.bp
+++ b/prebuilts/api/33.0/Android.bp
@@ -13,25 +13,44 @@
// limitations under the License.
se_policy_conf {
+ name: "33.0_reqd_policy_mask.conf",
+ defaults: ["se_policy_conf_flags_defaults"],
+ srcs: reqd_mask_policy,
+ installable: false,
+ build_variant: "user",
+ board_api_level: "33",
+}
+
+se_policy_cil {
+ name: "33.0_reqd_policy_mask.cil",
+ src: ":33.0_reqd_policy_mask.conf",
+ secilc_check: false,
+ installable: false,
+}
+
+se_policy_conf {
name: "33.0_plat_pub_policy.conf",
+ defaults: ["se_policy_conf_flags_defaults"],
srcs: [
":se_build_files{.plat_public_33.0}",
":se_build_files{.reqd_mask}",
],
installable: false,
build_variant: "user",
+ board_api_level: "33",
}
se_policy_cil {
name: "33.0_plat_pub_policy.cil",
src: ":33.0_plat_pub_policy.conf",
- filter_out: [":reqd_policy_mask.cil"],
+ filter_out: [":33.0_reqd_policy_mask.cil"],
secilc_check: false,
installable: false,
}
se_policy_conf {
name: "33.0_product_pub_policy.conf",
+ defaults: ["se_policy_conf_flags_defaults"],
srcs: [
":se_build_files{.plat_public_33.0}",
":se_build_files{.system_ext_public_33.0}",
@@ -40,18 +59,28 @@
],
installable: false,
build_variant: "user",
+ board_api_level: "33",
}
se_policy_cil {
name: "33.0_product_pub_policy.cil",
src: ":33.0_product_pub_policy.conf",
- filter_out: [":reqd_policy_mask.cil"],
+ filter_out: [":33.0_reqd_policy_mask.cil"],
secilc_check: false,
installable: false,
}
+se_versioned_policy {
+ name: "33.0_plat_pub_versioned.cil",
+ base: ":33.0_product_pub_policy.cil",
+ target_policy: ":33.0_product_pub_policy.cil",
+ version: "33.0",
+ installable: false,
+}
+
se_policy_conf {
name: "33.0_plat_policy.conf",
+ defaults: ["se_policy_conf_flags_defaults"],
srcs: [
":se_build_files{.plat_public_33.0}",
":se_build_files{.plat_private_33.0}",
@@ -62,6 +91,7 @@
],
installable: false,
build_variant: "user",
+ board_api_level: "33",
}
se_policy_cil {
diff --git a/prebuilts/api/34.0/Android.bp b/prebuilts/api/34.0/Android.bp
index b3be5bb..efd3c25 100644
--- a/prebuilts/api/34.0/Android.bp
+++ b/prebuilts/api/34.0/Android.bp
@@ -13,25 +13,44 @@
// limitations under the License.
