Skip to content
Snippets Groups Projects
  1. Mar 24, 2017
    • Alex Klyubin's avatar
      Vendor domains must not use Binder · f5446eb1
      Alex Klyubin authored
      On PRODUCT_FULL_TREBLE devices, non-vendor domains (except vendor
      apps) are not permitted to use Binder. This commit thus:
      * groups non-vendor domains using the new "coredomain" attribute,
      * adds neverallow rules restricting Binder use to coredomain and
        appdomain only, and
      * temporarily exempts the domains which are currently violating this
        rule from this restriction. These domains are grouped using the new
        "binder_in_vendor_violators" attribute. The attribute is needed
        because the types corresponding to violators are not exposed to the
        public policy where the neverallow rules are.
      
      Test: mmm system/sepolicy
      Test: Device boots, no new denials
      Test: In Chrome, navigate to ip6.me, play a YouTube video
      Test: YouTube: play a video
      Test: Netflix: play a movie
      Test: Google Camera: take a photo, take an HDR+ photo, record video with
            sound, record slow motion video with sound. Confirm videos play
            back fine and with sound.
      Bug: 35870313
      Change-Id: I0cd1a80b60bcbde358ce0f7a47b90f4435a45c95
      f5446eb1
  2. Jan 31, 2017
    • Mark Salyzyn's avatar
      logd: add getEventTag command and service · 384ce662
      Mark Salyzyn authored
      The event log tag service uses /dev/event-log-tags, pstore and
      /data/misc/logd/event-log-tags as sticky storage for the invented
      log tags.
      
      Test: gTest liblog-unit-tests, logd-unit-tests & logcat-unit-tests
      Bug: 31456426
      Change-Id: Iacc8f36f4a716d4da8dca78a4a54600ad2a288dd
      384ce662
    • Mark Salyzyn's avatar
      logd: restrict access to /dev/event-log-tags · d33a9a19
      Mark Salyzyn authored
      Create an event_log_tags_file label and use it for
      /dev/event-log-tags.  Only trusted system log readers are allowed
      direct read access to this file, no write access.  Untrusted domain
      requests lack direct access, and are thus checked for credentials via
      the "plan b" long path socket to the event log tag service.
      
      Test: gTest logd-unit-tests, liblog-unit-tests and logcat-unit-tests
      Bug: 31456426
      Bug: 30566487
      Change-Id: Ib9b71ca225d4436d764c9bc340ff7b1c9c252a9e
      d33a9a19
  3. Dec 20, 2016
    • Mark Salyzyn's avatar
      logcat: introduce split to logd and logpersist domains · da62cb4d
      Mark Salyzyn authored
      - transition to logpersist from init
      - sort some overlapping negative references
      - intention is to allow logpersist to be used by vendor
        userdebug logging
      
      Test: gTest liblog-unit-tests, logd-unit-tests & logcat-unit-tests
      Bug: 30566487
      Change-Id: I7806f5a2548cbe0c1f257a0ba2855f2eb69d8e7c
      da62cb4d
Loading