platform_system_sepolicy/private/radio.te

typeattribute radio coredomain;

app_domain(radio)

read_runtime_log_tags(radio)

# Telephony code contains time / time zone detection logic so it reads the associated properties.
get_prop(radio, time_prop)
Vendor domains must not use Binder On PRODUCT_FULL_TREBLE devices, non-vendor domains (except vendor apps) are not permitted to use Binder. This commit thus: * groups non-vendor domains using the new "coredomain" attribute, * adds neverallow rules restricting Binder use to coredomain and appdomain only, and * temporarily exempts the domains which are currently violating this rule from this restriction. These domains are grouped using the new "binder_in_vendor_violators" attribute. The attribute is needed because the types corresponding to violators are not exposed to the public policy where the neverallow rules are. Test: mmm system/sepolicy Test: Device boots, no new denials Test: In Chrome, navigate to ip6.me, play a YouTube video Test: YouTube: play a video Test: Netflix: play a movie Test: Google Camera: take a photo, take an HDR+ photo, record video with sound, record slow motion video with sound. Confirm videos play back fine and with sound. Bug: 35870313 Change-Id: I0cd1a80b60bcbde358ce0f7a47b90f4435a45c95 2017-03-23 22:27:32 +01:00			`typeattribute radio coredomain;`

Whitespace fix Because I'm nitpicky. Test: policy compiles Change-Id: I4d886d0d6182d29d7b260cf1f142c47cd32eda29 2016-12-10 05:14:31 +01:00			`app_domain(radio)`
logd: restrict access to /dev/event-log-tags Create an event_log_tags_file label and use it for /dev/event-log-tags. Only trusted system log readers are allowed direct read access to this file, no write access. Untrusted domain requests lack direct access, and are thus checked for credentials via the "plan b" long path socket to the event log tag service. Test: gTest logd-unit-tests, liblog-unit-tests and logcat-unit-tests Bug: 31456426 Bug: 30566487 Change-Id: Ib9b71ca225d4436d764c9bc340ff7b1c9c252a9e 2016-11-08 00:11:39 +01:00
			`read_runtime_log_tags(radio)`
Add label for time (zone) system properties This adds a label for system properties that will affect system-wide time / time detection logic. The first example will be something like: persist.time.detection_impl_version Bug: 78217059 Test: build Change-Id: I46044f1e28170760001da9acf2496a1e3037e48a 2018-06-25 16:36:51 +02:00
			`# Telephony code contains time / time zone detection logic so it reads the associated properties.`
			`get_prop(radio, time_prop)`