)]}' { "log": [ { "commit": "c81ebe522c66dd6e6ef4419ecc7737e2e1740d59", "tree": "4174530cbf7f483e0ebdcfca48beef00f2d5e63c", "parents": [ "6937aa93ac0a36f19cb13b81a282dedcad324be5" ], "author": { "name": "Nick Kralevich", "email": "nnk@google.com", "time": "Tue Mar 29 15:37:20 2016 -0700" }, "committer": { "name": "Nick Kralevich", "email": "nnk@google.com", "time": "Tue Mar 29 15:37:20 2016 -0700" }, "message": "Delete external/sepolicy files.\n\nThese files have been moved to system/sepolicy.\n\nBug: 27875478\nChange-Id: I057784af0e9f6e43cd9a22ffce26fd63acccf98b\n" }, { "commit": "6937aa93ac0a36f19cb13b81a282dedcad324be5", "tree": "94df2c83e574833dc12d14f27786f70e467f9b35", "parents": [ "4d19f98c728373860c5628d46fe5f4d664c601d2" ], "author": { "name": "Nick Kralevich", "email": "nnk@google.com", "time": "Sat Mar 26 07:43:38 2016 -0700" }, "committer": { "name": "Nick Kralevich", "email": "nnk@google.com", "time": "Mon Mar 28 09:21:00 2016 -0700" }, "message": "refine /data/misc/logd rules\n\nFollowup to 121f5bfd80298266d293fa5c0a30fed66f4facfa.\n\nMove misc_logd_file neverallow rule from domain.te to logd.te,\nsince the goal of the neverallow rule is to protect logd / logpersist\nfiles from other processes.\n\nSwitch the misc_logd_file neverallow rule from using \"rw_file_perms\"\nto \"no_rw_file_perms\". The latter covers more cases of file\nmodifications.\n\nAdd more neverallow rules covering misc_logd_file directories.\n\nInstead of using not_userdebug_nor_eng(), modify the rules to be\nconsistent with other highly constrained file types such as\nkeystore_data_file or vold_data_file. See, for example,\nhttps://android-review.googlesource.com/144768\n\nTo see the net effect of this change, you can use the following\ncommand line:\n\n sesearch --allow -t misc_logd_file -c file,dir,lnk_file \\\n out/target/product/bullhead/root/sepolicy\n\nBefore this change:\n\n # userdebug builds\n allow init misc_logd_file:dir { search setattr read create getattr write relabelfrom ioctl rmdir remove_name relabelto open add_name };\n allow init misc_logd_file:file { setattr read create write relabelfrom getattr relabelto unlink open };\n allow init misc_logd_file:lnk_file { setattr relabelfrom create getattr relabelto unlink };\n allow logd misc_logd_file:dir { search read lock getattr write ioctl remove_name open add_name };\n allow logd misc_logd_file:file { rename setattr read lock create getattr write ioctl unlink open append };\n allow shell misc_logd_file:dir { search read lock getattr ioctl open };\n allow shell misc_logd_file:file { read lock ioctl open getattr };\n\n # user builds\n allow init misc_logd_file:dir { search setattr read create getattr write relabelfrom ioctl rmdir remove_name relabelto open add_name };\n allow init misc_logd_file:file relabelto;\n allow init misc_logd_file:lnk_file { setattr relabelfrom create getattr relabelto unlink };\n\nAfter this change:\n\n # userdebug builds\n allow init misc_logd_file:dir { search setattr read create getattr ioctl relabelto open };\n allow init misc_logd_file:file { relabelto getattr };\n allow init misc_logd_file:lnk_file relabelto;\n allow logd misc_logd_file:dir { search read lock getattr write ioctl remove_name open add_name };\n allow logd misc_logd_file:file { rename setattr read lock create getattr write ioctl unlink open append };\n allow shell misc_logd_file:dir { search read lock getattr ioctl open };\n allow shell misc_logd_file:file { read lock ioctl open getattr };\n\n # user builds\n allow init misc_logd_file:dir { search setattr read create getattr ioctl relabelto open };\n allow init misc_logd_file:file { relabelto getattr };\n allow init misc_logd_file:lnk_file relabelto;\n\nChange-Id: I0b00215049ad83182f458b4b9e258289c5144479\n" }, { "commit": "4d19f98c728373860c5628d46fe5f4d664c601d2", "tree": "e6786e48e023a997cfc0937de8115a6f020b0cef", "parents": [ "0144eedba57cc078112f95ca66d827f98ecf4a5b" ], "author": { "name": "Daichi Hirono", "email": "hirono@google.com", "time": "Tue Mar 22 17:14:30 2016 +0900" }, "committer": { "name": "Nick Kralevich", "email": "nnk@google.com", "time": "Mon Mar 28 00:06:45 2016 +0000" }, "message": "Add mlstrustedobject to appfuse object type.\n\nTo write bytes to appfuse file from priv_app, we need to specify\nmlstrustedobject.\nThe CL fixes the following denial.\n\ntype\u003d1400 audit(0.0:77): avc: denied { write } for name\u003d\"10\" dev\u003d\"fuse\" ino\u003d10 scontext\u003du:r:priv_app:s0:c512,c768 tcontext\u003du:object_r:app_fuse_file:s0 tclass\u003dfile permissive\u003d0\n\nBUG\u003d23093747\n\nChange-Id: I9901033bb3349d5def0bd7128db45a1169856dc1\n" }, { "commit": "0144eedba57cc078112f95ca66d827f98ecf4a5b", "tree": "d9035707f33cbf09d42e31ceeab0fbef38d49727", "parents": [ "8ae52a05ba30a4f7709d8bce381bfb3662e8cfea", "121f5bfd80298266d293fa5c0a30fed66f4facfa" ], "author": { "name": "Mark Salyzyn", "email": "salyzyn@google.com", "time": "Fri Mar 25 20:57:20 2016 +0000" }, "committer": { "name": "Gerrit Code Review", "email": "noreply-gerritcodereview@google.com", "time": "Fri Mar 25 20:57:20 2016 +0000" }, "message": "Merge \"init: logpersist access on debug\"" }, { "commit": "8ae52a05ba30a4f7709d8bce381bfb3662e8cfea", "tree": "852a3cfe8b1bf272c27dc681ada8b234d12ce5fb", "parents": [ "369cf8cde5f69e6d6b752e250edfba80289b9c83", "4bf9a47ea8b6f7fbe48f4cd511d79a066b8e79b7" ], "author": { "name": "Mark Salyzyn", "email": "salyzyn@google.com", "time": "Fri Mar 25 20:55:22 2016 +0000" }, "committer": { "name": "Gerrit Code Review", "email": "noreply-gerritcodereview@google.com", "time": "Fri Mar 25 20:55:22 2016 +0000" }, "message": "Merge \"dumpstate: access to /data/misc/recovery\"" }, { "commit": "4bf9a47ea8b6f7fbe48f4cd511d79a066b8e79b7", "tree": "fc2f12da022275b056565c032dbbe6174f4aa99b", "parents": [ "f2d07904f7754a066c7e15a072cf57126ff348d3" ], "author": { "name": "Mark Salyzyn", "email": "salyzyn@google.com", "time": "Fri Mar 25 13:34:11 2016 -0700" }, "committer": { "name": "Mark Salyzyn", "email": "salyzyn@google.com", "time": "Fri Mar 25 13:50:21 2016 -0700" }, "message": "dumpstate: access to /data/misc/recovery\n\nBug: 27176738\nChange-Id: I70e4b7b54044dd541076eddd39a8e9f5d881badf\n" }, { "commit": "121f5bfd80298266d293fa5c0a30fed66f4facfa", "tree": "1d7104769649cc164b2a5a7a0e32028d22d150a9", "parents": [ "f2d07904f7754a066c7e15a072cf57126ff348d3" ], "author": { "name": "Mark Salyzyn", "email": "salyzyn@google.com", "time": "Fri Mar 25 09:59:18 2016 -0700" }, "committer": { "name": "Mark Salyzyn", "email": "salyzyn@google.com", "time": "Fri Mar 25 13:05:07 2016 -0700" }, "message": "init: logpersist access on debug\n\n03-25 09:31:22.996 1 1 W init : type\u003d1400 audit(0.0:8): \\\n avc: denied { getattr } for path\u003d\"/data/misc/logd/logcat.052\" \\\n dev\u003d\"dm-2\" ino\u003d124778 scontext\u003du:r:init:s0 \\\n tcontext\u003du:object_r:misc_logd_file:s0 tclass\u003dfile permissive\u003d0\n. . .\n\nIntroduced a new macro not_userdebug_nor_eng()\n\nChange-Id: I9c3a952c265cac096342493598fff7d41604ca45\n" }, { "commit": "369cf8cde5f69e6d6b752e250edfba80289b9c83", "tree": "0f91bd625cbaa65531eeb88869dbb7e1d144c416", "parents": [ "f2d07904f7754a066c7e15a072cf57126ff348d3" ], "author": { "name": "Nick Kralevich", "email": "nnk@google.com", "time": "Fri Mar 25 12:22:32 2016 -0700" }, "committer": { "name": "Nick Kralevich", "email": "nnk@google.com", "time": "Fri Mar 25 12:22:32 2016 -0700" }, "message": "neverallow /data/anr access for isolated/untrusted apps\n\nAdd a neverallow rule (compile time assertion + CTS test) that\nisolated_apps and untrusted_apps can\u0027t do anything else but append\nto /data/anr/traces.txt. In particular, assert that they can\u0027t\nread from the file, or overwrite other data which may already be\nin the file.\n\nBug: 18340553\nBug: 27853304\nChange-Id: I249fe2a46401b660efaa3f1102924a448ed750d5\n" }, { "commit": "f2d07904f7754a066c7e15a072cf57126ff348d3", "tree": "4cd0b4dc23f9aed796d6a61fe1a0af75ccb6a5ab", "parents": [ "df72abb3a2c11591bbb77535f06e3c11192acb86" ], "author": { "name": "Jeff Vander Stoep", "email": "jeffv@google.com", "time": "Fri Mar 25 07:52:22 2016 -0700" }, "committer": { "name": "Jeff Vander Stoep", "email": "jeffv@google.com", "time": "Fri Mar 25 08:22:24 2016 -0700" }, "message": "sysfs_uio: declare type in core policy\n\n/dev/uio uio_device is already declared. Accessing uio through /sys\nis also common.\n\nBug: 26990688\nChange-Id: I3db941161dae31d3b87f265708abbcd9171a2c1f\n" }, { "commit": "df72abb3a2c11591bbb77535f06e3c11192acb86", "tree": "4d0dc74c27b1d81a90a48a62acecc884a3ce5a79", "parents": [ "16fe52c90caae18c0d91918d6bfc471f2e637207" ], "author": { "name": "dcashman", "email": "dcashman@google.com", "time": "Thu Mar 24 09:23:54 2016 -0700" }, "committer": { "name": "dcashman", "email": "dcashman@google.com", "time": "Thu Mar 24 14:18:27 2016 -0700" }, "message": "Move sysfs_thermal to global policy and grant access.\n\nsysfs_thermal nodes are common enough to warrant an entry in global\npolicy and the new HardwarePropertiesManagerService exists explicitly to\nexpose some of this information.\n\nAddress the following denials:\navc: denied { search } for name\u003d\"thermal\" dev\u003d\"sysfs\" ino\u003d17509 scontext\u003du:r:system_server:s0 tcontext\u003du:object_r:sysfs_thermal:s0 tclass\u003ddir permissive\u003d1\navc: denied { read } for name\u003d\"temp\" dev\u003d\"sysfs\" ino\u003d17848 scontext\u003du:r:system_server:s0 tcontext\u003du:object_r:sysfs_thermal:s0 tclass\u003dfile permissive\u003d1\navc: denied { open } for path\u003d\"/sys/devices/virtual/thermal/thermal_zone8/temp\" dev\u003d\"sysfs\" ino\u003d17848 scontext\u003du:r:system_server:s0 tcontext\u003du:object_r:sysfs_thermal:s0 tclass\u003dfile permissive\u003d1\navc: denied { getattr } for path\u003d\"/sys/devices/virtual/thermal/thermal_zone8/temp\" dev\u003d\"sysfs\" ino\u003d17848 scontext\u003du:r:system_server:s0 tcontext\u003du:object_r:sysfs_thermal:s0 tclass\u003dfile permissive\u003d1\n\n(cherry-pick of internal commit: 98eff7c3d46abe2db996c0718b7386a3e368f344)\n\nBug: 27809332\nChange-Id: I6f812a7e281e348aa24c76b119e71ed95e1a1d9f\n" }, { "commit": "16fe52c90caae18c0d91918d6bfc471f2e637207", "tree": "531d0b1225e9fb7393ee8279995a7ac783cb643b", "parents": [ "af3ca33f612a764301fb294513320091c23a2966" ], "author": { "name": "Mark Salyzyn", "email": "salyzyn@google.com", "time": "Wed Mar 16 08:11:49 2016 -0700" }, "committer": { "name": "Mark Salyzyn", "email": "salyzyn@google.com", "time": "Thu Mar 24 11:30:29 2016 -0700" }, "message": "Add recovery_persist \u0026 recovery_refresh\n\nOne time executables. recovery_refresh can be used at any time to\nensure recovery logs in pmsg are re-placed at the end of the FIFO.