GitLab

* commit 'bf323ff8':

* commit 'c9b882dc':

* commit 'a669507e':

* commit '5c190886':

am 582620ae: am c2eb12b2: am 9f0af9ec: Merge "zygote/dex2oat: Grant additional symlink permissions" into lmp-sprout-dev

* commit '582620ae':

* commit 'f83e617f':

am 330dd6e4: am 0edbecf2: am 7cd346a7: am 0055ea90: Allow recovery to create device nodes and modify rootfs

* commit '330dd6e4':

* commit 'aa03e496':

* commit '21827ff0':

* commit 'a045ca42':

* commit 'b5dd69a1':

* commit '57dec60c':

am c2eb12b2: am 9f0af9ec: Merge "zygote/dex2oat: Grant additional symlink permissions" into lmp-sprout-dev

* commit 'c2eb12b2':

* commit '4008b6c6':

* commit '0edbecf2':

* commit 'e2ba13b9':

* commit 'f82f5e01':
  Accept command-line input for neverallow-check.

* commit '87f3802a':
  appdomain: relax netlink_socket neverallow rule

* commit 'c423b1aa':
  Add neverallow checking to sepolicy-analyze.

* commit '6f201ddc':
  App: add permissions to read symlinks from dalvik cache.

* commit '9f0af9ec':
  zygote/dex2oat: Grant additional symlink permissions

* commit 'b7934922':
  allow run-as to access /data/local/tmp

* commit '7cd346a7':

* commit '7adc8cfe':
  Allow adbd to write to /data/adb

Change-Id: I093d7ecf48e9137b974047cd7d0fd2209792b748

Also, divide each sepolicy-analyze function into its own component for simplified
command-line parsing and potentially eventual modularization.

Bug: 18005561

Cherry-pick of commit: ef4fd306
with commit: 47c14611
squashed in.

Bug: 19191637
Change-Id: Id66cad549b7311a6bbd92fd64b6ec2c60d0433a4

* commit '87f3802a':
  appdomain: relax netlink_socket neverallow rule

Relax the neverallow netlink restrictions for app domains.
In particular, some non-AOSP app domains may use netlink sockets
to communicate with a kernel driver.

Continue to neverallow generic netlink sockets for untrusted_app.
The intention here is that only app domains which explicitly need
this functionality should be able to request it.

This change does not add or remove any SELinux rules. Rather, it
just changes SELinux compile time assertions, as well as allowing
this behavior in CTS.

Modify other neverallow rules to use "domain" instead of "self".
Apps shouldn't be able to handle netlink sockets, even those
created in other SELinux domains.

(cherry picked from commit d31936f8)

Change-Id: I4763cb0c9510220693c506636dbb7584712b67e2

See NEVERALLOW CHECKING in tools/README for documentation.

Depends on change I45b3502ff96b1d093574e1fecff93a582f8d00bd
for libsepol to support reporting all neverallow failures.

Cherry-pick of commit: 59906bf8
with build-fix from commit: 74bbf703


added manually.

Bug: 19191637

Change-Id: I1c18fa854b3c5f5e05d5dc42d9006c5fdacebdc3
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>

Relax the neverallow netlink restrictions for app domains.
In particular, some non-AOSP app domains may use netlink sockets
to communicate with a kernel driver.

Continue to neverallow generic netlink sockets for untrusted_app.
The intention here is that only app domains which explicitly need
this functionality should be able to request it.

This change does not add or remove any SELinux rules. Rather, it
just changes SELinux compile time assertions, as well as allowing
this behavior in CTS.

Modify other neverallow rules to use "domain" instead of "self".
Apps shouldn't be able to handle netlink sockets, even those
created in other SELinux domains.

(cherry picked from commit d31936f8)

Bug: 19198997
Change-Id: Icfed1ee66f082df1117b090341f62981f01bc849

Chrome team recommends reverting this patch and introducing
it into a future version of Android, to avoid potential
compatibility issues.

This reverts commit 9de62d6f.

