Copies the /data/misc/keychain/cacert-* directories to all users on
the device, whereas previously they were simply copied to user 0.
This is a shallow copy so anything that wasn't supposed to be there
will disappear.
Bug: 17811821
Change-Id: Iae5909ab8d5efdb83c9c8fdf0e10ab7060d022cc
Sometimes dumping threads takes a long time and bugreport times
out. This change will cause us to accept the bugreport socket connection
before dumping threads and should avoid the failed to connect to dumpstate
service problems we've seen.
Bug: 17758374
Change-Id: I80afa0353cf1c340873f481a8d1d7faffff54120
All extra options are provided as one argument to dex2oat.
The patch splits all options to individual ones.
Change-Id: Ied65bb9cf38b114611e88a8d5d86305021700d0b
Signed-off-by: Serguei Katkov <serguei.i.katkov@intel.com>
Signed-off-by: Yevgeny Rouban <yevgeny.y.rouban@intel.com>
Previously, the vibration was not performed until after stacks
were gathered which takes a long time. Moved the vibration
to happen earlier so we provide better user feedback for the
three-button salute when collecting a bug report.
Deleted some dead code for playing begin/end sounds.
Improved the timing measurement code to help track down why
bug reports are so slow. (They take over a minute now which
can cause us to lose valuable diagnostic information.)
Bug: 17474152
Change-Id: Iac73f7993d7dc85196aad96f459b22fd4a710f94
The clock() function returns the processor time used by the process. This
is not a good timeout mechanism since the code is suspended most of the
time waiting for the forked process to finish. Replace with the time()
function.
Bug: 17154069
(cherry picked from commit 89d4949f86)
Change-Id: I42f0f24ee53ef99955fd482a1089e39d491f3bd5
The clock() function returns the processor time used by the process. This
is not a good timeout mechanism since the code is suspended most of the
time waiting for the forked process to finish. Replace with the time()
function.
Bug: 17154069
Change-Id: Ib383329f9db269445d71a100553b08e71fddda3f
Add /system/priv-app and /oem/app paths to system paths. Also allow
rmdex on system apps, and quietly ignore when it was already removed.
Also relax logging when clearing code cache, since it's optional.
Bug: 17205122
Change-Id: I4fc4d0f63a3596937c4defbd64e1f8a1c563f02d
When relabeling secondary user package directories, we need to use
the uid of the directory rather than the primary package UID;
otherwise, levelFrom=user will not work correctly.
Change-Id: I0d76ec6ec6fe56a566023ca5e1398efdf28fc81e
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
It should nuke everything under the data directory. PMS will come
around and generate the lib symlink after we're finished.
Bug: 16739202
Change-Id: Ib70af2e1450e3bed6781fb497b9cc67e1e594c49
The flag enforces interpret-only flag for dex2oat.
Bug: 12457423
(cherry picked from commit b1efac1035)
(cherry picked from commit 97477d203e)
Change-Id: I215339527e998b24e274c8df42a5024839e6a9fa
Leave default signal handler (terminate) for parent process,
add SIG_IGN as signal handler for children and let them
go down when the parent gets SIGPIPE.
Bug: 17109154
Change-Id: Id33db3e97a32f289eb2a9a1a0ca8acbe3dcd285d
System apps are now installed under their own directory
(system_app_dir/app_dir/app.apk). The new path doesn't pass installd
validation because of obsolete checks which verify that the path does
not contain subdirectories past the system_app_dir.
The CL fixes the validation to accept at most on subdirectory.
Bug: 17109858
(cherry picked from commit c597b6dd89)
Change-Id: Ic5f15d1864c6af9f4c4b07dc27244ebbb521ad5e
System apps are now installed under their own directory
(system_app_dir/app_dir/app.apk). The new path doesn't pass installd
validation because of obsolete checks which verify that the path does
not contain subdirectories past the system_app_dir.
The CL fixes the validation to accept at most on subdirectory.
Bug: 17109858
Change-Id: I13abb52c0016610ff436f6a26bb6b3b85dc4dfb0
In the current directory layout this prevented rm_dex and move_dex
commands to validate the apk path and thus cleaning up resources.
