Merge "Allow update_engine to read /proc/filesystems" into main
diff --git a/Android.bp b/Android.bp
index dedcf63..6c8fa2a 100644
--- a/Android.bp
+++ b/Android.bp
@@ -207,36 +207,6 @@
}
-se_policy_conf {
- name: "apex_sepolicy-33.conf",
- srcs: plat_public_policy + plat_private_policy + ["com.android.sepolicy/33/*.te"],
- installable: false,
-}
-
-se_policy_cil {
- name: "apex_sepolicy-33.cil",
- src: ":apex_sepolicy-33.conf",
- filter_out: [":plat_sepolicy.cil"],
- installable: false,
- stem: "apex_sepolicy.cil",
-}
-
-se_policy_cil {
- name: "decompiled_sepolicy-without_apex.cil",
- src: ":precompiled_sepolicy-without_apex",
- decompile_binary: true,
-}
-
-se_policy_cil {
- name: "apex_sepolicy-33.decompiled.cil",
- src: ":precompiled_sepolicy",
- decompile_binary: true,
- filter_out: [":decompiled_sepolicy-without_apex.cil"],
- additional_cil_files: ["com.android.sepolicy/33/definitions/definitions.cil"],
- secilc_check: false,
- stem: "apex_sepolicy.decompiled.cil",
-}
-
// userdebug_plat_policy.conf - the userdebug version plat_sepolicy.cil
se_policy_conf {
name: "userdebug_plat_sepolicy.conf",
@@ -470,9 +440,6 @@
// AND
// - product_sepolicy_and_mapping.sha256 equals
// precompiled_sepolicy.product_sepolicy_and_mapping.sha256
-// AND
-// - apex_sepolicy.sha256 equals
-// precompiled_sepolicy.apex_sepolicy.sha256
// See system/core/init/selinux.cpp for details.
//////////////////////////////////
genrule {
@@ -490,20 +457,6 @@
}
genrule {
- name: "apex_sepolicy.sha256_gen",
- srcs: [":apex_sepolicy-33.cil"],
- out: ["apex_sepolicy.sha256"],
- cmd: "cat $(in) | sha256sum | cut -d' ' -f1 > $(out)",
-}
-
-prebuilt_etc {
- name: "apex_sepolicy.sha256",
- filename: "apex_sepolicy.sha256",
- src: ":apex_sepolicy.sha256_gen",
- installable: false,
-}
-
-genrule {
name: "system_ext_sepolicy_and_mapping.sha256_gen",
srcs: [":system_ext_sepolicy.cil", ":system_ext_mapping_file"],
out: ["system_ext_sepolicy_and_mapping.sha256"],
@@ -572,18 +525,6 @@
}
//////////////////////////////////
-// SHA-256 digest of the apex_sepolicy.cil against which precompiled_policy
-// was built.
-//////////////////////////////////
-prebuilt_etc {
- defaults: ["precompiled_sepolicy_prebuilts"],
- name: "precompiled_sepolicy.apex_sepolicy.sha256",
- filename: "precompiled_sepolicy.apex_sepolicy.sha256",
- src: ":apex_sepolicy.sha256_gen",
- relative_install_path: "selinux",
-}
-
-//////////////////////////////////
// SHA-256 digest of the system_ext_sepolicy.cil and system_ext_mapping_file against
// which precompiled_policy was built.
//////////////////////////////////
@@ -615,11 +556,10 @@
properties: ["vendor", "device_specific"],
}
-precompiled_se_policy_binary {
- name: "precompiled_sepolicy",
+filegroup {
+ name: "precompiled_sepolicy_srcs",
srcs: [
":plat_sepolicy.cil",
- ":apex_sepolicy-33.cil",
":plat_pub_versioned.cil",
":system_ext_sepolicy.cil",
":product_sepolicy.cil",
@@ -629,34 +569,15 @@
":system_ext_mapping_file",
":product_mapping_file",
],
- soong_config_variables: {
- BOARD_USES_ODMIMAGE: {
- device_specific: true,
- conditions_default: {
- vendor: true,
- },
- },
- },
- required: [
- "sepolicy_neverallows",
- ],
- dist: {
- targets: ["base-sepolicy-files-for-mapping"],
- },
+ // Make precompiled_sepolicy_srcs as public so that OEMs have access to them.
+ // Useful when some partitions need to be bind mounted across VM boundaries.
+ visibility: ["//visibility:public"],
}
precompiled_se_policy_binary {
- name: "precompiled_sepolicy-without_apex",
+ name: "precompiled_sepolicy",
srcs: [
- ":plat_sepolicy.cil",
- ":plat_pub_versioned.cil",
- ":system_ext_sepolicy.cil",
- ":product_sepolicy.cil",
- ":vendor_sepolicy.cil",
- ":odm_sepolicy.cil",
- ":plat_mapping_file",
- ":system_ext_mapping_file",
- ":product_mapping_file",
+ ":precompiled_sepolicy_srcs",
],
soong_config_variables: {
BOARD_USES_ODMIMAGE: {
@@ -753,33 +674,6 @@
}
se_policy_conf {
- name: "base_system_ext_sepolicy.conf",
- srcs: plat_public_policy +
- plat_private_policy +
- system_ext_public_policy +
- system_ext_private_policy,
- build_variant: "user",
- installable: false,
- system_ext_specific: true,
-}
-
-se_policy_cil {
- name: "base_system_ext_sepolicy.cil",
- src: ":base_system_ext_sepolicy.conf",
- additional_cil_files: ["private/technical_debt.cil"],
- system_ext_specific: true,
- installable: false,
- secilc_check: false, // done by se_policy_binary
-}
-
-se_policy_binary {
- name: "base_system_ext_sepolicy",
- srcs: [":base_system_ext_sepolicy.cil"],
- system_ext_specific: true,
- installable: false,
-}
-
-se_policy_conf {
name: "base_product_sepolicy.conf",
srcs: plat_public_policy +
plat_private_policy +
@@ -828,25 +722,6 @@
}
se_policy_conf {
- name: "base_system_ext_pub_policy.conf",
- srcs: plat_public_policy +
- system_ext_public_policy +
- reqd_mask_policy,
- build_variant: "user",
- installable: false,
- system_ext_specific: true,
-}
-
-se_policy_cil {
- name: "base_system_ext_pub_policy.cil",
- src: ":base_system_ext_pub_policy.conf",
- filter_out: [":reqd_policy_mask.cil"],
- secilc_check: false,
- installable: false,
- system_ext_specific: true,
-}
-
-se_policy_conf {
name: "base_product_pub_policy.conf",
srcs: plat_public_policy +
system_ext_public_policy +
diff --git a/Android.mk b/Android.mk
index b39ee44..384c416 100644
--- a/Android.mk
+++ b/Android.mk
@@ -1,13 +1,7 @@
LOCAL_PATH:= $(call my-dir)
-include $(LOCAL_PATH)/definitions.mk
-include $(LOCAL_PATH)/policy_version.mk
-
include $(CLEAR_VARS)
-MLS_SENS=1
-MLS_CATS=1024
-
ifdef BOARD_SEPOLICY_UNION
$(warning BOARD_SEPOLICY_UNION is no longer required - all files found in BOARD_SEPOLICY_DIRS are implicitly unioned; please remove from your BoardConfig.mk or other .mk file.)
endif
@@ -73,7 +67,6 @@
HAS_PRODUCT_SEPOLICY_DIR := true
endif
-NEVERALLOW_ARG :=
ifeq ($(SELINUX_IGNORE_NEVERALLOWS),true)
ifeq ($(TARGET_BUILD_VARIANT),user)
$(error SELINUX_IGNORE_NEVERALLOWS := true cannot be used in user builds)
@@ -81,7 +74,6 @@
$(warning Be careful when using the SELINUX_IGNORE_NEVERALLOWS flag. \
It does not work in user builds and using it will \
not stop you from failing CTS.)
-NEVERALLOW_ARG := -N
endif
# BOARD_SEPOLICY_DIRS was used for vendor/odm sepolicy customization before.
@@ -102,13 +94,6 @@
$(strip $(foreach type, $(1), $(foreach file, $(addsuffix /$(type), $(2)), $(sort $(wildcard $(file))))))
endef
-# Builds paths for all policy files found in BOARD_VENDOR_SEPOLICY_DIRS.
-# $(1): the set of policy name paths to build
-build_vendor_policy = $(call build_policy, $(1), $(PLAT_VENDOR_POLICY) $(BOARD_VENDOR_SEPOLICY_DIRS))
-
-# Builds paths for all policy files found in BOARD_ODM_SEPOLICY_DIRS.
-build_odm_policy = $(call build_policy, $(1), $(BOARD_ODM_SEPOLICY_DIRS))
-
sepolicy_build_files := security_classes \
initial_sids \
access_vectors \
@@ -170,36 +155,11 @@
endif
endif # ifdef HAS_PRODUCT_SEPOLICY_DIR
-# CIL files which contain workarounds for current limitation of human-readable
-# module policy language. These files are appended to the CIL files produced
-# from module language files.
-sepolicy_build_cil_workaround_files := technical_debt.cil
-
-my_target_arch := $(TARGET_ARCH)
-ifneq (,$(filter mips mips64,$(TARGET_ARCH)))
- my_target_arch := mips
-endif
-
-intermediates := $(TARGET_OUT_INTERMEDIATES)/ETC/sepolicy_intermediates
-
with_asan := false
ifneq (,$(filter address,$(SANITIZE_TARGET)))
with_asan := true
endif
-with_native_coverage := false
-ifeq ($(NATIVE_COVERAGE),true)
- with_native_coverage := true
-endif
-ifeq ($(CLANG_COVERAGE),true)
- with_native_coverage := true
-endif
-
-treble_sysprop_neverallow := true
-ifeq ($(BUILD_BROKEN_TREBLE_SYSPROP_NEVERALLOW),true)
- treble_sysprop_neverallow := false
-endif
-
ifeq ($(PRODUCT_SHIPPING_API_LEVEL),)
#$(warning no product shipping level defined)
else ifneq ($(call math_lt,29,$(PRODUCT_SHIPPING_API_LEVEL)),)
@@ -208,16 +168,6 @@
endif
endif
-enforce_sysprop_owner := true
-ifeq ($(BUILD_BROKEN_ENFORCE_SYSPROP_OWNER),true)
- enforce_sysprop_owner := false
-endif
-
-enforce_debugfs_restriction := false
-ifeq ($(PRODUCT_SET_DEBUGFS_RESTRICTIONS),true)
- enforce_debugfs_restriction := true
-endif
-
ifeq ($(PRODUCT_SHIPPING_API_LEVEL),)
#$(warning no product shipping level defined)
else ifneq ($(call math_lt,30,$(PRODUCT_SHIPPING_API_LEVEL)),)
@@ -226,13 +176,6 @@
endif
endif
-# Library extension for host-side tests
-ifeq ($(HOST_OS),darwin)
-SHAREDLIB_EXT=dylib
-else
-SHAREDLIB_EXT=so
-endif
-
#################################
include $(CLEAR_VARS)
@@ -306,7 +249,7 @@
ifneq ($(PLATFORM_SEPOLICY_VERSION),$(TOT_SEPOLICY_VERSION))
LOCAL_REQUIRED_MODULES += \
- sepolicy_freeze_test
+ se_freeze_test
endif # ($(PLATFORM_SEPOLICY_VERSION),$(TOT_SEPOLICY_VERSION))
include $(BUILD_PHONY_PACKAGE)
@@ -480,16 +423,6 @@
# Policy files are now built with Android.bp. Grab them from intermediate.
# See Android.bp for details of policy files.
#
-built_plat_cil := $(call intermediates-dir-for,ETC,plat_sepolicy.cil)/plat_sepolicy.cil
-
-ifdef HAS_SYSTEM_EXT_SEPOLICY
-built_system_ext_cil := $(call intermediates-dir-for,ETC,system_ext_sepolicy.cil)/system_ext_sepolicy.cil
-endif # ifdef HAS_SYSTEM_EXT_SEPOLICY
-
-ifdef HAS_PRODUCT_SEPOLICY
-built_product_cil := $(call intermediates-dir-for,ETC,product_sepolicy.cil)/product_sepolicy.cil
-endif # ifdef HAS_PRODUCT_SEPOLICY
-
built_sepolicy := $(call intermediates-dir-for,ETC,precompiled_sepolicy)/precompiled_sepolicy
built_sepolicy_neverallows := $(call intermediates-dir-for,ETC,sepolicy_neverallows)/sepolicy_neverallows
@@ -525,22 +458,32 @@
# Note: That a newline file is placed between each file_context file found to
# ensure a proper build when an fc file is missing an ending newline.
-local_fc_files := $(call build_policy, file_contexts, $(PLAT_PRIVATE_POLICY))
+local_fc_files := $(call intermediates-dir-for,ETC,plat_file_contexts)/plat_file_contexts
ifdef HAS_SYSTEM_EXT_SEPOLICY_DIR
-local_fc_files += $(call build_policy, file_contexts, $(SYSTEM_EXT_PRIVATE_POLICY))
+local_fc_files += $(call intermediates-dir-for,ETC,system_ext_file_contexts)/system_ext_file_contexts
endif
ifdef HAS_PRODUCT_SEPOLICY_DIR
-local_fc_files += $(call build_policy, file_contexts, $(PRODUCT_PRIVATE_POLICY))
+local_fc_files += $(call intermediates-dir-for,ETC,product_file_contexts)/product_file_contexts
endif
-ifneq ($(filter address,$(SANITIZE_TARGET)),)
- local_fc_files += $(wildcard $(addsuffix /file_contexts_asan, $(PLAT_PRIVATE_POLICY)))
-endif
-ifneq (,$(filter userdebug eng,$(TARGET_BUILD_VARIANT)))
- local_fc_files += $(wildcard $(addsuffix /file_contexts_overlayfs, $(PLAT_PRIVATE_POLICY)))
-endif
+###########################################################
+## Collect file_contexts files into a single tmp file with m4
+##
+## $(1): list of file_contexts files
+## $(2): filename into which file_contexts files are merged
+###########################################################
+
+define _merge-fc-files
+$(2): $(1) $(M4)
+ $(hide) mkdir -p $$(dir $$@)
+ $(hide) $(M4) --fatal-warnings -s $(1) > $$@
+endef
+
+define merge-fc-files
+$(eval $(call _merge-fc-files,$(1),$(2)))
+endef
file_contexts.local.tmp := $(intermediates)/file_contexts.local.tmp
$(call merge-fc-files,$(local_fc_files),$(file_contexts.local.tmp))
@@ -549,10 +492,10 @@
# it gathers LOCAL_FILE_CONTEXTS from product_MODULES
file_contexts.modules.tmp := $(intermediates)/file_contexts.modules.tmp
-device_fc_files := $(call build_vendor_policy, file_contexts)
+device_fc_files += $(call intermediates-dir-for,ETC,vendor_file_contexts)/vendor_file_contexts
ifdef BOARD_ODM_SEPOLICY_DIRS
-device_fc_files += $(call build_odm_policy, file_contexts)
+device_fc_files += $(call intermediates-dir-for,ETC,odm_file_contexts)/odm_file_contexts
endif
file_contexts.device.tmp := $(intermediates)/file_contexts.device.tmp
@@ -581,11 +524,8 @@
$(hide) $(HOST_OUT_EXECUTABLES)/checkfc $(PRIVATE_SEPOLICY) $<
$(hide) $(HOST_OUT_EXECUTABLES)/sefcontext_compile -o $@ $<
-built_fc := $(LOCAL_BUILT_MODULE)
local_fc_files :=
-local_fcfiles_with_nl :=
device_fc_files :=
-device_fcfiles_with_nl :=
file_contexts.concat.tmp :=
file_contexts.device.sorted.tmp :=
file_contexts.device.tmp :=
@@ -593,65 +533,34 @@
file_contexts.modules.tmp :=
##################################
-
-all_fc_files := $(TARGET_OUT)/etc/selinux/plat_file_contexts
-all_fc_files += $(TARGET_OUT_VENDOR)/etc/selinux/vendor_file_contexts
-ifdef HAS_SYSTEM_EXT_SEPOLICY_DIR
-all_fc_files += $(TARGET_OUT_SYSTEM_EXT)/etc/selinux/system_ext_file_contexts
-endif
-ifdef HAS_PRODUCT_SEPOLICY_DIR
-all_fc_files += $(TARGET_OUT_PRODUCT)/etc/selinux/product_file_contexts
-endif
-ifdef BOARD_ODM_SEPOLICY_DIRS
-all_fc_files += $(TARGET_OUT_ODM)/etc/selinux/odm_file_contexts
-endif
-all_fc_args := $(foreach file, $(all_fc_files), -f $(file))
-
-##################################
# Tests for Treble compatibility of current platform policy and vendor policy of
# given release version.
-built_plat_sepolicy := $(call intermediates-dir-for,ETC,base_plat_sepolicy)/base_plat_sepolicy
-built_system_ext_sepolicy := $(call intermediates-dir-for,ETC,base_system_ext_sepolicy)/base_system_ext_sepolicy
-built_product_sepolicy := $(call intermediates-dir-for,ETC,base_product_sepolicy)/base_product_sepolicy
-
-base_plat_pub_policy.cil := $(call intermediates-dir-for,ETC,base_plat_pub_policy.cil)/base_plat_pub_policy.cil
-base_system_ext_pub_polcy.cil := $(call intermediates-dir-for,ETC,base_system_ext_pub_polcy.cil)/base_system_ext_pub_polcy.cil
-base_product_pub_policy.cil := $(call intermediates-dir-for,ETC,base_product_pub_policy.cil)/base_product_pub_policy.cil
+ver := $(PLATFORM_SEPOLICY_VERSION)
+ifneq ($(wildcard $(LOCAL_PATH)/prebuilts/api/$(PLATFORM_SEPOLICY_VERSION)),)
+# If PLATFORM_SEPOLICY_VERSION is already frozen, use prebuilts for compat test
+base_plat_pub_policy.cil := $(call intermediates-dir-for,ETC,$(ver)_plat_pub_policy.cil)/$(ver)_plat_pub_policy.cil
+base_product_pub_policy.cil := $(call intermediates-dir-for,ETC,$(ver)_product_pub_policy.cil)/$(ver)_product_pub_policy.cil
+else
+# If not, use ToT for compat test
+base_plat_pub_policy.cil := $(call intermediates-dir-for,ETC,base_plat_pub_policy.cil)/base_plat_pub_policy.cil
+base_product_pub_policy.cil := $(call intermediates-dir-for,ETC,base_product_pub_policy.cil)/base_product_pub_policy.cil
+endif
+ver :=
$(foreach v,$(PLATFORM_SEPOLICY_COMPAT_VERSIONS), \
$(eval version_under_treble_tests := $(v)) \
$(eval include $(LOCAL_PATH)/treble_sepolicy_tests_for_release.mk) \
)
-built_plat_sepolicy :=
-built_system_ext_sepolicy :=
-built_product_sepolicy :=
base_plat_pub_policy.cil :=
-base_system_ext_pub_polcy.cil :=
base_product_pub_policy.cil :=
-all_fc_files :=
-all_fc_args :=
#################################
-build_vendor_policy :=
-build_odm_policy :=
build_policy :=
-built_plat_cil :=
-built_system_ext_cil :=
-built_product_cil :=
built_sepolicy :=
built_sepolicy_neverallows :=
-built_plat_svc :=
-built_vendor_svc :=
-treble_sysprop_neverallow :=
-enforce_sysprop_owner :=
-enforce_debugfs_restriction :=
-my_target_arch :=
sepolicy_build_files :=
-sepolicy_build_cil_workaround_files :=
with_asan :=
-
-include $(call all-makefiles-under,$(LOCAL_PATH))
diff --git a/apex/Android.bp b/apex/Android.bp
index 37b6171..21054fc 100644
--- a/apex/Android.bp
+++ b/apex/Android.bp
@@ -38,13 +38,6 @@
}
filegroup {
- name: "com.android.threadnetwork-file_contexts",
- srcs: [
- "com.android.threadnetwork-file_contexts",
- ],
-}
-
-filegroup {
name: "com.android.sdkext-file_contexts",
srcs: [
"com.android.sdkext-file_contexts",
@@ -199,13 +192,6 @@
}
filegroup {
- name: "com.android.sepolicy-file_contexts",
- srcs: [
- "com.android.sepolicy-file_contexts",
- ],
-}
-
-filegroup {
name: "com.android.tzdata-file_contexts",
srcs: [
"com.android.tzdata-file_contexts",
@@ -295,3 +281,10 @@
"com.android.devicelock-file_contexts",
],
}
+
+filegroup {
+ name: "com.android.telephonymodules-file_contexts",
+ srcs: [
+ "com.android.telephonymodules-file_contexts"
+ ],
+}
diff --git a/apex/com.android.nfcservices-file_contexts b/apex/com.android.nfcservices-file_contexts
new file mode 100644
index 0000000..f6b21da
--- /dev/null
+++ b/apex/com.android.nfcservices-file_contexts
@@ -0,0 +1,2 @@
+(/.*)? u:object_r:system_file:s0
+/lib(64)?(/.*) u:object_r:system_lib_file:s0
diff --git a/apex/com.android.sepolicy-file_contexts b/apex/com.android.sepolicy-file_contexts
deleted file mode 100644
index 83b4b58..0000000
--- a/apex/com.android.sepolicy-file_contexts
+++ /dev/null
@@ -1 +0,0 @@
-(/.*)? u:object_r:system_file:s0
diff --git a/apex/com.android.telephonymodules-file_contexts b/apex/com.android.telephonymodules-file_contexts
new file mode 100644
index 0000000..4cee48b
--- /dev/null
+++ b/apex/com.android.telephonymodules-file_contexts
@@ -0,0 +1 @@
+(/.*)? u:object_r:system_file:s0
diff --git a/apex/com.android.tethering-file_contexts b/apex/com.android.tethering-file_contexts
index af366d8..473b0f2 100644
--- a/apex/com.android.tethering-file_contexts
+++ b/apex/com.android.tethering-file_contexts
@@ -1,3 +1,5 @@
(/.*)? u:object_r:system_file:s0
/bin/for-system/clatd u:object_r:clatd_exec:s0
+/bin/netbpfload u:object_r:bpfloader_exec:s0
+/bin/ot-daemon u:object_r:ot_daemon_exec:s0
/lib(64)?(/.*) u:object_r:system_lib_file:s0
diff --git a/apex/com.android.threadnetwork-file_contexts b/apex/com.android.threadnetwork-file_contexts
deleted file mode 100644
index 412c555..0000000
--- a/apex/com.android.threadnetwork-file_contexts
+++ /dev/null
@@ -1,3 +0,0 @@
-(/.*)? u:object_r:system_file:s0
-/bin/ot-daemon u:object_r:ot_daemon_exec:s0
-/bin/ot-ctl u:object_r:ot_ctl_exec:s0
diff --git a/build/soong/policy.go b/build/soong/policy.go
index d8c3ffb..0793e2a 100644
--- a/build/soong/policy.go
+++ b/build/soong/policy.go
@@ -27,7 +27,6 @@
)
const (
- // TODO: sync with Android.mk
MlsSens = 1
MlsCats = 1024
PolicyVers = 30
diff --git a/build/soong/selinux_contexts.go b/build/soong/selinux_contexts.go
index a7a2436..de7355c 100644
--- a/build/soong/selinux_contexts.go
+++ b/build/soong/selinux_contexts.go
@@ -289,8 +289,8 @@
}
func (m *selinuxContextsModule) buildFileContexts(ctx android.ModuleContext, inputs android.Paths) android.Path {
- if m.properties.Fc_sort == nil {
- m.properties.Fc_sort = proptools.BoolPtr(true)
+ if m.properties.Remove_comment == nil {
+ m.properties.Remove_comment = proptools.BoolPtr(true)
}
return m.buildGeneralContexts(ctx, inputs)
}
@@ -517,19 +517,32 @@
Sepolicy *string `android:"path"`
}
+type fileContextsTestProperties struct {
+ // Test data. File passed to `checkfc -t` to validate how contexts are resolved.
+ Test_data *string `android:"path"`
+}
+
type contextsTestModule struct {
android.ModuleBase
- // Name of the test tool. "checkfc" or "property_info_checker"
- tool string
+ // The type of context.
+ context contextType
- // Additional flags to be passed to the tool.
- flags []string
-
- properties contextsTestProperties
- testTimestamp android.OutputPath
+ properties contextsTestProperties
+ fileProperties fileContextsTestProperties
+ testTimestamp android.OutputPath
}
+type contextType int
+
+const (
+ FileContext contextType = iota
+ PropertyContext
+ ServiceContext
+ HwServiceContext
+ VndServiceContext
+)
+
// checkfc parses a context file and checks for syntax errors.
// If -s is specified, the service backend is used to verify binder services.
// If -l is specified, the service backend is used to verify hwbinder services.
@@ -538,15 +551,16 @@
// file_contexts_test tests given file_contexts files with checkfc.
func fileContextsTestFactory() android.Module {
- m := &contextsTestModule{tool: "checkfc" /* no flags: file_contexts file check */}
+ m := &contextsTestModule{context: FileContext}
m.AddProperties(&m.properties)
+ m.AddProperties(&m.fileProperties)
android.InitAndroidArchModule(m, android.DeviceSupported, android.MultilibCommon)
return m
}
// property_contexts_test tests given property_contexts files with property_info_checker.
func propertyContextsTestFactory() android.Module {
- m := &contextsTestModule{tool: "property_info_checker"}
+ m := &contextsTestModule{context: PropertyContext}
m.AddProperties(&m.properties)
android.InitAndroidArchModule(m, android.DeviceSupported, android.MultilibCommon)
return m
@@ -554,7 +568,7 @@
// hwservice_contexts_test tests given hwservice_contexts files with checkfc.
func hwserviceContextsTestFactory() android.Module {
- m := &contextsTestModule{tool: "checkfc", flags: []string{"-e" /* allow empty */, "-l" /* hwbinder services */}}
+ m := &contextsTestModule{context: HwServiceContext}
m.AddProperties(&m.properties)
android.InitAndroidArchModule(m, android.DeviceSupported, android.MultilibCommon)
return m
@@ -563,7 +577,7 @@
// service_contexts_test tests given service_contexts files with checkfc.
func serviceContextsTestFactory() android.Module {
// checkfc -s: service_contexts test
- m := &contextsTestModule{tool: "checkfc", flags: []string{"-s" /* binder services */}}
+ m := &contextsTestModule{context: ServiceContext}
m.AddProperties(&m.properties)
android.InitAndroidArchModule(m, android.DeviceSupported, android.MultilibCommon)
return m
@@ -571,16 +585,16 @@
// vndservice_contexts_test tests given vndservice_contexts files with checkfc.
func vndServiceContextsTestFactory() android.Module {
- m := &contextsTestModule{tool: "checkfc", flags: []string{"-e" /* allow empty */, "-v" /* vnd service */}}
+ m := &contextsTestModule{context: VndServiceContext}
m.AddProperties(&m.properties)
android.InitAndroidArchModule(m, android.DeviceSupported, android.MultilibCommon)
return m
}
func (m *contextsTestModule) GenerateAndroidBuildActions(ctx android.ModuleContext) {
- tool := m.tool
- if tool != "checkfc" && tool != "property_info_checker" {
- panic(fmt.Errorf("%q: unknown tool name: %q", ctx.ModuleName(), tool))
+ tool := "checkfc"
+ if m.context == PropertyContext {
+ tool = "property_info_checker"
}
if len(m.properties.Srcs) == 0 {
@@ -588,19 +602,50 @@
return
}
+ validateWithPolicy := true
if proptools.String(m.properties.Sepolicy) == "" {
- ctx.PropertyErrorf("sepolicy", "can't be empty")
- return
+ if m.context == FileContext {
+ if proptools.String(m.fileProperties.Test_data) == "" {
+ ctx.PropertyErrorf("test_data", "Either test_data or sepolicy should be provided")
+ return
+ }
+ validateWithPolicy = false
+ } else {
+ ctx.PropertyErrorf("sepolicy", "can't be empty")
+ return
+ }
+ }
+
+ flags := []string(nil)
+ switch m.context {
+ case FileContext:
+ if !validateWithPolicy {
+ flags = []string{"-t"}
+ }
+ case ServiceContext:
+ flags = []string{"-s" /* binder services */}
+ case HwServiceContext:
+ flags = []string{"-e" /* allow empty */, "-l" /* hwbinder services */}
+ case VndServiceContext:
+ flags = []string{"-e" /* allow empty */, "-v" /* vnd service */}
}
srcs := android.PathsForModuleSrc(ctx, m.properties.Srcs)
- sepolicy := android.PathForModuleSrc(ctx, proptools.String(m.properties.Sepolicy))
-
rule := android.NewRuleBuilder(pctx, ctx)
- rule.Command().BuiltTool(tool).
- Flags(m.flags).
- Input(sepolicy).
- Inputs(srcs)
+
+ if validateWithPolicy {
+ sepolicy := android.PathForModuleSrc(ctx, proptools.String(m.properties.Sepolicy))
+ rule.Command().BuiltTool(tool).
+ Flags(flags).
+ Input(sepolicy).
+ Inputs(srcs)
+ } else {
+ test_data := android.PathForModuleSrc(ctx, proptools.String(m.fileProperties.Test_data))
+ rule.Command().BuiltTool(tool).
+ Flags(flags).
+ Inputs(srcs).
+ Input(test_data)
+ }
m.testTimestamp = pathForModuleOut(ctx, "timestamp")
rule.Command().Text("touch").Output(m.testTimestamp)
diff --git a/build/soong/service_fuzzer_bindings.go b/build/soong/service_fuzzer_bindings.go
index 345a9d2..b7836b2 100644
--- a/build/soong/service_fuzzer_bindings.go
+++ b/build/soong/service_fuzzer_bindings.go
@@ -70,6 +70,9 @@
"android.hardware.input.processor.IInputProcessor/default": EXCEPTION_NO_FUZZER,
"android.hardware.ir.IConsumerIr/default": EXCEPTION_NO_FUZZER,
"android.hardware.light.ILights/default": EXCEPTION_NO_FUZZER,
+ "android.hardware.macsec.IMacsecPskPlugin/default": EXCEPTION_NO_FUZZER,
+ "android.hardware.media.c2.IComponentStore/default": EXCEPTION_NO_FUZZER,
+ "android.hardware.media.c2.IComponentStore/software": []string{"libcodec2-aidl-fuzzer"},
"android.hardware.memtrack.IMemtrack/default": EXCEPTION_NO_FUZZER,
"android.hardware.net.nlinterceptor.IInterceptor/default": EXCEPTION_NO_FUZZER,
"android.hardware.nfc.INfc/default": EXCEPTION_NO_FUZZER,
@@ -112,6 +115,7 @@
"android.hardware.secure_element.ISecureElement/SIM1": EXCEPTION_NO_FUZZER,
"android.hardware.secure_element.ISecureElement/SIM2": EXCEPTION_NO_FUZZER,
"android.hardware.secure_element.ISecureElement/SIM3": EXCEPTION_NO_FUZZER,
+ "android.hardware.security.authgraph.IAuthGraphKeyExchange/nonsecure": EXCEPTION_NO_FUZZER,
"android.hardware.security.dice.IDiceDevice/default": EXCEPTION_NO_FUZZER,
"android.hardware.security.keymint.IKeyMintDevice/default": EXCEPTION_NO_FUZZER,
"android.hardware.security.keymint.IRemotelyProvisionedComponent/default": EXCEPTION_NO_FUZZER,
@@ -390,6 +394,7 @@
"search": EXCEPTION_NO_FUZZER,
"search_ui": EXCEPTION_NO_FUZZER,
"secure_element": EXCEPTION_NO_FUZZER,
+ "security_state": EXCEPTION_NO_FUZZER,
"sec_key_att_app_id_provider": EXCEPTION_NO_FUZZER,
"selection_toolbar": EXCEPTION_NO_FUZZER,
"sensorservice": EXCEPTION_NO_FUZZER,
@@ -455,8 +460,10 @@
"uwb": EXCEPTION_NO_FUZZER,
"vcn_management": EXCEPTION_NO_FUZZER,
"vibrator": EXCEPTION_NO_FUZZER,
+ "vibrator_control": EXCEPTION_NO_FUZZER,
"vibrator_manager": EXCEPTION_NO_FUZZER,
"virtualdevice": EXCEPTION_NO_FUZZER,
+ "virtualdevice_native": EXCEPTION_NO_FUZZER,
"virtual_camera_service": EXCEPTION_NO_FUZZER,
"virtual_touchpad": EXCEPTION_NO_FUZZER,
"voiceinteraction": EXCEPTION_NO_FUZZER,
@@ -465,6 +472,7 @@
"vrmanager": EXCEPTION_NO_FUZZER,
"wallpaper": EXCEPTION_NO_FUZZER,
"wallpaper_effects_generation": EXCEPTION_NO_FUZZER,
+ "wearable_sensing": EXCEPTION_NO_FUZZER,
"webviewupdate": EXCEPTION_NO_FUZZER,
"wifip2p": EXCEPTION_NO_FUZZER,
"wifiscanner": EXCEPTION_NO_FUZZER,
diff --git a/com.android.sepolicy/33/Android.bp b/com.android.sepolicy/33/Android.bp
deleted file mode 100644
index f3387ac..0000000
--- a/com.android.sepolicy/33/Android.bp
+++ /dev/null
@@ -1,56 +0,0 @@
-// Copyright (C) 2021 The Android Open Source Project
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-// http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package {
- // http://go/android-license-faq
- // A large-scale-change added 'default_applicable_licenses' to import
- // the below license kinds from "system_sepolicy_license":
- // SPDX-license-identifier-Apache-2.0
- default_applicable_licenses: ["system_sepolicy_license"],
-}
-
-genrule {
- name: "apex_file_contexts-33.gen",
- defaults: ["sepolicy_file_contexts_gen_default"],
- srcs: ["file_contexts"],
- out: ["apex_file_contexts-33"],
-}
-
-prebuilt_etc {
- name: "apex_file_contexts-33",
- filename: "apex_file_contexts",
- src: ":apex_file_contexts-33.gen",
- installable: false,
-}
-
-prebuilt_etc {
- name: "apex_property_contexts-33",
- filename: "apex_property_contexts",
- src: "property_contexts",
- installable: false,
-}
-
-prebuilt_etc {
- name: "apex_service_contexts-33",
- filename: "apex_service_contexts",
- src: "service_contexts",
- installable: false,
-}
-
-prebuilt_etc {
- name: "apex_seapp_contexts-33",
- filename: "apex_seapp_contexts",
- src: "seapp_contexts",
- installable: false,
-}
diff --git a/com.android.sepolicy/33/definitions/definitions.cil b/com.android.sepolicy/33/definitions/definitions.cil
deleted file mode 100644
index ffe4660..0000000
--- a/com.android.sepolicy/33/definitions/definitions.cil
+++ /dev/null
@@ -1,15 +0,0 @@
-; This file is required for sepolicy amend (go/seamendc).
