Skip to content
Snippets Groups Projects
  1. Jan 23, 2017
  2. Jan 20, 2017
  3. Jan 19, 2017
  4. Jan 18, 2017
    • Max Bires's avatar
      Removing setprop permissions from rild. · 8aef51e7
      Max Bires authored
      There were some auditallow rules left around in rild.te that had logs
      showing nothing was triggering them. Thus the rules they were auditing
      could be removed, as that's clear indication there's no use for them.
      Having rules around that aren't being used does nothing except increase
      attack surface and bloat sepolicy, and so should always be removed if
      possible.
      
      Test: The device boots
      Change-Id: I906ffc493807fbae90593548d478643cda4864eb
      8aef51e7
    • mukesh agrawal's avatar
      allow init and system_server access to tracing · 3a6bc68e
      mukesh agrawal authored
      Revise policy, to allow init and system_server to configure,
      clear, and read kernel trace events. This will enable us to
      debug certain WiFi failures.
      
      Note that system_server is restricted to only accessing
      a wifi-specific trace instance. (Hence, system_server is
      not allowed to interfere with atrace.) Moreover, even for
      the wifi trace instance, system_server is granted limited
      permissions. (system_server can not, e.g., change which
      events are traced.)
      
      Note also that init and system_server are only granted these
      powers on userdebug or eng builds.
      
      The init.te and system_server.te changes resolve the
      following denials:
      
      // Denials when wifi-events.rc configures tracing
      { write } for pid=1 comm="init" name="instances" dev="debugfs" ino=755 scontext=u:r:init:s0 tcontext=u:object_r:debugfs_tracing_instances:s0 tclass=dir permissive=1
      { add_name } for pid=1 comm="init" name="wifi" scontext=u:r:init:s0 tcontext=u:object_r:debugfs_tracing_instances:s0 tclass=dir permissive=1
      { create } for pid=1 comm="init" name="wifi" scontext=u:r:init:s0 tcontext=u:object_r:debugfs_tracing_instances:s0 tclass=dir permissive=1
      { write } for pid=1 comm="init" name="tracing_on" dev="debugfs" ino=18067 scontext=u:r:init:s0 tcontext=u:object_r:debugfs_wifi_tracing:s0 tclass=file permissive=1
      { write } for pid=1 comm="init" name="buffer_size_kb" dev="debugfs" ino=18061 scontext=u:r:init:s0 tcontext=u:object_r:debugfs_tracing_instances:s0 tclass=file permissive=1
      
      // Denials when system_server sets up fail-safe
      // (auto-terminate tracing if system_server dies)
      { search } for pid=882 comm="system_server" name="instances" dev="debugfs" ino=755 scontext=u:r:system_server:s0 tcontext=u:object_r:debugfs_tracing_instances:s0 tclass=dir permissive=1
      { read } for pid=882 comm="system_server" name="free_buffer" dev="debugfs" ino=18063 scontext=u:r:system_server:s0 tcontext=u:object_r:debugfs_wifi_tracing:s0 tclass=file permissive=1
      { open } for pid=882 comm="system_server" path="/sys/kernel/debug/tracing/instances/wifi/free_buffer" dev="debugfs" ino=18063 scontext=u:r:system_server:s0 tcontext=u:object_r:debugfs_wifi_tracing:s0 tclass=file permissive=1
      { getattr } for pid=882 comm="system_server" path="/sys/kernel/debug/tracing/instances/wifi/free_buffer" dev="debugfs" ino=18063 scontext=u:r:system_server:s0 tcontext=u:object_r:debugfs_wifi_tracing:s0 tclass=file permissive=1
      
