platform_system_sepolicy/inputflinger.te

# inputflinger
type inputflinger, domain, domain_deprecated;
type inputflinger_exec, exec_type, file_type;

init_daemon_domain(inputflinger)
binder_use(inputflinger)
binder_service(inputflinger)

binder_call(inputflinger, system_server)

wakelock_use(inputflinger)

allow inputflinger inputflinger_service:service_manager { add find };
allow inputflinger input_device:dir r_dir_perms;
allow inputflinger input_device:chr_file rw_file_perms;
initial inputflinger domain Add a placeholder domain for inputflinger. Mark it initially unconfined and enforcing. Change-Id: I433fd9e1954486136cb8abb084b4e19bb7fc2f19 2013-12-15 21:50:00 +01:00			`# inputflinger`
Create attribute for moving perms out of domain Motivation: Domain is overly permissive. Start removing permissions from domain and assign them to the domain_deprecated attribute. Domain_deprecated and domain can initially be assigned to all domains. The goal is to not assign domain_deprecated to new domains and to start removing domain_deprecated where it is not required or reassigning the appropriate permissions to the inheriting domain when necessary. Bug: 25433265 Change-Id: I8b11cb137df7bdd382629c98d916a73fe276413c 2015-11-03 18:54:39 +01:00			`type inputflinger, domain, domain_deprecated;`
initial inputflinger domain Add a placeholder domain for inputflinger. Mark it initially unconfined and enforcing. Change-Id: I433fd9e1954486136cb8abb084b4e19bb7fc2f19 2013-12-15 21:50:00 +01:00			`type inputflinger_exec, exec_type, file_type;`

			`init_daemon_domain(inputflinger)`
			`binder_use(inputflinger)`
			`binder_service(inputflinger)`
Allow inputflinger to call system_server. Resolves denials such as: avc: denied { read } for pid=752 comm="ActivityManager" name="stat" dev="proc" ino=1878 scontext=u:r:system_server:s0 tcontext=u:r:inputflinger:s0 tclass=file avc: denied { open } for pid=752 comm="ActivityManager" name="stat" dev="proc" ino=1878 scontext=u:r:system_server:s0 tcontext=u:r:inputflinger:s0 tclass=file avc: denied { search } for pid=752 comm="ActivityManager" name="214" dev="proc" ino=1568 scontext=u:r:system_server:s0 tcontext=u:r:inputflinger:s0 tclass=dir avc: denied { read } for pid=752 comm="ActivityManager" name="stat" dev="proc" ino=1878 scontext=u:r:system_server:s0 tcontext=u:r:inputflinger:s0 tclass=file avc: denied { call } for pid=187 comm="Binder_2" scontext=u:r:inputflinger:s0 tcontext=u:r:system_server:s0 tclass=binder Change-Id: I099d7dacf7116efa73163245597c3de629d358c1 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov> 2014-03-21 15:40:56 +01:00
			`binder_call(inputflinger, system_server)`
Add SELinux rules for service_manager. Add a service_mananger class with the verb add. Add a type that groups the services for each of the processes that is allowed to start services in service.te and an attribute for all services controlled by the service manager. Add the service_contexts file which maps service name to target label. Bug: 12909011 Change-Id: I017032a50bc90c57b536e80b972118016d340c7d 2014-06-06 00:52:02 +02:00
Update selinux for inputflinger Allow CAP_BLOCK_SUSPEND Allow reading /dev/input/* Change-Id: I869a4921e024702300aa9ecba9cdf84ae2b6edac 2015-03-24 23:31:47 +01:00			`wakelock_use(inputflinger)`

Restrict service_manager find and list access. All domains are currently granted list and find service_manager permissions, but this is not necessary. Pare the permissions which did not trigger any of the auditallow reporting. Bug: 18106000 Change-Id: Ie0ce8de2af8af2cbe4ce388a2dcf4534694c994a 2014-12-12 01:01:27 +01:00			`allow inputflinger inputflinger_service:service_manager { add find };`
Update selinux for inputflinger Allow CAP_BLOCK_SUSPEND Allow reading /dev/input/* Change-Id: I869a4921e024702300aa9ecba9cdf84ae2b6edac 2015-03-24 23:31:47 +01:00			`allow inputflinger input_device:dir r_dir_perms;`
			`allow inputflinger input_device:chr_file rw_file_perms;`