{"push_id":1273465639,"size":11,"distinct_size":11,"ref":"refs/heads/nougat-release","head":"4f8e65d536c6b5155c377293bc94d497bed6761b","before":"92353eabfd885c2cbf55df86de5e0861833042a6","commits":[{"sha":"88830063e04beddbfd5ceee1c4d263abd3bd6cc2","author":{"name":"Daniel Micay","email":"56a4f5a14d32bfcf295ef186e01c362d3f5fc20f@gmail.com"},"message":"remove rules tied to the Dalvik/ART JIT compiler\n\nChange-Id: Ief72adfc3ccd92f4268d9257899437d264305789","distinct":true,"url":"https://api.github.com/repos/CopperheadOS/platform_system_sepolicy/commits/88830063e04beddbfd5ceee1c4d263abd3bd6cc2"},{"sha":"76f1c3e546e0c38781ec3fd30d99d995cd6f91ab","author":{"name":"Daniel Micay","email":"56a4f5a14d32bfcf295ef186e01c362d3f5fc20f@gmail.com"},"message":"allow the system user to configure malloc","distinct":true,"url":"https://api.github.com/repos/CopperheadOS/platform_system_sepolicy/commits/76f1c3e546e0c38781ec3fd30d99d995cd6f91ab"},{"sha":"8e6c088d3730c796fbafc375bfa2a1e85d139743","author":{"name":"Daniel Micay","email":"56a4f5a14d32bfcf295ef186e01c362d3f5fc20f@gmail.com"},"message":"add persist.privacy. property namespace\n\nThis will be used to control whether the MAC address is randomized,\namong other things.","distinct":true,"url":"https://api.github.com/repos/CopperheadOS/platform_system_sepolicy/commits/8e6c088d3730c796fbafc375bfa2a1e85d139743"},{"sha":"71f46421135eabc47ec8a1764bb7134255830470","author":{"name":"Daniel Micay","email":"56a4f5a14d32bfcf295ef186e01c362d3f5fc20f@gmail.com"},"message":"allow system to set security.deny_new_usb","distinct":true,"url":"https://api.github.com/repos/CopperheadOS/platform_system_sepolicy/commits/71f46421135eabc47ec8a1764bb7134255830470"},{"sha":"51c9648cffd9c24b0bddcda0a63e9f43bb7b230b","author":{"name":"Daniel Micay","email":"56a4f5a14d32bfcf295ef186e01c362d3f5fc20f@gmail.com"},"message":"restrict access to timing information in /proc\n\nThese APIs expose sensitive information via timing side channels. This\nleaves access via the adb shell intact along with the current uses by\ndumpstate, init and system_server.\n\nThe /proc/interrupts and /proc/stat files were covered in this paper:\n\nhttps://www.lightbluetouchpaper.org/2016/07/29/yet-another-android-side-channel/\n\nThe /proc/softirqs, /proc/timer_list and /proc/timer_stats files are\nalso relevant.\n\nAccess to /proc has been greatly restricted since then, with untrusted\napps no longer having direct access to these, but stricter restrictions\nbeyond that would be quite useful.\n\nChange-Id: Ibed16674856569d26517e5729f0f194b830cfedd","distinct":true,"url":"https://api.github.com/repos/CopperheadOS/platform_system_sepolicy/commits/51c9648cffd9c24b0bddcda0a63e9f43bb7b230b"},{"sha":"a741f62ae2b8816cdbcfe2c256e93696832e20fc","author":{"name":"Daniel Micay","email":"56a4f5a14d32bfcf295ef186e01c362d3f5fc20f@gmail.com"},"message":"fine-grained policy for access to /proc/zoneinfo\n\nChange-Id: Ica9a16311075f5cc3744d0e0833ed876e201029f","distinct":true,"url":"https://api.github.com/repos/CopperheadOS/platform_system_sepolicy/commits/a741f62ae2b8816cdbcfe2c256e93696832e20fc"},{"sha":"1a7fc271781031b364ad72d8849449ddc03a63e1","author":{"name":"Daniel Micay","email":"56a4f5a14d32bfcf295ef186e01c362d3f5fc20f@gmail.com"},"message":"fine-grained policy for access to /proc/vmstat\n\nChange-Id: I97f8faaa5c71f08383b3db027576da73c900922c","distinct":true,"url":"https://api.github.com/repos/CopperheadOS/platform_system_sepolicy/commits/1a7fc271781031b364ad72d8849449ddc03a63e1"},{"sha":"bb7a793ee3b9e1cb1bda54b9cbaa226400eb5961","author":{"name":"Daniel Micay","email":"56a4f5a14d32bfcf295ef186e01c362d3f5fc20f@gmail.com"},"message":"expose control over ptrace access to the shell\n\nChange-Id: Ibb0862b589f25d3be1a5ea30bad840797b6cf0d5","distinct":true,"url":"https://api.github.com/repos/CopperheadOS/platform_system_sepolicy/commits/bb7a793ee3b9e1cb1bda54b9cbaa226400eb5961"},{"sha":"97227dccb293ccd845ee2105a6c0684b39ce5a2f","author":{"name":"Daniel Micay","email":"56a4f5a14d32bfcf295ef186e01c362d3f5fc20f@gmail.com"},"message":"rm base system dalvikcache_data_file execute\n\nThis only needs to be permitted for the domains used by third party apps\nnow that the base system doesn't map any executable data from /data.\n\n* shell\n* isolated_app\n* untrusted_app\n\nChange-Id: If77943f62a367db4b3a284993304a2fc5b1aa4d2","distinct":true,"url":"https://api.github.com/repos/CopperheadOS/platform_system_sepolicy/commits/97227dccb293ccd845ee2105a6c0684b39ce5a2f"},{"sha":"a5497ec0585d46f674a22980cb852a9863582ca3","author":{"name":"Jeff Vander Stoep","email":"3c7c1df314a95c4ce859cc668e778f3e3567dbe8@google.com"},"message":"resurrect camera_device\n\n(cherry picked from commit e8a53dff5b769de2b6c218877cc59595771ca5be)\n\nWith the breakup of mediaserver, distinguishing between\ncamera_device and video_device is meaningful. Only grant\ncameraserver access to camera_device.\n\nBug: 28359909\nChange-Id: I0ae12f87bac8a5c912f0a693d1d56a8d5af7f3f3","distinct":true,"url":"https://api.github.com/repos/CopperheadOS/platform_system_sepolicy/commits/a5497ec0585d46f674a22980cb852a9863582ca3"},{"sha":"4f8e65d536c6b5155c377293bc94d497bed6761b","author":{"name":"Daniel Micay","email":"56a4f5a14d32bfcf295ef186e01c362d3f5fc20f@gmail.com"},"message":"remove shared_relro support\n\nChange-Id: I558f464fd49981a6fe9e6ef241205665c587a21b","distinct":true,"url":"https://api.github.com/repos/CopperheadOS/platform_system_sepolicy/commits/4f8e65d536c6b5155c377293bc94d497bed6761b"}]}
{"actor":{"display_login":"thestinger"}}