openkylin
/
platform_system_core
mirror of https://gitee.com/openkylin/platform_system_core.git
9
0
Fork 0
Code Issues Projects Releases Wiki Activity
28,876 Commits 2 Branches 1 Tag 197 MiB
Commit Graph

28876 Commits

Author SHA1 Message Date
Tao Bao 2b5065648c Merge "adb: Fix the 'adb reboot sideload' for A/B devices." am: 9f59a4663c 
am: b26579f326

Change-Id: I297f0ca93ea98f520b5b492af23f598f876136b0
 2017-01-06 17:08:28 +00:00
Tao Bao b26579f326 Merge "adb: Fix the 'adb reboot sideload' for A/B devices." 
am: 9f59a4663c

Change-Id: I9d1998124a38508a5681b0230ad7d11eba3edb60
 2017-01-06 17:04:28 +00:00
Tao Bao 9f59a4663c Merge "adb: Fix the 'adb reboot sideload' for A/B devices." 2017-01-06 16:59:39 +00:00
Tao Bao 40e0ec918e adb: Fix the 'adb reboot sideload' for A/B devices. 
We used to write the command file (/cache/recovery/command) to trigger
the sideload mode. A/B devices don't support that (may not have /cache
paritition). This CL switches to using libbootloader_message which
writes the command to BCB (bootloader control block) instead.

Test: "adb root && adb reboot sideload" reboots sailfish into recovery
      sideload mode.

Change-Id: I158fd7cbcfa9a5d0609f1f684a2d03675217628f
 2017-01-05 18:01:01 -08:00
Jaekyun Seok 1faf78e32f Merge "Use shared lib of libutils, libz and libbase." am: 4bf9c82857 am: 70f6d5878e am: 3b00f1cc8f 
am: da100377b0

Change-Id: I947f7edc8e3ef3c56502387e2b764a3826244025
 2017-01-05 23:39:16 +00:00
Jaekyun Seok da100377b0 Merge "Use shared lib of libutils, libz and libbase." am: 4bf9c82857 am: 70f6d5878e 
am: 3b00f1cc8f

Change-Id: I2b521fd2f7b275a10d230318189704730cac8f90
 2017-01-05 23:35:15 +00:00
Jaekyun Seok 3b00f1cc8f Merge "Use shared lib of libutils, libz and libbase." am: 4bf9c82857 
am: 70f6d5878e

Change-Id: I33d1f440eaf0aab019b0c222b44953923f255de9
 2017-01-05 23:31:45 +00:00
Jaekyun Seok 70f6d5878e Merge "Use shared lib of libutils, libz and libbase." 
am: 4bf9c82857

Change-Id: I7429632c24ca9f7581eb4e4d94640fb222b8d56e
 2017-01-05 23:27:45 +00:00
Treehugger Robot 4bf9c82857 Merge "Use shared lib of libutils, libz and libbase." 2017-01-05 23:24:21 +00:00
Mark Salyzyn c7f2e8925b Merge "logd: sepolicy dynamic rate limiting" am: 8954ef987b am: f80377d73a am: 4ec4e12b87 
am: cd6b2bb4f0

Change-Id: I2213e0ec7342bca0169cb8194800b9158a62f6df
 2017-01-05 20:55:30 +00:00
Mark Salyzyn cd6b2bb4f0 Merge "logd: sepolicy dynamic rate limiting" am: 8954ef987b am: f80377d73a 
am: 4ec4e12b87

Change-Id: Ib72ff5d5b6379181eeb55584badc44eed9ffe014
 2017-01-05 20:51:58 +00:00
Mark Salyzyn 4ec4e12b87 Merge "logd: sepolicy dynamic rate limiting" am: 8954ef987b 
am: f80377d73a

Change-Id: Ia920a417e95a87625775f0ac3a5151b8eb0948f1
 2017-01-05 20:48:28 +00:00
Mark Salyzyn f80377d73a Merge "logd: sepolicy dynamic rate limiting" 
am: 8954ef987b

