platform_system_sepolicy/vendor/hal_dumpstate_default.te

type hal_dumpstate_default, domain;
hal_server_domain(hal_dumpstate_default, hal_dumpstate)

type hal_dumpstate_default_exec, exec_type, vendor_file_type, file_type;
init_daemon_domain(hal_dumpstate_default)
Group all HAL impls using haldomain attribute This marks all HAL domain implementations with the haldomain attribute so that rules can be written which apply to all HAL implementations. This follows the pattern used for appdomain, netdomain and bluetoothdomain. Test: No change to policy according to sesearch. Bug: 34180936 Change-Id: I0cfe599b0d49feed36538503c226dfce41eb65f6 2017-01-11 00:54:25 +01:00			`type hal_dumpstate_default, domain;`
Switch Dumpstate HAL policy to _client/_server This switches Dumpstate HAL policy to the design which enables us to conditionally remove unnecessary rules from domains which are clients of Dumpstate HAL. Domains which are clients of Dumpstate HAL, such as dumpstate domain, are granted rules targeting hal_dumpstate only when the Dumpstate HAL runs in passthrough mode (i.e., inside the client's process). When the HAL runs in binderized mode (i.e., in another process/domain, with clients talking to the HAL over HwBinder IPC), rules targeting hal_dumpstate are not granted to client domains. Domains which offer a binderized implementation of Dumpstate HAL, such as hal_dumpstate_default domain, are always granted rules targeting hal_dumpstate. Test: adb bugreport Test: Take bugreport through system UI Bug: 34170079 Change-Id: I3e827534af03cdfa876921c5fa4af3a53025ba27 2017-02-22 19:15:24 +01:00			`hal_server_domain(hal_dumpstate_default, hal_dumpstate)`
Add hal_dumpstate attribute. - Also allow dumpstate to talk to hal_dumpstate. Bug: 31982882 Test: compiles Change-Id: Ib9cf0027ee7e71fa40b9ccc29fc8dccea6977e5c 2016-12-01 18:39:10 +01:00
sepolicy: make exec_types in /vendor a subset of vendor_file_type We install all default hal implementations in /vendor/bin/hw along with a few domains that are defined in vendor policy and installed in /vendor. These files MUST be a subset of the global 'vendor_file_type' which is used to address all files installed in /vendor throughout the policy. Bug: 36463595 Test: Boot sailfish without any new denials Change-Id: I3d26778f9a26f9095f49d8ecc12f2ec9d2f4cb41 Signed-off-by: Sandeep Patil <sspatil@google.com> 2017-04-10 22:03:28 +02:00			`type hal_dumpstate_default_exec, exec_type, vendor_file_type, file_type;`
Add hal_dumpstate attribute. - Also allow dumpstate to talk to hal_dumpstate. Bug: 31982882 Test: compiles Change-Id: Ib9cf0027ee7e71fa40b9ccc29fc8dccea6977e5c 2016-12-01 18:39:10 +01:00			`init_daemon_domain(hal_dumpstate_default)`