-; The seamendc binary reads an amend SELinux policy as input in CIL format and applies its rules to
-; a binary SELinux policy. To parse the input correctly, we require the amend policy to be a valid
-; standalone policy. This file contains the preliminary statements(sid, sidorder, etc.) and
-; definitions (type, typeattribute, class, etc.) necessary to make the amend policy compile
-; successfully.
-(sid amend)
-(sidorder (amend))
-
-(classorder (file))
-
-;;;;;;;;;;;;;;;;;;;;;; shell.te ;;;;;;;;;;;;;;;;;;;;;;
-(type shell)
-(type sepolicy_test_file)
-(class file (ioctl read getattr lock map open watch watch_reads))
diff --git a/com.android.sepolicy/33/file_contexts b/com.android.sepolicy/33/file_contexts
deleted file mode 100644
index 14f99f9..0000000
--- a/com.android.sepolicy/33/file_contexts
+++ /dev/null
@@ -1 +0,0 @@
-/dev/selinux/apex_test u:object_r:sepolicy_test_file:s0
diff --git a/com.android.sepolicy/33/property_contexts b/com.android.sepolicy/33/property_contexts
deleted file mode 100644
index e69de29..0000000
--- a/com.android.sepolicy/33/property_contexts
+++ /dev/null
diff --git a/com.android.sepolicy/33/seapp_contexts b/com.android.sepolicy/33/seapp_contexts
deleted file mode 100644
index e69de29..0000000
--- a/com.android.sepolicy/33/seapp_contexts
+++ /dev/null
diff --git a/com.android.sepolicy/33/service_contexts b/com.android.sepolicy/33/service_contexts
deleted file mode 100644
index e69de29..0000000
--- a/com.android.sepolicy/33/service_contexts
+++ /dev/null
diff --git a/com.android.sepolicy/33/shell.te b/com.android.sepolicy/33/shell.te
deleted file mode 100644
index 757328e..0000000
--- a/com.android.sepolicy/33/shell.te
+++ /dev/null
@@ -1,2 +0,0 @@
-allow shell sepolicy_test_file:file r_file_perms;
-
diff --git a/com.android.sepolicy/Android.bp b/com.android.sepolicy/Android.bp
deleted file mode 100644
index 1e042f3..0000000
--- a/com.android.sepolicy/Android.bp
+++ /dev/null
@@ -1,28 +0,0 @@
-// Copyright (C) 2021 The Android Open Source Project
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-// http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package {
- // http://go/android-license-faq
- // A large-scale-change added 'default_applicable_licenses' to import
- // the below license kinds from "system_sepolicy_license":
- // SPDX-license-identifier-Apache-2.0
- default_applicable_licenses: ["system_sepolicy_license"],
-}
-
-genrule_defaults {
- name: "sepolicy_file_contexts_gen_default",
- tools: ["fc_sort"],
- cmd: "sed -e 's/#.*$$//' -e '/^$$/d' $(in) > $(out).tmp && " +
- "$(location fc_sort) -i $(out).tmp -o $(out)",
-}
diff --git a/contexts/Android.bp b/contexts/Android.bp
index f2bb9c0..914232a 100644
--- a/contexts/Android.bp
+++ b/contexts/Android.bp
@@ -103,6 +103,7 @@
":file_contexts_files{.vendor}",
],
soc_specific: true,
+ fc_sort: true,
}
file_contexts {
@@ -113,6 +114,7 @@
],
stem: "vendor_file_contexts",
recovery: true,
+ fc_sort: true,
}
file_contexts {
@@ -145,6 +147,7 @@
name: "odm_file_contexts",
srcs: [":file_contexts_files{.odm}"],
device_specific: true,
+ fc_sort: true,
}
file_contexts {
@@ -152,6 +155,7 @@
srcs: [":file_contexts_files{.odm}"],
stem: "odm_file_contexts",
recovery: true,
+ fc_sort: true,
}
hwservice_contexts {
@@ -390,6 +394,12 @@
}
file_contexts_test {
+ name: "plat_file_contexts_data_test",
+ srcs: [":file_contexts_files{.plat_private}"],
+ test_data: "plat_file_contexts_test",
+}
+
+file_contexts_test {
name: "system_ext_file_contexts_test",
srcs: [":system_ext_file_contexts"],
sepolicy: ":precompiled_sepolicy",
diff --git a/contexts/plat_file_contexts_test b/contexts/plat_file_contexts_test
new file mode 100644
index 0000000..50d9de4
--- /dev/null
+++ b/contexts/plat_file_contexts_test
@@ -0,0 +1,1267 @@
+# Test data for private/file_contexts.
+#
+# It can be passed to checkfc to confirm that the regular expressions in
+# file_contexts are matching the intended paths.
+/ rootfs
+/adb_keys adb_keys_file
+/build.prop rootfs
+/default.prop rootfs
+/fstab.persist rootfs
+/fstab.postinstall rootfs
+/init.rc rootfs
+/init.environ.rc rootfs
+/res rootfs
+/res/test rootfs
+/selinux_version rootfs
+/ueventd.rc rootfs
+/ueventd.common.rc rootfs
+/verity_key rootfs
+
+/init init_exec
+/sbin rootfs
+/sbin/su rootfs
+
+/lib rootfs
+/lib/lib.so rootfs
+/system_dlkm system_dlkm_file
+/system_dlkm/lib/modules/modules.load system_dlkm_file
+
+/lost+found rootfs
+/acct cgroup
+/config rootfs
+/data_mirror mirror_data_file
+/debug_ramdisk tmpfs
+/mnt tmpfs
+/proc rootfs
+/second_stage_resources tmpfs
+/sys sysfs
+/apex apex_mnt_dir
+/bootstrap-apex apex_mnt_dir
+
+/postinstall postinstall_mnt_dir
+/postinstall/apex postinstall_apex_mnt_dir
+
+/apex/.bootstrap-apex-info-list.xml apex_info_file
+/apex/.default-apex-info-list.xml apex_info_file
+/apex/apex-info-list.xml apex_info_file
+
+/bin rootfs
+/bugreports rootfs
+/charger rootfs
+/d rootfs
+/etc rootfs
+/sdcard rootfs
+
+/vendor_file_contexts file_contexts_file
+/plat_file_contexts file_contexts_file
+/product_file_contexts file_contexts_file
+/mapping_sepolicy.cil sepolicy_file
+/plat_sepolicy.cil sepolicy_file
+/plat_property_contexts property_contexts_file
+/product_property_contexts property_contexts_file
+/vendor_property_contexts property_contexts_file
+/seapp_contexts seapp_contexts_file
+/vendor_seapp_contexts seapp_contexts_file
+/plat_seapp_contexts seapp_contexts_file
+/sepolicy sepolicy_file
+/plat_service_contexts service_contexts_file
+/plat_hwservice_contexts hwservice_contexts_file
+/plat_keystore2_key_contexts keystore2_key_contexts_file
+/vendor_service_contexts vendor_service_contexts_file
+/vendor_hwservice_contexts hwservice_contexts_file
+/vndservice_contexts vndservice_contexts_file
+
+/dev device
+/dev/does_not_exist device
+/dev/adf graphics_device
+/dev/adf0 graphics_device
+/dev/adf123 graphics_device
+/dev/adf-interface. graphics_device
+/dev/adf-interface0. graphics_device
+/dev/adf-interface.1 graphics_device
+/dev/adf-interface2.3 graphics_device
+/dev/adf-overlay-engine. graphics_device
+/dev/adf-overlay-engine0. graphics_device
+/dev/adf-overlay-engine.1 graphics_device
+/dev/adf-overlay-engine2.3 graphics_device
+/dev/ashmem ashmem_device
+/dev/ashmemtest ashmem_libcutils_device
+/dev/ashmem-test ashmem_libcutils_device
+/dev/ashmem/test ashmem_libcutils_device
+/dev/audio audio_device
+/dev/audiotest audio_device
+/dev/audio-test audio_device
+/dev/audio/test audio_device
+/dev/binder binder_device
+/dev/block block_device
+/dev/block/does_not_exist block_device
+/dev/block123 device
+/dev/block/by-name/zoned_device zoned_block_device
+/dev/block/dm-0 dm_device
+/dev/block/dm-123 dm_device
+/dev/block/dm block_device
+/dev/block/dm- block_device
+/dev/block/ublkb0 ublk_block_device
+/dev/block/ublkb123 ublk_block_device
+/dev/block/ublkb block_device
+/dev/block/loop0 loop_device
+/dev/block/loop10 loop_device
+/dev/block/loop loop_device
+/dev/block/vda vd_device
+/dev/block/vdb vd_device
+/dev/block/vda0 vd_device
+/dev/block/vda10 vd_device
+/dev/block/vd block_device
+/dev/block/vd1a block_device
+/dev/block/vold block_device
+/dev/block/vold/disk:253,32 vold_device
+/dev/block/ram ram_device
+/dev/block/ram0 ram_device
+/dev/block/ram10 ram_device
+/dev/block/zram ram_device
+/dev/block/zram0 ram_device
+/dev/block/zram10 ram_device
+/dev/boringssl/selftest boringssl_self_test_marker
+/dev/boringssl/selftest/test boringssl_self_test_marker
+/dev/bus/usb usb_device
+/dev/bus/usb/001 usb_device
+/dev/console console_device
+/dev/cpu_variant: dev_cpu_variant
+/dev/cpu_variant:test dev_cpu_variant
+/dev/dma_heap dmabuf_heap_device
+/dev/dma_heap/test dmabuf_heap_device
+/dev/dma_heap/system dmabuf_system_heap_device
+/dev/dma_heap/system-uncached dmabuf_system_heap_device
+/dev/dma_heap/system-secure dmabuf_system_secure_heap_device
+/dev/dma_heap/system-secure-test dmabuf_system_secure_heap_device
+/dev/dma_heap/system-secure/test dmabuf_system_secure_heap_device
+/dev/dm-user dm_user_device
+/dev/dm-user/test dm_user_device
+/dev/ublk-control ublk_control_device
+/dev/device-mapper dm_device
+/dev/eac audio_device
+/dev/event-log-tags runtime_event_log_tags_file
+/dev/cgroup_info cgroup_rc_file
+/dev/cgroup_info/cgroup.rc cgroup_rc_file
+/dev/fscklogs fscklogs
+/dev/fscklogs/fsck fscklogs
+/dev/fuse fuse_device
+/dev/gnss0 gnss_device
+/dev/gnss10 gnss_device
+/dev/graphics graphics_device
+/dev/graphics/test graphics_device
+/dev/hw_random hw_random_device
+/dev/hwbinder hwbinder_device
+/dev/input input_device
+/dev/input/event0 input_device
+/dev/iio:device0 iio_device
+/dev/iio:device1 iio_device
+/dev/ion ion_device
+/dev/keychord keychord_device
+/dev/loop-control loop_control_device
+/dev/modem radio_device
+/dev/modem0 radio_device
+/dev/modem-test radio_device
+/dev/modem/test radio_device
+/dev/mtp_usb mtp_device
+/dev/pmsg0 pmsg_device
+/dev/pn544 nfc_device
+/dev/port port_device
+/dev/ppp ppp_device
+/dev/ptmx ptmx_device
+/dev/pvrsrvkm gpu_device
+/dev/kmsg kmsg_device
+/dev/kmsg_debug kmsg_debug_device
+/dev/kvm kvm_device
+/dev/null null_device
+/dev/nvhdcp1 video_device
+/dev/random random_device
+/dev/rpmsg-omx0 rpmsg_device
+/dev/rpmsg-omx1 rpmsg_device
+/dev/rproc_user rpmsg_device
+/dev/rtc0 rtc_device
+/dev/rtc9 rtc_device
+/dev/snd audio_device
+/dev/snd/controlC0 audio_device
+/dev/snd/timer audio_device
+/dev/socket socket_device
+/dev/socket/does_not_exist socket_device
+/dev/socket/adbd adbd_socket
+/dev/socket/dnsproxyd dnsproxyd_socket
+/dev/socket/dumpstate dumpstate_socket
+/dev/socket/fwmarkd fwmarkd_socket
+/dev/socket/lmkd lmkd_socket
+/dev/socket/logd logd_socket
+/dev/socket/logdr logdr_socket
+/dev/socket/logdw logdw_socket
+/dev/socket/statsdw statsdw_socket
+/dev/socket/mdns mdns_socket
+/dev/socket/mdnsd mdnsd_socket
+/dev/socket/mtpd mtpd_socket
+/dev/socket/pdx/system/buffer_hub pdx_bufferhub_dir
+/dev/socket/pdx/system/buffer_hub/client pdx_bufferhub_client_endpoint_socket
+/dev/socket/pdx/system/performance pdx_performance_dir
+/dev/socket/pdx/system/performance/client pdx_performance_client_endpoint_socket
+/dev/socket/pdx/system/vr/display pdx_display_dir
+/dev/socket/pdx/system/vr/display/client pdx_display_client_endpoint_socket
+/dev/socket/pdx/system/vr/display/manager pdx_display_manager_endpoint_socket
+/dev/socket/pdx/system/vr/display/screenshot pdx_display_screenshot_endpoint_socket
+/dev/socket/pdx/system/vr/display/vsync pdx_display_vsync_endpoint_socket
+/dev/socket/prng_seeder prng_seeder_socket
+/dev/socket/property_service property_socket
+/dev/socket/property_service_for_system property_socket
+/dev/socket/racoon racoon_socket
+/dev/socket/recovery recovery_socket
+/dev/socket/rild rild_socket
+/dev/socket/rild-debug rild_debug_socket
+/dev/socket/snapuserd snapuserd_socket
+/dev/socket/snapuserd_proxy snapuserd_proxy_socket
+/dev/socket/tombstoned_crash tombstoned_crash_socket
+/dev/socket/tombstoned_java_trace tombstoned_java_trace_socket
+/dev/socket/tombstoned_intercept tombstoned_intercept_socket
+/dev/socket/traced_consumer traced_consumer_socket
+/dev/socket/traced_perf traced_perf_socket
+/dev/socket/traced_producer traced_producer_socket
+/dev/socket/heapprofd heapprofd_socket
+/dev/socket/uncrypt uncrypt_socket
+/dev/socket/wpa_eth0 wpa_socket
+/dev/socket/wpa_eth9 wpa_socket
+/dev/socket/wpa_wlan0 wpa_socket
+/dev/socket/wpa_wlan9 wpa_socket
+/dev/socket/zygote zygote_socket
+/dev/socket/zygote_secondary zygote_socket
+/dev/socket/usap_pool_primary zygote_socket
+/dev/socket/usap_pool_secondary zygote_socket
+/dev/spdif_out audio_device
+/dev/spdif_out-test audio_device
+/dev/spdif_out/test audio_device
+/dev/sys/block/by-name/rootdisk rootdisk_sysdev
+/dev/sys/block/by-name/rootdisk/test rootdisk_sysdev
+/dev/sys/block/by-name/rootdisk-test device
+/dev/sys/block/by-name/userdata userdata_sysdev
+/dev/sys/block/by-name/userdata/test userdata_sysdev
+/dev/sys/block/by-name/userdata-test device
+/dev/sys/fs/by-name/userdata userdata_sysdev
+/dev/sys/fs/by-name/userdata/test userdata_sysdev
+/dev/sys/fs/by-name/userdata-test device
+/dev/tty owntty_device
+/dev/tty0 tty_device
+/dev/tty1 tty_device
+/dev/ttyS serial_device
+/dev/ttyS0 serial_device
+/dev/ttyS99 serial_device
+/dev/ttyUSB usb_serial_device
+/dev/ttyUSB0 usb_serial_device
+/dev/ttyUSB99 usb_serial_device
+/dev/ttyACM usb_serial_device
+/dev/ttyACM0 usb_serial_device
+/dev/ttyACM99 usb_serial_device
+/dev/tun tun_device
+/dev/uhid uhid_device
+/dev/uinput uhid_device
+/dev/uio uio_device
+/dev/uio0 uio_device
+/dev/uio9 uio_device
+/dev/urandom random_device
+/dev/usb_accessory usbaccessory_device
+/dev/v4l-touch input_device
+/dev/v4l-touch0 input_device
+/dev/v4l-touch10 input_device
+/dev/vfio vfio_device
+/dev/vfio/test vfio_device
+/dev/vfio-test device
+/dev/vhost-vsock kvm_device
+/dev/video video_device
+/dev/video0 video_device
+/dev/video99 video_device
+/dev/vndbinder vndbinder_device
+/dev/watchdog watchdog_device
+/dev/xt_qtaguid qtaguid_device
+/dev/zero zero_device
+/dev/__properties__ properties_device
+/dev/__properties__/property_info property_info
+/dev/__properties__/appcompat_override properties_device
+/dev/__properties__/appcompat_override/property_info property_info
+
+/linkerconfig linkerconfig_file
+/linkerconfig/test linkerconfig_file
+
+/system system_file
+/system/does_not_exist system_file
+/system/apex/com.android.art art_apex_dir
+/system/lib system_lib_file
+/system/lib64 system_lib_file
+/system/lib/does_not_exist system_lib_file
+/system/lib64/does_not_exist system_lib_file
+/system/lib/bootstrap system_bootstrap_lib_file
+/system/lib64/bootstrap system_bootstrap_lib_file
+/system/lib/bootstrap/test system_bootstrap_lib_file
+/system/lib64/bootstrap/test system_bootstrap_lib_file
+/system/bin/mm_events mm_events_exec
+/system/bin/atrace atrace_exec
+/system/bin/auditctl auditctl_exec
+/system/bin/bcc rs_exec
+/system/bin/blank_screen blank_screen_exec
+/system/bin/boringssl_self_test32 boringssl_self_test_exec
+/system/bin/boringssl_self_test64 boringssl_self_test_exec
+/system/bin/boringssl_self_test31 system_file
+/system/bin/prng_seeder prng_seeder_exec
+/system/bin/charger charger_exec
+/system/bin/e2fsdroid e2fs_exec
+/system/bin/mke2fs e2fs_exec
+/system/bin/e2fsck fsck_exec
+/system/bin/extra_free_kbytes.sh extra_free_kbytes_exec
+/system/bin/fsck.exfat fsck_exec
+/system/bin/fsck.f2fs fsck_exec
+/system/bin/init init_exec
+/system/bin/mini-keyctl toolbox_exec
+/system/bin/fsverity_init fsverity_init_exec
+/system/bin/sload_f2fs e2fs_exec
+/system/bin/make_f2fs e2fs_exec
+/system/bin/fsck_msdos fsck_exec
+/system/bin/tcpdump tcpdump_exec
+/system/bin/tune2fs fsck_exec
+/system/bin/resize2fs fsck_exec
+/system/bin/toolbox toolbox_exec
+/system/bin/toybox toolbox_exec
+/system/bin/ld.mc rs_exec
+/system/bin/logcat logcat_exec
+/system/bin/logcatd logcat_exec
+/system/bin/sh shell_exec
+/system/bin/run-as runas_exec
+/system/bin/bootanimation bootanim_exec
+/system/bin/bootstat bootstat_exec
+/system/bin/app_process32 zygote_exec
+/system/bin/app_process64 zygote_exec
+/system/bin/servicemanager servicemanager_exec
+/system/bin/surfaceflinger surfaceflinger_exec
+/system/bin/gpuservice gpuservice_exec
+/system/bin/bufferhubd bufferhubd_exec
+/system/bin/performanced performanced_exec
+/system/bin/drmserver drmserver_exec
+/system/bin/drmserver32 drmserver_exec
+/system/bin/drmserver64 drmserver_exec
+/system/bin/dumpstate dumpstate_exec
+/system/bin/incident incident_exec
+/system/bin/incidentd incidentd_exec
+/system/bin/incident_helper incident_helper_exec
+/system/bin/iw iw_exec
+/system/bin/netutils-wrapper-1.0 netutils_wrapper_exec
+/system/bin/vold vold_exec
+/system/bin/netd netd_exec
+/system/bin/wificond wificond_exec
+/system/bin/audioserver audioserver_exec
+/system/bin/mediadrmserver mediadrmserver_exec
+/system/bin/mediaserver mediaserver_exec
+/system/bin/mediaserver32 mediaserver_exec
+/system/bin/mediaserver64 mediaserver_exec
+/system/bin/mediametrics mediametrics_exec
+/system/bin/cameraserver cameraserver_exec
+/system/bin/mediaextractor mediaextractor_exec
+/system/bin/mediaswcodec mediaswcodec_exec
+/system/bin/mediatranscoding mediatranscoding_exec
+/system/bin/mediatuner mediatuner_exec
+/system/bin/mdnsd mdnsd_exec
+/system/bin/installd installd_exec
+/system/bin/otapreopt_chroot otapreopt_chroot_exec
+/system/bin/otapreopt_slot otapreopt_slot_exec
+/system/bin/credstore credstore_exec
+/system/bin/keystore keystore_exec
+/system/bin/keystore2 keystore_exec
+/system/bin/fingerprintd fingerprintd_exec
+/system/bin/gatekeeperd gatekeeperd_exec
+/system/bin/tombstoned tombstoned_exec
+/system/bin/recovery-persist recovery_persist_exec
+/system/bin/recovery-refresh recovery_refresh_exec
+/system/bin/sdcard sdcardd_exec
+/system/bin/snapshotctl snapshotctl_exec
+/system/bin/remount remount_exec
+/system/bin/dhcpcd dhcp_exec
+/system/bin/dhcpcd-6.8.2 dhcp_exec
+/system/bin/dmesgd dmesgd_exec
+/system/bin/mtpd mtp_exec
+/system/bin/pppd ppp_exec
+/system/bin/racoon racoon_exec
+/system/xbin/su su_exec
+/system/bin/dnsmasq dnsmasq_exec
+/system/bin/linker system_linker_exec
+/system/bin/linker64 system_linker_exec
+/system/bin/linker63 system_file
+/system/bin/linkerconfig linkerconfig_exec
+/system/bin/bootstrap/linker system_linker_exec
+/system/bin/bootstrap/linker64 system_linker_exec
+/system/bin/bootstrap/linker63 system_file
+/system/bin/bootstrap/linkerconfig linkerconfig_exec
+/system/bin/llkd llkd_exec
+/system/bin/lmkd lmkd_exec
+/system/bin/usbd usbd_exec
+/system/bin/inputflinger inputflinger_exec
+/system/bin/logd logd_exec
+/system/bin/lpdumpd lpdumpd_exec
+/system/bin/rss_hwm_reset rss_hwm_reset_exec
+/system/bin/perfetto perfetto_exec
+/system/bin/mtectrl mtectrl_exec
+/system/bin/traced traced_exec
+/system/bin/traced_perf traced_perf_exec
+/system/bin/traced_probes traced_probes_exec
+/system/bin/heapprofd heapprofd_exec
+/system/bin/uncrypt uncrypt_exec
+/system/bin/update_verifier update_verifier_exec
+/system/bin/logwrapper system_file
+/system/bin/vdc vdc_exec
+/system/bin/cppreopts.sh cppreopts_exec
+/system/bin/preloads_copy.sh preloads_copy_exec
+/system/bin/preopt2cachename preopt2cachename_exec
+/system/bin/viewcompiler viewcompiler_exec
+/system/bin/sgdisk sgdisk_exec
+/system/bin/blkid blkid_exec
+/system/bin/flags_health_check flags_health_check_exec
+/system/bin/idmap2 idmap_exec
+/system/bin/idmap2d idmap_exec
+/system/bin/update_engine update_engine_exec
+/system/bin/profcollectd profcollectd_exec
+/system/bin/profcollectctl profcollectd_exec
+/system/bin/storaged storaged_exec
+/system/bin/virtual_camera virtual_camera_exec
+/system/bin/virtual_touchpad virtual_touchpad_exec
+/system/bin/hw/android.frameworks.bufferhub@1.0-service fwk_bufferhub_exec
+/system/bin/hw/android.system.suspend-service system_suspend_exec
+/system/etc/cgroups.json cgroup_desc_file
+/system/etc/task_profiles/cgroups_0.json cgroup_desc_api_file
+/system/etc/task_profiles/cgroups_999.json cgroup_desc_api_file
+/system/etc/event-log-tags system_event_log_tags_file
+/system/etc/font_fallback.xml system_font_fallback_file
+/system/etc/group system_group_file
+/system/etc/ld.config. system_linker_config_file
+/system/etc/ld.config.test system_linker_config_file
+/system/etc/passwd system_passwd_file
+/system/etc/seccomp_policy system_seccomp_policy_file
+/system/etc/seccomp_policy/crash_dump.x86.policy system_seccomp_policy_file
+/system/etc/security/cacerts system_security_cacerts_file
+/system/etc/security/cacerts/123 system_security_cacerts_file
+/system/etc/selinux/mapping/30.0.cil sepolicy_file
+#/system/etc/selinux/mapping/30.compat.0.cil sepolicy_file
+/system/etc/selinux/plat_mac_permissions.xml mac_perms_file
+/system/etc/selinux/plat_property_contexts property_contexts_file
+/system/etc/selinux/plat_service_contexts service_contexts_file
+/system/etc/selinux/plat_hwservice_contexts hwservice_contexts_file
+/system/etc/selinux/plat_keystore2_key_contexts keystore2_key_contexts_file
+/system/etc/selinux/plat_file_contexts file_contexts_file
+/system/etc/selinux/plat_seapp_contexts seapp_contexts_file
+/system/etc/selinux/plat_sepolicy.cil sepolicy_file
+/system/etc/selinux/plat_and_mapping_sepolicy.cil.sha256 sepolicy_file
+/system/etc/task_profiles.json task_profiles_file
+/system/etc/task_profiles/task_profiles_0.json task_profiles_api_file
+/system/etc/task_profiles/task_profiles_99.json task_profiles_api_file
+/system/usr/share/zoneinfo system_zoneinfo_file
+/system/usr/share/zoneinfo/0 system_zoneinfo_file
+/system/bin/adbd adbd_exec
+/system/bin/vold_prepare_subdirs vold_prepare_subdirs_exec
+/system/bin/stats stats_exec
+/system/bin/statsd statsd_exec
+/system/bin/bpfloader bpfloader_exec
+/system/bin/netbpfload bpfloader_exec
+/system/bin/watchdogd watchdogd_exec
+/system/bin/apexd apexd_exec
+/system/bin/gsid gsid_exec
+/system/bin/simpleperf simpleperf_exec
+/system/bin/simpleperf_app_runner simpleperf_app_runner_exec
+/system/bin/migrate_legacy_obb_data migrate_legacy_obb_data_exec
+/system/bin/android.frameworks.automotive.display@1.0-service automotive_display_service_exec
+/system/bin/snapuserd snapuserd_exec
+/system/bin/odsign odsign_exec
+/system/bin/vehicle_binding_util vehicle_binding_util_exec
+/system/bin/cardisplayproxyd automotive_display_service_exec
+/system/bin/evsmanagerd evsmanagerd_exec
+/system/bin/android.automotive.evs.manager@1.0 evsmanagerd_exec
+/system/bin/android.automotive.evs.manager@1.99 evsmanagerd_exec
+/system/bin/uprobestats uprobestats_exec
+
+/vendor vendor_file
+/vendor/does_not_exist vendor_file
+/system/vendor vendor_file
+/system/vendor/does_not_exist vendor_file
+/vendor/bin/sh vendor_shell_exec
+/system/vendor/bin/sh vendor_shell_exec
+/vendor/bin/toybox_vendor vendor_toolbox_exec
+/system/vendor/bin/toybox_vendor vendor_toolbox_exec
+/vendor/bin/toolbox vendor_toolbox_exec
+/system/vendor/bin/toolbox vendor_toolbox_exec
+/vendor/etc vendor_configs_file
+/vendor/etc/does_not_exist vendor_configs_file
+/system/vendor/etc vendor_configs_file
+/system/vendor/etc/does_not_exist vendor_configs_file
+/vendor/etc/cgroups.json vendor_cgroup_desc_file
+/system/vendor/etc/cgroups.json vendor_cgroup_desc_file
+/vendor/etc/task_profiles.json vendor_task_profiles_file
+/system/vendor/etc/task_profiles.json vendor_task_profiles_file
+
+/vendor/lib/egl same_process_hal_file
+/vendor/lib64/egl same_process_hal_file
+/vendor/lib/egl/test same_process_hal_file
+/vendor/lib64/egl/test same_process_hal_file
+/system/vendor/lib/egl same_process_hal_file
+/system/vendor/lib64/egl same_process_hal_file
+/system/vendor/lib/egl/test same_process_hal_file
+/system/vendor/lib64/egl/test same_process_hal_file
+
+/vendor/lib/vndk-sp vndk_sp_file
+/vendor/lib64/vndk-sp vndk_sp_file
+/vendor/lib/vndk-sp/test vndk_sp_file
+/vendor/lib64/vndk-sp/test vndk_sp_file
+/system/vendor/lib/vndk-sp vndk_sp_file
+/system/vendor/lib64/vndk-sp vndk_sp_file
+/system/vendor/lib/vndk-sp/test vndk_sp_file
+/system/vendor/lib64/vndk-sp/test vndk_sp_file
+
+/vendor/manifest.xml vendor_configs_file
+/system/vendor/manifest.xml vendor_configs_file
+/vendor/compatibility_matrix.xml vendor_configs_file
+/system/vendor/compatibility_matrix.xml vendor_configs_file
+/vendor/etc/vintf vendor_configs_file
+/vendor/etc/vintf/test vendor_configs_file
+/system/vendor/etc/vintf vendor_configs_file
+/system/vendor/etc/vintf/test vendor_configs_file
+/vendor/app vendor_app_file
+/vendor/app/test vendor_app_file
+/system/vendor/app vendor_app_file
+/system/vendor/app/test vendor_app_file
+/vendor/priv-app vendor_app_file
+/vendor/priv-app/test vendor_app_file
+/system/vendor/priv-app vendor_app_file
+/system/vendor/priv-app/test vendor_app_file
+/vendor/overlay vendor_overlay_file
+/vendor/overlay/test vendor_overlay_file
+/system/vendor/overlay vendor_overlay_file
+/system/vendor/overlay/test vendor_overlay_file
+/vendor/framework vendor_framework_file
+/vendor/framework/test vendor_framework_file
+/system/vendor/framework vendor_framework_file
+/system/vendor/framework/test vendor_framework_file
+
+/vendor/apex vendor_apex_file
+/vendor/apex/test vendor_apex_file
+/vendor/apex/test/test vendor_apex_file
+/vendor/apex/test/test/test vendor_file
+/system/vendor/apex vendor_apex_file
+/system/vendor/apex/test vendor_apex_file
+/system/vendor/apex/test/test vendor_apex_file
+/system/vendor/apex/test/test/test vendor_file
+/vendor/bin/misc_writer vendor_misc_writer_exec
+/system/vendor/bin/misc_writer vendor_misc_writer_exec
+/vendor/bin/boringssl_self_test32 vendor_boringssl_self_test_exec
+/vendor/bin/boringssl_self_test64 vendor_boringssl_self_test_exec
+/system/vendor/bin/boringssl_self_test32 vendor_boringssl_self_test_exec
+/system/vendor/bin/boringssl_self_test64 vendor_boringssl_self_test_exec
+
+/vendor/lib/hw vendor_hal_file
+/vendor/lib64/hw vendor_hal_file
+/system/vendor/lib/hw vendor_hal_file
+/system/vendor/lib64/hw vendor_hal_file
+
+/vendor/etc/selinux/vendor_service_contexts vendor_service_contexts_file
+/system/vendor/etc/selinux/vendor_service_contexts vendor_service_contexts_file
+
+/odm vendor_file
+/odm/does_not_exist vendor_file
+/vendor/odm vendor_file
+/vendor/does_not_exist vendor_file
+/odm/lib/egl same_process_hal_file
+/odm/lib64/egl same_process_hal_file
+/odm/lib/egl/test same_process_hal_file
+/odm/lib64/egl/test same_process_hal_file
+/vendor/odm/lib/egl same_process_hal_file
+/vendor/odm/lib64/egl same_process_hal_file
+/vendor/odm/lib/egl/test same_process_hal_file
+/vendor/odm/lib64/egl/test same_process_hal_file
+/odm/lib/hw vendor_hal_file
+/odm/lib64/hw vendor_hal_file
+/vendor/odm/lib/hw vendor_hal_file
+/vendor/odm/lib64/hw vendor_hal_file
+/odm/lib/vndk-sp vndk_sp_file
+/odm/lib64/vndk-sp vndk_sp_file
+/odm/lib/vndk-sp/test vndk_sp_file
+/odm/lib64/vndk-sp/test vndk_sp_file
+/vendor/odm/lib/vndk-sp vndk_sp_file
+/vendor/odm/lib64/vndk-sp vndk_sp_file
+/vendor/odm/lib/vndk-sp/test vndk_sp_file
+/vendor/odm/lib64/vndk-sp/test vndk_sp_file
+
+/odm/bin/sh vendor_shell_exec
+/vendor/odm/bin/sh vendor_shell_exec
+/odm/etc vendor_configs_file
+/odm/etc/test vendor_configs_file
+/vendor/odm/etc vendor_configs_file
+/vendor/odm/etc/test vendor_configs_file
+/odm/app vendor_app_file
+/odm/app/test vendor_app_file
+/vendor/odm/app vendor_app_file
+/vendor/odm/app/test vendor_app_file
+/odm/priv-app vendor_app_file
+/odm/priv-app/test vendor_app_file
+/vendor/odm/priv-app vendor_app_file
+/vendor/odm/priv-app/test vendor_app_file
+/odm/overlay vendor_overlay_file
+/odm/overlay/test vendor_overlay_file
+/vendor/odm/overlay vendor_overlay_file
+/vendor/odm/overlay/test vendor_overlay_file
+/odm/framework vendor_framework_file
+/odm/framework/test vendor_framework_file
+/vendor/odm/framework vendor_framework_file
+/vendor/odm/framework/test vendor_framework_file
+
+/odm/etc/hal_uuid_map_.xml vendor_uuid_mapping_config_file
+/odm/etc/hal_uuid_map_test.xml vendor_uuid_mapping_config_file
+/vendor/odm/etc/hal_uuid_map_.xml vendor_uuid_mapping_config_file
+/vendor/odm/etc/hal_uuid_map_test.xml vendor_uuid_mapping_config_file
+/vendor/etc/hal_uuid_map_.xml vendor_uuid_mapping_config_file
+/vendor/etc/hal_uuid_map_test.xml vendor_uuid_mapping_config_file
+/system/vendor/etc/hal_uuid_map_.xml vendor_uuid_mapping_config_file
+/system/vendor/etc/hal_uuid_map_test.xml vendor_uuid_mapping_config_file
+
+/odm/usr/keylayout.kl vendor_keylayout_file
+/odm/usr/keylayout/test.kl vendor_keylayout_file
+/vendor/odm/usr/keylayout.kl vendor_keylayout_file
+/vendor/odm/usr/keylayout/test.kl vendor_keylayout_file
+/vendor/usr/keylayout.kl vendor_keylayout_file
+/vendor/usr/keylayout/test.kl vendor_keylayout_file
+/system/vendor/usr/keylayout.kl vendor_keylayout_file
+/system/vendor/usr/keylayout/test.kl vendor_keylayout_file
+/odm/usr/keychars.kcm vendor_keychars_file
+/odm/usr/keychars/test.kcm vendor_keychars_file
+/vendor/odm/usr/keychars.kcm vendor_keychars_file
+/vendor/odm/usr/keychars/test.kcm vendor_keychars_file
+/vendor/usr/keychars.kcm vendor_keychars_file
+/vendor/usr/keychars/test.kcm vendor_keychars_file
+/system/vendor/usr/keychars.kcm vendor_keychars_file
+/system/vendor/usr/keychars/test.kcm vendor_keychars_file
+/odm/usr/idc.idc vendor_idc_file
+/odm/usr/idc/test.idc vendor_idc_file
+/vendor/odm/usr/idc.idc vendor_idc_file
+/vendor/odm/usr/idc/test.idc vendor_idc_file
+/vendor/usr/idc.idc vendor_idc_file
+/vendor/usr/idc/test.idc vendor_idc_file
+/system/vendor/usr/idc.idc vendor_idc_file
+/system/vendor/usr/idc/test.idc vendor_idc_file
+
+/oem oemfs
+/oem/does_not_exist oemfs
+/oem/overlay vendor_overlay_file
+/oem/overlay/does_not_exist vendor_overlay_file
+
+/odm/etc/selinux/precompiled_sepolicy sepolicy_file
+/odm/etc/selinux/precompiled_sepolicy.plat_and_mapping.sha256 sepolicy_file
+
+/odm/etc/selinux/odm_sepolicy.cil sepolicy_file
+/vendor/odm/etc/selinux/odm_sepolicy.cil sepolicy_file
+/odm/etc/selinux/odm_file_contexts file_contexts_file
+/vendor/odm/etc/selinux/odm_file_contexts file_contexts_file
+/odm/etc/selinux/odm_seapp_contexts seapp_contexts_file
+/vendor/odm/etc/selinux/odm_seapp_contexts seapp_contexts_file
+/odm/etc/selinux/odm_property_contexts property_contexts_file
+/vendor/odm/etc/selinux/odm_property_contexts property_contexts_file
+/odm/etc/selinux/odm_service_contexts vendor_service_contexts_file
+/vendor/odm/etc/selinux/odm_service_contexts vendor_service_contexts_file