\nrecovery_persist takes the recovery logs in pmsg and drops them\ninto /data/misc/recovery/ directory.\n\nBug: 27176738\nChange-Id: Ife3cf323930fb7a6a5d1704667961f9d42bfc5ac\n" }, { "commit": "af3ca33f612a764301fb294513320091c23a2966", "tree": "4af5ae94b4c4db61a94566345db0970d54cbbe88", "parents": [ "0792d8a0f22ed444d2dc49e5bffa3c0e436c6ac5" ], "author": { "name": "Nick Kralevich", "email": "nnk@google.com", "time": "Mon Mar 21 18:15:05 2016 -0700" }, "committer": { "name": "Nick Kralevich", "email": "nnk@google.com", "time": "Tue Mar 22 10:03:41 2016 -0700" }, "message": "global_macros: Allow directory locking\n\nSee https://groups.google.com/d/msg/android-ndk/BbEOA9pnR-I/HgLkGy5qAgAJ\n\nAddresses the following denial:\n\n avc: denied { lock } for path\u003d\"/data/data/com.mypackage/files/somefilename\" dev\u003d\"mmcblk0p28\" ino\u003d114736 scontext\u003du:r:untrusted_app:s0:c512,c768 tcontext\u003du:object_r:app_data_file:s0:c512,c768 tclass\u003ddir permissive\u003d0\n\nWhile I\u0027m here, also add lock to w_file_perms.\n\n(cherrypicked from commit 4ee494cce1670e6883fb56cea96aa6bab10a4523)\n\nChange-Id: I2568a228099c4e112e4a8b80da3bfcf2e35eb0ea\n" }, { "commit": "0792d8a0f22ed444d2dc49e5bffa3c0e436c6ac5", "tree": "7d2dc0c02b939c007681c91a5f9accd5f02ec6d7", "parents": [ "610f461ecf79865548a5a30e85d07d8cee87c14d" ], "author": { "name": "Nick Kralevich", "email": "nnk@google.com", "time": "Sun Mar 20 20:29:09 2016 -0700" }, "committer": { "name": "Nick Kralevich", "email": "nnk@google.com", "time": "Sun Mar 20 20:29:09 2016 -0700" }, "message": "system_server.te: expand app_data_file neverallow rule\n\nBlock other operations which involve non-file descriptor\noperations.\n\nChange-Id: I5d813781c201a732aa1ee6ff6fd3d82f2af32ec7\n" }, { "commit": "610f461ecf79865548a5a30e85d07d8cee87c14d", "tree": "0d4233a383bde95cce8de89f36d9879f1189f095", "parents": [ "dda5590883745ab01840bd8ab17d0ef58406b55b" ], "author": { "name": "Felipe Leme", "email": "felipeal@google.com", "time": "Thu Mar 17 16:08:21 2016 -0700" }, "committer": { "name": "Felipe Leme", "email": "felipeal@google.com", "time": "Thu Mar 17 16:08:21 2016 -0700" }, "message": "Add rules to allow dumpstate to run systrace.\n\nBUG: 27419521\nChange-Id: I63108468d75be3ef7f9761107a3df8997f207d07\n" }, { "commit": "dda5590883745ab01840bd8ab17d0ef58406b55b", "tree": "0e2f6b3e16c1d999be4d0d1ed7140f20e2241ef4", "parents": [ "9ed71eff4bed91653cba393ea6cb42f041d4e257" ], "author": { "name": "Evgenii Stepanov", "email": "eugenis@google.com", "time": "Wed Mar 16 13:51:31 2016 -0700" }, "committer": { "name": "Evgenii Stepanov", "email": "eugenis@google.com", "time": "Wed Mar 16 14:05:12 2016 -0700" }, "message": "Add /data/lib64, /data/vendor/lib64 to ASan sepolicy.\n\nThis policy takes effect only when building with\nSANITIZE_TARGET\u003daddress and allows the Zygote to load libraries from\n/data. That\u0027s where ASan-instrumented copies of system libraries are\nlocated. 32-bit library directories have been added a while back;\nthis CL extends the same policy to 64-bit directories.\n\nBug: 25751174\n\nChange-Id: Ieb4701b78db9649ec8563f2962a69db537ae61b3\n" }, { "commit": "9ed71eff4bed91653cba393ea6cb42f041d4e257", "tree": "3733378a865b461ac762a0ed7fd361bd0afa664c", "parents": [ "f100b2c4e678ed5c0a70747c3a1c1bdb9ffffc62" ], "author": { "name": "dcashman", "email": "dcashman@google.com", "time": "Mon Mar 14 12:21:18 2016 -0700" }, "committer": { "name": "dcashman", "email": "dcashman@google.com", "time": "Mon Mar 14 12:44:14 2016 -0700" }, "message": "Mark batteryproperties service as app_api_service.\n\nApplications do not explicitly request handles to the batteryproperties\nservice, but the BatteryManager obtains a reference to it and uses it\nfor its underlying property queries. Mark it as an app_api_service so\nthat all applications may use this API. Also remove the batterypropreg\nservice label, as this does not appear to be used and may have been a\nduplication of batteryproperties. As a result, remove the\nhealthd_service type and replace it with a more specific\nbatteryproperties_service type.\n\nBug: 27442760\nChange-Id: I5c0f9d7992ff2ec64adaeef22356e88fd0e8169c\n" }, { "commit": "f100b2c4e678ed5c0a70747c3a1c1bdb9ffffc62", "tree": "fcd5d3130fc01d8f5e458ef03fc876540d1c2d6a", "parents": [ "1c983327cf7e841183da15934c7ba2e99d0979c0" ], "author": { "name": "dcashman", "email": "dcashman@google.com", "time": "Fri Mar 11 15:23:49 2016 -0800" }, "committer": { "name": "dcashman", "email": "dcashman@google.com", "time": "Mon Mar 14 10:27:33 2016 -0700" }, "message": "Create sysfs_hwrandom type.\n\nHwRngTest needs access to the hwrandom sysfs files, but untrused_app\ndoes not have access to sysfs. Give these files their own label and\nallow the needed read access.\n\n(cherry-pick from internal commit: 85c0f8affa4d3aa3c50331e272327e360eb8bed9)\n\nBug: 27263241\nChange-Id: If572ad0931a534d76e148b688b76687460e99af9\n" }, { "commit": "1c983327cf7e841183da15934c7ba2e99d0979c0", "tree": "d98a1d305c4ff398408af931648d64da1d6e673e", "parents": [ "f4c403d1f6a05a6df36cea5c4096fe098d0c50c8" ], "author": { "name": "Janis Danisevskis", "email": "jdanis@google.com", "time": "Thu Mar 10 12:58:23 2016 +0000" }, "committer": { "name": "Janis Danisevskis", "email": "jdanis@google.com", "time": "Fri Mar 11 17:48:19 2016 +0000" }, "message": "Leftovers of SELinux policy reload mechanism\n\nRemove references to /data/security and the corresponding\ntype securitly_file.\n\nBug: 26544104\nChange-Id: Iac00c293daa6b781a24c2bd4c12168dfb1cceac6\n" }, { "commit": "f4c403d1f6a05a6df36cea5c4096fe098d0c50c8", "tree": "d0ffa707d320d365787f455c2535ffa4622f06f4", "parents": [ "07e6b0418e1e2f8da88fca049cec80f9726da361" ], "author": { "name": "dcashman", "email": "dcashman@google.com", "time": "Thu Mar 10 13:43:58 2016 -0800" }, "committer": { "name": "dcashman", "email": "dcashman@google.com", "time": "Thu Mar 10 14:50:47 2016 -0800" }, "message": "Allow domains to getattr proc lnk_file.\n\nMany permissions were removed from untrusted_app by the removal of\ndomain_deprecated, including procfs access. procfs file access was restored,\nhowever, but not completely. Add the ability to getattr to all domains,\nso that other domains which lost domain_deprecated may benefit, as they\nwill likely need it.\n\nBug: 27249037\nChange-Id: Id3f5e6121548b29d739d5e0fa6ccdbc9f0fc29be\n" }, { "commit": "07e6b0418e1e2f8da88fca049cec80f9726da361", "tree": "bc3b67fe3ec93bccea7807096dabc41d33c94c01", "parents": [ "a57cff0679e1bf4efe25cb1c7de64c6fbf1b241f", "48141c36754a16795d8666a76d92dbf182119563" ], "author": { "name": "Josh Gao", "email": "jmgao@google.com", "time": "Thu Mar 10 00:00:54 2016 +0000" }, "committer": { "name": "Gerrit Code Review", "email": "noreply-gerritcodereview@google.com", "time": "Thu Mar 10 00:00:54 2016 +0000" }, "message": "Merge \"Allow debuggerd to send SIGKILL.\"" }, { "commit": "a57cff0679e1bf4efe25cb1c7de64c6fbf1b241f", "tree": "0df1ad769449a40513e5ef43130443a79954eda2", "parents": [ "3c47d5a44ce55d2eaf753fceb6c26fdc8d464bad", "b64ea38366ca3acb7b8ee7bc15600bd8456fd693" ], "author": { "name": "Daniel Cashman", "email": "dcashman@google.com", "time": "Wed Mar 09 15:29:40 2016 +0000" }, "committer": { "name": "Gerrit Code Review", "email": "noreply-gerritcodereview@google.com", "time": "Wed Mar 09 15:29:41 2016 +0000" }, "message": "Merge \"Remove procfs file read perm from untrusted_app.\"" }, { "commit": "48141c36754a16795d8666a76d92dbf182119563", "tree": "b59c6b9bfb9e6c2d144cb073e1ed4b2c7302e5ac", "parents": [ "3c47d5a44ce55d2eaf753fceb6c26fdc8d464bad" ], "author": { "name": "Josh Gao", "email": "jmgao@google.com", "time": "Tue Mar 08 18:02:15 2016 -0800" }, "committer": { "name": "Josh Gao", "email": "jmgao@google.com", "time": "Tue Mar 08 18:02:15 2016 -0800" }, "message": "Allow debuggerd to send SIGKILL.\n\nBug: http://b/27367422\nChange-Id: I936c16281e06214b35f8d245da8f619dc92ff15f\n" }, { "commit": "b64ea38366ca3acb7b8ee7bc15600bd8456fd693", "tree": "0df1ad769449a40513e5ef43130443a79954eda2", "parents": [ "edd86a63672b718448ad115b079aeb8f11d6bb90" ], "author": { "name": "dcashman", "email": "dcashman@google.com", "time": "Mon Mar 07 10:24:14 2016 -0800" }, "committer": { "name": "dcashman", "email": "dcashman@google.com", "time": "Mon Mar 07 10:24:14 2016 -0800" }, "message": "Remove procfs file read perm from untrusted_app.\n\nBug: 26813932\nChange-Id: I155087d28d9284d8c96554cc6739bb676272a00f\n" }, { "commit": "3c47d5a44ce55d2eaf753fceb6c26fdc8d464bad", "tree": "4fe06111faf63cdaa6397dd640a1ac1ce32f7f21", "parents": [ "d27df9606344738cd2122ce98fa89a2d79e22f12", "edd86a63672b718448ad115b079aeb8f11d6bb90" ], "author": { "name": "Alex Deymo", "email": "deymo@google.com", "time": "Fri Mar 04 08:01:49 2016 +0000" }, "committer": { "name": "android-build-merger", "email": "android-build-merger@google.com", "time": "Fri Mar 04 08:01:49 2016 +0000" }, "message": "Merge \"New postinstall domain and rules to run post-install program.\"\nam: edd86a6367\n\n* commit \u0027edd86a63672b718448ad115b079aeb8f11d6bb90\u0027:\n New postinstall domain and rules to run post-install program.