platform_system_sepolicy/wificond.te

# wificond
type wificond, domain;
type wificond_exec, exec_type, file_type;

init_daemon_domain(wificond)

binder_use(wificond)
binder_call(wificond, system_server)
binder_call(wificond, wpa)

allow wificond wificond_service:service_manager { add find };

allow wificond sysfs_wlan_fwpath:file w_file_perms;
Sepolicy files for wificond This sepolicy change allows wificond to run as a deamon. BUG=28865186 TEST=compile TEST=compile with ag/1059605 Add wificond to '/target/product/base.mk' Adb shell ps -A \| grep 'wificond' Change-Id: If1e4a8542ac03e8ae42371d75aa46b90c3d8545d (cherry picked from commit 4ef44a616ee5888023e5c53bbc2c4df6549f748a) 2016-05-20 04:31:20 +02:00			`# wificond`
			`type wificond, domain;`
			`type wificond_exec, exec_type, file_type;`

			`init_daemon_domain(wificond)`
sepolicy: add sepolicy binder support for wificond This allows wificond to publish binder interface using service manager. Denial warnings: wificond: type=1400 audit(0.0:8): avc: denied { call } for scontext=u:r:wificond:s0 tcontext=u:r:servicemanager:s0 tclass=binder permissive=1 wificond: type=1400 audit(0.0:9): avc: denied { transfer } for scontext=u:r:wificond:s0 tcontext=u:r:servicemanager:s0 tclass=binder permissive=1 servicemanager: type=1400 audit(0.0:10): avc: denied { search } for name="6085" dev="proc" ino=40626 scontext=u:r:servicemanager:s0 tcontext=u:r:wificond:s0 tclass=dir permissive=1 servicemanager: type=1400 audit(0.0:11): avc: denied { read } for name="current" dev="proc" ino=40641 scontext=u:r:servicemanager:s0 tcontext=u:r:wificond:s0 tclass=file permissive=1 servicemanager: type=1400 audit(0.0:12): avc: denied { open } for path="/proc/6085/attr/current" dev="proc" ino=40641 scontext=u:r:servicemanager:s0 tcontext=u:r:wificond:s0 tclass=file permissive=1 servicemanager: type=1400 audit(0.0:13): avc: denied { getattr } for scontext=u:r:servicemanager:s0 tcontext=u:r:wificond:s0 tclass=process permissive=1 SELinux : avc: denied { add } for service=wificond pid=6085 uid=0 scontext=u:r:wificond:s0 tcontext=u:object_r:wifi_service:s0 tclass=service_manager permissive=1 BUG=28867093 TEST=compile TEST=use a client to call wificond service through binder Change-Id: I9312892caff171f17b04c30a415c07036b39ea7f (cherry picked from commit d56bcb1c5452c8dcdda7e4ef5d0f44b91b6bb08b) 2016-06-03 19:08:56 +02:00
			`binder_use(wificond)`
			`binder_call(wificond, system_server)`
sepolicy: Add permissions for wpa_supplicant binder Add the necessary permissions for \|wpa_supplicant\| to expose a binder interface. This binder interface will be used by the newly added \|wificond\| service (and potentially system_server). \|wpa_supplicant\| also needs to invoke binder callbacks on \|wificond\|. Changes in the CL: 1. Allow \|wpa_supplicant\| to register binder service. 2. Allow \|wpa_supplicant\| to invoke binder calls on \|wificond\|. 3. Allow \|wificond\| to invoke binder calls on \|wpa_supplicant\| Denials: 06-30 08:14:42.788 400 400 E SELinux : avc: denied { add } for service=wpa_supplicant pid=20756 uid=1010 scontext=u:r:wpa:s0 tcontext=u:object_r:default_android_service:s0 tclass=service_manager permissive=1 BUG:29877467 TEST: Compiled and ensured that the selinux denials are no longer present in logs. TEST: Ran integration test to find the service. Change-Id: Ib78d8e820fc81b2c3d9260e1c877c5faa9f1f662 (cherry picked from commit 18883a93b795da6409beeddf2c6ce34ce8234cb0) 2016-06-30 17:20:29 +02:00			`binder_call(wificond, wpa)`
sepolicy: add sepolicy binder support for wificond This allows wificond to publish binder interface using service manager. Denial warnings: wificond: type=1400 audit(0.0:8): avc: denied { call } for scontext=u:r:wificond:s0 tcontext=u:r:servicemanager:s0 tclass=binder permissive=1 wificond: type=1400 audit(0.0:9): avc: denied { transfer } for scontext=u:r:wificond:s0 tcontext=u:r:servicemanager:s0 tclass=binder permissive=1 servicemanager: type=1400 audit(0.0:10): avc: denied { search } for name="6085" dev="proc" ino=40626 scontext=u:r:servicemanager:s0 tcontext=u:r:wificond:s0 tclass=dir permissive=1 servicemanager: type=1400 audit(0.0:11): avc: denied { read } for name="current" dev="proc" ino=40641 scontext=u:r:servicemanager:s0 tcontext=u:r:wificond:s0 tclass=file permissive=1 servicemanager: type=1400 audit(0.0:12): avc: denied { open } for path="/proc/6085/attr/current" dev="proc" ino=40641 scontext=u:r:servicemanager:s0 tcontext=u:r:wificond:s0 tclass=file permissive=1 servicemanager: type=1400 audit(0.0:13): avc: denied { getattr } for scontext=u:r:servicemanager:s0 tcontext=u:r:wificond:s0 tclass=process permissive=1 SELinux : avc: denied { add } for service=wificond pid=6085 uid=0 scontext=u:r:wificond:s0 tcontext=u:object_r:wifi_service:s0 tclass=service_manager permissive=1 BUG=28867093 TEST=compile TEST=use a client to call wificond service through binder Change-Id: I9312892caff171f17b04c30a415c07036b39ea7f (cherry picked from commit d56bcb1c5452c8dcdda7e4ef5d0f44b91b6bb08b) 2016-06-03 19:08:56 +02:00
			`allow wificond wificond_service:service_manager { add find };`
Define explicit label for wlan sysfs fwpath avc: denied { write } for name="fwpath" dev="sysfs" ino=6863 scontext=u:r:wificond:s0 tcontext=u:object_r:sysfs_wlan_fwpath:s0 tclass=file permissive=0 Test: wificond and netd can write to this path, wifi works Test: `runtest frameworks-wifi` passes Bug: 29579539 Change-Id: Ia21c654b00b09b9fe3e50d564b82966c9c8e6994 (cherry picked from commit 7d13dd806f37523ba8164325fef9b000d6eacd7c) 2016-06-30 23:23:12 +02:00
			`allow wificond sysfs_wlan_fwpath:file w_file_perms;`