se_policy_conf {
+ name: "34.0_reqd_policy_mask.conf",
+ defaults: ["se_policy_conf_flags_defaults"],
+ srcs: reqd_mask_policy,
+ installable: false,
+ build_variant: "user",
+ board_api_level: "34",
+}
+
+se_policy_cil {
+ name: "34.0_reqd_policy_mask.cil",
+ src: ":34.0_reqd_policy_mask.conf",
+ secilc_check: false,
+ installable: false,
+}
+
+se_policy_conf {
name: "34.0_plat_pub_policy.conf",
+ defaults: ["se_policy_conf_flags_defaults"],
srcs: [
":se_build_files{.plat_public_34.0}",
":se_build_files{.reqd_mask}",
],
installable: false,
build_variant: "user",
+ board_api_level: "34",
}
se_policy_cil {
name: "34.0_plat_pub_policy.cil",
src: ":34.0_plat_pub_policy.conf",
- filter_out: [":reqd_policy_mask.cil"],
+ filter_out: [":34.0_reqd_policy_mask.cil"],
secilc_check: false,
installable: false,
}
se_policy_conf {
name: "34.0_product_pub_policy.conf",
+ defaults: ["se_policy_conf_flags_defaults"],
srcs: [
":se_build_files{.plat_public_34.0}",
":se_build_files{.system_ext_public_34.0}",
@@ -40,18 +59,28 @@
],
installable: false,
build_variant: "user",
+ board_api_level: "34",
}
se_policy_cil {
name: "34.0_product_pub_policy.cil",
src: ":34.0_product_pub_policy.conf",
- filter_out: [":reqd_policy_mask.cil"],
+ filter_out: [":34.0_reqd_policy_mask.cil"],
secilc_check: false,
installable: false,
}
+se_versioned_policy {
+ name: "34.0_plat_pub_versioned.cil",
+ base: ":34.0_product_pub_policy.cil",
+ target_policy: ":34.0_product_pub_policy.cil",
+ version: "34.0",
+ installable: false,
+}
+
se_policy_conf {
name: "34.0_plat_policy.conf",
+ defaults: ["se_policy_conf_flags_defaults"],
srcs: [
":se_build_files{.plat_public_34.0}",
":se_build_files{.plat_private_34.0}",
@@ -62,6 +91,7 @@
],
installable: false,
build_variant: "user",
+ board_api_level: "34",
}
se_policy_cil {
diff --git a/private/access_vectors b/private/access_vectors
index 7a280c5..9d82ac8 100644
--- a/private/access_vectors
+++ b/private/access_vectors
@@ -139,8 +139,8 @@
block_suspend
audit_read
perfmon
- checkpoint_restore
- bpf
+ starting_at_board_api(202504, `checkpoint_restore')
+ starting_at_board_api(202504, `bpf')
}
#
diff --git a/private/artd.te b/private/artd.te
index e6a6aaa..bc4a7a2 100644
--- a/private/artd.te
+++ b/private/artd.te
@@ -4,6 +4,9 @@
type artd_exec, system_file_type, exec_type, file_type;
type artd_tmpfs, file_type;
+# All types of artd subprocesses, which artd can kill.
+attribute artd_subprocess_type;
+
# Allow artd to publish a binder service and make binder calls.
binder_use(artd)
add_service(artd, artd_service)
@@ -131,7 +134,7 @@
domain_auto_trans(artd, dex2oat_exec, dex2oat)
# Allow sending sigkill to subprocesses.
-allow artd { profman dex2oat }:process sigkill;
+allow artd artd_subprocess_type:process sigkill;
# Allow reading process info (/proc/<pid>/...).
# This is needed for getting CPU time and wall time spent on subprocesses.
@@ -159,9 +162,6 @@
domain_auto_trans(artd, derive_classpath_exec, derive_classpath)
domain_auto_trans(artd, odrefresh_exec, odrefresh)
-# Allow sending sigkill to subprocesses.
-allow artd { derive_classpath odrefresh }:process sigkill;
-
# Allow accessing Pre-reboot Dexopt files.
allow artd pre_reboot_dexopt_file:dir { getattr search };
@@ -185,3 +185,15 @@
# Never allow running other binaries without a domain transition.
# The exception for art_exec_exec is explained above.
neverallow artd ~{art_exec_exec}:file execute_no_trans;
+
+# Make sure artd_subprocess_type is complete, in a sense that it includes all
+# types of artd subprocesses.
+neverallow artd ~{artd_subprocess_type crash_dump}:process transition;
+
+# artd uses process groups to manage subprocesses and kill them. To ensure
+# successful kill, we need to prevent subprocesses from changing their
+# process groups or transitioning to other domains.
+# Transitioning crash_dump is allowed because it is transient and is only used
+# upon crashes.
