tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
platform_system_sepolicy/public/charger.te

49 lines
1.5 KiB
Text
Raw Normal View History

healthd: create SEPolicy for 'charger' and reduce healthd's scope healthd is being split into 'charger' and 'healthd' processes, that will never run together. 'charger' is to be run only in charge-only and recovery, while healthd runs with Android. While they both share much of battery monitoring code, they both now have reduced scope. E.g. 'charger', doesn't need to use binder anymore and healthd doesn't need to do charging ui animation. So, amend the SEPolicy for healthd to reduce it's scope and add a new one for charger. Test: Tested all modes {recovery, charger-only, android} with new policy Change-Id: If7f81875c605f7f07da4d23a313f308b9dde9ce8 Signed-off-by: Sandeep Patil <sspatil@google.com>
2016-11-01 21:49:10 +01:00
type charger, domain;
Move /sbin/charger to /system/bin/charger. With the CLs in the same topic, it's being built as a dynamically linked executable. And this applies to normal boot (including charger mode) and recovery mode both. /system/bin/charger under normal boot will be labeled as charger_exec, which has the attribute of system_file_type. The file in recovery image will still be labeled as rootfs. So we keep the domain_trans rule for rootfs file, but allowing for recovery mode only. Bug: 73660730 Test: Boot into charger mode on taimen. Check that charger UI works. Test: Boot into recovery mode. Check that charger process works. Change-Id: I062d81c346578cdfce1cc2dce18c829387a1fdbc
2018-09-08 00:05:33 +02:00
type charger_exec, system_file_type, exec_type, file_type;
healthd: create SEPolicy for 'charger' and reduce healthd's scope healthd is being split into 'charger' and 'healthd' processes, that will never run together. 'charger' is to be run only in charge-only and recovery, while healthd runs with Android. While they both share much of battery monitoring code, they both now have reduced scope. E.g. 'charger', doesn't need to use binder anymore and healthd doesn't need to do charging ui animation. So, amend the SEPolicy for healthd to reduce it's scope and add a new one for charger. Test: Tested all modes {recovery, charger-only, android} with new policy Change-Id: If7f81875c605f7f07da4d23a313f308b9dde9ce8 Signed-off-by: Sandeep Patil <sspatil@google.com>
2016-11-01 21:49:10 +01:00
# Write to /dev/kmsg
allow charger kmsg_device:chr_file rw_file_perms;
# Read access to pseudo filesystems.
r_dir_file(charger, rootfs)
r_dir_file(charger, cgroup)
charger: allow to read /sys/class/power_supply Test: charger mode correctly shuts off when unplugged Change-Id: I06a7ffad67beb9f6d9642c4f53c35067b0dc2b3d Fixes: 71328882
2018-01-19 00:36:07 +01:00
# Allow to read /sys/class/power_supply directory
allow charger sysfs_type:dir r_dir_perms;
sepolicy: Add rules for non-init namespaces In kernel 4.7, the capability and capability2 classes were split apart from cap_userns and cap2_userns (see kernel commit 8e4ff6f228e4722cac74db716e308d1da33d744f). Since then, Android cannot be run in a container with SELinux in enforcing mode. This change applies the existing capability rules to user namespaces as well as the root namespace so that Android running in a container behaves the same on pre- and post-4.7 kernels. This is essentially: 1. New global_capability_class_set and global_capability2_class_set that match capability+cap_userns and capability2+cap2_userns, respectively. 2. s/self:capability/self:global_capability_class_set/g 3. s/self:capability2/self:global_capability2_class_set/g 4. Add cap_userns and cap2_userns to the existing capability_class_set so that it covers all capabilities. This set was used by several neverallow and dontaudit rules, and I confirmed that the new classes are still appropriate. Test: diff new policy against old and confirm that all new rules add only cap_userns or cap2_userns; Boot ARC++ on a device with the 4.12 kernel. Bug: crbug.com/754831 Change-Id: I4007eb3a2ecd01b062c4c78d9afee71c530df95f
2017-11-09 23:51:26 +01:00
allow charger self:global_capability_class_set { sys_tty_config };
allow charger self:global_capability_class_set sys_boot;
healthd: create SEPolicy for 'charger' and reduce healthd's scope healthd is being split into 'charger' and 'healthd' processes, that will never run together. 'charger' is to be run only in charge-only and recovery, while healthd runs with Android. While they both share much of battery monitoring code, they both now have reduced scope. E.g. 'charger', doesn't need to use binder anymore and healthd doesn't need to do charging ui animation. So, amend the SEPolicy for healthd to reduce it's scope and add a new one for charger. Test: Tested all modes {recovery, charger-only, android} with new policy Change-Id: If7f81875c605f7f07da4d23a313f308b9dde9ce8 Signed-off-by: Sandeep Patil <sspatil@google.com>
