platform_system_sepolicy/public/llkd.te

# llkd Live LocK Daemon
type llkd, domain, mlstrustedsubject;
type llkd_exec, system_file_type, exec_type, file_type;
llkd: add live-lock daemon Introduce a standalone live-lock daemon (llkd), to catch kernel or native user space deadlocks and take mitigating actions. Test: llkd_unit_test Bug: 33808187 Bug: 72838192 Change-Id: If869ecd06e5ce7b04bba1dafd0a77971b71aa517 2018-02-20 20:02:39 +01:00			`# llkd Live LocK Daemon`
			`type llkd, domain, mlstrustedsubject;`
Introduce system_file_type system_file_type is a new attribute used to identify files which exist on the /system partition. It's useful for allow rules in init, which are based off of a blacklist of writable files. Additionally, it's useful for constructing neverallow rules to prevent regressions. Additionally, add commented out tests which enforce that all files on the /system partition have the system_file_type attribute. These tests will be uncommented in a future change after all the device-specific policies are cleaned up. Test: Device boots and no obvious problems. Change-Id: Id9bae6625f042594c8eba74ca712abb09702c1e5 2018-09-27 19:21:37 +02:00			`type llkd_exec, system_file_type, exec_type, file_type;`