Bug: 17471434
Bug: 18609318
Change-Id: I3086cb8a8d7142b1eadce622f7e87a4c3426b6bf

Addresses denials such as:
type=1400 : avc: denied { lock } for comm="PushCheckSendS" path="socket:[1834573]" dev="sockfs" ino=X scontext=u:r:untrusted_app:s0 tcontext=u:r:untrusted_app:s0 tclass=tcp_socket
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>

(cherry picked from commit 2c759185)

Bug: 18730521
Change-Id: Ie68955c26ddedb3acd7b7aa18afbf8b35c2c2f78

Required for Settings to show name/icon of apps on sd card
(permission copied from untrusted_app)

Also removed duplicate permission (from domain) in untrusted_app

(cherry picked from commit c06ed8f7)

Bug: 18730865
Change-Id: I725d088d1d4a1256e3bfe49bc32796a54889f925

Bug: 18485243

(cherry picked from commit fc6214bf)

Change-Id: I1b9e2705383bd0a3bae75b35906110e490f8785d

Bug: 18642766

Change-Id: I97d6ab0b76b69d99dcc1928232c8961437e1e68c
Signed-off-by: Patrick Tjin <pattjin@google.com>

Bug: 18112269
Change-Id: I801a3ecb42a2636b15612ff19a55150d06786363

The GMS core feedback agent runs as untrusted_app, and needs
the ability to read /data/anr/traces.txt to report ANR information.

Allow all untrusted_apps to read /data/anr/traces.txt so that GMS core
can access it.

Longer term, we need to move GMS core into it's own domain, but that's
a longer term change.

Addresses the following denial:

W/ndroid.feedback(17825): type=1400 audit(0.0:68004): avc: denied { read } for name="traces.txt" dev="mmcblk0p28" ino=325762 scontext=u:r:untrusted_app:s0 tcontext=u:object_r:anr_data_file:s0 tclass=file

Bug: 18504118
Bug: 18340553
Change-Id: Ia9fac599befc3a3b6e5282be15ec8fd04bb23385

Dex2oat needs the ability to read from already open file descriptors
in /oem so that apps from that location can be installed. Allow it.

Addresses the following denials:

  avc: denied { read } for comm="dex2oat" path="/oem/app/TabletInfo.apk" dev="mmcblk0p12" ino=20 scontext=u:r:dex2oat:s0 tcontext=u:object_r:oemfs:s0 tclass=file permissive=0
  avc: denied { read } for comm="dex2oat" path="/oem/app/AskMe_android_one.apk" dev="mmcblk0p12" ino=14 scontext=u:r:dex2oat:s0 tcontext=u:object_r:oemfs:s0 tclass=file permissive=0
  avc: denied { read } for comm="dex2oat" path="/oem/app/PartnerRegulatoryInfo.apk" dev="mmcblk0p12" ino=19 scontext=u:r:dex2oat:s0 tcontext=u:object_r:oemfs:s0 tclass=file permissive=0
  avc: denied { read } for comm="dex2oat" path="/oem/app/PartnerLauncherProvider.apk" dev="mmcblk0p12" ino=18 scontext=u:r:dex2oat:s0 tcontext=u:object_r:oemfs:s0 tclass=file permissive=0
  avc: denied { read } for comm="dex2oat" path="/oem/app/Amazon_Mobile_com.apk" dev="mmcblk0p12" ino=13 scontext=u:r:dex2oat:s0 tcontext=u:object_r:oemfs:s0 tclass=file permissive=0
  avc: denied { read } for comm="dex2oat" path="/oem/app/PartnerBookmarksProvider.apk" dev="mmcblk0p12" ino=17 scontext=u:r:dex2oat:s0 tcontext=u:object_r:oemfs:s0 tclass=file permissive=0
  avc: denied { read } for comm="dex2oat" path="/oem/app/Hike.apk" dev="mmcblk0p12" ino=15 scontext=u:r:dex2oat:s0 tcontext=u:object_r:oemfs:s0 tclass=file permissive=0
  avc: denied { read } for comm="dex2oat" path="/oem/app/MiLive_embedded_IndiaGames_version4.0_android1.apk" dev="mmcblk0p12" ino=16 scontext=u:r:dex2oat:s0 tcontext=u:object_r:oemfs:s0 tclass=file permissive=0

Bug: 18539205
Change-Id: I92bd91c66befc5a1060dd189324b2c046bba0258