1180216 - Create Selinux policy for flame-l

Status: RESOLVED FIXED

(Firefox OS Graveyard :: General, defect)

Description

[Kai-Zhen Li [:seinlin][:kli]]

+++ This bug was initially created as a clone of Bug #1136032 +++

I think it could be better to handle flame-l in a different bug for tracking purpose.

Comment 1

[Julian Hector [:tedd] [:jhector]]

Ok, since I am already taking care of the nexus 5 rules I will also work on this.

Comment 2

[Julian Hector [:tedd] [:jhector]]

In response to Bug 1136032 Comment 52: I would think that having to maintain a branch is easier than to keep track of what domain needs a dummy definition.
I also think that having a fork of the original repository makes it easier to update to a newer version of the policies in case things change.

But at the same time, I can also see the benefit of moving the device specific policies into a single place instead of having them spread across the file system.

Both methods probably have their benefits, but you are more experienced with the maintenance and all, so if you think it is better to move them over I will do that.

Comment 3

[Kai-Zhen Li [:seinlin][:kli]]

What I concern about is if we have all selinux policies in each device specific repo, when we want to update b2g common policies we need to update all device specific repos.

If we have b2g common policies in the same place, we can update them at once.

So that's why I think having b2g common policies and device specific things separately could be better.

Comment 4

[Julian Hector [:tedd] [:jhector]]

(In reply to Kai-Zhen Li [:kli][:seinlin] from comment #3)
> What I concern about is if we have all selinux policies in each device
> specific repo, when we want to update b2g common policies we need to update
> all device specific repos.
> 
> If we have b2g common policies in the same place, we can update them at once.
> 
> So that's why I think having b2g common policies and device specific things
> separately could be better.

Ok, good points, let's go with your approach. I will make the modifications and create pull requests.

Comment 5

[Julian Hector [:tedd] [:jhector]]

So I encountered the problem I described in Bug 1136032 Comment 67, flame-l uses a later version of platform/external/sepolicy, which defines a domain that isn't defined in the branched that is used by nexus-5.

But the qcom policy files used in the Flame, define allow rules for that domain, but since it is not defined it can't successfully build the policy.

What do you think?

Comment 6

[Kai-Zhen Li [:seinlin][:kli]]

Flame-l is based on 5.0; Nexus-l is based on 5.1. We can expect there is some difference.

Basically, we have this rule for all repos forked from aosp, aosp branch + b2g change -> b2g branch.

But flame-l use a tag instead of aosp branch. I think we can follow how "frameworks/av" does and have a branch LA.BF.1.1.2_rb1.12 for platform/external/sepolicy too.

Comment 7

[Julian Hector [:tedd] [:jhector]]

(In reply to Kai-Zhen Li [:kli][:seinlin] from comment #6)
> But flame-l use a tag instead of aosp branch. I think we can follow how
> "frameworks/av" does and have a branch LA.BF.1.1.2_rb1.12 for
> platform/external/sepolicy too.

Sounds good, once we have the branch I can make the PR's.

Comment 8

[Kai-Zhen Li [:seinlin][:kli]]

The branched is created.
https://github.com/mozilla-b2g/platform_external_sepolicy/tree/LA.BF.1.1.2_rb1.12

Comment 9

[Julian Hector [:tedd] [:jhector]]

Attachment: Part 1: Bug 1180216 - Exclude b2g from some neverallow rules r=kang

Comment 10

[Julian Hector [:tedd] [:jhector]]

Attachment: Part 2: Bug 1180216 - Move qcom policies, add device specific b2g related policies r=kang,seinlin

Comment 11

[Julian Hector [:tedd] [:jhector]]

Attachment: Part 3: Bug 1180216 - Use forked external/sepolicy, remove qcom sepolicy r=seinlin

Comment 12

[Kai-Zhen Li [:seinlin][:kli]]

Comment on attachment 8635079 [details] [review]
Part 3: Bug 1180216 - Use forked external/sepolicy, remove qcom sepolicy r=seinlin

Looks good to me.

Comment 13

[Kai-Zhen Li [:seinlin][:kli]]

Dependent bug 1136032 need to be landed before this bug. Once the patches are ready for landing, please add checkin-needed keyword in corresponding bug.

Comment 14

[Julian Hector [:tedd] [:jhector]]

Ok, Bug 1136032 has landed, I think we can merge these patches now as well.

Comment 15

[Julian Hector [:tedd] [:jhector]]

Rather not now, I will be out of the office the next two days.

Comment 16

[Julian Hector [:tedd] [:jhector]]

we can give it a shot now

Comment 17

[Ryan VanderMeulen [:RyanVM]]

LA.BF.1.1.2_rb1.12: https://github.com/mozilla-b2g/platform_external_sepolicy/commit/a3e56c260c4dd75d6b090675bb400723a92c1e3f

lollipop: https://github.com/mozilla-b2g/device-flame/commit/6c0fefd2f478a6d528ae6581da5b52bfc48dca1e

Master: https://github.com/mozilla-b2g/b2g-manifest/commit/43bd24f38678a6064977b0b8dd30ba43c7c16a42