NameDateSize

..02-Jul-20154 KiB

access_vectors02-Jul-20159.2 KiB

adbd.te02-Jul-20152.5 KiB

Android.mk02-Jul-201510.4 KiB

app.te02-Jul-201513.4 KiB

attributes02-Jul-20151.6 KiB

binderservicedomain.te02-Jul-2015784

bluetooth.te02-Jul-20152.2 KiB

bootanim.te02-Jul-2015424

clatd.te02-Jul-2015841

debuggerd.te02-Jul-20151.3 KiB

device.te02-Jul-20152.1 KiB

dex2oat.te02-Jul-2015503

dhcp.te02-Jul-20151.1 KiB

dnsmasq.te02-Jul-2015917

domain.te02-Jul-201511.9 KiB

drmserver.te02-Jul-20151.7 KiB

dumpstate.te02-Jul-20153.4 KiB

file.te02-Jul-20156.7 KiB

file_contexts02-Jul-201510.6 KiB

fs_use02-Jul-2015818

genfs_contexts02-Jul-20151.8 KiB

global_macros02-Jul-20152.6 KiB

gpsd.te02-Jul-2015686

hci_attach.te02-Jul-2015313

healthd.te02-Jul-20151.5 KiB

hostapd.te02-Jul-20151.1 KiB

init.te02-Jul-20154.3 KiB

init_shell.te02-Jul-2015455

initial_sid_contexts02-Jul-2015973

initial_sids02-Jul-2015416

inputflinger.te02-Jul-2015280

install_recovery.te02-Jul-20151,007

installd.te02-Jul-20154.2 KiB

isolated_app.te02-Jul-2015631

kernel.te02-Jul-20152.6 KiB

keys.conf02-Jul-2015851

keystore.te02-Jul-20151.1 KiB

lmkd.te02-Jul-20151,003

logd.te02-Jul-2015992

mac_permissions.xml02-Jul-20151.3 KiB

mdnsd.te02-Jul-2015118

mediaserver.te02-Jul-20152.9 KiB

mls02-Jul-20154 KiB

mls_macros02-Jul-20151.2 KiB

mtp.te02-Jul-2015288

net.te02-Jul-2015852

netd.te02-Jul-20152.9 KiB

nfc.te02-Jul-2015518

NOTICE02-Jul-20151 KiB

platform_app.te02-Jul-20151 KiB

policy_capabilities02-Jul-2015122

port_contexts02-Jul-201577

ppp.te02-Jul-2015493

property.te02-Jul-2015917

property_contexts02-Jul-20152.7 KiB

racoon.te02-Jul-2015874

radio.te02-Jul-2015952

README02-Jul-20156.2 KiB

recovery.te02-Jul-20154 KiB

rild.te02-Jul-20151.7 KiB

roles02-Jul-201529

runas.te02-Jul-2015962

sdcardd.te02-Jul-2015814

seapp_contexts02-Jul-20152 KiB

security_classes02-Jul-20152.6 KiB

selinux-network.sh02-Jul-20151 KiB

service.te02-Jul-2015648

service_contexts02-Jul-20159.2 KiB

servicemanager.te02-Jul-2015632

shared_relro.te02-Jul-2015442

shell.te02-Jul-20151.7 KiB

su.te02-Jul-20151.5 KiB

surfaceflinger.te02-Jul-20152.2 KiB

system_app.te02-Jul-20152.3 KiB

system_server.te02-Jul-201514.6 KiB

te_macros02-Jul-201510.9 KiB

tee.te02-Jul-2015434

tools/02-Jul-20154 KiB

ueventd.te02-Jul-20151.2 KiB

unconfined.te02-Jul-20153.5 KiB

uncrypt.te02-Jul-2015899

untrusted_app.te02-Jul-20153.8 KiB

users02-Jul-201555

vdc.te02-Jul-2015622

vold.te02-Jul-20152.9 KiB

watchdogd.te02-Jul-2015420

wpa.te02-Jul-20151.1 KiB

zygote.te02-Jul-20152.4 KiB

README

1Policy Generation:
2
3Additional, per device, policy files can be added into the
4policy build.
5
6They can be configured through the use of four variables,
7they are:
81. BOARD_SEPOLICY_REPLACE
92. BOARD_SEPOLICY_UNION
103. BOARD_SEPOLICY_DIRS
114. BOARD_SEPOLICY_IGNORE
12
13The variables should be set in the BoardConfig.mk file in
14the device or vendor directories.
15
16BOARD_SEPOLICY_UNION is a list of files that will be
17"unioned", IE concatenated, at the END of their respective
18file in external/sepolicy. Note, to add a unique file you
19would use this variable.
20
21BOARD_SEPOLICY_REPLACE is a list of files that will be
22used instead of the corresponding file in external/sepolicy.
23
24BOARD_SEPOLICY_DIRS contains a list of directories to search
25for BOARD_SEPOLICY_UNION and BOARD_SEPOLICY_REPLACE files. Order
26matters in this list.
27eg.) If you have BOARD_SEPOLICY_UNION += widget.te and have 2
28instances of widget.te files on BOARD_SEPOLICY_DIRS search path.
29The first one found (at the first search dir containing the file)
30gets processed first.
31Reviewing out/target/product/<device>/etc/sepolicy_intermediates/policy.conf
32will help sort out ordering issues.
33
34It is an error to specify a BOARD_POLICY_REPLACE file that does
35not exist in external/sepolicy.
36
37It is an error to specify a BOARD_POLICY_REPLACE file that appears
38multiple times on the policy search path defined by BOARD_SEPOLICY_DIRS.
39eg.) if you specify shell.te in BOARD_SEPOLICY_REPLACE and
40BOARD_SEPOLICY_DIRS is set to
41"vendor/widget/common/sepolicy device/widget/x/sepolicy" and shell.te
42appears in both locations, it is an error. Unless it is in
43BOARD_SEPOLICY_IGNORE to be filtered out. See BOARD_SEPOLICY_IGNORE
44for more details.
45
46It is an error to specify the same file name in both
47BOARD_POLICY_REPLACE and BOARD_POLICY_UNION.
48
49It is an error to specify a BOARD_SEPOLICY_DIRS that has no entries when
50specifying BOARD_SEPOLICY_REPLACE.
51
52It is an error to specify a BOARD_POLICY_UNION file that