Bug: 16888084
(cherry picked from commit fd88ff2edd)
Change-Id: I1002529b0c35852c67540d3165d1444523460592
In the current directory layout this prevented rm_dex and move_dex
commands to validate the apk path and thus cleaning up resources.
Bug: 16888084
Change-Id: Iba579d075a9c6d7de047e7ffef95441498257086
Writing to trace_clock erases the trace buffer, even if the value
hasn't changed. This prevents use of --async_start and --async_dump
to leave background tracing running and dump after an even that
needs debugging, because --async_dump writes to trace_clock and
resets the buffer before it can read it.
Read and parse the current value from trace_clock before writing,
and skip the write if the value isn't changing.
Change-Id: Ia2ec5bb654fb0bd179771b511ff261731ba47dca
This will allow us to conditionally change the compiler-filter based on other properties.
Bug: 15165413
(cherry picked from commit cf51ba1360)
Change-Id: I6613c9710878d56ed8c121e0caded76a64430f76
Make installd understand a patchoat directive and carry it out.
Bug: 15358152
(cherry picked from commit 7365a10689)
Change-Id: Id84a15e626ddde63876914068d3d9aa037abc65b
1. Explicitly dump IP addresses.
Currently, some IP addresses are dumped using netcfg, but that
only dumps the first IPv4 address on each interface. Instead,
call ip -4 addr and ip -6 addr explicitly to dump all IPv4 and
IPv6 addresses on the system.
2. Disable dumping /proc/net/{ipv6,}route, because:
- We already dump all IPv4 and IPv6 routes in the tables that
we use.
- /proc/net/route is confusing because it only includes routes
in the main table, which are all but unused. It's also in
unreadable host-byte-order hex.
- /proc/net/ipv6_route is confusing because it includes routes
from all tables but does not say what table they are in.
3. Instead of dumping the contents of /proc/net/arp , use
"ip -4 neigh show" and "ip -6 neigh show" to dump the
neighbour caches for both IPv4 and IPv6.
Bug: 16663736
Change-Id: Id3e509b877ab7b00eb2399b6a9868b12245da2f0
This will allow us to conditionally change the compiler-filter based on other properties.
Bug: 15165413
Change-Id: Iff27dc2904f4f0d7c25a684cd6ba16a597f252fd
dumpstate was not dumping any stack traces for vm processes because
it was failing the string compare for /system/bin/app_process.
64-bit devices use app_process32 and app_process64 instead of
app_process, and zygote64 alongside zygote. Change the string
matching to be prefix matching.
(cherry picked from commit 8eb25d552b)
Change-Id: I6b1568161fae278f0e6107990e5b750cf0ca902b
dumpstate was not dumping any stack traces for vm processes because
it was failing the string compare for /system/bin/app_process.
64-bit devices use app_process32 and app_process64 instead of
app_process, and zygote64 alongside zygote. Change the string
matching to be prefix matching.
Change-Id: I6970e1b1fedfcd601f8db6af62852422fcb71d59
Add SELinux MAC for the list and find functionality
to service_manager. By default the list action uses
the service_manager_type attribute as its target
object.
(cherry picked from commit c67e6307ca)
Change-Id: Iaf14b21346822a6b544091a0f4a9949117934b9a
Add SELinux MAC for the list and find functionality
to service_manager. By default the list action uses
the service_manager_type attribute as its target
object.
Change-Id: I7630f21a9f3232ae3d6d8b9a1119230b40899aef
Remove the hardcoded tuples of UIDs and the services that
each is allowed to register. We will rely only on permissions
from SELinux.
Change-Id: I1c44555a6e274814282398865b30ee938f40dabb
Removes the dependency on default constructor parameters for
GLConsumer so that a different constructor prototype can safely be
added.
Change-Id: I0da924bbd4c141edbf305598c1be8bc575654680
This requires a companion package manager change to prune
each instruction specific dex cache individually.
bug: 15677279
Change-Id: I5891981512bde20e49bff65b1842c28886f2b177
Add a MAC check to the svc_can_register function in
service_manager. The types are defined in
external/sepolicy/service.te and the mapping from service
names is defined in external/sepolicy/service_contexts.