+/odm/etc/selinux/odm_hwservice_contexts hwservice_contexts_file
+/vendor/odm/etc/selinux/odm_hwservice_contexts hwservice_contexts_file
+/odm/etc/selinux/odm_keystore2_key_contexts keystore2_key_contexts_file
+/vendor/odm/etc/selinux/odm_keystore2_key_contexts keystore2_key_contexts_file
+/odm/etc/selinux/odm_mac_permissions.xml mac_perms_file
+/vendor/odm/etc/selinux/odm_mac_permissions.xml mac_perms_file
+
+/product system_file
+/product/does_not_exist system_file
+/system/product system_file
+/system/product/does_not_exist system_file
+/product/etc/group system_group_file
+/system/product/etc/group system_group_file
+/product/etc/passwd system_passwd_file
+/system/product/etc/passwd system_passwd_file
+/product/overlay system_file
+/product/overlay/does_not_exist system_file
+/system/product/overlay system_file
+/system/product/overlay/does_not_exist system_file
+
+/product/etc/selinux/product_file_contexts file_contexts_file
+/system/product/etc/selinux/product_file_contexts file_contexts_file
+/product/etc/selinux/product_hwservice_contexts hwservice_contexts_file
+/system/product/etc/selinux/product_hwservice_contexts hwservice_contexts_file
+/product/etc/selinux/product_keystore2_key_contexts keystore2_key_contexts_file
+/system/product/etc/selinux/product_keystore2_key_contexts keystore2_key_contexts_file
+/product/etc/selinux/product_property_contexts property_contexts_file
+/system/product/etc/selinux/product_property_contexts property_contexts_file
+/product/etc/selinux/product_seapp_contexts seapp_contexts_file
+/system/product/etc/selinux/product_seapp_contexts seapp_contexts_file
+/product/etc/selinux/product_service_contexts service_contexts_file
+/system/product/etc/selinux/product_service_contexts service_contexts_file
+/product/etc/selinux/product_mac_permissions.xml mac_perms_file
+/system/product/etc/selinux/product_mac_permissions.xml mac_perms_file
+
+/product/lib system_lib_file
+/product/lib/does_not_exist system_lib_file
+/product/lib64 system_lib_file
+/product/lib64/does_not_exist system_lib_file
+/system/product/lib system_lib_file
+/system/product/lib/does_not_exist system_lib_file
+/system/product/lib64 system_lib_file
+/system/product/lib64/does_not_exist system_lib_file
+
+/system_ext system_file
+/system_ext/does_not_exist system_file
+/system/system_ext system_file
+/system/system_ext/does_not_exist system_file
+/system_ext/etc/group system_group_file
+/system/system_ext/etc/group system_group_file
+/system_ext/etc/passwd system_passwd_file
+/system/system_ext/etc/passwd system_passwd_file
+/system_ext/overlay vendor_overlay_file
+/system_ext/overlay/does_not_exist vendor_overlay_file
+/system/system_ext/overlay vendor_overlay_file
+/system/system_ext/overlay/does_not_exist vendor_overlay_file
+
+/system_ext/etc/selinux/system_ext_file_contexts file_contexts_file
+/system/system_ext/etc/selinux/system_ext_file_contexts file_contexts_file
+/system_ext/etc/selinux/system_ext_hwservice_contexts hwservice_contexts_file
+/system/system_ext/etc/selinux/system_ext_hwservice_contexts hwservice_contexts_file
+/system_ext/etc/selinux/system_ext_keystore2_key_contexts keystore2_key_contexts_file
+/system/system_ext/etc/selinux/system_ext_keystore2_key_contexts keystore2_key_contexts_file
+/system_ext/etc/selinux/system_ext_property_contexts property_contexts_file
+/system/system_ext/etc/selinux/system_ext_property_contexts property_contexts_file
+/system_ext/etc/selinux/system_ext_seapp_contexts seapp_contexts_file
+/system/system_ext/etc/selinux/system_ext_seapp_contexts seapp_contexts_file
+/system_ext/etc/selinux/system_ext_service_contexts service_contexts_file
+/system/system_ext/etc/selinux/system_ext_service_contexts service_contexts_file
+/system_ext/etc/selinux/system_ext_mac_permissions.xml mac_perms_file
+/system/system_ext/etc/selinux/system_ext_mac_permissions.xml mac_perms_file
+/system_ext/etc/selinux/userdebug_plat_sepolicy.cil sepolicy_file
+/system/system_ext/etc/selinux/userdebug_plat_sepolicy.cil sepolicy_file
+
+/system_ext/bin/aidl_lazy_test_server aidl_lazy_test_server_exec
+/system/system_ext/bin/aidl_lazy_test_server aidl_lazy_test_server_exec
+/system_ext/bin/aidl_lazy_cb_test_server aidl_lazy_test_server_exec
+/system/system_ext/bin/aidl_lazy_cb_test_server aidl_lazy_test_server_exec
+/system_ext/bin/hidl_lazy_test_server hidl_lazy_test_server_exec
+/system/system_ext/bin/hidl_lazy_test_server hidl_lazy_test_server_exec
+/system_ext/bin/hidl_lazy_cb_test_server hidl_lazy_test_server_exec
+/system/system_ext/bin/hidl_lazy_cb_test_server hidl_lazy_test_server_exec
+/system_ext/bin/hwservicemanager hwservicemanager_exec
+/system/system_ext/bin/hwservicemanager hwservicemanager_exec
+/system_ext/bin/hw/android.hidl.allocator@1.0-service hal_allocator_default_exec
+/system/system_ext/bin/hw/android.hidl.allocator@1.0-service hal_allocator_default_exec
+
+
+/system_ext/bin/canhalconfigurator canhalconfigurator_exec
+/system_ext/bin/canhalconfigurator-aidl canhalconfigurator_exec
+/system/system_ext/bin/canhalconfigurator canhalconfigurator_exec
+/system/system_ext/bin/canhalconfigurator-aidl canhalconfigurator_exec
+
+/system_ext/lib system_lib_file
+/system_ext/lib/does_not_exist system_lib_file
+/system_ext/lib64 system_lib_file
+/system_ext/lib64/does_not_exist system_lib_file
+/system/system_ext/lib system_lib_file
+/system/system_ext/lib/does_not_exist system_lib_file
+/system/system_ext/lib64 system_lib_file
+/system/system_ext/lib64/does_not_exist system_lib_file
+
+/vendor_dlkm vendor_file
+/vendor_dlkm/does_not_exist vendor_file
+/vendor/vendor_dlkm vendor_file
+/vendor/vendor_dlkm/does_not_exist vendor_file
+/system/vendor/vendor_dlkm vendor_file
+/system/vendor/vendor_dlkm/does_not_exist vendor_file
+/vendor_dlkm/etc vendor_configs_file
+/vendor_dlkm/etc/does_not_exist vendor_configs_file
+/vendor/vendor_dlkm/etc vendor_configs_file
+/vendor/vendor_dlkm/etc/does_not_exist vendor_configs_file
+/system/vendor/vendor_dlkm/etc vendor_configs_file
+/system/vendor/vendor_dlkm/etc/does_not_exist vendor_configs_file
+
+/odm_dlkm vendor_file
+/odm_dlkm/does_not_exist vendor_file
+/vendor/odm_dlkm vendor_file
+/vendor/odm_dlkm/does_not_exist vendor_file
+/system/vendor/odm_dlkm vendor_file
+/system/vendor/odm_dlkm/does_not_exist vendor_file
+/odm_dlkm/etc vendor_configs_file
+/odm_dlkm/etc/does_not_exist vendor_configs_file
+/vendor/odm_dlkm/etc vendor_configs_file
+/vendor/odm_dlkm/etc/does_not_exist vendor_configs_file
+/system/vendor/odm_dlkm/etc vendor_configs_file
+/system/vendor/odm_dlkm/etc/does_not_exist vendor_configs_file
+
+/product/vendor_overlay/0/test vendor_file
+/product/vendor_overlay/1/test vendor_file
+/system/product/vendor_overlay/0/test vendor_file
+/system/product/vendor_overlay/1/test vendor_file
+
+/data system_data_root_file
+/data/does_not_exist system_data_file
+/data/system/environ environ_system_data_file
+/data/system/environ/test environ_system_data_file
+/data/system/packages.list packages_list_file
+/data/system/game_mode_intervention.list game_mode_intervention_list_file
+/data/unencrypted unencrypted_data_file
+/data/unencrypted/test unencrypted_data_file
+/data/backup backup_data_file
+/data/backup/test backup_data_file
+/data/secure/backup backup_data_file
+/data/secure/backup/test backup_data_file
+/data/system/ndebugsocket system_ndebug_socket
+/data/system/unsolzygotesocket system_unsolzygote_socket
+/data/drm drm_data_file
+/data/drm/test drm_data_file
+/data/resource-cache resourcecache_data_file
+/data/resource-cache/test resourcecache_data_file
+/data/dalvik-cache dalvikcache_data_file
+/data/dalvik-cache/test dalvikcache_data_file
+/data/ota ota_data_file
+/data/ota/test ota_data_file
+/data/ota_package ota_package_file
+/data/ota_package/test ota_package_file
+/data/adb adb_data_file
+/data/adb/test adb_data_file
+/data/anr anr_data_file
+/data/anr/test anr_data_file
+/data/apex apex_data_file
+/data/apex/test apex_data_file
+/data/apex/active/test staging_data_file
+/data/apex/backup/test staging_data_file
+/data/apex/decompressed/test staging_data_file
+/data/apex/ota_reserved apex_ota_reserved_file
+/data/apex/ota_reserved/test apex_ota_reserved_file
+/data/app apk_data_file
+/data/app/test apk_data_file
+/data/app/test01/oat dalvikcache_data_file
+/data/app/test01/oat/test dalvikcache_data_file
+/data/app/test01/test02/oat dalvikcache_data_file
+/data/app/test01/test02/oat/test dalvikcache_data_file
+/data/app/vmdltest01.tmp apk_tmp_file
+/data/app/vmdltest01.tmp/test apk_tmp_file
+/data/app/vmdltest02.tmp/oat dalvikcache_data_file
+/data/app/vmdltest02.tmp/oat/test dalvikcache_data_file
+/data/app-private apk_private_data_file
+/data/app-private/test apk_private_data_file
+/data/app-private/vmdltest.tmp apk_private_tmp_file
+/data/app-private/vmdltest/does_not_exist.tmp apk_private_tmp_file
+/data/app-private/vmdltest.tmp/test apk_private_tmp_file
+/data/gsi gsi_data_file
+/data/gsi/test gsi_data_file
+/data/gsi_persistent_data gsi_persistent_data_file
+/data/gsi/ota ota_image_data_file
+/data/gsi/ota/test ota_image_data_file
+/data/tombstones tombstone_data_file
+/data/tombstones/test tombstone_data_file
+/data/vendor/tombstones/wifi tombstone_wifi_data_file
+/data/vendor/tombstones/wifi/test tombstone_wifi_data_file
+/data/local/tests shell_test_data_file
+/data/local/tests/test shell_test_data_file
+/data/local/tmp shell_data_file
+/data/local/tmp/test shell_data_file
+/data/local/tmp/ltp nativetest_data_file
+/data/local/tmp/ltp/test nativetest_data_file
+/data/local/traces trace_data_file
+/data/local/traces/test trace_data_file
+/data/media media_userdir_file
+/data/media/test media_rw_data_file
+/data/mediadrm media_data_file
+/data/mediadrm/test media_data_file
+/data/nativetest nativetest_data_file
+/data/nativetest/test nativetest_data_file
+/data/nativetest64 nativetest_data_file
+/data/nativetest64/test nativetest_data_file
+/data/pkg_staging staging_data_file
+/data/pkg_staging/test staging_data_file
+/data/property property_data_file
+/data/property/test property_data_file
+/data/preloads preloads_data_file
+/data/preloads/test preloads_data_file
+/data/preloads/media preloads_media_file
+/data/preloads/media/test preloads_media_file
+/data/preloads/demo preloads_media_file
+/data/preloads/demo/test preloads_media_file
+/data/server_configurable_flags server_configurable_flags_data_file
+/data/server_configurable_flags/test server_configurable_flags_data_file
+/data/app-staging staging_data_file
+/data/app-staging/test staging_data_file
+/data/rollback/0/test/test.apk apk_data_file
+/data/rollback/999/test/test.apex staging_data_file
+/data/fonts/files font_data_file
+/data/fonts/files/test font_data_file
+/data/misc_ce system_userdir_file
+/data/misc_de system_userdir_file
+/data/system_ce system_userdir_file
+/data/system_de system_userdir_file
+/data/user system_userdir_file
+/data/user_de system_userdir_file
+
+/data/misc/adb adb_keys_file
+/data/misc/adb/test adb_keys_file
+/data/misc/a11ytrace accessibility_trace_data_file
+/data/misc/a11ytrace/test accessibility_trace_data_file
+/data/misc/apexdata apex_module_data_file
+/data/misc/apexdata/test apex_module_data_file
+/data/misc/apexdata/com.android.art apex_art_data_file
+/data/misc/apexdata/com.android.art/test apex_art_data_file
+/data/misc/apexdata/com.android.compos apex_compos_data_file
+/data/misc/apexdata/com.android.compos/test apex_compos_data_file
+/data/misc/apexdata/com.android.virt apex_virt_data_file
+/data/misc/apexdata/com.android.virt/test apex_virt_data_file
+/data/misc/apexdata/com.android.permission apex_system_server_data_file
+/data/misc/apexdata/com.android.permission/test apex_system_server_data_file
+/data/misc/apexdata/com.android.scheduling apex_system_server_data_file
+/data/misc/apexdata/com.android.scheduling/test apex_system_server_data_file
+/data/misc/apexdata/com.android.tethering apex_system_server_data_file
+/data/misc/apexdata/com.android.tethering/test apex_system_server_data_file
+/data/misc/apexdata/com.android.uwb apex_system_server_data_file
+/data/misc/apexdata/com.android.uwb/test apex_system_server_data_file
+/data/misc/apexdata/com.android.wifi apex_system_server_data_file
+/data/misc/apexdata/com.android.wifi/test apex_system_server_data_file
+/data/misc/apexrollback apex_rollback_data_file
+/data/misc/apexrollback/test apex_rollback_data_file
+/data/misc/apns radio_data_file
+/data/misc/apns/test radio_data_file
+/data/misc/appcompat appcompat_data_file
+/data/misc/appcompat/test appcompat_data_file
+/data/misc/audio audio_data_file
+/data/misc/audio/test audio_data_file
+/data/misc/audioserver audioserver_data_file
+/data/misc/audioserver/test audioserver_data_file
+/data/misc/audiohal audiohal_data_file
+/data/misc/audiohal/test audiohal_data_file
+/data/misc/bootstat bootstat_data_file
+/data/misc/bootstat/test bootstat_data_file
+/data/misc/boottrace boottrace_data_file
+/data/misc/boottrace/test boottrace_data_file
+/data/misc/bluetooth bluetooth_data_file
+/data/misc/bluetooth/test bluetooth_data_file
+/data/misc/bluetooth/logs bluetooth_logs_data_file
+/data/misc/bluetooth/logs/test bluetooth_logs_data_file
+/data/misc/bluedroid bluetooth_data_file
+/data/misc/bluedroid/test bluetooth_data_file
+/data/misc/bluedroid/.a2dp_ctrl bluetooth_socket
+/data/misc/bluedroid/.a2dp_data bluetooth_socket
+/data/misc/camera camera_data_file
+/data/misc/camera/test camera_data_file
+/data/misc/carrierid radio_data_file
+/data/misc/carrierid/test radio_data_file
+/data/misc/dhcp dhcp_data_file
+/data/misc/dhcp/test dhcp_data_file
+/data/misc/dhcp-6.8.2 dhcp_data_file
+/data/misc/dhcp-6.8.2/test dhcp_data_file
+/data/misc/dmesgd dmesgd_data_file
+/data/misc/dmesgd/test dmesgd_data_file
+/data/misc/emergencynumberdb emergency_data_file
+/data/misc/emergencynumberdb/test emergency_data_file
+/data/misc/gatekeeper gatekeeper_data_file
+/data/misc/gatekeeper/test gatekeeper_data_file
+/data/misc/incidents incident_data_file
+/data/misc/incidents/test incident_data_file
+/data/misc/installd install_data_file
+/data/misc/installd/test install_data_file
+/data/misc/keychain keychain_data_file
+/data/misc/keychain/test keychain_data_file
+/data/misc/credstore credstore_data_file
+/data/misc/credstore/test credstore_data_file
+/data/misc/keystore keystore_data_file
+/data/misc/keystore/test keystore_data_file
+/data/misc/logd misc_logd_file
+/data/misc/logd/test misc_logd_file
+/data/misc/media media_data_file
+/data/misc/media/test media_data_file
+/data/misc/net net_data_file
+/data/misc/net/test net_data_file
+/data/misc/network_watchlist network_watchlist_data_file
+/data/misc/network_watchlist/test network_watchlist_data_file
+/data/misc/nfc/logs nfc_logs_data_file
+/data/misc/nfc/logs/test nfc_logs_data_file
+/data/misc/odrefresh odrefresh_data_file
+/data/misc/odrefresh/test odrefresh_data_file
+/data/misc/odsign odsign_data_file
+/data/misc/odsign/test odsign_data_file
+/data/misc/odsign/metrics odsign_metrics_file
+/data/misc/odsign/metrics/test odsign_metrics_file
+/data/misc/perfetto-traces/bugreport perfetto_traces_bugreport_data_file
+/data/misc/perfetto-traces/bugreport/test perfetto_traces_bugreport_data_file
+/data/misc/perfetto-traces perfetto_traces_data_file
+/data/misc/perfetto-traces/test perfetto_traces_data_file
+/data/misc/perfetto-configs perfetto_configs_data_file
+/data/misc/perfetto-configs/test perfetto_configs_data_file
+/data/misc/prereboot prereboot_data_file
+/data/misc/prereboot/test prereboot_data_file
+/data/misc/profcollectd profcollectd_data_file
+/data/misc/profcollectd/test profcollectd_data_file
+/data/misc/radio radio_core_data_file
+/data/misc/radio/test radio_core_data_file
+/data/misc/recovery recovery_data_file
+/data/misc/recovery/test recovery_data_file
+/data/misc/shared_relro shared_relro_file
+/data/misc/shared_relro/test shared_relro_file
+/data/misc/sms radio_data_file
+/data/misc/sms/test radio_data_file
+/data/misc/snapshotctl_log snapshotctl_log_data_file
+/data/misc/snapshotctl_log/test snapshotctl_log_data_file
+/data/misc/stats-active-metric stats_data_file
+/data/misc/stats-active-metric/test stats_data_file
+/data/misc/stats-data stats_data_file
+/data/misc/stats-data/test stats_data_file
+/data/misc/stats-service stats_config_data_file
+/data/misc/stats-service/test stats_config_data_file
+/data/misc/stats-metadata stats_data_file
+/data/misc/stats-metadata/test stats_data_file
+/data/misc/systemkeys systemkeys_data_file
+/data/misc/systemkeys/test systemkeys_data_file
+/data/misc/textclassifier textclassifier_data_file
+/data/misc/textclassifier/test textclassifier_data_file
+/data/misc/threadnetwork threadnetwork_data_file
+/data/misc/threadnetwork/test threadnetwork_data_file
+/data/misc/train-info stats_data_file
+/data/misc/train-info/test stats_data_file
+/data/misc/user misc_user_data_file
+/data/misc/user/test misc_user_data_file
+/data/misc/virtualizationservice virtualizationservice_data_file
+/data/misc/virtualizationservice/test virtualizationservice_data_file
+/data/misc/vpn vpn_data_file
+/data/misc/vpn/test vpn_data_file
+/data/misc/wifi wifi_data_file
+/data/misc/wifi/test wifi_data_file
+/data/misc_ce/0/wifi wifi_data_file
+/data/misc_ce/99/wifi/test wifi_data_file
+/data/misc/wifi/sockets wpa_socket
+/data/misc/wifi/sockets/test wpa_socket
+/data/misc/wifi/sockets/wpa_ctrl_test system_wpa_socket
+/data/misc/wifi/sockets/wpa_ctrl.rc system_wpa_socket
+/data/misc/vold vold_data_file
+/data/misc/vold/test vold_data_file
+/data/misc/update_engine update_engine_data_file
+/data/misc/update_engine/test update_engine_data_file
+/data/misc/update_engine_log update_engine_log_data_file
+/data/misc/update_engine_log/test update_engine_log_data_file
+/data/misc/snapuserd_log snapuserd_log_data_file
+/data/misc/snapuserd_log/test snapuserd_log_data_file
+/data/system/dropbox dropbox_data_file
+/data/system/dropbox/test dropbox_data_file
+/data/system/heapdump heapdump_data_file
+/data/system/heapdump/test heapdump_data_file
+/data/misc/trace method_trace_data_file
+/data/misc/trace/test method_trace_data_file
+/data/misc/wmtrace wm_trace_data_file
+/data/misc/wmtrace/test wm_trace_data_file
+/data/misc/profiles/cur/0 user_profile_root_file
+/data/misc/profiles/cur/9 user_profile_root_file
+/data/misc/profiles/cur/0/test user_profile_data_file
+/data/misc/profiles/ref user_profile_data_file
+/data/misc/profiles/ref/test user_profile_data_file
+/data/misc/profman profman_dump_data_file
+/data/misc/profman/test profman_dump_data_file
+/data/vendor vendor_data_file
+/data/vendor/test vendor_data_file
+/data/vendor_ce vendor_userdir_file
+/data/vendor_ce/test vendor_data_file
+/data/vendor_de vendor_userdir_file
+/data/vendor_de/test vendor_data_file
+
+/data/misc_de/0/storaged storaged_data_file
+/data/misc_de/99/storaged/test storaged_data_file
+/data/misc_ce/0/storaged storaged_data_file
+/data/misc_ce/99/storaged/test storaged_data_file
+
+/data/misc_ce/0/checkin checkin_data_file
+/data/misc_ce/99/checkin/test checkin_data_file
+
+/data/system/users/0/fpdata fingerprintd_data_file
+/data/system/users/99/fpdata/test fingerprintd_data_file
+/data/vendor_de/0/fpdata fingerprint_vendor_data_file
+/data/vendor_de/99/fpdata/test fingerprint_vendor_data_file
+/data/vendor_de/0/facedata face_vendor_data_file
+/data/vendor_de/99/facedata/test face_vendor_data_file
+/data/vendor_ce/0/facedata face_vendor_data_file
+/data/vendor_ce/99/facedata/test face_vendor_data_file
+/data/vendor_de/0/irisdata iris_vendor_data_file
+/data/vendor_de/99/irisdata/test iris_vendor_data_file
+
+/data/bootchart bootchart_data_file
+/data/bootchart/test bootchart_data_file
+
+/data/misc_de/0/sdksandbox sdk_sandbox_system_data_file
+/data/misc_de/99/sdksandbox sdk_sandbox_system_data_file
+/data/misc_ce/0/sdksandbox sdk_sandbox_system_data_file
+/data/misc_ce/99/sdksandbox sdk_sandbox_system_data_file
+
+/data/misc_de/0/rollback rollback_data_file
+/data/misc_de/99/rollback/test rollback_data_file
+/data/misc_ce/0/rollback rollback_data_file
+/data/misc_ce/99/rollback/test rollback_data_file
+
+/data/misc_de/0/apexdata apex_module_data_file
+/data/misc_de/99/apexdata/test apex_module_data_file
+/data/misc_ce/0/apexdata apex_module_data_file
+/data/misc_ce/99/apexdata/test apex_module_data_file
+/data/misc_ce/0/apexdata/com.android.appsearch apex_system_server_data_file
+/data/misc_ce/99/apexdata/com.android.appsearch/test apex_system_server_data_file
+/data/misc_de/0/apexdata/com.android.permission apex_system_server_data_file
+/data/misc_de/99/apexdata/com.android.permission/test apex_system_server_data_file
+/data/misc_ce/0/apexdata/com.android.permission apex_system_server_data_file
+/data/misc_ce/99/apexdata/com.android.permission/test apex_system_server_data_file
+/data/misc_de/0/apexdata/com.android.wifi apex_system_server_data_file
+/data/misc_de/99/apexdata/com.android.wifi/test apex_system_server_data_file
+/data/misc_ce/0/apexdata/com.android.wifi apex_system_server_data_file
+/data/misc_ce/99/apexdata/com.android.wifi/test apex_system_server_data_file
+/data/misc_de/0/apexdata/com.android.uwb apex_system_server_data_file
+/data/misc_de/99/apexdata/com.android.uwb/test apex_system_server_data_file
+/data/misc_ce/0/apexdata/com.android.uwb apex_system_server_data_file
+/data/misc_ce/99/apexdata/com.android.uwb/test apex_system_server_data_file
+
+/data/misc_de/0/apexrollback apex_rollback_data_file
+/data/misc_de/99/apexrollback/test apex_rollback_data_file
+/data/misc_ce/0/apexrollback apex_rollback_data_file
+/data/misc_ce/99/apexrollback/test apex_rollback_data_file
+
+/data/incremental apk_data_file
+/data/incremental/test apk_data_file
+/data/incremental/MT_test/mount/.pending_reads incremental_control_file
+/data/incremental/MT_test/mount/.log incremental_control_file
+/data/incremental/MT_test/mount/.blocks_written incremental_control_file
+
+/data/misc/bootanim bootanim_data_file
+/data/misc/bootanim/test bootanim_data_file
+/mnt/expand mnt_expand_file
+/mnt/expand/does_not_exist system_data_file
+/mnt/expand/test/test system_data_file
+/mnt/expand/test/app apk_data_file
+/mnt/expand/test/app/test apk_data_file
+/mnt/expand/test/app/test/oat dalvikcache_data_file
+/mnt/expand/test/app/test/oat/test dalvikcache_data_file
+/mnt/expand/test/app/test/test/oat dalvikcache_data_file
+/mnt/expand/test/app/test/test/oat/test dalvikcache_data_file
+/mnt/expand/test/app/vmdltest.tmp apk_tmp_file
+/mnt/expand/test/app/vmdltest.tmp/test apk_tmp_file
+/mnt/expand/test/app/vmdltest.tmp/oat dalvikcache_data_file
+/mnt/expand/test/app/vmdltest.tmp/oat/test dalvikcache_data_file
+/mnt/expand/test/local/tmp shell_data_file
+/mnt/expand/test/local/tmp/test shell_data_file
+/mnt/expand/test/media media_userdir_file
+/mnt/expand/test/media/test media_rw_data_file
+/mnt/expand/test/misc/vold vold_data_file
+/mnt/expand/test/misc/vold/test vold_data_file
+/mnt/expand/test/misc_ce system_userdir_file
+/mnt/expand/test/misc_de system_userdir_file
+/mnt/expand/test/user system_userdir_file
+/mnt/expand/test/user_de system_userdir_file
+
+/cores coredump_file
+/cores/test coredump_file
+
+/data/system/users/0/wallpaper_lock_orig wallpaper_file
+/data/system/users/99/wallpaper_lock wallpaper_file
+/data/system/users/0/wallpaper_orig wallpaper_file
+/data/system/users/10/wallpaper wallpaper_file
+
+/data/system_de/0/ringtones ringtone_file
+/data/system_de/0/ringtones/test ringtone_file
+
+/data/system_ce/0/shortcut_service/bitmaps shortcut_manager_icons
+/data/system_ce/9/shortcut_service/bitmaps/test shortcut_manager_icons
+
+/data/system/users/10/photo.png icon_file
+
+/data/system/shutdown-checkpoints shutdown_checkpoints_system_data_file
+/data/system/shutdown-checkpoints/test shutdown_checkpoints_system_data_file
+
+/data/misc_de/0/vold vold_data_file
+/data/misc_de/99/vold/test vold_data_file
+/data/misc_ce/0/vold vold_data_file
+/data/misc_ce/99/vold/test vold_data_file
+
+/data/system_ce/0/backup backup_data_file
+/data/system_ce/99/backup/test backup_data_file
+/data/system_ce/0/backup_stage backup_data_file
+/data/system_ce/99/backup_stage/test backup_data_file
+
+/efs efs_file
+/efs/test efs_file
+
+/cache cache_file
+/cache/test cache_file
+/cache/recovery cache_recovery_file
+/cache/recovery/test cache_recovery_file
+/cache/backup_stage cache_backup_file
+/cache/backup_stage/test cache_backup_file
+/cache/backup cache_private_backup_file
+/cache/backup/test cache_private_backup_file
+
+/cache/overlay overlayfs_file
+/cache/overlay/test overlayfs_file
+/mnt/scratch overlayfs_file
+/mnt/scratch/test overlayfs_file
+
+/data/cache cache_file
+/data/cache/test cache_file
+/data/cache/recovery cache_recovery_file
+/data/cache/recovery/test cache_recovery_file
+/data/cache/backup_stage cache_backup_file
+/data/cache/backup_stage/test cache_backup_file
+/data/cache/backup cache_private_backup_file
+/data/cache/backup/test cache_private_backup_file
+
+/metadata metadata_file
+/metadata/test metadata_file
+/metadata/apex apex_metadata_file
+/metadata/apex/test apex_metadata_file
+/metadata/vold vold_metadata_file
+/metadata/vold/test vold_metadata_file
+/metadata/gsi gsi_metadata_file
+/metadata/gsi/test gsi_metadata_file
+/metadata/gsi/dsu/active gsi_public_metadata_file
+/metadata/gsi/dsu/booted gsi_public_metadata_file
+/metadata/gsi/dsu/lp_names gsi_public_metadata_file
+/metadata/gsi/dsu/test/metadata_encryption_dir gsi_public_metadata_file
+/metadata/gsi/ota ota_metadata_file
+/metadata/gsi/ota/test ota_metadata_file
+/metadata/password_slots password_slot_metadata_file
+/metadata/password_slots/test password_slot_metadata_file
+/metadata/ota ota_metadata_file
+/metadata/ota/test ota_metadata_file
+/metadata/bootstat metadata_bootstat_file
+/metadata/bootstat/test metadata_bootstat_file
+/metadata/staged-install staged_install_file
+/metadata/staged-install/test staged_install_file
+/metadata/userspacereboot userspace_reboot_metadata_file
+/metadata/userspacereboot/test userspace_reboot_metadata_file
+/metadata/watchdog watchdog_metadata_file
+/metadata/watchdog/test watchdog_metadata_file
+/metadata/repair-mode repair_mode_metadata_file
+/metadata/repair-mode/test repair_mode_metadata_file
+
+/mnt/asec asec_apk_file
+/mnt/asec/test asec_apk_file
+/mnt/asec/test/test.zip asec_public_file
+/mnt/asec/test/lib asec_public_file
+/mnt/asec/test/lib/test asec_public_file
+/data/app-asec asec_image_file
+/data/app-asec/test asec_image_file
+
+/mnt/media_rw mnt_media_rw_file
+/mnt/media_rw/test mnt_media_rw_file
+/mnt/user mnt_user_file
+/mnt/user/test mnt_user_file
+/mnt/pass_through mnt_pass_through_file
+/mnt/pass_through/test mnt_pass_through_file
+/mnt/sdcard mnt_sdcard_file
+/mnt/runtime storage_file
+/mnt/runtime/test storage_file
+/storage storage_file
+/storage/test storage_file
+
+/mnt/vendor mnt_vendor_file
+/mnt/vendor/test mnt_vendor_file
+
+/mnt/product mnt_product_file
+/mnt/product/test mnt_product_file
+
+/system/bin/check_dynamic_partitions postinstall_exec
+/product/bin/check_dynamic_partitions postinstall_exec
+/system/bin/otapreopt_script postinstall_exec
+/product/bin/otapreopt_script postinstall_exec
+/system/bin/otapreopt postinstall_dexopt_exec
+/product/bin/otapreopt postinstall_dexopt_exec
diff --git a/definitions.mk b/definitions.mk
deleted file mode 100644
index 63c4d94..0000000
--- a/definitions.mk
+++ /dev/null
@@ -1,39 +0,0 @@
-# Command to turn collection of policy files into a policy.conf file to be
-# processed by checkpolicy
-define transform-policy-to-conf
-@mkdir -p $(dir $@)
-$(hide) $(M4) --fatal-warnings $(PRIVATE_ADDITIONAL_M4DEFS) \
- -D mls_num_sens=$(PRIVATE_MLS_SENS) -D mls_num_cats=$(PRIVATE_MLS_CATS) \
- -D target_build_variant=$(PRIVATE_TARGET_BUILD_VARIANT) \
- -D target_with_dexpreopt=$(WITH_DEXPREOPT) \
- -D target_arch=$(PRIVATE_TGT_ARCH) \
- -D target_with_asan=$(PRIVATE_TGT_WITH_ASAN) \
- -D target_with_native_coverage=$(PRIVATE_TGT_WITH_NATIVE_COVERAGE) \
- -D target_full_treble=$(PRIVATE_SEPOLICY_SPLIT) \
- -D target_compatible_property=$(PRIVATE_COMPATIBLE_PROPERTY) \
- -D target_treble_sysprop_neverallow=$(PRIVATE_TREBLE_SYSPROP_NEVERALLOW) \
- -D target_enforce_sysprop_owner=$(PRIVATE_ENFORCE_SYSPROP_OWNER) \
- -D target_exclude_build_test=$(PRIVATE_EXCLUDE_BUILD_TEST) \
- -D target_requires_insecure_execmem_for_swiftshader=$(PRODUCT_REQUIRES_INSECURE_EXECMEM_FOR_SWIFTSHADER) \
- -D target_enforce_debugfs_restriction=$(PRIVATE_ENFORCE_DEBUGFS_RESTRICTION) \
- $(PRIVATE_TGT_RECOVERY) \
- -s $(PRIVATE_POLICY_FILES) > $@
-endef
-.KATI_READONLY := transform-policy-to-conf
-
-###########################################################
-## Collect file_contexts files into a single tmp file with m4
-##
-## $(1): list of file_contexts files
-## $(2): filename into which file_contexts files are merged
-###########################################################
-
-define _merge-fc-files
-$(2): $(1) $(M4)
- $(hide) mkdir -p $$(dir $$@)
- $(hide) $(M4) --fatal-warnings -s $(1) > $$@
-endef
-
-define merge-fc-files
-$(eval $(call _merge-fc-files,$(1),$(2)))
-endef
diff --git a/microdroid/system/private/file.te b/microdroid/system/private/file.te
index c6ed654..62ca9b7 100644
--- a/microdroid/system/private/file.te
+++ b/microdroid/system/private/file.te
@@ -14,10 +14,6 @@
type authfs_fuse, fs_type, contextmount_type;
-# /dev/selinux/test - used to verify that apex sepolicy is loaded and
-# property labeled.
