platform_system_sepolicy/private/wait_for_keymaster.te

# wait_for_keymaster service
type wait_for_keymaster, domain, coredomain;
type wait_for_keymaster_exec, system_file_type, exec_type, file_type;

init_daemon_domain(wait_for_keymaster)

hal_client_domain(wait_for_keymaster, hal_keymaster)

allow wait_for_keymaster kmsg_device:chr_file w_file_perms;
Add wait_for_keymaster Bug: 79228237 Test: audit2allow finds no relevant denials on boot Merged-In: Ia80b77ba9a1ec2354127cd0ef68d50ebcf593fb0 Change-Id: Ia80b77ba9a1ec2354127cd0ef68d50ebcf593fb0 2018-05-09 00:45:38 +02:00			`# wait_for_keymaster service`
			`type wait_for_keymaster, domain, coredomain;`
Introduce system_file_type system_file_type is a new attribute used to identify files which exist on the /system partition. It's useful for allow rules in init, which are based off of a blacklist of writable files. Additionally, it's useful for constructing neverallow rules to prevent regressions. Additionally, add commented out tests which enforce that all files on the /system partition have the system_file_type attribute. These tests will be uncommented in a future change after all the device-specific policies are cleaned up. Test: Device boots and no obvious problems. Change-Id: Id9bae6625f042594c8eba74ca712abb09702c1e5 2018-09-27 19:21:37 +02:00			`type wait_for_keymaster_exec, system_file_type, exec_type, file_type;`
Add wait_for_keymaster Bug: 79228237 Test: audit2allow finds no relevant denials on boot Merged-In: Ia80b77ba9a1ec2354127cd0ef68d50ebcf593fb0 Change-Id: Ia80b77ba9a1ec2354127cd0ef68d50ebcf593fb0 2018-05-09 00:45:38 +02:00
			`init_daemon_domain(wait_for_keymaster)`

			`hal_client_domain(wait_for_keymaster, hal_keymaster)`

			`allow wait_for_keymaster kmsg_device:chr_file w_file_perms;`