      // Denials when system_server toggles tracing on or off
      // (WifiStateMachine is a thread in system_server)
      { search } for pid=989 comm="WifiStateMachin" name="instances" dev="debugfs" ino=755 scontext=u:r:system_server:s0 tcontext=u:object_r:debugfs_tracing_instances:s0 tclass=dir permissive=1
      { write } for pid=989 comm="WifiStateMachin" name="tracing_on" dev="debugfs" ino=18067 scontext=u:r:system_server:s0 tcontext=u:object_r:debugfs_wifi_tracing:s0 tclass=file permissive=1
      { open } for pid=989 comm="WifiStateMachin" path="/sys/kernel/debug/tracing/instances/wifi/tracing_on" dev="debugfs" ino=18067 scontext=u:r:system_server:s0 tcontext=u:object_r:debugfs_wifi_tracing:s0 tclass=file permissive=1
      { getattr } for pid=989 comm="WifiStateMachin" path="/sys/kernel/debug/tracing/instances/wifi/tracing_on" dev="debugfs" ino=18067 scontext=u:r:system_server:s0 tcontext=u:object_r:debugfs_wifi_tracing:s0 tclass=file permissive=1
      { write } for pid=989 comm="WifiStateMachin" name="tracing_on" dev="debugfs" ino=18067 scontext=u:r:system_server:s0 tcontext=u:object_r:debugfs_wifi_tracing:s0 tclass=file permissive=1
      { open } for pid=989 comm="WifiStateMachin" path="/sys/kernel/debug/tracing/instances/wifi/tracing_on" dev="debugfs" ino=18067 scontext=u:r:system_server:s0 tcontext=u:object_r:debugfs_wifi_tracing:s0 tclass=file permissive=1
      { getattr } for pid=989 comm="WifiStateMachin" path="/sys/kernel/debug/tracing/instances/wifi/tracing_on" dev="debugfs" ino=18067 scontext=u:r:system_server:s0 tcontext=u:object_r:debugfs_wifi_tracing:s0 tclass=file permissive=1
      
      // Denials when system_server reads the event trace
      // (This happens in response to a dumpsys request)
      { search } for pid=3537 comm="Binder:882_B" name="instances" dev="debugfs" ino=755 scontext=u:r:system_server:s0 tcontext=u:object_r:debugfs_tracing_instances:s0 tclass=dir permissive=1
      { read } for pid=3537 comm="Binder:882_B" name="trace" dev="debugfs" ino=18059 scontext=u:r:system_server:s0 tcontext=u:object_r:debugfs_wifi_tracing:s0 tclass=file permissive=1
      { open } for pid=3537 comm="Binder:882_B" path="/sys/kernel/debug/tracing/instances/wifi/trace" dev="debugfs" ino=18059 scontext=u:r:system_server:s0 tcontext=u:object_r:debugfs_wifi_tracing:s0 tclass=file permissive=1
      { getattr } for pid=3537 comm="Binder:882_B" path="/sys/kernel/debug/tracing/instances/wifi/trace" dev="debugfs" ino=18059 scontext=u:r:system_server:s0 tcontext=u:object_r:debugfs_wifi_tracing:s0 tclass=file permissive=1
      { write } for pid=3537 comm="Binder:882_B" name="trace" dev="debugfs" ino=18059 scontext=u:r:system_server:s0 tcontext=u:object_r:debugfs_wifi_tracing:s0 tclass=file permissive=1
      
      Bug: 27254565
      Test: manual
      Manual test:
      - Build this CL along with CL:322337
      - Verify that system boots, and that we can connect to GoogleGuest.
        (Testing of actual trace functionality with require some more
        patches in frameworks/opt/net/wifi.)
      $ adb root && adb shell dmesg | egrep 'avc: denied.+debugfs'
      
      Change-Id: Ib6eb4116549277f85bd510d25fb30200f1752f4d
      3a6bc68e
    • Josh Gao's avatar
      Introduce crash_dump debugging helper. · cb3eb4ee
      Josh Gao authored
      Replace the global debuggerd with a per-process debugging helper that
      gets exec'ed by the process that crashed.
      
