platform_system_sepolicy/inputflinger.te

# inputflinger
type inputflinger, domain;
type inputflinger_exec, exec_type, file_type;

init_daemon_domain(inputflinger)
binder_use(inputflinger)
binder_service(inputflinger)

binder_call(inputflinger, system_server)

allow inputflinger inputflinger_service:service_manager add;

# Audited locally.
service_manager_local_audit_domain(inputflinger)
auditallow inputflinger { service_manager_type -inputflinger_service }:service_manager find;
initial inputflinger domain Add a placeholder domain for inputflinger. Mark it initially unconfined and enforcing. Change-Id: I433fd9e1954486136cb8abb084b4e19bb7fc2f19 2013-12-15 21:50:00 +01:00			`# inputflinger`
			`type inputflinger, domain;`
			`type inputflinger_exec, exec_type, file_type;`

			`init_daemon_domain(inputflinger)`
			`binder_use(inputflinger)`
			`binder_service(inputflinger)`
Allow inputflinger to call system_server. Resolves denials such as: avc: denied { read } for pid=752 comm="ActivityManager" name="stat" dev="proc" ino=1878 scontext=u:r:system_server:s0 tcontext=u:r:inputflinger:s0 tclass=file avc: denied { open } for pid=752 comm="ActivityManager" name="stat" dev="proc" ino=1878 scontext=u:r:system_server:s0 tcontext=u:r:inputflinger:s0 tclass=file avc: denied { search } for pid=752 comm="ActivityManager" name="214" dev="proc" ino=1568 scontext=u:r:system_server:s0 tcontext=u:r:inputflinger:s0 tclass=dir avc: denied { read } for pid=752 comm="ActivityManager" name="stat" dev="proc" ino=1878 scontext=u:r:system_server:s0 tcontext=u:r:inputflinger:s0 tclass=file avc: denied { call } for pid=187 comm="Binder_2" scontext=u:r:inputflinger:s0 tcontext=u:r:system_server:s0 tclass=binder Change-Id: I099d7dacf7116efa73163245597c3de629d358c1 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov> 2014-03-21 15:40:56 +01:00
			`binder_call(inputflinger, system_server)`
Add SELinux rules for service_manager. Add a service_mananger class with the verb add. Add a type that groups the services for each of the processes that is allowed to start services in service.te and an attribute for all services controlled by the service manager. Add the service_contexts file which maps service name to target label. Bug: 12909011 Change-Id: I017032a50bc90c57b536e80b972118016d340c7d 2014-06-06 00:52:02 +02:00
			`allow inputflinger inputflinger_service:service_manager add;`
Add access control for each service_manager action. Add SELinux MAC for the service manager actions list and find. Add the list and find verbs to the service_manager class. Add policy requirements for service_manager to enforce policies to binder_use macro. Change-Id: I224b1c6a6e21e3cdeb23badfc35c82a37558f964 2014-07-07 22:56:27 +02:00
			`# Audited locally.`
			`service_manager_local_audit_domain(inputflinger)`
			`auditallow inputflinger { service_manager_type -inputflinger_service }:service_manager find;`