+neverallow artd_subprocess_type self:process setpgid;
+neverallow artd_subprocess_type ~{artd_subprocess_type crash_dump}:process transition;
diff --git a/private/compat/202404/202404.ignore.cil b/private/compat/202404/202404.ignore.cil
index efeeff7..6874821 100644
--- a/private/compat/202404/202404.ignore.cil
+++ b/private/compat/202404/202404.ignore.cil
@@ -13,4 +13,5 @@
binderfs_logs_transaction_history
proc_compaction_proactiveness
proc_cgroups
+ sysfs_udc
))
diff --git a/private/coredomain.te b/private/coredomain.te
index d89e9ca..93cbff5 100644
--- a/private/coredomain.te
+++ b/private/coredomain.te
@@ -55,7 +55,6 @@
-appdomain
-artd
-dex2oat
- -dexoptanalyzer
-idmap
-init
-installd
@@ -73,7 +72,6 @@
-appdomain
-artd
-dex2oat
- -dexoptanalyzer
-idmap
-init
-installd
@@ -96,7 +94,6 @@
-appdomain
-artd
-dex2oat
- -dexoptanalyzer
-idmap
-init
-installd
@@ -117,7 +114,6 @@
-appdomain
-artd
-dex2oat
- -dexoptanalyzer
-idmap
-init
-installd
diff --git a/private/derive_classpath.te b/private/derive_classpath.te
index 8dd6572..d7c29c2 100644
--- a/private/derive_classpath.te
+++ b/private/derive_classpath.te
@@ -1,6 +1,6 @@
# Domain for derive_classpath
-type derive_classpath, domain, coredomain;
+type derive_classpath, domain, coredomain, artd_subprocess_type;
type derive_classpath_exec, system_file_type, exec_type, file_type;
init_daemon_domain(derive_classpath)
diff --git a/private/dex2oat.te b/private/dex2oat.te
index 18600d8..3a841ce 100644
--- a/private/dex2oat.te
+++ b/private/dex2oat.te
@@ -1,5 +1,5 @@
# dex2oat
-type dex2oat, domain, coredomain;
+type dex2oat, domain, coredomain, artd_subprocess_type;
type dex2oat_exec, system_file_type, exec_type, file_type;
userfaultfd_use(dex2oat)
diff --git a/private/dexoptanalyzer.te b/private/dexoptanalyzer.te
index ca715c1..4c87f99 100644
--- a/private/dexoptanalyzer.te
+++ b/private/dexoptanalyzer.te
@@ -1,60 +1,3 @@
-# dexoptanalyzer
-type dexoptanalyzer, domain, coredomain, mlstrustedsubject;
+# Deprecated file type for the legacy dexoptanalyzer binary, used by Android T-. We need to keep it
+# for compatibility because the file type is burnt into the apex image.
type dexoptanalyzer_exec, system_file_type, exec_type, file_type;
-type dexoptanalyzer_tmpfs, file_type;
-
-r_dir_file(dexoptanalyzer, apk_data_file)
-# Access to /vendor/app
-r_dir_file(dexoptanalyzer, vendor_app_file)
-
-# Reading an APK opens a ZipArchive, which unpack to tmpfs.
-# Use tmpfs_domain() which will give tmpfs files created by dexoptanalyzer their
-# own label, which differs from other labels created by other processes.
-# This allows to distinguish in policy files created by dexoptanalyzer vs other
-# processes.
-tmpfs_domain(dexoptanalyzer)
-
-userfaultfd_use(dexoptanalyzer)
-
-# Allow dexoptanalyzer to read files in the dalvik cache.
-allow dexoptanalyzer dalvikcache_data_file:dir { getattr search };
-allow dexoptanalyzer dalvikcache_data_file:file r_file_perms;
-
-# Read symlinks in /data/dalvik-cache. This is required for PIC mode boot
-# app_data_file the oat file is symlinked to the original file in /system.
-allow dexoptanalyzer dalvikcache_data_file:lnk_file read;
-
-# Allow dexoptanalyzer to read files in the ART APEX data directory.
-allow dexoptanalyzer { apex_art_data_file apex_module_data_file }:dir { getattr search };
-allow dexoptanalyzer apex_art_data_file:file r_file_perms;
-
-# Allow dexoptanalyzer to use file descriptors from odrefresh.
-allow dexoptanalyzer odrefresh:fd use;
-
-# Use devpts and fd from odsign (which exec()'s odrefresh)
-allow dexoptanalyzer odsign:fd use;
-allow dexoptanalyzer odsign_devpts:chr_file { read write };
-
-allow dexoptanalyzer installd:fd use;
-allow dexoptanalyzer installd:fifo_file { getattr write };
-
-# Acquire advisory lock on /system/framework/arm/*
-allow dexoptanalyzer system_file:file lock;
-
-# Allow reading secondary dex files that were reported by the app to the
-# package manager.
