Skip to content
Snippets Groups Projects
  1. Dec 08, 2016
    • dcashman's avatar
      Restore app_domain macro and move to private use. · 76035ea0
      dcashman authored
      app_domain was split up in commit: 2e00e637 to
      enable compilation by hiding type_transition rules from public policy.  These
      rules need to be hidden from public policy because they describe how objects are
      labeled, of which non-platform should be unaware.  Instead of cutting apart the
      app_domain macro, which non-platform policy may rely on for implementing new app
      types, move all app_domain calls to private policy.
      
      Bug: 33428593
      Test: bullhead and sailfish both boot. sediff shows no policy change.
      Change-Id: I4beead8ccc9b6e13c6348da98bb575756f539665
      76035ea0
  2. Dec 06, 2016
    • dcashman's avatar
      sepolicy: add version_policy tool and version non-platform policy. · 2e00e637
      dcashman authored
      In order to support platform changes without simultaneous updates from
      non-platform components, the platform and non-platform policies must be
      split.  In order to provide a guarantee that policy written for
      non-platform objects continues to provide the same access, all types
      exposed to non-platform policy are versioned by converting them and the
      policy using them into attributes.
      
      This change performs that split, the subsequent versioning and also
      generates a mapping file to glue the different policy components
      together.
      
      Test: Device boots and runs.
      Bug: 31369363
      Change-Id: Ibfd3eb077bd9b8e2ff3b2e6a0ca87e44d78b1317
      2e00e637
  3. Oct 06, 2016
    • dcashman's avatar
      Split general policy into public and private components. · cc39f637
      dcashman authored
      Divide policy into public and private components.  This is the first
      step in splitting the policy creation for platform and non-platform
      policies.  The policy in the public directory will be exported for use
      in non-platform policy creation.  Backwards compatibility with it will
      be achieved by converting the exported policy into attribute-based
      policy when included as part of the non-platform policy and a mapping
      file will be maintained to be included with the platform policy that
      maps exported attributes of previous versions to the current platform
      version.
      
      Eventually we would like to create a clear interface between the
      platform and non-platform device components so that the exported policy,
      and the need for attributes is minimal.  For now, almost all types and
      avrules are left in public.
      
      Test: Tested by building policy and running on device.
      
      Change-Id: Idef796c9ec169259787c3f9d8f423edf4ce27f8c
      cc39f637
Loading