2016-11-01 21:49:10 +01:00
wakelock_use(charger)
allow charger self:netlink_kobject_uevent_socket create_socket_perms_no_ioctl;
charger: read permissions to /sys/power/state Fixes these denials: avc: denied { read } for pid=585 comm="charger" name="state" dev="sysfs" ino=18844 scontext=u:r:charger:s0 tcontext=u:object_r:sysfs_power:s0 tclass=file permissive=1 avc: denied { open } for pid=585 comm="charger" path="/sys/power/state" dev="sysfs" ino=18844 scontext=u:r:charger:s0 tcontext=u:object_r:sysfs_power:s0 tclass=file permissive=1 Test: above denials not observed in charger mode. Change-Id: I5660e63315fada7f24d6cfe2e0bd2b383b556670
2017-11-15 02:40:11 +01:00
# Read/write to /sys/power/state
allow charger sysfs_power:file rw_file_perms;
healthd: create SEPolicy for 'charger' and reduce healthd's scope healthd is being split into 'charger' and 'healthd' processes, that will never run together. 'charger' is to be run only in charge-only and recovery, while healthd runs with Android. While they both share much of battery monitoring code, they both now have reduced scope. E.g. 'charger', doesn't need to use binder anymore and healthd doesn't need to do charging ui animation. So, amend the SEPolicy for healthd to reduce it's scope and add a new one for charger. Test: Tested all modes {recovery, charger-only, android} with new policy Change-Id: If7f81875c605f7f07da4d23a313f308b9dde9ce8 Signed-off-by: Sandeep Patil <sspatil@google.com>
2016-11-01 21:49:10 +01:00
Remove access to 'sysfs' files from healtd and charger. We rely on vendors to label all dependencies of healthd/charger under /sys/class/power_supply with sysfs_batteryinfo type. Bug: 65643247 Bug: 32659667 Test: boots without denials from healthd, to sysfs_batteryinfo or to sysfs_msm_subsys. Test: charging with device turned off works without /sys denials. Change-Id: I893f309ecad8a0caf7d0b81f5f945725907255c2
2017-10-17 00:54:49 +02:00
r_dir_file(charger, sysfs_batteryinfo)
healthd: create SEPolicy for 'charger' and reduce healthd's scope healthd is being split into 'charger' and 'healthd' processes, that will never run together. 'charger' is to be run only in charge-only and recovery, while healthd runs with Android. While they both share much of battery monitoring code, they both now have reduced scope. E.g. 'charger', doesn't need to use binder anymore and healthd doesn't need to do charging ui animation. So, amend the SEPolicy for healthd to reduce it's scope and add a new one for charger. Test: Tested all modes {recovery, charger-only, android} with new policy Change-Id: If7f81875c605f7f07da4d23a313f308b9dde9ce8 Signed-off-by: Sandeep Patil <sspatil@google.com>
2016-11-01 21:49:10 +01:00
# Read /sys/fs/pstore/console-ramoops
# Don't worry about overly broad permissions for now, as there's
# only one file in /sys/fs/pstore
allow charger pstorefs:dir r_dir_perms;
allow charger pstorefs:file r_file_perms;
allow charger graphics_device:dir r_dir_perms;
allow charger graphics_device:chr_file rw_file_perms;
allow charger input_device:dir r_dir_perms;
allow charger input_device:chr_file r_file_perms;
allow charger tty_device:chr_file rw_file_perms;
allow charger proc_sysrq:file rw_file_perms;
# charger needs to tell init to continue the boot
# process when running in charger mode.
set_prop(charger, system_prop)
Whitelist exported platform properties This CL lists all the exported platform properties in private/exported_property_contexts. Additionally accessing core_property_type from vendor components is restricted. Instead public_readable_property_type is used to allow vendor components to read exported platform properties, and accessibility from vendor_init is also specified explicitly. Note that whitelisting would be applied only if PRODUCT_COMPATIBLE_PROPERTY is set on. Bug: 38146102 Test: tested on walleye with PRODUCT_COMPATIBLE_PROPERTY=true Change-Id: I304ba428cc4ca82668fec2ddeb17c971e7ec065e
2017-10-19 09:54:49 +02:00
set_prop(charger, exported_system_prop)
set_prop(charger, exported2_system_prop)
set_prop(charger, exported3_system_prop)
Allow charger to read ro.charger.* Allow charger to read system properties with this prefix so that charger's behavior is controlled by runtime. Test: run offline charging on walleye Bug: 124118169 Change-Id: I4266b2d043a5323b4adbd1636ada46b7e08ca667
2019-07-08 19:57:46 +02:00
get_prop(charger, charger_prop)
Allow charger to open health passthrough HAL Test: charger mode Bug: 142286265 Change-Id: I75910cec415595ac9b503358ac4984ef478e44ad
2019-10-12 03:12:09 +02:00
hal_client_domain(charger, hal_health)
Reference in a new issue Copy permalink