Merge "Add missing SELinux rule for accessing GPU" into main
diff --git a/build/soong/selinux_contexts.go b/build/soong/selinux_contexts.go
index d0bbc28..a65de35 100644
--- a/build/soong/selinux_contexts.go
+++ b/build/soong/selinux_contexts.go
@@ -255,7 +255,7 @@
return nil
}
-func (m *selinuxContextsModule) SetImageVariation(ctx android.BaseModuleContext, variation string, module android.Module) {
+func (m *selinuxContextsModule) SetImageVariation(ctx android.BaseModuleContext, variation string) {
}
var _ android.ImageInterface = (*selinuxContextsModule)(nil)
@@ -730,7 +730,7 @@
return nil
}
-func (m *contextsTestModule) SetImageVariation(ctx android.BaseModuleContext, variation string, module android.Module) {
+func (m *contextsTestModule) SetImageVariation(ctx android.BaseModuleContext, variation string) {
}
var _ android.ImageInterface = (*contextsTestModule)(nil)
diff --git a/build/soong/service_fuzzer_bindings.go b/build/soong/service_fuzzer_bindings.go
index 6ea7679..b7364bd 100644
--- a/build/soong/service_fuzzer_bindings.go
+++ b/build/soong/service_fuzzer_bindings.go
@@ -190,6 +190,7 @@
"android.system.virtualizationservice_internal.IVfioHandler": EXCEPTION_NO_FUZZER,
"android.system.virtualizationservice_internal.IVmnic": EXCEPTION_NO_FUZZER,
"android.system.virtualizationmaintenance": EXCEPTION_NO_FUZZER,
+ "android.system.vmtethering.IVmTethering": EXCEPTION_NO_FUZZER,
"ambient_context": EXCEPTION_NO_FUZZER,
"app_binding": EXCEPTION_NO_FUZZER,
"app_hibernation": EXCEPTION_NO_FUZZER,
diff --git a/contexts/plat_file_contexts_test b/contexts/plat_file_contexts_test
index a0933b4..0bd8e07 100644
--- a/contexts/plat_file_contexts_test
+++ b/contexts/plat_file_contexts_test
@@ -407,6 +407,7 @@
/system/bin/traced traced_exec
/system/bin/traced_perf traced_perf_exec
/system/bin/traced_probes traced_probes_exec
+/system/bin/traced_relay traced_exec
/system/bin/heapprofd heapprofd_exec
/system/bin/uncrypt uncrypt_exec
/system/bin/update_verifier update_verifier_exec
diff --git a/private/file_contexts b/private/file_contexts
index ffc06f2..f0832f3 100644
--- a/private/file_contexts
+++ b/private/file_contexts
@@ -339,6 +339,7 @@
/system/bin/traced u:object_r:traced_exec:s0
/system/bin/traced_perf u:object_r:traced_perf_exec:s0
/system/bin/traced_probes u:object_r:traced_probes_exec:s0
+/system/bin/traced_relay u:object_r:traced_exec:s0
/system/bin/trace_redactor u:object_r:trace_redactor_exec:s0
/system/bin/heapprofd u:object_r:heapprofd_exec:s0
/system/bin/uncrypt u:object_r:uncrypt_exec:s0
diff --git a/private/gmscore_app.te b/private/gmscore_app.te
index 859c2ec..f938ad5 100644
--- a/private/gmscore_app.te
+++ b/private/gmscore_app.te
@@ -136,6 +136,10 @@
allow gmscore_app shell_data_file:file r_file_perms;
allow gmscore_app shell_data_file:dir r_dir_perms;
+# allow gms core app write to aconfigd socket
+allow gmscore_app aconfigd_socket:sock_file {read write};
+allow gmscore_app aconfigd:unix_stream_socket connectto;
+
# b/18504118: Allow reads from /data/anr/traces.txt
allow gmscore_app anr_data_file:file r_file_perms;
diff --git a/private/service.te b/private/service.te
index 1fb4d1d..6c55ed4 100644
--- a/private/service.te
+++ b/private/service.te
@@ -31,7 +31,8 @@
type virtualization_maintenance_service, service_manager_type;
')
is_flag_enabled(RELEASE_AVF_ENABLE_NETWORK, `
- type vmnic_service, service_manager_type;
+ type vm_tethering_service, system_server_service, service_manager_type;
+ type vmnic_service, service_manager_type;
')
type uce_service, service_manager_type;
diff --git a/private/service_contexts b/private/service_contexts
index c7917f1..d1eecd5 100644
--- a/private/service_contexts
+++ b/private/service_contexts
@@ -172,6 +172,7 @@
')
is_flag_enabled(RELEASE_AVF_ENABLE_NETWORK, `
android.system.virtualizationservice_internal.IVmnic u:object_r:vmnic_service:s0
+ android.system.vmtethering.IVmTethering u:object_r:vm_tethering_service:s0
')
ambient_context u:object_r:ambient_context_service:s0
app_binding u:object_r:app_binding_service:s0
diff --git a/private/statsd.te b/private/statsd.te
index 5820d23..b932bc6 100644
--- a/private/statsd.te
+++ b/private/statsd.te
@@ -19,8 +19,11 @@
# Allow StatsCompanionService to pipe data to statsd.
allow statsd system_server:fifo_file { read write getattr };
-# Allow Statsd to pipe data to privileged apps.
-allow statsd priv_app:fifo_file { read write getattr };
+# Allow any app to pipe data to statsd.
+# Access control to all statsd APIs inherit from system_api_service, so
+# appdomain permissions are granted to avoid listing each individual
+# service that can access system_api_service.
+allow statsd appdomain:fifo_file { read write getattr };
# Allow statsd to retrieve SF statistics over binder
binder_call(statsd, surfaceflinger);
diff --git a/private/virtualizationservice.te b/private/virtualizationservice.te
index 3d0aac0..b6ba55b 100644
--- a/private/virtualizationservice.te
+++ b/private/virtualizationservice.te
@@ -28,6 +28,7 @@
# Let virtualizationservice find and communicate with vmnic.
allow virtualizationservice vmnic_service:service_manager find;
binder_call(virtualizationservice, vmnic)
+ allow virtualizationservice vm_tethering_service:service_manager find;
')
# Allow the virtualizationservice domain to serve a remotely provisioned component for
diff --git a/private/vmnic.te b/private/vmnic.te
index da1aebb..1b7e0d8 100644
--- a/private/vmnic.te
+++ b/private/vmnic.te
@@ -13,13 +13,13 @@
# Let the vmnic domain use Binder.
binder_use(vmnic)
- # Allow for creating TAP network interfaces.
+ # Allow for creating and deleting TAP network interfaces.
allow vmnic self:global_capability_class_set net_admin;
allow vmnic self:tun_socket create_socket_perms_no_ioctl;
allow vmnic tun_device:chr_file rw_file_perms;
- allowxperm vmnic tun_device:chr_file ioctl { TUNSETIFF TUNSETPERSIST };
+ allowxperm vmnic tun_device:chr_file ioctl { TUNGETIFF TUNSETIFF TUNSETPERSIST };
allow vmnic self:udp_socket create_socket_perms;
- allowxperm vmnic self:udp_socket ioctl { SIOCGIFFLAGS SIOCSIFFLAGS };
+ allowxperm vmnic self:udp_socket ioctl SIOCSIFFLAGS;
# Only virtualizationservice can communicate to vmnic
neverallow { domain -virtualizationservice -servicemanager } vmnic:binder call;