No longer used.  :-)

Change-Id: I687cc36404e8ad8b899b6e76b1de7ee8c5392e07

Bug: 19050686
Change-Id: Ie41c3e4d5aaeb43577ba85a4768a5fdbdd665efb
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>

The install_recovery script creates a new recovery image based
off of the boot image plus a patch on /system. We need to allow
read access to the boot image to allow the patching to succeed,
otherwise OTAs are broken.

Addresses the following denial:

  type=1400 audit(9109404.519:6): avc: denied { read } for pid=341 comm="applypatch" name="mmcblk0p37" dev="tmpfs" ino=9186 scontext=u:r:install_recovery:s0 tcontext=u:object_r:block_device:s0 tclass=blk_file permissive=0

TODO: Add device specific labels for the boot image.

Bug: 19534538
Change-Id: Ic811ec03e235df3b1bfca9b0a65e23307cd968aa

When encrypting a device, or when an encrypted device boots,
a tmpfs is mounted in place of /data, so that a pseudo filesystem
exists to start system_server and related components. SELinux labels
need to be applied to that tmpfs /data so the system boots
properly.

Allow init to relabel a tmpfs /data.

Addresses the following denial:

[    6.294896] type=1400 audit(29413651.850:4): avc:  denied  { relabelfrom } for  pid=1 comm="init" name="/" dev="tmpfs" ino=6360 scontext=u:r:init:s0 tcontext=u:object_r:tmpfs:s0 tclass=dir

Steps to reproduce:
  1) Go into Settings > Security > Encrypt Phone
  2) Encrypt phone
  3) See denial
  4) reboot phone
  5) See denial on boot

Bug: 19050686
Change-Id: Ie57864fe1079d9164d5cfea44683a97498598e41

Updating properties from ueventd may lead to deadlocks with init in rare
cases, which makes these changes unnecessary after all.

This reverts commit 47cd53a5.

Change-Id: I87bdd66f0ec025eb3a9ea17574a67e908f3de6da

STEPS TO REPRODUCE:
  1. Connect the device to Mac.
  2. Switch to AFT.
  3. Now AFT on Mac will show the device contents.
  4. Now drag and drop the file to device and observe.

EXPECTED RESULTS:
  Should able to copy.

OBSERVED RESULTS:
  Showing can not copy file and on clicking ok,
  It shows device storage can not connect and close the AFT.

Addresses the following denial:

  W kworker/u:11: type=1400 audit(0.0:729): avc: denied { use } for path="/storage/emulated/0/Download/song2.mp3" dev="fuse" ino=143 scontext=u:r:kernel:s0 tcontext=u:r:untrusted_app:s0:c512,c768 tclass=fd
  12310 12530 E MtpRequestPacket: Malformed MTP request packet

ps -Z entry:
  u:r:untrusted_app:s0:c512,c768 u0_a6     12310 203   android.process.media

Bug: 15835289
Change-Id: I47b653507f8d4089b31254c19f44706077e2e96a

clatd calls mmap(MAP_LOCKED) with a 1M buffer. MAP_LOCKED first checks
capable(CAP_IPC_LOCK), and then checks to see the requested amount is
under RLIMIT_MEMLOCK. The latter check succeeds. As a result, clatd
does not need CAP_IPC_LOCK, so we suppress any denials we see
from clatd asking for this capability.
See https://android-review.googlesource.com/127940

Suppresses the following denial:
  type=1400 audit(1424916750.163:7): avc: denied { ipc_lock } for pid=3458 comm="clatd" capability=14 scontext=u:r:clatd:s0 tcontext=u:r:clatd:s0 tclass=capability

Change-Id: Ica108f66010dfc6a5431efa0b4e58f6a784672d1

Add rules to allow /sbin/slideshow to access framebuffer and input
devices at early stages of boot, and rules to allow init to execute
the program (from init.rc using exec).

Needed by changes from
  I58c79a7f3ac747eec0d73a10f018d3d8ade9df7d

Change-Id: I1d5018feb7025853f0bf81651f497fef8c3a6ab0

Vold opens ASEC containsers on the sdcard, or OBB files from app's
home directories, both of which are supplied by vold. We need to
allow kernel threads to access those file descriptors.

Addresses the following denial:

  loop0   : type=1400 audit(0.0:28): avc: denied { use } for path="/mnt/secure/asec/smdl1159865753.tmp.asec" dev="mmcblk1" ino=19 scontext=u:r:kernel:s0 tcontext=u:r:vold:s0 tclass=fd permissive=0

Bug: 19516891
Change-Id: I5a3607b48f5e0e504e4b3fcaec19152c3784f49d

Change-Id: Icfa4b2cac6a960ef47e928308e4c6c9bd797d180
Signed-off-by: Mohamad Ayyash <mkayyash@google.com>

Revert the tightening of /proc/net access. These changes
are causing a lot of denials, and I want additional time to
figure out a better solution.

