Merge changes I9cdd52a2,Idf00e7a6 into nyc-dev

am: fbb6d2de

* commit 'fbb6d2de':
  allow system server to set log.tag.WifiHAL
  limit shell's access to log.* properties

Change-Id: I42f413661978dc693340264f9f9faac303095a1b

attributes

@@ -67,6 +67,9 @@ attribute property_type;
 # used by device specific properties
 attribute core_property_type;
 
+# All properties used to configure log filtering.
+attribute log_property_type;
+
 # All service_manager types created by system_server
 attribute system_server_service;
 

domain.te

@@ -84,6 +84,9 @@ allow domain properties_serial:file r_file_perms;
 # For now, everyone can access core property files
 # Device specific properties are not granted by default
 get_prop(domain, core_property_type)
+# Let everyone read log properties, so that liblog can avoid sending unloggable
+# messages to logd.
+get_prop(domain, log_property_type)
 dontaudit domain property_type:file audit_access;
 allow domain property_contexts:file r_file_perms;
 

property.te

@@ -12,6 +12,7 @@ type net_radio_prop, property_type, core_property_type;
 type system_radio_prop, property_type, core_property_type;
 type system_prop, property_type, core_property_type;
 type vold_prop, property_type, core_property_type;
+type wifi_log_prop, property_type, log_property_type;
 type ctl_bootanim_prop, property_type;
 type ctl_default_prop, property_type;
 type ctl_dumpstate_prop, property_type;
@@ -21,6 +22,7 @@ type ctl_rildaemon_prop, property_type;
 type ctl_bugreport_prop, property_type;
 type ctl_console_prop, property_type;
 type audio_prop, property_type, core_property_type;
+type log_prop, property_type, log_property_type;
 type logd_prop, property_type, core_property_type;
 type mmc_prop, property_type;
 type restorecon_prop, property_type, core_property_type;

property_contexts

@@ -32,7 +32,8 @@ bluetooth.              u:object_r:bluetooth_prop:s0
 debug.                  u:object_r:debug_prop:s0
 debug.db.               u:object_r:debuggerd_prop:s0
 dumpstate.              u:object_r:dumpstate_prop:s0
-log.                    u:object_r:shell_prop:s0
+log.                    u:object_r:log_prop:s0
+log.tag.WifiHAL         u:object_r:wifi_log_prop:s0
 service.adb.root        u:object_r:shell_prop:s0
 service.adb.tcp.port    u:object_r:shell_prop:s0
 
@@ -40,7 +41,7 @@ persist.audio.          u:object_r:audio_prop:s0
 persist.debug.          u:object_r:persist_debug_prop:s0
 persist.logd.           u:object_r:logd_prop:s0
 persist.logd.security   u:object_r:device_logging_prop:s0
-persist.log.tag         u:object_r:logd_prop:s0
+persist.log.tag         u:object_r:log_prop:s0
 persist.mmc.            u:object_r:mmc_prop:s0
 persist.sys.            u:object_r:system_prop:s0
 persist.sys.safemode    u:object_r:safemode_prop:s0

shell.te

@@ -63,6 +63,8 @@ set_prop(shell, ctl_dumpstate_prop)
 set_prop(shell, dumpstate_prop)
 set_prop(shell, debug_prop)
 set_prop(shell, powerctl_prop)
+userdebug_or_eng(`set_prop(shell, log_prop)')
+userdebug_or_eng(`set_prop(shell, wifi_log_prop)')
 
 # systrace support - allow atrace to run
 allow shell debugfs_tracing:dir r_dir_perms;

system_app.te

@@ -31,6 +31,7 @@ set_prop(system_app, system_prop)
 set_prop(system_app, logd_prop)
 set_prop(system_app, net_radio_prop)
 set_prop(system_app, system_radio_prop)
+set_prop(system_app, log_prop)
 auditallow system_app net_radio_prop:property_service set;
 auditallow system_app system_radio_prop:property_service set;
 

system_server.te

@@ -321,6 +321,7 @@ set_prop(system_server, debug_prop)
 set_prop(system_server, powerctl_prop)
 set_prop(system_server, fingerprint_prop)
 set_prop(system_server, device_logging_prop)
+userdebug_or_eng(`set_prop(system_server, wifi_log_prop)')
 
 # ctl interface
 set_prop(system_server, ctl_default_prop)