PWN-Hunter/android_system_sepolicy
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
1a3ee382ec
android_system_sepolicy/vendor/hal_graphics_composer_default.te

11 lines
521 B
Plaintext
Raw Normal View History

Group all HAL impls using haldomain attribute This marks all HAL domain implementations with the haldomain attribute so that rules can be written which apply to all HAL implementations. This follows the pattern used for appdomain, netdomain and bluetoothdomain. Test: No change to policy according to sesearch. Bug: 34180936 Change-Id: I0cfe599b0d49feed36538503c226dfce41eb65f6
2017-01-10 15:54:25 -08:00
type hal_graphics_composer_default, domain;
Annotate most remaining HALs with _client/_server This switches most remaining HALs to the _client/_server approach. To unblock efforts blocked on majority of HALs having to use this model, this change does not remove unnecessary rules from clients of these HALs. That work will be performed in follow-up commits. This commit only adds allow rules and thus does not break existing functionality. The HALs not yet on the _client/_server model after this commit are: * Allocator HAL, because it's non-trivial to declare all apps except isolated apps as clients of this HAL, which they are. * Boot HAL, because it's still on the non-attributized model and I'm waiting for update_engine folks to answer a couple of questions which will let me refactor the policy of this HAL. Test: mmm system/sepolicy Test: Device boots, no new denials Test: Device boots in recovery mode, no new denials Bug: 34170079 Change-Id: I03e6bcec2fa02f14bdf17d11f7367b62c68a14b9
2017-03-16 18:48:40 -07:00
hal_server_domain(hal_graphics_composer_default, hal_graphics_composer)
All hal policies expressed as attributes. Bug: 32123421 Bug: 32905206 Test: compiles, nfc works Change-Id: Ibf72ef70255573e4df0863ea640354b3c37eb47d
2016-12-13 12:17:09 -08:00
sepolicy: make exec_types in /vendor a subset of vendor_file_type We install all default hal implementations in /vendor/bin/hw along with a few domains that are defined in vendor policy and installed in /vendor. These files MUST be a subset of the global 'vendor_file_type' which is used to address *all files installed in /vendor* throughout the policy. Bug: 36463595 Test: Boot sailfish without any new denials Change-Id: I3d26778f9a26f9095f49d8ecc12f2ec9d2f4cb41 Signed-off-by: Sandeep Patil <sspatil@google.com>
2017-04-10 13:03:28 -07:00
type hal_graphics_composer_default_exec, exec_type, vendor_file_type, file_type;
All hal policies expressed as attributes. Bug: 32123421 Bug: 32905206 Test: compiles, nfc works Change-Id: Ibf72ef70255573e4df0863ea640354b3c37eb47d
2016-12-13 12:17:09 -08:00
init_daemon_domain(hal_graphics_composer_default)
Initial selinux policy support for memfd Move all app tmpfs types to appdomain_tmpfs. These are still protected by mls categories and DAC. TODO clean up other app tmpfs types in a separate change. Treble-ize tmpfs passing between graphics composer HAL and surfaceflinger. Bug: 122854450 Test: boot Blueline with memfd enabled. Change-Id: Ib98aaba062f10972af6ae80fb85b7a0f60a32eee
2019-01-29 14:43:45 -08:00
type_transition hal_graphics_composer_default tmpfs:file hal_graphics_composer_server_tmpfs;
allow hal_graphics_composer_default hal_graphics_composer_server_tmpfs:file { getattr map read write };
Dontaudit denials caused by race with labeling. These denials seem to be caused by a race with the process that labels the files. While we work on fixing them, hide the denials. Bug: 68864350 Bug: 70180742 Test: Built policy. Change-Id: I58a32e38e6384ca55e865e9575dcfe7c46b2ed3c
2018-02-14 16:32:28 -08:00
# b/68864350
dontaudit hal_graphics_composer_default unlabeled:dir search;
Reference in New Issue Copy Permalink