Change-Id: Id219bfcf31a621afe0c0109455119da0a29ba2d5
 2017-01-05 20:44:58 +00:00
Treehugger Robot 8954ef987b Merge "logd: sepolicy dynamic rate limiting" 2017-01-05 20:28:34 +00:00
Steven Moreland a1538906ac Merge "Return<*> getStatus().isOk() -> isOk()" 2017-01-04 23:46:52 +00:00
Mark Salyzyn 247d682fe1 logd: sepolicy dynamic rate limiting 
Processing overhead for selinux violation messages is costly. We want
to deal with bursts of violations, but we have no intent of allowing
that sustained burst to go unabated as there is a cost of processing
and battery usage.

Tunables in libaudit.h are:

AUDIT_RATE_LIMIT_DEFAULT 20        /* acceptable burst rate      */
AUDIT_RATE_LIMIT_BURST_DURATION 10 /* number of seconds of burst */
AUDIT_RATE_LIMIT_MAX     5         /* acceptable sustained rate  */

Since we can only asymptotically handle DEFAULT rate, we set an upper
threshold of half way between the MAX and DEFAULT rate.

Default kernel audit subsystem message rate is set to 20 a second.
If sepolicy exceeds 125 violation messages over up to ten seconds
(>=~12/s), tell kernel audit subsystem to drop the rate to 5 messages
a second.  If rate drops below 50 messages over the past ten seconds
(<5/s), tell kernel it is ok to increase the burst rate back to 20
messages a second.

Test: gTest logd-unit-tests --gtest_filter=logd.sepolicy_rate_limiter_*
Bug: 27878170
Change-Id: I843f8dcfbb3ecfbbe94a4865ea332c858e3be7f2
 2017-01-04 14:46:58 -08:00
Alexey Polyudov e4bfb06dc2 Merge "gatekeeperd: protect from invalid data passed by HAL" into nyc-mr2-dev am: d286af0bef 
am: acfb7c41a6

Change-Id: I491f06462d40a86eb9564328a48fa019b7766986
 2017-01-04 03:33:32 +00:00
Alexey Polyudov 48e00f7470 gatekeeperd: protect from invalid data passed by HAL am: 8c63536ded 
am: 563ed1672f

Change-Id: I524b468ef7d54444feaceacbcdc66861a1cada0c
 2017-01-04 03:33:20 +00:00
Alexey Polyudov acfb7c41a6 Merge "gatekeeperd: protect from invalid data passed by HAL" into nyc-mr2-dev 
am: d286af0bef

Change-Id: I66655ed41572e91f69d598413fb54d2a30ba43e5
 2017-01-04 03:31:21 +00:00
Alexey Polyudov 563ed1672f gatekeeperd: protect from invalid data passed by HAL 
am: 8c63536ded

Change-Id: Ie020281e63504ea0b9f27e9e36433d3e137ae018
 2017-01-04 03:31:20 +00:00
Alexey Polyudov d286af0bef Merge "gatekeeperd: protect from invalid data passed by HAL" into nyc-mr2-dev 2017-01-04 03:28:42 +00:00
Steven Moreland 813309326b Return<*> getStatus().isOk() -> isOk() 
Bug: 31348667
Test: compiles
Change-Id: I44d89e45c8bf8bcd7a47dff1f5cd4d454c95a079
 2017-01-03 17:05:26 -08:00
Elliott Hughes f456868d84 Merge "Don't use bare `noreturn` in log.h." am: fe05f1cde4 am: 3f789b70ea am: ed5555ed8a 
am: 2ebbcb17cf

Change-Id: I720de4a9a09739cc37d90af029f72a702b2db578
 2017-01-04 00:48:59 +00:00
Elliott Hughes 2ebbcb17cf Merge "Don't use bare `noreturn` in log.h." am: fe05f1cde4 am: 3f789b70ea 
am: ed5555ed8a

Change-Id: Ie8542e03cd07103643818df2bdba580641b1a911
 2017-01-04 00:46:30 +00:00
Elliott Hughes ed5555ed8a Merge "Don't use bare `noreturn` in log.h." am: fe05f1cde4 
am: 3f789b70ea