Addresses the following denials (and many more):

  avc: denied { read } for comm="SyncAdapterThre" name="stats" dev="proc" ino=X scontext=u:r:untrusted_app:s0:c512,c768 tcontext=u:object_r:proc_net:s0 tclass=file
  avc: denied { read } for comm="facebook.katana" name="iface_stat_fmt" dev="proc" ino=X scontext=u:r:untrusted_app:s0:c512,c768 tcontext=u:object_r:proc_net:s0 tclass=file
  avc: denied { read } for comm="IntentService[C" name="if_inet6" dev="proc" ino=X scontext=u:r:untrusted_app:s0:c512,c768 tcontext=u:object_r:proc_net:s0 tclass=file
  avc: denied { read } for comm="dumpstate" name="iface_stat_all" dev="proc" ino=X scontext=u:r:dumpstate:s0 tcontext=u:object_r:proc_net:s0 tclass=file

This reverts commit 0f0324cc
and commit 99940d1a

Bug: 9496886
Bug: 19034637
Change-Id: I436a6e3638ac9ed49afbee214e752fe2b0112868

Addresses the following auditallow messages:

  avc: granted { find } for service=accessibility scontext=u:r:su:s0 tcontext=u:object_r:accessibility_service:s0 tclass=service_manager
  avc: granted { find } for service=activity scontext=u:r:su:s0 tcontext=u:object_r:activity_service:s0 tclass=service_manager
  avc: granted { find } for service=package scontext=u:r:su:s0 tcontext=u:object_r:package_service:s0 tclass=service_manager
  avc: granted { find } for service=user scontext=u:r:su:s0 tcontext=u:object_r:user_service:s0 tclass=service_manager
  avc: granted { find } for service=window scontext=u:r:su:s0 tcontext=u:object_r:window_service:s0 tclass=service_manager

Change-Id: Ie58ad3347e9ef1aacd39670cfec7d095875e237b

Addresses post-review comment in
https://android-review.googlesource.com/130620

Change-Id: I427ba99d63724eb526d41da47b95cc0ae038acdd

The recovery partition has been assigned a recovery_block_device
type for the AOSP devices, so install_recovery should not need
rw access to the generic block_device type.  Remove it.

Change-Id: I31621a8157998102859a6e9eb76d405caf6d5f0d
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>

SELinux policy booleans are prohibited in AOSP, so we can drop the
support for the sebool= input selector.

Change-Id: I5ae31247b2f68d90f6ae4c8830458f22c4ffc854
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>

Presently it ignores duplicate keys in seapp_contexts entries, e.g.
if you were to specify:

user=system seinfo=platform user=bluetooth domain=system_app type=system_app_data_file

checkseapp would ignore the duplicate and libselinux would end up using
the last value defined for the key in each line.

Change-Id: I18cadb0c1bf5a907e6fc6513df65aafed91d76fe
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>

Add a compile time assertion that no SELinux rule exists which
allows mounting on top of symbolic links, fifo files, or socket
files. Remove the capability from unconfined domains.

Change-Id: I6d7cc95cd17e2e5f165fa5948563800ed206bb71

The README jumped directly into using the BOARD_SEPOLICY_*
variables for device-specific policy; add a short introduction
describing what external/sepolicy contains and noting where to put
device-specific policy.

Change-Id: I3c800df93d70074384da993a689a5a0771ecb314
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>

allow the bootchart to create dir and files at init,
also allow user to create the stop and start file under
/data/bootchart directory to start and stop bootchart

Change-Id: Icfee8dcd17366383eef00fbe3139744bf4427a6b
Signed-off-by: Yongqin Liu <yongqin.liu@linaro.org>

Exempt unnamed pipes from the MLS constraints so that they can
be used for cross-user communications when passed over binder or
local socket IPC.

Addresses denials such as:
avc: denied { read } for path="pipe:[59071]" dev="pipefs" ino=59071 scontext=u:r:untrusted_app:s0:c522,c768 tcontext=u:r:untrusted_app:s0:c512,c768 tclass=fifo_file

Bug: 19087939

Change-Id: I77d494c4a38bf473fec05b728eaf253484deeaf8
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>

On dm-verity errors, we catch uevents in ueventd and set the value
for a matching verity.* property. Allow ueventd to actually change
property values.

Needed by changes from
  Ibb82953594d234f81ad21c40f524190b88e4ac8f

Change-Id: I79bc90733edf8a45b27e64795f4adfbb3bc028dc

Presently it only detects complete duplicates if you specify -s (strict),
which is not used in the external/sepolicy Makefile, and it allows
overriding earlier entries that have the same input selectors (e.g.
user=, seinfo=) with different values for the output selectors (e.g.
domain=, type=).  Thus, a device/<vendor>/<board>/sepolicy/seapp_contexts
file can override the external/sepolicy definitions, and even a single
seapp_contexts file can contain duplicated or conflicting definitions.