-allow dexoptanalyzer { privapp_data_file app_data_file }:file { getattr read map };
-
-# dexoptanalyzer checks the DM files next to dex files. We don't need this check
-# for secondary dex files, but it's not harmful. Just deny it and ignore it.
-dontaudit dexoptanalyzer { privapp_data_file app_data_file }:dir search;
-
-# Allow testing /data/user/0 which symlinks to /data/data
-allow dexoptanalyzer system_data_file:lnk_file { getattr };
-
-# Allow query ART device config properties
-get_prop(dexoptanalyzer, device_config_runtime_native_prop)
-get_prop(dexoptanalyzer, device_config_runtime_native_boot_prop)
-
-# Allow dexoptanalyzer to read /apex/apex-info-list.xml
-allow dexoptanalyzer apex_info_file:file r_file_perms;
diff --git a/private/domain.te b/private/domain.te
index 4cf9138..94f96d9 100644
--- a/private/domain.te
+++ b/private/domain.te
@@ -15,12 +15,12 @@
setsched
getsession
getpgid
- setpgid
getcap
setcap
getattr
setrlimit
};
+allow { domain -artd_subprocess_type } self:process setpgid;
allow domain self:fd use;
allow domain proc:dir r_dir_perms;
allow domain proc_net_type:dir search;
@@ -1633,7 +1633,6 @@
-appdomain
-app_zygote
-artd # compile secondary dex files
- -dexoptanalyzer
-installd
-profman
-rs # spawned by appdomain, so carryover the exception above
diff --git a/private/ferrochrome_app.te b/private/ferrochrome_app.te
new file mode 100644
index 0000000..e12c84c
--- /dev/null
+++ b/private/ferrochrome_app.te
@@ -0,0 +1,11 @@
+type ferrochrome_app, domain;
+typeattribute ferrochrome_app coredomain;
+
+app_domain(ferrochrome_app)
+
+allow ferrochrome_app app_api_service:service_manager find;
+allow ferrochrome_app system_api_service:service_manager find;
+
+# TODO(b/348113995): after remove sysprop usage, we can use just (priv_)app.te
+set_prop(ferrochrome_app, debug_prop);
+get_prop(ferrochrome_app, debug_prop);
diff --git a/private/file.te b/private/file.te
index f8a48cd..d30465b 100644
--- a/private/file.te
+++ b/private/file.te
@@ -38,6 +38,7 @@
type uprobestats_configs_data_file, file_type, data_file_type, core_data_file_type;
# /apex/com.android.art/bin/oatdump
+# TODO (b/350628688): Remove this once it's safe to do so.
type oatdump_exec, system_file_type, exec_type, file_type;
# /data/misc_{ce/de}/<user>/sdksandbox root data directory for sdk sandbox processes
diff --git a/private/genfs_contexts b/private/genfs_contexts
index ac59c9a..de2b139 100644
--- a/private/genfs_contexts
+++ b/private/genfs_contexts
@@ -136,6 +136,7 @@
genfscon sysfs /class/rtc u:object_r:sysfs_rtc:s0
genfscon sysfs /class/switch u:object_r:sysfs_switch:s0
genfscon sysfs /class/wakeup u:object_r:sysfs_wakeup:s0
+genfscon sysfs /class/udc u:object_r:sysfs_udc:s0
genfscon sysfs /devices/platform/nfc-power/nfc_power u:object_r:sysfs_nfc_power_writable:s0
genfscon sysfs /devices/virtual/android_usb u:object_r:sysfs_android_usb:s0
genfscon sysfs /devices/virtual/block/ u:object_r:sysfs_devices_block:s0
diff --git a/private/installd.te b/private/installd.te
index 742c897..55e962a 100644
--- a/private/installd.te
+++ b/private/installd.te
@@ -9,9 +9,6 @@
# Run dex2oat in its own sandbox.
domain_auto_trans(installd, dex2oat_exec, dex2oat)
-# Run dexoptanalyzer in its own sandbox.
