| 325bf7259227b15a6b356051d90d5a89ad739a4d |
|
01-Mar-2017 |
Sohani Rao <sohanirao@google.com> |
SE Policy for Wifi Offload HAL
Update SE Policy to allow calls to and callbacks from Wifi Offload HAL
HIDL binderized service.
Combined cherry pick from d56aa1982d15acfc2408271138dac43f1e5dc987
and 66e27bf502246c8e8870b7b3e2573a8c87e89fe1
Bug: 32842314
Test: Unit tests, Mannual test to ensure Wifi can be brought up and
connected to an AP, ensure that Offload HAL service is running and that
that wificond can get the service handle by calling hwservicemanager.
Change-Id: I0fc51a4152f1891c8d88967e75d45ded115e766e
/system/sepolicy/vendor/file_contexts
|
| 976fb16bc14dfefe12f56e23a677dce99a091b14 |
|
12-Apr-2017 |
TreeHugger Robot <treehugger-gerrit@google.com> |
Merge "Add sepolicy for tv.cec" into oc-dev
|
| f81dd0c57886815b384fe209bdfa70f7b786957a |
|
05-Apr-2017 |
Donghyun Cho <donghyun@google.com> |
Add sepolicy for tv.cec
Bug: 36562029
Test: m -j40 and CEC functionality works well
Change-Id: I5a693e65abdd5139a848d939149a475056cc41e8
/system/sepolicy/vendor/file_contexts
|
| 366c2ec1dc9caedd102f7705261032274d3d92b3 |
|
06-Apr-2017 |
Sandeep Patil <sspatil@google.com> |
sepolicy: add missing labels for same process HALs.
Some of the same process HAL labeling was missing from Marlin.
These are identified by tracking library dependencies.
Bug: 37084733
Test: Build and boot sailfish. The change allows the labelled libraries
to be opened by any domain. So, the boot test is sufficient.
Change-Id: Id55e834d6863ca644f912efdd690fccb71d3eaf3
Signed-off-by: Sandeep Patil <sspatil@google.com>
/system/sepolicy/vendor/file_contexts
|
| 277a20ebecda8f9d12a10c4f8eb52dbf04c30e43 |
|
02-Apr-2017 |
Sandeep Patil <sspatil@google.com> |
sepolicy: relabel /vendor
The CL splits /vendor labeling from /system. Which was allowing all
processes read, execute access to /vendor.
Following directories will remain world readable
/vendor/etc
/vendor/lib(64)/hw/
Following are currently world readable but their scope
will be minimized to platform processes that require access
/vendor/app
/vendor/framework/
/vendor/overlay
Files labelled with 'same_process_hal_file' are allowed to be
read + executed from by the world. This is for Same process HALs and
their dependencies.
Bug: 36527360
Bug: 36832490
Bug: 36681210
Bug: 36680116
Bug: 36690845
Bug: 36697328
Bug: 36696623
Bug: 36806861
Bug: 36656392
Bug: 36696623
Bug: 36792803
All of the tests were done on sailfish, angler, bullhead, dragon
Test: Boot and connect to wifi
Test: Run chrome and load websites, play video in youtube, load maps w/
current location, take pictures and record video in camera,
playback recorded video.
Test: Connect to BT headset and ensure BT audio playback works.
Test: OTA sideload using recovery
Test: CTS SELinuxHostTest pass
Change-Id: I278435b72f7551a28f3c229f720ca608b77a7029
Signed-off-by: Sandeep Patil <sspatil@google.com>
/system/sepolicy/vendor/file_contexts
|
| c76e158c2717a386c3a98b1756892ecf9ed30460 |
|
30-Mar-2017 |
Shubang <shubang@google.com> |
Add sepolicy for tv.input
Test: build, flash; adb shell lshal
Bug: 36562029
Change-Id: If8f6d8dbd99d31e6627fa4b7c1fd4faea3b75cf2
/system/sepolicy/vendor/file_contexts
|
| 7cfba9a7738b304ce1db1cc01534a1c57543d52a |
|
22-Mar-2017 |
Martijn Coenen <maco@google.com> |
Merge "Initial sepolicy for vndservicemanager."
|
| cba70be751dee6482f3cedc8b6f9e34195c59167 |
|
22-Mar-2017 |
Martijn Coenen <maco@google.com> |
Initial sepolicy for vndservicemanager.
vndservicemanager is the context manager for binder services
that are solely registered and accessed from vendor processes.
