platform_system_sepolicy/public/hal_sensors.te

# HwBinder IPC from client to server
binder_call(hal_sensors_client, hal_sensors_server)

hal_attribute_hwservice(hal_sensors, hal_sensors_hwservice)

# Allow sensor hals to access ashmem memory allocated by apps
allow hal_sensors { appdomain -isolated_app }:fd use;

# Allow sensor hals to access ashmem memory allocated by android.hidl.allocator
# fd is passed in from framework sensorservice HAL.
allow hal_sensors hal_allocator:fd use;

# allow to run with real-time scheduling policy
allow hal_sensors self:global_capability_class_set sys_nice;

add_service(hal_sensors_server, hal_sensors_service)
binder_call(hal_sensors_server, servicemanager)

allow hal_sensors_client hal_sensors_service:service_manager find;
Switch Sensors HAL policy to _client/_server This switches Sensors HAL policy to the design which enables us to conditionally remove unnecessary rules from domains which are clients of Sensors HAL. Domains which are clients of Sensors HAL, such as system_server, are granted rules targeting hal_sensors only when the Sensors HAL runs in passthrough mode (i.e., inside the client's process). When the HAL runs in binderized mode (i.e., in another process/domain, with clients talking to the HAL over HwBinder IPC), rules targeting hal_sensors are not granted to client domains. Domains which offer a binderized implementation of Sensors HAL, such as hal_sensors_default domain, are always granted rules targeting hal_sensors. P. S. This commit also removes allow system_server sensors_device:chr_file rw_file_perms because this is device-specific and thus not needed in device-agnostic policy. The device-specific policy of the affected devices already has this rule. Test: Device boots, no new denials Test: adb shell dumpsys sensorservice lists tons of sensors Test: Proprietary sensors test app indicates that there are sensors and that the app can register to listen for updates for sensors and that such updates arrive to the app. Bug: 34170079 Change-Id: I61bf779070eabcb64ae73724d62b6e837319a668 2017-03-13 23:13:52 +01:00			`# HwBinder IPC from client to server`
			`binder_call(hal_sensors_client, hal_sensors_server)`

