Home | History | Annotate | only in /system/sepolicy
Up to higher level directory
NameDateSize
access_vectors06-Dec-20166.6K
adbd.te06-Dec-20163.8K
Android.mk06-Dec-201617.7K
app.te06-Dec-201616.9K
atrace.te06-Dec-2016701
attributes06-Dec-20163.3K
audioserver.te06-Dec-20161.9K
autoplay_app.te06-Dec-20163.9K
binderservicedomain.te06-Dec-2016970
blkid.te06-Dec-2016708
blkid_untrusted.te06-Dec-20161.1K
bluetooth.te06-Dec-20162.6K
bluetoothdomain.te06-Dec-2016167
boot_control_hal.te06-Dec-2016130
bootanim.te06-Dec-2016970
bootstat.te06-Dec-2016359
cameraserver.te06-Dec-20161.4K
clatd.te06-Dec-20161.3K
CleanSpec.mk06-Dec-20162.3K
cppreopts.te06-Dec-20161K
debuggerd.te06-Dec-20161.7K
device.te06-Dec-20163.2K
dex2oat.te06-Dec-20161.7K
dhcp.te06-Dec-20161.2K
dnsmasq.te06-Dec-2016936
domain.te06-Dec-201620.5K
domain_deprecated.te06-Dec-20162.8K
drmserver.te06-Dec-20161.9K
dumpstate.te06-Dec-20165.7K
file.te06-Dec-201610.3K
file_contexts06-Dec-201617.7K
file_contexts_asan06-Dec-2016228
fingerprintd.te06-Dec-2016758
fs_use06-Dec-2016865
fsck.te06-Dec-20161.4K
fsck_untrusted.te06-Dec-20161.1K
gatekeeperd.te06-Dec-20161,003
genfs_contexts06-Dec-20162.3K
global_macros06-Dec-20162.7K
gpsd.te06-Dec-2016992
hci_attach.te06-Dec-2016332
healthd.te06-Dec-20161.6K
hostapd.te06-Dec-20161.2K
idmap.te06-Dec-2016394
init.te06-Dec-201611.6K
initial_sid_contexts06-Dec-2016973
initial_sids06-Dec-2016416
inputflinger.te06-Dec-2016441
install_recovery.te06-Dec-20161.2K
installd.te06-Dec-20165.1K
ioctl_defines06-Dec-2016111.6K
ioctl_macros06-Dec-20162.9K
isolated_app.te06-Dec-20163K
kernel.te06-Dec-20163.5K
keys.conf06-Dec-2016851
keystore.te06-Dec-20161.1K
lmkd.te06-Dec-20161.1K
logd.te06-Dec-20162.2K
mac_permissions.xml06-Dec-20161.8K
mdnsd.te06-Dec-2016188
mediacodec.te06-Dec-2016967
mediadrmserver.te06-Dec-20162.3K
mediaextractor.te06-Dec-2016769
mediaserver.te06-Dec-20164.7K
mls06-Dec-20164.3K
mls_macros06-Dec-20161.2K
MODULE_LICENSE_PUBLIC_DOMAIN06-Dec-20160
mtp.te06-Dec-2016307
net.te06-Dec-2016914
netd.te06-Dec-20163.6K
neverallow_macros06-Dec-2016369
nfc.te06-Dec-20161.2K
NOTICE06-Dec-20161K
otapreopt_chroot.te06-Dec-2016991
otapreopt_slot.te06-Dec-20161.3K
perfprofd.te06-Dec-20162.1K
platform_app.te06-Dec-20162.5K
policy_capabilities06-Dec-2016122
port_contexts06-Dec-201677
postinstall.te06-Dec-20161.5K
postinstall_dexopt.te06-Dec-20162.4K
ppp.te06-Dec-2016512
preopt2cachename.te06-Dec-2016469
priv_app.te06-Dec-20165.4K
profman.te06-Dec-2016583
property.te06-Dec-20162K
property_contexts06-Dec-20164.1K
racoon.te06-Dec-2016893
radio.te06-Dec-20161.2K
README06-Dec-20165.3K
recovery.te06-Dec-20164.7K
recovery_persist.te06-Dec-20161K
recovery_refresh.te06-Dec-2016962
rild.te06-Dec-20161.6K
roles06-Dec-201629
runas.te06-Dec-20161.1K
sdcardd.te06-Dec-20161.4K
seapp_contexts06-Dec-20164.4K
security_classes06-Dec-20161.9K
service.te06-Dec-20169.4K
service_contexts06-Dec-201610.8K
servicemanager.te06-Dec-2016680
sgdisk.te06-Dec-2016759
shared_relro.te06-Dec-2016588
shell.te06-Dec-20165K
slideshow.te06-Dec-2016568
su.te06-Dec-20161.9K
surfaceflinger.te06-Dec-20162.4K
system_app.te06-Dec-20162K
system_server.te06-Dec-201622K
te_macros06-Dec-201610.9K
tee.te06-Dec-2016512
toolbox.te06-Dec-20161K
tools/06-Dec-2016
tzdatacheck.te06-Dec-2016272
ueventd.te06-Dec-20162K
uncrypt.te06-Dec-20161.2K
untrusted_app.te06-Dec-20168.6K
update_engine.te06-Dec-20161.4K
update_engine_common.te06-Dec-20161.8K
update_verifier.te06-Dec-2016567
users06-Dec-201655
vdc.te06-Dec-2016744
vold.te06-Dec-20167.4K
watchdogd.te06-Dec-2016185
wpa.te06-Dec-20161.3K
zygote.te06-Dec-20164.1K

README

      1 This directory contains the core Android SELinux policy configuration.
      2 It defines the domains and types for the AOSP services and apps common to
      3 all devices.  Device-specific policy should be placed under a
      4 separate device/<vendor>/<board>/sepolicy subdirectory and linked
      5 into the policy build as described below.
