GitLab

This prevents denials from being generated by the base policy.
Over time, these rules will be incrementally tightened to improve
security.

Change-Id: I4be1c987a5d69ac784a56d42fc2c9063c402de11

Change-Id: Id41891b89c7b067919cbda06ab97d5eff2ad044f

sys_boot is not needed for adb as of system/core commit
ca8e66a8b0f843812014a28d49208f9f6f64ecbc

sys_boot is not needed for system server as of frameworks/base
commit dbcf2d7482562eff45ac727cea799b37a260e399

Change-Id: I61379ea858e05acd239c9b16e4e2bf454af3f51c

Long term this should be scoped down.

Change-Id: I261f05568566cca38bc5c43fbfa7ff1c816e5846

This rule doesn't work, as /proc/sysrq-trigger isn't properly labeled.
Revert this change for now.

This reverts commit bb2591e5.

Change-Id: Ief2d412dddf4cefdf43a26538c4be060df4cc787

Read access to /dev/log/* is no longer restricted.
Filtering on reads is performed per-uid by the kernel logger driver.

Change-Id: Ia986cbe66b84f3898e858c60f12c7f3d63ac47cf
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>

Change-Id: Ief2d412dddf4cefdf43a26538c4be060df4cc787

Read access to /dev/log/* is no longer restricted.
Filtering on reads is performed per-uid by the kernel logger driver.

Change-Id: Ia986cbe66b84f3898e858c60f12c7f3d63ac47cf
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>

Change-Id: I73a2b841ab3399b7528b8084a5c4736e6ecea48a

Change-Id: I73a2b841ab3399b7528b8084a5c4736e6ecea48a

This reverts commit ba84bf1d

Hidden dependency resolved.

Change-Id: I9f0844f643abfda8405db2c722a36c847882c392

This reverts commit 8a814a76

Change-Id: Id1497cc42d07ee7ff2ca44ae4042fc9f2efc9aad

Change-Id: I5a3584b6cc5eda2b7d82e85452f9fe457877f1d1
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>

Update policy for Android 4.2 / latest master.
Primarily this consists of changes around the bluetooth subsystem.
The zygote also needs further permissions to set up /storage/emulated.
adbd service now gets a socket under /dev/socket.
keystore uses the binder.

Change-Id: I8c5aeb8d100313c75169734a0fa614aa974b3bfc
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>

Allow reading of properties area, which is now created before init has switched contexts.  Revisit this later - we should explicitly label the properties file.