No description or website provided.
Makefile
Pull request Compare This branch is 17 commits ahead, 183 commits behind CyanogenMod:cm-14.1.
Latest commit 6325aab Nov 6, 2014 @rmcc rmcc committed with westcripp domain: Create a dummy domain for qc's rmt and let it access /dev/mem
Old (pre-L) binaries will fail hard if unable to access mem. Create
a domain that rmt_storage can use to get those perms

Limit to userdebug and eng builds

Change-Id: I3ff72b11434df7217631330370b05f59a13348e9
Permalink
Failed to load latest commit information.
tools Add cts artifact tag for use in CTS tests. Mar 30, 2016
Android.mk Add rules required for TARGET_HAS_LEGACY_CAMERA_HAL1 Nov 8, 2016
CleanSpec.mk Update Android.mk to support file_contexts.bin Aug 12, 2015
MODULE_LICENSE_PUBLIC_DOMAIN Update MODULE_LICENSE May 22, 2015
NOTICE Public domain notice Jun 19, 2012
README Ensure newlines are added between context config files Dec 13, 2015
access_vectors Add module_load permission to system class Apr 7, 2016
adbd.te Merge tag 'android-7.1.0_r4' of https://android.googlesource.com/plat… Oct 26, 2016
app.te sepolicy: exclude sdcard_posix/fuseblk from shipping builds Dec 7, 2016
atrace.te atrace.te: fix /sys/kernel/debug/tracing label Dec 15, 2015
attributes Merge tag 'android-7.1.0_r4' of https://android.googlesource.com/plat… Oct 26, 2016
audioserver.te Merge "buildtime/cts enforce no inet access for media domains" into n… Apr 22, 2016
autoplay_app.te autoplay_app: cgroup write perms moved to domain Jan 27, 2016
binderservicedomain.te allow binderservice domains to write to a fifo file Mar 7, 2016
blkid.te Replace "neverallow domain" by "neverallow *" Feb 5, 2016
blkid_untrusted.te Replace "neverallow domain" by "neverallow *" Feb 5, 2016
bluetooth.te Expand bluetooth access to media_rw_data_file for now. Apr 6, 2016
bluetoothdomain.te bluetoothdomain.te: drop allow bluetoothdomain self:socket create_soc… Dec 12, 2015
boot_control_hal.te Move boot_control HAL permissions to an attribute. Apr 22, 2016
bootanim.te Merge tag 'android-7.1.1_r4' into cm-14.1 Dec 7, 2016
bootstat.te bootstat: Fix the SELinux policy after removing domain_deprecated. Jan 26, 2016
cameraserver.te buildtime/cts enforce no inet access for media domains Apr 22, 2016
clatd.te Create attribute for moving perms out of domain Nov 3, 2015
cppreopts.te Merge tag 'android-7.1.0_r4' of https://android.googlesource.com/plat… Oct 26, 2016
debuggerd.te Sepolicy: Allow debuggerd to dump backtraces of Bluetooth May 13, 2016
device.te Re-introduce camera_device type Apr 24, 2016
dex2oat.te Merge tag 'android-7.1.0_r4' of https://android.googlesource.com/plat… Oct 26, 2016
dhcp.te drop dhcp auditallow Jan 14, 2016
dnsmasq.te Create attribute for moving perms out of domain Nov 3, 2015
domain.te domain: Create a dummy domain for qc's rmt and let it access /dev/mem Jan 18, 2017
domain_deprecated.te DO NOT MERGE. Remove isolated_app's ability to read sysfs. May 12, 2016
drmserver.te Merge tag 'android-7.1.0_r4' of https://android.googlesource.com/plat… Oct 26, 2016
dumpstate.te Merge tag 'android-7.1.1_r4' into cm-14.1 Dec 7, 2016
file.te system: sepolicy: Import fuseblk from vendor/cm Nov 8, 2016
file_contexts Merge tag 'android-7.1.0_r4' of https://android.googlesource.com/plat… Oct 26, 2016
file_contexts_asan Add /data/lib64, /data/vendor/lib64 to ASan sepolicy. May 10, 2016
fingerprintd.te Revert "fingerprintd.te: neverallow fingerprint data file access" Dec 17, 2015
