Merge cherrypicks of [2836977, 2836171, 2836172, 2836173, 2836174, 2836978,...

Merge cherrypicks of [2836977, 2836171, 2836172, 2836173, 2836174, 2836978, 2836979] into oc-mr1-release

Change-Id: Iac019fd094fb2f6fc752abff02bb220d646578c8

private/adbd.te

@@ -65,9 +65,14 @@ get_prop(adbd, serialno_prop)
 # Run /system/bin/bu
 allow adbd system_file:file rx_file_perms;
 
-# Use screencap
-domain_auto_trans(adbd, screencap_exec, screencap)
-allow adbd screencap:process signal;
+# Perform binder IPC to surfaceflinger (screencap)
+# XXX Run screencap in a separate domain?
+binder_use(adbd)
+binder_call(adbd, surfaceflinger)
+# b/13188914
+allow adbd gpu_device:chr_file rw_file_perms;
+allow adbd ion_device:chr_file rw_file_perms;
+r_dir_file(adbd, system_file)
 
 # Needed for various screenshots
 hal_client_domain(adbd, hal_graphics_allocator)
@@ -134,5 +139,5 @@ allow adbd rootfs:dir r_dir_perms;
 # No transitions from adbd to non-shell, non-crash_dump domains. adbd only ever
 # transitions to the shell domain (except when it crashes). In particular, we
 # never want to see a transition from adbd to su (aka "adb root")
-neverallow adbd { domain -crash_dump -shell -screencap }:process transition;
+neverallow adbd { domain -crash_dump -shell }:process transition;
 neverallow adbd { domain userdebug_or_eng(`-su') }:process dyntransition;

private/app.te

@@ -409,9 +409,7 @@ neverallow appdomain { domain -appdomain }:file write;
 # sigchld allowed for parent death notification.
 # signull allowed for kill(pid, 0) existence test.
 # All others prohibited.
-neverallow { appdomain -shell } { domain -appdomain }:process
-    { sigkill sigstop signal };
-neverallow shell { domain -appdomain -screencap }:process
+neverallow appdomain { domain -appdomain }:process
     { sigkill sigstop signal };
 
 # Transition to a non-app domain.

private/compat/26.0/26.0.ignore.cil

@@ -31,6 +31,4 @@
 ;;     Thus, these types are also not mapped, but recorded for checkapi tests
 (typeattribute priv_objects)
 (typeattributeset priv_objects
-     ( adbd_tmpfs
-       screencap
-       screencap_exec ))
+     ( adbd_tmpfs ))

private/dumpstate.te

@@ -24,7 +24,3 @@ binder_call(dumpstate, storaged)
 
 # Collect metrics on boot time created by init
 get_prop(dumpstate, boottime_prop)
-
-# Use screencap
-domain_auto_trans(dumpstate, screencap_exec, screencap)
-allow dumpstate screencap:process signal;

private/file_contexts

@@ -212,7 +212,6 @@
 /system/bin/mediametrics	u:object_r:mediametrics_exec:s0
 /system/bin/cameraserver	u:object_r:cameraserver_exec:s0
 /system/bin/mediaextractor	u:object_r:mediaextractor_exec:s0
-/system/bin/screencap	u:object_r:screencap_exec:s0
 /system/bin/mdnsd	u:object_r:mdnsd_exec:s0
 /system/bin/installd	u:object_r:installd_exec:s0
 /system/bin/otapreopt_chroot   u:object_r:otapreopt_chroot_exec:s0

private/screencap.te

-type screencap_exec, exec_type, file_type;
-
-typeattribute screencap coredomain;
-
-allow screencap gpu_device:chr_file rw_file_perms;
-allow screencap ion_device:chr_file rw_file_perms;
-
-allow screencap adbd:fifo_file write;
-allow screencap adbd:fd use;
-allow screencap adbd:unix_stream_socket { read write getattr ioctl };
-
-allow screencap shell_data_file:file write;
-allow screencap shell:fd use;
-allow screencap shell:unix_stream_socket { read write };
-
-allow screencap dumpstate:fd use;
-allow screencap dumpstate:unix_stream_socket { read write };
-
-binder_use(screencap)
-binder_call(screencap, surfaceflinger)
-allow screencap surfaceflinger_service:service_manager find;
-binder_call(screencap, system_server)
-allow screencap activity_service:service_manager find;
-
-hwbinder_use(screencap)
-hal_client_domain(screencap, hal_graphics_allocator)
-
-allow screencap shell_exec:file rx_file_perms;
-allow screencap system_file:file execute_no_trans;
-
-allow screencap media_rw_data_file:dir rw_dir_perms;
-allow screencap media_rw_data_file:file rw_file_perms;
-allow screencap mnt_user_file:dir search;
-allow screencap mnt_user_file:lnk_file read;
-allow screencap sdcardfs:dir { search write };
-allow screencap sdcardfs:file { open write };
-allow screencap shell_data_file:file create_file_perms;
-allow screencap shell_data_file:dir rw_dir_perms;
-allow screencap storage_file:dir search;
-allow screencap storage_file:lnk_file read;
-allow screencap tmpfs:dir search;

private/shell.te

@@ -26,7 +26,3 @@ binder_call(shell, storaged)
 # Perform SELinux access checks, needed for CTS
 selinux_check_access(shell)
 selinux_check_context(shell)
-
-# Use screencap
-domain_auto_trans(shell, screencap_exec, screencap)
-allow shell screencap:process signal;

private/surfaceflinger.te

@@ -21,7 +21,6 @@ binder_use(surfaceflinger)
 binder_call(surfaceflinger, binderservicedomain)
 binder_call(surfaceflinger, appdomain)
 binder_call(surfaceflinger, bootanim)
-binder_call(surfaceflinger, screencap)
 binder_service(surfaceflinger)
 
 # Binder IPC to bu, presently runs in adbd domain.

private/system_server.te

@@ -181,7 +181,6 @@ binder_call(system_server, gatekeeperd)
 binder_call(system_server, installd)
 binder_call(system_server, incidentd)
 binder_call(system_server, netd)
-binder_call(system_server, screencap)
 binder_call(system_server, wificond)
 binder_service(system_server)
 

public/domain.te

@@ -924,7 +924,6 @@ neverallow {
   -dumpstate
   -installd
   -init
-  -screencap
   -shell
   -vold
 } shell_data_file:dir no_w_dir_perms;
@@ -936,7 +935,6 @@ neverallow {
   -dumpstate
   -init
   -installd
-  -screencap
   -system_server # why?
   userdebug_or_eng(`-uncrypt')
 } shell_data_file:dir { open search };
@@ -949,7 +947,6 @@ neverallow {
   -appdomain
   -dumpstate
   -installd
-  -screencap
   userdebug_or_eng(`-uncrypt')
 } shell_data_file:file open;
 

public/dumpstate.te

@@ -142,6 +142,9 @@ allow dumpstate bluetooth_data_file:dir search;
 allow dumpstate bluetooth_logs_data_file:dir r_dir_perms;
 allow dumpstate bluetooth_logs_data_file:file r_file_perms;
 
+# Dumpstate calls screencap, which grabs a screenshot. Needs gpu access
+allow dumpstate gpu_device:chr_file rw_file_perms;
+
 # logd access
 read_logd(dumpstate)
 control_logd(dumpstate)

public/screencap.te

-type screencap, domain;