platform_system_sepolicy/public/prng_seeder.te

# PRNG seeder daemon
type prng_seeder, domain;

# system/sepolicy/public is for vendor-facing type and attribute definitions.
# DO NOT ADD allow, neverallow, or dontaudit statements here.
# Instead, add such policy rules to system/sepolicy/private/*.te.
Add SEPolicy for PRNG seeder daemon. Manual testing protocol: * Verify prng_seeder daemon is running and has the correct label (via ps -Z) * Verify prng_seeder socket present and has correct label (via ls -Z) * Verify no SELinux denials * strace a libcrypto process and verify it reads seeding data from prng_seeder (e.g. strace bssl rand -hex 1024) * strace seeder daemon to observe incoming connections (e.g. strace -f -p `pgrep prng_seeder`) * Kill daemon, observe that init restarts it * strace again and observe clients now seed from new instance Bug: 243933553 Test: Manual - see above Change-Id: I0a7e339115a2cf6b819730dcf5f8b189a339c57d 2022-09-16 16:31:39 +02:00			`# PRNG seeder daemon`
			`type prng_seeder, domain;`
Add "DO NOT ADD statements" comments to public For visibility Bug: 232023812 Test: N/A Change-Id: I0bc6dc568210b81ba1f52acb18afd4bcc454ea1c 2024-03-28 02:37:28 +01:00
			`# system/sepolicy/public is for vendor-facing type and attribute definitions.`
			`# DO NOT ADD allow, neverallow, or dontaudit statements here.`
			`# Instead, add such policy rules to system/sepolicy/private/*.te.`