2017-02-19 06:32:32 +01:00
|
|
|
# wpa supplicant or equivalent
|
|
|
|
|
type hal_wifi_supplicant_default, domain;
|
|
|
|
|
hal_server_domain(hal_wifi_supplicant_default, hal_wifi_supplicant)
|
2017-04-10 22:03:28 +02:00
|
|
|
type hal_wifi_supplicant_default_exec, exec_type, vendor_file_type, file_type;
|
2017-02-19 06:32:32 +01:00
|
|
|
init_daemon_domain(hal_wifi_supplicant_default)
|
|
|
|
|
|
|
|
|
|
net_domain(hal_wifi_supplicant_default)
|
|
|
|
|
# Create a socket for receiving info from wpa
|
|
|
|
|
type_transition hal_wifi_supplicant_default wifi_data_file:dir wpa_socket "sockets";
|
2017-03-23 22:27:32 +01:00
|
|
|
|
2018-04-18 18:46:53 +02:00
|
|
|
# Allow wpa_supplicant to configure nl80211
|
|
|
|
|
allow hal_wifi_supplicant_default proc_net:file write;
|
|
|
|
|
|
Wifi Keystore HAL is not a HAL
Wifi Keystore HAL is a HwBinder service (currently offered by keystore
daemon) which is used by Wifi Supplicant HAL. This commit thus
switches the SELinux policy of Wifi Keystore HAL to the approach used
for non-HAL HwBinder services.
The basic idea is simimilar to how we express Binder services in the
policy, with two tweaks: (1) we don't have 'hwservicemanager find' and
thus there's no add_hwservice macro, and (2) we need loosen the
coupling between core and vendor components. For example, it should be
possible to move a HwBinder service offered by a core component into
another core component, without having to update the SELinux policy of
the vendor image. We thus annotate all components offering HwBinder
service x across the core-vendor boundary with x_server, which enables
the policy of clients to contain rules of the form:
binder_call(mydomain, x_server), and, if the service uses IPC
callbacks, also binder_call(x_server, mydomain).
Test: mmm system/sepolicy
Test: sesearch indicates to changes to binder { call transfer} between
keystore and hal_wifi_supplicant_default domains
Bug: 36896667
Change-Id: I45c4ce8159b63869d7bb6df5c812c5291776d892
2017-04-04 23:56:31 +02:00
|
|
|
# Allow wpa_supplicant to talk to Wifi Keystore HwBinder service.
|
|
|
|
|
hwbinder_use(hal_wifi_supplicant_default)
|
2017-04-14 04:05:27 +02:00
|
|
|
allow hal_wifi_supplicant_default system_wifi_keystore_hwservice:hwservice_manager find;
|
Wifi Keystore HAL is not a HAL
Wifi Keystore HAL is a HwBinder service (currently offered by keystore
daemon) which is used by Wifi Supplicant HAL. This commit thus
switches the SELinux policy of Wifi Keystore HAL to the approach used
for non-HAL HwBinder services.
The basic idea is simimilar to how we express Binder services in the
policy, with two tweaks: (1) we don't have 'hwservicemanager find' and
thus there's no add_hwservice macro, and (2) we need loosen the
coupling between core and vendor components. For example, it should be
possible to move a HwBinder service offered by a core component into
another core component, without having to update the SELinux policy of
the vendor image. We thus annotate all components offering HwBinder
service x across the core-vendor boundary with x_server, which enables
the policy of clients to contain rules of the form:
binder_call(mydomain, x_server), and, if the service uses IPC
callbacks, also binder_call(x_server, mydomain).
Test: mmm system/sepolicy
Test: sesearch indicates to changes to binder { call transfer} between
keystore and hal_wifi_supplicant_default domains
Bug: 36896667
Change-Id: I45c4ce8159b63869d7bb6df5c812c5291776d892
2017-04-04 23:56:31 +02:00
|
|
|
binder_call(hal_wifi_supplicant_default, wifi_keystore_service_server)
|
2018-01-24 17:49:16 +01:00
|
|
|
|
|
|
|
|
allow hal_wifi_supplicant_default wpa_data_file:dir create_dir_perms;
|
|
|
|
|
allow hal_wifi_supplicant_default wpa_data_file:file create_file_perms;
|
|
|
|
|
allow hal_wifi_supplicant_default wpa_data_file:sock_file create_file_perms;
|
2018-02-13 17:35:10 +01:00
|
|
|
|
|
|
|
|
# Write to security logs for audit.
|
|
|
|
|
get_prop(hal_wifi_supplicant_default, device_logging_prop)
|
2018-03-10 00:47:47 +01:00
|
|
|
|
|
|
|
|
# Devices upgrading to P may grant this permission in device-specific
|
|
|
|
|
# policy along with the data_between_core_and_vendor_violators
|
|
|
|
|
# attribute needed for an exemption. However, devices that launch with
|
|
|
|
|
# P should use /data/vendor/wifi, which is already granted in core
|
|
|
|
|
# policy. This is dontaudited here to avoid conditional
|
|
|
|
|
# device-specific behavior in wpa_supplicant.
|
|
|
|
|
dontaudit hal_wifi_supplicant_default wifi_data_file:dir search;
|
