Skip to content
Snippets Groups Projects
Select Git revision
0 results
Search by author
  • Any Author
  • Werner Sembach Matombo
  • dex dex dex
2 authors
  1. Jun 08, 2017
  3. Jun 06, 2017
  5. Jun 05, 2017
    • Josh Gao's avatar
      crash_dump_fallback: allow dumpstate:pipe_file write. · 7aa08523
      Josh Gao authored 
      It appears that selinux requires the write permission to receive
a writable pipe from dumpstate, for unclear reasons. Add the permission
for now.

Bug: http://b/62297059
Test: dumpstate
Change-Id: I0f25682177115aacd5c2203ddc0008228b0380ad
      7aa08523
    • Jeff Vander Stoep's avatar
      Run Treble sepolicy tests at build time · 1fc0682e
      Jeff Vander Stoep authored 
      Bug: 37008075
Test: build policy on Marlin
Change-Id: I53748f94c5df66fa17a53e7d0bed1be6b8603544
(cherry picked from commit e1ddc6df)
      1fc0682e
    • Sandeep Patil's avatar
      Fix coredomain violation for modprobe · e41af203
      Sandeep Patil authored 
      
modprobe domain was allowed to launch vendor toolbox even if its a
coredomain. That violates the treble separation. Fix that by creating a
separate 'vendor_modprobe' domain that init is allowed to transition to
through vendor_toolbox.

Bug: 37008075
Test: Build and boot sailfish

Change-Id: Ic3331797691bb5d1fdc05a674aa4aa313e1f86b2
Signed-off-by: default avatarSandeep Patil <sspatil@google.com>
(cherry picked from commit 9e366a0e)
      e41af203
    • Jeff Vander Stoep's avatar
      Verify correct application of labels and attributes · bdfc0301
      Jeff Vander Stoep authored 
      With project Treble, we're relying heavily on attributes for
permission inheritance and enforcement of separation between
platform and vendor components.

We neead tests that verify those attributes are correctly applied.
This change adds the framework for those tests including a wrapper
around libsepol for loading and querying policy, and a python module
for running tests on policy and file_contexts.

Included with the testing framework is a test asserting that the
coredomain attribute is only applied to core processes. This
verification is done using the following rules:
1. Domain's entrypoint is on /system - coredomain
2. Domain's entrypoint is on /vendor - not coredomain
3. Domain belongs to a whitelist of known coredomains - coredomain

In a subsequent commit these tests will be applied at build time.
However, I first need to fix existing Treble violations exposed by
this test. These tests will also be applied during CTS.

Test: LD_PRELOAD=$ANDROID_HOST_OUT/lib64/libsepolwrap.so python \
    treble.py -p $OUT/vendor/etc/selinux/precompiled_sepolicy \
    -f $OUT/vendor/etc/selinux/nonplat_file_contexts \
    -f $OUT/system/etc/selinux/plat_file_contexts
Bug: 37008075
Change-Id: I7825f5c2909a5801deaccf2bef2bfd227adb0ae9
(cherry picked from commit 0366afdf)
      bdfc0301
  7. Jun 03, 2017
  9. Jun 02, 2017
  11. Jun 01, 2017