b23d287681
On manta, the keystore CTS tests are failing, because
keystore isn't allowed to talk to the tee. Allow it.
I've only seen this bug on manta, but it seems appropriate
for all domains.
Fixes the following denial:
<5>[ 286.249563] type=1400 audit(1389210059.924:6): avc: denied { connectto } for pid=126 comm="keystore" path=006D636461656D6F6E scontext=u:r:keystore:s0 tcontext=u:r:tee:s0 tclass=unix_stream_socket
Bug: 12450710
Change-Id: I07133d9abeaf967392118ba478a5a391cf0c5fa5
14 lines
477 B
Plaintext
14 lines
477 B
Plaintext
type keystore, domain;
|
|
type keystore_exec, exec_type, file_type;
|
|
|
|
# keystore daemon
|
|
init_daemon_domain(keystore)
|
|
typeattribute keystore mlstrustedsubject;
|
|
binder_use(keystore)
|
|
binder_service(keystore)
|
|
allow keystore keystore_data_file:dir create_dir_perms;
|
|
allow keystore keystore_data_file:notdevfile_class_set create_file_perms;
|
|
allow keystore keystore_exec:file { getattr };
|
|
allow keystore tee_device:chr_file rw_file_perms;
|
|
allow keystore tee:unix_stream_socket connectto;
|