Skip to content
Snippets Groups Projects
  1. Apr 11, 2017
    • Sandeep Patil's avatar
      sepolicy: make exec_types in /vendor a subset of vendor_file_type · 2ee66e7d
      Sandeep Patil authored
      
      We install all default hal implementations in /vendor/bin/hw along with
      a few domains that are defined in vendor policy and installed in
      /vendor. These files MUST be a subset of the global 'vendor_file_type'
      which is used to address *all files installed in /vendor* throughout the
      policy.
      
      Bug: 36463595
      Test: Boot sailfish without any new denials
      
      Change-Id: I3d26778f9a26f9095f49d8ecc12f2ec9d2f4cb41
      Signed-off-by: default avatarSandeep Patil <sspatil@google.com>
      2ee66e7d
  2. Mar 17, 2017
    • Alex Klyubin's avatar
      Annotate most remaining HALs with _client/_server · 9e6b24c6
      Alex Klyubin authored
      This switches most remaining HALs to the _client/_server approach.
      To unblock efforts blocked on majority of HALs having to use this
      model, this change does not remove unnecessary rules from clients of
      these HALs. That work will be performed in follow-up commits. This
      commit only adds allow rules and thus does not break existing
      functionality.
      
      The HALs not yet on the _client/_server model after this commit are:
      * Allocator HAL, because it's non-trivial to declare all apps except
        isolated apps as clients of this HAL, which they are.
      * Boot HAL, because it's still on the non-attributized model and I'm
        waiting for update_engine folks to answer a couple of questions
        which will let me refactor the policy of this HAL.
      
      Test: mmm system/sepolicy
      Test: Device boots, no new denials
      Test: Device boots in recovery mode, no new denials
      Bug: 34170079
      Change-Id: I03e6bcec2fa02f14bdf17d11f7367b62c68a14b9
      9e6b24c6
  3. Feb 15, 2017
    • Alex Klyubin's avatar
      Move hal_*_default policy to vendor image · ac1a6d44
      Alex Klyubin authored
      hal_*_default daemons whose policy is in common/device-agnostic policy
      are provided by the vendor image (see vendor/file_contexts). Thus,
      their policy should also reside in the vendor image, rather than in
      the system image. This means their policy should live in the vendor
      subdirectory of this project.
      
      Test: Device boots and appears to work
      Bug: 34135607
      Bug: 34170079
      Change-Id: I6613e43733e03d4a3d4726f849732d903e024016
      ac1a6d44
  4. Jan 17, 2017
    • Alex Klyubin's avatar
      Group all HAL impls using haldomain attribute · f41d89eb
      Alex Klyubin authored
      This marks all HAL domain implementations with the haldomain attribute
      so that rules can be written which apply to all HAL implementations.
      
      This follows the pattern used for appdomain, netdomain and
      bluetoothdomain.
      
      Test: No change to policy according to sesearch.
      Bug: 34180936
      Change-Id: I0cfe599b0d49feed36538503c226dfce41eb65f6
      f41d89eb
  5. Dec 15, 2016
  6. Dec 14, 2016
Loading