Make it always check strictly, and prohibit either duplicates on the
input selectors (i.e. overrides) or complete duplicates (redundant).

Change-Id: Id1e38133cbe31b796253101cfe3b111d1826bc8c
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>

Address the following denial:
02-12 07:51:42.702: E/SELinux(158): avc:  denied  { find } for service=SurfaceFlinger scontext=u:r:bluetooth:s0 tcontext=u:object_r:surfaceflinger_service:s0 tclass=service_manager

which occurs when the remote service starts up.
02-12 07:51:42.702: E/ServiceManager(158): find_service('SurfaceFlinger') uid=1002 - PERMISSION DENIED
02-12 07:51:42.702: I/ServiceManager(2827): Waiting for service SurfaceFlinger...
02-12 07:51:42.959: E/ActivityManager(469): ANR in com.google.android.remote.tv.services
02-12 07:51:42.959: E/ActivityManager(469): PID: 2827
02-12 07:51:42.959: E/ActivityManager(469): Reason: executing service com.google.android.tv.remote/.RemoteService

Bug: 19268019
Change-Id: I2d415c2ea2f70cf71851147253cf6e1906fd0940

14d5619a added a neverallow
rule for System V IPC calls. Since this was still allowed
for unconfined domains, this broke user builds.

Remove System V IPC stuff from unconfined and fix the build.

Change-Id: Iea66a9f97a90f8db496f6fa34b5e9642ee926fe6

Android doesn't want to support System V IPC classes.
Ensure that it isn't supported by adding a neverallow rule
(compile time assertion).

Change-Id: I278d45960ee557917584f9137323b4cabfe140a9

This was observed when attempting to change volume for a bluetooth device
supporting AVRCP volume control.

Addresses the following denials:
avc:  denied  { find } for service=media.audio_flinger scontext=u:r:bluetooth:s0 tcontext=u:object_r:mediaserver_service:s0 tclass=service_manager
avc:  denied  { find } for service=media.audio_policy scontext=u:r:bluetooth:s0 tcontext=u:object_r:mediaserver_service:s0 tclass=service_manager

Bug: 19341236
Change-Id: If7f2ff1ea9fc694bad700cf59f400f2d2df8c2dd

Commit a833763b enabled per-user
isolation, which requires that any files / processes which cross
user boundaries be marked with the mlstrustedsubject attribute.

system_app_data_file, used for storing a user's profile photos,
is not marked as such. As a result, users are unable to add profile
photos.

Addresses the following denial:

  avc: denied { write } for path="/data/data/com.android.settings/cache/TakeEditUserPhoto2.jpg" dev="mmcblk0p28" ino=82184 scontext=u:r:untrusted_app:s0:c512,c768 tcontext=u:object_r:system_app_data_file:s0 tclass=file

Steps to reproduce:

  1.Flash & Factory the Deb device with tip-of-tree build
  2.Go to 'Settings-Users'
  3.Under users&profiles,click on Owner to add profile photo.
  4.Select 'Choose photo from Gallery' and select a photo.
  5.Then click the 'Done' button.
  6.Device showed the message as 'Unable to save the photo edits'.

OBSERVED RESULTS:
  Unable to add user's profile photo id. This issue is coming for all
  users(Restricted user,second user)also.

EXPECTED RESULTS:
  Device should allow to add profile photo id.

Bug: 19170844
Change-Id: If657dc09dd391e63ca85320f9cc1728580e51a15

Addresses denials such as:
avc:  denied  { search } for  pid=143 comm="e2fsck" name="block" dev="tmpfs" ino=5987 scontext=u:r:fsck:s0 tcontext=u:object_r:block_device:s0 tclass=dir

Change-Id: Ieb72fc5e28146530c2f3b235ce74f2f397e49c56
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>

Change-Id: If414cf8d973270a91628d64442a6d82e546f18f3
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>

Change-Id: I70529f83ccba57fae20742827737a300a9f0733f
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>

Address the following denial:
SELinux : avc:  denied  { find } for service=android.security.keystore scontext=u:r:bluetooth:s0 tcontext=u:object_r:keystore_service:s0 tclass=service_manager

Encountered when remote service attempts access:
02-04 00:15:19.174 E/AndroidRuntime(10847): FATAL EXCEPTION: main
02-04 00:15:19.174 E/AndroidRuntime(10847): Process: com.google.android.remote.tv.services, PID: 10847
02-04 00:15:19.174 E/AndroidRuntime(10847): java.lang.RuntimeException: Unable to create service com.google.android.tv.remote.RemoteService: java.lang.NullPointerException: Attempt to invoke interface method 'int android.security.IKeystoreService.exist(java.lang.String, int)' on a null object reference
02-04 00:15:19.174 E/AndroidRuntime(10847):         at android.app.ActivityThread.handleCreateService(ActivityThread.java:2801)

Bug: 19268019
Change-Id: I86f85cb19c5540bf041c82ec9a8088aacae67792