\n" }, { "commit": "edd86a63672b718448ad115b079aeb8f11d6bb90", "tree": "4fe06111faf63cdaa6397dd640a1ac1ce32f7f21", "parents": [ "01d95c23ab8c14d72e4ce98b3dda64ce81ab6306", "6cb2c893b12db00c73009f6ab1f6c69426b0cc05" ], "author": { "name": "Alex Deymo", "email": "deymo@google.com", "time": "Fri Mar 04 07:58:51 2016 +0000" }, "committer": { "name": "Gerrit Code Review", "email": "noreply-gerritcodereview@google.com", "time": "Fri Mar 04 07:58:52 2016 +0000" }, "message": "Merge \"New postinstall domain and rules to run post-install program.\"" }, { "commit": "d27df9606344738cd2122ce98fa89a2d79e22f12", "tree": "15defb347da3220c65adbe955cab03b48979d039", "parents": [ "1274aa15d415ea317c48b321445583bf25999b6a", "01d95c23ab8c14d72e4ce98b3dda64ce81ab6306" ], "author": { "name": "Stephen Smalley", "email": "sds@tycho.nsa.gov", "time": "Thu Mar 03 21:44:06 2016 +0000" }, "committer": { "name": "android-build-merger", "email": "android-build-merger@google.com", "time": "Thu Mar 03 21:44:06 2016 +0000" }, "message": "Update netlink socket classes.\nam: 01d95c23ab\n\n* commit \u002701d95c23ab8c14d72e4ce98b3dda64ce81ab6306\u0027:\n Update netlink socket classes.\n" }, { "commit": "01d95c23ab8c14d72e4ce98b3dda64ce81ab6306", "tree": "15defb347da3220c65adbe955cab03b48979d039", "parents": [ "6ef10bd48b09ae0cb371c9d9f161c3b3b8f003fc" ], "author": { "name": "Stephen Smalley", "email": "sds@tycho.nsa.gov", "time": "Thu May 21 16:17:26 2015 -0400" }, "committer": { "name": "Stephen Smalley", "email": "sds@tycho.nsa.gov", "time": "Thu Mar 03 16:16:48 2016 -0500" }, "message": "Update netlink socket classes.\n\nDefine new netlink socket security classes introduced by upstream kernel commit\n6c6d2e9bde1c1c87a7ead806f8f5e2181d41a652 (\"selinux: update netlink socket\nclasses\"). This was merged in Linux 4.2 and is therefore only required\nfor Android kernels based on 4.2 or newer (e.g. the android-4.4 branch\nof the kernel/common tree).\n\nAdd the new socket classes to socket_class_set.\nAdd an initial set of allow rules although further refinement\nwill likely be necessary. Any allow rule previously written\non :netlink_socket may need to be rewritten or duplicated for\none or more of the more specific classes. For now, we retain\nthe existing :netlink_socket rules for compatibility on older kernels.\n\nChange-Id: I5040b30edd2d374538490a080feda96dd4bae5bf\nSigned-off-by: Stephen Smalley \u003csds@tycho.nsa.gov\u003e\n" }, { "commit": "6cb2c893b12db00c73009f6ab1f6c69426b0cc05", "tree": "d6a6046c35d0a27ddda73ff6caa39f34d3caa7aa", "parents": [ "6ef10bd48b09ae0cb371c9d9f161c3b3b8f003fc" ], "author": { "name": "Alex Deymo", "email": "deymo@google.com", "time": "Tue Mar 01 16:14:45 2016 -0800" }, "committer": { "name": "Alex Deymo", "email": "deymo@google.com", "time": "Wed Mar 02 15:33:12 2016 -0800" }, "message": "New postinstall domain and rules to run post-install program.\n\nWhen using the A/B updater, a device specific hook is sometimes needed\nto run after the new partitions are updated but before rebooting into\nthe new image. This hook is referred to throughout the code as the\n\"postinstall\" step.\n\nThis patch creates a new execution domain \"postinstall\" which\nupdate_engine will use to run said hook. Since the hook needs to run\nfrom the new image (namelly, slot \"B\"), update_engine needs to\ntemporarly mount this B partition into /postinstall and then run a\nprogram from there.\n\nSince the new program in B runs from the old execution context in A, we\ncan\u0027t rely on the labels set in the xattr in the new filesystem to\nenforce the policies baked into the old running image. Instead, when\ntemporarily mounting the new filesystem in update_engine, we override\nall the new file attributes with the new postinstall_file type by\npassing \"context\u003du:object_r:postinstall_file:s0\" to the mount syscall.\nThis allows us to set new rules specific to the postinstall environment\nthat are consistent with the rules in the old system.\n\nBug: 27177071\nTEST\u003dDeployed a payload with a trivial postinstall script to edison-eng.\n\nChange-Id: Ib06fab92afb45edaec3c9c9872304dc9386151b4\n" }, { "commit": "1274aa15d415ea317c48b321445583bf25999b6a", "tree": "8cd9d86a88b10fe51e585bc039a62cd2371ced24", "parents": [ "087601e07160bfd3cd6ae3ab4ba1143df7a2040d", "6ef10bd48b09ae0cb371c9d9f161c3b3b8f003fc" ], "author": { "name": "Nick Kralevich", "email": "nnk@google.com", "time": "Wed Mar 02 01:39:47 2016 +0000" }, "committer": { "name": "android-build-merger", "email": "android-build-merger@google.com", "time": "Wed Mar 02 01:39:47 2016 +0000" }, "message": "suppress unnecessary makefile output\nam: 6ef10bd48b\n\n* commit \u00276ef10bd48b09ae0cb371c9d9f161c3b3b8f003fc\u0027:\n suppress unnecessary makefile output\n" }, { "commit": "6ef10bd48b09ae0cb371c9d9f161c3b3b8f003fc", "tree": "8cd9d86a88b10fe51e585bc039a62cd2371ced24", "parents": [ "9a1347eee668990a8fb357d0d088beb430a61c27" ], "author": { "name": "Nick Kralevich", "email": "nnk@google.com", "time": "Mon Feb 29 16:59:33 2016 -0800" }, "committer": { "name": "Nick Kralevich", "email": "nnk@google.com", "time": "Mon Feb 29 16:59:33 2016 -0800" }, "message": "suppress unnecessary makefile output\n\ncheckpolicy spits out a bunch of unnecessary lines during normal\noperation, which bloat the logs and hide other more important\nwarnings. Suppress the normal output.\n\nSELinux compile time errors are printed to stderr, and are\nuneffected by this change.\n\nChange-Id: I07f2cbe8afcd14abf1c025355a169b5214ed5c6e\n" }, { "commit": "087601e07160bfd3cd6ae3ab4ba1143df7a2040d", "tree": "5d67a38ece973280342f1f340d2ae9c0f7a77106", "parents": [ "0551e9e8d4764578d7304d695ba20040a6e0ea0b", "9a1347eee668990a8fb357d0d088beb430a61c27" ], "author": { "name": "Nick Kralevich", "email": "nnk@google.com", "time": "Mon Feb 29 18:00:03 2016 +0000" }, "committer": { "name": "android-build-merger", "email": "android-build-merger@google.com", "time": "Mon Feb 29 18:00:03 2016 +0000" }, "message": "Allow bluetooth access to the tun device.\nam: 9a1347eee6\n\n* commit \u00279a1347eee668990a8fb357d0d088beb430a61c27\u0027:\n Allow bluetooth access to the tun device.\n" }, { "commit": "9a1347eee668990a8fb357d0d088beb430a61c27", "tree": "5d67a38ece973280342f1f340d2ae9c0f7a77106", "parents": [ "bca98efa575bedab68f2d5eaee2cd1fd1741962b" ], "author": { "name": "Nick Kralevich", "email": "nnk@google.com", "time": "Sun Feb 28 20:52:55 2016 -0800" }, "committer": { "name": "Nick Kralevich", "email": "nnk@google.com", "time": "Mon Feb 29 09:22:27 2016 -0800" }, "message": "Allow bluetooth access to the tun device.\n\nBluetooth uses the tun device for tethering. Allow access.\n\n STEPS TO REPRODUCE:\n 0. Have two devices to test on, say Device A and Device B\n 1. On Device A, Go to settings -\u003eBluetooth .\n 2. Turn on the Bluetooth .\n 3. Pair it with device B\n 4. Tap on the paired device\n\n OBSERVED RESULTS:\n -Bluetooth share crash is observed with \"Bluetooth share has stopped\"\n error message\n -Unable to use Bluetooth tethering due to this issue\n\n EXPECTED RESULTS:\n No crash and Bluetooth devices should be able to connect for tethering\n\nAddresses the following denial:\n\ncom.android.bluetooth: type\u003d1400 audit(0.0:131): avc: denied { open }\nfor comm\u003d425420536572766963652043616C6C path\u003d\"/dev/tun\" dev\u003d\"tmpfs\"\nino\u003d12340 scontext\u003du:r:bluetooth:s0 tcontext\u003du:object_r:tun_device:s0\ntclass\u003dchr_file permissive\u003d0\n\nBug: 27372573\nChange-Id: I07724d8d68ffcdda691f1179787a4f40a0ab1c73\n" }, { "commit": "0551e9e8d4764578d7304d695ba20040a6e0ea0b", "tree": "cf2e2dfab673dcf553358dba4afb2698596e8f51", "parents": [ "fff4bf792a47194ce0a17575bc5468cf62132b77", "bca98efa575bedab68f2d5eaee2cd1fd1741962b" ], "author": { "name": "Nick Kralevich", "email": "nnk@google.com", "time": "Sat Feb 27 04:36:39 2016 +0000" }, "committer": { "name": "android-build-merger", "email": "android-build-merger@google.com", "time": "Sat Feb 27 04:36:39 2016 +0000" }, "message": "Don\\\u0027t allow permissive SELinux domains on user builds.\nam: bca98efa57\n\n* commit \u0027bca98efa575bedab68f2d5eaee2cd1fd1741962b\u0027:\n Don\u0027t allow permissive SELinux domains on user builds.\n" }, { "commit": "bca98efa575bedab68f2d5eaee2cd1fd1741962b", "tree": "cf2e2dfab673dcf553358dba4afb2698596e8f51", "parents": [ "f25ea5f9c00dff32a2d04c7af3e76d0efac28a7c" ], "author": { "name": "Nick Kralevich", "email": "nnk@google.com", "time": "Fri Feb 26 20:06:52 2016 -0800" }, "committer": { "name": "Nick Kralevich", "email": "nnk@google.com", "time": "Fri Feb 26 20:06:52 2016 -0800" }, "message": "Don\u0027t allow permissive SELinux domains on user builds.\n\nIt\u0027s a CTS requirement that all SELinux domains be in\nenforcing mode. Add the same assertion to the build system\nwhen targeting user builds.\n\nIn particular, this avoids a situation where device integrity\nchecking is enabled on user builds, but permissive denials\nare being generated, causing the device to unexpectedly reboot\ninto safe mode.\n\nA developer wanting to put an SELinux domain into permissive\nmode for userdebug/eng purposes can write the following\nin their policy:\n\n userdebug_or_eng(`\n permissive foo;\n \u0027)\n\nBug: 26902605\nBug: 27313768\nChange-Id: Ic0971d9e96a28f2a98f9d56a547661d24fb81a21\n" }, { "commit": "fff4bf792a47194ce0a17575bc5468cf62132b77", "tree": "73875dd546241f9cd32bd4449d5b1114b1acfdd9", "parents": [ "9b7d41901c82e6cd941e3092dbbad567216bcf93", "f25ea5f9c00dff32a2d04c7af3e76d0efac28a7c" ], "author": { "name": "dcashman", "email": "dcashman@google.com", "time": "Wed Feb 24 15:52:24 2016 +0000" }, "committer": { "name": "android-build-merger", "email": "android-build-merger@google.com", "time": "Wed Feb 24 15:52:24 2016 +0000" }, "message": "Label /proc/meminfo.\nam: f25ea5f9c0\n\n* commit \u0027f25ea5f9c00dff32a2d04c7af3e76d0efac28a7c\u0027:\n Label /proc/meminfo.\n" }, { "commit": "f25ea5f9c00dff32a2d04c7af3e76d0efac28a7c", "tree": "73875dd546241f9cd32bd4449d5b1114b1acfdd9", "parents": [ "7905d6819efc5f3052bc4eaa6da8b40c03f3abb1" ], "author": { "name": "dcashman", "email": "dcashman@google.com", "time": "Tue Feb 23 17:09:48 2016 -0800" }, "committer": { "name": "dcashman", "email": "dcashman@google.com", "time": "Wed Feb 24 07:38:28 2016 -0800" }, "message": "Label /proc/meminfo.