PWN-Hunter/android_system_sepolicy
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Restrict access to suspend control

Browse Source 
Test: m selinux_policy
Change-Id: Ieccfd2aa059da065ace4f2db1b9634c52dd2cb24
This commit is contained in:
Tri Vo 2019-02-07 13:29:39 -08:00
parent d99b7fd3f9
commit 131fa73add
3 changed files with 11 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
private/system_app.te
View File

@ -80,6 +80,7 @@ allow system_app {
-iorapd_service
-ipmemorystore_service
-netd_service
-system_suspend_control_service
-virtual_touchpad_service
-vold_service
-vr_hwc_service

9
private/system_suspend.te
View File

@ -9,3 +9,12 @@ add_service(system_suspend, system_suspend_control_service)
# Access to /sys/power/{ wakeup_count, state } suspend interface.
allow system_suspend sysfs_power:file rw_file_perms;
neverallow {
domain
-atrace # tracing
-dumpstate # bug reports
-system_suspend # implements system_suspend_control_service
-system_server # configures system_suspend via ISuspendControlService
-traceur_app # tracing
} system_suspend_control_service:service_manager find;

1
public/shell.te
View File

@ -116,6 +116,7 @@ allow shell {
-installd_service
-iorapd_service
-netd_service
-system_suspend_control_service
-virtual_touchpad_service
-vold_service
-vr_hwc_service