PWN-Hunter/android_system_sepolicy
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
dd958e5a21
android_system_sepolicy/public/bootanim.te

33 lines
929 B
Plaintext
Raw Normal View History

Define a domain for the bootanim service. Leave the domain permissive initially until it gets more testing. Change-Id: I9d88d76d1ffdc79a2eff4545d37a9e615482df50 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-12-11 12:17:53 -08:00
# bootanimation oneshot service
bootanim: Remove domain_deprecated Remove domain_deprecated from bootanim. This removes some unnecessarily permissive rules. As part of this, re-allow access to cgroups, proc and sysfs, removed as a result of removing domain_deprecated. Bug: 25433265 Change-Id: I58658712666c719c8f5a39fe2076c4f6d166616c
2015-12-02 13:29:20 -08:00
type bootanim, domain;
Define a domain for the bootanim service. Leave the domain permissive initially until it gets more testing. Change-Id: I9d88d76d1ffdc79a2eff4545d37a9e615482df50 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-12-11 12:17:53 -08:00
type bootanim_exec, exec_type, file_type;
binder_use(bootanim)
binder_call(bootanim, surfaceflinger)
Allow audioserver for bootanim. (cherry picked from commit ad5b4be399f18c4755c0d469aab2aacd4de68df6) Required for using native audio in BootAnimation Bug: 29055299 Change-Id: Ie75d35219be95a8dc697cc3c0384a4de90ea3478
2016-06-29 14:14:34 -07:00
binder_call(bootanim, audioserver)
Define a domain for the bootanim service. Leave the domain permissive initially until it gets more testing. Change-Id: I9d88d76d1ffdc79a2eff4545d37a9e615482df50 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-12-11 12:17:53 -08:00
allow bootanim gpu_device:chr_file rw_file_perms;
reconcile aosp (3a8c5dc05fb7696dd81b8a7c1b2524224154e8ea) after branching. Please do not merge. Change-Id: Ic8ee83ed6ffef02bddd17e1175416fc2481db7b2
2014-07-14 23:31:31 -07:00
# /oem access
allow bootanim oemfs:dir search;
sepolicy for oem cutomization Added read permissions for bootanimation Bug: 16635599 Change-Id: Ib5d0ba5a6d1144ff831f4f0eda092879f853c376
2014-09-22 13:03:52 -07:00
allow bootanim oemfs:file r_file_perms;
Resync lmp-dev-plus-aosp with master A DO NOT MERGE change merged from lmp-dev to lmp-dev-plus-aosp. This is expected, but it's causing unnecessary merge conflicts when handling AOSP contributions. Resolve those conflicts. This is essentially a revert of bf696327246833c9aba55a645e6c433e9f321e27 for lmp-dev-plus-aosp only. Change-Id: Icc66def7113ab45176ae015f659cb442d53bce5c
2014-07-25 15:19:47 -07:00
Give bootanimation access to /dev/snd files so it can use tinyalsa Bug: 17674304 Change-Id: Ide32833809bca8d3ed8ddc898748e25d7a692319
2014-09-29 06:18:19 -07:00
allow bootanim audio_device:dir r_dir_perms;
allow bootanim audio_device:chr_file rw_file_perms;
resolved conflicts for merge of 0a52df50 to lmp-dev-plus-aosp Change-Id: I3c6af086fc8ca3e9600c2267c439718c9a572dfb
2014-10-06 11:56:31 -07:00
Allow audioserver for bootanim. (cherry picked from commit ad5b4be399f18c4755c0d469aab2aacd4de68df6) Required for using native audio in BootAnimation Bug: 29055299 Change-Id: Ie75d35219be95a8dc697cc3c0384a4de90ea3478
2016-06-29 14:14:34 -07:00
allow bootanim audioserver_service:service_manager find;
Restrict service_manager find and list access. All domains are currently granted list and find service_manager permissions, but this is not necessary. Pare the permissions which did not trigger any of the auditallow reporting. Bug: 18106000 Change-Id: Ie0ce8de2af8af2cbe4ce388a2dcf4534694c994a
2014-12-11 16:01:27 -08:00
allow bootanim surfaceflinger_service:service_manager find;
bootanim: Remove domain_deprecated Remove domain_deprecated from bootanim. This removes some unnecessarily permissive rules. As part of this, re-allow access to cgroups, proc and sysfs, removed as a result of removing domain_deprecated. Bug: 25433265 Change-Id: I58658712666c719c8f5a39fe2076c4f6d166616c