\n\nAddress the following denial:\nm.chrome.canary: type\u003d1400 audit(0.0:15): avc: granted { read open } for path\u003d\"/proc/meminfo\" dev\u003d\"proc\" ino\u003d4026544360 scontext\u003du:r:untrusted_app:s0:c512,c768 tcontext\u003du:object_r:proc:s0 tclass\u003dfile\n\n(cherry-pick of internal commit: 971aeeda2138b27e3f8850f2fd7c95f60508154c)\n\nBug: 22032619\nChromium Bug: 586021\n\nChange-Id: I2dcb2d4800bbc92ea47c37d4fd7a10f827a0114c\n" }, { "commit": "9b7d41901c82e6cd941e3092dbbad567216bcf93", "tree": "51232d9ddd4b4c1a35124f7480397f12dd2ec23b", "parents": [ "fe06f87e5b40fcdd0d83ab7ed8902f9f7d18d94e", "7905d6819efc5f3052bc4eaa6da8b40c03f3abb1" ], "author": { "name": "Dan Sandler", "email": "dsandler@android.com", "time": "Wed Feb 24 04:15:44 2016 +0000" }, "committer": { "name": "android-build-merger", "email": "android-build-merger@google.com", "time": "Wed Feb 24 04:15:44 2016 +0000" }, "message": "Allow access to the daydream (\"dreams\") service.\nam: 7905d6819e\n\n* commit \u00277905d6819efc5f3052bc4eaa6da8b40c03f3abb1\u0027:\n Allow access to the daydream (\"dreams\") service.\n" }, { "commit": "7905d6819efc5f3052bc4eaa6da8b40c03f3abb1", "tree": "51232d9ddd4b4c1a35124f7480397f12dd2ec23b", "parents": [ "65b5fde912285ebeeefc9c7486f4453dd86d994f" ], "author": { "name": "Dan Sandler", "email": "dsandler@android.com", "time": "Tue Feb 23 14:15:49 2016 -0500" }, "committer": { "name": "Nick Kralevich", "email": "nnk@google.com", "time": "Tue Feb 23 21:08:44 2016 +0000" }, "message": "Allow access to the daydream (\"dreams\") service.\n\nBug: 26804329\nChange-Id: I7b789c6fe8411e3a4a718da86d442a0f48c5c310\n" }, { "commit": "fe06f87e5b40fcdd0d83ab7ed8902f9f7d18d94e", "tree": "1909c26ab26d3dfbd1b38ce7ed7a250ca66bdc97", "parents": [ "ead74ee28615941fc4d953aa77c72a8899a9b1bf", "65b5fde912285ebeeefc9c7486f4453dd86d994f" ], "author": { "name": "Tao Bao", "email": "tbao@google.com", "time": "Mon Feb 22 19:25:46 2016 +0000" }, "committer": { "name": "android-build-merger", "email": "android-build-merger@google.com", "time": "Mon Feb 22 19:25:46 2016 +0000" }, "message": "Add recovery service.\nam: 65b5fde912\n\n* commit \u002765b5fde912285ebeeefc9c7486f4453dd86d994f\u0027:\n Add recovery service.\n" }, { "commit": "65b5fde912285ebeeefc9c7486f4453dd86d994f", "tree": "1909c26ab26d3dfbd1b38ce7ed7a250ca66bdc97", "parents": [ "6b843bcff0c7560dec2aef6fd6d31e8cc9d67f0f" ], "author": { "name": "Tao Bao", "email": "tbao@google.com", "time": "Wed Feb 03 12:43:58 2016 -0800" }, "committer": { "name": "Tao Bao", "email": "tbao@google.com", "time": "Mon Feb 22 18:37:38 2016 +0000" }, "message": "Add recovery service.\n\nRecoverySystemService is separated from PowerManagerService as a\ndedicated system service to handle recovery related requests (such as\ninvoking uncrypt to uncrypt an OTA package on /data or to set up /\nclear the bootloader control block (i.e. /misc) and etc).\n\nThe matching CL in frameworks/base is in:\n Change-Id: Ic606fcf5b31c54ce54f0ab12c1768fef0fa64560.\n\nBug: 26830925\nChange-Id: Iee0583c458f784bfa422d0f7af5d1f2681d9609e\n" }, { "commit": "ead74ee28615941fc4d953aa77c72a8899a9b1bf", "tree": "7a8fc702d5236504a9c250d8c83895f7c11abf7e", "parents": [ "a2c93a40bc78cccae48e53ada3611815ca7a569f", "6b843bcff0c7560dec2aef6fd6d31e8cc9d67f0f" ], "author": { "name": "Yabin Cui", "email": "yabinc@google.com", "time": "Fri Feb 19 17:38:33 2016 +0000" }, "committer": { "name": "android-build-merger", "email": "android-build-merger@google.com", "time": "Fri Feb 19 17:38:33 2016 +0000" }, "message": "Enable recovery to read batteryinfo.\nam: 6b843bcff0\n\n* commit \u00276b843bcff0c7560dec2aef6fd6d31e8cc9d67f0f\u0027:\n Enable recovery to read batteryinfo.\n" }, { "commit": "6b843bcff0c7560dec2aef6fd6d31e8cc9d67f0f", "tree": "7a8fc702d5236504a9c250d8c83895f7c11abf7e", "parents": [ "9bb93fa537ceac80b6b1a414b3d094019efcf206" ], "author": { "name": "Yabin Cui", "email": "yabinc@google.com", "time": "Wed Feb 17 12:23:13 2016 -0800" }, "committer": { "name": "Yabin Cui", "email": "yabinc@google.com", "time": "Thu Feb 18 17:58:04 2016 -0800" }, "message": "Enable recovery to read batteryinfo.\n\nBug: 26879394\n\nChange-Id: I09ac9027ca343e00488dedab8df1687fd32bb255\n" }, { "commit": "a2c93a40bc78cccae48e53ada3611815ca7a569f", "tree": "75518379317dfa03c999c68fd88e68b9d637312e", "parents": [ "9bb93fa537ceac80b6b1a414b3d094019efcf206", "563b2bfc73740720af9f9048ad164e6f5a9f9128" ], "author": { "name": "Bill Yi", "email": "byi@google.com", "time": "Wed Feb 17 09:50:38 2016 -0800" }, "committer": { "name": "Bill Yi", "email": "byi@google.com", "time": "Wed Feb 17 09:50:38 2016 -0800" }, "message": "Merge commit \u0027563b2bfc73740720af9f9048ad164e6f5a9f9128\u0027 into HEAD\n" }, { "commit": "9bb93fa537ceac80b6b1a414b3d094019efcf206", "tree": "75518379317dfa03c999c68fd88e68b9d637312e", "parents": [ "b38e2790944d028a81089ec088ded54f269aa1f2", "9c168711d5f79642a5357cd4c58ad5e88a9795ba" ], "author": { "name": "Sami Tolvanen", "email": "samitolvanen@google.com", "time": "Tue Feb 16 21:52:13 2016 +0000" }, "committer": { "name": "Gerrit Code Review", "email": "noreply-gerritcodereview@google.com", "time": "Tue Feb 16 21:52:13 2016 +0000" }, "message": "Merge \"Allow logd.auditd to reboot to safe mode\"" }, { "commit": "b38e2790944d028a81089ec088ded54f269aa1f2", "tree": "b8d8fa583feeb1811184cec606fa78bed2ff2d40", "parents": [ "c1e48835078d60f969f2e0d6c69a8b7e698dbbac" ], "author": { "name": "Lorenzo Colitti", "email": "lorenzo@google.com", "time": "Mon Feb 15 17:16:06 2016 +0900" }, "committer": { "name": "Lorenzo Colitti", "email": "lorenzo@google.com", "time": "Tue Feb 16 10:11:49 2016 +0900" }, "message": "Allow netd to use NETLINK_SOCK_DIAG.\n\nThis is needed to kill sockets using the new SOCK_DESTROY\noperation instead of using SIOCKILLADDR.\n\nBug: 26976388\nChange-Id: I01a63a754726a0e9fb68be48b76df4dc47752edb\n" }, { "commit": "9c168711d5f79642a5357cd4c58ad5e88a9795ba", "tree": "a0165f44edc07cdba2200c9ce140198ab717b1a8", "parents": [ "c1e48835078d60f969f2e0d6c69a8b7e698dbbac" ], "author": { "name": "Sami Tolvanen", "email": "samitolvanen@google.com", "time": "Fri Feb 05 15:42:32 2016 -0800" }, "committer": { "name": "Sami Tolvanen", "email": "samitolvanen@google.com", "time": "Wed Feb 10 15:51:28 2016 -0800" }, "message": "Allow logd.auditd to reboot to safe mode\n\nBug: 26902605\nChange-Id: Ica825cf2af74f5624cf4091544bd24bb5482dbe7\n" }, { "commit": "c1e48835078d60f969f2e0d6c69a8b7e698dbbac", "tree": "284810ffc93fa3342efa55ede69024921360b4ca", "parents": [ "e931bdd67bb68f6dae32156235ec7e75eb089d61", "0b80f4dc8aa09817532138ff2d1fbdc98a34a4ac" ], "author": { "name": "Daniel Cashman", "email": "dcashman@google.com", "time": "Wed Feb 10 20:32:22 2016 +0000" }, "committer": { "name": "Gerrit Code Review", "email": "noreply-gerritcodereview@google.com", "time": "Wed Feb 10 20:32:22 2016 +0000" }, "message": "Merge \"Remove appdomain sysfs auditallow.\"" }, { "commit": "0b80f4dc8aa09817532138ff2d1fbdc98a34a4ac", "tree": "9dbc45161576156734210905506a55a1c746c162", "parents": [ "3ec34ceb43b15c30e9c7bf1720ebea24f868d07a" ], "author": { "name": "dcashman", "email": "dcashman@google.com", "time": "Wed Feb 10 12:26:41 2016 -0800" }, "committer": { "name": "dcashman", "email": "dcashman@google.com", "time": "Wed Feb 10 12:26:41 2016 -0800" }, "message": "Remove appdomain sysfs auditallow.\n\nLarge numbers of denials have been collected. Remove from logging until\nfurther action is taken to address existing denials and remove sysfs\naccess from additional appdomains.\n\nChange-Id: Ia7ad6264d85490824089b5074bf9c22303cc864a\n" }, { "commit": "e931bdd67bb68f6dae32156235ec7e75eb089d61", "tree": "c5753a1b3ff70a6d383b076be6f29e164d016237", "parents": [ "eb43e6548e1c23d9b47b98d6dd429f9887223dfa", "29adea51edfe190e29fd24397e0b8d7abbf5f5f6" ], "author": { "name": "Jeffrey Vander Stoep", "email": "jeffv@google.com", "time": "Wed Feb 10 18:04:52 2016 +0000" }, "committer": { "name": "Gerrit Code Review", "email": "noreply-gerritcodereview@google.com", "time": "Wed Feb 10 18:04:52 2016 +0000" }, "message": "Merge changes from topic \u0027checkseapp-fixups\u0027\n\n* changes:\n checkseapp: remove .data \u003d NULL assignments\n checkseapp: remove data types form static map\n checkseapp: generalize input validation\n checkseapp: update error message output\n checkseapp: declare internal function as static\n" }, { "commit": "eb43e6548e1c23d9b47b98d6dd429f9887223dfa", "tree": "79ed7f631002de7f2f37f7f65b5eae5dcf92c318", "parents": [ "3ec34ceb43b15c30e9c7bf1720ebea24f868d07a" ], "author": { "name": "Nick Kralevich", "email": "nnk@google.com", "time": "Wed Feb 10 09:33:08 2016 -0800" }, "committer": { "name": "Nick Kralevich", "email": "nnk@google.com", "time": "Wed Feb 10 09:41:40 2016 -0800" }, "message": "uncrypt: drop generic block_device allow rules\n\nCurrently, uncrypt has write access to \"block_device\". This is\nthe generic label used for a file in /dev/block which doesn\u0027t\nhave a more specific label assigned to it.\n\nThis is an overly broad grant. Commit a10f789d286d0f28c85488629cc92f5ab6ca8e00\nstarted the process of deprecating \"block_device\" access in favor\nof \"misc_block_device\".\n\nThis change completes the deprecation and removes the overly\nbroad grant. Also update the neverallow rules so that\nthis overly broad rule cannot be reintroduced into uncrypt.\n\nBug: 25091603\nChange-Id: Ifc5fa412db2f95726ae89c32c577a6659885ae55\n" }, { "commit": "3ec34ceb43b15c30e9c7bf1720ebea24f868d07a", "tree": "a151071b0bad0422d9b3b5c2ebcc76964391b13c", "parents": [ "bd0768cc93e6c934ccec62e521228fecddb5d61b" ], "author": { "name": "Tao Bao", "email": "tbao@google.com", "time": "Tue Feb 09 14:12:58 2016 -0800" }, "committer": { "name": "Tao Bao", "email": "tbao@google.com", "time": "Tue Feb 09 15:16:46 2016 -0800" }, "message": "update_engine: Allow to access bootctrl_block_device.