Change-Id: I5f5d65daaf5d6b9e006463960da50a33e9f8bfd3
 2017-01-04 00:44:30 +00:00
Elliott Hughes 3f789b70ea Merge "Don't use bare `noreturn` in log.h." 
am: fe05f1cde4

Change-Id: I5e1fa172496d2b5c038df9e1f66a7ac3734ed3bc
 2017-01-04 00:42:00 +00:00
Elliott Hughes fe05f1cde4 Merge "Don't use bare `noreturn` in log.h." 2017-01-04 00:37:18 +00:00
Adrian Salido d004bc1645 Merge "init/service.cpp: fix access check for console" am: 4a3b03e9e5 am: 7cc669c493 am: 08cbedfb14 
am: 9d4179dada

Change-Id: Ifee9f10f537386d07ea2fd93f5faece74bad1a22
 2017-01-03 23:36:36 +00:00
Adrian Salido 9d4179dada Merge "init/service.cpp: fix access check for console" am: 4a3b03e9e5 am: 7cc669c493 
am: 08cbedfb14

Change-Id: I2b82459bcd305feddce157057c8d1e9f5cf22fc9
 2017-01-03 23:34:37 +00:00
Nick Kralevich a9aa17b8e8 Merge "Send property_service AVC messages to the kernel audit system" am: d06f86ced6 am: d4fc568820 am: 7d93c5c036 
am: 7cb4bd8589

Change-Id: Ie5d4fde5f65c584db02c674fedb2aab0cfcf6211
 2017-01-03 23:32:38 +00:00
Adrian Salido 08cbedfb14 Merge "init/service.cpp: fix access check for console" am: 4a3b03e9e5 
am: 7cc669c493

Change-Id: I4b8db330cf35d4c227ac1778201dbd4a3bc882a0
 2017-01-03 23:32:37 +00:00
Nick Kralevich 7cb4bd8589 Merge "Send property_service AVC messages to the kernel audit system" am: d06f86ced6 am: d4fc568820 
am: 7d93c5c036

Change-Id: Ib6e6f1468a43ac3749b5f83420eaf3da16a1802b
 2017-01-03 23:30:38 +00:00
Adrian Salido 7cc669c493 Merge "init/service.cpp: fix access check for console" 
am: 4a3b03e9e5

Change-Id: I69e33c783d8afb7cd7781a8782504f3307b61435
 2017-01-03 23:30:36 +00:00
Nick Kralevich 7d93c5c036 Merge "Send property_service AVC messages to the kernel audit system" am: d06f86ced6 
am: d4fc568820

Change-Id: Ica6e9eb7f578953f07f2c37cdbd074ce69f3468a
 2017-01-03 23:28:37 +00:00
Treehugger Robot 4a3b03e9e5 Merge "init/service.cpp: fix access check for console" 2017-01-03 23:27:40 +00:00
Nick Kralevich d4fc568820 Merge "Send property_service AVC messages to the kernel audit system" 
am: d06f86ced6

Change-Id: I6a1b06620029935bedc28b69ec46eff0bade140b
 2017-01-03 23:26:06 +00:00
Treehugger Robot d06f86ced6 Merge "Send property_service AVC messages to the kernel audit system" 2017-01-03 23:24:48 +00:00
Nick Kralevich 43912b1674 Merge "LogAudit.cpp: replace newlines with spaces in audit messages" am: 5badada997 am: 5083c589fa am: 48ff04f986 
am: 196969f951

Change-Id: I79e02a0348170723116fc8fc8f5fcd83dde3adbc
 2017-01-03 22:55:02 +00:00
Nick Kralevich 196969f951 Merge "LogAudit.cpp: replace newlines with spaces in audit messages" am: 5badada997 am: 5083c589fa 
am: 48ff04f986

Change-Id: I760273682cdc1ad7a5b0191bffc7c7a43e3b23c1
 2017-01-03 22:47:02 +00:00
Nick Kralevich 48ff04f986 Merge "LogAudit.cpp: replace newlines with spaces in audit messages" am: 5badada997 
am: 5083c589fa