2015-12-02 13:29:20 -08:00
# Allow access to ion memory allocation device
allow bootanim ion_device:chr_file rw_file_perms;
Add sepolicy for gralloc-alloc HAL Allow SurfaceFlinger to call into IAllocator, and allow everyone to access IAllocator's fd. Specifically, hwbinder_use(...) for avc: denied { call } for scontext=u:r:hal_graphics_allocator:s0 tcontext=u:r:hwservicemanager:s0 tclass=binder permissive=1 avc: denied { transfer } for scontext=u:r:hal_graphics_allocator:s0 tcontext=u:r:hwservicemanager:s0 tclass=binder permissive=1 allow ... ion_device:chr_file r_file_perms for avc: denied { read } for name="ion" dev="tmpfs" ino=15014 scontext=u:r:hal_graphics_allocator:s0 tcontext=u:object_r:ion_device:s0 tclass=chr_file permissive=1 avc: denied { open } for path="/dev/ion" dev="tmpfs" ino=15014 scontext=u:r:hal_graphics_allocator:s0 tcontext=u:object_r:ion_device:s0 tclass=chr_file permissive=1 avc: denied { ioctl } for path="/dev/ion" dev="tmpfs" ino=15014 ioctlcmd=4900 scontext=u:r:hal_graphics_allocator:s0 tcontext=u:object_r:ion_device:s0 tclass=chr_file permissive=1 allow ... gpu_device:chr_file rw_file_perms; for avc: denied { read write } for name="kgsl-3d0" dev="tmpfs" ino=14956 scontext=u:r:hal_graphics_allocator:s0 tcontext=u:object_r:gpu_device:s0 tclass=chr_file permissive=1 avc: denied { open } for path="/dev/kgsl-3d0" dev="tmpfs" ino=14956 scontext=u:r:hal_graphics_allocator:s0 tcontext=u:object_r:gpu_device:s0 tclass=chr_file permissive=1 avc: denied { ioctl } for path="/dev/kgsl-3d0" dev="tmpfs" ino=14956 ioctlcmd=940 scontext=u:r:hal_graphics_allocator:s0 tcontext=u:object_r:gpu_device:s0 tclass=chr_file permissive=1 binder_call(surfaceflinger, ...) for avc: denied { call } for scontext=u:r:surfaceflinger:s0 tcontext=u:r:hal_graphics_allocator:s0 tclass=binder permissive=1 allow ... ...:fd use for avc: denied { use } for path="anon_inode:dmabuf" dev="anon_inodefs" ino=12794 scontext=u:r:surfaceflinger:s0 tcontext=u:r:hal_graphics_allocator:s0 tclass=fd permissive=1 Bug: 32021161 Test: make bootimage Change-Id: Ie7700142313407ac438c43dd1a85544dc4c67f13
2016-10-12 06:38:00 -07:00
allow bootanim hal_graphics_allocator:fd use;
bootanim: Remove domain_deprecated Remove domain_deprecated from bootanim. This removes some unnecessarily permissive rules. As part of this, re-allow access to cgroups, proc and sysfs, removed as a result of removing domain_deprecated. Bug: 25433265 Change-Id: I58658712666c719c8f5a39fe2076c4f6d166616c
2015-12-02 13:29:20 -08:00
# Read access to pseudo filesystems.
r_dir_file(bootanim, proc)
bootanim: allow /proc/meminfo read Allow /proc/meminfo to be read by bootanim. Not sure why it's needed, but harmless enough. Modify domain_deprecated so it doesn't use r_dir_file(). /proc/meminfo is neither a symlink nor a directory, so it doesn't make sense to create allow rules for those classes of objects. Addresses the following denial: avc: denied { read } for comm="BootAnimation" name="meminfo" dev="proc" ino=4026536593 scontext=u:r:bootanim:s0 tcontext=u:object_r:proc_meminfo:s0 tclass=file permissive=0 This denial is only showing up on flounder, flounder_lte, or dragon devices. I'm not sure why. Change-Id: I0f808bcae47fc2fda512cd147c3b44593835cac5
2016-03-31 14:11:50 -07:00
allow bootanim proc_meminfo:file r_file_perms;
bootanim: Remove domain_deprecated Remove domain_deprecated from bootanim. This removes some unnecessarily permissive rules. As part of this, re-allow access to cgroups, proc and sysfs, removed as a result of removing domain_deprecated. Bug: 25433265 Change-Id: I58658712666c719c8f5a39fe2076c4f6d166616c
2015-12-02 13:29:20 -08:00
r_dir_file(bootanim, sysfs)
r_dir_file(bootanim, cgroup)
# System file accesses.
allow bootanim system_file:dir r_dir_perms;
Reference in New Issue Copy Permalink