\n\nupdate_engine needs to access bootctrl_block_device to get and set the slot to boot.\navc: denied { write } for name\u003d\"mmcblk0boot1\" dev\u003d\"tmpfs\" ino\u003d1266 scontext\u003du:r:update_engine:s0 tcontext\u003du:object_r:bootctrl_block_device:s0 tclass\u003dblk_file\navc: denied { open } for path\u003d\"/dev/block/mmcblk0boot1\" dev\u003d\"tmpfs\" ino\u003d1266 scontext\u003du:r:update_engine:s0 tcontext\u003du:object_r:bootctrl_block_device:s0 tclass\u003dblk_file\n\nAlso track the name change of the native binder service.\navc: denied { add } for service\u003dandroid.os.UpdateEngineService pid\u003d210 uid\u003d0 scontext\u003du:r:update_engine:s0 tcontext\u003du:object_r:default_android_service:s0 tclass\u003dservice_manager\n\nBug: 27106053\nChange-Id: Idbfef18578489db33fead0721e8f26d63db5ce09\n" }, { "commit": "bd0768cc93e6c934ccec62e521228fecddb5d61b", "tree": "6be4c74e8eeb08e8cc394b19f3b05756aef932b5", "parents": [ "eebdb473079c1b0cefadf372d0139519ac1465ac" ], "author": { "name": "William Roberts", "email": "william.c.roberts@intel.com", "time": "Mon Feb 08 16:20:50 2016 -0800" }, "committer": { "name": "Nick Kralevich", "email": "nnk@google.com", "time": "Tue Feb 09 13:32:58 2016 -0800" }, "message": "untrusted_app: confine filesystem creation to sandbox\n\nuntrusted_apps could be allowed to create/unlink files in world\naccessible /data locations. These applications could create\nfiles in a way that would need cap dac_override to remove from\nthe system when they are uninstalled and/or leave orphaned\ndata behind.\n\nKeep untrusted_app file creation to sandbox, sdcard and media\nlocations.\n\nChange-Id: Ife680cb9425dad8223651f16b9be8a3179839ec3\nSigned-off-by: William Roberts \u003cwilliam.c.roberts@intel.com\u003e\n" }, { "commit": "eebdb473079c1b0cefadf372d0139519ac1465ac", "tree": "351dc3afa1b6dba2bc174dae88d14eb518b83bab", "parents": [ "e3965aa29581ea5c567bfd892854576a953faa96" ], "author": { "name": "Andre Eisenbach", "email": "eisenbach@google.com", "time": "Mon Feb 08 15:39:00 2016 -0800" }, "committer": { "name": "Andre Eisenbach", "email": "eisenbach@google.com", "time": "Tue Feb 09 02:10:11 2016 +0000" }, "message": "Allow system apps (Settings) to configure Bluetooth properties\n\nBug: 27078729\nChange-Id: I74115521e1def661dea5575eb532b93fe7f1f4ad\n" }, { "commit": "e3965aa29581ea5c567bfd892854576a953faa96", "tree": "91d8b7c1f00b229ae83fc3b7b0c9712132da1c21", "parents": [ "abf31acb01f85ade4b97b05f9893d270b915b7b6", "e178ac5a7147f6f808844ab9ba4f0d6eb948cb88" ], "author": { "name": "Daichi Hirono", "email": "hirono@google.com", "time": "Sat Feb 06 07:16:58 2016 +0000" }, "committer": { "name": "Gerrit Code Review", "email": "noreply-gerritcodereview@google.com", "time": "Sat Feb 06 07:16:58 2016 +0000" }, "message": "Merge \"Add SELinux label for app fuse.\"" }, { "commit": "abf31acb01f85ade4b97b05f9893d270b915b7b6", "tree": "3bb46bba26d54c25c3bb813fc4c30c287a90404a", "parents": [ "35a145143076ceee50f387025d8cb3c62e62569e" ], "author": { "name": "dcashman", "email": "dcashman@google.com", "time": "Fri Feb 05 15:13:36 2016 -0800" }, "committer": { "name": "dcashman", "email": "dcashman@google.com", "time": "Fri Feb 05 15:16:51 2016 -0800" }, "message": "Allow domain to read proc dirs.\n\nAbility to read all of proc was placed in domain_deprecated with the\nintention of reducing information leaking from proc. Many processes try\nto read proc dirs, though. Allow this with the belief that information\nleakage is from the proc files themselves rather than dir structure.\n\nAddress the following denial:\navc: denied { read } for name\u003d\"/\" dev\u003d\"proc\" ino\u003d1 scontext\u003du:r:untrusted_app:s0:c512,c768 tcontext\u003du:object_r:proc:s0 tclass\u003ddir permissive\u003d0\n\nBug: 26833472\nChange-Id: I975ae022c093e1cf80de21487dc11e49f938e5a3\n" }, { "commit": "35a145143076ceee50f387025d8cb3c62e62569e", "tree": "0186c87954be0cefa5941faeea370903fec5de39", "parents": [ "d1435604455e5e274c88f6ee0308c7881cddaf20" ], "author": { "name": "Nick Kralevich", "email": "nnk@google.com", "time": "Fri Feb 05 14:48:03 2016 -0800" }, "committer": { "name": "Nick Kralevich", "email": "nnk@google.com", "time": "Fri Feb 05 14:54:04 2016 -0800" }, "message": "Replace \"neverallow domain\" by \"neverallow *\"\n\nModify many \"neverallow domain\" rules to be \"neverallow *\" rules\ninstead. This will catch more SELinux policy bugs where a label\nis assigned an irrelevant rule, as well as catch situations where\na domain attribute is not assigned to a process.\n\nChange-Id: I5b83a2504c13b384f9dff616a70ca733b648ccdf\n" }, { "commit": "e178ac5a7147f6f808844ab9ba4f0d6eb948cb88", "tree": "47e6e293e7bf8cbe5182674c2ad2de2ef3875ffb", "parents": [ "d1435604455e5e274c88f6ee0308c7881cddaf20" ], "author": { "name": "Daichi Hirono", "email": "hirono@google.com", "time": "Thu Jan 28 15:48:39 2016 +0900" }, "committer": { "name": "Daichi Hirono", "email": "hirono@google.com", "time": "Fri Feb 05 16:10:53 2016 +0900" }, "message": "Add SELinux label for app fuse.\n\nThe labels for filesystem and files are assigned by vold with using\ncontext\u003d mount option.\n\nChange-Id: I8a9d701a46a333093a27107fc3c52b17a2af1a94\n" }, { "commit": "d1435604455e5e274c88f6ee0308c7881cddaf20", "tree": "b170e7052fb13155fb8f51e3c62b4890f4b3eb92", "parents": [ "4c42a0dcc087c1d188620aa4c6f9afe4e66ba902" ], "author": { "name": "Mark Salyzyn", "email": "salyzyn@google.com", "time": "Thu Feb 04 10:55:43 2016 -0800" }, "committer": { "name": "Mark Salyzyn", "email": "salyzyn@google.com", "time": "Thu Feb 04 11:03:10 2016 -0800" }, "message": "persist.mmc.* only set in init\n\nBug: 26976972\nChange-Id: I0e44bfc6774807a3bd2ba05637a432675d855118\n" }, { "commit": "4c42a0dcc087c1d188620aa4c6f9afe4e66ba902", "tree": "766e16bafb5db9bfddeb377c5d4ba758ee950756", "parents": [ "84fbd53a1b39dbec2703b56f92d6fe2612c4a4a4", "59e3d7b42dab41a42c37c84ec872a8584c4e7258" ], "author": { "name": "Daichi Hirono", "email": "hirono@google.com", "time": "Thu Feb 04 03:34:01 2016 +0000" }, "committer": { "name": "Gerrit Code Review", "email": "noreply-gerritcodereview@google.com", "time": "Thu Feb 04 03:34:01 2016 +0000" }, "message": "Merge \"Fix SELinux warning when passing fuse FD from system server.\"" }, { "commit": "59e3d7b42dab41a42c37c84ec872a8584c4e7258", "tree": "82f8c69d3b7060b3f07b3157b0e6fe1c34321cc6", "parents": [ "0e591bd256233add2c06c306bc17f5ebd71fe088" ], "author": { "name": "Daichi Hirono", "email": "hirono@google.com", "time": "Thu Jan 28 15:59:14 2016 +0900" }, "committer": { "name": "Daichi Hirono", "email": "hirono@google.com", "time": "Wed Feb 03 18:15:33 2016 +0900" }, "message": "Fix SELinux warning when passing fuse FD from system server.\n\nBefore applying the CL, Android shows the following error when passing\nFD of /dev/fuse.\n\n\u003e Binder_2: type\u003d1400 audit(0.0:38): avc: denied { getattr } for\n\u003e path\u003d\"/dev/fuse\" dev\u003d\"tmpfs\" ino\u003d9300 scontext\u003du:r:system_server:s0\n\u003e tcontext\u003du:object_r:fuse_device:s0 tclass\u003dchr_file permissive\u003d0\n\nChange-Id: I59dec819d79d4e2e1a8e42523b6f521481cb2afd\n" }, { "commit": "84fbd53a1b39dbec2703b56f92d6fe2612c4a4a4", "tree": "e6faceca346b3a2c095b8c1bae8a9c0b954fed9c", "parents": [ "3d8391e759fd3ffe70f10fc77e252fe71c902836", "9a28f90d6a36d3627ff525a6f3ac160039b27b5e" ], "author": { "name": "Jeffrey Vander Stoep", "email": "jeffv@google.com", "time": "Mon Feb 01 19:15:15 2016 +0000" }, "committer": { "name": "Gerrit Code Review", "email": "noreply-gerritcodereview@google.com", "time": "Mon Feb 01 19:15:15 2016 +0000" }, "message": "Merge \"init: allow to access console-ramoops with newer kernels\"" }, { "commit": "29adea51edfe190e29fd24397e0b8d7abbf5f5f6", "tree": "1545ddcd535ca64bdffe4bc620567734b7982da2", "parents": [ "c92dae9807e890e7b8bdc8f293ef35143ad51ca5" ], "author": { "name": "William Roberts", "email": "william.c.roberts@intel.com", "time": "Fri Jan 29 15:12:58 2016 -0800" }, "committer": { "name": "William Roberts", "email": "william.c.roberts@intel.com", "time": "Fri Jan 29 15:12:58 2016 -0800" }, "message": "checkseapp: remove .data \u003d NULL assignments\n\nRemove the .data\u003dNULL assignments that were pushing the\nstatic keymap mapping horizontal.\n\nChange-Id: I2e6e78930ac8d1d8b9bd61d9dedb59f4859ea13c\nSigned-off-by: William Roberts \u003cwilliam.c.roberts@intel.com\u003e\n" }, { "commit": "c92dae9807e890e7b8bdc8f293ef35143ad51ca5", "tree": "658e0faf5c9ac969f30f84a6ed93787a88fdcc5a", "parents": [ "696a66ba202780d757bd8a2d47db72473b7d558b" ], "author": { "name": "William Roberts", "email": "william.c.roberts@intel.com", "time": "Fri Jan 29 11:03:40 2016 -0800" }, "committer": { "name": "William Roberts", "email": "william.c.roberts@intel.com", "time": "Fri Jan 29 11:05:57 2016 -0800" }, "message": "checkseapp: remove data types form static map\n\nData type tracking is no longer needed now that per\nkey validation routines are supported.\n\nChange-Id: I2f1d0d5b1713e0477996479b0f279a58f43f15c7\nSigned-off-by: William Roberts \u003cwilliam.c.roberts@intel.com\u003e\n" }, { "commit": "696a66ba202780d757bd8a2d47db72473b7d558b", "tree": "660e0345ecda35ff7b5c77b92144f0e79c6aba53", "parents": [ "efebf97e23ce6a170fbea5f3376af0d9f0a63858" ], "author": { "name": "William Roberts", "email": "william.c.roberts@intel.com", "time": "Fri Jan 29 10:41:50 2016 -0800" }, "committer": { "name": "William Roberts", "email": "william.c.roberts@intel.com", "time": "Fri Jan 29 10:53:16 2016 -0800" }, "message": "checkseapp: generalize input validation\n\nInput validation was hard-coded into a validation routine\nthat would check against type and key names in a scattered,\norder dependent conditional code block.\n\nThis makes it harder than it should be to add new key value\npairs and types into checkseapp.