Merge 25Q1 (ab/12770256) to aosp-main-future Bug: 385190204 Merged-In: Ia8c27c5031bb14d77f581b4569a8d39a5613244f Change-Id: I1d15a54365a7bde3b22673cd891df0aa699807cf
diff --git a/legacy/whitechapel_pro/property.te b/legacy/whitechapel_pro/property.te index 7fe4817..ff5ef04 100644 --- a/legacy/whitechapel_pro/property.te +++ b/legacy/whitechapel_pro/property.te
@@ -1,4 +1,6 @@ +# Vendor vendor_internal_prop(vendor_nfc_prop) +vendor_restricted_prop(vendor_nfc_antenna_prop) vendor_internal_prop(vendor_secure_element_prop) vendor_internal_prop(vendor_battery_profile_prop) vendor_internal_prop(vendor_camera_prop)
diff --git a/legacy/whitechapel_pro/property_contexts b/legacy/whitechapel_pro/property_contexts index fa5c917..a422206 100644 --- a/legacy/whitechapel_pro/property_contexts +++ b/legacy/whitechapel_pro/property_contexts
@@ -3,6 +3,7 @@ # NFC persist.vendor.nfc. u:object_r:vendor_nfc_prop:s0 +persist.vendor.nfc.antenna. u:object_r:vendor_nfc_antenna_prop:s0 # SecureElement persist.vendor.se. u:object_r:vendor_secure_element_prop:s0
diff --git a/radio/file_contexts b/radio/file_contexts index d4f29be..e02a1aa 100644 --- a/radio/file_contexts +++ b/radio/file_contexts
@@ -6,7 +6,6 @@ /vendor/bin/sced u:object_r:sced_exec:s0 /vendor/bin/rfsd u:object_r:rfsd_exec:s0 /vendor/bin/modem_logging_control u:object_r:modem_logging_control_exec:s0 -/vendor/bin/modem_svc_sit u:object_r:modem_svc_sit_exec:s0 /vendor/bin/modem_ml_svc_sit u:object_r:modem_ml_svc_sit_exec:s0 /vendor/bin/cbd u:object_r:cbd_exec:s0 /vendor/bin/hw/rild_exynos u:object_r:rild_exec:s0
diff --git a/radio/modem_svc_sit.te b/radio/modem_svc_sit.te index 2b34874..3f22531 100644 --- a/radio/modem_svc_sit.te +++ b/radio/modem_svc_sit.te
@@ -1,3 +1,4 @@ +# Selinux rule for modem_svc_sit daemon type modem_svc_sit, domain; type modem_svc_sit_exec, vendor_file_type, exec_type, file_type; init_daemon_domain(modem_svc_sit)
diff --git a/system_ext/private/systemui_app.te b/system_ext/private/systemui_app.te index 5a5f9d2..3b8dadf 100644 --- a/system_ext/private/systemui_app.te +++ b/system_ext/private/systemui_app.te
@@ -1,3 +1,4 @@ +# SEPolicy for System UI typeattribute systemui_app coredomain; app_domain(systemui_app) @@ -19,9 +20,11 @@ get_prop(systemui_app, keyguard_config_prop) set_prop(systemui_app, bootanim_system_prop) get_prop(systemui_app, qemu_hw_prop) +get_prop(systemui_app, radio_cdma_ecm_prop) # Allow writing and removing wmshell protolog in /data/misc/wmtrace. userdebug_or_eng(` allow systemui_app wm_trace_data_file:dir rw_dir_perms; allow systemui_app wm_trace_data_file:file create_file_perms; ') +set_prop(systemui_app, debug_tracing_desktop_mode_visible_tasks_prop)
diff --git a/tracking_denials/bluetooth.te b/tracking_denials/bluetooth.te new file mode 100644 index 0000000..203d58a --- /dev/null +++ b/tracking_denials/bluetooth.te
@@ -0,0 +1,2 @@ +# b/382362125 +dontaudit bluetooth default_android_service:service_manager { find };
diff --git a/tracking_denials/bug_map b/tracking_denials/bug_map index 48bf2b9..cfb0d77 100644 --- a/tracking_denials/bug_map +++ b/tracking_denials/bug_map
@@ -1,24 +1,37 @@ +aconfigd apex_info_file file b/381326735 +bluetooth audio_config_prop file b/379245855 dump_modem sscoredump_vendor_data_coredump_file dir b/361725982 dump_modem sscoredump_vendor_data_logcat_file dir b/361725982 dumpstate app_zygote process b/288049050 +edgetpu_vendor_server shell_data_file dir b/369475225 +edgetpu_vendor_server shell_data_file dir b/369475363 hal_bluetooth_btlinux vendor_default_prop property_service b/350832030 +hal_camera_default aconfig_storage_metadata_file dir b/383013471 hal_radioext_default radio_vendor_data_file file b/312590044 -hal_vibrator_default default_android_service service_manager b/314054292 -hal_vibrator_default default_android_service service_manager b/367943515 incidentd debugfs_wakeup_sources file b/288049561 incidentd incidentd anon_inode b/288049561 +init init capability b/379207041 insmod-sh insmod-sh key b/274374722 kernel dm_device blk_file b/319403445 modem_svc_sit hal_radioext_default process b/364446415 modem_svc_sit modem_ml_svc_sit file b/360060606 modem_svc_sit modem_ml_svc_sit file b/360060992 mtectrl unlabeled dir b/264483752 +pixelstats_vendor block_device dir b/369540673 +pixelstats_vendor block_device dir b/369540836 +platform_app radio_vendor_data_file dir b/380756119 +platform_app vendor_fw_file dir b/372121912 +platform_app vendor_rild_prop file b/372121912 +priv_app audio_config_prop file b/379246064 +radio audio_config_prop file b/379245771 +ramdump ramdump capability b/369475700 shell sysfs_net file b/330081782 ssr_detector_app default_prop file b/340722729 system_server sysfs_batteryinfo file b/294967729 system_server vendor_default_prop file b/366116488 system_suspend sysfs_batteryinfo dir b/317316633 system_suspend sysfs_touch_gti dir b/350832258 +untrusted_app audio_config_prop file b/379245754 vendor_init default_prop file b/315104235 vendor_init default_prop file b/315104803 vendor_init default_prop file b/323087197 @@ -26,3 +39,4 @@ vendor_init default_prop property_service b/315104235 vendor_init default_prop property_service b/359428180 vendor_init vendor_volte_mif_off property_service b/316816642 +zygote zygote capability b/379207101
diff --git a/vendor/debug_camera_app.te b/vendor/debug_camera_app.te index 86394cf..6474cb1 100644 --- a/vendor/debug_camera_app.te +++ b/vendor/debug_camera_app.te
@@ -1,3 +1,4 @@ +# File containing sepolicies for GCA-Eng & GCA-Next. userdebug_or_eng(` # Allows GCA-Eng & GCA-Next access the GXP device and properties. allow debug_camera_app gxp_device:chr_file rw_file_perms; @@ -9,4 +10,7 @@ # Allows GCA_Eng & GCA-Next to access the hw_jpeg /dev/video12. allow debug_camera_app hw_jpg_device:chr_file rw_file_perms; + + # Allow tachyon_service to communicate with GCA-Eng via binder. + binder_call(edgetpu_tachyon_server, debug_camera_app); ')
diff --git a/vendor/genfs_contexts b/vendor/genfs_contexts index 4384177..4b6ad96 100644 --- a/vendor/genfs_contexts +++ b/vendor/genfs_contexts
@@ -346,3 +346,8 @@ # CPU genfscon sysfs /kernel/metrics/cpuidle_histogram/cpuidle_histogram u:object_r:sysfs_cpu:s0 genfscon sysfs /kernel/metrics/cpuidle_histogram/cpucluster_histogram u:object_r:sysfs_cpu:s0 + +# USB +starting_at_board_api(202504, ` +genfscon sysfs /devices/platform/11210000.usb/11210000.dwc3/udc/11210000.dwc3/state u:object_r:sysfs_udc:s0 +')
diff --git a/vendor/google_camera_app.te b/vendor/google_camera_app.te index c572c26..05aff08 100644 --- a/vendor/google_camera_app.te +++ b/vendor/google_camera_app.te
@@ -8,3 +8,6 @@ # Allows GCA to access the hw_jpeg /dev/video12. allow google_camera_app hw_jpg_device:chr_file rw_file_perms; + +# Allow tachyon service to communicate with google_camera_app via binder. +binder_call(edgetpu_tachyon_server, google_camera_app);
diff --git a/vendor/hal_nfc_default.te b/vendor/hal_nfc_default.te index d71d9e2..d4dcf47 100644 --- a/vendor/hal_nfc_default.te +++ b/vendor/hal_nfc_default.te
@@ -1,5 +1,9 @@ # HAL NFC property -get_prop(hal_nfc_default, vendor_nfc_prop) +set_prop(hal_nfc_default, vendor_nfc_prop) +set_prop(hal_nfc_default, vendor_nfc_antenna_prop) +userdebug_or_eng( + get_prop(untrusted_app, vendor_nfc_antenna_prop) +) # SecureElement property set_prop(hal_nfc_default, vendor_secure_element_prop)
diff --git a/vendor/hal_usb_impl.te b/vendor/hal_usb_impl.te index 3d89a09..2e8652e 100644 --- a/vendor/hal_usb_impl.te +++ b/vendor/hal_usb_impl.te
@@ -20,6 +20,9 @@ # For monitoring usb sysfs attributes allow hal_usb_impl sysfs_wakeup:dir search; allow hal_usb_impl sysfs_wakeup:file r_file_perms; +starting_at_board_api(202504, ` +allow hal_usb_impl sysfs_udc:file r_file_perms; +') # For metrics upload allow hal_usb_impl fwk_stats_service:service_manager find;
diff --git a/vendor/service_contexts b/vendor/service_contexts index 00cf9c5..ffa2639 100644 --- a/vendor/service_contexts +++ b/vendor/service_contexts
@@ -3,5 +3,3 @@ vendor.google.wireless_charger.IWirelessCharger/default u:object_r:hal_wireless_charger_service:s0 arm.mali.platform.ICompression/default u:object_r:arm_mali_platform_service:s0 - -android.hardware.media.c2.IComponentStore/default1 u:object_r:hal_codec2_service:s0
diff --git a/zuma-sepolicy.mk b/zuma-sepolicy.mk index abfaa28..56502eb 100644 --- a/zuma-sepolicy.mk +++ b/zuma-sepolicy.mk
@@ -1,6 +1,6 @@ # sepolicy that are shared among devices using zuma BOARD_SEPOLICY_DIRS += device/google/zuma-sepolicy/vendor -BOARD_SEPOLICY_DIRS += device/google/zuma-sepolicy/radio +BOARD_VENDOR_SEPOLICY_DIRS += device/google/zuma-sepolicy/radio PRODUCT_PRIVATE_SEPOLICY_DIRS += device/google/zuma-sepolicy/radio/private # unresolved SELinux error log with bug tracking