-domain_auto_trans(installd, dexoptanalyzer_exec, dexoptanalyzer)
-
# Run profman in its own sandbox.
domain_auto_trans(installd, profman_exec, profman)
@@ -44,11 +41,6 @@
allow installd staging_data_file:file unlink;
allow installd staging_data_file:dir { open read add_name remove_name rename rmdir search write getattr };
-allow installd { dex2oat dexoptanalyzer }:process signal;
-
-# installd kills subprocesses if they time out.
-allow installd { dex2oat dexoptanalyzer profman }:process sigkill;
-
# Allow installd manage dirs in /data/misc_ce/0/sdksandbox
allow installd sdk_sandbox_system_data_file:dir { create_dir_perms relabelfrom };
diff --git a/private/odrefresh.te b/private/odrefresh.te
index 899b0d9..97205c2 100644
--- a/private/odrefresh.te
+++ b/private/odrefresh.te
@@ -1,5 +1,5 @@
# odrefresh
-type odrefresh, domain, coredomain;
+type odrefresh, domain, coredomain, artd_subprocess_type;
type odrefresh_exec, system_file_type, exec_type, file_type;
# Allow odrefresh to create files and directories for on device signing.
@@ -24,12 +24,6 @@
# Allow odrefresh to kill dex2oat if compilation times out.
allow odrefresh dex2oat:process sigkill;
-# Run dexoptanalyzer in its own sandbox.
-domain_auto_trans(odrefresh, dexoptanalyzer_exec, dexoptanalyzer)
-
-# Allow odrefresh to kill dexoptanalyzer if analysis times out.
-allow odrefresh dexoptanalyzer:process sigkill;
-
# Use devpts and fd from odsign (which exec()'s odrefresh)
allow odrefresh odsign_devpts:chr_file { read write };
allow odrefresh odsign:fd use;
diff --git a/private/profman.te b/private/profman.te
index af53646..7071334 100644
--- a/private/profman.te
+++ b/private/profman.te
@@ -1,4 +1,5 @@
typeattribute profman coredomain;
+typeattribute profman artd_subprocess_type;
# Allow profman to read APKs and profile files next to them by FDs passed from
# other programs. In addition, allow profman to acquire flocks on those files.
diff --git a/private/property.te b/private/property.te
index 77fd497..7907dbc 100644
--- a/private/property.te
+++ b/private/property.te
@@ -68,12 +68,14 @@
system_internal_prop(suspend_debug_prop)
system_internal_prop(system_service_enable_prop)
+
# Properties which can't be written outside system
system_restricted_prop(device_config_virtualization_framework_native_prop)
system_restricted_prop(fstype_prop)
system_restricted_prop(log_file_logger_prop)
system_restricted_prop(persist_sysui_builder_extras_prop)
system_restricted_prop(persist_sysui_ranking_update_prop)
+system_restricted_prop(page_size_prop)
# Properties which should only be written by vendor_init
system_vendor_config_prop(avf_virtualizationservice_prop)
diff --git a/private/property_contexts b/private/property_contexts
index 48845a6..7a27625 100644
--- a/private/property_contexts
+++ b/private/property_contexts
@@ -1025,6 +1025,9 @@
# Property for enabling 16k pages developer option.
ro.product.build.16k_page.enabled u:object_r:enable_16k_pages_prop:s0 exact bool
+# Property that indicates which page size the device boots by default.
