platform_system_sepolicy/vendor/hal_audio_default.te

type hal_audio_default, domain;
hal_server_domain(hal_audio_default, hal_audio)

type hal_audio_default_exec, exec_type, vendor_file_type, file_type;
init_daemon_domain(hal_audio_default)

hal_client_domain(hal_audio_default, hal_allocator)
Group all HAL impls using haldomain attribute This marks all HAL domain implementations with the haldomain attribute so that rules can be written which apply to all HAL implementations. This follows the pattern used for appdomain, netdomain and bluetoothdomain. Test: No change to policy according to sesearch. Bug: 34180936 Change-Id: I0cfe599b0d49feed36538503c226dfce41eb65f6 2017-01-11 00:54:25 +01:00			`type hal_audio_default, domain;`
Use _client and _server for Audio HAL policy This starts the switch for HAL policy to the approach where: * domains which are clients of Foo HAL are associated with hal_foo_client attribute, * domains which offer the Foo HAL service over HwBinder are associated with hal_foo_server attribute, * policy needed by the implementation of Foo HAL service is written against the hal_foo attribute. This policy is granted to domains which offer the Foo HAL service over HwBinder and, if Foo HAL runs in the so-called passthrough mode (inside the process of each client), also granted to all domains which are clients of Foo HAL. hal_foo is there to avoid duplicating the rules for hal_foo_client and hal_foo_server to cover the passthrough/in-process Foo HAL and binderized/out-of-process Foo HAL cases. A benefit of associating all domains which are clients of Foo HAL with hal_foo (when Foo HAL is in passthrough mode) is that this removes the need for device-specific policy to be able to reference these domains directly (in order to add device-specific allow rules). Instead, device-specific policy only needs to reference hal_foo and should no longer need to care which particular domains on the device are clients of Foo HAL. This can be seen in simplification of the rules for audioserver domain which is a client of Audio HAL whose policy is being restructured in this commit. This commit uses Audio HAL as an example to illustrate the approach. Once this commit lands, other HALs will also be switched to this approach. Test: Google Play Music plays back radios Test: Google Camera records video with sound and that video is then successfully played back with sound Test: YouTube app plays back clips with sound Test: YouTube in Chrome plays back clips with sound Bug: 34170079 Change-Id: I2597a046753edef06123f0476c2ee6889fc17f20 2017-02-13 23:40:49 +01:00			`hal_server_domain(hal_audio_default, hal_audio)`
All hal policies expressed as attributes. Bug: 32123421 Bug: 32905206 Test: compiles, nfc works Change-Id: Ibf72ef70255573e4df0863ea640354b3c37eb47d 2016-12-13 21:17:09 +01:00
sepolicy: make exec_types in /vendor a subset of vendor_file_type We install all default hal implementations in /vendor/bin/hw along with a few domains that are defined in vendor policy and installed in /vendor. These files MUST be a subset of the global 'vendor_file_type' which is used to address all files installed in /vendor throughout the policy. Bug: 36463595 Test: Boot sailfish without any new denials Change-Id: I3d26778f9a26f9095f49d8ecc12f2ec9d2f4cb41 Signed-off-by: Sandeep Patil <sspatil@google.com> 2017-04-10 22:03:28 +02:00			`type hal_audio_default_exec, exec_type, vendor_file_type, file_type;`
All hal policies expressed as attributes. Bug: 32123421 Bug: 32905206 Test: compiles, nfc works Change-Id: Ibf72ef70255573e4df0863ea640354b3c37eb47d 2016-12-13 21:17:09 +01:00			`init_daemon_domain(hal_audio_default)`
Mark all clients of Allocator HAL This change associates all domains which are clients of Allocator HAL with hal_allocator_client and the, required for all HAL client domains, halclientdomain. This enables this commit to remove the now unnecessary hwallocator_use macro because its binder_call(..., hal_allocator_server) is covered by binder_call(hal_allocator_client, hal_allocator_server) added in this commit. Unfortunately apps, except isolated app, are clients of Allocator HAL as well. This makes it hard to use the hal_client_domain(..., hal_allocator) macro because it translates into "typeattribute" which currently does not support being provided with a set of types, such as { appdomain -isolated_app }. As a workaround, hopefully until typeattribute is improved, this commit expresses the necessary association operation in CIL. private/technical_debt.cil introduced by this commit is appended into the platform policy CIL file, thus ensuring that the hack has effect on the final monolithic policy. P. S. This change also removes Allocator HAL access from isolated_app. Isolated app shouldn't have access to this HAL anyway. Test: Google Play Music plays back radios Test: Google Camera records video with sound and that video is then successfully played back with sound Test: YouTube app plays back clips with sound Test: YouTube in Chrome plays back clips with sound Bug: 34170079 Change-Id: Id00bba6fde83e7cf04fb58bc1c353c2f66333f92 2017-03-21 22:28:53 +01:00
			`hal_client_domain(hal_audio_default, hal_allocator)`
Ban socket connections between core and vendor On PRODUCT_FULL_TREBLE devices, non-vendor domains (coredomain) and vendor domain are not permitted to connect to each other's sockets. There are two main exceptions: (1) apps are permitted to talk to other apps over Unix domain sockets (this is public API in Android framework), and (2) domains with network access (netdomain) are permitted to connect to netd. This commit thus: * adds neverallow rules restricting socket connection establishment, * temporarily exempts the domains which are currently violating this rule from this restriction. These domains are grouped using the new "socket_between_core_and_vendor_violators" attribute. The attribute is needed because the types corresponding to violators are not exposed to the public policy where the neverallow rules are. Test: mmm system/sepolicy Bug: 36613996 Change-Id: I458f5a09a964b06ad2bddb52538ec3a15758b003 2017-03-25 00:07:35 +01:00