PWN-Hunter/android_system_sepolicy
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add policies for Atomic Display Framework

Browse Source 
ADF is a modern replacement for fbdev.

ADF's device nodes (/dev/adf[X]), interface nodes
(/dev/adf-interface[X].[Y]), and overlay engine nodes
(/dev/adf-overlay-engine[X].[Y]) are collectively used in similar
contexts as fbdev nodes.  Vendor HW composers (via SurfaceFlinger) and
healthd will need to send R/W ioctls to these nodes to prepare and
update the display.

Ordinary apps should not talk to ADF directly.

Change-Id: Ic0a76b1e82c0cc1e8f240f219928af1783e79343
Signed-off-by: Greg Hackmann <ghackmann@google.com>
This commit is contained in:
Greg Hackmann 2014-05-06 15:42:18 -07:00
parent 778520650a
commit 7004789de3
5 changed files with 12 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
app.te
View File

@ -191,8 +191,10 @@ neverallow { appdomain -unconfineddomain } {
}:chr_file { read write };
# Note: Try expanding list of app domains in the future.
neverallow { untrusted_app isolated_app shell -unconfineddomain }
graphics_device:chr_file { read write };
neverallow { untrusted_app isolated_app shell -unconfineddomain } {
adf_device
graphics_device
}:chr_file { read write };
neverallow { appdomain -nfc -unconfineddomain } nfc_device:chr_file
{ read write };

1
device.te
View File

@ -2,6 +2,7 @@
type device, dev_type, fs_type;
type alarm_device, dev_type, mlstrustedobject;
type adb_device, dev_type;
type adf_device, dev_type;
type ashmem_device, dev_type, mlstrustedobject;
type audio_device, dev_type;
type binder_device, dev_type, mlstrustedobject;

3
file_contexts
View File

@ -31,6 +31,9 @@
/dev(/.*)? u:object_r:device:s0
/dev/akm8973.* u:object_r:sensors_device:s0
/dev/accelerometer u:object_r:sensors_device:s0
/dev/adf[0-9]* u:object_r:adf_device:s0
/dev/adf-interface[0-9]*\.[0-9]* u:object_r:adf_device:s0
/dev/adf-overlay-engine[0-9]*\.[0-9]* u:object_r:adf_device:s0
/dev/alarm u:object_r:alarm_device:s0
/dev/android_adb.* u:object_r:adb_device:s0
/dev/ashmem u:object_r:ashmem_device:s0

1
healthd.te
View File

@ -23,6 +23,7 @@ allow healthd sysfs:file write;
### healthd: charger mode
###
allow healthd adf_device:chr_file rw_file_perms;
allow healthd graphics_device:dir r_dir_perms;
allow healthd graphics_device:chr_file rw_file_perms;
allow healthd input_device:dir r_dir_perms;

3
surfaceflinger.te
View File

@ -30,6 +30,9 @@ allow surfaceflinger gpu_device:chr_file rw_file_perms;
allow surfaceflinger graphics_device:dir search;
allow surfaceflinger graphics_device:chr_file rw_file_perms;
# Access ADF device nodes.
allow surfaceflinger adf_device:chr_file rw_file_perms;
# Access /dev/video1.
allow surfaceflinger video_device:dir r_dir_perms;
allow surfaceflinger video_device:chr_file rw_file_perms;