Bill Richardson
f1fcb6a099
Allow citadeld to set a property on firmware changes
...
This will allow services which need to be aware of Dauntless
firmware changes to be notified by an init script trigger on
that property.
Bug: 286433589
Test: manual
Build an image with this change, confirm that `getprop
vendor.nos.citadel.version` returns the current Dauntless
firmware version string.
Update the Dauntless firmware, confirm that the property value
changes to match.
Change-Id: I45ce87070ce2b6c9fff2c8119db50445b0e576b3
Signed-off-by: Bill Richardson <wfrichar@google.com>
2023-06-08 20:11:39 -05:00
Tommy Chiu
98761efacc
vndservicemanager: allow binder_call to hal_keymint_citadel
...
original log: [ 2.048586] type=1400 audit(1683652072.956:4):
avc: denied { call } for comm="vndservicemanag" scontext=u:r:vndservicemanager:s0
tcontext=u:r:hal_keymint_citadel:s0 tclass=binder permissive=0
Fix: 281814811
Change-Id: I905e2927af1377fed34d6f47254fb68d22fcac77
2023-05-12 04:40:32 +00:00
Joseph Jang
6c4c5cdf26
Move recovery.te to device/google/gs-common/dauntless/sepolicy
...
Bug: 279381809
Change-Id: I1b5b802bccbcd7e649f58af2c8393ecfca66e6e4
2023-04-24 09:10:10 +00:00
Chengyou Ho
1bfa9e6a2f
Merge changes from topic "240932137"
...
* changes:
Add oemlock aidl service sepolicy
gsc.mk: install oemlock aidl service
2022-09-21 13:52:14 +00:00
Chengyou Ho
94f9ddc10e
Merge changes from topic "b/246952216"
...
* changes:
Add weaver AIDL service sepolicy
gsc.mk: install weaver AIDL service
2022-09-21 13:51:48 +00:00
Adam Shih
f3105ca062
add missing dumpstate permission
...
Bug: 247097496
Test: adb bugreport
Change-Id: Icccfe2c4610ae3a9e77d1ad2c17d828e2e860f1b
2022-09-19 10:52:52 +08:00
ChengYou Ho
141c01ba0c
Add oemlock aidl service sepolicy
...
1. avc: denied { find } for pid=889 uid=1064 name=android.hardware.citadel.ICitadeld scontext=u:r:hal_oemlock_citadel:s0 tcontext=u:object_r:citadeld_service:s0 tclass=service_manager permissive=1
2. avc: denied { read } for name="vndbinder" dev="binder" ino=6 scontext=u:r:hal_oemlock_citadel:s0 tcontext=u:object_r:vndbinder_device:s0 tclass=chr_file permissive=1
3. avc: denied { write } for name="vndbinder" dev="binder" ino=6 scontext=u:r:hal_oemlock_citadel:s0 tcontext=u:object_r:vndbinder_device:s0 tclass=chr_file permissive=1
4. avc: denied { open } for path="/dev/binderfs/vndbinder" dev="binder" ino=6 scontext=u:r:hal_oemlock_citadel:s0 tcontext=u:object_r:vndbinder_device:s0 tclass=chr_file permissive=1
5. avc: denied { ioctl } for path="/dev/binderfs/vndbinder" dev="binder" ino=6 ioctlcmd=0x6209 scontext=u:r:hal_oemlock_citadel:s0 tcontext=u:object_r:vndbinder_device:s0 tclass=chr_file permissive=1
6. avc: denied { call } for scontext=u:r:hal_oemlock_citadel:s0 tcontext=u:r:vndservicemanager:s0 tclass=binder permissive=1
Bug: 240932137
Change-Id: I804d925e020f6adfe8cd0c34aedead366c99adc0
2022-09-18 20:54:20 +00:00
ChengYou Ho
f31f736d36
Add weaver AIDL service sepolicy
...