-type sepolicy_test_file, file_type;
-
# /system/bin/mke2fs - used to format encryptedstore block device
type e2fs_exec, system_file_type, exec_type, file_type;
diff --git a/microdroid/system/private/file_contexts b/microdroid/system/private/file_contexts
index 3498680..046f20f 100644
--- a/microdroid/system/private/file_contexts
+++ b/microdroid/system/private/file_contexts
@@ -59,6 +59,7 @@
/dev/socket/adbd u:object_r:adbd_socket:s0
/dev/socket/prng_seeder u:object_r:prng_seeder_socket:s0
/dev/socket/property_service u:object_r:property_socket:s0
+/dev/socket/property_service_for_system u:object_r:property_socket:s0
/dev/socket/statsdw u:object_r:statsdw_socket:s0
/dev/socket/authfs_service u:object_r:authfs_service_socket:s0
/dev/socket/vm_payload_service u:object_r:vm_payload_service_socket:s0
@@ -71,7 +72,9 @@
/dev/vsock u:object_r:vsock_device:s0
/dev/zero u:object_r:zero_device:s0
/dev/__properties__ u:object_r:properties_device:s0
+/dev/__properties__/appcompat_override u:object_r:properties_device:s0
/dev/__properties__/property_info u:object_r:property_info:s0
+/dev/__properties__/appcompat_override/property_info u:object_r:property_info:s0
#############################
# Linker configuration
#
diff --git a/microdroid/system/private/init.te b/microdroid/system/private/init.te
index f4541a3..896590d 100644
--- a/microdroid/system/private/init.te
+++ b/microdroid/system/private/init.te
@@ -32,11 +32,11 @@
# /dev/__null__ node created by init.
allow init tmpfs:chr_file { create setattr unlink rw_file_perms };
-# /dev/__properties__
+# /dev/__properties__ and /dev/__properties__/appcompat_override
allow init properties_device:dir relabelto;
allow init properties_serial:file { write relabelto };
allow init property_type:file { append create getattr map open read relabelto rename setattr unlink write };
-# /dev/__properties__/property_info
+# /dev/__properties__/property_info and /dev/__properties__/appcompat_override/property_info
allow init properties_device:file create_file_perms;
allow init property_info:file relabelto;
# /dev/socket
diff --git a/microdroid/system/private/kernel.te b/microdroid/system/private/kernel.te
index e81173d..1d03c4a 100644
--- a/microdroid/system/private/kernel.te
+++ b/microdroid/system/private/kernel.te
@@ -81,16 +81,3 @@
#-----------------------------------------
allow kernel apkdmverity:fd use;
-
-# Some contexts are changed before the device is flipped into enforcing mode
-# during the setup of Apex sepolicy. These denials can be suppressed since
-# the permissions should not be allowed after the device is flipped into
-# enforcing mode.
-dontaudit kernel device:dir { open read relabelto };
-dontaudit kernel tmpfs:file { getattr open read relabelfrom };
-dontaudit kernel {
- file_contexts_file
- property_contexts_file
- sepolicy_test_file
- service_contexts_file
-}:file relabelto;
diff --git a/policy_version.mk b/policy_version.mk
deleted file mode 100644
index e6bb747..0000000
--- a/policy_version.mk
+++ /dev/null
@@ -1,4 +0,0 @@
-# SELinux policy version.
-# Must be <= /sys/fs/selinux/policyvers reported by the Android kernel.
-# Must be within the compatibility range reported by checkpolicy -V.
-POLICYVERS ?= 30
diff --git a/prebuilts/api/29.0/Android.bp b/prebuilts/api/29.0/Android.bp
index 34052a2..fd2099f 100644
--- a/prebuilts/api/29.0/Android.bp
+++ b/prebuilts/api/29.0/Android.bp
@@ -26,3 +26,53 @@
secilc_check: false,
installable: false,
}
+
+se_policy_conf {
+ name: "29.0_product_pub_policy.conf",
+ srcs: [
+ ":se_build_files{.plat_public_29.0}",
+ ":se_build_files{.system_ext_public_29.0}",
+ ":se_build_files{.product_public_29.0}",
+ ":se_build_files{.reqd_mask}",
+ ],
+ installable: false,
+ build_variant: "user",
+}
+
+se_policy_cil {
+ name: "29.0_product_pub_policy.cil",
+ src: ":29.0_product_pub_policy.conf",
+ filter_out: [":reqd_policy_mask.cil"],
+ secilc_check: false,
+ installable: false,
+}
+
+se_policy_conf {
+ name: "29.0_plat_policy.conf",
+ srcs: [
+ ":se_build_files{.plat_public_29.0}",
+ ":se_build_files{.plat_private_29.0}",
+ ":se_build_files{.system_ext_public_29.0}",
+ ":se_build_files{.system_ext_private_29.0}",
+ ":se_build_files{.product_public_29.0}",
+ ":se_build_files{.product_private_29.0}",
+ ],
+ installable: false,
+ build_variant: "user",
+}
+
+se_policy_cil {
+ name: "29.0_plat_policy.cil",
+ src: ":29.0_plat_policy.conf",
+ additional_cil_files: [":sepolicy_technical_debt{.plat_private_29.0}"],
+ installable: false,
+}
+
+se_policy_binary {
+ name: "29.0_plat_policy",
+ srcs: [":29.0_plat_policy.cil"],
+ installable: false,
+ dist: {
+ targets: ["base-sepolicy-files-for-mapping"],
+ },
+}
diff --git a/prebuilts/api/30.0/Android.bp b/prebuilts/api/30.0/Android.bp
index 0e51bb7..b958de0 100644
--- a/prebuilts/api/30.0/Android.bp
+++ b/prebuilts/api/30.0/Android.bp
@@ -26,3 +26,53 @@
secilc_check: false,
installable: false,
}
+
+se_policy_conf {
+ name: "30.0_product_pub_policy.conf",
+ srcs: [
+ ":se_build_files{.plat_public_30.0}",
+ ":se_build_files{.system_ext_public_30.0}",
+ ":se_build_files{.product_public_30.0}",
+ ":se_build_files{.reqd_mask}",
+ ],
+ installable: false,
+ build_variant: "user",
+}
+
+se_policy_cil {
+ name: "30.0_product_pub_policy.cil",
+ src: ":30.0_product_pub_policy.conf",
+ filter_out: [":reqd_policy_mask.cil"],
+ secilc_check: false,
+ installable: false,
+}
+
+se_policy_conf {
+ name: "30.0_plat_policy.conf",
+ srcs: [
+ ":se_build_files{.plat_public_30.0}",
+ ":se_build_files{.plat_private_30.0}",
+ ":se_build_files{.system_ext_public_30.0}",
+ ":se_build_files{.system_ext_private_30.0}",
+ ":se_build_files{.product_public_30.0}",
+ ":se_build_files{.product_private_30.0}",
+ ],
+ installable: false,
+ build_variant: "user",
+}
+
+se_policy_cil {
+ name: "30.0_plat_policy.cil",
+ src: ":30.0_plat_policy.conf",
+ additional_cil_files: [":sepolicy_technical_debt{.plat_private_30.0}"],
+ installable: false,
+}
+
+se_policy_binary {
+ name: "30.0_plat_policy",
+ srcs: [":30.0_plat_policy.cil"],
+ installable: false,
+ dist: {
+ targets: ["base-sepolicy-files-for-mapping"],
+ },
+}
diff --git a/prebuilts/api/31.0/Android.bp b/prebuilts/api/31.0/Android.bp
index 5697173..dbb07b4 100644
--- a/prebuilts/api/31.0/Android.bp
+++ b/prebuilts/api/31.0/Android.bp
@@ -26,3 +26,53 @@
secilc_check: false,
installable: false,
}
+
+se_policy_conf {
+ name: "31.0_product_pub_policy.conf",
+ srcs: [
+ ":se_build_files{.plat_public_31.0}",
+ ":se_build_files{.system_ext_public_31.0}",
+ ":se_build_files{.product_public_31.0}",
+ ":se_build_files{.reqd_mask}",
+ ],
+ installable: false,
+ build_variant: "user",
+}
+
+se_policy_cil {
+ name: "31.0_product_pub_policy.cil",
+ src: ":31.0_product_pub_policy.conf",
+ filter_out: [":reqd_policy_mask.cil"],
+ secilc_check: false,
+ installable: false,
+}
+
+se_policy_conf {
+ name: "31.0_plat_policy.conf",
+ srcs: [
+ ":se_build_files{.plat_public_31.0}",
+ ":se_build_files{.plat_private_31.0}",
+ ":se_build_files{.system_ext_public_31.0}",
+ ":se_build_files{.system_ext_private_31.0}",
+ ":se_build_files{.product_public_31.0}",
+ ":se_build_files{.product_private_31.0}",
+ ],
+ installable: false,
+ build_variant: "user",
+}
+
+se_policy_cil {
+ name: "31.0_plat_policy.cil",
+ src: ":31.0_plat_policy.conf",
+ additional_cil_files: [":sepolicy_technical_debt{.plat_private_31.0}"],
+ installable: false,
+}
+
+se_policy_binary {
+ name: "31.0_plat_policy",
+ srcs: [":31.0_plat_policy.cil"],
+ installable: false,
+ dist: {
+ targets: ["base-sepolicy-files-for-mapping"],
+ },
+}
diff --git a/prebuilts/api/32.0/Android.bp b/prebuilts/api/32.0/Android.bp
index 723f743..39722b4 100644
--- a/prebuilts/api/32.0/Android.bp
+++ b/prebuilts/api/32.0/Android.bp
@@ -26,3 +26,53 @@
secilc_check: false,
installable: false,
}
+
+se_policy_conf {
+ name: "32.0_product_pub_policy.conf",
+ srcs: [
+ ":se_build_files{.plat_public_32.0}",
+ ":se_build_files{.system_ext_public_32.0}",
+ ":se_build_files{.product_public_32.0}",
+ ":se_build_files{.reqd_mask}",
+ ],
+ installable: false,
+ build_variant: "user",
+}
+
+se_policy_cil {
+ name: "32.0_product_pub_policy.cil",
+ src: ":32.0_product_pub_policy.conf",
+ filter_out: [":reqd_policy_mask.cil"],
+ secilc_check: false,
+ installable: false,
+}
+
+se_policy_conf {
+ name: "32.0_plat_policy.conf",
+ srcs: [
+ ":se_build_files{.plat_public_32.0}",
+ ":se_build_files{.plat_private_32.0}",
+ ":se_build_files{.system_ext_public_32.0}",
+ ":se_build_files{.system_ext_private_32.0}",
+ ":se_build_files{.product_public_32.0}",
+ ":se_build_files{.product_private_32.0}",
+ ],
+ installable: false,
+ build_variant: "user",
+}
+
+se_policy_cil {
+ name: "32.0_plat_policy.cil",
+ src: ":32.0_plat_policy.conf",
+ additional_cil_files: [":sepolicy_technical_debt{.plat_private_32.0}"],
+ installable: false,
+}
+
+se_policy_binary {
+ name: "32.0_plat_policy",
+ srcs: [":32.0_plat_policy.cil"],
+ installable: false,
+ dist: {
+ targets: ["base-sepolicy-files-for-mapping"],
+ },
+}
diff --git a/prebuilts/api/33.0/Android.bp b/prebuilts/api/33.0/Android.bp
index df4da89..9bc68c6 100644
--- a/prebuilts/api/33.0/Android.bp
+++ b/prebuilts/api/33.0/Android.bp
@@ -26,3 +26,53 @@
secilc_check: false,
installable: false,
}
+
+se_policy_conf {
+ name: "33.0_product_pub_policy.conf",
+ srcs: [
+ ":se_build_files{.plat_public_33.0}",
+ ":se_build_files{.system_ext_public_33.0}",
+ ":se_build_files{.product_public_33.0}",
+ ":se_build_files{.reqd_mask}",
+ ],
+ installable: false,
+ build_variant: "user",
+}
+
+se_policy_cil {
+ name: "33.0_product_pub_policy.cil",
+ src: ":33.0_product_pub_policy.conf",
+ filter_out: [":reqd_policy_mask.cil"],
+ secilc_check: false,
+ installable: false,
+}
+
+se_policy_conf {
+ name: "33.0_plat_policy.conf",
+ srcs: [
+ ":se_build_files{.plat_public_33.0}",
+ ":se_build_files{.plat_private_33.0}",
+ ":se_build_files{.system_ext_public_33.0}",
+ ":se_build_files{.system_ext_private_33.0}",
+ ":se_build_files{.product_public_33.0}",
+ ":se_build_files{.product_private_33.0}",
+ ],
+ installable: false,
+ build_variant: "user",
+}
+
+se_policy_cil {
+ name: "33.0_plat_policy.cil",
+ src: ":33.0_plat_policy.conf",
+ additional_cil_files: [":sepolicy_technical_debt{.plat_private_33.0}"],
+ installable: false,
+}
+
+se_policy_binary {
+ name: "33.0_plat_policy",
+ srcs: [":33.0_plat_policy.cil"],
+ installable: false,
+ dist: {
+ targets: ["base-sepolicy-files-for-mapping"],
+ },
+}
diff --git a/prebuilts/api/34.0/Android.bp b/prebuilts/api/34.0/Android.bp
index e962848..499a342 100644
--- a/prebuilts/api/34.0/Android.bp
+++ b/prebuilts/api/34.0/Android.bp
@@ -26,3 +26,53 @@
secilc_check: false,
installable: false,
}
+
+se_policy_conf {
+ name: "34.0_product_pub_policy.conf",
+ srcs: [
+ ":se_build_files{.plat_public_34.0}",
+ ":se_build_files{.system_ext_public_34.0}",
+ ":se_build_files{.product_public_34.0}",
+ ":se_build_files{.reqd_mask}",
+ ],
+ installable: false,
+ build_variant: "user",
+}
+
+se_policy_cil {
+ name: "34.0_product_pub_policy.cil",
+ src: ":34.0_product_pub_policy.conf",
+ filter_out: [":reqd_policy_mask.cil"],
+ secilc_check: false,
+ installable: false,
+}
+
+se_policy_conf {
+ name: "34.0_plat_policy.conf",
+ srcs: [
+ ":se_build_files{.plat_public_34.0}",
+ ":se_build_files{.plat_private_34.0}",
+ ":se_build_files{.system_ext_public_34.0}",
+ ":se_build_files{.system_ext_private_34.0}",
+ ":se_build_files{.product_public_34.0}",
+ ":se_build_files{.product_private_34.0}",
+ ],
+ installable: false,
+ build_variant: "user",
+}
+
+se_policy_cil {
+ name: "34.0_plat_policy.cil",
+ src: ":34.0_plat_policy.conf",
+ additional_cil_files: [":sepolicy_technical_debt{.plat_private_34.0}"],
+ installable: false,
+}
+
+se_policy_binary {
+ name: "34.0_plat_policy",
+ srcs: [":34.0_plat_policy.cil"],
+ installable: false,
+ dist: {
+ targets: ["base-sepolicy-files-for-mapping"],
+ },
+}
diff --git a/prebuilts/api/34.0/private/compat/33.0/33.0.ignore.cil b/prebuilts/api/34.0/private/compat/33.0/33.0.ignore.cil
index fa6712f..069d06a 100644
--- a/prebuilts/api/34.0/private/compat/33.0/33.0.ignore.cil
+++ b/prebuilts/api/34.0/private/compat/33.0/33.0.ignore.cil
@@ -59,6 +59,7 @@
quick_start_prop
recovery_usb_config_prop
remote_provisioning_service
+ repair_mode_metadata_file
rkpdapp
servicemanager_prop
shutdown_checkpoints_system_data_file
diff --git a/prebuilts/api/34.0/private/file_contexts b/prebuilts/api/34.0/private/file_contexts
index ac2ab12..0caddf2 100644
--- a/prebuilts/api/34.0/private/file_contexts
+++ b/prebuilts/api/34.0/private/file_contexts
@@ -841,6 +841,7 @@
/metadata/staged-install(/.*)? u:object_r:staged_install_file:s0
/metadata/userspacereboot(/.*)? u:object_r:userspace_reboot_metadata_file:s0
/metadata/watchdog(/.*)? u:object_r:watchdog_metadata_file:s0
+/metadata/repair-mode(/.*)? u:object_r:repair_mode_metadata_file:s0
#############################
# asec containers
diff --git a/prebuilts/api/34.0/private/property_contexts b/prebuilts/api/34.0/private/property_contexts
index d38dd4c..2c7557f 100644
--- a/prebuilts/api/34.0/private/property_contexts
+++ b/prebuilts/api/34.0/private/property_contexts
@@ -1326,6 +1326,7 @@
ro.surface_flinger.display_update_imminent_timeout_ms u:object_r:surfaceflinger_prop:s0 exact int
ro.surface_flinger.uclamp.min u:object_r:surfaceflinger_prop:s0 exact int
ro.surface_flinger.ignore_hdr_camera_layers u:object_r:surfaceflinger_prop:s0 exact bool
+ro.surface_flinger.clear_slots_with_set_layer_buffer u:object_r:surfaceflinger_prop:s0 exact bool
ro.sf.disable_triple_buffer u:object_r:surfaceflinger_prop:s0 exact bool
ro.sf.lcd_density u:object_r:surfaceflinger_prop:s0 exact int
diff --git a/prebuilts/api/34.0/private/system_server.te b/prebuilts/api/34.0/private/system_server.te
index 98d859c..aff4a0a 100644
--- a/prebuilts/api/34.0/private/system_server.te
+++ b/prebuilts/api/34.0/private/system_server.te
@@ -1441,6 +1441,9 @@
allow system_server watchdog_metadata_file:dir rw_dir_perms;
allow system_server watchdog_metadata_file:file create_file_perms;
+allow system_server repair_mode_metadata_file:dir rw_dir_perms;
+allow system_server repair_mode_metadata_file:file create_file_perms;
+
allow system_server gsi_persistent_data_file:dir rw_dir_perms;
allow system_server gsi_persistent_data_file:file create_file_perms;
diff --git a/prebuilts/api/34.0/public/file.te b/prebuilts/api/34.0/public/file.te
index da76aee..7cfd8ad 100644
--- a/prebuilts/api/34.0/public/file.te
+++ b/prebuilts/api/34.0/public/file.te
@@ -287,6 +287,8 @@
type staged_install_file, file_type;
# Metadata information within /metadata/watchdog
type watchdog_metadata_file, file_type;
+# Repair mode files within /metadata/repair-mode
+type repair_mode_metadata_file, file_type;
# Type for /dev/cpu_variant:.*.
type dev_cpu_variant, file_type;
diff --git a/private/access_vectors b/private/access_vectors
index adb3a61..32d73dd 100644
--- a/private/access_vectors
+++ b/private/access_vectors
@@ -726,6 +726,7 @@
early_boot_ended
get_attestation_key
get_auth_token
+ get_last_auth_time
get_state
list
lock
diff --git a/private/apexd.te b/private/apexd.te
index f158ef6..b62e6e6 100644
--- a/private/apexd.te
+++ b/private/apexd.te
@@ -13,14 +13,6 @@
allow apexd apex_metadata_file:dir create_dir_perms;
allow apexd apex_metadata_file:file create_file_perms;
-# Allow creating and writing APEX files/dirs in the SEPolicy metadata dir
-allow apexd sepolicy_metadata_file:dir create_dir_perms;
-allow apexd sepolicy_metadata_file:file create_file_perms;
-# Allow apexd to setup fs-verity for SEPolicy files in metadata
-allowxperm apexd sepolicy_metadata_file:file ioctl {
- FS_IOC_ENABLE_VERITY FS_IOC_MEASURE_VERITY
-};
-
# Allow reserving space on /data/apex/ota_reserved for apex decompression
allow apexd apex_ota_reserved_file:dir create_dir_perms;
allow apexd apex_ota_reserved_file:file create_file_perms;
diff --git a/private/app.te b/private/app.te
index 59d9a5f..19cb2e0 100644
--- a/private/app.te
+++ b/private/app.te
@@ -176,11 +176,9 @@
control_logd({ appdomain -isolated_app_all -ephemeral_app -sdk_sandbox_all })
# application inherit logd write socket (urge is to deprecate this long term)
-allow { appdomain -isolated_app_all -ephemeral_app -sdk_sandbox_all } keystore:keystore_key { get_state get insert delete exist list sign verify };
allow { appdomain -isolated_app_all -ephemeral_app -sdk_sandbox_all } keystore:keystore2_key { delete use get_info rebind update };
allow { appdomain -isolated_app_all -ephemeral_app -sdk_sandbox_all } keystore_maintenance_service:service_manager find;
-allow { appdomain -isolated_app_all -ephemeral_app -sdk_sandbox_all } keystore:keystore2 get_state;
use_keystore({ appdomain -isolated_app_all -ephemeral_app -sdk_sandbox_all })
@@ -429,8 +427,8 @@
allow appdomain shared_relro_file:file r_file_perms;
# Allow apps to read/execute installed binaries
-allow appdomain apk_data_file:dir r_dir_perms;
-allow appdomain apk_data_file:file rx_file_perms;
+allow appdomain apk_data_file:dir { open getattr read search ioctl lock };
+allow appdomain apk_data_file:file { getattr open read ioctl lock map x_file_perms };
# /data/resource-cache
allow appdomain resourcecache_data_file:file r_file_perms;
@@ -532,3 +530,23 @@
appdomain
-device_as_webcam
} video_device:chr_file { read write };
+
+# Prevent calling inotify on APKs. This can be used as a side channel
+# to observer app launches, so it must be disallowed. b/231587164
+# Gate by targetSdkVersion to avoid breaking existing apps.
+neverallow {
+ appdomain
+ -untrusted_app_25
+ -untrusted_app_27
+ -untrusted_app_29
+ -untrusted_app_30
+ -untrusted_app_32
+} apk_data_file:dir { watch watch_reads };
+neverallow {
+ appdomain
+ -untrusted_app_25
+ -untrusted_app_27
+ -untrusted_app_29
+ -untrusted_app_30
+ -untrusted_app_32
+} apk_data_file:file { watch watch_reads };
diff --git a/private/app_zygote.te b/private/app_zygote.te
index e3869cd..46cea8e 100644
--- a/private/app_zygote.te
+++ b/private/app_zygote.te
@@ -34,6 +34,8 @@
# Interaction between the app_zygote and its children.
allow app_zygote isolated_app:process setpgid;
+allow app_zygote properties_device:dir mounton;
+
# TODO (b/63631799) fix this access
dontaudit app_zygote mnt_expand_file:dir getattr;
diff --git a/private/artd.te b/private/artd.te
index 3b234bf..acab397 100644
--- a/private/artd.te
+++ b/private/artd.te
@@ -137,3 +137,8 @@
# This is needed for getting CPU time and wall time spent on subprocesses.
r_dir_file(artd, profman);
r_dir_file(artd, dex2oat);
+
+# Allow artd to reopen its own memfd.
+# artd needs to reopen a memfd with readonly in order to pass it to subprocesses
+# that don't have write permissions on memfds.
+allow artd artd_tmpfs:file open;
diff --git a/private/attributes b/private/attributes
index 77143a3..fe50b0d 100644
--- a/private/attributes
+++ b/private/attributes
@@ -13,4 +13,5 @@
# All SDK sandbox domains
attribute sdk_sandbox_all;
-
+# The SDK sandbox domains for the current SDK level.