\n\nTo correct this, we add a validation callback into the\nstatic mapping. If the validation callback is set, the\nexisting validation routine will call this for input\nvalidation. On failure, a validation specific error message\nis returned to be displayed.\n\nChange-Id: I92cf1cdf4ddbcfae19168b621f47169a3cf551ac\nSigned-off-by: William Roberts \u003cwilliam.c.roberts@intel.com\u003e\n" }, { "commit": "efebf97e23ce6a170fbea5f3376af0d9f0a63858", "tree": "0176dd0222f751cbe008dece0f5bd36f54749fd5", "parents": [ "25528cf4a5d2b037d4d51d6163bbde412b5bc33c" ], "author": { "name": "William Roberts", "email": "william.c.roberts@intel.com", "time": "Fri Jan 29 10:34:04 2016 -0800" }, "committer": { "name": "William Roberts", "email": "william.c.roberts@intel.com", "time": "Fri Jan 29 10:51:00 2016 -0800" }, "message": "checkseapp: update error message output\n\nChange the final error message to be consistent with the others.\n\nFrom:\nError: reading /home/wcrobert/workspace/aosp/external/sepolicy/seapp_contexts, line 82, name domain, value system_server\n\nTo:\nError: Reading file: \"/home/wcrobert/workspace/aosp/external/sepolicy/seapp_contexts\" line: 82 name: \"domain\" value: \"system_server\"\n\nChange-Id: Idf791d28fbba95fbeed8b9ccec9a296eea33afb9\nSigned-off-by: William Roberts \u003cwilliam.c.roberts@intel.com\u003e\n" }, { "commit": "25528cf4a5d2b037d4d51d6163bbde412b5bc33c", "tree": "27e12129e89d4e6107e83df489f379ab33f9c744", "parents": [ "3d8391e759fd3ffe70f10fc77e252fe71c902836" ], "author": { "name": "William Roberts", "email": "william.c.roberts@intel.com", "time": "Fri Jan 29 10:32:34 2016 -0800" }, "committer": { "name": "William Roberts", "email": "william.c.roberts@intel.com", "time": "Fri Jan 29 10:51:00 2016 -0800" }, "message": "checkseapp: declare internal function as static\n\nChange-Id: Ic4dc59650ca849b950cb145fedafdf4fc250f009\nSigned-off-by: William Roberts \u003cwilliam.c.roberts@intel.com\u003e\n" }, { "commit": "3d8391e759fd3ffe70f10fc77e252fe71c902836", "tree": "8099671b9276225a989d3fad0f713cb3735431b2", "parents": [ "61e9386030d67a14030d7191a19838ed7d06e076", "72e78bfcac1373a3440b04ba2d33792480e58a15" ], "author": { "name": "Jeffrey Vander Stoep", "email": "jeffv@google.com", "time": "Thu Jan 28 15:35:17 2016 +0000" }, "committer": { "name": "Gerrit Code Review", "email": "noreply-gerritcodereview@google.com", "time": "Thu Jan 28 15:35:17 2016 +0000" }, "message": "Merge \"mediaserver: grant perms from domain_deprecated\"" }, { "commit": "61e9386030d67a14030d7191a19838ed7d06e076", "tree": "a2fa35b5f0a0afc236cfac8dfe7c15b075dd50f4", "parents": [ "e48ab7848dac5fecfe64fcabeef786156eeae261", "2f3979a778d8fbe4e0a8ea0206fdaa823eb0aabd" ], "author": { "name": "Jeffrey Vander Stoep", "email": "jeffv@google.com", "time": "Thu Jan 28 15:34:28 2016 +0000" }, "committer": { "name": "Gerrit Code Review", "email": "noreply-gerritcodereview@google.com", "time": "Thu Jan 28 15:34:28 2016 +0000" }, "message": "Merge \"logd: grant perms from domain_deprecated\"" }, { "commit": "e48ab7848dac5fecfe64fcabeef786156eeae261", "tree": "366e32584ff63e21ec5a58cadbc7e0bccdb19bb2", "parents": [ "0e591bd256233add2c06c306bc17f5ebd71fe088", "bc2b76b06bc34d1f02e1a9d1a8a6a22bc3da5f04" ], "author": { "name": "Jeffrey Vander Stoep", "email": "jeffv@google.com", "time": "Thu Jan 28 15:34:06 2016 +0000" }, "committer": { "name": "Gerrit Code Review", "email": "noreply-gerritcodereview@google.com", "time": "Thu Jan 28 15:34:06 2016 +0000" }, "message": "Merge \"kernel: grant perms from domain_deprecated\"" }, { "commit": "72e78bfcac1373a3440b04ba2d33792480e58a15", "tree": "06563c6aa2e5a975c062fa1a701a0e77d390c690", "parents": [ "cdae042a07cda569f2366cb8f6b0b036f0a8c634" ], "author": { "name": "Jeff Vander Stoep", "email": "jeffv@google.com", "time": "Wed Jan 27 19:31:45 2016 -0800" }, "committer": { "name": "Jeff Vander Stoep", "email": "jeffv@google.com", "time": "Wed Jan 27 19:33:42 2016 -0800" }, "message": "mediaserver: grant perms from domain_deprecated\n\nIn preparation of removing permissions from domain_deprecated.\n\nAddresses:\navc: denied { getattr } for path\u003d\"/proc/self\" dev\u003d\"proc\" ino\u003d4026531841 scontext\u003du:r:mediaserver:s0 tcontext\u003du:object_r:proc:s0 tclass\u003dlnk_file permissive\u003d1\navc: denied { read } for name\u003d\"mediadrm\" dev\u003d\"mmcblk0p24\" ino\u003d209 scontext\u003du:r:mediaserver:s0 tcontext\u003du:object_r:system_file:s0 tclass\u003ddir permissive\u003d1\navc: denied { open } for path\u003d\"/vendor/lib/mediadrm\" dev\u003d\"mmcblk0p24\" ino\u003d209 scontext\u003du:r:mediaserver:s0 tcontext\u003du:object_r:system_file:s0 tclass\u003ddir permissive\u003d1\n\nChange-Id: Ibffa0c9a31316b9a2f1912ae68a8dcd3a4e671b7\n" }, { "commit": "2f3979a778d8fbe4e0a8ea0206fdaa823eb0aabd", "tree": "2f0666ef90398ea0845dae7bb6e8de0e91a4101d", "parents": [ "cdae042a07cda569f2366cb8f6b0b036f0a8c634" ], "author": { "name": "Jeff Vander Stoep", "email": "jeffv@google.com", "time": "Wed Jan 27 19:23:10 2016 -0800" }, "committer": { "name": "Jeff Vander Stoep", "email": "jeffv@google.com", "time": "Wed Jan 27 19:25:52 2016 -0800" }, "message": "logd: grant perms from domain_deprecated\n\nIn preparation of removing permissions from domain_deprecated.\n\nAddresses:\navc: denied { read } for name\u003d\"psched\" dev\u003d\"proc\" ino\u003d4026536519 scontext\u003du:r:logd:s0 tcontext\u003du:object_r:proc_net:s0 tclass\u003dfile permissive\u003d1\navc: denied { open } for path\u003d\"/proc/147/net/psched\" dev\u003d\"proc\" ino\u003d4026536519 scontext\u003du:r:logd:s0 tcontext\u003du:object_r:proc_net:s0 tclass\u003dfile permissive\u003d1\navc: denied { getattr } for path\u003d\"/proc/147/net/psched\" dev\u003d\"proc\" ino\u003d4026536519 scontext\u003du:r:logd:s0 tcontext\u003du:object_r:proc_net:s0 tclass\u003dfile permissive\u003d1\navc: denied { read } for name\u003d\"kmsg\" dev\u003d\"proc\" ino\u003d4026536603 scontext\u003du:r:logd:s0 tcontext\u003du:object_r:proc:s0 tclass\u003dfile permissive\u003d1\navc: denied { open } for path\u003d\"/proc/kmsg\" dev\u003d\"proc\" ino\u003d4026536603 scontext\u003du:r:logd:s0 tcontext\u003du:object_r:proc:s0 tclass\u003dfile permissive\u003d1\navc: denied { getattr } for path\u003d\"/proc/meminfo\" dev\u003d\"proc\" ino\u003d4026536598 scontext\u003du:r:logd:s0 tcontext\u003du:object_r:proc:s0 tclass\u003dfile permissive\u003d1\n\nChange-Id: Iaa67a6b8369c0449b09b64b807bc5819d6d68f02\n" }, { "commit": "bc2b76b06bc34d1f02e1a9d1a8a6a22bc3da5f04", "tree": "b6e744c852843aca1f8302985c99334a339a708c", "parents": [ "cdae042a07cda569f2366cb8f6b0b036f0a8c634" ], "author": { "name": "Jeff Vander Stoep", "email": "jeffv@google.com", "time": "Wed Jan 27 19:15:41 2016 -0800" }, "committer": { "name": "Jeff Vander Stoep", "email": "jeffv@google.com", "time": "Wed Jan 27 19:18:01 2016 -0800" }, "message": "kernel: grant perms from domain_deprecated\n\nIn preparation of removing permissions from domain_deprecated.\n\nAddresses:\navc: denied { read } for name\u003d\"enforce\" dev\u003d\"selinuxfs\" ino\u003d4 scontext\u003du:r:kernel:s0 tcontext\u003du:object_r:selinuxfs:s0 tclass\u003dfile permissive\u003d1\navc: denied { open } for path\u003d\"/sys/fs/selinux/enforce\" dev\u003d\"selinuxfs\" ino\u003d4 scontext\u003du:r:kernel:s0 tcontext\u003du:object_r:selinuxfs:s0 tclass\u003dfile permissive\u003d1\navc: denied { read } for name\u003d\"selinux_version\" dev\u003d\"rootfs\" ino\u003d4765 scontext\u003du:r:kernel:s0 tcontext\u003du:object_r:rootfs:s0 tclass\u003dfile permissive\u003d1\navc: denied { open } for path\u003d\"/selinux_version\" dev\u003d\"rootfs\" ino\u003d4765 scontext\u003du:r:kernel:s0 tcontext\u003du:object_r:rootfs:s0 tclass\u003dfile permissive\u003d1\navc: denied { getattr } for path\u003d\"/selinux_version\" dev\u003d\"rootfs\" ino\u003d4765 scontext\u003du:r:kernel:s0 tcontext\u003du:object_r:rootfs:s0 tclass\u003dfile permissive\u003d1\n\nChange-Id: I62cbffe85941677283d3b7bf8fc1c437671569a3\n" }, { "commit": "0e591bd256233add2c06c306bc17f5ebd71fe088", "tree": "fd0701cff016a52f8af901bbec432bd9c6695614", "parents": [ "1cf93217fa578b3439b37b7f5a3b5045a97ec5d4" ], "author": { "name": "dcashman", "email": "dcashman@google.com", "time": "Wed Jan 27 15:46:44 2016 -0800" }, "committer": { "name": "dcashman", "email": "dcashman@google.com", "time": "Wed Jan 27 15:49:11 2016 -0800" }, "message": "Allow apps to check attrs of /cache\n\nAddress the following denial:\ntype\u003d1400 audit(0.0:261): avc: denied { getattr } for path\u003d\"/cache\" dev\u003d\"mmcblk0p27\" ino\u003d2 scontext\u003du:r:untrusted_app:s0:c512,c768 tcontext\u003du:object_r:cache_file:s0 tclass\u003ddir permissive\u003d0\n\nBug: 26823157\nChange-Id: I937046969e92d96f2d31feceddd9ebe7c59bd3e6\n" }, { "commit": "1cf93217fa578b3439b37b7f5a3b5045a97ec5d4", "tree": "bbc534500115a5aba3e3be01fdfb562e1d81eeea", "parents": [ "f33507dfc588692e01fac148d6f151f2dbac8b04", "9306072c97db7aadda86baf1eb402d7e36baf6fc" ], "author": { "name": "Jeffrey Vander Stoep", "email": "jeffv@google.com", "time": "Wed Jan 27 23:44:48 2016 +0000" }, "committer": { "name": "Gerrit Code Review", "email": "noreply-gerritcodereview@google.com", "time": "Wed Jan 27 23:44:48 2016 +0000" }, "message": "Merge \"vold: grant perms from domain_deprecated\"" }, { "commit": "f33507dfc588692e01fac148d6f151f2dbac8b04", "tree": "f1d3b31faf801b94741d21bb5705d066ef075316", "parents": [ "fea9ad7c290f54b601934ae585efef8ffcdc08ca", "12401b8d1833de33dba29eb0839259be9d0596a5" ], "author": { "name": "Jeffrey Vander Stoep", "email": "jeffv@google.com", "time": "Wed Jan 27 20:47:31 2016 +0000" }, "committer": { "name": "Gerrit Code Review", "email": "noreply-gerritcodereview@google.com", "time": "Wed Jan 27 20:47:31 2016 +0000" }, "message": "Merge \"healthd: grant perms from domain_deprecated\"" }, { "commit": "fea9ad7c290f54b601934ae585efef8ffcdc08ca", "tree": "b3d6897392d0707c10e52f8fe9d063942bf49395", "parents": [ "eecaa0b5f9d83bb86b66d5ad7feacb5c4d6d83f7", "001b10bdff87474ff1b3b246ea2f92baec3515cd" ], "author": { "name": "Daniel Cashman", "email": "dcashman@google.com", "time": "Wed Jan 27 20:46:44 2016 +0000" }, "committer": { "name": "Gerrit Code Review", "email": "noreply-gerritcodereview@google.com", "time": "Wed Jan 27 20:46:44 2016 +0000" }, "message": "Merge \"remove access_kmsg macro, because it to be more explicit.