tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
platform_system_sepolicy/public/hal_dumpstate.te

12 lines
535 B
Text
Raw Normal View History

Switch Dumpstate HAL policy to _client/_server This switches Dumpstate HAL policy to the design which enables us to conditionally remove unnecessary rules from domains which are clients of Dumpstate HAL. Domains which are clients of Dumpstate HAL, such as dumpstate domain, are granted rules targeting hal_dumpstate only when the Dumpstate HAL runs in passthrough mode (i.e., inside the client's process). When the HAL runs in binderized mode (i.e., in another process/domain, with clients talking to the HAL over HwBinder IPC), rules targeting hal_dumpstate are not granted to client domains. Domains which offer a binderized implementation of Dumpstate HAL, such as hal_dumpstate_default domain, are always granted rules targeting hal_dumpstate. Test: adb bugreport Test: Take bugreport through system UI Bug: 34170079 Change-Id: I3e827534af03cdfa876921c5fa4af3a53025ba27
2017-02-22 19:15:24 +01:00
# HwBinder IPC from client to server, and callbacks
binder_call(hal_dumpstate_client, hal_dumpstate_server)
binder_call(hal_dumpstate_server, hal_dumpstate_client)
hal_dumpstate: allow writing to bug report files Bug: 31982882 Test: works with wip bullhead binderized dumpstate implementation Change-Id: Iae964f49b3c2704688ded8e7366d89ace35a92aa
2016-12-29 03:45:14 +01:00
Restrict access to hwservicemanager This adds fine-grained policy about who can register and find which HwBinder services in hwservicemanager. Test: Play movie in Netflix and Google Play Movies Test: Play video in YouTube app and YouTube web page Test: In Google Camera app, take photo (HDR+ and conventional), record video (slow motion and normal), and check that photos look fine and videos play back with sound. Test: Cast screen to a Google Cast device Test: Get location fix in Google Maps Test: Make and receive a phone call, check that sound works both ways and that disconnecting the call frome either end works fine. Test: Run RsHelloCompute RenderScript demo app Test: Run fast subset of media CTS tests: make and install CtsMediaTestCases.apk adb shell am instrument -e size small \ -w 'android.media.cts/android.support.test.runner.AndroidJUnitRunner' Test: Play music using Google Play music Test: Adjust screen brightness via the slider in Quick Settings Test: adb bugreport Test: Enroll in fingerprint screen unlock, unlock screen using fingerprint Test: Apply OTA update: Make some visible change, e.g., rename Settings app. make otatools && \ make dist Ensure device has network connectivity ota_call.py -s <serial here> --file out/dist/sailfish-ota-*.zip Confirm the change is now live on the device Bug: 34454312 Change-Id: Iecf74000e6c68f01299667486f3c767912c076d3
2017-04-14 04:05:27 +02:00
add_hwservice(hal_dumpstate_server, hal_dumpstate_hwservice)
allow hal_dumpstate_client hal_dumpstate_hwservice:hwservice_manager find;
hal_dumpstate: allow writing to bug report files Bug: 31982882 Test: works with wip bullhead binderized dumpstate implementation Change-Id: Iae964f49b3c2704688ded8e7366d89ace35a92aa
2016-12-29 03:45:14 +01:00
# write bug reports in /data/data/com.android.shell/files/bugreports/bugreport
allow hal_dumpstate shell_data_file:file write;
dumpstate: allow HALs to read /proc/interrupts /proc/interrupts may be dumped by dumpstate HAL if required. Bug: 36486169 Test: 'adb shell bugreport' on sailfish Change-Id: Ifc41a516aeea846bc56b86b064bda555b43c58ed Signed-off-by: Sandeep Patil <sspatil@google.com>
2017-03-22 20:44:16 +01:00
# allow reading /proc/interrupts for all hal impls
allow hal_dumpstate proc_interrupts:file r_file_perms;
Reference in a new issue Copy permalink