PWN-Hunter/android_system_sepolicy
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
1a3ee382ec
android_system_sepolicy/vendor/hal_configstore_default.te

6 lines
218 B
Plaintext
Raw Normal View History

configstore: add selinux policy for configstore@1.0 hal This change adds selinux policy for configstore@1.0 hal. Currently, only surfaceflinger has access to the HAL, but need to be widen. Bug: 34314793 Test: build & run Merged-In: I40e65032e9898ab5f412bfdb7745b43136d8e964 Change-Id: I40e65032e9898ab5f412bfdb7745b43136d8e964 (cherry picked from commit 5ff0f178ba077594e80d9777bbe7a13d25d2484d)
2017-01-18 18:41:56 -08:00
type hal_configstore_default, domain;
Annotate most remaining HALs with _client/_server This switches most remaining HALs to the _client/_server approach. To unblock efforts blocked on majority of HALs having to use this model, this change does not remove unnecessary rules from clients of these HALs. That work will be performed in follow-up commits. This commit only adds allow rules and thus does not break existing functionality. The HALs not yet on the _client/_server model after this commit are: * Allocator HAL, because it's non-trivial to declare all apps except isolated apps as clients of this HAL, which they are. * Boot HAL, because it's still on the non-attributized model and I'm waiting for update_engine folks to answer a couple of questions which will let me refactor the policy of this HAL. Test: mmm system/sepolicy Test: Device boots, no new denials Test: Device boots in recovery mode, no new denials Bug: 34170079 Change-Id: I03e6bcec2fa02f14bdf17d11f7367b62c68a14b9
2017-03-16 18:48:40 -07:00
hal_server_domain(hal_configstore_default, hal_configstore)
configstore: add selinux policy for configstore@1.0 hal This change adds selinux policy for configstore@1.0 hal. Currently, only surfaceflinger has access to the HAL, but need to be widen. Bug: 34314793 Test: build & run Merged-In: I40e65032e9898ab5f412bfdb7745b43136d8e964 Change-Id: I40e65032e9898ab5f412bfdb7745b43136d8e964 (cherry picked from commit 5ff0f178ba077594e80d9777bbe7a13d25d2484d)
2017-01-18 18:41:56 -08:00
sepolicy: make exec_types in /vendor a subset of vendor_file_type We install all default hal implementations in /vendor/bin/hw along with a few domains that are defined in vendor policy and installed in /vendor. These files MUST be a subset of the global 'vendor_file_type' which is used to address *all files installed in /vendor* throughout the policy. Bug: 36463595 Test: Boot sailfish without any new denials Change-Id: I3d26778f9a26f9095f49d8ecc12f2ec9d2f4cb41 Signed-off-by: Sandeep Patil <sspatil@google.com>
2017-04-10 13:03:28 -07:00
type hal_configstore_default_exec, exec_type, vendor_file_type, file_type;
configstore: add selinux policy for configstore@1.0 hal This change adds selinux policy for configstore@1.0 hal. Currently, only surfaceflinger has access to the HAL, but need to be widen. Bug: 34314793 Test: build & run Merged-In: I40e65032e9898ab5f412bfdb7745b43136d8e964 Change-Id: I40e65032e9898ab5f412bfdb7745b43136d8e964 (cherry picked from commit 5ff0f178ba077594e80d9777bbe7a13d25d2484d)
2017-01-18 18:41:56 -08:00
init_daemon_domain(hal_configstore_default)
Reference in New Issue Copy Permalink