Commit Graph

155 Commits

Author SHA1 Message Date
Wolfgang Wiedmeyer f14027ae6b
sepolicy: set fsck_untrusted to permissive in recovery
Breaks installation from SD card in some cases otherwise.

Signed-off-by: Wolfgang Wiedmeyer <wolfgit@wiedmeyer.de>
2017-06-16 23:32:12 +02:00
Wolfgang Wiedmeyer 180780e30b
readd mac_permissions.xml from LineageOS
Signed-off-by: Wolfgang Wiedmeyer <wolfgit@wiedmeyer.de>
2017-05-02 20:01:24 +02:00
Wolfgang Wiedmeyer 801e730e7e Merge branch 'cm-13.0' of https://github.com/LineageOS/android_vendor_cm into replicant-6.0 2017-05-02 19:56:19 +02:00
Sean McCreary 4a53e9a7d0 sepolicy: com.cyanogenmod.updater -> org.lineageos.updater
Update seapp_contexts and mac_permissions.xml for the new
LineageOS updater

Change-Id: I171b35ad5578202724efc3f823f7e7a461e5e5cd
2017-03-26 14:58:55 -06:00
Wolfgang Wiedmeyer 1bbac0dbd1 Merge branch 'cm-13.0' of https://github.com/CyanogenMod/android_vendor_cm into replicant-6.0 2016-12-12 13:09:51 +01:00
d34d 699dceabbf themes: allow system_server to relabel them dir
On a fresh install the theme service broker creates the initial
theme directory which needs to be relabeled to a themeservice_app_data_File
in order for the brokered theme service to write to this directory

Change-Id: Ifd689a0c619c0e954192749b83a0cacaa945468f
TICKET: NIGHTLIES-3349
2016-09-20 09:18:26 -07:00
Steve Kondik e73b8c1bd6 cm: Allow LiveDisplay to write to display misc dir
* Need write permission to create file containing the current mode.

Change-Id: I4ed26412e7ec38861156110c7eb51ef707a0999f
2016-08-15 01:43:06 -07:00
Steve Kondik eac861613e sepolicy: Move new QCOM-specific policy to the right place
* Don't wanna break the build for anyone again :(  The
   native stuff is very QCOM specific and won't work elsewhere.

Change-Id: Id5dbba1a46dc12cbd5914cf3072ed92a72039b31
2016-08-09 00:07:19 -07:00
Steve Kondik dfcd472673 sepolicy: Additional policy for LiveDisplay
* LiveDisplay needs to store the user-selected default mode somewhere
   in the case where we are mixing local sysfs-style modes with QDCM
   modes. Add a rule for this.

Change-Id: I42b80df7c0ee3c2815594c8a6feea3dc078c6ae2
2016-08-07 12:05:32 -07:00
Adrian DC 463feb6005 cm: sepolicy: Fix the vold blkid.tab denial from recovery
* denied  { link } for  pid=190 comm="minivold"
    name="vold_blkid.tab" dev="tmpfs" scontext=u:r:vold:s0
    tcontext=u:object_r:vold_tmpfs:s0 tclass=file

Change-Id: I0b3e47dd00c5a32261691f51838a8d9af9778faa
2016-08-05 00:00:03 -07:00
d34d 79eda9ebb8 sepolicy: Put theme service in its own context
Allow the theme manager and its data to be sandboxed in
its own context