\"" }, { "commit": "eecaa0b5f9d83bb86b66d5ad7feacb5c4d6d83f7", "tree": "8d9561013d1aafc9c03a9c522061f65101bf75bd", "parents": [ "db559a348ed23f3cc2a214de456524129c048d66", "cee6a0e748d39a5d94ab56c20ffb6669423696fc" ], "author": { "name": "Jeffrey Vander Stoep", "email": "jeffv@google.com", "time": "Wed Jan 27 20:35:12 2016 +0000" }, "committer": { "name": "Gerrit Code Review", "email": "noreply-gerritcodereview@google.com", "time": "Wed Jan 27 20:35:12 2016 +0000" }, "message": "Merge \"zygote: grant perms from domain_deprecated\"" }, { "commit": "9306072c97db7aadda86baf1eb402d7e36baf6fc", "tree": "74a2f8f7e3becb66bc0bdb53e4f6b423425265db", "parents": [ "cdae042a07cda569f2366cb8f6b0b036f0a8c634" ], "author": { "name": "Jeff Vander Stoep", "email": "jeffv@google.com", "time": "Wed Jan 27 12:24:26 2016 -0800" }, "committer": { "name": "Jeff Vander Stoep", "email": "jeffv@google.com", "time": "Wed Jan 27 12:24:26 2016 -0800" }, "message": "vold: grant perms from domain_deprecated\n\nIn preparation of removing permissions from domain_deprecated.\n\nAddresses:\navc: denied { read } for name\u003d\"fstab.flounder\" dev\u003d\"rootfs\" ino\u003d4729 scontext\u003du:r:vold:s0 tcontext\u003du:object_r:rootfs:s0 tclass\u003dfile\navc: denied { open } for path\u003d\"/fstab.flounder\" dev\u003d\"rootfs\" ino\u003d4729 scontext\u003du:r:vold:s0 tcontext\u003du:object_r:rootfs:s0 tclass\u003dfile\navc: denied { getattr } for path\u003d\"/fstab.flounder\" dev\u003d\"rootfs\" ino\u003d4729 scontext\u003du:r:vold:s0 tcontext\u003du:object_r:rootfs:s0 tclass\u003dfile\n\navc: denied { read } for name\u003d\"/\" dev\u003d\"mmcblk0p30\" ino\u003d2 scontext\u003du:r:vold:s0 tcontext\u003du:object_r:cache_file:s0 tclass\u003ddir\navc: denied { open } for path\u003d\"/cache\" dev\u003d\"mmcblk0p30\" ino\u003d2 scontext\u003du:r:vold:s0 tcontext\u003du:object_r:cache_file:s0 tclass\u003ddir\navc: denied { ioctl } for path\u003d\"/cache\" dev\u003d\"mmcblk0p30\" ino\u003d2 ioctlcmd\u003d5879 scontext\u003du:r:vold:s0 tcontext\u003du:object_r:cache_file:s0 tclass\u003ddir\n\navc: denied { read } for name\u003d\"/\" dev\u003d\"proc\" ino\u003d1 scontext\u003du:r:vold:s0 tcontext\u003du:object_r:proc:s0 tclass\u003ddir\navc: denied { open } for path\u003d\"/proc\" dev\u003d\"proc\" ino\u003d1 scontext\u003du:r:vold:s0 tcontext\u003du:object_r:proc:s0 tclass\u003ddir\n\navc: denied { read } for name\u003d\"psched\" dev\u003d\"proc\" ino\u003d4026536519 scontext\u003du:r:vold:s0 tcontext\u003du:object_r:proc_net:s0 tclass\u003dfile\navc: denied { open } for path\u003d\"/proc/157/net/psched\" dev\u003d\"proc\" ino\u003d4026536519 scontext\u003du:r:vold:s0 tcontext\u003du:object_r:proc_net:s0 tclass\u003dfile\navc: denied { getattr } for path\u003d\"/proc/157/net/psched\" dev\u003d\"proc\" ino\u003d4026536519 scontext\u003du:r:vold:s0 tcontext\u003du:object_r:proc_net:s0 tclass\u003dfile\n\nChange-Id: I8af7edc5b06675a9a2d62bf86e1c22dbb5d74370\navc: denied { read } for name\u003d\"block\" dev\u003d\"sysfs\" ino\u003d2582 scontext\u003du:r:vold:s0 tcontext\u003du:object_r:sysfs:s0 tclass\u003ddir\navc: denied { open } for path\u003d\"/sys/block\" dev\u003d\"sysfs\" ino\u003d2582 scontext\u003du:r:vold:s0 tcontext\u003du:object_r:sysfs:s0 tclass\u003ddir\n" }, { "commit": "12401b8d1833de33dba29eb0839259be9d0596a5", "tree": "b05deb563ad7a37cafe54b9bb2f37a67c67850f9", "parents": [ "cdae042a07cda569f2366cb8f6b0b036f0a8c634" ], "author": { "name": "Jeff Vander Stoep", "email": "jeffv@google.com", "time": "Wed Jan 27 11:19:34 2016 -0800" }, "committer": { "name": "Jeff Vander Stoep", "email": "jeffv@google.com", "time": "Wed Jan 27 11:20:52 2016 -0800" }, "message": "healthd: grant perms from domain_deprecated\n\nIn preparation of removing permissions from domain_deprecated.\n\nAddresses:\navc: denied { read } for name\u003d\"present\" dev\u003d\"sysfs\" ino\u003d5003 scontext\u003du:r:healthd:s0 tcontext\u003du:object_r:sysfs:s0 tclass\u003dfile\navc: denied { open } for path\u003d\"/sys/devices/platform/htc_battery_max17050.8/power_supply/flounder-battery/present\" dev\u003d\"sysfs\" ino\u003d5003 scontext\u003du:r:healthd:s0 tcontext\u003du:object_r:sysfs:s0 tclass\u003dfile\n\nChange-Id: Iaee5b79a45aedad98e08c670addbf444c984165e\n" }, { "commit": "cee6a0e748d39a5d94ab56c20ffb6669423696fc", "tree": "327379908281ee36c2d0b20ea7c0527812d3c810", "parents": [ "cdae042a07cda569f2366cb8f6b0b036f0a8c634" ], "author": { "name": "Jeff Vander Stoep", "email": "jeffv@google.com", "time": "Wed Jan 27 10:54:16 2016 -0800" }, "committer": { "name": "Jeff Vander Stoep", "email": "jeffv@google.com", "time": "Wed Jan 27 10:55:03 2016 -0800" }, "message": "zygote: grant perms from domain_deprecated\n\nIn preparation of removing permissions from domain_deprecated.\n\nAddresses:\navc: denied { read } for name\u003d\"ipv6_route\" dev\u003d\"proc\" ino\u003d4026536875 scontext\u003du:r:zygote:s0 tcontext\u003du:object_r:proc_net:s0 tclass\u003dfile\navc: denied { open } for path\u003d\"/proc/220/net/ipv6_route\" dev\u003d\"proc\" ino\u003d4026536875 scontext\u003du:r:zygote:s0 tcontext\u003du:object_r:proc_net:s0 tclass\u003dfile\navc: denied { getattr } for path\u003d\"/proc/220/net/ipv6_route\" dev\u003d\"proc\" ino\u003d4026536875 scontext\u003du:r:zygote:s0 tcontext\u003du:object_r:proc_net:s0 tclass\u003dfile\n\nChange-Id: Ie94d3db3c5dccb8077ef5da26221a6413f5d19c2\n" }, { "commit": "db559a348ed23f3cc2a214de456524129c048d66", "tree": "1ce4475ca6cc7165edeb3ea41856660b0fe3637b", "parents": [ "98f60e5c742d32ed878ca420636cd86d4bf64272" ], "author": { "name": "dcashman", "email": "dcashman@google.com", "time": "Wed Jan 27 07:24:34 2016 -0800" }, "committer": { "name": "dcashman", "email": "dcashman@google.com", "time": "Wed Jan 27 10:42:54 2016 -0800" }, "message": "Allow sdcardd tmpfs read access.\n\nAddress the following denial:\ntype\u003d1400 audit(1453854842.899:7): avc: denied { search } for pid\u003d1512 comm\u003d\"sdcard\" name\u003d\"/\" dev\u003d\"tmpfs\" ino\u003d7547 scontext\u003du:r:sdcardd:s0 tcontext\u003du:object_r:tmpfs:s0 tclass\u003ddir permissive\u003d0\n\nvold: EmulatedVolume calls sdcard to mount on /storage/emulated.\n\nBug: 26807309\nChange-Id: Ifdd7c356589f95165bba489dd06282a4087e9aee\n" }, { "commit": "98f60e5c742d32ed878ca420636cd86d4bf64272", "tree": "3ed5e9a5e462d5b22f65e2c4b7a251a6031e915a", "parents": [ "4115beae6375b3b7c1cb777d342e0e7cd6028995", "b898360e27a3c335794176ddbbea7c2726ff1cee" ], "author": { "name": "Jeffrey Vander Stoep", "email": "jeffv@google.com", "time": "Wed Jan 27 18:39:42 2016 +0000" }, "committer": { "name": "Gerrit Code Review", "email": "noreply-gerritcodereview@google.com", "time": "Wed Jan 27 18:39:42 2016 +0000" }, "message": "Merge \"Revert \"zygote: grant perms from domain_deprecated\"\"" }, { "commit": "b898360e27a3c335794176ddbbea7c2726ff1cee", "tree": "fb1b47aa6a1b3af42f61b3f1f394df1ab086c546", "parents": [ "e52fff83a10648b4257b9390cdb51803bccf4009" ], "author": { "name": "Jeffrey Vander Stoep", "email": "jeffv@google.com", "time": "Wed Jan 27 18:39:28 2016 +0000" }, "committer": { "name": "Jeffrey Vander Stoep", "email": "jeffv@google.com", "time": "Wed Jan 27 18:39:28 2016 +0000" }, "message": "Revert \"zygote: grant perms from domain_deprecated\"\n\nThis reverts commit e52fff83a10648b4257b9390cdb51803bccf4009.\n\nChange-Id: Ieafb5214940585d63ff6f0b4802d8c7d1c126174\n" }, { "commit": "4115beae6375b3b7c1cb777d342e0e7cd6028995", "tree": "bfbc7a3b936a3156a9c0eeb4cb7dc15f33bad728", "parents": [ "c4121add28c75ab12d634d2aa7570417ebb4e043", "e52fff83a10648b4257b9390cdb51803bccf4009" ], "author": { "name": "Jeffrey Vander Stoep", "email": "jeffv@google.com", "time": "Wed Jan 27 18:08:01 2016 +0000" }, "committer": { "name": "Gerrit Code Review", "email": "noreply-gerritcodereview@google.com", "time": "Wed Jan 27 18:08:01 2016 +0000" }, "message": "Merge \"zygote: grant perms from domain_deprecated\"" }, { "commit": "e52fff83a10648b4257b9390cdb51803bccf4009", "tree": "395afdbee0f33b9568ad1b4ec625061f093f9a83", "parents": [ "cdae042a07cda569f2366cb8f6b0b036f0a8c634" ], "author": { "name": "Jeff Vander Stoep", "email": "jeffv@google.com", "time": "Wed Jan 27 09:54:06 2016 -0800" }, "committer": { "name": "Jeff Vander Stoep", "email": "jeffv@google.com", "time": "Wed Jan 27 09:57:25 2016 -0800" }, "message": "zygote: grant perms from domain_deprecated\n\nIn preparation of removing permissions from domain_deprecated.\n\nAddresses:\navc: denied { read } for name\u003d\"ipv6_route\" dev\u003d\"proc\" ino\u003d4026536875 scontext\u003du:r:zygote:s0 tcontext\u003du:object_r:proc_net:s0 tclass\u003dfile\navc: denied { open } for path\u003d\"/proc/220/net/ipv6_route\" dev\u003d\"proc\" ino\u003d4026536875 scontext\u003du:r:zygote:s0 tcontext\u003du:object_r:proc_net:s0 tclass\u003dfile\navc: denied { getattr } for path\u003d\"/proc/220/net/ipv6_route\" dev\u003d\"proc\" ino\u003d4026536875 scontext\u003du:r:zygote:s0 tcontext\u003du:object_r:proc_net:s0 tclass\u003dfile\n\nChange-Id: I5b505ad386a445113bc0a1bb35d4f88f7761c048\n" }, { "commit": "9a28f90d6a36d3627ff525a6f3ac160039b27b5e", "tree": "39c776a78079d32a1cd6367698519478d99d9cc7", "parents": [ "be0616baf0c0caf8e1c8a4fdc9b488839f6af27d" ], "author": { "name": "Sylvain Chouleur", "email": "sylvain.chouleur@intel.com", "time": "Wed Jan 27 16:27:23 2016 +0100" }, "committer": { "name": "Sylvain Chouleur", "email": "sylvain.chouleur@intel.com", "time": "Wed Jan 27 16:42:31 2016 +0100" }, "message": "init: allow to access console-ramoops with newer kernels\n\nSince linux 3.18, commit 68c4a4f8abc60c9440ede9cd123d48b78325f7a3 has\nbeen integrated and requires syslog_read capability a process accessing\nconsole-ramoops file.