Bug: 36052864
Test: vendorservicemanager runs
Change-Id: Ifbf536932678d0ff13d019635fe6347e185ef387
/system/sepolicy/vendor/file_contexts
|
| 96a5b4a75a18cfb3a647897fb84347e349502a62 |
|
28-Feb-2017 |
Pawin Vongmasa <pawin@google.com> |
Move mediacodec to vendor partition.
Test: Camera, Photos, YouTube and Play Movies apps.
Bug: 35328855
Change-Id: I3643b668817a7336f7ccda781734920fbbcc2c63
/system/sepolicy/vendor/file_contexts
|
| 24388047196446aab99e678dfd5f5119ff3db7cc |
|
20-Mar-2017 |
Alex Klyubin <klyubin@google.com> |
Merge "Switch Boot Control HAL policy to _client/_server" am: 51a2238c9e am: 2a887bfb3d
am: 4abc2d23d5
Change-Id: I6602b883078cbf5778f9843d68263633de351dbc
|
| 09d13e734d651e8cb92187f477e3cdc485128311 |
|
17-Mar-2017 |
Alex Klyubin <klyubin@google.com> |
Switch Boot Control HAL policy to _client/_server
This switches Boot Control HAL policy to the design which enables us
to conditionally remove unnecessary rules from domains which are
clients of Boot Control HAL.
Domains which are clients of Boot Control HAL, such as update_server,
are granted rules targeting hal_bootctl only when the Boot Control HAL
runs in passthrough mode (i.e., inside the client's process). When the
HAL runs in binderized mode (i.e., in another process/domain, with
clients talking to the HAL over HwBinder IPC), rules targeting
hal_bootctl are not granted to client domains.
Domains which offer a binderized implementation of Boot Control HAL,
such as hal_bootctl_default domain, are always granted rules targeting
hal_bootctl.
P. S. This commit removes direct access to Boot Control HAL from
system_server because system_server is not a client of this HAL. This
commit also removes bootctrl_block_device type which is no longer
used. Finally, boot_control_hal attribute is removed because it is now
covered by the hal_bootctl attribute.
Test: Device boots up, no new denials
Test: Reboot into recovery, sideload OTA update succeeds
Test: Apply OTA update via update_engine:
1. make dist
2. Ensure device has network connectivity
3. ota_call.py -s <serial here> out/dist/sailfish-ota-*.zip
Bug: 34170079
Change-Id: I9c410c092069e431a3852b66c04c4d2a9f1a25cf
/system/sepolicy/vendor/file_contexts
|
| 9a29301376809be37b6ab478855466345bd7964b |
|
11-Feb-2017 |
Po-Chien Hsueh <pchsueh@google.com> |
sepolicy: Move hostapd to vendor
Move hostapd to vendor/bin/ because it's only used by WIFI HAL.
This commit is for sepolicy corresponding changes.
Bug: 34236942
Bug: 34237659
Test: Hotspot works fine. Integration test.
Change-Id: I2ee165970a20f4015d5d62fc590d448e9acb92c1
/system/sepolicy/vendor/file_contexts
|
| a976e64d89575fb93b9fb1ca47c6aefc496e91b9 |
|
19-Feb-2017 |
Roshan Pius <rpius@google.com> |
sepolicy: Make wpa_supplicant a HIDL service
Note: The existing rules allowing socket communication will be removed
once we migrate over to HIDL completely.
(cherry-pick of 2a9595ede2c9a224686e619c2ee5c976dd324ac0)
Bug: 34603782
Test: Able to connect to wifi networks.
