Exempt attributes from policy versioning.
Commit: ee5a1aef6bcf7cdd186bfa53eb4e6b5d98c5db9c added code to change types and
attributes from exported public platform policy into versioned attributes that
map to the underlying types (and attributes) in the platform policy. This was
done to create greater flexibility from a platform labeling perspective: objects
could be labeled with different types by the platform and then given the
attributes of the previous type to ensure non-platform policy preserved access
that may be relied upon.
This broke the neverallow and checkfc assertions,
though, which rely on attributes being universally applied across all policy,
e.g. all types have attribute domain, whereas with this change non-platform
types would have a domain of doman_N, as well as complicating the maintenance of
the mapping file. This CL exempts attributes from versioning, which combined
with the previous change means that the versioning approach is to keep platform
types and attributes unchanged, and only convert non-platform types to versioned
attributes. This provides the same ability to change labels of objects, which
concern a concrete type, but does require the platform to guarantee that once an
object has an attribute, it never loses that attribute for as long as previous
non-platform versions are supported.
Bug: 33388095
Test: Device builds and boots.
Change-Id: I4848064af8737e25243f14b4cc369881cf29c5c3
Second part getting rid of versioned attribs.
Change-Id: Ib03a8cf5e8efd34ae57b126e1d6d3aba3885ede3
2 files changed