      6 
      7 Policy Generation:
      8 
      9 Additional, per device, policy files can be added into the
     10 policy build. These files should have each line including the
     11 final line terminated by a newline character (0x0A).  This
     12 will allow files to be concatenated and processed whenever
     13 the m4(1) macro processor is called by the build process.
     14 Adding the newline will also make the intermediate text files
     15 easier to read when debugging build failures.  The sets of file,
     16 service and property contexts files will automatically have a
     17 newline inserted between each file as these are common failure
     18 points.
     19 
     20 These device policy files can be configured through the use of
     21 the BOARD_SEPOLICY_DIRS variable. This variable should be set
     22 in the BoardConfig.mk file in the device or vendor directories.
     23 
     24 BOARD_SEPOLICY_DIRS contains a list of directories to search
     25 for additional policy files. Order matters in this list.
     26 For example, if you have 2 instances of widget.te files in the
     27 BOARD_SEPOLICY_DIRS search path, then the first one found (at the
     28 first search dir containing the file) will be concatenated first.
     29 Reviewing out/target/product/<device>/etc/sepolicy_intermediates/policy.conf
     30 will help sort out ordering issues.
     31 
     32 Example BoardConfig.mk Usage:
     33 From the Tuna device BoardConfig.mk, device/samsung/tuna/BoardConfig.mk
     34 
     35 BOARD_SEPOLICY_DIRS += device/samsung/tuna/sepolicy
     36 
     37 Additionally, OEMs can specify BOARD_SEPOLICY_M4DEFS to pass arbitrary m4
     38 definitions during the build. A definition consists of a string in the form
     39 of macro-name=value. Spaces must NOT be present. This is useful for building modular
     40 policies, policy generation, conditional file paths, etc. It is supported in
     41 the following file types:
     42  * All *.te and SE Linux policy files as passed to checkpolicy
     43  * file_contexts
     44  * service_contexts
     45  * property_contexts
     46  * keys.conf
     47 
     48 Example BoardConfig.mk Usage:
     49 BOARD_SEPOLICY_M4DEFS += btmodule=foomatic \
     50                          btdevice=/dev/gps
     51 
     52 SPECIFIC POLICY FILE INFORMATION
     53 
     54 mac_permissions.xml:
     55   ABOUT:
     56     The mac_permissions.xml file is used for controlling the mmac solutions
     57     as well as mapping a public base16 signing key with an arbitrary seinfo
     58     string. Details of the files contents can be found in a comment at the
     59     top of that file. The seinfo string, previously mentioned, is the same string
     60     that is referenced in seapp_contexts.
     61 
     62     It is important to note the final processed version of this file
     63     is stripped of comments and whitespace. This is to preserve space on the
     64     system.img. If one wishes to view it in a more human friendly format,
     65     the "tidy" or "xmllint" command will assist you.
     66 
     67   TOOLING:
     68     insertkeys.py
     69       Is a helper script for mapping arbitrary tags in the signature stanzas of
     70       mac_permissions.xml to public keys found in pem files. This script takes
     71       a mac_permissions.xml file(s) and configuration file in order to operate.
     72       Details of the configuration file (keys.conf) can be found in the subsection
     73       keys.conf. This tool is also responsible for stripping the comments and
     74       whitespace during processing.
     75 
     76       keys.conf
     77         The keys.conf file is used for controlling the mapping of "tags" found in
     78         the mac_permissions.xml signature stanzas with actual public keys found in
     79         pem files. The configuration file is processed via m4.
     80 
     81         The script allows for mapping any string contained in TARGET_BUILD_VARIANT
     82         with specific path to a pem file. Typically TARGET_BUILD_VARIANT is either
     83         user, eng or userdebug. Additionally, one can specify "ALL" to map a path to
     84         any string specified in TARGET_BUILD_VARIANT. All tags are matched verbatim
     85         and all options are matched lowercase. The options are "tolowered" automatically
     86         for the user, it is convention to specify tags and options in all uppercase
     87         and tags start with @. The option arguments can also use environment variables
     88         via the familiar $VARIABLE syntax. This is often useful for setting a location
     89         to ones release keys.
     90 
     91         Often times, one will need to integrate an application that was signed by a separate
     92         organization and may need to extract the pem file for the insertkeys/keys.conf tools.
     93         Extraction of the public key in the pem format is possible via openssl. First you need
     94         to unzip the apk, once it is unzipped, cd into the META_INF directory and then execute
     95         openssl pkcs7 -inform DER -in CERT.RSA -out CERT.pem -outform PEM  -print_certs
     96         On some occasions CERT.RSA has a different name, and you will need to adjust for that.
     97         After extracting the pem, you can rename it, and configure keys.conf and
     98         mac_permissions.xml to pick up the change. You MUST open the generated pem file in a text
     99         editor and strip out anything outside the opening and closing scissor lines. Failure to do
    100         so WILL cause a compile time issue thrown by insertkeys.py
    101 
    102         NOTE: The pem files are base64 encoded and PackageManagerService, mac_permissions.xml
    103               and setool all use base16 encodings.
    104