Change-Id: I7898663d1c196bfe04fa4c539d20191a43fde284
2016-08-02 12:15:34 -07:00
Steve Kondik cd726ac1db sepolicy: More IOP rules
Change-Id: I6d6cfd7202c94135344eb718e0c6ac5347a0ece7
2016-08-01 02:08:38 -07:00
dianlujitao 5b6ff16746 sepolicy: Fix MTP for sdcardfs
Change-Id: I8fe011140798925ee5b5926355868febd595a788
2016-07-29 21:25:15 -07:00
Steve Kondik fa37074c9f sepolicy: Let the IO prefetcher look at sdcardfs
Change-Id: Ie618887fbf292c702df720f04840ab3c8ff222f7
2016-07-29 04:24:05 -07:00
Luca Stefani 630d7ed01f cm: sepolicy: Allow system_server dir read access
Change-Id: Ia6fc26781c1cb576c2feee3e941d7206e7878bb5
2016-07-28 20:21:24 -07:00
Steve Kondik 441752f996 sepolicy: Allow media_rw write to fix camcorder denials
Change-Id: Icc892d8b2c34950431564738b66d8e8baefc62be
2016-07-27 23:58:08 -07:00
Steve Kondik 6905134e76 sepolicy: Revert custom sdcardfs policy in favor of AOSP
* Upstream policy showed up in AOSP this morning. Dropping
   ours in favor of AOSP.

Revert "sepolicy: A few more denials"

This reverts commit 522c421f66.

Revert "sepolicy: More policy for sdcardfs"

This reverts commit 4a24ffeb6a.

Revert "sepolicy: Add sdcardfs support"

This reverts commit ba87877dd0.

Change-Id: I4f066b9bd5d8c899137fcaa12999f2547f9e0ec0
2016-07-26 18:43:41 -07:00
Steve Kondik 522c421f66 sepolicy: A few more denials
* Hopefully the last of the sdcardfs denials

Change-Id: I2a9fbc33696d2517fd2596f64f55656a14d66c2c
2016-07-26 07:53:16 -07:00
Steve Kondik 4a24ffeb6a sepolicy: More policy for sdcardfs
Change-Id: Iddc6f86bd1e4b9942139acf9b7e75279b3865b8a
2016-07-25 22:11:33 -07:00
Steve Kondik d4a0f0adff sepolicy: Add rule to allow sdcardfs to read package list
* Do not carry forward into N release.

Change-Id: I1f90695c48ac5a19848efafb146eabdff1ca4b6a
2016-07-24 04:28:55 -07:00
Steve Kondik ba87877dd0 sepolicy: Add sdcardfs support
Change-Id: Ib9486b0ad7ed0e4c53494271e6fd35bcfedba40a
2016-07-24 00:16:22 -07:00
Bruno Martins 6fed2cf409 sepolicy: Allow batterymanager and batteryproperties services to be found
Change-Id: Ia2a1734a74c4bba0bc09f150442aec573d769370
2016-07-23 20:51:04 -07:00
Dan Pasanen 2b8c4b27fe sepolicy: put bash in shell context
* Necessary for being able to execute commands such as 'su'
  from a non-root shell

Change-Id: Icbaaa6ff7447add65441011944bdc5d13b788c86
2016-06-21 12:23:51 -07:00
Deepak Kundra 278fa600d7 persist.dbg/data for radio to control QC prop's
Issue-id:FEIJ-679

Change-Id: Iafe0405fd4a83c8f22e1af7152c1c3a009cd2e71
2016-06-03 19:22:47 -07:00
Pat Erley ca2061460c sepolicy: Allow uncrypt additional access
Uncrypt may need access to additional selinux contexts for devices
with created storage solutions.

Change-Id: Ie90f130ff6bafdd195379f7d57504b2fce4ef830
2016-05-16 13:29:06 -07:00
Steve Kondik 603ce3ba3e cm: Extend policy for IOP
* IO prefetcher needs to dig into themes and media as well.

Change-Id: I72cd7fca3a7cacf28764023a73c66e4ea8a58be5
2016-05-14 02:42:13 -04:00
Steve Kondik e49dd26ace cm: Add SE policy for iop service
Change-Id: I14338a03c469cd71a6d5c7fecc71eb2290b2e6c4
2016-05-06 12:38:50 -07:00
Zhao Wei Liew de1ad36765 cm: Allow LiveDisplay to write to color_enhance
The proper permissions for the color_enhance sysfs node weren't
being set, rendering the color enhancement switch useless.

Set the proper permissions for LiveDisplay to toggle color enhancement.

Change-Id: Ic8dba8953b73a497cb01a645834c0e7934092b38
2016-04-30 17:06:13 -07:00
Steve Kondik 7a92949668 cm: Remove garbage from sepolicy
* Not sure how the -- got here but it causes the rules to be invalid.