fs_use fs_use: Enabled loading security xattrs for squashfs Jun 16, 2015
fsck.te Replace "neverallow domain" by "neverallow *" Feb 5, 2016
fsck_untrusted.te Replace "neverallow domain" by "neverallow *" Feb 5, 2016
gatekeeperd.te Renamed hardwareproperties to hardware_properties Mar 9, 2016
genfs_contexts sepolicy: add support for new tracefs May 13, 2016
global_macros global_macros: Allow directory locking Mar 22, 2016
gpsd.te Keep pre-existing sysfs write permissions. Jun 14, 2016
hci_attach.te Create attribute for moving perms out of domain Nov 3, 2015
healthd.te Keep pre-existing sysfs write permissions. Jun 14, 2016
hostapd.te Update netlink socket classes. Mar 3, 2016
idmap.te Create attribute for moving perms out of domain Nov 3, 2015
init.te Merge tag 'android-7.1.0_r4' of https://android.googlesource.com/plat… Oct 26, 2016
initial_sid_contexts Restore devnull initial sid context. Jul 12, 2012
initial_sids SE Android policy. Jan 4, 2012
inputflinger.te Create attribute for moving perms out of domain Nov 3, 2015
install_recovery.te Creates a new permission for /cache/recovery Jan 4, 2016
installd.te Merge tag 'android-7.1.0_r4' of https://android.googlesource.com/plat… Oct 26, 2016
ioctl_defines Merge tag 'android-7.1.0_r4' of https://android.googlesource.com/plat… Oct 26, 2016
ioctl_macros Merge tag 'android-7.1.0_r4' of https://android.googlesource.com/plat… Oct 26, 2016
isolated_app.te Merge "Further restrict socket ioctls available to apps" into nyc-dev Apr 15, 2016
kernel.te Allow access to media_rw_data_file for now. Mar 31, 2016
keys.conf Make DEFAULT_SYSTEM_DEV_CERTIFICATE available in keys.conf Oct 28, 2013
keystore.te Replace "neverallow domain" by "neverallow *" Feb 5, 2016
lmkd.te lmkd: grant read access to all of /sys Jun 23, 2016
logd.te Merge tag 'android-7.1.0_r4' of https://android.googlesource.com/plat… Oct 26, 2016
mac_permissions.xml Drop the default stanza from mac_permissions.xml Sep 1, 2015
mdnsd.te mdnsd: Remove domain_deprecated Dec 2, 2015
mediacodec.te buildtime/cts enforce no inet access for media domains Apr 22, 2016
mediadrmserver.te Merge tag 'android-7.1.0_r4' of https://android.googlesource.com/plat… Oct 26, 2016
mediaextractor.te buildtime/cts enforce no inet access for media domains Apr 22, 2016
mediaserver.te Add rules required for TARGET_HAS_LEGACY_CAMERA_HAL1 Nov 8, 2016
mls sepolicy: Clean up mls constraints. Mar 13, 2015
mls_macros SE Android policy. Jan 4, 2012
mtp.te Create attribute for moving perms out of domain Nov 3, 2015
net.te Further restrict socket ioctls available to apps Apr 15, 2016
netd.te Keep pre-existing sysfs write permissions. Jun 14, 2016
neverallow_macros system_server: neverallow blk_file read/write Mar 11, 2015
nfc.te sepolicy: Fix android beam image transfer Nov 8, 2016
otapreopt_chroot.te Merge tag 'android-7.1.1_r4' into cm-14.1 Dec 7, 2016
otapreopt_slot.te Merge tag 'android-7.1.0_r4' of https://android.googlesource.com/plat… Oct 26, 2016
perfprofd.te label /sys/kernel/debug/tracing and remove debugfs write Dec 14, 2015
platform_app.te Merge tag 'android-7.1.1_r4' into cm-14.1 Dec 7, 2016
policy_capabilities SE Android policy. Jan 4, 2012
port_contexts Support for ocontexts per device. Jul 12, 2012
postinstall.te Merge tag 'android-7.1.0_r4' of https://android.googlesource.com/plat… Oct 26, 2016
postinstall_dexopt.te Merge tag 'android-7.1.0_r4' of https://android.googlesource.com/plat… Oct 26, 2016