\n\nsepolicy must be adapted to this new requirement.\n\nChange-Id: Ib4032a6bd96b1828a0154edc8fb510e3c1d3bdc2\nSigned-off-by: Sylvain Chouleur \u003csylvain.chouleur@intel.com\u003e\n" }, { "commit": "c4121add28c75ab12d634d2aa7570417ebb4e043", "tree": "3ed5e9a5e462d5b22f65e2c4b7a251a6031e915a", "parents": [ "be0616baf0c0caf8e1c8a4fdc9b488839f6af27d", "f4d7eef731a14317be48b1c6bfd44e8220770f51" ], "author": { "name": "Narayan Kamath", "email": "narayan@google.com", "time": "Wed Jan 27 15:39:28 2016 +0000" }, "committer": { "name": "Gerrit Code Review", "email": "noreply-gerritcodereview@google.com", "time": "Wed Jan 27 15:39:28 2016 +0000" }, "message": "Merge \"Revert \"Remove domain_deprecated from sdcard domains\"\"" }, { "commit": "f4d7eef731a14317be48b1c6bfd44e8220770f51", "tree": "6c9ecb47bd864326d81705066a23850934ae927e", "parents": [ "0c7bc58e91eeda73e24f13735c0205fd3f88f91a" ], "author": { "name": "Narayan Kamath", "email": "narayan@google.com", "time": "Wed Jan 27 15:32:47 2016 +0000" }, "committer": { "name": "Narayan Kamath", "email": "narayan@google.com", "time": "Wed Jan 27 15:39:05 2016 +0000" }, "message": "Revert \"Remove domain_deprecated from sdcard domains\"\n\nThis reverts commit 0c7bc58e91eeda73e24f13735c0205fd3f88f91a.\n\nbug: 26807309\n\nChange-Id: I8a7b0e56a0d6f723508d0fddceffdff76eb0459a\n" }, { "commit": "be0616baf0c0caf8e1c8a4fdc9b488839f6af27d", "tree": "95d3830eaa9cd70c11517b92a6608e47b66ee528", "parents": [ "5833e3f5ca04e88629e3bd76331fa0ab42d568f4" ], "author": { "name": "Jeff Vander Stoep", "email": "jeffv@google.com", "time": "Tue Jan 26 18:56:52 2016 -0800" }, "committer": { "name": "Jeffrey Vander Stoep", "email": "jeffv@google.com", "time": "Wed Jan 27 03:00:50 2016 +0000" }, "message": "domain: grant write perms to cgroups\n\nWas moved to domain_deprecated. Move back to domain.\n\nFiles in /acct/uid/*/tasks are well protected by unix permissions.\nNo information is leaked with write perms.\n\nChange-Id: I8017e906950cba41ce350bc0892a36269ade8d53\n" }, { "commit": "5833e3f5ca04e88629e3bd76331fa0ab42d568f4", "tree": "9ccb1f12d4fca9ec8ac7a2ddc82581dfa84cb946", "parents": [ "093ea6fb9a284acbce10641f8743de24abd70734" ], "author": { "name": "dcashman", "email": "dcashman@google.com", "time": "Tue Jan 26 16:56:24 2016 -0800" }, "committer": { "name": "dcashman", "email": "dcashman@google.com", "time": "Tue Jan 26 16:56:24 2016 -0800" }, "message": "Restore untrusted_app proc_net access.\n\nAddress the following denial:\ntype\u003d1400 audit(0.0:853): avc: denied { read } for name\u003d\"/\" dev\u003d\"proc\" ino\u003d1 scontext\u003du:r:untrusted_app:s0:c512,c768 tcontext\u003du:object_r:proc:s0 tclass\u003ddir permissive\u003d0\n\nBug: 26806629\nChange-Id: Ic2ad91aadac00dc04d7e04f7460d5681d81134f4\n" }, { "commit": "001b10bdff87474ff1b3b246ea2f92baec3515cd", "tree": "c6323e4c60b478808e7a8ed2f363339e8c8e17f9", "parents": [ "cdae042a07cda569f2366cb8f6b0b036f0a8c634" ], "author": { "name": "SimHyunYong", "email": "jonesn5508@gmail.com", "time": "Tue Jan 26 16:42:54 2016 +0900" }, "committer": { "name": "SimHyunYong", "email": "jonesn5508@gmail.com", "time": "Wed Jan 27 08:56:30 2016 +0900" }, "message": "remove access_kmsg macro, because it to be more explicit.\n\nThis macro does not give us anything to it.\n\nChange-Id: Ie0b56716cc0144f0a59849647cad31e06a25acf1\n" }, { "commit": "093ea6fb9a284acbce10641f8743de24abd70734", "tree": "ec8b4a09740e31eac1218c1a76a65b5dfc072889", "parents": [ "cdae042a07cda569f2366cb8f6b0b036f0a8c634" ], "author": { "name": "SimHyunYong", "email": "jonesn5508@gmail.com", "time": "Tue Jan 26 16:22:12 2016 +0900" }, "committer": { "name": "SimHyunYong", "email": "jonesn5508@gmail.com", "time": "Wed Jan 27 07:54:47 2016 +0900" }, "message": "Using r_dir_file macro in domain.te\n\nr_dir_file(domain, self)\n\nallow domain self:dir r_dir_perms;\nallow domain self:lnk_file r_file_perms;\nallow domain self:file r_file_perms;\n\nte_macros\ndefine(`r_dir_file\u0027, `\nallow $1 $2:dir r_dir_perms;\nallow $1 $2:{ file lnk_file } r_file_perms;\n\u0027)\n\nChange-Id: I7338f63a1eaa8ca52cd31b51ce841e3dbe46ad4f\n" }, { "commit": "cdae042a07cda569f2366cb8f6b0b036f0a8c634", "tree": "fb1b47aa6a1b3af42f61b3f1f394df1ab086c546", "parents": [ "ae29dea8b7580478bd18f4354adeff38b1de1476", "0c7bc58e91eeda73e24f13735c0205fd3f88f91a" ], "author": { "name": "Jeffrey Vander Stoep", "email": "jeffv@google.com", "time": "Tue Jan 26 22:44:14 2016 +0000" }, "committer": { "name": "Gerrit Code Review", "email": "noreply-gerritcodereview@google.com", "time": "Tue Jan 26 22:44:14 2016 +0000" }, "message": "Merge \"Remove domain_deprecated from sdcard domains\"" }, { "commit": "ae29dea8b7580478bd18f4354adeff38b1de1476", "tree": "a5e42b6df74cb51654a20811add2ce262d558d4a", "parents": [ "7171232c02d27e777ad2267f1a8b5246b3aabc8d", "2e8d71c3bec6cbe2baba0bbd4105e76737756339" ], "author": { "name": "James Hawkins", "email": "jhawkins@google.com", "time": "Tue Jan 26 21:26:37 2016 +0000" }, "committer": { "name": "Gerrit Code Review", "email": "noreply-gerritcodereview@google.com", "time": "Tue Jan 26 21:26:37 2016 +0000" }, "message": "Merge \"bootstat: Fix the SELinux policy after removing domain_deprecated.\"" }, { "commit": "2e8d71c3bec6cbe2baba0bbd4105e76737756339", "tree": "eea450eb8d365f3938e3d7cd8df9508baa61efe4", "parents": [ "2fdeab3789ec6e5ec6f7424abf41a9aaa73564b0" ], "author": { "name": "James Hawkins", "email": "jhawkins@google.com", "time": "Mon Jan 25 16:23:10 2016 -0800" }, "committer": { "name": "James Hawkins", "email": "jhawkins@google.com", "time": "Tue Jan 26 18:52:58 2016 +0000" }, "message": "bootstat: Fix the SELinux policy after removing domain_deprecated.\n\n* Allow reading /proc.\n\ntype\u003d1400 audit(1453834004.239:7): avc: denied { read } for pid\u003d1305\ncomm\u003d\"bootstat\" name\u003d\"uptime\" dev\u003d\"proc\" ino\u003d4026536600\nscontext\u003du:r:bootstat:s0 tcontext\u003du:object_r:proc:s0 tclass\u003dfile\npermissive\u003d0\n\n* Define domain for the /system/bin/bootstat file.\n\ninit: Service exec 4 (/system/bin/bootstat) does not have a SELinux\ndomain defined.\n\nBug: 21724738\nChange-Id: I4baa2fa7466ac35a1ced79776943c07635ec9804\n" }, { "commit": "7171232c02d27e777ad2267f1a8b5246b3aabc8d", "tree": "d4339e140588f404416a8dbcc1614d7dcfc6e66a", "parents": [ "0220b345b39fa7781e3a352ecf84f45bc29016ab" ], "author": { "name": "SimHyunYong", "email": "jonesn5508@gmail.com", "time": "Tue Jan 26 16:33:44 2016 +0900" }, "committer": { "name": "SimHyunYong", "email": "jonesn5508@gmail.com", "time": "Tue Jan 26 16:33:44 2016 +0900" }, "message": "Delete policy it is alread included in binder_call macros.\n\ndefine(`binder_call\u0027, `\nallow $1 $2:binder { call transfer };\nallow $2 $1:binder transfer;\nallow $1 $2:fd use;\n\u0027)\n\nbinder_call(surfaceflinger, appdomain)\nbinder_call(surfaceflinger, bootanim)\n\nit is alread include these policy.. so I can delete these policy!\nallow surfaceflinger appdomain:fd use;\nallow surfaceflinger bootanim:fd use;\n" }, { "commit": "0220b345b39fa7781e3a352ecf84f45bc29016ab", "tree": "ce754cefd3b2cf8fe05c3b795a686e39d313cfa4", "parents": [ "6899e0a38b14047f561493e87341b72dfbf3fe8a", "5ba9af23908b839a9a1a65c53af7f715b9abf172" ], "author": { "name": "Jeffrey Vander Stoep", "email": "jeffv@google.com", "time": "Tue Jan 26 06:17:32 2016 +0000" }, "committer": { "name": "Gerrit Code Review", "email": "noreply-gerritcodereview@google.com", "time": "Tue Jan 26 06:17:32 2016 +0000" }, "message": "Merge \"Delete duplicated policy, it is already include in app.te.\"" }, { "commit": "6899e0a38b14047f561493e87341b72dfbf3fe8a", "tree": "968ef2585f7ddbe0263f4bb07bbb673f6a81c31c", "parents": [ "b037a6c94b357c9a85d13dde548f5799c592c6ac", "dce317cf43e458e85ca94d6488beb865f13f4868" ], "author": { "name": "Tao Bao", "email": "tbao@google.com", "time": "Tue Jan 26 04:33:51 2016 +0000" }, "committer": { "name": "Gerrit Code Review", "email": "noreply-gerritcodereview@google.com", "time": "Tue Jan 26 04:33:51 2016 +0000" }, "message": "Merge \"Allow update_engine to use Binder IPC.\"" }, { "commit": "5ba9af23908b839a9a1a65c53af7f715b9abf172", "tree": "6b8673e171eeaca583bea81c43b901b96d638740", "parents": [ "b037a6c94b357c9a85d13dde548f5799c592c6ac" ], "author": { "name": "SimHyunYong", "email": "jonesn5508@gmail.com", "time": "Tue Jan 26 11:13:29 2016 +0900" }, "committer": { "name": "SimHyunYong", "email": "jonesn5508@gmail.com", "time": "Tue Jan 26 11:13:29 2016 +0900" }, "message": "Delete duplicated policy, it is already include in app.te.\n\nallow appdomain keychain_data_file:dir r_dir_perms;\nallow appdomain keychain_data_file:file r_file_perms;\n" }, { "commit": "dce317cf43e458e85ca94d6488beb865f13f4868", "tree": "5ce30b5af6fa2bc33f47bdb8aa648dcef6a3be87", "parents": [ "2fdeab3789ec6e5ec6f7424abf41a9aaa73564b0" ], "author": { "name": "Tao Bao", "email": "tbao@google.com", "time": "Mon Jan 25 16:41:03 2016 -0800" }, "committer": { "name": "Tao Bao", "email": "tbao@google.com", "time": "Mon Jan 25 16:42:38 2016 -0800" }, "message": "Allow update_engine to use Binder IPC.\n\nRegister service with servicemanager and name the context.\n\navc: denied { call } for scontext\u003du:r:update_engine:s0 tcontext\u003du:r:servicemanager:s0 tclass\u003dbinder\navc: denied { add } for service\u003dandroid.os.IUpdateEngine scontext\u003du:r:update_engine:s0 tcontext\u003du:object_r:update_engine_service:s0 tclass\u003dservice_manager\n\nAlso allow priv_app to communicate with update_engine.\n\navc: denied { find } for service\u003dandroid.os.IUpdateEngine scontext\u003du:r:priv_app:s0:c512,c768 tcontext\u003du:object_r:update_engine_service:s0 tclass\u003dservice_manager\navc: denied { call } for scontext\u003du:r:priv_app:s0:c512,c768 tcontext\u003du:r:update_engine:s0 tclass\u003dbinder\navc: denied { call } for scontext\u003du:r:update_engine:s0 tcontext\u003du:r:priv_app:s0 tclass\u003dbinder\n\nChange-Id: Ib4498717c1a72f5faab5ea04c636924ee4eb412c\n" } ], "next": "b037a6c94b357c9a85d13dde548f5799c592c6ac" }