tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
platform_system_sepolicy/public/bootanim.te

39 lines
1 KiB
Text
Raw Normal View History

Define a domain for the bootanim service. Leave the domain permissive initially until it gets more testing. Change-Id: I9d88d76d1ffdc79a2eff4545d37a9e615482df50 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-12-11 21:17:53 +01:00
# bootanimation oneshot service
bootanim: Remove domain_deprecated Remove domain_deprecated from bootanim. This removes some unnecessarily permissive rules. As part of this, re-allow access to cgroups, proc and sysfs, removed as a result of removing domain_deprecated. Bug: 25433265 Change-Id: I58658712666c719c8f5a39fe2076c4f6d166616c
2015-12-02 22:29:20 +01:00
type bootanim, domain;
Define a domain for the bootanim service. Leave the domain permissive initially until it gets more testing. Change-Id: I9d88d76d1ffdc79a2eff4545d37a9e615482df50 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-12-11 21:17:53 +01:00
type bootanim_exec, exec_type, file_type;
binder_use(bootanim)
binder_call(bootanim, surfaceflinger)
Allow audioserver for bootanim. (cherry picked from commit ad5b4be399f18c4755c0d469aab2aacd4de68df6) Required for using native audio in BootAnimation Bug: 29055299 Change-Id: Ie75d35219be95a8dc697cc3c0384a4de90ea3478
2016-06-29 23:14:34 +02:00
binder_call(bootanim, audioserver)
Define a domain for the bootanim service. Leave the domain permissive initially until it gets more testing. Change-Id: I9d88d76d1ffdc79a2eff4545d37a9e615482df50 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-12-11 21:17:53 +01:00
Allow bootanimation to talk to hwservicemanager. Because bootanimation uses the graphics mapper HIDL service (which is always passthrough), it makes a call to hwservicemanager to let it know it has obtained a reference to it. Bug: 35207188 Test: no more denials from bootanim Change-Id: I99ea57a0d7777cb84eeaca26426ea38bf72ee933
2017-02-15 13:38:33 +01:00
hwbinder_use(bootanim)
Define a domain for the bootanim service. Leave the domain permissive initially until it gets more testing. Change-Id: I9d88d76d1ffdc79a2eff4545d37a9e615482df50 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-12-11 21:17:53 +01:00
allow bootanim gpu_device:chr_file rw_file_perms;
reconcile aosp (3a8c5dc05fb7696dd81b8a7c1b2524224154e8ea) after branching. Please do not merge. Change-Id: Ic8ee83ed6ffef02bddd17e1175416fc2481db7b2
2014-07-15 08:31:31 +02:00
# /oem access
allow bootanim oemfs:dir search;
sepolicy for oem cutomization Added read permissions for bootanimation Bug: 16635599 Change-Id: Ib5d0ba5a6d1144ff831f4f0eda092879f853c376
2014-09-22 22:03:52 +02:00
allow bootanim oemfs:file r_file_perms;
Resync lmp-dev-plus-aosp with master A DO NOT MERGE change merged from lmp-dev to lmp-dev-plus-aosp. This is expected, but it's causing unnecessary merge conflicts when handling AOSP contributions. Resolve those conflicts. This is essentially a revert of bf696327246833c9aba55a645e6c433e9f321e27 for lmp-dev-plus-aosp only. Change-Id: Icc66def7113ab45176ae015f659cb442d53bce5c
2014-07-26 00:19:47 +02:00
Give bootanimation access to /dev/snd files so it can use tinyalsa Bug: 17674304 Change-Id: Ide32833809bca8d3ed8ddc898748e25d7a692319
2014-09-29 15:18:19 +02:00
allow bootanim audio_device:dir r_dir_perms;
allow bootanim audio_device:chr_file rw_file_perms;
resolved conflicts for merge of 0a52df50 to lmp-dev-plus-aosp Change-Id: I3c6af086fc8ca3e9600c2267c439718c9a572dfb
2014-10-06 20:56:31 +02:00
Allow audioserver for bootanim. (cherry picked from commit ad5b4be399f18c4755c0d469aab2aacd4de68df6) Required for using native audio in BootAnimation Bug: 29055299 Change-Id: Ie75d35219be95a8dc697cc3c0384a4de90ea3478
2016-06-29 23:14:34 +02:00
allow bootanim audioserver_service:service_manager find;
Restrict service_manager find and list access. All domains are currently granted list and find service_manager permissions, but this is not necessary. Pare the permissions which did not trigger any of the auditallow reporting. Bug: 18106000 Change-Id: Ie0ce8de2af8af2cbe4ce388a2dcf4534694c994a