+attribute sdk_sandbox_current;
diff --git a/private/binderservicedomain.te b/private/binderservicedomain.te
index 21349df..b8ae9f4 100644
--- a/private/binderservicedomain.te
+++ b/private/binderservicedomain.te
@@ -18,8 +18,6 @@
# allow all services to run permission checks
allow binderservicedomain permission_service:service_manager find;
-allow binderservicedomain keystore:keystore_key { get_state get insert delete exist list sign verify };
-allow binderservicedomain keystore:keystore2 { get_state };
allow binderservicedomain keystore:keystore2_key { delete get_info rebind use };
use_keystore(binderservicedomain)
diff --git a/private/bootanim.te b/private/bootanim.te
index 2b3c807..f63a230 100644
--- a/private/bootanim.te
+++ b/private/bootanim.te
@@ -18,3 +18,6 @@
# Allow accessing /data/misc/bootanim
r_dir_file(bootanim, bootanim_data_file)
+
+# Allow accessing vendor apex for EGL/GLES
+allow bootanim vendor_apex_metadata_file:dir r_dir_perms;
diff --git a/private/bootstat.te b/private/bootstat.te
index 016292e..99d8c6d 100644
--- a/private/bootstat.te
+++ b/private/bootstat.te
@@ -17,6 +17,7 @@
-dumpstate
userdebug_or_eng(`-incidentd')
-init
+ -platform_app
-recovery
-shell
-system_server
diff --git a/private/bpfloader.te b/private/bpfloader.te
index eecda30..0ad2c6b 100644
--- a/private/bpfloader.te
+++ b/private/bpfloader.te
@@ -41,7 +41,8 @@
neverallow { domain -bpfloader -netd -network_stack -system_server } fs_bpf_netd_readonly:file { getattr read };
neverallow { domain -bpfloader -netd -netutils_wrapper -network_stack -system_server } fs_bpf_netd_shared:file { getattr read };
neverallow { domain -bpfloader -network_stack } fs_bpf_tethering:file { getattr read };
-neverallow { domain -bpfloader -gpuservice -netd -netutils_wrapper -network_stack -system_server } { bpffs_type -fs_bpf_vendor }:file write;
+neverallow { domain -bpfloader -uprobestats } fs_bpf_uprobe_private:file { getattr read };
+neverallow { domain -bpfloader -gpuservice -netd -netutils_wrapper -network_stack -system_server -uprobestats } { bpffs_type -fs_bpf_vendor }:file write;
neverallow { domain -bpfloader } bpffs_type:lnk_file ~read;
neverallow { domain -bpfdomain } bpffs_type:lnk_file read;
@@ -62,8 +63,9 @@
-netutils_wrapper
-network_stack
-system_server
+ -uprobestats
} *:bpf prog_run;
-neverallow { domain -bpfloader -gpuservice -lmkd -mediaprovider_app -netd -network_stack -system_server } *:bpf { map_read map_write };
+neverallow { domain -bpfloader -gpuservice -lmkd -mediaprovider_app -netd -network_stack -system_server -uprobestats } *:bpf { map_read map_write };
neverallow { domain -bpfloader -init } bpfloader_exec:file { execute execute_no_trans };
neverallow { coredomain -bpfloader } fs_bpf_vendor:file *;
diff --git a/private/bug_map b/private/bug_map
index 0a1d741..3a78a40 100644
--- a/private/bug_map
+++ b/private/bug_map
@@ -1,6 +1,7 @@
dnsmasq netd fifo_file b/77868789
dnsmasq netd unix_stream_socket b/77868789
gmscore_app system_data_file dir b/146166941
+gmscore_app kernel security b/303319090
init app_data_file file b/77873135
init cache_file blk_file b/77873135
init logpersist file b/77873135
@@ -18,8 +19,12 @@
mediaprovider cache_file blk_file b/77925342
mediaprovider mnt_media_rw_file dir b/77925342
mediaprovider shell_data_file dir b/77925342
+mediaprovider_app device_config_media_native_prop file b/308043377
mediaswcodec ashmem_device chr_file b/142679232
+nfc device_config_media_native_prop file b/308043377
+platform_app device_config_media_native_prop file b/308043377
platform_app nfc_data_file dir b/74331887
+platform_app system_data_file dir b/306090533
system_server overlayfs_file file b/142390309
system_server sdcardfs file b/77856826
system_server system_server capability b/228030183
@@ -28,4 +33,4 @@
untrusted_app untrusted_app netlink_route_socket b/155595000
vold system_data_file file b/124108085
zygote untrusted_app_25 process b/77925912
-zygote labeledfs filesystem b/170748799
+zygote labeledfs filesystem b/170748799
\ No newline at end of file
diff --git a/private/cameraserver.te b/private/cameraserver.te
index 96d7dbd..76ffba6 100644
--- a/private/cameraserver.te
+++ b/private/cameraserver.te
@@ -7,3 +7,4 @@
allow cameraserver gpu_device:chr_file rw_file_perms;
allow cameraserver gpu_device:dir r_dir_perms;
+allow cameraserver virtual_camera:binder call;
diff --git a/private/compat/29.0/29.0.cil b/private/compat/29.0/29.0.cil
index 7315687..408cf33 100644
--- a/private/compat/29.0/29.0.cil
+++ b/private/compat/29.0/29.0.cil
@@ -1,13 +1,15 @@
;; types removed from current policy
(type ashmemd)
+(type clatd_exec)
+(type clatd)
(type exported_audio_prop)
(type exported_dalvik_prop)
(type exported_vold_prop)
(type exported2_config_prop)
(type exported2_vold_prop)
(type hal_wifi_offload_hwservice)
-(type install_recovery)
(type install_recovery_exec)
+(type install_recovery)
(type mediacodec_service)
(type perfprofd_data_file)
(type perfprofd_service)
diff --git a/private/compat/30.0/30.0.cil b/private/compat/30.0/30.0.cil
index 83d83ff..f95488c 100644
--- a/private/compat/30.0/30.0.cil
+++ b/private/compat/30.0/30.0.cil
@@ -1,11 +1,16 @@
;; types removed from current policy
+(type adbd_prop)
(type cgroup_bpf)
+(type device_config_configuration_prop)
+(type device_config_storage_native_boot_prop)
+(type device_config_sys_traced_prop)
+(type device_config_window_manager_native_boot_prop)
(type exported_audio_prop)
(type exported_dalvik_prop)
(type exported_ffs_prop)
(type exported_fingerprint_prop)
-(type exported_system_radio_prop)
(type exported_radio_prop)
+(type exported_system_radio_prop)
(type exported_vold_prop)
(type exported_wifi_prop)
(type exported2_config_prop)
@@ -16,8 +21,19 @@
(type exported3_default_prop)
(type exported3_radio_prop)
(type ffs_prop)
+(type gsid_prop)
+(type init_perf_lsm_hooks_prop)
+(type init_svc_debug_prop)
+(type last_boot_reason_prop)
+(type mediatranscoding_exec)
+(type netd_stable_secret_prop)
+(type pm_prop)
+(type system_adbd_prop)
(type system_radio_prop)
(type thermalcallback_hwservice)
+(type traced_perf_enabled_prop)
+(type userspace_reboot_log_prop)
+(type userspace_reboot_test_prop)
(typeattribute binder_in_vendor_violators)
diff --git a/private/compat/33.0/33.0.ignore.cil b/private/compat/33.0/33.0.ignore.cil
index 618bb11..ea4ed5d 100644
--- a/private/compat/33.0/33.0.ignore.cil
+++ b/private/compat/33.0/33.0.ignore.cil
@@ -29,6 +29,7 @@
fwk_altitude_service
fwk_camera_service
fwk_sensor_service
+ game_manager_config_prop
grammatical_inflection_service
graphics_config_writable_prop
hal_bluetooth_service
@@ -63,6 +64,7 @@
quick_start_prop
recovery_usb_config_prop
remote_provisioning_service
+ repair_mode_metadata_file
rkpdapp
servicemanager_prop
shutdown_checkpoints_system_data_file
diff --git a/private/compat/34.0/34.0.ignore.cil b/private/compat/34.0/34.0.ignore.cil
index e16be89..ddaa7e2 100644
--- a/private/compat/34.0/34.0.ignore.cil
+++ b/private/compat/34.0/34.0.ignore.cil
@@ -9,9 +9,22 @@
dtbo_block_device
ota_build_prop
snapuserd_log_data_file
+ hal_authgraph_service
+ vibrator_control_service
+ hal_codec2_service
+ hal_macsec_service
hal_threadnetwork_service
virtual_camera_service
ot_daemon_service
remote_auth_service
+ security_state_service
+ sysfs_sync_on_suspend
threadnetwork_service
+ device_config_aconfig_flags_prop
+ proc_memhealth
+ virtual_device_native_service
+ next_boot_prop
+ binderfs_logs_stats
+ drm_forcel3_prop
+ proc_percpu_pagelist_high_fraction
))
diff --git a/private/domain.te b/private/domain.te
index 692c962..0861fa5 100644
--- a/private/domain.te
+++ b/private/domain.te
@@ -214,7 +214,6 @@
} self:global_capability_class_set sys_ptrace;
# Limit ability to generate hardware unique device ID attestations to priv_apps
-neverallow { domain -priv_app -gmscore_app } *:keystore_key gen_unique_id;
neverallow { domain -priv_app -gmscore_app } *:keystore2_key gen_unique_id;
neverallow { domain -system_server } *:keystore2_key use_dev_id;
neverallow { domain -system_server } keystore:keystore2 { clear_ns lock reset unlock };
@@ -668,6 +667,7 @@
userdebug_or_eng(`
-init
-hal_dumpstate
+ -incidentd
')
} { debugfs_type
userdebug_or_eng(`-debugfs_kcov')
@@ -678,6 +678,16 @@
# Restrict write access to etm sysfs interface.
neverallow { domain -ueventd -vendor_init } sysfs_devices_cs_etm:file no_w_file_perms;
+# Restrict CAP_PERFMON.
+neverallow {
+ domain
+ -init
+ -vendor_modprobe
+ userdebug_or_eng(`-simpleperf_boot')
+ -kernel
+ -uprobestats
+} self:capability2 perfmon;
+
# Restrict direct access to shell owned files. The /data/local/tmp directory is
# untrustworthy, and non-allowed domains should not be trusting any content in
# those directories. We allow shell files to be passed around by file
diff --git a/private/dumpstate.te b/private/dumpstate.te
index b369797..18924ca 100644
--- a/private/dumpstate.te
+++ b/private/dumpstate.te
@@ -56,6 +56,9 @@
binder_call(dumpstate, profcollectd)
')
+# Allow dumpstate to talk to automotive_display_service over binder
+binder_call(dumpstate, automotive_display_service)
+
# Collect metrics on boot time created by init
get_prop(dumpstate, boottime_prop)
diff --git a/private/file.te b/private/file.te
index efdf4d1..f4c3e2d 100644
--- a/private/file.te
+++ b/private/file.te
@@ -8,6 +8,7 @@
type fs_bpf_netd_readonly, fs_type, bpffs_type;
type fs_bpf_netd_shared, fs_type, bpffs_type;
type fs_bpf_loader, fs_type, bpffs_type;
+type fs_bpf_uprobe_private, fs_type, bpffs_type;
# /data/misc/storaged
type storaged_data_file, file_type, data_file_type, core_data_file_type;
@@ -117,13 +118,6 @@
# /apex/com.android.compos/bin/compos_key_helper
type compos_key_helper_exec, exec_type, file_type, system_file_type;
-# /metadata/sepolicy
-type sepolicy_metadata_file, file_type;
-
-# /dev/selinux/test - used to verify that apex sepolicy is loaded and
-# property labeled.
-type sepolicy_test_file, file_type;
-
# /apex/com.android.art/bin/art_exec
# This executable does not have its own domain because it is executed in the caller's domain. For
# example, it is executed in the `artd` domain when artd calls it.
@@ -142,3 +136,6 @@
# Type for /system/fonts/font_fallback.xm
type system_font_fallback_file, system_file_type, file_type;
+
+# Type for /sys/devices/uprobe.
+type sysfs_uprobe, fs_type, sysfs_type;
diff --git a/private/file_contexts b/private/file_contexts
index 6ac2400..2481c07 100644
--- a/private/file_contexts
+++ b/private/file_contexts
@@ -155,6 +155,7 @@
/dev/socket/pdx/system/vr/display/vsync u:object_r:pdx_display_vsync_endpoint_socket:s0
/dev/socket/prng_seeder u:object_r:prng_seeder_socket:s0
/dev/socket/property_service u:object_r:property_socket:s0
+/dev/socket/property_service_for_system u:object_r:property_socket:s0
/dev/socket/racoon u:object_r:racoon_socket:s0
/dev/socket/recovery u:object_r:recovery_socket:s0
/dev/socket/rild u:object_r:rild_socket:s0
@@ -199,20 +200,14 @@
/dev/xt_qtaguid u:object_r:qtaguid_device:s0
/dev/zero u:object_r:zero_device:s0
/dev/__properties__ u:object_r:properties_device:s0
+/dev/__properties__/appcompat_override u:object_r:properties_device:s0
/dev/__properties__/property_info u:object_r:property_info:s0
+/dev/__properties__/appcompat_override/property_info u:object_r:property_info:s0
#############################
# Linker configuration
#
/linkerconfig(/.*)? u:object_r:linkerconfig_file:s0
-# Apex sepoolicy files.
-/dev/selinux/apex_file_contexts u:object_r:file_contexts_file:s0
-/dev/selinux/apex_seapp_contexts u:object_r:seapp_contexts_file:s0
-/dev/selinux/apex_service_contexts u:object_r:service_contexts_file:s0
-/dev/selinux/apex_property_contexts u:object_r:property_contexts_file:s0
-/dev/selinux/apex_hwservice_contexts u:object_r:hwservice_contexts_file:s0
-/dev/selinux/apex_mac_permissions\.xml u:object_r:mac_perms_file:s0
-
#############################
# System files
#
@@ -340,6 +335,7 @@
/system/bin/profcollectctl u:object_r:profcollectd_exec:s0
/system/bin/storaged u:object_r:storaged_exec:s0
/system/bin/virtual_touchpad u:object_r:virtual_touchpad_exec:s0
+/system/bin/virtual_camera u:object_r:virtual_camera_exec:s0
/system/bin/hw/android\.frameworks\.bufferhub@1\.0-service u:object_r:fwk_bufferhub_exec:s0
/system/bin/hw/android\.system\.suspend-service u:object_r:system_suspend_exec:s0
/system/etc/cgroups\.json u:object_r:cgroup_desc_file:s0
@@ -351,7 +347,7 @@
/system/etc/passwd u:object_r:system_passwd_file:s0
/system/etc/seccomp_policy(/.*)? u:object_r:system_seccomp_policy_file:s0
/system/etc/security/cacerts(/.*)? u:object_r:system_security_cacerts_file:s0
-/system/etc/selinux/mapping/[0-9]+\.[0-9]+\.cil u:object_r:sepolicy_file:s0
+/system/etc/selinux/mapping/[0-9]+\.[0-9]+(\.compat)?\.cil u:object_r:sepolicy_file:s0
/system/etc/selinux/plat_mac_permissions\.xml u:object_r:mac_perms_file:s0
/system/etc/selinux/plat_property_contexts u:object_r:property_contexts_file:s0
/system/etc/selinux/plat_service_contexts u:object_r:service_contexts_file:s0
@@ -369,7 +365,7 @@
/system/bin/stats u:object_r:stats_exec:s0
/system/bin/statsd u:object_r:statsd_exec:s0
/system/bin/bpfloader u:object_r:bpfloader_exec:s0
-/system/bin/btfloader u:object_r:bpfloader_exec:s0
+/system/bin/netbpfload u:object_r:bpfloader_exec:s0
/system/bin/watchdogd u:object_r:watchdogd_exec:s0
/system/bin/apexd u:object_r:apexd_exec:s0
/system/bin/gsid u:object_r:gsid_exec:s0
@@ -383,6 +379,7 @@
/system/bin/cardisplayproxyd u:object_r:automotive_display_service_exec:s0
/system/bin/evsmanagerd u:object_r:evsmanagerd_exec:s0
/system/bin/android\.automotive\.evs\.manager@1\.[0-9]+ u:object_r:evsmanagerd_exec:s0
+/system/bin/uprobestats u:object_r:uprobestats_exec:s0
#############################
# Vendor files
@@ -566,7 +563,6 @@
/data/gsi_persistent_data u:object_r:gsi_persistent_data_file:s0
/data/gsi/ota(/.*)? u:object_r:ota_image_data_file:s0
/data/tombstones(/.*)? u:object_r:tombstone_data_file:s0
-/data/vendor/tombstones/wifi(/.*)? u:object_r:tombstone_wifi_data_file:s0
/data/local/tests(/.*)? u:object_r:shell_test_data_file:s0
/data/local/tmp(/.*)? u:object_r:shell_data_file:s0
/data/local/tmp/ltp(/.*)? u:object_r:nativetest_data_file:s0
@@ -641,8 +637,8 @@
/data/misc/odrefresh(/.*)? u:object_r:odrefresh_data_file:s0
/data/misc/odsign(/.*)? u:object_r:odsign_data_file:s0
/data/misc/odsign/metrics(/.*)? u:object_r:odsign_metrics_file:s0
-/data/misc/perfetto-traces/bugreport(.*)? u:object_r:perfetto_traces_bugreport_data_file:s0
/data/misc/perfetto-traces(/.*)? u:object_r:perfetto_traces_data_file:s0
+/data/misc/perfetto-traces/bugreport(.*)? u:object_r:perfetto_traces_bugreport_data_file:s0
/data/misc/perfetto-configs(/.*)? u:object_r:perfetto_configs_data_file:s0
/data/misc/prereboot(/.*)? u:object_r:prereboot_data_file:s0
/data/misc/profcollectd(/.*)? u:object_r:profcollectd_data_file:s0
@@ -685,6 +681,7 @@
/data/vendor_ce/.* u:object_r:vendor_data_file:s0
/data/vendor_de u:object_r:vendor_userdir_file:s0
/data/vendor_de/.* u:object_r:vendor_data_file:s0
+/data/vendor/tombstones/wifi(/.*)? u:object_r:tombstone_wifi_data_file:s0
# storaged proto files
/data/misc_de/[0-9]+/storaged(/.*)? u:object_r:storaged_data_file:s0
@@ -843,10 +840,10 @@
/metadata/password_slots(/.*)? u:object_r:password_slot_metadata_file:s0
/metadata/ota(/.*)? u:object_r:ota_metadata_file:s0
/metadata/bootstat(/.*)? u:object_r:metadata_bootstat_file:s0
-/metadata/sepolicy(/.*)? u:object_r:sepolicy_metadata_file:s0
/metadata/staged-install(/.*)? u:object_r:staged_install_file:s0
/metadata/userspacereboot(/.*)? u:object_r:userspace_reboot_metadata_file:s0
/metadata/watchdog(/.*)? u:object_r:watchdog_metadata_file:s0
+/metadata/repair-mode(/.*)? u:object_r:repair_mode_metadata_file:s0
#############################
# asec containers
diff --git a/private/flags_health_check.te b/private/flags_health_check.te
index 64da97b..b7f5808 100644
--- a/private/flags_health_check.te
+++ b/private/flags_health_check.te
@@ -33,6 +33,8 @@
set_prop(flags_health_check, device_config_memory_safety_native_prop)
set_prop(flags_health_check, device_config_remote_key_provisioning_native_prop)
set_prop(flags_health_check, device_config_camera_native_prop)
+set_prop(flags_health_check, device_config_tethering_u_or_later_native_prop)
+set_prop(flags_health_check, next_boot_prop)
# system property device_config_boot_count_prop is used for deciding when to perform server
# configurable flags related disaster recovery. Mistakenly set up by unrelated components can, at a
diff --git a/private/genfs_contexts b/private/genfs_contexts
index 759ac38..41c60df 100644
--- a/private/genfs_contexts
+++ b/private/genfs_contexts
@@ -19,6 +19,7 @@
genfscon proc /locks u:object_r:proc_locks:s0
genfscon proc /lowmemorykiller u:object_r:proc_lowmemorykiller:s0
genfscon proc /meminfo u:object_r:proc_meminfo:s0
+genfscon proc /memhealth u:object_r:proc_memhealth:s0
genfscon proc /misc u:object_r:proc_misc:s0
genfscon proc /modules u:object_r:proc_modules:s0
genfscon proc /mounts u:object_r:proc_mounts:s0
@@ -91,6 +92,7 @@
genfscon proc /sys/vm/min_free_order_shift u:object_r:proc_min_free_order_shift:s0
genfscon proc /sys/vm/watermark_boost_factor u:object_r:proc_watermark_boost_factor:s0
genfscon proc /sys/vm/watermark_scale_factor u:object_r:proc_watermark_scale_factor:s0
+genfscon proc /sys/vm/percpu_pagelist_high_fraction u:object_r:proc_percpu_pagelist_high_fraction:s0
genfscon proc /timer_list u:object_r:proc_timer:s0
genfscon proc /timer_stats u:object_r:proc_timer:s0
genfscon proc /tty/drivers u:object_r:proc_tty_drivers:s0
@@ -156,6 +158,7 @@
genfscon sysfs /power/autosleep u:object_r:sysfs_power:s0
genfscon sysfs /power/state u:object_r:sysfs_power:s0
genfscon sysfs /power/suspend_stats u:object_r:sysfs_suspend_stats:s0
+genfscon sysfs /power/sync_on_suspend u:object_r:sysfs_sync_on_suspend:s0
genfscon sysfs /power/wakeup_count u:object_r:sysfs_power:s0
genfscon sysfs /power/wake_lock u:object_r:sysfs_wake_lock:s0
genfscon sysfs /power/wake_unlock u:object_r:sysfs_wake_lock:s0
@@ -176,6 +179,7 @@
genfscon sysfs /devices/virtual/timed_output/vibrator/enable u:object_r:sysfs_vibrator:s0
genfscon sysfs /devices/virtual/misc/uhid u:object_r:sysfs_uhid:s0
genfscon sysfs /kernel/vendor_sched u:object_r:sysfs_vendor_sched:s0
+genfscon sysfs /devices/uprobe u:object_r:sysfs_uprobe:s0
genfscon debugfs /kprobes u:object_r:debugfs_kprobes:s0
genfscon debugfs /mmc0 u:object_r:debugfs_mmc:s0
@@ -284,6 +288,8 @@
genfscon tracefs /events/binder/binder_unlock/ u:object_r:debugfs_tracing:s0
genfscon tracefs /events/binder/binder_transaction_alloc_buf/ u:object_r:debugfs_tracing:s0
genfscon tracefs /events/binder/binder_set_priority/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/binder/binder_command/ u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/binder/binder_return/ u:object_r:debugfs_tracing:s0
genfscon tracefs /events/lowmemorykiller/ u:object_r:debugfs_tracing:s0
genfscon tracefs /events/sync/ u:object_r:debugfs_tracing:s0
genfscon tracefs /events/fence/ u:object_r:debugfs_tracing:s0
@@ -349,6 +355,8 @@
genfscon debugfs /tracing/events/binder/binder_unlock/ u:object_r:debugfs_tracing:s0
genfscon debugfs /tracing/events/binder/binder_transaction_alloc_buf/ u:object_r:debugfs_tracing:s0
genfscon debugfs /tracing/events/binder/binder_set_priority/ u:object_r:debugfs_tracing:s0
+genfscon debugfs /tracing/events/binder/binder_command/ u:object_r:debugfs_tracing:s0
+genfscon debugfs /tracing/events/binder/binder_return/ u:object_r:debugfs_tracing:s0
genfscon debugfs /tracing/events/lowmemorykiller/ u:object_r:debugfs_tracing:s0
genfscon debugfs /tracing/events/sync/ u:object_r:debugfs_tracing:s0
genfscon debugfs /tracing/events/fence/ u:object_r:debugfs_tracing:s0
@@ -385,6 +393,7 @@
genfscon binder /vndbinder u:object_r:vndbinder_device:s0
genfscon binder /binder_logs u:object_r:binderfs_logs:s0
genfscon binder /binder_logs/proc u:object_r:binderfs_logs_proc:s0
+genfscon binder /binder_logs/stats u:object_r:binderfs_logs_stats:s0
genfscon binder /features u:object_r:binderfs_features:s0
genfscon inotifyfs / u:object_r:inotify:s0
@@ -410,3 +419,4 @@
genfscon bpf /netd_shared u:object_r:fs_bpf_netd_shared:s0
genfscon bpf /tethering u:object_r:fs_bpf_tethering:s0
genfscon bpf /vendor u:object_r:fs_bpf_vendor:s0
+genfscon bpf /uprobe_private u:object_r:fs_bpf_uprobe_private:s0
diff --git a/private/gmscore_app.te b/private/gmscore_app.te
index 46b90c6..859c2ec 100644
--- a/private/gmscore_app.te
+++ b/private/gmscore_app.te
@@ -36,7 +36,6 @@
allow gmscore_app perfetto_traces_data_file:file { read getattr };
# Allow GMS core to generate unique hardware IDs
-allow gmscore_app keystore:keystore_key gen_unique_id;
allow gmscore_app keystore:keystore2_key gen_unique_id;
# Allow GMS core to access /sys/fs/selinux/policyvers for compatibility check
@@ -46,6 +45,7 @@
dontaudit gmscore_app exec_type:file r_file_perms;
dontaudit gmscore_app device:dir r_dir_perms;
dontaudit gmscore_app fs_bpf:dir r_dir_perms;
+dontaudit gmscore_app kernel:security *;
dontaudit gmscore_app net_dns_prop:file r_file_perms;
dontaudit gmscore_app proc:file r_file_perms;
dontaudit gmscore_app proc_interrupts:file r_file_perms;
diff --git a/private/incidentd.te b/private/incidentd.te
index e86b3bf..bf98d31 100644
--- a/private/incidentd.te
+++ b/private/incidentd.te
@@ -29,9 +29,7 @@
allow incidentd proc_pagetypeinfo:file r_file_perms;
# section id 2002, allow reading /d/wakeup_sources
-no_debugfs_restriction(`
- allow incidentd debugfs_wakeup_sources:file r_file_perms;
-')
+userdebug_or_eng(`allow incidentd debugfs_wakeup_sources:file r_file_perms');
# section id 2003, allow executing top
allow incidentd proc_meminfo:file { open read };
diff --git a/private/isolated_compute_app.te b/private/isolated_compute_app.te
index d5e8a74..5d4070d 100644
--- a/private/isolated_compute_app.te
+++ b/private/isolated_compute_app.te
@@ -21,6 +21,8 @@
hal_client_domain(isolated_compute_app, hal_allocator)
hwbinder_use(isolated_compute_app)
+hal_client_domain(isolated_compute_app, hal_codec2)
+
allow isolated_compute_app dmabuf_system_heap_device:chr_file r_file_perms;
# Allow access to network sockets received over IPC. New socket creation is not
diff --git a/private/kernel.te b/private/kernel.te
index 03ba79f..2d46b3e 100644
--- a/private/kernel.te
+++ b/private/kernel.te
@@ -44,19 +44,3 @@
dontaudit kernel dm_user_device:chr_file { create setattr };
dontaudit kernel tmpfs:lnk_file read;
dontaudit kernel tmpfs:blk_file { open read };
-
-# Some contexts are changed before the device is flipped into enforcing mode
-# during the setup of Apex sepolicy. These denials can be suppressed since
-# the permissions should not be allowed after the device is flipped into
-# enforcing mode.
-dontaudit kernel device:dir { open read relabelto };
-dontaudit kernel tmpfs:file { getattr open read relabelfrom };
-dontaudit kernel {
- file_contexts_file
- hwservice_contexts_file
- mac_perms_file
- property_contexts_file
- seapp_contexts_file
- sepolicy_test_file
- service_contexts_file
-}:file relabelto;
diff --git a/private/keystore.te b/private/keystore.te
index cd2ef76..73961ac 100644
--- a/private/keystore.te
+++ b/private/keystore.te
@@ -26,7 +26,7 @@
# Allow keystore to write to statsd.
unix_socket_send(keystore, statsdw, statsd)
-# Keystore need access to the keystore_key context files to load the keystore key backend.
+# Keystore need access to the keystore2_key_contexts file to load the keystore key backend.
allow keystore keystore2_key_contexts_file:file r_file_perms;
# Allow keystore to listen to changing boot levels
diff --git a/private/keystore2_key_contexts b/private/keystore2_key_contexts
index 3833971..868bf15 100644
--- a/private/keystore2_key_contexts
+++ b/private/keystore2_key_contexts
@@ -4,10 +4,10 @@
# <namespace> <label>
#
# <namespace> must be an integer in the interval [0 ... 2^31)
-# su_key is a keystore_key namespace for the su domain intended for native tests.
+# su_key is a keystore2_key namespace for the su domain intended for native tests.
0 u:object_r:su_key:s0
-# shell_key is a keystore_key namespace for the shell domain intended for native tests.
+# shell_key is a keystore2_key namespace for the shell domain intended for native tests.
1 u:object_r:shell_key:s0
# vold_key is a keystore2_key namespace for vold. It allows using raw Keymint blobs.
diff --git a/private/network_stack.te b/private/network_stack.te
index d9135a1..84c8d4d 100644
--- a/private/network_stack.te
+++ b/private/network_stack.te
@@ -63,6 +63,8 @@
allow network_stack { fs_bpf_net_private fs_bpf_net_shared fs_bpf_netd_readonly fs_bpf_netd_shared fs_bpf_tethering }:dir search;
allow network_stack { fs_bpf_net_private fs_bpf_net_shared fs_bpf_netd_readonly fs_bpf_netd_shared fs_bpf_tethering }:file { getattr read write };
allow network_stack bpfloader:bpf { map_read map_write prog_run };
+# allow Tethering(network_stack process) to read flag value in tethering_u_or_later_native namespace
+get_prop(network_stack, device_config_tethering_u_or_later_native_prop)
# Use XFRM (IPsec) netlink sockets
allow network_stack self:netlink_xfrm_socket { create_socket_perms_no_ioctl nlmsg_write nlmsg_read };
diff --git a/private/ot_ctl.te b/private/ot_ctl.te
deleted file mode 100644
index 12e7ce2..0000000
--- a/private/ot_ctl.te
+++ /dev/null
@@ -1,11 +0,0 @@
-#
-# ot_ctl is the commandline tool for controling the native Thread network daemon (ot_daemon).
-#
-
-type ot_ctl, domain, coredomain;
-type ot_ctl_exec, exec_type, system_file_type, file_type;
-
-init_daemon_domain(ot_ctl)
-
-# Allow the ot_ctl to read/write the socket file.
-allow ot_ctl threadnetwork_data_file:sock_file {read write};
diff --git a/private/ot_daemon.te b/private/ot_daemon.te
index cdf5486..066d3d5 100644
--- a/private/ot_daemon.te
+++ b/private/ot_daemon.te
@@ -20,9 +20,15 @@
# Allow OT daemon to read/write the Thread tunnel interface
allow ot_daemon tun_device:chr_file {read write};
+# Allow OT daemon to read/write on the socket created by System Server
+allow ot_daemon system_server:rawip_socket rw_socket_perms_no_ioctl;
+
hal_client_domain(ot_daemon, hal_threadnetwork)
# Only ot_daemon can publish the binder service
binder_use(ot_daemon)
add_service(ot_daemon, ot_daemon_service)
binder_call(ot_daemon, system_server)
+
+# Allow OT daemon to write to statsd
+unix_socket_send(ot_daemon, statsdw, statsd)
diff --git a/private/platform_app.te b/private/platform_app.te
index 1bd0020..cd95353 100644
--- a/private/platform_app.te
+++ b/private/platform_app.te
@@ -116,6 +116,9 @@
# allow platform apps to read qemu.hw.mainkeys
get_prop(platform_app, qemu_hw_prop)
+# allow platform apps to read sys.boot.reason.last
+get_prop(platform_app, last_boot_reason_prop)
+
# allow platform apps to create symbolic link
allow platform_app app_data_file:lnk_file create_file_perms;
diff --git a/private/priv_app.te b/private/priv_app.te
index 52077ef..cadefe1 100644
--- a/private/priv_app.te
+++ b/private/priv_app.te
@@ -150,7 +150,7 @@
dontaudit priv_app sysfs:file read;
dontaudit priv_app sysfs_android_usb:file read;
dontaudit priv_app sysfs_dm:file r_file_perms;
-dontaudit priv_app { wifi_prop wifi_hal_prop }:file read;
+dontaudit priv_app { wifi_prop wifi_config_prop wifi_hal_prop }:file read;
# allow privileged apps to use UDP sockets provided by the system server but not
# modify them other than to connect
@@ -176,6 +176,9 @@
# allow privileged apps to read the vendor property that indicates if Incremental File System is enabled
get_prop(priv_app, incremental_prop)
+# allow privileged apps to read the device config flags.
+get_prop(priv_app, device_config_aconfig_flags_prop)
+
# Required for Phonesky to be able to read APEX files under /data/apex/active/.
allow priv_app apex_data_file:dir search;
allow priv_app staging_data_file:file r_file_perms;
diff --git a/private/profman.te b/private/profman.te
index 390f83e..7ad49b2 100644
--- a/private/profman.te
+++ b/private/profman.te
@@ -10,3 +10,8 @@
# Allow profman to use file descriptors passed from privileged programs.
allow profman { artd installd }:fd use;
+
+# Allow profman to read from memfd created by artd.
+# profman needs to read the embedded profile that artd extracts from an APK,
+# which is passed by a memfd.
