platform_system_sepolicy/public/inputflinger.te

# inputflinger
type inputflinger, domain;
type inputflinger_exec, system_file_type, exec_type, file_type;

binder_use(inputflinger)
binder_service(inputflinger)

binder_call(inputflinger, system_server)

wakelock_use(inputflinger)

allow inputflinger input_device:dir r_dir_perms;
allow inputflinger input_device:chr_file rw_file_perms;

r_dir_file(inputflinger, cgroup)
initial inputflinger domain Add a placeholder domain for inputflinger. Mark it initially unconfined and enforcing. Change-Id: I433fd9e1954486136cb8abb084b4e19bb7fc2f19 2013-12-15 21:50:00 +01:00			`# inputflinger`
Remove domain_deprecated from some domains. No denials showing up in collected audit logs. Bug: 28760354 Test: Device boots Test: No unexpected denials in denial collection logs. Change-Id: I5a0d4f3c51d296bfa04e71fc226a01dcf5b5b508 2016-11-26 02:37:30 +01:00			`type inputflinger, domain;`
Introduce system_file_type system_file_type is a new attribute used to identify files which exist on the /system partition. It's useful for allow rules in init, which are based off of a blacklist of writable files. Additionally, it's useful for constructing neverallow rules to prevent regressions. Additionally, add commented out tests which enforce that all files on the /system partition have the system_file_type attribute. These tests will be uncommented in a future change after all the device-specific policies are cleaned up. Test: Device boots and no obvious problems. Change-Id: Id9bae6625f042594c8eba74ca712abb09702c1e5 2018-09-27 19:21:37 +02:00			`type inputflinger_exec, system_file_type, exec_type, file_type;`
initial inputflinger domain Add a placeholder domain for inputflinger. Mark it initially unconfined and enforcing. Change-Id: I433fd9e1954486136cb8abb084b4e19bb7fc2f19 2013-12-15 21:50:00 +01:00
			`binder_use(inputflinger)`
			`binder_service(inputflinger)`
Allow inputflinger to call system_server. Resolves denials such as: avc: denied { read } for pid=752 comm="ActivityManager" name="stat" dev="proc" ino=1878 scontext=u:r:system_server:s0 tcontext=u:r:inputflinger:s0 tclass=file avc: denied { open } for pid=752 comm="ActivityManager" name="stat" dev="proc" ino=1878 scontext=u:r:system_server:s0 tcontext=u:r:inputflinger:s0 tclass=file avc: denied { search } for pid=752 comm="ActivityManager" name="214" dev="proc" ino=1568 scontext=u:r:system_server:s0 tcontext=u:r:inputflinger:s0 tclass=dir avc: denied { read } for pid=752 comm="ActivityManager" name="stat" dev="proc" ino=1878 scontext=u:r:system_server:s0 tcontext=u:r:inputflinger:s0 tclass=file avc: denied { call } for pid=187 comm="Binder_2" scontext=u:r:inputflinger:s0 tcontext=u:r:system_server:s0 tclass=binder Change-Id: I099d7dacf7116efa73163245597c3de629d358c1 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov> 2014-03-21 15:40:56 +01:00
			`binder_call(inputflinger, system_server)`
Add SELinux rules for service_manager. Add a service_mananger class with the verb add. Add a type that groups the services for each of the processes that is allowed to start services in service.te and an attribute for all services controlled by the service manager. Add the service_contexts file which maps service name to target label. Bug: 12909011 Change-Id: I017032a50bc90c57b536e80b972118016d340c7d 2014-06-06 00:52:02 +02:00
Update selinux for inputflinger Allow CAP_BLOCK_SUSPEND Allow reading /dev/input/* Change-Id: I869a4921e024702300aa9ecba9cdf84ae2b6edac 2015-03-24 23:31:47 +01:00			`wakelock_use(inputflinger)`

			`allow inputflinger input_device:dir r_dir_perms;`
			`allow inputflinger input_device:chr_file rw_file_perms;`
audit domain_deprecated perms for removal Grant permissions observed. Bug: 28760354 Change-Id: Ie63cda709319bbf635ef7bffbba3477c2cccc11b 2016-09-10 01:27:17 +02:00
			`r_dir_file(inputflinger, cgroup)`