2014-12-12 01:01:27 +01:00
allow bootanim surfaceflinger_service:service_manager find;
DO NOT MERGE - fix truncated boot sound. Allow bootanim process to access audioserver service. Bug: 31651778 Change-Id: I5bec8812877792b1df3b37dddc5ccea3b243f5c4
2016-09-23 23:20:16 +02:00
allow bootanim audioserver_service:service_manager find;
bootanim: Remove domain_deprecated Remove domain_deprecated from bootanim. This removes some unnecessarily permissive rules. As part of this, re-allow access to cgroups, proc and sysfs, removed as a result of removing domain_deprecated. Bug: 25433265 Change-Id: I58658712666c719c8f5a39fe2076c4f6d166616c
2015-12-02 22:29:20 +01:00
# Allow access to ion memory allocation device
allow bootanim ion_device:chr_file rw_file_perms;
Add sepolicy for gralloc-alloc HAL Allow SurfaceFlinger to call into IAllocator, and allow everyone to access IAllocator's fd. Specifically, hwbinder_use(...) for avc: denied { call } for scontext=u:r:hal_graphics_allocator:s0 tcontext=u:r:hwservicemanager:s0 tclass=binder permissive=1 avc: denied { transfer } for scontext=u:r:hal_graphics_allocator:s0 tcontext=u:r:hwservicemanager:s0 tclass=binder permissive=1 allow ... ion_device:chr_file r_file_perms for avc: denied { read } for name="ion" dev="tmpfs" ino=15014 scontext=u:r:hal_graphics_allocator:s0 tcontext=u:object_r:ion_device:s0 tclass=chr_file permissive=1 avc: denied { open } for path="/dev/ion" dev="tmpfs" ino=15014 scontext=u:r:hal_graphics_allocator:s0 tcontext=u:object_r:ion_device:s0 tclass=chr_file permissive=1 avc: denied { ioctl } for path="/dev/ion" dev="tmpfs" ino=15014 ioctlcmd=4900 scontext=u:r:hal_graphics_allocator:s0 tcontext=u:object_r:ion_device:s0 tclass=chr_file permissive=1 allow ... gpu_device:chr_file rw_file_perms; for avc: denied { read write } for name="kgsl-3d0" dev="tmpfs" ino=14956 scontext=u:r:hal_graphics_allocator:s0 tcontext=u:object_r:gpu_device:s0 tclass=chr_file permissive=1 avc: denied { open } for path="/dev/kgsl-3d0" dev="tmpfs" ino=14956 scontext=u:r:hal_graphics_allocator:s0 tcontext=u:object_r:gpu_device:s0 tclass=chr_file permissive=1 avc: denied { ioctl } for path="/dev/kgsl-3d0" dev="tmpfs" ino=14956 ioctlcmd=940 scontext=u:r:hal_graphics_allocator:s0 tcontext=u:object_r:gpu_device:s0 tclass=chr_file permissive=1 binder_call(surfaceflinger, ...) for avc: denied { call } for scontext=u:r:surfaceflinger:s0 tcontext=u:r:hal_graphics_allocator:s0 tclass=binder permissive=1 allow ... ...:fd use for avc: denied { use } for path="anon_inode:dmabuf" dev="anon_inodefs" ino=12794 scontext=u:r:surfaceflinger:s0 tcontext=u:r:hal_graphics_allocator:s0 tclass=fd permissive=1 Bug: 32021161 Test: make bootimage Change-Id: Ie7700142313407ac438c43dd1a85544dc4c67f13
2016-10-12 15:38:00 +02:00
allow bootanim hal_graphics_allocator:fd use;
bootanim: Remove domain_deprecated Remove domain_deprecated from bootanim. This removes some unnecessarily permissive rules. As part of this, re-allow access to cgroups, proc and sysfs, removed as a result of removing domain_deprecated. Bug: 25433265 Change-Id: I58658712666c719c8f5a39fe2076c4f6d166616c
2015-12-02 22:29:20 +01:00
Add sepolicy for hwcomposer HAL Allow SurfaceFlinger to call into IComposer, and vice versa for IComposerCallback. Specifically, hwbinder_use(...) for avc: denied { call } for scontext=u:r:hal_graphics_composer:s0 tcontext=u:r:hwservicemanager:s0 tclass=binder permissive=1 avc: denied { transfer } for scontext=u:r:hal_graphics_composer:s0 tcontext=u:r:hwservicemanager:s0 tclass=binder permissive=1 binder_call(..., surfaceflinger) for avc: denied { call } for scontext=u:r:hal_graphics_composer:s0 tcontext=u:r:surfaceflinger:s0 tclass=binder permissive=1 allow ... gpu_device:chr_file rw_file_perms for avc: denied { read write } for name="kgsl-3d0" dev="tmpfs" ino=14956 scontext=u:r:hal_graphics_composer:s0 tcontext=u:object_r:gpu_device:s0 tclass=chr_file permissive=1 avc: denied { open } for path="/dev/kgsl-3d0" dev="tmpfs" ino=14956 scontext=u:r:hal_graphics_composer:s0 