+ro.product.page_size u:object_r:page_size_prop:s0 exact int
+
ro.debuggable u:object_r:userdebug_or_eng_prop:s0 exact bool
ro.force.debuggable u:object_r:build_prop:s0 exact bool
diff --git a/private/seapp_contexts b/private/seapp_contexts
index 291e097..907861c 100644
--- a/private/seapp_contexts
+++ b/private/seapp_contexts
@@ -223,3 +223,4 @@
user=_app fromRunAs=true domain=runas_app levelFrom=user
user=_app isPrivApp=true name=com.android.virtualization.vmlauncher domain=vmlauncher_app type=privapp_data_file levelFrom=all
user=_app isPrivApp=true name=com.google.android.virtualization.vmlauncher domain=vmlauncher_app type=privapp_data_file levelFrom=all
+user=_app isPrivApp=true name=com.android.virtualization.ferrochrome domain=ferrochrome_app type=privapp_data_file levelFrom=all
diff --git a/private/shell.te b/private/shell.te
index d613a94..f896541 100644
--- a/private/shell.te
+++ b/private/shell.te
@@ -198,6 +198,11 @@
# Allow shell to execute the remote key provisioning factory tool
binder_call(shell, hal_keymint)
+# Allow shell to run the AVF RKP HAL during the execution of the remote key
+# provisioning factory tool.
+# TODO(b/351113293): Remove this once the AVF RKP HAL registration is moved to
+# a separate process.
+binder_call(shell, virtualizationservice)
# Allow reading the outcome of perf_event_open LSM support test for CTS.
get_prop(shell, init_perf_lsm_hooks_prop)
@@ -262,6 +267,7 @@
get_prop(shell, build_attestation_prop)
# Allow shell to execute oatdump.
+# TODO (b/350628688): Remove this once it's safe to do so.
allow shell oatdump_exec:file rx_file_perms;
# Allow shell access to socket for test
@@ -359,6 +365,7 @@
-virtual_touchpad_service
-vold_service
-default_android_service
+ -virtualization_service
}:service_manager find;
allow shell dumpstate:binder call;
@@ -488,6 +495,7 @@
hal_keymint_service
hal_secureclock_service
hal_sharedsecret_service
+ virtualization_service
}:service_manager find;
# Do not allow shell to hard link to any files.
diff --git a/private/system_server.te b/private/system_server.te
index 1298bf7..1c9f732 100644
--- a/private/system_server.te
+++ b/private/system_server.te
@@ -1264,6 +1264,9 @@
# UsbDeviceManager uses /dev/usb-ffs
allow system_server functionfs:dir search;
allow system_server functionfs:file rw_file_perms;
+# To resolve arbitrary sysfs paths from /sys/class/udc/* symlinks.
+allow system_server sysfs_type:dir search;
+r_dir_file(system_server, sysfs_udc)
# system_server contains time / time zone detection logic so reads the associated properties.
get_prop(system_server, time_prop)
@@ -1542,10 +1545,6 @@
# Read /proc/pressure/cpu and /proc/pressure/io
allow system_server { proc_pressure_cpu proc_pressure_io }:file r_file_perms;
-# dexoptanalyzer is currently used only for secondary dex files which
-# system_server should never access.
-neverallow system_server dexoptanalyzer_exec:file no_x_file_perms;
-
# No ptracing others
neverallow system_server { domain -system_server }:process ptrace;
diff --git a/private/uprobestats.te b/private/uprobestats.te
index f6dd906..2c5711f 100644
--- a/private/uprobestats.te
+++ b/private/uprobestats.te
@@ -16,7 +16,7 @@
allow uprobestats sysfs_uprobe:dir { search };
# Allow uprobestats to popen oatdump.
-allow uprobestats oatdump_exec:file rx_file_perms;
+allow uprobestats system_file:file rx_file_perms;
# Allow uprobestats to write atoms to statsd
unix_socket_send(uprobestats, statsdw, statsd)
diff --git a/public/file.te b/public/file.te
index 9f75f05..b28ca85 100644
--- a/public/file.te
+++ b/public/file.te
@@ -105,6 +105,9 @@
type cgroup_v2, fs_type;
type sysfs, fs_type, sysfs_type, mlstrustedobject;
type sysfs_android_usb, fs_type, sysfs_type;
+starting_at_board_api(202504, `
+ type sysfs_udc, fs_type, sysfs_type;
+')
type sysfs_uio, sysfs_type, fs_type;
type sysfs_batteryinfo, fs_type, sysfs_type;
type sysfs_bluetooth_writable, fs_type, sysfs_type, mlstrustedobject;