Change-Id: Ib17217d14f844d7aa27bb554346183e32ff5ae13
2016-04-30 02:32:02 -07:00
Steve Kondik 3fe3faafd0 cm: Add CMAudioService the platform
* Also brings JNI to CMSDK

Change-Id: I599964a1f9200a8d2ecdad0bb8c4d8593e6d7415
2016-04-26 16:41:19 -07:00
Pat Erley da1a9004f8 sepolicy: Allow recovery to mount on tmpfs
/storage is a tmpfs volume, and is where updater stores its zip
when downloading updates.  Devices with emmc partitions that are
used as 'sdcard' volumes will end up with paths like:

  /storage/UUID/...../update.zip

where UUID is the mount point for the partition and update.zip is
the downloaded update.  With this change, minivold can create the
UUID folder and mount onto it, fixing the application of updates.

Change-Id: I4fa84fd590f5ff0f91e38c49cef0c179728fdf43
2016-04-22 13:09:37 -07:00
Steve Kondik 512d428d2f cm: Moving LiveDisplay to CMSDK
* Also alphabetized the list of feature xmls, you filthy pigs.

Change-Id: I094a46c313be4531c6dd1af1e007a26b2476d60e
2016-04-13 01:37:20 -07:00
Matthias Yzusqui ef1a479318 cm: sepolicy: allow platform apps to execute render scripts
* Needed by Gallery3D Photo Editor to apply effects like:
  Vignette and Graduated.

Change-Id: I7b07a974fbdb77abbaba1c15a21e918406d2175b
2016-04-05 13:46:19 -07:00
Luis Vidal 6d61d301e5 Add Weather Content Provider [3/5]
Introduce the weather system feature, which will be used to
identify if the Weather Content Provider/Weather services are
available in the device.

Add SELinux entries for the cmweather service

Change-Id: Ibe862903095276f87f23c0d7dae54733eeeb5638
2016-03-31 17:42:56 -07:00
d34d 2cf159cdf9 LLS: Add live lock screen service [3/4]
Change-Id: I9136e9c9c1413c45aa300f0c92fd69b0c409a052
2016-03-30 08:46:20 -07:00
Wolfgang Wiedmeyer be9e1314a1
Merge branch 'cm-13.0' of https://github.com/CyanogenMod/android_vendor_cm into replicant-6.0 2016-03-18 10:59:16 +01:00
codeworkx b7c8dec762 cm: sepolicy: allow platform apps to crop user images
Needed for gallery3d when setting contact pics

avc: denied { write } for comm=4173796E635461736B202334
path="/data/data/com.android.settings/cache/CropEditUserPhoto.jpg" dev="mmcblk0p50" ino=65849
scontext=u:r:platform_app:s0:c512,c768 tcontext=u:object_r:system_app_data_file:s0 tclass=file
permissive=0

03-05 13:07:40.741  22060-22207/com.android.gallery3d W/System.err﹕ java.io.IOException: write
failed: EACCES (Permission denied)

Change-Id: Iaa7f75abfd41c86e1a321d5f35b950f9dc7eb930
2016-03-16 15:48:15 -07:00
d34d e7036e8387 Themes: Refactor themes to CMSDK [3/6]
Change-Id: Ia8f3a5080f2ca2cecc3474058db4970c5661c89c
TICKET: CYNGNOS-2126
2016-03-01 09:57:15 -08:00
AdrianDC 36cb29d509 recovery: Add new rule for sys.usb.ffs.ready
init: avc:  denied  { set } for property=sys.usb.ffs.ready
    scontext=u:r:recovery:s0 tcontext=u:object_r:ffs_prop:s0
    tclass=property_service

Change-Id: Id3441ccc3c6a8915a5fdf50efd8c617d1242868a
2016-02-23 16:28:56 -08:00
FrozenCow ec0322e31b cm: sepolicy: allow kernel to read storage
This fixes issues where the kernel would need to read and write
files from internal or external storage. More specifically, the
kernel needs these rules for USB mass storage to work correctly.

