platform_system_sepolicy/inputflinger.te

# inputflinger
type inputflinger, domain;
type inputflinger_exec, exec_type, file_type;

init_daemon_domain(inputflinger)
binder_use(inputflinger)
binder_service(inputflinger)

binder_call(inputflinger, system_server)

wakelock_use(inputflinger)

allow inputflinger inputflinger_service:service_manager { add find };
allow inputflinger input_device:dir r_dir_perms;
allow inputflinger input_device:chr_file rw_file_perms;
initial inputflinger domain Add a placeholder domain for inputflinger. Mark it initially unconfined and enforcing. Change-Id: I433fd9e1954486136cb8abb084b4e19bb7fc2f19 2013-12-15 21:50:00 +01:00			`# inputflinger`
			`type inputflinger, domain;`
			`type inputflinger_exec, exec_type, file_type;`

			`init_daemon_domain(inputflinger)`
			`binder_use(inputflinger)`
			`binder_service(inputflinger)`
Allow inputflinger to call system_server. Resolves denials such as: avc: denied { read } for pid=752 comm="ActivityManager" name="stat" dev="proc" ino=1878 scontext=u:r:system_server:s0 tcontext=u:r:inputflinger:s0 tclass=file avc: denied { open } for pid=752 comm="ActivityManager" name="stat" dev="proc" ino=1878 scontext=u:r:system_server:s0 tcontext=u:r:inputflinger:s0 tclass=file avc: denied { search } for pid=752 comm="ActivityManager" name="214" dev="proc" ino=1568 scontext=u:r:system_server:s0 tcontext=u:r:inputflinger:s0 tclass=dir avc: denied { read } for pid=752 comm="ActivityManager" name="stat" dev="proc" ino=1878 scontext=u:r:system_server:s0 tcontext=u:r:inputflinger:s0 tclass=file avc: denied { call } for pid=187 comm="Binder_2" scontext=u:r:inputflinger:s0 tcontext=u:r:system_server:s0 tclass=binder Change-Id: I099d7dacf7116efa73163245597c3de629d358c1 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov> 2014-03-21 15:40:56 +01:00
			`binder_call(inputflinger, system_server)`
Add SELinux rules for service_manager. Add a service_mananger class with the verb add. Add a type that groups the services for each of the processes that is allowed to start services in service.te and an attribute for all services controlled by the service manager. Add the service_contexts file which maps service name to target label. Bug: 12909011 Change-Id: I017032a50bc90c57b536e80b972118016d340c7d 2014-06-06 00:52:02 +02:00
Update selinux for inputflinger Allow CAP_BLOCK_SUSPEND Allow reading /dev/input/* (cherrypicked from commit 2133c2a167217574b3105c17614f1ff00b952e3e) Change-Id: I869a4921e024702300aa9ecba9cdf84ae2b6edac 2015-03-24 23:31:47 +01:00			`wakelock_use(inputflinger)`

Restrict service_manager find and list access. All domains are currently granted list and find service_manager permissions, but this is not necessary. Pare the permissions which did not trigger any of the auditallow reporting. Bug: 18106000 Change-Id: Ie0ce8de2af8af2cbe4ce388a2dcf4534694c994a 2014-12-12 01:01:27 +01:00			`allow inputflinger inputflinger_service:service_manager { add find };`
Update selinux for inputflinger Allow CAP_BLOCK_SUSPEND Allow reading /dev/input/* (cherrypicked from commit 2133c2a167217574b3105c17614f1ff00b952e3e) Change-Id: I869a4921e024702300aa9ecba9cdf84ae2b6edac 2015-03-24 23:31:47 +01:00			`allow inputflinger input_device:dir r_dir_perms;`
			`allow inputflinger input_device:chr_file rw_file_perms;`