      Bug: http://b/30705528
      Test: crasher/crasher64, `debuggerd <pid>`, `kill -ABRT <pid>`
      Change-Id: Iad1b7478f7a4e2690720db4b066417d8b66834ed
      cb3eb4ee
    • Treehugger Robot's avatar
    • Treehugger Robot's avatar
      becc13e8
    • Eino-Ville Talvala's avatar
      DO NOT MERGE: Camera: Add initial Treble camera HAL sepolicy · 9c43a3ff
      Eino-Ville Talvala authored
      - Allow cameraservice to talk to hwbinder, hwservicemanager
      - Allow hal_camera to talk to the same interfaces as cameraservice
      
      Test: Compiles, confirmed that cameraservice can call hwservicemanager
      Bug: 32991422
      Change-Id: Ied0a3f5f7149e29c468a13887510c78d555dcb2a
      9c43a3ff
    • Jin Qian's avatar
      Define policy for /proc/uid_io/stats · d345906b
      Jin Qian authored
      New procfs file read by storaged to dump fg/bg IO usage.
      
      Remove kmsg rule since it's no longer used by storaged.
      
      Allow storaged to find permission_service to translate UID
      to package name.
      
      Test: adb shell storaged -u
      Bug: 34198239
      Change-Id: I74654662c75571cbe166cf2b8cbab84828218cbd
      d345906b
    • Colin Cross's avatar
      Fix incremental builds · 596fa95f
      Colin Cross authored
      Some recent CLs changed the list of files that are installed in the
      root directory.  Incremental builds have no way to uninstall files
      that were previously installed, which results in old stray files lying
      around.  If the root directory is contained in system.img, this causes
      an error while building system.img:
      error: build_directory_structure: cannot lookup security context for /service_contexts
      
      Update CleanSpec.mk to remove files obsoleted by:
      Ide67d37d85273c60b9e387e72fbeb87be6da306a
      I7881af8922834dc69b37dae3b06d921e05206564
      Ide67d37d85273c60b9e387e72fbeb87be6da306a
      
      This is not seen on the incremental build servers because they run
      make installclean between builds.
      
      Test: incremental build passes
      Change-Id: I22ecd1d3698404df352263fa99b56cb65247a23b
      596fa95f
    • Steven Moreland's avatar
      haldomain: add hwbinder_use · a2519226
      Steven Moreland authored
      All hals need to use hwbinder.
      
      Test: no additional denials
      Bug: 34180936
      Change-Id: Ie92cdbd79fc75062c4afa4cda53cb57ccde7e370
      a2519226
    • Jorim Jaggi's avatar
    • Jorim Jaggi's avatar
      Revert "property_context: split into platform and non-platform components." · aa03ef26
      Jorim Jaggi authored
      This reverts commit 262edc38.
      
      Fixes: 34370523
      Change-Id: I077d064d4031d40bc48cb39eba310e6c16b9627d
      aa03ef26
    • Treehugger Robot's avatar
    • Daichi Hirono's avatar
      Don't open appfuse files in apps. · 7ae1d237
      Daichi Hirono authored
      Previously we published appfuse mount points to apps and apps open
      appfuse file by themselves. We changed the design and we don't allow
      apps to access appfuse mount point. Instead system server opens a file
      on appfuse mount points and passes FD to apps.
      
      The change updates apps and system server policies to adopt new design.
      
      Bug: 29970149
      Test: None
      Change-Id: I0b35fee9816f61565705eecb88a472754ccffdca
      7ae1d237
    • Jeff Sharkey's avatar
      Define policy for /proc/uid_procstat/set. · 828433c8
      Jeff Sharkey authored
      New procfs file written by the system_server to communicate fg/bg
      state of UIDs to switch the statistics counter sets used.
      
      avc: denied { write } for name="set" dev="proc" ino=4026531862 scontext=u:r:system_server:s0 tcontext=u:object_r:proc:s0 tclass=file permissive=1
      
      Test: builds, boots, counter sets updated
      Bug: 34360629
      Change-Id: I2efbfbba9e73f50ce50a80a3dffd3b14fa55c048
      828433c8
Loading