Skip to content
Snippets Groups Projects
  1. Sep 26, 2017
  2. Sep 25, 2017
  3. Sep 23, 2017
    • Jeff Vander Stoep's avatar
      Remove domain_deprecated audit logging · 5d8b059f
      Jeff Vander Stoep authored
      These are no longer necessary as domain_deprecated has been
      removed in AOSP master.
      
      Bug: 66749762
      Test: build
      Merged-In: I99953ecc7d275fdbe8e56d8f47a27d1f9e1cc09a
      Change-Id: I01878a4410f8cb3c97ff96c67845dfaa7b0051ce
      5d8b059f
  4. Sep 20, 2017
  5. Sep 19, 2017
  6. Sep 18, 2017
    • Peng Xu's avatar
      Allow sensor hal to use wakelock · 8c5a6814
      Peng Xu authored
      am: 4c4b433c
      
      Change-Id: Ibb136df8fadd90013455cd8ff476ed28551f40e2
      8c5a6814
    • Peng Xu's avatar
      Allow sensor hal to use wakelock · 4c4b433c
      Peng Xu authored
      Added permission related to use of wake lock. Wakelock in sensor
      HAL is used to gurantee delivery of wake up sensor events before
      system go back to sleep.
      
      Bug: 63995095
      Test: QCOM and nanohub sensor hal are able to acquire wakelock
            successfuly.
      
      Change-Id: Id4ac3552e18a1cad252017e3dc9ab3d4be8d4ab9
      Merged-In: Id4ac3552e18a1cad252017e3dc9ab3d4be8d4ab9
      4c4b433c
  7. Sep 16, 2017
  8. Sep 15, 2017
    • Jeff Vander Stoep's avatar
      do not expand hal_cas attribute · aa5f37da
      Jeff Vander Stoep authored
      Addresses:
      junit.framework.AssertionFailedError: The following errors were
      encountered when validating the SELinuxneverallow rule:
      neverallow {   domain   -adbd   -dumpstate   -hal_drm -hal_cas -init
      -mediadrmserver   -recovery   -shell   -system_server }
      serialno_prop:file { getattr open read ioctl lock map };
      Warning!  Type or attribute hal_cas used in neverallow undefined in
      policy being checked.
      libsepol.report_failure: neverallow violated by allow mediaextractor
      serialno_prop:file { ioctl read getattr lock map open };
      libsepol.report_failure: neverallow violated by allow mediacodec
      serialno_prop:file { ioctl read getattr lock map open };
      libsepol.report_failure: neverallow violated by allow hal_cas_default
      serialno_prop:file { ioctl read getattr lock map open };
      libsepol.check_assertions: 3 neverallow failures occurred
      
      Bug: 65681219
      Test: build
      Change-Id: I2a6445d6372ee4e768cc2cea2140c6de97707a74
      Merged-In: I1092aff40da9dcf09bd044400bedd1f549eb7e38
      aa5f37da
  9. Sep 11, 2017
  10. Sep 01, 2017
  11. Aug 31, 2017
    • Steven Moreland's avatar
      Add permissions for screencap for dumpstate. · b5dd44b1
      Steven Moreland authored
      screencap domain needs additional permissions for
      dumpstate to dump screenshots.
      
      Test: adb shell cmd activity bug-report
      Bug: 65206688
      Change-Id: I824f345fd90d286454d570576c5888d7719c4c5c
      b5dd44b1
    • Steven Moreland's avatar
      Permissions for screencap saving files to /sdcard/ · 7d60f385
      Steven Moreland authored
      am: c12c7349
      
      Change-Id: I254f296e81225510d909d8bab8e20e648b2d18df
      7d60f385
    • Ray Essick's avatar
      Give media.metrics service access to uid/pkg info · 9b0924e1
      Ray Essick authored
      relax the sepolicy for media.metrics to allow access to
      package manager for uid->packagename mapping functionality.
      
      Bug: 65027506
      Test: read output of 'dumpsys media.metrics'
      Change-Id: I0d25af16c06dc65154cfda854e28ab70ada097c4
      9b0924e1
    • Steven Moreland's avatar
      Permissions for screencap saving files to /sdcard/ · c12c7349
      Steven Moreland authored
      Before screencap was in its own domain, it was able to do
      this by using all of shell's permissions.
      