tcontext=u:object_r:gpu_device:s0 tclass=chr_file permissive=1 avc: denied { ioctl } for path="/dev/kgsl-3d0" dev="tmpfs" ino=14956 ioctlcmd=940 scontext=u:r:hal_graphics_composer:s0 tcontext=u:object_r:gpu_device:s0 tclass=chr_file permissive=1 allow ... ion_device:chr_file r_file_perms for avc: denied { ioctl } for path="/dev/ion" dev="tmpfs" ino=15014 ioctlcmd=4900 scontext=u:r:hal_graphics_composer:s0 tcontext=u:object_r:ion_device:s0 tclass=chr_file permissive=1 allow ... graphics_device ... for avc: denied { ioctl } for path="/dev/graphics/fb0" dev="tmpfs" ino=15121 ioctlcmd=5380 scontext=u:r:hal_graphics_composer:s0 tcontext=u:object_r:graphics_device:s0 tclass=chr_file permissive=1 allow ... ...:fd use for avc: denied { use } for path="anon_inode:dmabuf" dev="anon_inodefs" ino=12794 scontext=u:r:hal_graphics_composer:s0 tcontext=u:r:hal_graphics_allocator_service:s0 tclass=fd permissive=1 avc: denied { use } for path="anon_inode:sync_fence" dev="anon_inodefs" ino=12794 scontext=u:r:hal_graphics_composer:s0 tcontext=u:r:bootanim:s0 tclass=fd permissive=1 avc: denied { use } for path="anon_inode:sync_fence" dev="anon_inodefs" ino=12794 scontext=u:r:hal_graphics_composer:s0 tcontext=u:r:surfaceflinger:s0 tclass=fd permissive=1 avc: denied { use } for path="anon_inode:sync_fence" dev="anon_inodefs" ino=12794 scontext=u:r:hal_graphics_composer:s0 tcontext=u:r:platform_app:s0:c512,c768 tclass=fd permissive=1 binder_call(surfaceflinger, ...) for avc: denied { call } for scontext=u:r:surfaceflinger:s0 tcontext=u:r:hal_graphics_composer:s0 tclass=binder permissive=1 avc: denied { transfer } for scontext=u:r:surfaceflinger:s0 tcontext=u:r:hal_graphics_composer:s0 tclass=binder permissive=1 avc: denied { use } for path="anon_inode:sync_fence" dev="anon_inodefs" ino=12794 ioctlcmd=3e02 scontext=u:r:surfaceflinger:s0 tcontext=u:r:hal_graphics_composer:s0 tclass=fd permissive=1 avc: denied { use } for path="anon_inode:sync_fence" dev="anon_inodefs" ino=12794 scontext=u:r:surfaceflinger:s0 tcontext=u:r:hal_graphics_composer:s0 tclass=fd permissive=1 allow bootanim ...:fd use for avc: denied { use } for path="anon_inode:sync_fence" dev="anon_inodefs" ino=11947 scontext=u:r:bootanim:s0 tcontext=u:r:hal_graphics_composer:s0 tclass=fd permissive=1 Bug: 32021609 Test: make bootimage Change-Id: I036cdbebf0c619fef7559f294f1865f381b17588
2016-10-18 04:58:22 +02:00
# Fences
allow bootanim hal_graphics_composer:fd use;
bootanim: Remove domain_deprecated Remove domain_deprecated from bootanim. This removes some unnecessarily permissive rules. As part of this, re-allow access to cgroups, proc and sysfs, removed as a result of removing domain_deprecated. Bug: 25433265 Change-Id: I58658712666c719c8f5a39fe2076c4f6d166616c
2015-12-02 22:29:20 +01:00
# Read access to pseudo filesystems.
r_dir_file(bootanim, proc)
bootanim: allow /proc/meminfo read Allow /proc/meminfo to be read by bootanim. Not sure why it's needed, but harmless enough. Modify domain_deprecated so it doesn't use r_dir_file(). /proc/meminfo is neither a symlink nor a directory, so it doesn't make sense to create allow rules for those classes of objects. Addresses the following denial: avc: denied { read } for comm="BootAnimation" name="meminfo" dev="proc" ino=4026536593 scontext=u:r:bootanim:s0 tcontext=u:object_r:proc_meminfo:s0 tclass=file permissive=0 This denial is only showing up on flounder, flounder_lte, or dragon devices. I'm not sure why. Change-Id: I0f808bcae47fc2fda512cd147c3b44593835cac5
2016-03-31 23:11:50 +02:00
allow bootanim proc_meminfo:file r_file_perms;
bootanim: Remove domain_deprecated Remove domain_deprecated from bootanim. This removes some unnecessarily permissive rules. As part of this, re-allow access to cgroups, proc and sysfs, removed as a result of removing domain_deprecated. Bug: 25433265 Change-Id: I58658712666c719c8f5a39fe2076c4f6d166616c
2015-12-02 22:29:20 +01:00
r_dir_file(bootanim, sysfs)
r_dir_file(bootanim, cgroup)
# System file accesses.
allow bootanim system_file:dir r_dir_perms;
Reference in a new issue Copy permalink