Evolution-x-devices/device_google_wahoo
2
0
Fork 0
mirror of https://github.com/Evolution-X-Devices/device_google_wahoo synced 2026-02-01 07:50:47 +00:00
Code Issues Packages Projects Releases Wiki Activity

Ban sharing data between platform and vendor processes

Browse Source 
Annotate processes that violate the ban including fingerprint and
widevine HALs.

Bug: 34980020
Test: build
Change-Id: I4afa03841e1648d4624e66bbd5ed21d09d357547
This commit is contained in:
Jeff Vander Stoep
2017-11-02 14:46:44 -07:00
parent ef4aac3023
commit 458d1f6a6e
4 changed files with 9 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
sepolicy/private/ramoops.te
View File

@@ -1,5 +1,5 @@
type ramoops, domain, coredomain;
type ramoops_data_file, file_type, data_file_type;
type ramoops_data_file, file_type, data_file_type, core_data_file_type;
type ramoops_exec, exec_type, file_type;
init_daemon_domain(ramoops);

2
sepolicy/public/file.te
View File

@@ -1,2 +1,2 @@
type elabel_data_file, file_type, data_file_type;
type elabel_data_file, file_type, data_file_type, core_data_file_type;
type sysfs_pstore, sysfs_type, fs_type;

4
sepolicy/vendor/hal_drm_widevine.te vendored
View File

@@ -15,3 +15,7 @@ allow hal_drm { appdomain -isolated_app }:fd use;
# by the HWC HAL.
allow hal_drm_widevine qdisplay_service:service_manager { find };
binder_call(hal_drm_widevine, hal_graphics_composer)
# TODO(b/36601695): Remove data_between_core_and_vendor violators once
# hal_drm no longer directly accesses media_data_file.
typeattribute hal_drm_widevine data_between_core_and_vendor_violators;

4
sepolicy/vendor/tee.te vendored
View File

@@ -16,8 +16,10 @@ allow tee persist_drm_file:file create_file_perms;
allow tee persist_data_file:dir create_dir_perms;
allow tee persist_data_file:file create_file_perms;
# TODO(b/36644492): Remove data_between_core_and_vendor_violators once
# tee no longer directly accesses /data owned by the frameworks.
typeattribute tee data_between_core_and_vendor_violators;
allow tee system_data_file:dir r_dir_perms;
allow tee fingerprintd_data_file:dir rw_dir_perms;
allow tee fingerprintd_data_file:file create_file_perms;