+allow profman artd_tmpfs:file { getattr read map lock };
diff --git a/private/property.te b/private/property.te
index 90cfad2..e1b42a0 100644
--- a/private/property.te
+++ b/private/property.te
@@ -2,7 +2,6 @@
system_internal_prop(adbd_prop)
system_internal_prop(apexd_payload_metadata_prop)
system_internal_prop(ctl_snapuserd_prop)
-system_internal_prop(device_config_aconfig_flags_prop)
system_internal_prop(device_config_core_experiments_team_internal_prop)
system_internal_prop(device_config_lmkd_native_prop)
system_internal_prop(device_config_mglru_native_prop)
@@ -16,6 +15,7 @@
system_internal_prop(device_config_configuration_prop)
system_internal_prop(device_config_connectivity_prop)
system_internal_prop(device_config_swcodec_native_prop)
+system_internal_prop(device_config_tethering_u_or_later_native_prop)
system_internal_prop(dmesgd_start_prop)
system_internal_prop(fastbootd_protocol_prop)
system_internal_prop(gsid_prop)
@@ -31,6 +31,7 @@
system_internal_prop(net_464xlat_fromvendor_prop)
system_internal_prop(net_connectivity_prop)
system_internal_prop(netd_stable_secret_prop)
+system_internal_prop(next_boot_prop)
system_internal_prop(odsign_prop)
system_internal_prop(perf_drop_caches_prop)
system_internal_prop(pm_prop)
@@ -56,6 +57,7 @@
system_internal_prop(sensors_config_prop)
system_internal_prop(hypervisor_pvmfw_prop)
system_internal_prop(hypervisor_virtualizationmanager_prop)
+system_internal_prop(game_manager_config_prop)
# Properties which can't be written outside system
system_restricted_prop(device_config_virtualization_framework_native_prop)
diff --git a/private/property_contexts b/private/property_contexts
index 39dd3b5..69e4ec2 100644
--- a/private/property_contexts
+++ b/private/property_contexts
@@ -115,6 +115,7 @@
suspend.sleep_time_scale_factor u:object_r:suspend_prop:s0 exact double
suspend.failed_suspend_backoff_enabled u:object_r:suspend_prop:s0 exact bool
suspend.short_suspend_backoff_enabled u:object_r:suspend_prop:s0 exact bool
+suspend.disable_sync_on_suspend u:object_r:suspend_prop:s0 exact bool
# Fastbootd protocol control property
fastbootd.protocol u:object_r:fastbootd_protocol_prop:s0 exact enum usb tcp
@@ -276,6 +277,10 @@
persist.device_config.window_manager_native_boot. u:object_r:device_config_window_manager_native_boot_prop:s0
persist.device_config.memory_safety_native_boot. u:object_r:device_config_memory_safety_native_boot_prop:s0
persist.device_config.memory_safety_native. u:object_r:device_config_memory_safety_native_prop:s0
+persist.device_config.tethering_u_or_later_native. u:object_r:device_config_tethering_u_or_later_native_prop:s0
+
+# Properties that is for staging
+next_boot. u:object_r:next_boot_prop:s0
# F2FS smart idle maint prop
persist.device_config.storage_native_boot.smart_idle_maint_enabled u:object_r:smart_idle_maint_enabled_prop:s0 exact bool
@@ -411,6 +416,7 @@
ro.camera.enableCamera1MaxZsl u:object_r:camera_config_prop:s0 exact bool
ro.camera.disableJpegR u:object_r:camera_config_prop:s0 exact bool
ro.camera.enableCompositeAPI0JpegR u:object_r:camera_config_prop:s0 exact bool
+ro.camera.enableVirtualCamera u:object_r:camera_config_prop:s0 exact bool
ro.camerax.extensions.enabled u:object_r:camerax_extensions_prop:s0 exact bool
@@ -507,6 +513,7 @@
keyguard.no_require_sim u:object_r:keyguard_config_prop:s0 exact bool
media.c2.dmabuf.padding u:object_r:codec2_config_prop:s0 exact int
+media.c2.hal.selection u:object_r:codec2_config_prop:s0 exact enum aidl hidl
media.recorder.show_manufacturer_and_model u:object_r:media_config_prop:s0 exact bool
media.resolution.limit.32bit u:object_r:media_config_prop:s0 exact int
@@ -578,6 +585,7 @@
bluetooth.profile.pan.panu.enabled u:object_r:bluetooth_config_prop:s0 exact bool
bluetooth.profile.pbap.client.enabled u:object_r:bluetooth_config_prop:s0 exact bool
bluetooth.profile.pbap.server.enabled u:object_r:bluetooth_config_prop:s0 exact bool
+bluetooth.profile.pbap.sim.enabled u:object_r:bluetooth_config_prop:s0 exact bool
bluetooth.profile.sap.server.enabled u:object_r:bluetooth_config_prop:s0 exact bool
bluetooth.profile.vcp.controller.enabled u:object_r:bluetooth_config_prop:s0 exact bool
@@ -669,6 +677,7 @@
ro.config.alarm_alert u:object_r:systemsound_config_prop:s0 exact string
ro.config.alarm_vol_default u:object_r:systemsound_config_prop:s0 exact int
ro.config.alarm_vol_steps u:object_r:systemsound_config_prop:s0 exact int
+ro.config.assistant_vol_min u:object_r:systemsound_config_prop:s0 exact int
ro.config.media_vol_default u:object_r:systemsound_config_prop:s0 exact int
ro.config.media_vol_steps u:object_r:systemsound_config_prop:s0 exact int
ro.config.notification_sound u:object_r:systemsound_config_prop:s0 exact string
@@ -818,6 +827,7 @@
drm.64bit.enabled u:object_r:mediadrm_config_prop:s0 exact bool
media.mediadrmservice.enable u:object_r:mediadrm_config_prop:s0 exact bool
+persist.drm.forcel3.enabled u:object_r:drm_forcel3_prop:s0 exact bool
drm.service.enabled u:object_r:drm_service_config_prop:s0 exact bool
@@ -1337,6 +1347,8 @@
ro.surface_flinger.uclamp.min u:object_r:surfaceflinger_prop:s0 exact int
ro.surface_flinger.ignore_hdr_camera_layers u:object_r:surfaceflinger_prop:s0 exact bool
ro.surface_flinger.clear_slots_with_set_layer_buffer u:object_r:surfaceflinger_prop:s0 exact bool
+ro.surface_flinger.prime_shader_cache.ultrahdr u:object_r:surfaceflinger_prop:s0 exact bool
+ro.surface_flinger.game_default_frame_rate_override u:object_r:surfaceflinger_prop:s0 exact int
ro.sf.disable_triple_buffer u:object_r:surfaceflinger_prop:s0 exact bool
ro.sf.lcd_density u:object_r:surfaceflinger_prop:s0 exact int
@@ -1582,3 +1594,6 @@
# Properties for sensor service
sensors.aosp_low_power_sensor_fusion.maximum_rate u:object_r:sensors_config_prop:s0 exact uint
+
+# Propertues for game manager service
+persist.graphics.game_default_frame_rate.enabled u:object_r:game_manager_config_prop:s0 exact bool
diff --git a/private/sdk_sandbox_34.te b/private/sdk_sandbox_34.te
index d45da88..bb15057 100644
--- a/private/sdk_sandbox_34.te
+++ b/private/sdk_sandbox_34.te
@@ -3,89 +3,7 @@
###
### This file defines the security policy for the sdk sandbox processes
### for targetSdkVersion=34.
-type sdk_sandbox_34, domain, coredomain, sdk_sandbox_all;
+type sdk_sandbox_34, domain, coredomain, sdk_sandbox_all, sdk_sandbox_current;
net_domain(sdk_sandbox_34)
app_domain(sdk_sandbox_34)
-
-# Allow finding services. This is different from ephemeral_app policy.
-# Adding services manually to the allowlist is preferred hence app_api_service is not used.
-allow sdk_sandbox_34 {
- activity_service
- activity_task_service
- appops_service
- audio_service
- audioserver_service
- batteryproperties_service
- batterystats_service
- cameraserver_service
- connectivity_service
- connmetrics_service
- deviceidle_service
- display_service
- dropbox_service
- ephemeral_app_api_service
- font_service
- game_service
- gpu_service
- graphicsstats_service
- hardware_properties_service
- hint_service
- imms_service
- input_method_service
- input_service
- IProxyService_service
- ipsec_service
- launcherapps_service
- legacy_permission_service
- light_service
- locale_service
- media_communication_service
- mediadrmserver_service
- mediaextractor_service
- mediametrics_service
- media_projection_service
- media_router_service
- mediaserver_service
- media_session_service
- memtrackproxy_service
- midi_service
- netpolicy_service
- netstats_service
- network_management_service
- notification_service
- package_service
- permission_checker_service
- permission_service
- permissionmgr_service
- platform_compat_service
- power_service
- procstats_service
- radio_service
- registry_service
- restrictions_service
- rttmanager_service
- search_service
- selection_toolbar_service
- sensor_privacy_service
- sensorservice_service
- servicediscovery_service
- settings_service
- speech_recognition_service
- statusbar_service
- storagestats_service
- surfaceflinger_service
- telecom_service
- tethering_service
- textclassification_service
- textservices_service
- texttospeech_service
- thermal_service
- translation_service
- tv_iapp_service
- tv_input_service
- uimode_service
- vcn_management_service
- webviewupdate_service
-}:service_manager find;
-
diff --git a/private/sdk_sandbox_audit.te b/private/sdk_sandbox_audit.te
new file mode 100644
index 0000000..bb531ca
--- /dev/null
+++ b/private/sdk_sandbox_audit.te
@@ -0,0 +1,34 @@
+###
+### SDK Sandbox process.
+###
+### This file defines the audit sdk sandbox security policy for
+### the set of restrictions proposed for the next SDK level.
+###
+### The sdk_sandbox_audit domain has the same rules as the
+### sdk_sandbox_current domain and additional auditing rules
+### for the accesses we are considering forbidding in the upcoming
+### sdk_sandbox_next domain.
+type sdk_sandbox_audit, domain, coredomain, sdk_sandbox_all, sdk_sandbox_current;
+
+net_domain(sdk_sandbox_audit)
+app_domain(sdk_sandbox_audit)
+
+# Auditallow rules for accesses that are currently allowed but we
+# might remove in the future.
+
+auditallow sdk_sandbox_audit {
+ cameraserver_service
+ ephemeral_app_api_service
+ mediadrmserver_service
+ radio_service
+}:service_manager find;
+
+auditallow sdk_sandbox_audit {
+ property_type
+ -system_property_type
+}:file rw_file_perms;
+
+auditallow sdk_sandbox_audit {
+ property_type
+ -system_property_type
+}:dir rw_dir_perms;
diff --git a/private/sdk_sandbox_current.te b/private/sdk_sandbox_current.te
new file mode 100644
index 0000000..55e5bc1
--- /dev/null
+++ b/private/sdk_sandbox_current.te
@@ -0,0 +1,87 @@
+###
+### SDK Sandbox process.
+###
+### This file defines the security policy for the sdk sandbox processes
+### for the current SDK level.
+
+# Allow finding services. This is different from ephemeral_app policy.
+# Adding services manually to the allowlist is preferred hence app_api_service is not used.
+allow sdk_sandbox_current {
+ activity_service
+ activity_task_service
+ appops_service
+ audio_service
+ audioserver_service
+ batteryproperties_service
+ batterystats_service
+ cameraserver_service
+ connectivity_service
+ connmetrics_service
+ deviceidle_service
+ display_service
+ dropbox_service
+ ephemeral_app_api_service
+ font_service
+ game_service
+ gpu_service
+ graphicsstats_service
+ hardware_properties_service
+ hint_service
+ imms_service
+ input_method_service
+ input_service
+ IProxyService_service
+ ipsec_service
+ launcherapps_service
+ legacy_permission_service
+ light_service
+ locale_service
+ media_communication_service
+ mediadrmserver_service
+ mediaextractor_service
+ mediametrics_service
+ media_projection_service
+ media_router_service
+ mediaserver_service
+ media_session_service
+ memtrackproxy_service
+ midi_service
+ netpolicy_service
+ netstats_service
+ network_management_service
+ notification_service
+ package_service
+ permission_checker_service
+ permission_service
+ permissionmgr_service
+ platform_compat_service
+ power_service
+ procstats_service
+ radio_service
+ registry_service
+ restrictions_service
+ rttmanager_service
+ search_service
+ selection_toolbar_service
+ sensor_privacy_service
+ sensorservice_service
+ servicediscovery_service
+ settings_service
+ speech_recognition_service
+ statusbar_service
+ storagestats_service
+ surfaceflinger_service
+ telecom_service
+ tethering_service
+ textclassification_service
+ textservices_service
+ texttospeech_service
+ thermal_service
+ translation_service
+ tv_iapp_service
+ tv_input_service
+ uimode_service
+ vcn_management_service
+ webviewupdate_service
+}:service_manager find;
+
diff --git a/private/seapp_contexts b/private/seapp_contexts
index bc68209..74701df 100644
--- a/private/seapp_contexts
+++ b/private/seapp_contexts
@@ -13,6 +13,7 @@
# fromRunAs (boolean)
# isIsolatedComputeApp (boolean)
# isSdkSandboxNext (boolean)
+# isSdkSandboxAudit (boolean)
#
# All specified input selectors in an entry must match (i.e. logical AND).
# An unspecified string or boolean selector with no default will match any
@@ -49,10 +50,20 @@
# to provide isolated processes with relaxed security restrictions.
# An unspecified isIsolatedComputeApp defaults to false.
#
+# The sdk_sandbox_next and sdk_sandbox_audit domains are special domains for the
+# SDK sandbox process. sdk_sandbox_next defines the set of restrictions proposed
+# for the upcoming dessert release. sdk_sandbox_audit uses the same restrictions
+# as the current dessert release, with additional auditing rules for the accesses
+# we are considering forbidding in the upcoming release.
+#
# isSdkSandboxNext=true means sdk sandbox processes will get
# sdk_sandbox_next sepolicy applied to them.
# An unspecified isSdkSandboxNext defaults to false.
#
+# isSdkSandboxAudit=true means sdk sandbox processes will get
+# sdk_sandbox_audit sepolicy applied to them.
+# An unspecified isSdkSandboxAudit defaults to false.
+#
# Precedence: entries are compared using the following rules, in the order shown
# (see external/selinux/libselinux/src/android/android_platform.c,
# seapp_context_cmp()).
@@ -174,6 +185,7 @@
user=_isolated isIsolatedComputeApp=true domain=isolated_compute_app levelFrom=user
user=_sdksandbox domain=sdk_sandbox_34 type=sdk_sandbox_data_file levelFrom=all
user=_sdksandbox isSdkSandboxNext=true domain=sdk_sandbox_next type=sdk_sandbox_data_file levelFrom=all
+user=_sdksandbox isSdkSandboxAudit=true domain=sdk_sandbox_audit type=sdk_sandbox_data_file levelFrom=all
user=_app seinfo=app_zygote domain=app_zygote levelFrom=user
user=_app seinfo=media domain=mediaprovider type=app_data_file levelFrom=user
user=_app seinfo=platform domain=platform_app type=app_data_file levelFrom=user
diff --git a/private/service.te b/private/service.te
index ccb9e17..861afb3 100644
--- a/private/service.te
+++ b/private/service.te
@@ -23,3 +23,4 @@
type transparency_service, system_server_service, service_manager_type;
type vfio_handler_service, service_manager_type;
type uce_service, service_manager_type;
+type wearable_sensing_service, system_api_service, system_server_service, service_manager_type;
diff --git a/private/service_contexts b/private/service_contexts
index 71bd7e4..898cb14 100644
--- a/private/service_contexts
+++ b/private/service_contexts
@@ -51,6 +51,9 @@
android.hardware.input.processor.IInputProcessor/default u:object_r:hal_input_processor_service:s0
android.hardware.ir.IConsumerIr/default u:object_r:hal_ir_service:s0
android.hardware.light.ILights/default u:object_r:hal_light_service:s0
+android.hardware.macsec.IMacsecPskPlugin/default u:object_r:hal_macsec_service:s0
+android.hardware.media.c2.IComponentStore/default u:object_r:hal_codec2_service:s0
+android.hardware.media.c2.IComponentStore/software u:object_r:hal_codec2_service:s0
android.hardware.memtrack.IMemtrack/default u:object_r:hal_memtrack_service:s0
android.hardware.net.nlinterceptor.IInterceptor/default u:object_r:hal_nlinterceptor_service:s0
android.hardware.nfc.INfc/default u:object_r:hal_nfc_service:s0
@@ -87,6 +90,7 @@
android.hardware.radio.voice.IRadioVoice/slot2 u:object_r:hal_radio_service:s0
android.hardware.radio.voice.IRadioVoice/slot3 u:object_r:hal_radio_service:s0
android.hardware.rebootescrow.IRebootEscrow/default u:object_r:hal_rebootescrow_service:s0
+android.hardware.security.authgraph.IAuthGraphKeyExchange/nonsecure u:object_r:hal_authgraph_service:s0
android.hardware.security.keymint.IKeyMintDevice/default u:object_r:hal_keymint_service:s0
android.hardware.security.keymint.IRemotelyProvisionedComponent/default u:object_r:hal_remotelyprovisionedcomponent_service:s0
android.hardware.gatekeeper.IGatekeeper/default u:object_r:hal_gatekeeper_service:s0
@@ -366,6 +370,7 @@
search_ui u:object_r:search_ui_service:s0
secure_element u:object_r:secure_element_service:s0
sec_key_att_app_id_provider u:object_r:sec_key_att_app_id_provider_service:s0
+security_state u:object_r:security_state_service:s0
selection_toolbar u:object_r:selection_toolbar_service:s0
sensorservice u:object_r:sensorservice_service:s0
sensor_privacy u:object_r:sensor_privacy_service:s0
@@ -431,8 +436,10 @@
uwb u:object_r:uwb_service:s0
vcn_management u:object_r:vcn_management_service:s0
vibrator u:object_r:vibrator_service:s0
+vibrator_control u:object_r:vibrator_control_service:s0
vibrator_manager u:object_r:vibrator_manager_service:s0
virtualdevice u:object_r:virtual_device_service:s0
+virtualdevice_native u:object_r:virtual_device_native_service:s0
virtual_touchpad u:object_r:virtual_touchpad_service:s0
voiceinteraction u:object_r:voiceinteraction_service:s0
vold u:object_r:vold_service:s0
@@ -440,6 +447,7 @@
vrmanager u:object_r:vr_manager_service:s0
wallpaper u:object_r:wallpaper_service:s0
wallpaper_effects_generation u:object_r:wallpaper_effects_generation_service:s0
+wearable_sensing u:object_r:wearable_sensing_service:s0
webviewupdate u:object_r:webviewupdate_service:s0
wifip2p u:object_r:wifip2p_service:s0
wifiscanner u:object_r:wifiscanner_service:s0
diff --git a/private/shell.te b/private/shell.te
index 1b859d1..aa6bef8 100644
--- a/private/shell.te
+++ b/private/shell.te
@@ -250,3 +250,6 @@
# Allow shell to set persist.sysui.notification.ranking_update_ashmem property
userdebug_or_eng(`set_prop(shell, persist_sysui_ranking_update_prop)')
+# Allow shell to read the build properties for attestation feature
+get_prop(shell, build_attestation_prop)
+
diff --git a/private/system_app.te b/private/system_app.te
index d0d88e9..06b0feb 100644
--- a/private/system_app.te
+++ b/private/system_app.te
@@ -52,6 +52,7 @@
set_prop(system_app, usb_control_prop)
set_prop(system_app, usb_prop)
set_prop(system_app, log_tag_prop)
+set_prop(system_app, drm_forcel3_prop)
userdebug_or_eng(`set_prop(system_app, logpersistd_logging_prop)')
auditallow system_app net_radio_prop:property_service set;
auditallow system_app usb_control_prop:property_service set;
@@ -120,26 +121,6 @@
# Ignore access to zram when Debug.getMemInfo is called.
dontaudit system_app sysfs_zram:dir search;
-allow system_app keystore:keystore_key {
- get_state
- get
- insert
- delete
- exist
- list
- reset
- password
- lock
- unlock
- is_empty
- sign
- verify
- grant
- duplicate
- clear_uid
- user_changed
-};
-
allow system_app keystore:keystore2_key {
delete
get_info
diff --git a/private/system_server.te b/private/system_server.te
index 136db38..3d49a65 100644
--- a/private/system_server.te
+++ b/private/system_server.te
@@ -306,6 +306,7 @@
# Use HALs
hal_client_domain(system_server, hal_allocator)
hal_client_domain(system_server, hal_audio)
+hal_client_domain(system_server, hal_authgraph)
hal_client_domain(system_server, hal_authsecret)
hal_client_domain(system_server, hal_broadcastradio)
hal_client_domain(system_server, hal_codec2)
@@ -770,9 +771,13 @@
set_prop(system_server, device_config_memory_safety_native_boot_prop)
set_prop(system_server, device_config_memory_safety_native_prop)
set_prop(system_server, device_config_remote_key_provisioning_native_prop)
+set_prop(system_server, device_config_tethering_u_or_later_native_prop)
set_prop(system_server, smart_idle_maint_enabled_prop)
set_prop(system_server, arm64_memtag_prop)
+# staged flag properties
+set_prop(system_server, next_boot_prop)
+
# Allow query ART device config properties
get_prop(system_server, device_config_runtime_native_boot_prop)
get_prop(system_server, device_config_runtime_native_prop)
@@ -923,6 +928,9 @@
allow system_server sysfs_zram:dir search;
allow system_server sysfs_zram:file rw_file_perms;
+# Read /sys/fs/selinux/policy
+allow system_server kernel:security read_policy;
+
add_service(system_server, system_server_service);
allow system_server artd_service:service_manager find;
allow system_server audioserver_service:service_manager find;
@@ -969,34 +977,13 @@
add_service(system_server, batteryproperties_service)
-allow system_server keystore:keystore_key {
- get_state
- get
- insert
- delete
- exist
- list
- reset
- password
- lock
- unlock
- is_empty
- sign
- verify
- grant
- duplicate
- clear_uid
- add_auth
- user_changed
-};
-
allow system_server keystore:keystore2 {
add_auth
change_password
change_user
clear_ns
clear_uid
- get_state
+ get_last_auth_time
lock
pull_metrics
reset
@@ -1114,7 +1101,7 @@
allow system_server toolbox_exec:file rx_file_perms;
# Allow system process to setup fs-verity
-allowxperm system_server { apk_data_file system_data_file apex_system_server_data_file }:file ioctl FS_IOC_ENABLE_VERITY;
+allowxperm system_server { apk_data_file apk_tmp_file system_data_file apex_system_server_data_file }:file ioctl FS_IOC_ENABLE_VERITY;
# Allow system process to measure fs-verity for apps, including those being installed
allowxperm system_server { apk_data_file apk_tmp_file }:file ioctl FS_IOC_MEASURE_VERITY;
@@ -1145,6 +1132,7 @@
allow system_server dmabuf_system_secure_heap_device:chr_file r_file_perms;
r_dir_file(system_server, proc_asound)
+r_dir_file(system_server, proc_memhealth)
r_dir_file(system_server, proc_net_type)
r_dir_file(system_server, proc_qtaguid_stat)
allow system_server {
@@ -1334,6 +1322,8 @@
device_config_swcodec_native_prop
device_config_aconfig_flags_prop
device_config_window_manager_native_boot_prop
+ device_config_tethering_u_or_later_native_prop
+ next_boot_prop
}:property_service set;
# Only allow system_server and init to set tuner_server_ctl_prop
@@ -1450,6 +1440,9 @@
allow system_server watchdog_metadata_file:dir rw_dir_perms;
allow system_server watchdog_metadata_file:file create_file_perms;
+allow system_server repair_mode_metadata_file:dir rw_dir_perms;
+allow system_server repair_mode_metadata_file:file create_file_perms;
+
allow system_server gsi_persistent_data_file:dir rw_dir_perms;
allow system_server gsi_persistent_data_file:file create_file_perms;
@@ -1554,3 +1547,11 @@
# Allow system server to set dynamic ART properties.
set_prop(system_server, dalvik_dynamic_config_prop)
+
+# Allow system server to read binderfs
+allow system_server binderfs_logs:dir r_dir_perms;
+allow system_server binderfs_logs_stats:file r_file_perms;
+
+# Allow GameManagerService to read and write persist.graphics.game_default_frame_rate.enabled
+set_prop(system_server, game_manager_config_prop)
+
diff --git a/private/system_suspend.te b/private/system_suspend.te
index bef7c6d..683d913 100644
--- a/private/system_suspend.te
+++ b/private/system_suspend.te
@@ -37,6 +37,9 @@
allow system_suspend sysfs_wake_lock:file rw_file_perms;
allow system_suspend self:global_capability2_class_set block_suspend;
+# Allow init to set /sys/power/sync_on_suspend.
+allow init sysfs_sync_on_suspend:file w_file_perms;
+
neverallow {
domain
-atrace # tracing
diff --git a/private/untrusted_app_25.te b/private/untrusted_app_25.te
index 2c0391f..d59245c 100644
--- a/private/untrusted_app_25.te
+++ b/private/untrusted_app_25.te
@@ -59,3 +59,12 @@
auditallow untrusted_app_25 mdnsd_socket:sock_file write;
auditallow untrusted_app_25 mdnsd:unix_stream_socket connectto;
')
+
+# Allow calling inotify on APKs for backwards compatibility. This is disallowed
+# for targetSdkVersion>=34 to remove a sidechannel.
+allow untrusted_app_25 apk_data_file:dir { watch watch_reads };
+allow untrusted_app_25 apk_data_file:file { watch watch_reads };
+userdebug_or_eng(`
+ auditallow untrusted_app_25 apk_data_file:dir { watch watch_reads };
+ auditallow untrusted_app_25 apk_data_file:file { watch watch_reads };
+')
diff --git a/private/untrusted_app_27.te b/private/untrusted_app_27.te
index 163803a..8c970d8 100644
--- a/private/untrusted_app_27.te
+++ b/private/untrusted_app_27.te
@@ -47,3 +47,12 @@
auditallow untrusted_app_27 mdnsd_socket:sock_file write;
auditallow untrusted_app_27 mdnsd:unix_stream_socket connectto;
')
+
+# Allow calling inotify on APKs for backwards compatibility. This is disallowed
+# for targetSdkVersion>=34 to remove a sidechannel.
+allow untrusted_app_27 apk_data_file:dir { watch watch_reads };
+allow untrusted_app_27 apk_data_file:file { watch watch_reads };
+userdebug_or_eng(`
+ auditallow untrusted_app_27 apk_data_file:dir { watch watch_reads };
+ auditallow untrusted_app_27 apk_data_file:file { watch watch_reads };
+')
diff --git a/private/untrusted_app_29.te b/private/untrusted_app_29.te
index 758ed23..ed0bbfc 100644
--- a/private/untrusted_app_29.te
+++ b/private/untrusted_app_29.te
@@ -25,3 +25,12 @@
auditallow untrusted_app_29 mdnsd_socket:sock_file write;
auditallow untrusted_app_29 mdnsd:unix_stream_socket connectto;
')
+
+# Allow calling inotify on APKs for backwards compatibility. This is disallowed
+# for targetSdkVersion>=34 to remove a sidechannel.
+allow untrusted_app_29 apk_data_file:dir { watch watch_reads };
+allow untrusted_app_29 apk_data_file:file { watch watch_reads };
+userdebug_or_eng(`
+ auditallow untrusted_app_29 apk_data_file:dir { watch watch_reads };
+ auditallow untrusted_app_29 apk_data_file:file { watch watch_reads };
+')
diff --git a/private/untrusted_app_30.te b/private/untrusted_app_30.te
index 830106d..c87548e 100644
--- a/private/untrusted_app_30.te
+++ b/private/untrusted_app_30.te
@@ -27,3 +27,12 @@
auditallow untrusted_app_30 mdnsd_socket:sock_file write;
auditallow untrusted_app_30 mdnsd:unix_stream_socket connectto;
')
+
+# Allow calling inotify on APKs for backwards compatibility. This is disallowed
+# for targetSdkVersion>=34 to remove a sidechannel.
+allow untrusted_app_30 apk_data_file:dir { watch watch_reads };
+allow untrusted_app_30 apk_data_file:file { watch watch_reads };
+userdebug_or_eng(`
+ auditallow untrusted_app_30 apk_data_file:dir { watch watch_reads };
+ auditallow untrusted_app_30 apk_data_file:file { watch watch_reads };
+')
diff --git a/private/untrusted_app_32.te b/private/untrusted_app_32.te
index 643c122..6e95fd1 100644
--- a/private/untrusted_app_32.te
+++ b/private/untrusted_app_32.te
@@ -28,3 +28,12 @@
auditallow untrusted_app_32 mdnsd_socket:sock_file write;
auditallow untrusted_app_32 mdnsd:unix_stream_socket connectto;
')
+
+# Allow calling inotify on APKs for backwards compatibility. This is disallowed
+# for targetSdkVersion>=34 to remove a sidechannel.
+allow untrusted_app_32 apk_data_file:dir { watch watch_reads };
+allow untrusted_app_32 apk_data_file:file { watch watch_reads };
+userdebug_or_eng(`
+ auditallow untrusted_app_32 apk_data_file:dir { watch watch_reads };
+ auditallow untrusted_app_32 apk_data_file:file { watch watch_reads };
+')
diff --git a/private/uprobestats.te b/private/uprobestats.te
new file mode 100644
index 0000000..f2a4ae3
--- /dev/null
+++ b/private/uprobestats.te
@@ -0,0 +1,16 @@
+type uprobestats, domain, coredomain;
+
+typeattribute uprobestats bpfdomain;
+
+type uprobestats_exec, system_file_type, exec_type, file_type;
+
+# Allow uprobestats to be invoked by statsd.
+domain_auto_trans(statsd, uprobestats_exec, uprobestats)
+
+allow uprobestats fs_bpf_uprobe_private:file { read write };
+allow uprobestats fs_bpf_uprobe_private:dir search;
+allow uprobestats bpfloader:bpf { map_read map_write prog_run };
+allow uprobestats self:capability2 perfmon;
+allow uprobestats self:perf_event { cpu open write };
+allow uprobestats sysfs_uprobe:file { open read };
+allow uprobestats sysfs_uprobe:dir { search };
diff --git a/private/vfio_handler.te b/private/vfio_handler.te
index 3bed3c6..1b553e9 100644
--- a/private/vfio_handler.te
+++ b/private/vfio_handler.te
@@ -20,11 +20,11 @@
allow vfio_handler sysfs:dir r_dir_perms;
allow vfio_handler sysfs:file rw_file_perms;
-# Allow vfio_handler to write to VM DTBO via a file created by virtualizationmanager.
-allow vfio_handler virtualizationmanager:fd use;
+# Allow vfio_handler to write to VM DTBO via a file created by virtualizationservice.
+allow vfio_handler virtualizationservice:fd use;
allow vfio_handler virtualizationservice_data_file:file write;
-# vfio_handler can only use fd from virtualizationmanager, and can't open files itself
+# vfio_handler can only use fd from virtualizationservice, and can't open files itself
neverallow vfio_handler virtualizationservice_data_file:file { open create };
# Allow vfio_handler to search /dev/block for accessing dtbo.img
diff --git a/private/virtual_camera.te b/private/virtual_camera.te
index c39625d..765a59f 100644
--- a/private/virtual_camera.te
+++ b/private/virtual_camera.te
@@ -1,16 +1,20 @@
# virtual_camera - virtual camera daemon
type virtual_camera, domain, coredomain;
+type virtual_camera_exec, system_file_type, exec_type, file_type;
-app_domain(virtual_camera)
+init_daemon_domain(virtual_camera)
-allow virtual_camera system_app_data_file:dir create_dir_perms;
-allow virtual_camera system_app_data_file:file create_file_perms;
+# Since virtual_camera is not a real HAL we don't set the
+# hal_server_domain(virtual_camera, hal_camera) macro but only the rules that
+# we actually need from halserverdomain and hal_camera_server:
+binder_use(virtual_camera)
-allow virtual_camera activity_service:service_manager find;
+# Allow virtual_camera to use fd from apps
+allow virtual_camera { appdomain -isolated_app }:fd use;
-# hal_server_domain adds this rule to prevent any other domain from adding
-# a virtual_camera_service. We cannot mix app_domain and hal_server_domain
-# so we use app_domain and manully add the neverallow
-allow virtual_camera virtual_camera_service:service_manager add;
-neverallow { domain -virtual_camera} virtual_camera_service:service_manager add;
+# Only allow virtual_camera to add a virtual_camera_service and no one else.
+add_service(virtual_camera, virtual_camera_service);
+
+# Allow virtual_camera to map graphic buffers
+hal_client_domain(virtual_camera, hal_graphics_allocator)
diff --git a/private/virtualizationservice.te b/private/virtualizationservice.te
index 2d20195..93cd04c 100644
--- a/private/virtualizationservice.te
+++ b/private/virtualizationservice.te
@@ -34,8 +34,8 @@
# Let virtualizationservice create and delete temporary directories of VMs. To remove old
# directories, it needs the permission to unlink the files created by virtualizationmanager.
allow virtualizationservice virtualizationservice_data_file:dir create_dir_perms;
-allow virtualizationservice virtualizationservice_data_file:{ file sock_file } unlink;
-allow virtualizationservice virtualizationservice_data_file:file write;
+allow virtualizationservice virtualizationservice_data_file:sock_file unlink;
+allow virtualizationservice virtualizationservice_data_file:file create_file_perms;
# Allow to use fd (e.g. /dev/pts/0) inherited from adbd so that we can redirect output from
# crosvm to the console
diff --git a/private/webview_zygote.te b/private/webview_zygote.te
index 0556950..7b05af2 100644
--- a/private/webview_zygote.te
+++ b/private/webview_zygote.te
@@ -83,6 +83,8 @@
allow webview_zygote system_data_file:lnk_file r_file_perms;
+allow webview_zygote properties_device:dir mounton;
+
# Send unsolicited message to system_server
unix_socket_send(webview_zygote, system_unsolzygote, system_server)
diff --git a/private/zygote.te b/private/zygote.te
index 788dafe..4815ecc 100644
--- a/private/zygote.te
+++ b/private/zygote.te
@@ -76,6 +76,8 @@
user_profile_data_file
# /storage/emulated/$userId/Android/{data,obb}
media_rw_data_file
+ # /dev/__properties__
+ properties_device
}:dir { mounton search };
# Traverse /data_mirror to get to the above directories while their normal paths
diff --git a/public/attributes b/public/attributes
index fdac127..fa47b25 100644
--- a/public/attributes
+++ b/public/attributes
@@ -300,11 +300,6 @@
attribute untrusted_app_visible_halserver_violators;
expandattribute untrusted_app_visible_halserver_violators false;
-# All system domains which are assignable with vendor's seapp_contexts files.