53doesn't appear in any of the BOARD_SEPOLICY_DIRS locations.
54
55BOARD_SEPOLICY_IGNORE is a list of paths (directory + filename) of
56files that are not to be included in the resulting policy. This list
57is passed to filter-out to remove any paths you may want to ignore. This
58is useful if you have numerous config directories that contain a file
59and you want to NOT include a particular file in your resulting
60policy file, either by UNION or REPLACE.
61Eg.) Suppose the following:
62     BOARD_SEPOLICY_DIRS += X Y
63     BOARD_SEPOLICY_REPLACE += A
64     BOARD_SEPOLICY_IGNORE += X/A
65
66     Directories X and Y contain A.
67
68     The resulting policy is created by using Y/A only, thus X/A was
69     ignored.
70
71Example BoardConfig.mk Usage:
72From the Tuna device BoardConfig.mk, device/samsung/tuna/BoardConfig.mk
73
74BOARD_SEPOLICY_DIRS += \
75        device/samsung/tuna/sepolicy
76
77BOARD_SEPOLICY_UNION += \
78        genfs_contexts \
79        file_contexts \
80        sepolicy.te
81
82SPECIFIC POLICY FILE INFORMATION
83
84mac_permissions.xml:
85  ABOUT:
86    The mac_permissions.xml file is used for controlling the mmac solutions
87    as well as mapping a public base16 signing key with an arbitrary seinfo
88    string. Details of the files contents can be found in a comment at the
89    top of that file. The seinfo string, previously mentioned, is the same string
90    that is referenced in seapp_contexts.
91
92    This file can be replaced through BOARD_SEPOLICY_REPLACE containing the
93    value "mac_permissions.xml", or appended to by using the BOARD_SEPOLICY_UNION
94    variable. It is important to note the final processed version of this file
95    is stripped of comments and whitespace. This is to preserve space on the
96    system.img. If one wishes to view it in a more human friendly format,
97    the "tidy" or "xmllint" command will assist you.
98
99  TOOLING:
100    insertkeys.py
101      Is a helper script for mapping arbitrary tags in the signature stanzas of
102      mac_permissions.xml to public keys found in pem files. This script takes
103      a mac_permissions.xml file(s) and configuration file in order to operate.
104      Details of the configuration file (keys.conf) can be found in the subsection
105      keys.conf. This tool is also responsible for stripping the comments and
106      whitespace during processing.
107
108      keys.conf
109        The keys.conf file is used for controlling the mapping of "tags" found in
110        the mac_permissions.xml signature stanzas with actual public keys found in
111        pem files. The configuration file can be used in BOARD_SEPOLICY_UNION and
112        BOARD_SEPOLICY_REPLACE variables and is processed via m4.
113
114        The script allows for mapping any string contained in TARGET_BUILD_VARIANT
115        with specific path to a pem file. Typically TARGET_BUILD_VARIANT is either
116        user, eng or userdebug. Additionally, one can specify "ALL" to map a path to
117        any string specified in TARGET_BUILD_VARIANT. All tags are matched verbatim
118        and all options are matched lowercase. The options are "tolowered" automatically
119        for the user, it is convention to specify tags and options in all uppercase
120        and tags start with @. The option arguments can also use environment variables
121        via the familiar $VARIABLE syntax. This is often useful for setting a location
122        to ones release keys.
123
124        Often times, one will need to integrate an application that was signed by a separate
125        organization and may need to extract the pem file for the insertkeys/keys.conf tools.
126        Extraction of the public key in the pem format is possible via openssl. First you need
127        to unzip the apk, once it is unzipped, cd into the META_INF directory and then execute
128        openssl pkcs7 -inform DER -in CERT.RSA -out CERT.pem -outform PEM  -print_certs
129        On some occasions CERT.RSA has a different name, and you will need to adjust for that.
130        After extracting the pem, you can rename it, and configure keys.conf and
131        mac_permissions.xml to pick up the change. You MUST open the generated pem file in a text
132        editor and strip out anything outside the opening and closing scissor lines. Failure to do
133        so WILL cause a compile time issue thrown by insertkeys.py
134
135        NOTE: The pem files are base64 encoded and PackageManagerService, mac_permissions.xml
136              and setool all use base16 encodings.
137