Change-Id: Ic41ed573f2ee717edb347ef1db28daa6ab20de07
 2017-01-03 22:38:31 +00:00
Nick Kralevich 5083c589fa Merge "LogAudit.cpp: replace newlines with spaces in audit messages" 
am: 5badada997

Change-Id: Ic19c090caafa110a88eded401015d1eebfede58d
 2017-01-03 22:30:01 +00:00
Treehugger Robot 5badada997 Merge "LogAudit.cpp: replace newlines with spaces in audit messages" 2017-01-03 22:21:37 +00:00
Josh Gao 0f5fd3f206 adb: fix IOKit handle leaks on OS X. am: 6c533a7fb9 
am: b1dbfb5862

Change-Id: I65ccbfe05d810b86c381bc45b1d8ce225656ba13
 2017-01-03 22:15:10 +00:00
Josh Gao b1dbfb5862 adb: fix IOKit handle leaks on OS X. 
am: 6c533a7fb9

Change-Id: I2be1631b57e8a959a26a18e7635529aa622a3f1f
 2017-01-03 22:06:57 +00:00
Nick Kralevich 8adb4d9d12 Send property_service AVC messages to the kernel audit system 
The property service uses an SELinux userspace check to determine if a
process is allowed to set a property. If the security check fails, a
userspace SELinux denial is generated. Currently, these denials are only
sent to dmesg.

Instead of sending these denials to dmesg, send it to the kernel audit
system. This will cause these userspace denials to be treated similarly
to kernel generated denials (eg, logd will pick them up and process
them). This will ensure that denials generated by the property service
will show up in logcat / dmesg / event log.

After this patch, running "setprop asdf asdf" from the unprivileged adb
shell user will result in the following audit message:

  type=1107 audit(39582851.013:48): pid=1 uid=0 auid=4294967295
  ses=4294967295 subj=u:r:init:s0 msg='avc: denied { set } for
  property=asdf pid=5537 uid=2000 gid=2000 scontext=u:r:shell:s0
  tcontext=u:object_r:default_prop:s0 tclass=property_service'

Test: manual
Bug: 27878170
Change-Id: I0b8994888653501f2f315eaa63d9e2ba32d851ef
 2017-01-03 13:50:13 -08:00
Mark Salyzyn 3120cf73ce Merge "logd: Add support for ro.logd.auditd.[main|events]" am: 891df1c410 am: 0236379593 am: 3322aaf11d 
am: 5ec0bfdea2

Change-Id: Iea828b819f6ea70c33ab319cf4d691d21bf3c611
 2017-01-03 21:42:31 +00:00
Mark Salyzyn 5ec0bfdea2 Merge "logd: Add support for ro.logd.auditd.[main|events]" am: 891df1c410 am: 0236379593 
am: 3322aaf11d

Change-Id: Ibae988c6e3d5f0a7dea63b2d72b32339af5677b0
 2017-01-03 21:33:57 +00:00
Mark Salyzyn 3322aaf11d Merge "logd: Add support for ro.logd.auditd.[main|events]" am: 891df1c410 
am: 0236379593

Change-Id: I06f4f668092c256d728d1a57a2e3ccd95587d4d2
 2017-01-03 21:25:27 +00:00
Elliott Hughes 9b3b119912 Don't use bare `noreturn` in log.h. 
toybox has a #define noreturn that trips over this.

Also move `format` out of the way, just in case.

Bug: https://github.com/android-ndk/ndk/issues/271
Test: builds
Change-Id: Ib8811136b4b422ff74625509539a5464a3c9af18
 2017-01-03 13:17:42 -08:00
Mark Salyzyn 0236379593 Merge "logd: Add support for ro.logd.auditd.[main|events]" 
am: 891df1c410

Change-Id: I1321ebbe91c492efc1e2173f2c5ff29e015ab6de
 2017-01-03 21:16:56 +00:00