-# TODO(b/280547417): Remove this once there are no violations
-attribute vendor_seapp_assigns_coredomain_violators;
-expandattribute vendor_seapp_assigns_coredomain_violators false;
-
# PDX services
attribute pdx_endpoint_dir_type;
attribute pdx_endpoint_socket_type;
@@ -336,6 +331,7 @@
hal_attribute(atrace);
hal_attribute(audio);
hal_attribute(audiocontrol);
+hal_attribute(authgraph);
hal_attribute(authsecret);
hal_attribute(bluetooth);
hal_attribute(bootctl);
@@ -369,6 +365,7 @@
hal_attribute(keymint);
hal_attribute(light);
hal_attribute(lowpan);
+hal_attribute(macsec);
hal_attribute(memtrack);
hal_attribute(neuralnetworks);
hal_attribute(nfc);
diff --git a/public/domain.te b/public/domain.te
index 4e4730a..ec8b247 100644
--- a/public/domain.te
+++ b/public/domain.te
@@ -57,6 +57,9 @@
allow domain method_trace_data_file:file create_file_perms;
')
+# Allow everyone to read aconfig flags
+get_prop(domain, device_config_aconfig_flags_prop);
+
# Root fs.
allow domain tmpfs:dir { getattr search };
allow domain rootfs:dir search;
@@ -334,10 +337,6 @@
allow domain apex_mnt_dir:dir { getattr search };
allow domain apex_mnt_dir:lnk_file r_file_perms;
-# Allow everyone to read media server-configurable flags, so that libstagefright can be
-# configured using server-configurable flags
-get_prop(domain, device_config_media_native_prop)
-
###
### neverallow rules
###
@@ -437,6 +436,10 @@
neverallow * init:binder *;
neverallow * vendor_init:binder *;
+# Binderfs logs contain sensitive information about other processes.
+neverallow { domain -dumpstate -init -vendor_init userdebug_or_eng(`-domain') } { binderfs_logs binderfs_logs_proc }:file no_rw_file_perms;
+neverallow { domain -dumpstate -init -vendor_init -system_server } binderfs_logs_stats:file no_rw_file_perms;
+
# Don't allow raw read/write/open access to block_device
# Rather force a relabel to a more specific type
neverallow { domain -kernel -init -recovery } block_device:blk_file { open read write };
diff --git a/public/dumpstate.te b/public/dumpstate.te
index 3748605..496d95974 100644
--- a/public/dumpstate.te
+++ b/public/dumpstate.te
@@ -151,6 +151,7 @@
# Allow dumpstate to call dump() on specific hals.
dump_hal(hal_audio)
dump_hal(hal_audiocontrol)
+dump_hal(hal_authgraph)
dump_hal(hal_authsecret)
dump_hal(hal_bluetooth)
dump_hal(hal_broadcastradio)
@@ -379,6 +380,7 @@
allow dumpstate binderfs_logs:dir r_dir_perms;
allow dumpstate binderfs_logs:file r_file_perms;
allow dumpstate binderfs_logs_proc:file r_file_perms;
+allow dumpstate binderfs_logs_stats:file r_file_perms;
use_apex_info(dumpstate)
diff --git a/public/file.te b/public/file.te
index f7fafcb..091c557 100644
--- a/public/file.te
+++ b/public/file.te
@@ -7,6 +7,7 @@
type binderfs, fs_type;
type binderfs_logs, fs_type;
type binderfs_logs_proc, fs_type;
+type binderfs_logs_stats, fs_type;
type binderfs_features, fs_type;
# Security-sensitive proc nodes that should not be writable to most.
type proc_security, fs_type, proc_type;
@@ -15,6 +16,7 @@
type proc_min_free_order_shift, fs_type, proc_type;
type proc_kpageflags, fs_type, proc_type;
type proc_watermark_boost_factor, fs_type, proc_type;
+type proc_percpu_pagelist_high_fraction, fs_type, proc_type;
# proc, sysfs, or other nodes that permit configuration of kernel usermodehelpers.
type usermodehelper, fs_type, proc_type;
type sysfs_usermodehelper, fs_type, sysfs_type;
@@ -46,6 +48,7 @@
type proc_lowmemorykiller, fs_type, proc_type;
type proc_max_map_count, fs_type, proc_type;
type proc_meminfo, fs_type, proc_type;
+type proc_memhealth, fs_type, proc_type;
type proc_misc, fs_type, proc_type;
type proc_modules, fs_type, proc_type;
type proc_mounts, fs_type, proc_type;
@@ -115,6 +118,7 @@
type sysfs_rtc, fs_type, sysfs_type;
type sysfs_suspend_stats, fs_type, sysfs_type;
type sysfs_switch, fs_type, sysfs_type;
+type sysfs_sync_on_suspend, fs_type, sysfs_type;
type sysfs_transparent_hugepage, fs_type, sysfs_type;
type sysfs_lru_gen_enabled, fs_type, sysfs_type;
type sysfs_usb, fs_type, sysfs_type;
@@ -287,6 +291,8 @@
type staged_install_file, file_type;
# Metadata information within /metadata/watchdog
type watchdog_metadata_file, file_type;
+# Repair mode files within /metadata/repair-mode
+type repair_mode_metadata_file, file_type;
# Type for /dev/cpu_variant:.*.
type dev_cpu_variant, file_type;
diff --git a/public/fingerprintd.te b/public/fingerprintd.te
index 8cf2411..eab38dd 100644
--- a/public/fingerprintd.te
+++ b/public/fingerprintd.te
@@ -17,7 +17,6 @@
# Need to add auth tokens to KeyStore
use_keystore(fingerprintd)
-allow fingerprintd keystore:keystore_key { add_auth };
allow fingerprintd keystore:keystore2 { add_auth };
# For permissions checking
diff --git a/public/gatekeeperd.te b/public/gatekeeperd.te
index d48c5f8..0035bc6 100644
--- a/public/gatekeeperd.te
+++ b/public/gatekeeperd.te
@@ -22,7 +22,6 @@
# Need to add auth tokens to KeyStore
use_keystore(gatekeeperd)
-allow gatekeeperd keystore:keystore_key { add_auth };
allow gatekeeperd keystore:keystore2 { add_auth };
allow gatekeeperd authorization_service:service_manager find;
diff --git a/public/hal_authgraph.te b/public/hal_authgraph.te
new file mode 100644
index 0000000..f053cb0
--- /dev/null
+++ b/public/hal_authgraph.te
@@ -0,0 +1,7 @@
+binder_call(hal_authgraph_client, hal_authgraph_server)
+
+hal_attribute_service(hal_authgraph, hal_authgraph_service)
+binder_call(hal_authgraph_server, servicemanager)
+
+allow hal_authgraph_server tee_device:chr_file rw_file_perms;
+allow hal_authgraph_server ion_device:chr_file r_file_perms;
diff --git a/public/hal_codec2.te b/public/hal_codec2.te
index a379bb3..f05e00a 100644
--- a/public/hal_codec2.te
+++ b/public/hal_codec2.te
@@ -7,6 +7,7 @@
binder_call(hal_codec2_server, hal_codec2_client)
hal_attribute_hwservice(hal_codec2, hal_codec2_hwservice)
+hal_attribute_service(hal_codec2, hal_codec2_service)
# The following permissions are added to hal_codec2_server because vendor and
# vndk libraries provided for Codec2 implementation need them.
diff --git a/public/hal_drm.te b/public/hal_drm.te
index 34ca0b2..0ee0c5f 100644
--- a/public/hal_drm.te
+++ b/public/hal_drm.te
@@ -13,6 +13,8 @@
# Permit reading device's serial number from system properties
get_prop(hal_drm_server, serialno_prop)
+# Permit reading force L3 system property
+get_prop(hal_drm_server, drm_forcel3_prop)
# Read files already opened under /data
allow hal_drm system_data_file:file { getattr read };
diff --git a/public/hal_dumpstate.te b/public/hal_dumpstate.te
index 193b05a..eaa223b 100644
--- a/public/hal_dumpstate.te
+++ b/public/hal_dumpstate.te
@@ -9,6 +9,8 @@
binder_call(hal_dumpstate_server, servicemanager)
+binder_use(hal_dumpstate_server)
+
# write bug reports in /data/data/com.android.shell/files/bugreports/bugreport
allow hal_dumpstate shell_data_file:file write;
# allow reading /proc/interrupts for all hal impls
diff --git a/public/hal_face.te b/public/hal_face.te
index 0134576..e14666a 100644
--- a/public/hal_face.te
+++ b/public/hal_face.te
@@ -5,7 +5,7 @@
hal_attribute_hwservice(hal_face, hal_face_hwservice)
hal_attribute_service(hal_face, hal_face_service)
-binder_call(hal_face_server, servicemanager)
+binder_use(hal_face_server)
# Allow access to the ion memory allocation device.
allow hal_face ion_device:chr_file r_file_perms;
diff --git a/public/hal_macsec.te b/public/hal_macsec.te
new file mode 100644
index 0000000..27225db
--- /dev/null
+++ b/public/hal_macsec.te
@@ -0,0 +1,7 @@
+# Binder IPC from client to server, and callbacks
+binder_call(hal_macsec_client, hal_macsec_server)
+binder_call(hal_macsec_server, hal_macsec_client)
+
+hal_attribute_service(hal_macsec, hal_macsec_service)
+
+binder_use(hal_macsec_server)
diff --git a/public/hal_vibrator.te b/public/hal_vibrator.te
index c902495..85b8e8c 100644
--- a/public/hal_vibrator.te
+++ b/public/hal_vibrator.te
@@ -12,3 +12,6 @@
# vibrator sysfs rw access
allow hal_vibrator sysfs_vibrator:file rw_file_perms;
allow hal_vibrator sysfs_vibrator:dir search;
+
+# Allow HAL vibrator to control some parameters of a vibration, such as scaling.
+allow hal_vibrator vibrator_control_service:service_manager find;
diff --git a/public/init.te b/public/init.te
index e552ec2..29dd42d 100644
--- a/public/init.te
+++ b/public/init.te
@@ -26,7 +26,7 @@
allow init properties_device:dir relabelto;
allow init properties_serial:file { write relabelto };
allow init property_type:file { append create getattr map open read relabelto rename setattr unlink write };
-# /dev/__properties__/property_info
+# /dev/__properties__/property_info and /dev/__properties/appcompat_override/property_info
allow init properties_device:file create_file_perms;
allow init property_info:file relabelto;
# /dev/event-log-tags
diff --git a/public/mediaswcodec.te b/public/mediaswcodec.te
index edbab03..b3b26c1 100644
--- a/public/mediaswcodec.te
+++ b/public/mediaswcodec.te
@@ -21,7 +21,8 @@
# permissions and be isolated from the rest of the system and network.
# Lengthier explanation here:
# https://android-developers.googleblog.com/2016/05/hardening-media-stack.html
-neverallow mediaswcodec domain:{ tcp_socket udp_socket rawip_socket } *;
+neverallow mediaswcodec domain:{ udp_socket rawip_socket } *;
+neverallow mediaswcodec { domain userdebug_or_eng(`-su') }:tcp_socket *;
allow mediaswcodec dmabuf_system_heap_device:chr_file r_file_perms;
allow mediaswcodec dmabuf_system_secure_heap_device:chr_file r_file_perms;
diff --git a/public/property.te b/public/property.te
index 17a9845..1a5b105 100644
--- a/public/property.te
+++ b/public/property.te
@@ -65,6 +65,7 @@
system_restricted_prop(build_bootimage_prop)
system_restricted_prop(build_prop)
system_restricted_prop(composd_vm_art_prop)
+system_restricted_prop(device_config_aconfig_flags_prop)
system_restricted_prop(device_config_camera_native_prop)
system_restricted_prop(device_config_edgetpu_native_prop)
system_restricted_prop(device_config_media_native_prop)
@@ -74,6 +75,7 @@
system_restricted_prop(device_config_surface_flinger_native_boot_prop)
system_restricted_prop(device_config_vendor_system_native_prop)
system_restricted_prop(device_config_vendor_system_native_boot_prop)
+system_restricted_prop(drm_forcel3_prop)
system_restricted_prop(fingerprint_prop)
system_restricted_prop(gwp_asan_prop)
system_restricted_prop(hal_instrumentation_prop)
@@ -102,7 +104,6 @@
system_restricted_prop(vold_status_prop)
system_restricted_prop(vts_status_prop)
-
compatible_property_only(`
# DO NOT ADD ANY PROPERTIES HERE
system_restricted_prop(config_prop)
diff --git a/public/racoon.te b/public/racoon.te
index 00d10a4..b0383f0 100644
--- a/public/racoon.te
+++ b/public/racoon.te
@@ -25,10 +25,3 @@
allow racoon vpn_data_file:dir w_dir_perms;
use_keystore(racoon)
-
-# Racoon (VPN) has a restricted set of permissions from the default.
-allow racoon keystore:keystore_key {
- get
- sign
- verify
-};
diff --git a/public/service.te b/public/service.te
index d2e6ca3..a208dcf 100644
--- a/public/service.te
+++ b/public/service.te
@@ -83,7 +83,7 @@
type binder_calls_stats_service, system_server_service, service_manager_type;
type blob_store_service, app_api_service, system_server_service, service_manager_type;
type bluetooth_manager_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
-type broadcastradio_service, system_server_service, service_manager_type;
+type broadcastradio_service, app_api_service, system_server_service, service_manager_type;
type cacheinfo_service, system_api_service, system_server_service, service_manager_type;
type cameraproxy_service, system_server_service, service_manager_type;
type clipboard_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
@@ -212,6 +212,7 @@
type search_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
type search_ui_service, app_api_service, system_server_service, service_manager_type;
type sec_key_att_app_id_provider_service, app_api_service, system_server_service, service_manager_type;
+type security_state_service, system_server_service, service_manager_type;
type selection_toolbar_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
type sensorservice_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
type sensor_privacy_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
@@ -253,9 +254,11 @@
type user_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
type uwb_service, app_api_service, system_server_service, service_manager_type;
type vcn_management_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type vibrator_control_service, system_server_service, service_manager_type;
type vibrator_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
type vibrator_manager_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
type virtual_device_service, app_api_service, system_server_service, service_manager_type;
+type virtual_device_native_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
type voiceinteraction_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
type vpn_management_service, app_api_service, system_server_service, service_manager_type;
type vr_manager_service, system_server_service, service_manager_type;
@@ -278,6 +281,7 @@
type hal_audio_service, protected_service, hal_service_type, service_manager_type;
type hal_audiocontrol_service, hal_service_type, service_manager_type;
+type hal_authgraph_service, protected_service, hal_service_type, service_manager_type;
type hal_authsecret_service, protected_service, hal_service_type, service_manager_type;
type hal_bluetooth_service, protected_service, hal_service_type, service_manager_type;
type hal_bootctl_service, protected_service, hal_service_type, service_manager_type;
@@ -285,6 +289,7 @@
type hal_camera_service, protected_service, hal_service_type, service_manager_type;
type hal_can_controller_service, protected_service, hal_service_type, service_manager_type;
type hal_cas_service, hal_service_type, service_manager_type;
+type hal_codec2_service, hal_service_type, service_manager_type, isolated_compute_allowed_service;
type hal_confirmationui_service, protected_service, hal_service_type, service_manager_type;
type hal_contexthub_service, protected_service, hal_service_type, service_manager_type;
type hal_drm_service, hal_service_type, service_manager_type;
@@ -304,6 +309,7 @@
type hal_ivn_service, protected_service, hal_service_type, service_manager_type;
type hal_keymint_service, protected_service, hal_service_type, service_manager_type;
type hal_light_service, protected_service, hal_service_type, service_manager_type;
+type hal_macsec_service, protected_service, hal_service_type, service_manager_type;
type hal_memtrack_service, protected_service, hal_service_type, service_manager_type;
type hal_neuralnetworks_service, hal_service_type, service_manager_type;
type hal_nfc_service, protected_service, hal_service_type, service_manager_type;
diff --git a/public/shell.te b/public/shell.te
index 6c67cea..d4d13e3 100644
--- a/public/shell.te
+++ b/public/shell.te
@@ -63,8 +63,6 @@
allow shell shell_exec:file rx_file_perms;
allow shell zygote_exec:file rx_file_perms;
-r_dir_file(shell, apk_data_file)
-
userdebug_or_eng(`
# "systrace --boot" support - allow boottrace service to run
allow shell boottrace_data_file:dir rw_dir_perms;
diff --git a/public/su.te b/public/su.te
index bcdc322..2887740 100644
--- a/public/su.te
+++ b/public/su.te
@@ -48,7 +48,6 @@
dontaudit su servicemanager:service_manager list;
dontaudit su hwservicemanager:hwservice_manager list;
dontaudit su vndservicemanager:service_manager list;
- dontaudit su keystore:keystore_key *;
dontaudit su keystore:keystore2 *;
dontaudit su domain:drmservice *;
dontaudit su unlabeled:filesystem *;
diff --git a/public/wificond.te b/public/wificond.te
index 98db0d7..1bd89f5 100644
--- a/public/wificond.te
+++ b/public/wificond.te
@@ -33,11 +33,8 @@
typeattribute wificond wifi_keystore_service_server;
add_hwservice(wificond, system_wifi_keystore_hwservice)
-# Allow keystore binder access to serve the HwBinder service.
-allow wificond keystore_service:service_manager find;
-allow wificond keystore:keystore_key get;
-
# Allow keystore2 binder access to serve the HwBinder service.
+allow wificond keystore_service:service_manager find;
allow wificond wifi_key:keystore2_key {
get_info
use
diff --git a/tests/Android.bp b/tests/Android.bp
index 544db37..743c856 100644
--- a/tests/Android.bp
+++ b/tests/Android.bp
@@ -50,9 +50,7 @@
},
libs: [
"mini_cil_parser",
- "pysepolwrap",
],
- data: [":libsepolwrap"],
}
python_binary_host {
@@ -161,3 +159,20 @@
"mini_cil_parser",
],
}
+
+python_test_host {
+ name: "policy_test",
+ srcs: [
+ "fc_sort.py",
+ "policy.py",
+ "policy_test.py",
+ ],
+ test_options: {
+ unit_test: true,
+ },
+ version: {
+ py3: {
+ embedded_launcher: true,
+ },
+ },
+}
diff --git a/tests/apex_sepolicy_tests.py b/tests/apex_sepolicy_tests.py
index 518ebbc..3c51b67 100644
--- a/tests/apex_sepolicy_tests.py
+++ b/tests/apex_sepolicy_tests.py
@@ -65,7 +65,13 @@
scontext: set[str]
-Rule = AllowRead
+@dataclass
+class ResolveType:
+ """Rule checking if type can be resolved"""
+ pass
+
+
+Rule = AllowRead | ResolveType
def match_path(path: str, matcher: Matcher) -> bool:
@@ -94,10 +100,18 @@
continue # no errors
errors.append(f"Error: {path}: {s} can't read. (tcontext={tcontext})")
+ case ResolveType():
+ if tcontext not in pol.GetAllTypes(False):
+ errors.append(f"Error: {path}: tcontext({tcontext}) is unknown")
return errors
-rules = [
+target_specific_rules = [
+ (Glob('*'), ResolveType()),
+]
+
+
+generic_rules = [
# permissions
(Is('./etc/permissions/'), AllowRead('dir', {'system_server'})),
(Glob('./etc/permissions/*.xml'), AllowRead('file', {'system_server'})),
@@ -114,7 +128,10 @@
]
-def check_line(pol: policy.Policy, line: str) -> List[str]:
+all_rules = target_specific_rules + generic_rules
+
+
+def check_line(pol: policy.Policy, line: str, rules) -> List[str]:
"""Parses a file_contexts line and runs checks"""
# skip empty/comment line
line = line.strip()
@@ -151,6 +168,7 @@
def do_main(work_dir):
"""Do testing"""
parser = argparse.ArgumentParser()
+ parser.add_argument('--all', action='store_true', help='tests ALL aspects')
parser.add_argument('-f', '--file_contexts', help='output of "deapexer list -Z"')
args = parser.parse_args()
@@ -158,10 +176,15 @@
policy_path = extract_data('precompiled_sepolicy', work_dir)
pol = policy.Policy(policy_path, None, lib_path)
+ if args.all:
+ rules = all_rules
+ else:
+ rules = generic_rules
+
errors = []
with open(args.file_contexts, 'rt', encoding='utf-8') as file_contexts:
for line in file_contexts:
- errors.extend(check_line(pol, line))
+ errors.extend(check_line(pol, line, rules))
if len(errors) > 0:
sys.exit('\n'.join(errors))
diff --git a/tests/apex_sepolicy_tests_test.py b/tests/apex_sepolicy_tests_test.py
index 9c87a00..6e719ed 100644
--- a/tests/apex_sepolicy_tests_test.py
+++ b/tests/apex_sepolicy_tests_test.py
@@ -43,12 +43,12 @@
return self.__class__.pol
def assert_ok(self, line: str):
- errors = apex.check_line(self.pol, line)
+ errors = apex.check_line(self.pol, line, apex.all_rules)
self.assertEqual(errors, [], "Should be no errors")
def assert_error(self, line: str, expected_error: str):
pattern = re.compile(expected_error)
- errors = apex.check_line(self.pol, line)
+ errors = apex.check_line(self.pol, line, apex.all_rules)
for err in errors:
if re.search(pattern, err):
return
@@ -76,17 +76,19 @@
r'Error: \./etc/permissions/permisssion.xml: .* can\'t read')
def test_initscripts(self):
+ # here, netd_service is chosen randomly for invalid label for a file
+
# init reads .rc file
self.assert_ok('./etc/init.rc u:object_r:vendor_file:s0')
- self.assert_error('./etc/init.rc u:object_r:unknown:s0',
+ self.assert_error('./etc/init.rc u:object_r:netd_service:s0',
r'Error: .* can\'t read')
# init reads .#rc file
self.assert_ok('./etc/init.32rc u:object_r:vendor_file:s0')
- self.assert_error('./etc/init.32rc u:object_r:unknown:s0',
+ self.assert_error('./etc/init.32rc u:object_r:netd_service:s0',
r'Error: .* can\'t read')
# init skips file with unknown extension => no errors
self.assert_ok('./etc/init.x32rc u:object_r:vendor_file:s0')
- self.assert_ok('./etc/init.x32rc u:object_r:unknown:s0')
+ self.assert_ok('./etc/init.x32rc u:object_r:netd_service:s0')
def test_linkerconfig(self):
self.assert_ok('./etc/linker.config.pb u:object_r:system_file:s0')
@@ -96,5 +98,9 @@
self.assert_error('./ u:object_r:apex_data_file:s0',
r'Error: .*linkerconfig.* can\'t read')
+ def test_unknown_label(self):
+ self.assert_error('./bin/hw/foo u:object_r:foo_exec:s0',
+ r'Error: \./bin/hw/foo: tcontext\(foo_exec\) is unknown')
+
if __name__ == '__main__':
unittest.main(verbosity=2)
diff --git a/tests/policy.py b/tests/policy.py
index 805c451..8fc2ef7 100644
--- a/tests/policy.py
+++ b/tests/policy.py
@@ -30,7 +30,46 @@
# 1) there is a match - return True or 2) run out of characters - return
# False.
#
+COMMON_PREFIXES = {
+ "/(vendor|system/vendor)": ["/vendor", "/system/vendor"],
+ "/(odm|vendor/odm)": ["/odm", "/vendor/odm"],
+ "/(product|system/product)": ["/product", "/system/product"],
+ "/(system_ext|system/system_ext)": ["/system_ext", "/system/system_ext"],
+}
+
def MatchPathPrefix(pathregex, prefix):
+ # Before running regex compile loop, try two heuristics, because compiling
+ # regex is too expensive. These two can handle more than 90% out of all
+ # MatchPathPrefix calls.
+
+ # Heuristic 1: handle common prefixes for partitions
+ for c in COMMON_PREFIXES:
+ if not pathregex.startswith(c):
+ continue
+ found = False
+ for p in COMMON_PREFIXES[c]:
+ if prefix.startswith(p):
+ found = True
+ prefix = prefix[len(p):]
+ pathregex = pathregex[len(c):]
+ break
+ if not found:
+ return False
+
+ # Heuristic 2: compare normal characters as long as possible
+ idx = 0
+ while idx < len(prefix):
+ if idx == len(pathregex):
+ return False
+ if pathregex[idx] in fc_sort.META_CHARS or pathregex[idx] == '\\':
+ break
+ if pathregex[idx] != prefix[idx]:
+ return False
+ idx += 1
+ if idx == len(prefix):
+ return True
+
+ # Fall back to regex compile loop.
for i in range(len(pathregex), 0, -1):
try:
pattern = re.compile('^' + pathregex[0:i] + "$")
@@ -70,17 +109,22 @@
# Query policy for the types associated with Attr
TypesPol = self.QueryTypeAttribute(Attr, True) - set(ExcludedTypes)
# Search file_contexts to find types associated with input paths.
- TypesFc, Files = self.__GetTypesAndFilesByFilePathPrefix(MatchPrefix, DoNotMatchPrefix)
- violators = TypesFc.intersection(TypesPol)
+ PathTypes = self.__GetTypesAndFilesByFilePathPrefix(MatchPrefix, DoNotMatchPrefix)
+ violators = set()
+ for PathType in PathTypes:
+ filepath, filetype = PathType
+ if filetype in TypesPol:
+ violators.add((str(filetype), str(filepath)))
+
ret = ""
if len(violators) > 0:
ret += "The following types on "
ret += " ".join(str(x) for x in sorted(MatchPrefix))
ret += " must not be associated with the "
- ret += "\"" + Attr + "\" attribute: "
- ret += " ".join(str(x) for x in sorted(violators)) + "\n"
- ret += " corresponding to files: "
- ret += " ".join(str(x) for x in sorted(Files)) + "\n"
+ ret += "\"" + Attr + "\" attribute.\n"
+ ret += "Violator types and corresponding paths:\n"
+ ret += "\n".join(str(x) for x in sorted(violators))
+ ret += "\n"
return ret
# Check that all types for "filesystem" have "attribute" associated with them
@@ -107,18 +151,22 @@
TypesPol = self.QueryTypeAttribute(Attr, True)
# Search file_contexts to find paths/types that should be associated with
# Attr.
- TypesFc, Files = self.__GetTypesAndFilesByFilePathPrefix(MatchPrefix, DoNotMatchPrefix)
- violators = TypesFc.difference(TypesPol)
+ PathTypes = self.__GetTypesAndFilesByFilePathPrefix(MatchPrefix, DoNotMatchPrefix)
+ violators = set()
+ for PathType in PathTypes:
+ filepath, filetype = PathType
+ if filetype not in TypesPol:
+ violators.add((str(filetype), str(filepath)))
ret = ""
if len(violators) > 0:
ret += "The following types on "
ret += " ".join(str(x) for x in sorted(MatchPrefix))
ret += " must be associated with the "
- ret += "\"" + Attr + "\" attribute: "
- ret += " ".join(str(x) for x in sorted(violators)) + "\n"
- ret += " corresponding to files: "
- ret += " ".join(str(x) for x in sorted(Files)) + "\n"
+ ret += "\"" + Attr + "\" attribute.\n"
+ ret += "Violator types and corresponding paths:\n"
+ ret += "\n".join(str(x) for x in sorted(violators))
+ ret += "\n"
return ret
def AssertPropertyOwnersAreExclusive(self):
@@ -295,8 +343,7 @@
# Return types that match MatchPrefixes but do not match
# DoNotMatchPrefixes
def __GetTypesAndFilesByFilePathPrefix(self, MatchPrefixes, DoNotMatchPrefixes):
- Types = set()
- Files = set()
+ ret = []
MatchPrefixesWithIndex = []
for MatchPrefix in MatchPrefixes:
@@ -307,9 +354,8 @@
for PathType in PathTypes:
if MatchPathPrefixes(PathType[0], DoNotMatchPrefixes):
continue
- Types.add(PathType[1])
- Files.add(PathType[0])
- return Types, Files
+ ret.append(PathType)
+ return ret
def __GetTERules(self, policydbP, avtabIterP, Rules):
if Rules is None:
diff --git a/tests/policy_test.py b/tests/policy_test.py
new file mode 100644
index 0000000..3cf4a1b
--- /dev/null
+++ b/tests/policy_test.py
@@ -0,0 +1,56 @@
+# Copyright 2023 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Tests for policy"""
+
+import unittest
+from policy import MatchPathPrefix
+
+# pylint: disable=missing-docstring
+class PolicyTests(unittest.TestCase):
+ def assertMatches(self, path, prefix):
+ self.assertTrue(MatchPathPrefix(path, prefix))
+
+ def assertDoesNotMatch(self, path, prefix):
+ self.assertFalse(MatchPathPrefix(path, prefix))
+
+ # tests
+
+ def test_match_path_prefix(self):
+ # check common prefix heuristics
+ self.assertMatches("/(vendor|system/vendor)/bin/sh", "/vendor/bin")
+ self.assertMatches("/(vendor|system/vendor)/bin/sh", "/system/vendor/bin"),
+ self.assertMatches("/(odm|vendor/odm)/etc/selinux", "/odm/etc"),
+ self.assertMatches("/(odm|vendor/odm)/etc/selinux", "/vendor/odm/etc"),
+ self.assertMatches("/(system_ext|system/system_ext)/bin/foo", "/system_ext/bin"),
+ self.assertMatches("/(system_ext|system/system_ext)/bin/foo", "/system/system_ext/bin"),
+ self.assertMatches("/(product|system/product)/lib/libc.so", "/product/lib"),
+ self.assertMatches("/(product|system/product)/lib/libc.so", "/system/product/lib"),
+ self.assertDoesNotMatch("/(vendor|system/vendor)/bin/sh", "/system/bin"),
+ self.assertDoesNotMatch("/(odm|vendor/odm)/etc/selinux", "/vendor/etc"),
+ self.assertDoesNotMatch("/(system_ext|system/system_ext)/bin/foo", "/system/bin"),
+ self.assertDoesNotMatch("/(product|system/product)/lib/libc.so", "/system/lib"),
+
+ # check generic regex
+ self.assertMatches("(/.*)+", "/system/etc/vintf")
+ self.assertDoesNotMatch("(/.*)+", "foo/bar/baz")
+
+ self.assertMatches("/(system|product)/lib(64)?(/.*)+.*\.so", "/system/lib/hw/libbaz.so")
+ self.assertMatches("/(system|product)/lib(64)?(/.*)+.*\.so", "/system/lib64/")
+ self.assertMatches("/(system|product)/lib(64)?(/.*)+.*\.so", "/product/lib/hw/libbaz.so")
+ self.assertMatches("/(system|product)/lib(64)?(/.*)+.*\.so", "/product/lib64/")
+ self.assertDoesNotMatch("/(system|product)/lib(64)?(/.*)+.*\.so", "/vendor/lib/hw/libbaz.so")
+ self.assertDoesNotMatch("/(system|product)/lib(64)?(/.*)+.*\.so", "/odm/lib64/")
+
+if __name__ == '__main__':
+ unittest.main(verbosity=2)
diff --git a/tests/treble_sepolicy_tests.py b/tests/treble_sepolicy_tests.py
index b2792a0..ff1a348 100644
--- a/tests/treble_sepolicy_tests.py
+++ b/tests/treble_sepolicy_tests.py
@@ -16,17 +16,11 @@
from optparse import Option, OptionValueError
import os
import mini_parser
-import pkgutil
-import policy
-from policy import MatchPathPrefix
import re
import shutil
import sys
import tempfile
-DEBUG=False
-SHARED_LIB_EXTENSION = '.dylib' if sys.platform == 'darwin' else '.so'
-
'''
Verify that Treble compatibility are not broken.