Currently uses the property context backend to parse the
contexts file.
Bug: 12909011
Change-Id: I5d90a614263c60571c7c70c2882e6fa929911ca5
Profiling information leaks data about how people interact
with apps, so we don't want the data to be available
to other apps. Only the app and system_server need access.
Don't create the /data/dalvik-cache/profiles directory. init.rc
does it for us now.
Change-Id: Ic1b44009faa30d704855e97631006c4b990a4ad3
Add profile-file option to dex2oat only if the profiler is active and
the file exists.
Bug: 12877748
Bug: 15275634
Change-Id: Icef76514c912c88311ed108f2be7a6329131f741
With new CA certificates being stored in /data/misc/user/<userid>/
existing ones need to be moved into the same place.
After this update only the owner user will have custom trusted CAs; all
other users will revert to the default set.
Change-Id: I14a4cd6048685902ad5dd3b53494b03fadc41c04
New command 'mkuser <id>' sets up a user directory in /data/misc/user/,
readable by all apps within that user and writeable by the local system
process.
Change-Id: I5ddde8c4a80f606e723bb41aa64581a0720842d5
At present, the app lib symlinks are created before setting
the package directory security context, and therefore default
to system_data_file. Upon a later restorecon_recursive,
they are relabeled to the same type as the package directory,
e.g. app_data_file. Avoid this inconsistency by setting the
package directory security context before creating the symlink
so that it inherits the same security context.
Change-Id: I1ee6ccd8a2aa63a4d2efda67f313c97932235911
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
The instruction-set is used to construct the dalvik cache
path and is also passed down to dex2oat.
(cherry picked from commit 791781bfb8)
Change-Id: I43396b16f6eaecacf0fb7d052526fc5a239167ac
Increased the maximum time dumpstate will wait for SIGQUIT process
to finish dumping its thread stacks to the logfile to 5 seconds.
Bug: 14057177
Change-Id: I0b43004512855d202f2fe0ea7b0e934e77a3a070
The instruction-set is used to construct the dalvik cache
path and is also passed down to dex2oat.
Change-Id: Ie480841b3e917dabe23ad4d5f4a0b08990500a51
It's wrong to just concatenate the apk_path and .odex.
The bug prevents the prebuilt odex being used since Kitkat.
The patch is copied from the code of JellyBean.
Change-Id: I0ce8a877e3df8ae1ab9a0e3aeeef2d5253efc223
This is required so that it will be assigned the correct SELinux
security context on first creation by installd.
Bug: 13927667
Change-Id: I4857d031f9e7e60d48b8c72fcb22a81b3a2ebaaa
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Changes above with PMS and below with libselinux
have resulted in a few changes to the restorecon data
api. This change is needed in order to support the new
way to issue a recursive restorecon of certain
/data/data directories.
The restorecondata function has also been modified to
find all users on the device for a given package name
(argument to the function) and to issue a separate
recursive restorecon call for each.
Change-Id: Ie440cba2c96f0907458086348197e1506d31c1b6
Signed-off-by: rpcraig <rpcraig@tycho.ncsc.mil>
Otherwise we can't readily see log messages from libselinux calls
made by installd.
Change-Id: I319b30c181470468fe19dd5fbe9251ef03f1163b
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Implement new restorecondata function which will allow
the relabeling of /data/data and /data/user directories.
This is needed in the case of certain OTAs. Not every
boot will apply this relabeling however. Consult change
I77bf2a0c4c34b1feef6fdf4d6c3bd92dbf32f4a1 for
clarification on this issue.
Change-Id: I05e8b438950ddb908e46c9168ea6ee601e6d674f
Signed-off-by: rpcraig <rpcraig@tycho.ncsc.mil>
This is the old screenshot utility, which relies on direct access
to the framebuffer device. It was replaced a long time ago by
"screencap", which talks to SurfaceFlinger (and includes a fallback
that tries to use the FB dev).
Change-Id: Id75a574bc78033761070b64d528fed06e23a0189