ppp.te ppp.te: Remove allow ppp toolbox_exec:file rx_file_perms; Jan 15, 2016
preopt2cachename.te Merge tag 'android-7.1.0_r4' of https://android.googlesource.com/plat… Oct 26, 2016
priv_app.te Merge tag 'android-7.1.0_r4' of https://android.googlesource.com/plat… Oct 26, 2016
profman.te Enable profman pretty printing Jun 6, 2016
property.te Merge tag 'android-7.1.0_r4' of https://android.googlesource.com/plat… Oct 26, 2016
property_contexts Merge tag 'android-7.1.0_r4' of https://android.googlesource.com/plat… Oct 26, 2016
qti-testscripts.te sepolicy: Forward declaration of qti-testscripts domain Oct 27, 2016
racoon.te racoon.te: Remove allow racoon toolbox_exec:file rx_file_perms; Jan 15, 2016
radio.te allow radio to find nfc_service Jun 16, 2016
recovery.te Merge tag 'android-7.1.0_r4' of https://android.googlesource.com/plat… Oct 26, 2016
recovery_persist.te Add recovery_persist & recovery_refresh Mar 24, 2016
recovery_refresh.te Add recovery_persist & recovery_refresh Mar 24, 2016
rild.te Update netlink socket classes. Mar 3, 2016
roles Add explicit role declaration for newer checkpolicy versions. Jan 12, 2012
runas.te Create attribute for moving perms out of domain Nov 3, 2015
sdcardd.te Allow sdcardd tmpfs read access. Jan 27, 2016
seapp_contexts Add autoplay_app domain Nov 9, 2015
security_classes Update netlink socket classes. Mar 3, 2016
service.te Merge tag 'android-7.1.1_r4' into cm-14.1 Dec 7, 2016
service_contexts Merge tag 'android-7.1.1_r4' into cm-14.1 Dec 7, 2016
servicemanager.te Create attribute for moving perms out of domain Nov 3, 2015
sgdisk.te Replace "neverallow domain" by "neverallow *" Feb 5, 2016
shared_relro.te Create attribute for moving perms out of domain Nov 3, 2015
shell.te Merge tag 'android-7.1.0_r4' of https://android.googlesource.com/plat… Oct 26, 2016
slideshow.te Create attribute for moving perms out of domain Nov 3, 2015
su.te sepolicy: Allow remount /system Oct 14, 2016
surfaceflinger.te Merge tag 'android-7.1.0_r4' of https://android.googlesource.com/plat… Oct 26, 2016
system_app.te Merge tag 'android-7.1.0_r4' of https://android.googlesource.com/plat… Oct 26, 2016
system_server.te Merge tag 'android-7.1.0_r4' of https://android.googlesource.com/plat… Oct 26, 2016
te_macros Further restrict socket ioctls available to apps Apr 15, 2016
tee.te Update netlink socket classes. Mar 3, 2016
toolbox.te Replace "neverallow domain" by "neverallow *" Feb 5, 2016
tzdatacheck.te Create attribute for moving perms out of domain Nov 3, 2015
ueventd.te Keep pre-existing sysfs write permissions. Jun 14, 2016
uncrypt.te Merge tag 'android-7.1.0_r4' of https://android.googlesource.com/plat… Oct 26, 2016
untrusted_app.te sepolicy: exclude sdcard_posix/fuseblk from shipping builds Dec 7, 2016
update_engine.te Merge tag 'android-7.1.0_r4' of https://android.googlesource.com/plat… Oct 26, 2016
update_engine_common.te Merge tag 'android-7.1.0_r4' of https://android.googlesource.com/plat… Oct 26, 2016
update_verifier.te Merge tag 'android-7.1.0_r4' of https://android.googlesource.com/plat… Oct 26, 2016
users SE Android policy. Jan 4, 2012
vdc.te Allow 'vdc' to be invoked with logwrapper. Feb 4, 2016
vold.te sepolicy: allow vold to mount ext4 sdcard Sep 17, 2016
watchdogd.te watchdog: remove domain_deprecated Jan 25, 2016
wpa.te Update netlink socket classes. Mar 3, 2016
zygote.te Merge tag 'android-7.1.0_r7' of https://android.googlesource.com/plat… Nov 9, 2016