Test: Will be sending for full wifi integration tests
(go/wifi-test-request)
Change-Id: I9ee238fd0017ec330f6eb67ef9049211f7bd4615
/system/sepolicy/vendor/file_contexts
|
| 97f64b90570e8ab810e9418a7bddd1cda3c50368 |
|
28-Feb-2017 |
Roshan Pius <rpius@google.com> |
Merge "sepolicy: Make wpa_supplicant a HIDL service"
|
| ba1c5831fdbb56fbbea175145ea3b0293b8f2310 |
|
27-Feb-2017 |
Steven Moreland <smoreland@google.com> |
Bluetooth hal: move to vendor partition.
Bug: 35328775
Test: works in both binderized and passthrough modes
Merged-In: I1f827b4983e5e67c516e4488ad3497dd62db7e20
Change-Id: I1f827b4983e5e67c516e4488ad3497dd62db7e20
/system/sepolicy/vendor/file_contexts
|
| 0b23d3ed89c7c35a020fa14c07cc1b97d3fe6e19 |
|
27-Feb-2017 |
Steven Moreland <smoreland@google.com> |
Bluetooth hal: move to vendor partition.
Bug: 35328775
Test: works in both binderized and passthrough modes
Change-Id: I1f827b4983e5e67c516e4488ad3497dd62db7e20
/system/sepolicy/vendor/file_contexts
|
| 2a9595ede2c9a224686e619c2ee5c976dd324ac0 |
|
19-Feb-2017 |
Roshan Pius <rpius@google.com> |
sepolicy: Make wpa_supplicant a HIDL service
Note: The existing rules allowing socket communication will be removed
once we migrate over to HIDL completely.
Bug: 34603782
Test: Able to connect to wifi networks.
Test: Will be sending for full wifi integration tests
(go/wifi-test-request)
Change-Id: I9ee238fd0017ec330f6eb67ef9049211f7bd4615
/system/sepolicy/vendor/file_contexts
|
| f7bed71a211ba1e19c37af5a606e48a9dee0c186 |
|
24-Feb-2017 |
Amit Mahajan <amitmahajan@google.com> |
Move rild to vendor partition.
Test: Basic telephony sanity
Bug: 35672432
Change-Id: I7d17cc7efda9902013c21d508cefc77baccc06a8
/system/sepolicy/vendor/file_contexts
|
| 3001d5a336a3f6d7023af48b6c0c474edbd6c505 |
|
16-Feb-2017 |
Alex Klyubin <klyubin@google.com> |
Label /vendor/bin/hw on devices without vendor partition
SELinux labeling of filesystem files ignores symlinks. Unfortunately,
/vendor is a symlink on devices without vendor partition
(e.g., hikey). Thus, policy in directories which are used both for
devices with vendor partition and for devices without vendor partition
must be adjusted to match both /vendor and /system/vendor. It is
assumed that the /vendor symlink, if it exists at all, always points
to /system/vendor.
The alternative solution of adjusting vendor policy file labelling
rules at vendor policy build time, when the actual on-device paths are
known, was considered to make it harder to see how files are labelled
by looking solely at the source tree.
Test: Files under /vendor/bin/hw correctly labelled on sailfish,
angler, and a device which uses the /vendor symlink.
Bug: 35431549
Change-Id: If6ccb2c9cb85b0589db03ab86de8071e15d5366f
/system/sepolicy/vendor/file_contexts
|
| aa11b6a9c7ea5a8d2b8bb7b9a463ca2be174dfff |
|
13-Feb-2017 |
Steven Moreland <smoreland@google.com> |
Move hals to vendor partition.
Bug: 34135607
Test: hals work
Merged-In: I6a1f87438bb5b540fce900e9ec5df07d3f4f6bd4
Change-Id: I6a1f87438bb5b540fce900e9ec5df07d3f4f6bd4
/system/sepolicy/vendor/file_contexts
|