'''
@@ -39,13 +33,13 @@
###
# Make sure that any new public type introduced in the new policy that was not
# present in the old policy has been recorded in the mapping file.
-def TestNoUnmappedNewTypes(test_policy):
- newt = test_policy.alltypes - test_policy.oldalltypes
+def TestNoUnmappedNewTypes(base_pub_policy, old_pub_policy, mapping):
+ newt = base_pub_policy.types - old_pub_policy.types
ret = ""
violators = []
for n in newt:
- if n in test_policy.pubtypes and test_policy.compatMapping.rTypeattributesets.get(n) is None:
+ if mapping.rTypeattributesets.get(n) is None:
violators.append(n)
if len(violators) > 0:
@@ -62,13 +56,13 @@
###
# Make sure that any public type removed in the current policy has its
# declaration added to the mapping file for use in non-platform policy
-def TestNoUnmappedRmTypes(test_policy):
- rmt = test_policy.oldalltypes - test_policy.alltypes
+def TestNoUnmappedRmTypes(base_pub_policy, old_pub_policy, mapping):
+ rmt = old_pub_policy.types - base_pub_policy.types
ret = ""
violators = []
for o in rmt:
- if o in test_policy.compatMapping.pubtypes and not o in test_policy.compatMapping.types:
+ if o in mapping.pubtypes and not o in mapping.types:
violators.append(o)
if len(violators) > 0:
@@ -81,9 +75,9 @@
ret += "https://android-review.googlesource.com/c/platform/system/sepolicy/+/822743\n"
return ret
-def TestTrebleCompatMapping(test_policy):
- ret = TestNoUnmappedNewTypes(test_policy)
- ret += TestNoUnmappedRmTypes(test_policy)
+def TestTrebleCompatMapping(base_pub_policy, old_pub_policy, mapping):
+ ret = TestNoUnmappedNewTypes(base_pub_policy, old_pub_policy, mapping)
+ ret += TestNoUnmappedRmTypes(base_pub_policy, old_pub_policy, mapping)
return ret
###
@@ -103,73 +97,38 @@
else:
Option.take_action(self, action, dest, opt, value, values, parser)
-def do_main(libpath):
- """
- Args:
- libpath: string, path to libsepolwrap.so
- """
- test_policy = policy.TestPolicy()
-
+def do_main():
usage = "treble_sepolicy_tests "
- usage += "-p curr_policy -b base_policy -o old_policy "
+ usage += "-b base_pub_policy -o old_pub_policy "
usage += "-m mapping file [--test test] [--help]"
parser = OptionParser(option_class=MultipleOption, usage=usage)
- parser.add_option("-b", "--basepolicy", dest="basepolicy", metavar="FILE")
- parser.add_option("-u", "--base-pub-policy", dest="base_pub_policy",
+ parser.add_option("-b", "--base-pub-policy", dest="base_pub_policy",
metavar="FILE")
parser.add_option("-m", "--mapping", dest="mapping", metavar="FILE")
- parser.add_option("-o", "--oldpolicy", dest="oldpolicy", metavar="FILE")
- parser.add_option("-p", "--policy", dest="policy", metavar="FILE")
+ parser.add_option("-o", "--old-pub-policy", dest="old_pub_policy",
+ metavar="FILE")
(options, args) = parser.parse_args()
- if not options.policy:
- sys.exit("Must specify current monolithic policy file\n" + parser.usage)
- if not os.path.exists(options.policy):
- sys.exit("Error: policy file " + options.policy + " does not exist\n"
- + parser.usage)
-
# Mapping files and public platform policy are only necessary for the
# TrebleCompatMapping test.
- if not options.basepolicy:
- sys.exit("Must specify the current platform-only policy file\n"
- + parser.usage)
if not options.mapping:
sys.exit("Must specify a compatibility mapping file\n"
+ parser.usage)
- if not options.oldpolicy:
- sys.exit("Must specify the previous monolithic policy file\n"
+ if not options.old_pub_policy:
+ sys.exit("Must specify the previous public policy .cil file\n"
+ parser.usage)
if not options.base_pub_policy:
sys.exit("Must specify the current platform-only public policy "
+ ".cil file\n" + parser.usage)
- basepol = policy.Policy(options.basepolicy, None, libpath)
- oldpol = policy.Policy(options.oldpolicy, None, libpath)
mapping = mini_parser.MiniCilParser(options.mapping)
- pubpol = mini_parser.MiniCilParser(options.base_pub_policy)
- test_policy.compatSetup(basepol, oldpol, mapping, pubpol.types)
+ base_pub_policy = mini_parser.MiniCilParser(options.base_pub_policy)
+ old_pub_policy = mini_parser.MiniCilParser(options.old_pub_policy)
- pol = policy.Policy(options.policy, None, libpath)
- test_policy.setup(pol)
-
- if DEBUG:
- test_policy.PrintScontexts()
-
- results = TestTrebleCompatMapping(test_policy)
+ results = TestTrebleCompatMapping(base_pub_policy, old_pub_policy, mapping)
if len(results) > 0:
sys.exit(results)
if __name__ == '__main__':
- temp_dir = tempfile.mkdtemp()
- try:
- libname = "libsepolwrap" + SHARED_LIB_EXTENSION
- libpath = os.path.join(temp_dir, libname)
- with open(libpath, "wb") as f:
- blob = pkgutil.get_data("treble_sepolicy_tests", libname)
- if not blob:
- sys.exit("Error: libsepolwrap does not exist. Is this binary corrupted?\n")
- f.write(blob)
- do_main(libpath)
- finally:
- shutil.rmtree(temp_dir)
+ do_main()
diff --git a/tools/Android.mk b/tools/Android.mk
deleted file mode 100644
index 34f4385..0000000
--- a/tools/Android.mk
+++ /dev/null
@@ -1,3 +0,0 @@
-LOCAL_PATH:= $(call my-dir)
-
-include $(call all-makefiles-under,$(LOCAL_PATH))
diff --git a/tools/check_seapp.c b/tools/check_seapp.c
index b80d0e6..02882af 100644
--- a/tools/check_seapp.c
+++ b/tools/check_seapp.c
@@ -22,7 +22,6 @@
#define APP_DATA_REQUIRED_ATTRIB "app_data_file_type"
#define COREDOMAIN "coredomain"
-#define VENDOR_SEAPP_ASSIGNS_COREDOMAIN_VIOLATORS "vendor_seapp_assigns_coredomain_violators"
/**
* Initializes an empty, static list.
@@ -229,6 +228,7 @@
{ .name = "minTargetSdkVersion", .dir = dir_in, .fn_validate = validate_uint },
{ .name = "fromRunAs", .dir = dir_in, .fn_validate = validate_bool },
{ .name = "isIsolatedComputeApp", .dir = dir_in, .fn_validate = validate_bool },
+ { .name = "isSdkSandboxAudit", .dir = dir_in, .fn_validate = validate_bool },
{ .name = "isSdkSandboxNext", .dir = dir_in, .fn_validate = validate_bool },
/*Outputs*/
{ .name = "domain", .dir = dir_out, .fn_validate = validate_domain },
@@ -450,13 +450,7 @@
return false;
}
- type_datum_t *attrib_violators = find_type(pol.db,
- VENDOR_SEAPP_ASSIGNS_COREDOMAIN_VIOLATORS,
- TYPE_ATTRIB);
- bool allowlisted = attrib_violators != NULL &&
- type_has_attribute(pol.db, type_dat, attrib_violators);
-
- if (type_has_attribute(pol.db, type_dat, attrib_dat) && !allowlisted) {
+ if (type_has_attribute(pol.db, type_dat, attrib_dat)) {
coredomain_violation_entry *entry = (coredomain_violation_entry *)malloc(sizeof(*entry));
entry->domain = strdup(value);
entry->filename = strdup(filename);
diff --git a/tools/checkfc.c b/tools/checkfc.c
index 83c631e..051e24b 100644
--- a/tools/checkfc.c
+++ b/tools/checkfc.c
@@ -7,6 +7,7 @@
#include <sepol/module.h>
#include <sepol/policydb/policydb.h>
#include <sepol/sepol.h>
+#include <selinux/context.h>
#include <selinux/selinux.h>
#include <selinux/label.h>
#include <sys/stat.h>
@@ -209,8 +210,14 @@
"If -e is specified, then the context_file is allowed to be empty.\n\n"
"usage2: %s -c file_contexts1 file_contexts2\n\n"
- "Compares two file contexts files and reports one of subset, equal, superset, or incomparable.\n\n",
- name, name);
+ "Compares two file contexts files and reports one of \n"
+ "subset, equal, superset, or incomparable.\n\n"
+
+ "usage3: %s -t file_contexts test_data\n\n"
+ "Validates a file contexts file against test_data.\n"
+ "test_data is a text file where each line has the format:\n"
+ " path expected_type\n\n\n",
+ name, name, name);
exit(1);
}
@@ -264,6 +271,88 @@
printf("%s\n", result_str[result]);
}
+static int warnings = 0;
+static int log_callback(int type, const char *fmt, ...) {
+ va_list ap;
+
+ if (type == SELINUX_WARNING) {
+ warnings += 1;
+ }
+ va_start(ap, fmt);
+ vfprintf(stderr, fmt, ap);
+ va_end(ap);
+ return 0;
+}
+
+static void do_test_data_and_die_on_error(struct selinux_opt opts[], unsigned int backend,
+ char *paths[])
+{
+ opts[0].value = NULL; /* not validating against a policy */
+ opts[1].value = paths[0];
+ global_state.sepolicy.sehnd[0] = selabel_open(backend, opts, 2);
+ if (!global_state.sepolicy.sehnd[0]) {
+ fprintf(stderr, "Error: could not load context file from %s: %s\n",
+ paths[0], strerror(errno));
+ exit(1);
+ }
+
+ FILE* test_data = fopen(paths[1], "r");
+ if (test_data == NULL) {
+ fprintf(stderr, "Error: could not load test file from %s : %s\n",
+ paths[1], strerror(errno));
+ exit(1);
+ }
+
+ char line[1024];
+ while (fgets(line, sizeof(line), test_data)) {
+ char *path;
+ char *expected_type;
+
+ if (!strcmp(line, "\n") || line[0] == '#') {
+ continue;
+ }
+
+ int ret = sscanf(line, "%ms %ms", &path, &expected_type);
+ if (ret != 2) {
+ fprintf(stderr, "Error: unable to parse the line %s\n", line);
+ exit(1);
+ }
+
+ char *found_context;
+ ret = selabel_lookup(global_state.sepolicy.sehnd[0], &found_context, path, 0);
+ if (ret != 0) {
+ fprintf(stderr, "Error: unable to lookup the path for %s\n", line);
+ exit(1);
+ }
+
+ context_t found = context_new(found_context);
+ const char *found_type = context_type_get(found);
+
+ if (strcmp(found_type, expected_type)) {
+ fprintf(stderr, "Incorrect type for %s: resolved to %s, expected %s\n",
+ path, found_type, expected_type);
+ }
+
+ free(found_context);
+ context_free(found);
+ free(path);
+ free(expected_type);
+ }
+ fclose(test_data);
+
+ // Prints the coverage of file_contexts on the test data. It includes
+ // warnings for rules that have not been hit by any test example.
+ union selinux_callback cb;
+ cb.func_log = log_callback;
+ selinux_set_callback(SELINUX_CB_LOG, cb);
+ selabel_stats(global_state.sepolicy.sehnd[0]);
+ if (warnings) {
+ fprintf(stderr, "No test entries were found for the contexts above. " \
+ "You may need to update %s.\n", paths[1]);
+ exit(1);
+ }
+}
+
static void do_fc_check_and_die_on_error(struct selinux_opt opts[], unsigned int backend, filemode mode,
const char *sepolicy_file, const char *context_file, bool allow_empty)
{
@@ -345,11 +434,12 @@
bool allow_empty = false;
bool compare = false;
+ bool test_data = false;
char c;
filemode mode = filemode_file_contexts;
- while ((c = getopt(argc, argv, "clpsve")) != -1) {
+ while ((c = getopt(argc, argv, "clpsvet")) != -1) {
switch (c) {
case 'c':
compare = true;
@@ -373,6 +463,9 @@
mode = filemode_vendor_service_contexts;
backend = SELABEL_CTX_ANDROID_SERVICE;
break;
+ case 't':
+ test_data = true;
+ break;
case 'h':
default:
usage(argv[0]);
@@ -385,7 +478,7 @@
usage(argv[0]);
}
- if (compare && backend != SELABEL_CTX_FILE) {
+ if ((compare || test_data) && backend != SELABEL_CTX_FILE) {
usage(argv[0]);
}
@@ -393,6 +486,8 @@
if (compare) {
do_compare_and_die_on_error(opts, backend, &(argv[index]));
+ } else if (test_data) {
+ do_test_data_and_die_on_error(opts, backend, &(argv[index]));
} else {
/* remaining args are sepolicy file and context file */
char *sepolicy_file = argv[index];
diff --git a/tools/finalize-sdk-rel.sh b/tools/finalize-sdk-rel.sh
new file mode 100755
index 0000000..80c6fa8
--- /dev/null
+++ b/tools/finalize-sdk-rel.sh
@@ -0,0 +1,95 @@
+#!/bin/bash
+
+# Copyright (C) 2023 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+if [ $# -ne 2 ]; then
+ echo "Usage: $0 <top> <ver>"
+ exit 1
+fi
+
+top=$1
+ver=$2
+
+mkdir -p "$top/system/sepolicy/prebuilts/api/${ver}.0/"
+cp -r "$top/system/sepolicy/public/" "$top/system/sepolicy/prebuilts/api/${ver}.0/"
+cp -r "$top/system/sepolicy/private/" "$top/system/sepolicy/prebuilts/api/${ver}.0/"
+
+cat > "$top/system/sepolicy/prebuilts/api/${ver}.0/Android.bp" <<EOF
+// Automatically generated file, do not edit!
+se_policy_conf {
+ name: "${ver}.0_plat_pub_policy.conf",
+ srcs: [":se_build_files{.plat_public_${ver}.0}", ":se_build_files{.reqd_mask}"],
+ installable: false,
+ build_variant: "user",
+}
+
+se_policy_cil {
+ name: "${ver}.0_plat_pub_policy.cil",
+ src: ":${ver}.0_plat_pub_policy.conf",
+ filter_out: [":reqd_policy_mask.cil"],
+ secilc_check: false,
+ installable: false,
+}
+
+se_policy_conf {
+ name: "${ver}.0_product_pub_policy.conf",
+ srcs: [
+ ":se_build_files{.plat_public_${ver}.0}",
+ ":se_build_files{.system_ext_public_${ver}.0}",
+ ":se_build_files{.product_public_${ver}.0}",
+ ":se_build_files{.reqd_mask}",
+ ],
+ installable: false,
+ build_variant: "user",
+}
+
+se_policy_cil {
+ name: "${ver}.0_product_pub_policy.cil",
+ src: ":${ver}.0_product_pub_policy.conf",
+ filter_out: [":reqd_policy_mask.cil"],
+ secilc_check: false,
+ installable: false,
+}
+
+se_policy_conf {
+ name: "${ver}.0_plat_policy.conf",
+ srcs: [
+ ":se_build_files{.plat_public_${ver}.0}",
+ ":se_build_files{.plat_private_${ver}.0}",
+ ":se_build_files{.system_ext_public_${ver}.0}",
+ ":se_build_files{.system_ext_private_${ver}.0}",
+ ":se_build_files{.product_public_${ver}.0}",
+ ":se_build_files{.product_private_${ver}.0}",
+ ],
+ installable: false,
+ build_variant: "user",
+}
+
+se_policy_cil {
+ name: "${ver}.0_plat_policy.cil",
+ src: ":${ver}.0_plat_policy.conf",
+ additional_cil_files: [":sepolicy_technical_debt{.plat_private_${ver}.0}"],
+ installable: false,
+}
+
+se_policy_binary {
+ name: "${ver}.0_plat_policy",
+ srcs: [":${ver}.0_plat_policy.cil"],
+ installable: false,
+ dist: {
+ targets: ["base-sepolicy-files-for-mapping"],
+ },
+}
+EOF
diff --git a/tools/policy_version_check.sh b/tools/policy_version_check.sh
index 33ce861..f82c53d 100755
--- a/tools/policy_version_check.sh
+++ b/tools/policy_version_check.sh
@@ -1,6 +1,6 @@
#!/bin/bash
-MK=$(awk -F= '/POLICYVERS/ { print $2 }' policy_version.mk | tr -d ' [:space:]')
+MK=$(awk -F= '/PolicyVers/ { print $2 }' build/soong/policy.go | tr -d ' [:space:]')
BP=$(awk -F= '/DSEPOLICY_VERSION/ { print $2 }' Android.bp | awk -F\" ' { print $1 }')
if [ "$MK" != "$BP" ]; then
diff --git a/treble_sepolicy_tests_for_release.mk b/treble_sepolicy_tests_for_release.mk
index 45845ab..9d6960b 100644
--- a/treble_sepolicy_tests_for_release.mk
+++ b/treble_sepolicy_tests_for_release.mk
@@ -11,15 +11,9 @@
LOCAL_MODULE_CLASS := FAKE
LOCAL_MODULE_TAGS := optional
-# BOARD_SYSTEM_EXT_PREBUILT_DIR can be set as system_ext prebuilt dir in sepolicy
-# make file of the system_ext partition.
-SYSTEM_EXT_PREBUILT_POLICY := $(BOARD_SYSTEM_EXT_PREBUILT_DIR)
-# BOARD_PRODUCT_PREBUILT_DIR can be set as product prebuilt dir in sepolicy
-# make file of the product partition.
-PRODUCT_PREBUILT_POLICY := $(BOARD_PRODUCT_PREBUILT_DIR)
IS_TREBLE_TEST_ENABLED_PARTNER := false
ifeq ($(filter 26.0 27.0 28.0 29.0,$(version)),)
-ifneq (,$(SYSTEM_EXT_PREBUILT_POLICY)$(PRODUCT_PREBUILT_POLICY))
+ifneq (,$(BOARD_SYSTEM_EXT_PREBUILT_DIR)$(BOARD_PRODUCT_PREBUILT_DIR))
IS_TREBLE_TEST_ENABLED_PARTNER := true
endif # (,$(SYSTEM_EXT_PREBUILT_POLICY)$(PRODUCT_PREBUILT_POLICY))
endif # ($(filter 26.0 27.0 28.0 29.0,$(version)),)
@@ -30,59 +24,7 @@
# built to enable us to determine the diff between the current policy and the
# $(version) policy, which will be used in tests to make sure that compatibility has
# been maintained by our mapping files.
-$(version)_PLAT_PUBLIC_POLICY := $(LOCAL_PATH)/prebuilts/api/$(version)/public
-$(version)_PLAT_PRIVATE_POLICY := $(LOCAL_PATH)/prebuilts/api/$(version)/private
-ifeq ($(IS_TREBLE_TEST_ENABLED_PARTNER),true)
-ifneq (,$(SYSTEM_EXT_PREBUILT_POLICY))
-$(version)_PLAT_PUBLIC_POLICY += \
- $(SYSTEM_EXT_PREBUILT_POLICY)/prebuilts/api/$(version)/public
-$(version)_PLAT_PRIVATE_POLICY += \
- $(SYSTEM_EXT_PREBUILT_POLICY)/prebuilts/api/$(version)/private
-endif # (,$(SYSTEM_EXT_PREBUILT_POLICY))
-ifneq (,$(PRODUCT_PREBUILT_POLICY))
-$(version)_PLAT_PUBLIC_POLICY += \
- $(PRODUCT_PREBUILT_POLICY)/prebuilts/api/$(version)/public
-$(version)_PLAT_PRIVATE_POLICY += \
- $(PRODUCT_PREBUILT_POLICY)/prebuilts/api/$(version)/private
-endif # (,$(PRODUCT_PREBUILT_POLICY))
-endif # ($(IS_TREBLE_TEST_ENABLED_PARTNER),true)
-policy_files := $(call build_policy, $(sepolicy_build_files), $($(version)_PLAT_PUBLIC_POLICY) $($(version)_PLAT_PRIVATE_POLICY))
-$(version)_plat_policy.conf := $(intermediates)/$(version)_plat_policy.conf
-$($(version)_plat_policy.conf): PRIVATE_MLS_SENS := $(MLS_SENS)
-$($(version)_plat_policy.conf): PRIVATE_MLS_CATS := $(MLS_CATS)
-$($(version)_plat_policy.conf): PRIVATE_TARGET_BUILD_VARIANT := user
-$($(version)_plat_policy.conf): PRIVATE_TGT_ARCH := $(my_target_arch)
-$($(version)_plat_policy.conf): PRIVATE_TGT_WITH_ASAN := $(with_asan)
-$($(version)_plat_policy.conf): PRIVATE_TGT_WITH_NATIVE_COVERAGE := $(with_native_coverage)
-$($(version)_plat_policy.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
-$($(version)_plat_policy.conf): PRIVATE_SEPOLICY_SPLIT := true
-$($(version)_plat_policy.conf): PRIVATE_POLICY_FILES := $(policy_files)
-$($(version)_plat_policy.conf): $(policy_files) $(M4)
- $(transform-policy-to-conf)
- $(hide) sed '/dontaudit/d' $@ > $@.dontaudit
-
-policy_files :=
-
-built_$(version)_plat_sepolicy := $(intermediates)/built_$(version)_plat_sepolicy
-$(built_$(version)_plat_sepolicy): PRIVATE_ADDITIONAL_CIL_FILES := \
- $(call build_policy, technical_debt.cil , $($(version)_PLAT_PRIVATE_POLICY))
-$(built_$(version)_plat_sepolicy): PRIVATE_NEVERALLOW_ARG := $(NEVERALLOW_ARG)
-$(built_$(version)_plat_sepolicy): $($(version)_plat_policy.conf) $(HOST_OUT_EXECUTABLES)/checkpolicy \
- $(HOST_OUT_EXECUTABLES)/secilc \
- $(call build_policy, technical_debt.cil, $($(version)_PLAT_PRIVATE_POLICY)) \
- $(built_sepolicy_neverallows)
- @mkdir -p $(dir $@)
- $(hide) $(CHECKPOLICY_ASAN_OPTIONS) $(HOST_OUT_EXECUTABLES)/checkpolicy -M -C -c \
- $(POLICYVERS) -o $@ $<
- $(hide) cat $(PRIVATE_ADDITIONAL_CIL_FILES) >> $@
- $(hide) $(HOST_OUT_EXECUTABLES)/secilc -m -M true -G -c $(POLICYVERS) $(PRIVATE_NEVERALLOW_ARG) $@ -o $@ -f /dev/null
-
-$(call declare-1p-target,$(built_$(version)_plat_sepolicy),system/sepolicy)
-
-# TODO(b/214336258): move to Soong
-$(call dist-for-goals,base-sepolicy-files-for-mapping,$(built_$(version)_plat_sepolicy):$(version)_plat_sepolicy)
-
-$(version)_plat_policy.conf :=
+built_$(version)_plat_sepolicy_cil := $(call intermediates-dir-for,ETC,$(version)_plat_policy.cil)/$(version)_plat_policy.cil
$(version)_mapping.cil := $(call intermediates-dir-for,ETC,plat_$(version).cil)/plat_$(version).cil
$(version)_mapping.ignore.cil := \
@@ -106,44 +48,31 @@
# combining the current platform policy with nonplatform policy based on the
# $(version) policy release and also a special ignored file that exists purely for
# these tests.
+intermediates := $(TARGET_OUT_INTERMEDIATES)/ETC/$(LOCAL_MODULE)_intermediates
$(version)_mapping.combined.cil := $(intermediates)/$(version)_mapping.combined.cil
$($(version)_mapping.combined.cil): $($(version)_mapping.cil) $($(version)_mapping.ignore.cil)
mkdir -p $(dir $@)
cat $^ > $@
ifeq ($(IS_TREBLE_TEST_ENABLED_PARTNER),true)
-built_sepolicy_files := $(built_product_sepolicy)
public_cil_files := $(base_product_pub_policy.cil)
else
-built_sepolicy_files := $(built_plat_sepolicy)
public_cil_files := $(base_plat_pub_policy.cil)
endif # ($(IS_TREBLE_TEST_ENABLED_PARTNER),true)
-$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
-$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY_OLD := $(built_$(version)_plat_sepolicy)
+$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY_OLD := $(built_$(version)_plat_sepolicy_cil)
$(LOCAL_BUILT_MODULE): PRIVATE_COMBINED_MAPPING := $($(version)_mapping.combined.cil)
-$(LOCAL_BUILT_MODULE): PRIVATE_PLAT_SEPOLICY := $(built_sepolicy_files)
$(LOCAL_BUILT_MODULE): PRIVATE_PLAT_PUB_SEPOLICY := $(public_cil_files)
$(LOCAL_BUILT_MODULE): $(HOST_OUT_EXECUTABLES)/treble_sepolicy_tests \
- $(all_fc_files) $(built_sepolicy) \
- $(built_sepolicy_files) \
$(public_cil_files) \
- $(built_$(version)_plat_sepolicy) $($(version)_mapping.combined.cil)
+ $(built_$(version)_plat_sepolicy_cil) $($(version)_mapping.combined.cil)
@mkdir -p $(dir $@)
$(hide) $(HOST_OUT_EXECUTABLES)/treble_sepolicy_tests \
- -b $(PRIVATE_PLAT_SEPOLICY) -m $(PRIVATE_COMBINED_MAPPING) \
- -o $(PRIVATE_SEPOLICY_OLD) -p $(PRIVATE_SEPOLICY) \
- -u $(PRIVATE_PLAT_PUB_SEPOLICY)
+ -b $(PRIVATE_PLAT_PUB_SEPOLICY) -m $(PRIVATE_COMBINED_MAPPING) \
+ -o $(PRIVATE_SEPOLICY_OLD)
$(hide) touch $@
-$(version)_SYSTEM_EXT_PUBLIC_POLICY :=
-$(version)_SYSTEM_EXT_PRIVATE_POLICY :=
-$(version)_PRODUCT_PUBLIC_POLICY :=
-$(version)_PRODUCT_PRIVATE_POLICY :=
-$(version)_PLAT_PUBLIC_POLICY :=
-$(version)_PLAT_PRIVATE_POLICY :=
built_sepolicy_files :=
public_cil_files :=
-cil_files :=
$(version)_mapping.cil :=
$(version)_mapping.combined.cil :=
$(version)_mapping.ignore.cil :=
diff --git a/vendor/file_contexts b/vendor/file_contexts
index 564ca9d..28613c9 100644
--- a/vendor/file_contexts
+++ b/vendor/file_contexts
@@ -76,6 +76,8 @@
/(vendor|system/vendor)/bin/hw/android\.hardware\.light@2\.0-service-lazy u:object_r:hal_light_default_exec:s0
/(vendor|system/vendor)/bin/hw/android\.hardware\.lights-service\.example u:object_r:hal_light_default_exec:s0
/(vendor|system/vendor)/bin/hw/android\.hardware\.lowpan@1\.0-service u:object_r:hal_lowpan_default_exec:s0
+/(vendor|system/vendor)/bin/hw/android\.hardware\.macsec-service u:object_r:hal_macsec_default_exec:s0
+/(vendor|system/vendor)/bin/hw/android\.hardware\.media\.c2-default-service u:object_r:mediacodec_exec:s0
/(vendor|system/vendor)/bin/hw/android\.hardware\.memtrack@1\.0-service u:object_r:hal_memtrack_default_exec:s0
/(vendor|system/vendor)/bin/hw/android\.hardware\.memtrack-service.example u:object_r:hal_memtrack_default_exec:s0
/(vendor|system/vendor)/bin/hw/android\.hardware\.nfc@1\.0-service u:object_r:hal_nfc_default_exec:s0
@@ -96,6 +98,7 @@
/(vendor|system/vendor)/bin/hw/android\.hardware\.sensors-service(\.multihal)? u:object_r:hal_sensors_default_exec:s0
/(vendor|system/vendor)/bin/hw/android\.hardware\.secure_element@1\.0-service u:object_r:hal_secure_element_default_exec:s0
/(vendor|system/vendor)/bin/hw/android\.hardware\.secure_element-service.example u:object_r:hal_secure_element_default_exec:s0
+/(vendor|system/vendor)/bin/hw/android\.hardware\.security\.authgraph-service\.nonsecure u:object_r:hal_authgraph_default_exec:s0
/(vendor|system/vendor)/bin/hw/android\.hardware\.security\.keymint-service u:object_r:hal_keymint_default_exec:s0
/(vendor|system/vendor)/bin/hw/rild u:object_r:rild_exec:s0
/(vendor|system/vendor)/bin/hw/android\.hardware\.tetheroffload-service\.example u:object_r:hal_tetheroffload_default_exec:s0
@@ -124,6 +127,7 @@
/(vendor|system/vendor)/bin/hw/android\.hardware\.wifi-service-lazy u:object_r:hal_wifi_default_exec:s0
/(vendor|system/vendor)/bin/hw/hostapd u:object_r:hal_wifi_hostapd_default_exec:s0
/(vendor|system/vendor)/bin/hw/wpa_supplicant u:object_r:hal_wifi_supplicant_default_exec:s0
+/(vendor|system/vendor)/bin/hw/wpa_supplicant_macsec u:object_r:wpa_supplicant_macsec_exec:s0
/(vendor|system/vendor)/bin/install-recovery\.sh u:object_r:vendor_install_recovery_exec:s0
/(vendor|system/vendor)/bin/ot-rcp u:object_r:ot_rcp_exec:s0
/(vendor|system/vendor)/bin/vndservicemanager u:object_r:vndservicemanager_exec:s0
diff --git a/vendor/hal_authgraph_default.te b/vendor/hal_authgraph_default.te
new file mode 100644
index 0000000..1676cca
--- /dev/null
+++ b/vendor/hal_authgraph_default.te
@@ -0,0 +1,5 @@
+type hal_authgraph_default, domain;
+hal_server_domain(hal_authgraph_default, hal_authgraph)
+
+type hal_authgraph_default_exec, exec_type, vendor_file_type, file_type;
+init_daemon_domain(hal_authgraph_default)
diff --git a/vendor/hal_drm_clearkey.te b/vendor/hal_drm_clearkey.te
index ab474d6..4b4ee46 100644
--- a/vendor/hal_drm_clearkey.te
+++ b/vendor/hal_drm_clearkey.te
@@ -4,3 +4,4 @@
init_daemon_domain(hal_drm_clearkey_aidl)
hal_server_domain(hal_drm_clearkey_aidl, hal_drm)
+allow hal_drm_clearkey_aidl mediacodec:fd use;
diff --git a/vendor/hal_evs_default.te b/vendor/hal_evs_default.te
index 0bdb7fd..9ed7a8a 100644
--- a/vendor/hal_evs_default.te
+++ b/vendor/hal_evs_default.te
@@ -32,3 +32,7 @@
# allow to access graphics related properties
get_prop(hal_evs_default, graphics_config_prop);
+get_prop(hal_evs_default, graphics_config_writable_prop)
+
+# allow to use binder IPC.
+binder_use(hal_evs_default)
diff --git a/vendor/hal_macsec_default.te b/vendor/hal_macsec_default.te
new file mode 100644
index 0000000..19b3d16
--- /dev/null
+++ b/vendor/hal_macsec_default.te
@@ -0,0 +1,8 @@
+type hal_macsec_default, domain;
+hal_server_domain(hal_macsec_default, hal_macsec)
+
+type hal_macsec_default_exec, exec_type, vendor_file_type, file_type;
+init_daemon_domain(hal_macsec_default)
+
+# Allow registering with service manager.
+binder_call(hal_macsec_default, servicemanager)
diff --git a/vendor/wpa_supplicant_macsec.te b/vendor/wpa_supplicant_macsec.te
new file mode 100644
index 0000000..1b90ac7
--- /dev/null
+++ b/vendor/wpa_supplicant_macsec.te
@@ -0,0 +1,28 @@
+# wpa supplicant macsec or equivalent
+type wpa_supplicant_macsec, domain;
+type wpa_supplicant_macsec_exec, exec_type, vendor_file_type, file_type;
+init_daemon_domain(wpa_supplicant_macsec)
+
+net_domain(wpa_supplicant_macsec)
+
+# Allow wpa_supplicant to configure nl80211
+allow wpa_supplicant_macsec proc_net_type:file write;
+
+# in addition to ioctls allowlisted for all domains, grant wpa_supplicant_macsec priv_sock_ioctls.
+allowxperm wpa_supplicant_macsec self:udp_socket ioctl priv_sock_ioctls;
+
+r_dir_file(wpa_supplicant_macsec, sysfs_type)
+r_dir_file(wpa_supplicant_macsec, proc_net_type)
+
+allow wpa_supplicant_macsec self:global_capability_class_set { setuid net_admin setgid net_raw };
+allow wpa_supplicant_macsec cgroup:dir create_dir_perms;
+allow wpa_supplicant_macsec cgroup_v2:dir create_dir_perms;
+allow wpa_supplicant_macsec self:netlink_route_socket nlmsg_write;
+allow wpa_supplicant_macsec self:netlink_socket create_socket_perms_no_ioctl;
+allow wpa_supplicant_macsec self:netlink_generic_socket create_socket_perms_no_ioctl;
+allow wpa_supplicant_macsec self:packet_socket create_socket_perms;
+allowxperm wpa_supplicant_macsec self:packet_socket ioctl { unpriv_sock_ioctls priv_sock_ioctls unpriv_tty_ioctls };
+
+binder_use(wpa_supplicant_macsec)
+hal_client_domain(wpa_supplicant_macsec, hal_macsec)
+