README

This directory contains the core Android SELinux policy configuration.
It defines the domains and types for the AOSP services and apps common to
all devices.  Device-specific policy should be placed under a
separate device/<vendor>/<board>/sepolicy subdirectory and linked
into the policy build as described below.

Policy Generation:

Additional, per device, policy files can be added into the
policy build. These files should have each line including the
final line terminated by a newline character (0x0A).  This
will allow files to be concatenated and processed whenever
the m4(1) macro processor is called by the build process.
Adding the newline will also make the intermediate text files
easier to read when debugging build failures.  The sets of file,
service and property contexts files will automatically have a
newline inserted between each file as these are common failure
points.

These device policy files can be configured through the use of
the BOARD_SEPOLICY_DIRS variable. This variable should be set
in the BoardConfig.mk file in the device or vendor directories.

BOARD_SEPOLICY_DIRS contains a list of directories to search
for additional policy files. Order matters in this list.
For example, if you have 2 instances of widget.te files in the
BOARD_SEPOLICY_DIRS search path, then the first one found (at the
first search dir containing the file) will be concatenated first.
Reviewing out/target/product/<device>/etc/sepolicy_intermediates/policy.conf
will help sort out ordering issues.

Example BoardConfig.mk Usage:
From the Tuna device BoardConfig.mk, device/samsung/tuna/BoardConfig.mk

BOARD_SEPOLICY_DIRS += device/samsung/tuna/sepolicy

Additionally, OEMs can specify BOARD_SEPOLICY_M4DEFS to pass arbitrary m4
definitions during the build. A definition consists of a string in the form
of macro-name=value. Spaces must NOT be present. This is useful for building modular
policies, policy generation, conditional file paths, etc. It is supported in
the following file types:
 * All *.te and SE Linux policy files as passed to checkpolicy
 * file_contexts
 * service_contexts
 * property_contexts
 * keys.conf

Example BoardConfig.mk Usage:
BOARD_SEPOLICY_M4DEFS += btmodule=foomatic \
                         btdevice=/dev/gps

SPECIFIC POLICY FILE INFORMATION

mac_permissions.xml:
  ABOUT:
    The mac_permissions.xml file is used for controlling the mmac solutions
    as well as mapping a public base16 signing key with an arbitrary seinfo
    string. Details of the files contents can be found in a comment at the
    top of that file. The seinfo string, previously mentioned, is the same string
    that is referenced in seapp_contexts.

    It is important to note the final processed version of this file
    is stripped of comments and whitespace. This is to preserve space on the
    system.img. If one wishes to view it in a more human friendly format,
    the "tidy" or "xmllint" command will assist you.

  TOOLING:
    insertkeys.py
      Is a helper script for mapping arbitrary tags in the signature stanzas of
      mac_permissions.xml to public keys found in pem files. This script takes
      a mac_permissions.xml file(s) and configuration file in order to operate.
      Details of the configuration file (keys.conf) can be found in the subsection
      keys.conf. This tool is also responsible for stripping the comments and
      whitespace during processing.

      keys.conf
        The keys.conf file is used for controlling the mapping of "tags" found in
        the mac_permissions.xml signature stanzas with actual public keys found in
        pem files. The configuration file is processed via m4.

        The script allows for mapping any string contained in TARGET_BUILD_VARIANT
        with specific path to a pem file. Typically TARGET_BUILD_VARIANT is either
        user, eng or userdebug. Additionally, one can specify "ALL" to map a path to
        any string specified in TARGET_BUILD_VARIANT. All tags are matched verbatim
        and all options are matched lowercase. The options are "tolowered" automatically
        for the user, it is convention to specify tags and options in all uppercase
        and tags start with @. The option arguments can also use environment variables
        via the familiar $VARIABLE syntax. This is often useful for setting a location
        to ones release keys.

        Often times, one will need to integrate an application that was signed by a separate
        organization and may need to extract the pem file for the insertkeys/keys.conf tools.
        Extraction of the public key in the pem format is possible via openssl. First you need
        to unzip the apk, once it is unzipped, cd into the META_INF directory and then execute
        openssl pkcs7 -inform DER -in CERT.RSA -out CERT.pem -outform PEM  -print_certs
        On some occasions CERT.RSA has a different name, and you will need to adjust for that.
        After extracting the pem, you can rename it, and configure keys.conf and
        mac_permissions.xml to pick up the change. You MUST open the generated pem file in a text
        editor and strip out anything outside the opening and closing scissor lines. Failure to do
        so WILL cause a compile time issue thrown by insertkeys.py

        NOTE: The pem files are base64 encoded and PackageManagerService, mac_permissions.xml
              and setool all use base16 encodings.