hal_attribute_hwservice_client drop '_client' Since this attribute just associates a hal_attribute with a given hwservice in the standard way. Bug: 80319537 Test: boot + sanity + test for denials Change-Id: I545de165515387317e6920ce8f5e8c491f9ab24e 2018-06-06 18:30:18 +02:00			`hal_attribute_hwservice(hal_sensors, hal_sensors_hwservice)`
Restrict access to hwservicemanager This adds fine-grained policy about who can register and find which HwBinder services in hwservicemanager. Test: Play movie in Netflix and Google Play Movies Test: Play video in YouTube app and YouTube web page Test: In Google Camera app, take photo (HDR+ and conventional), record video (slow motion and normal), and check that photos look fine and videos play back with sound. Test: Cast screen to a Google Cast device Test: Get location fix in Google Maps Test: Make and receive a phone call, check that sound works both ways and that disconnecting the call frome either end works fine. Test: Run RsHelloCompute RenderScript demo app Test: Run fast subset of media CTS tests: make and install CtsMediaTestCases.apk adb shell am instrument -e size small \ -w 'android.media.cts/android.support.test.runner.AndroidJUnitRunner' Test: Play music using Google Play music Test: Adjust screen brightness via the slider in Quick Settings Test: adb bugreport Test: Enroll in fingerprint screen unlock, unlock screen using fingerprint Test: Apply OTA update: Make some visible change, e.g., rename Settings app. make otatools && \ make dist Ensure device has network connectivity ota_call.py -s <serial here> --file out/dist/sailfish-ota-*.zip Confirm the change is now live on the device Bug: 34454312 (cherry picked from commit 632bc494f199d9d85c37c1751667fe41f4b094cb) Merged-In: Iecf74000e6c68f01299667486f3c767912c076d3 Change-Id: I7a9a487beaf6f30c52ce08e04d415624da49dd31 2017-04-14 04:05:27 +02:00
Switch Sensors HAL policy to _client/_server This switches Sensors HAL policy to the design which enables us to conditionally remove unnecessary rules from domains which are clients of Sensors HAL. Domains which are clients of Sensors HAL, such as system_server, are granted rules targeting hal_sensors only when the Sensors HAL runs in passthrough mode (i.e., inside the client's process). When the HAL runs in binderized mode (i.e., in another process/domain, with clients talking to the HAL over HwBinder IPC), rules targeting hal_sensors are not granted to client domains. Domains which offer a binderized implementation of Sensors HAL, such as hal_sensors_default domain, are always granted rules targeting hal_sensors. P. S. This commit also removes allow system_server sensors_device:chr_file rw_file_perms because this is device-specific and thus not needed in device-agnostic policy. The device-specific policy of the affected devices already has this rule. Test: Device boots, no new denials Test: adb shell dumpsys sensorservice lists tons of sensors Test: Proprietary sensors test app indicates that there are sensors and that the app can register to listen for updates for sensors and that such updates arrive to the app. Bug: 34170079 Change-Id: I61bf779070eabcb64ae73724d62b6e837319a668 2017-03-13 23:13:52 +01:00			`# Allow sensor hals to access ashmem memory allocated by apps`
			`allow hal_sensors { appdomain -isolated_app }:fd use;`
Allow hal_sensors to use ashmem from android.hidl.allocator android.framework.sensorservice@1.0 pass a file descriptor from hidl_memory into android.hardware.sensors@1.0, hence requiring the latter to use the file descriptor. Test: VtsHalSensorManagerV1_0TargetTest under selinux enforcing mode Bug: 35219747 Change-Id: I0185c8af0714776842c90ebb687b684324b55cd8 2017-04-04 22:44:46 +02:00
			`# Allow sensor hals to access ashmem memory allocated by android.hidl.allocator`
			`# fd is passed in from framework sensorservice HAL.`
			`allow hal_sensors hal_allocator:fd use;`
Grant CAP_SYS_NICE to processes that need it. New binder kernel changes extend the areas where binder will set real-time scheduling priorities on threads; to make sure the driver can correctly determine whether a process is allowed to run at real-time priority or not, add the capability to the services that need it. Bug: 37293077 Test: processes run at real-time prio on incoming real-time binder calls. Change-Id: Ia4b3e5ecb1f5e18e7272bdaaad5c31a856719633 2017-05-09 18:53:46 +02:00
			`# allow to run with real-time scheduling policy`
sepolicy: Add rules for non-init namespaces In kernel 4.7, the capability and capability2 classes were split apart from cap_userns and cap2_userns (see kernel commit 8e4ff6f228e4722cac74db716e308d1da33d744f). Since then, Android cannot be run in a container with SELinux in enforcing mode. This change applies the existing capability rules to user namespaces as well as the root namespace so that Android running in a container behaves the same on pre- and post-4.7 kernels. This is essentially: 1. New global_capability_class_set and global_capability2_class_set that match capability+cap_userns and capability2+cap2_userns, respectively. 2. s/self:capability/self:global_capability_class_set/g 3. s/self:capability2/self:global_capability2_class_set/g 4. Add cap_userns and cap2_userns to the existing capability_class_set so that it covers all capabilities. This set was used by several neverallow and dontaudit rules, and I confirmed that the new classes are still appropriate. Test: diff new policy against old and confirm that all new rules add only cap_userns or cap2_userns; Boot ARC++ on a device with the 4.12 kernel. Bug: crbug.com/754831 Change-Id: I4007eb3a2ecd01b062c4c78d9afee71c530df95f 2017-11-09 23:51:26 +01:00			`allow hal_sensors self:global_capability_class_set sys_nice;`
Sensors stable AIDL HAL sepolicy Bug: 195593357 Test: TreeHugger Change-Id: I02b88a93d829654a1ce946681b59e648b2cd7550 2021-10-15 17:47:13 +02:00
			`add_service(hal_sensors_server, hal_sensors_service)`
			`binder_call(hal_sensors_server, servicemanager)`

			`allow hal_sensors_client hal_sensors_service:service_manager find;`