      The following denials are caused (along with times from running the below test command)
      when screencap is invoked to write a file onto the sdcard:
      08-30 21:03:32.009  4986  4986 I screencap: type=1400 audit(0.0:23): avc: denied { read } for name="primary" dev="tmpfs" ino=19547 scontext=u:r:screencap:s0 tcontext=u:object_r:storage_file:s0 tclass=lnk_file permissive=1
      08-30 21:03:32.009  4986  4986 I screencap: type=1400 audit(0.0:24): avc: denied { search } for name="/" dev="tmpfs" ino=19529 scontext=u:r:screencap:s0 tcontext=u:object_r:tmpfs:s0 tclass=dir permissive=1
      08-30 21:03:32.009  4986  4986 I screencap: type=1400 audit(0.0:25): avc: denied { search } for name="user" dev="tmpfs" ino=19535 scontext=u:r:screencap:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir permissive=1
      08-30 21:03:32.009  4986  4986 I screencap: type=1400 audit(0.0:26): avc: denied { read } for name="primary" dev="tmpfs" ino=31198 scontext=u:r:screencap:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=lnk_file permissive=1
      08-30 21:03:32.009  4986  4986 I screencap: type=1400 audit(0.0:27): avc: denied { search } for name="/" dev="sdcardfs" ino=1310722 scontext=u:r:screencap:s0 tcontext=u:object_r:sdcardfs:s0 tclass=dir permissive=1
      08-30 21:03:32.009  4986  4986 I screencap: type=1400 audit(0.0:28): avc: denied { write } for name="image.png" dev="sdcardfs" ino=1310764 scontext=u:r:screencap:s0 tcontext=u:object_r:sdcardfs:s0 tclass=file permissive=1
      08-30 21:03:32.009  4986  4986 I screencap: type=1400 audit(0.0:29): avc: denied { open } for path="/storage/emulated/0/image.png" dev="sdcardfs" ino=1310764 scontext=u:r:screencap:s0 tcontext=u:object_r:sdcardfs:s0 tclass=file permissive=1
      08-30 21:03:32.009  4986  4986 I screencap: type=1400 audit(0.0:30): avc: denied { write open } for path="/data/media/0/image.png" dev="sda45" ino=1310764 scontext=u:r:screencap:s0 tcontext=u:object_r:media_rw_data_file:s0 tclass=file permissive=1
      08-30 21:03:32.582  4990  4990 I screencap: type=1400 audit(0.0:31): avc: denied { execute } for name="sh" dev="dm-0" ino=998 scontext=u:r:screencap:s0 tcontext=u:object_r:shell_exec:s0 tclass=file permissive=1
      08-30 21:03:32.582  4990  4990 I screencap: type=1400 audit(0.0:32): avc: denied { read open } for path="/system/bin/sh" dev="dm-0" ino=998 scontext=u:r:screencap:s0 tcontext=u:object_r:shell_exec:s0 tclass=file permissive=1
      08-30 21:03:32.582  4990  4990 I screencap: type=1400 audit(0.0:33): avc: denied { execute_no_trans } for path="/system/bin/sh" dev="dm-0" ino=998 scontext=u:r:screencap:s0 tcontext=u:object_r:shell_exec:s0 tclass=file permissive=1
      08-30 21:03:32.582  4990  4990 I sh      : type=1400 audit(0.0:34): avc: denied { getattr } for path="/system/bin/sh" dev="dm-0" ino=998 scontext=u:r:screencap:s0 tcontext=u:object_r:shell_exec:s0 tclass=file permissive=1
      08-30 21:03:32.586  4990  4990 I sh      : type=1400 audit(0.0:35): avc: denied { ioctl } for path="socket:[57515]" dev="sockfs" ino=57515 ioctlcmd=5401 scontext=u:r:screencap:s0 tcontext=u:r:adbd:s0 tclass=unix_stream_socket permissive=1
      08-30 21:03:32.586  4990  4990 I sh      : type=1400 audit(0.0:36): avc: denied { getattr } for path="socket:[57515]" dev="sockfs" ino=57515 scontext=u:r:screencap:s0 tcontext=u:r:adbd:s0 tclass=unix_stream_socket permissive=1
      08-30 21:03:32.589  4991  4991 I sh      : type=1400 audit(0.0:37): avc: denied { execute_no_trans } for path="/system/bin/am" dev="dm-0" ino=1178 scontext=u:r:screencap:s0 tcontext=u:object_r:system_file:s0 tclass=file permissive=1
      08-30 21:03:32.739  4992  4992 I cmd     : type=1400 audit(0.0:38): avc: denied { call } for scontext=u:r:screencap:s0 tcontext=u:r:system_server:s0 tclass=binder permissive=1
      08-30 21:03:32.739  4992  4992 I cmd     : type=1400 audit(0.0:39): avc: denied { use } for path="/dev/null" dev="tmpfs" ino=19514 scontext=u:r:system_server:s0 tcontext=u:r:screencap:s0 tclass=fd permissive=1
      08-30 21:03:32.739  4992  4992 I cmd     : type=1400 audit(0.0:40): avc: denied { transfer } for scontext=u:r:screencap:s0 tcontext=u:r:system_server:s0 tclass=binder permissive=1
      08-30 21:03:32.741   575   575 E SELinux : avc:  denied  { find } for service=activity pid=4992 uid=2000 scontext=u:r:screencap:s0 tcontext=u:object_r:activity_service:s0 tclass=service_manager permissive=1
      08-30 21:03:32.749   837   837 I Binder:837_9: type=1400 audit(0.0:41): avc: denied { call } for scontext=u:r:system_server:s0 tcontext=u:r:screencap:s0 tclass=binder permissive=1
      