Change-Id: I8cb0307727bc0c464d5470e55275ad808e748ee0
2016-02-20 14:26:41 -08:00
Wolfgang Wiedmeyer 9c205f0603
sepolicy: remove mac_permissions for proprietary google apps and cmupdater
Signed-off-by: Wolfgang Wiedmeyer <wolfgit@wiedmeyer.de>
2016-02-17 01:16:14 +01:00
Wolfgang Wiedmeyer cd25e76555
sepolicy: allow bootanim and surfaceflinger execmem and access to ashmem
This allows the device to boot with software rendering
using build/target/board/generic/sepolicy as reference

Signed-off-by: Wolfgang Wiedmeyer <wolfgit@wiedmeyer.de>
2016-02-16 17:32:25 +01:00
Pat Erley 18037e7462 sepolicy: Allow system server and uncrypt access pipe
System server needs to be able to create a pipe in the cache partition
for uncrypting OTAs. Uncrypt needs to be able to read and write the
pipe.

Change-Id: Ie03ee7d637eaecff8fe38bf03dc733b3915cd336
2016-02-16 14:49:04 +01:00
Pat Erley 15697319ca sepolicy: Allow system server and uncrypt access pipe
System server needs to be able to create a pipe in the cache partition
for uncrypting OTAs. Uncrypt needs to be able to read and write the
pipe.

Change-Id: Ie03ee7d637eaecff8fe38bf03dc733b3915cd336
2016-02-09 13:24:46 -08:00
Wolfgang Wiedmeyer 5b2d5516ff
Merge branch 'cm-13.0' of https://github.com/CyanogenMod/android_vendor_cm into replicant-6.0
Signed-off-by: Wolfgang Wiedmeyer <wolfgit@wiedmeyer.de>

Conflicts:
	overlay/common/frameworks/base/core/res/res/drawable-nodpi/default_wallpaper.jpg
	overlay/common/frameworks/base/core/res/res/drawable-sw600dp-nodpi/default_wallpaper.jpg
	overlay/common/frameworks/base/core/res/res/drawable-sw720dp-nodpi/default_wallpaper.jpg
	overlay/common/frameworks/base/core/res/res/drawable-xhdpi/default_wallpaper.jpg
2016-02-03 12:23:07 +01:00
Pat Erley db4fb0ee6b recovery: Add new rules for recursive wipe
We now use a temporary context when mounting /data, so add permissions
to do that, and add permissions necessary to do the recursive wipe.

Change-Id: Ic925c70f1cf01c8b19a6ac48a9468d6eb9205321
2016-01-28 15:20:51 -08:00
Jani Lusikka 8c780755f2 Grant platform apps access to /mnt/media_rw with sdcard_posix label
Also allow apps to read the contents of mounted OBBs.

See AOSP Change-Id: I66df236eade3ca25a10749dd43d173ff4628cfad
and Change-Id: I49b722b24c1c7d9ab084ebee7c1e349d8d660ffa

Change-Id: I757a2a8831c69d41c0496025a39eaf79ceb0e65f
2016-01-24 14:39:42 -08:00
Wolfgang Wiedmeyer cd55ab2858 Merge branch 'cm-13.0' of https://github.com/CyanogenMod/android_vendor_cm into replicant-6.0-toolchain 2016-01-14 15:27:42 +01:00
myfluxi e8df21c962 sepolicy: Add perfprofd with set_prop macro
Addresses:
avc: denied { write }
for pid=293 comm="perfprofd" name="property_service" dev="tmpfs" ino=9229 scontext=u:r:perfprofd:s0 tcontext=u:object_r:property_socket:s0 tclass=sock_file permissive=0

Change-Id: I5a88722eda4d0751fd9a081c434d385ac1c785ef
2016-01-12 17:21:32 -08:00
Wolfgang Wiedmeyer a746591c4e Merge branch 'cm-13.0' of https://github.com/CyanogenMod/android_vendor_cm into replicant-6.0 2016-01-02 14:12:03 +01:00