avc: denied { call } for scontext=u:r:hal_weaver_citadel:s0 tcontext=u:r:citadeld:s0 tclass=binder permissive=1
avc: denied { find } for pid=3023 uid=1064 name=android.hardware.citadel.ICitadeld scontext=u:r:hal_weaver_citadel:s0 tcontext=u:object_r:citadeld_service:s0 tclass=service_manager permissive=1
avc: denied { read } for comm="android.hardwar" name="vndbinder" dev="binder" ino=6 scontext=u:r:hal_weaver_citadel:s0 tcontext=u:object_r:vndbinder_device:s0 tclass=chr_file permissive=1
avc: denied { write } for comm="android.hardwar" name="vndbinder" dev="binder" ino=6 scontext=u:r:hal_weaver_citadel:s0 tcontext=u:object_r:vndbinder_device:s0 tclass=chr_file permissive=1
avc: denied { open } for comm="android.hardwar" path="/dev/binderfs/vndbinder" dev="binder" ino=6 scontext=u:r:hal_weaver_citadel:s0 tcontext=u:object_r:vndbinder_device:s0 tclass=chr_file permissive=1
avc: denied { ioctl } for comm="android.hardwar" path="/dev/binderfs/vndbinder" dev="binder" ino=6 ioctlcmd=0x6209 scontext=u:r:hal_weaver_citadel:s0 tcontext=u:object_r:vndbinder_device:s0 tclass=chr_file permissive=1
avc: denied { map } for comm="android.hardwar" path="/dev/binderfs/vndbinder" dev="binder" ino=6 scontext=u:r:hal_weaver_citadel:s0 tcontext=u:object_r:vndbinder_device:s0 tclass=chr_file permissive=1
Bug: 246952216
Change-Id: Id77dc947327a0b9f963fd98bd0143a1b86f646dd
2022-09-18 20:24:10 +00:00
ChengYou Ho
182bdd6c08
Add authsecret aidl hal sepolicy
...
avc: denied { read } for comm="android.hardwar" name="vndbinder" dev="binder" ino=6 scontext=u:r:hal_authsecret_citadel:s0 tcontext=u:object_r:vndbinder_device:s0 tclass=chr_file permissive=1
avc: denied { write } for comm="android.hardwar" name="vndbinder" dev="binder" ino=6 scontext=u:r:hal_authsecret_citadel:s0 tcontext=u:object_r:vndbinder_device:s0 tclass=chr_file permissive=1
avc: denied { open } for comm="android.hardwar" path="/dev/binderfs/vndbinder" dev="binder" ino=6 scontext=u:r:hal_authsecret_citadel:s0 tcontext=u:object_r:vndbinder_device:s0 tclass=chr_file permissive=1
avc: denied { ioctl } for comm="android.hardwar" path="/dev/binderfs/vndbinder" dev="binder" ino=6 ioctlcmd=0x6209 scontext=u:r:hal_authsecret_citadel:s0 tcontext=u:object_r:vndbinder_device:s0 tclass=chr_file permissive=1
avc: denied { map } for comm="android.hardwar" path="/dev/binderfs/vndbinder" dev="binder" ino=6 scontext=u:r:hal_authsecret_citadel:s0 tcontext=u:object_r:vndbinder_device:s0 tclass=chr_file permissive=1
avc: denied { call } for comm="android.hardwar" scontext=u:r:hal_authsecret_citadel:s0 tcontext=u:r:vndservicemanager:s0 tclass=binder permissive=1
avc: denied { call } for comm="android.hardwar" scontext=u:r:hal_authsecret_citadel:s0 tcontext=u:r:servicemanager:s0 tclass=binder permissive=1
avc: denied { transfer } for comm="android.hardwar" scontext=u:r:hal_authsecret_citadel:s0 tcontext=u:r:servicemanager:s0 tclass=binder permissive=1
avc: denied { call } for comm="binder:1286_7" scontext=u:r:system_server:s0 tcontext=u:r:hal_authsecret_citadel:s0 tclass=binder permissive=1
avc: denied { ioctl } for comm="android.hardwar" path="/dev/binderfs/vndbinder" dev="binder" ino=6 ioctlcmd=0x6201 scontext=u:r:hal_authsecret_citadel:s0 tcontext=u:object_r:vndbinder_device:s0 tclass=chr_file permissive=1
avc: denied { call } for comm="android.hardwar" scontext=u:r:hal_authsecret_citadel:s0 tcontext=u:r:citadeld:s0 tclass=binder permissive=1
avc: denied { find } for pid=3023 uid=1064 name=android.hardware.citadel.ICitadeld scontext=u:r:hal_authsecret_citadel:s0 tcontext=u:object_r:citadeld_service:s0 tclass=service_manager permissive=0
Bug: 244746589
Change-Id: I8d950329e057a2f806817384e6b00baf6f26efee
2022-09-13 15:52:31 +00:00
Adam Shih
33aa7718bc
Move dauntless settings to gs-common
...
Bug: 242479757
Test: build pass on all Gchip devices
Change-Id: Idfd52a88a420f04169b273a1ef575f10b92874c1
2022-08-31 10:32:55 +08:00
Adam Shih
d7aa396078
modularize gsc dump
...
Bug: 242479757
Test: do bugreport that has the same content as before
Change-Id: I4098775fb4b3f40167920354b2c361d801b11594
2022-08-24 02:39:51 +00:00