      If /data/media/ is deleted, the following denials also occur:
      08-31 00:45:45.966  8899  8899 I screencap: type=1400 audit(0.0:43): avc: denied { search } for name="0" dev="sda45" ino=1310728 scontext=u:r:screencap:s0 tcontext=u:object_r:media_rw_data_file:s0 tclass=dir permissive=1
      08-31 00:45:45.966  8899  8899 I screencap: type=1400 audit(0.0:44): avc: denied { read open } for path="/data/media/0" dev="sda45" ino=1310728 scontext=u:r:screencap:s0 tcontext=u:object_r:media_rw_data_file:s0 tclass=dir permissive=1
      08-31 00:45:45.966  8899  8899 I screencap: type=1400 audit(0.0:48): avc: denied { write } for name="0" dev="sda45" ino=1310728 scontext=u:r:screencap:s0 tcontext=u:object_r:media_rw_data_file:s0 tclass=dir permissive=1
      08-31 00:45:45.966  8899  8899 I screencap: type=1400 audit(0.0:49): avc: denied { add_name } for name="image.png" scontext=u:r:screencap:s0 tcontext=u:object_r:media_rw_data_file:s0 tclass=dir permissive=1
      08-31 00:45:45.966  8899  8899 I screencap: type=1400 audit(0.0:50): avc: denied { create } for name="image.png" scontext=u:r:screencap:s0 tcontext=u:object_r:media_rw_data_file:s0 tclass=file permissive=1
      08-31 00:45:45.966  8899  8899 I screencap: type=1400 audit(0.0:51): avc: denied { setattr } for name="image.png" dev="sda45" ino=1310764 scontext=u:r:screencap:s0 tcontext=u:object_r:media_rw_data_file:s0 tclass=file permissive=1
      08-31 00:45:45.966  8899  8899 I screencap: type=1400 audit(0.0:53): avc: denied { write open } for path="/data/media/0/image.png" dev="sda45" ino=1310764 scontext=u:r:screencap:s0 tcontext=u:object_r:media_rw_data_file:s0 tclass=file permissive=1
      08-31 01:04:29.741  6625  6625 W screencap: type=1400 audit(0.0:23): avc: denied { write } for name="0" dev="sdcardfs" ino=655364 scontext=u:r:screencap:s0 tcontext=u:object_r:sdcardfs:s0 tclass=dir permissive=0
      
      Test: adb shell screencap -p /sdcard/phone.png
      Bug: 65206688
      Change-Id: I808429b25fa3118fef7931050ab757c9bcd61881
      c12c7349
  12. Aug 29, 2017
Loading