Evolution-x-devices/device_google_wahoo
2
0
Fork 0
mirror of https://github.com/Evolution-X-Devices/device_google_wahoo synced 2026-02-01 15:09:54 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge "Wahoo sepolicy changes" into oc-dr1-dev

Browse Source 
am: 271fd0c603

Change-Id: I517b359636cbffca257b848ca7f3cba1700d8b73
This commit is contained in:
Siddharth Ray
2017-07-07 02:32:09 +00:00
committed by android-build-merger
parent 4e04b9271e 271fd0c603
commit 07b52a0836
2 changed files with 50 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files

29
sepolicy/vendor/hal_gnss_qti.te vendored
View File

@@ -11,19 +11,34 @@ vndbinder_use(hal_gnss_qti)
allow hal_gnss_qti sysfs_soc:dir r_dir_perms;
allow hal_gnss_qti sysfs_soc:file r_file_perms;
binder_call(hal_gnss_qti, per_mgr)
allow hal_gnss_qti per_mgr_service:service_manager find;
# /data/vendor/location
allow hal_gnss_qti location_data_file:fifo_file { open read setattr write };
allow hal_gnss_qti location_data_file:dir create_dir_perms;
allow hal_gnss_qti location_data_file:file create_file_perms;
allow hal_gnss_qti location_data_file:sock_file write;
allow hal_gnss_qti location:unix_stream_socket connectto;
allow hal_gnss_qti self:socket create_socket_perms;
allowxperm hal_gnss_qti self:socket ioctl msm_sock_ipc_ioctls;
unix_socket_connect(hal_gnss_qti, netmgrd, netmgrd)
allow hal_gnss_qti netmgrd_socket:dir search;
allow hal_gnss_qti self:socket create_socket_perms;
allowxperm hal_gnss_qti self:socket ioctl msm_sock_ipc_ioctls;
allow hal_gnss_qti self:netlink_generic_socket { bind create read };
allow hal_gnss_qti self:netlink_route_socket { bind create nlmsg_read read write };
vndbinder_use(hal_gnss_qti)
binder_call(hal_gnss_qti, per_mgr)
allow hal_gnss_qti per_mgr_service:service_manager find;
# Most HALs are not allowed to use network sockets. Qcom library
# libqdi is used across multiple processes which are clients of
# netmgrd including the GNSS HAL. libqdi first attempts to get the network
# interface using an IOCTL on a UDP INET socket, which isn't allowed here.
# If that fails, it falls back to using libc's if_nameindex() which requires
# a netlink route socket, which HALs may use. Due to the initial
# attempt to use a UDP socket, we still see a selinux denial,
# but it is safe to ignore.
# TODO (b/37730994) Remove udp_socket requirement from
# libqdi and have all its clients use netlink route
# sockets.
dontaudit hal_gnss_qti self:udp_socket create;

39
sepolicy/vendor/location.te vendored
View File

@@ -1,32 +1,49 @@
# loc_launcher service
# which launches various other services supporting GPS & Wifi-RTT (LOWI) location
type location, domain;
type location_exec, exec_type, vendor_file_type, file_type;
init_daemon_domain(location)
# STOPSHIP b/28340421
# Temporarily grant this permission and log its use.
# Temporarily grant this permission (for LOWI) and log its use.
allow location self:capability { net_admin };
auditallow location self:capability { net_admin };
allow location location_exec:file execute_no_trans;
allow location self:capability { setgid setuid };
allow location proc_net:file r_file_perms;
hwbinder_use(location)
get_prop(location, hwservicemanager_prop)
allow location fwk_sensor_hwservice:hwservice_manager find;
binder_call(location, system_server)
allow location hal_wifi:unix_stream_socket { read write };
allow location location_data_file:dir create_dir_perms;
allow location location_data_file:{ file sock_file } create_file_perms;
# Enable standard network access (for XTRA download)
net_domain(location)
# And some additional network access
allow location self:netlink_generic_socket create_socket_perms_no_ioctl;
allow location self:netlink_socket create_socket_perms_no_ioctl;
allow location self:socket create_socket_perms;
allowxperm location self:udp_socket ioctl { SIOCGIFHWADDR SIOCIWFIRSTPRIV_05 };
allowxperm location self:socket ioctl msm_sock_ipc_ioctls;
allowxperm location self:udp_socket ioctl { SIOCGIFINDEX SIOCGIFHWADDR SIOCIWFIRSTPRIV_05 };
# Enable network access (for XTRA download)
net_domain(location)
allow location self:socket create_socket_perms;
# whitelist socket ioctl commands
allowxperm location self:socket ioctl msm_sock_ipc_ioctls;
# files in /sys
r_dir_file(location, sysfs_type)
dontaudit location kernel:system module_request;
allow location proc_net:file r_file_perms;
# execute /vendor/bin/lowi-server
allow location location_exec:file rx_file_perms;
# /data/vendor/location
allow location location_data_file:dir create_dir_perms;
allow location location_data_file:{ file sock_file } create_file_perms;
userdebug_or_eng(`
allow location diag_device:chr_file rw_file_perms;
')