tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
platform_system_sepolicy/vendor/hal_health_default.te

14 lines
429 B
Text
Raw Normal View History

hal_health: express the sepolicy as attribute Bug: http://b/32905206 Test: Boot sailfish and no new selinux failures observed in logs Change-Id: Id9a46180074a61f8cf8d176a7b2ebc995a13b9f9 Signed-off-by: Sandeep Patil <sspatil@google.com>
2016-12-16 22:20:25 +01:00
# health info abstraction
Group all HAL impls using haldomain attribute This marks all HAL domain implementations with the haldomain attribute so that rules can be written which apply to all HAL implementations. This follows the pattern used for appdomain, netdomain and bluetoothdomain. Test: No change to policy according to sesearch. Bug: 34180936 Change-Id: I0cfe599b0d49feed36538503c226dfce41eb65f6
2017-01-11 00:54:25 +01:00
type hal_health_default, domain;
Add sepolicies to allow hal_health_default to load BPFs. Bug: 203462310 Test: Ensure that the BPF filter can be loaded Change-Id: Ib507d4c1718dd56fb336501ed7598de7b44a687b
2022-03-08 23:56:27 +01:00
typeattribute hal_health_default bpfdomain;
Annotate most remaining HALs with _client/_server This switches most remaining HALs to the _client/_server approach. To unblock efforts blocked on majority of HALs having to use this model, this change does not remove unnecessary rules from clients of these HALs. That work will be performed in follow-up commits. This commit only adds allow rules and thus does not break existing functionality. The HALs not yet on the _client/_server model after this commit are: * Allocator HAL, because it's non-trivial to declare all apps except isolated apps as clients of this HAL, which they are. * Boot HAL, because it's still on the non-attributized model and I'm waiting for update_engine folks to answer a couple of questions which will let me refactor the policy of this HAL. Test: mmm system/sepolicy Test: Device boots, no new denials Test: Device boots in recovery mode, no new denials Bug: 34170079 Change-Id: I03e6bcec2fa02f14bdf17d11f7367b62c68a14b9
2017-03-17 02:48:40 +01:00
hal_server_domain(hal_health_default, hal_health)
hal_health: express the sepolicy as attribute Bug: http://b/32905206 Test: Boot sailfish and no new selinux failures observed in logs Change-Id: Id9a46180074a61f8cf8d176a7b2ebc995a13b9f9 Signed-off-by: Sandeep Patil <sspatil@google.com>
2016-12-16 22:20:25 +01:00
sepolicy: make exec_types in /vendor a subset of vendor_file_type We install all default hal implementations in /vendor/bin/hw along with a few domains that are defined in vendor policy and installed in /vendor. These files MUST be a subset of the global 'vendor_file_type' which is used to address *all files installed in /vendor* throughout the policy. Bug: 36463595 Test: Boot sailfish without any new denials Change-Id: I3d26778f9a26f9095f49d8ecc12f2ec9d2f4cb41 Signed-off-by: Sandeep Patil <sspatil@google.com>
2017-04-10 22:03:28 +02:00
type hal_health_default_exec, exec_type, vendor_file_type, file_type;
hal_health: express the sepolicy as attribute Bug: http://b/32905206 Test: Boot sailfish and no new selinux failures observed in logs Change-Id: Id9a46180074a61f8cf8d176a7b2ebc995a13b9f9 Signed-off-by: Sandeep Patil <sspatil@google.com>
2016-12-16 22:20:25 +01:00
init_daemon_domain(hal_health_default)
Add charger_vendor type This is the context when health HAL runs in offline charging mode. This has the same permissions as the health HAL, but is also able to do charger specific things. Also restrict neverallow rules in charger_type. Test: manual in offline charging mode Bug: 203246116 Change-Id: I6034853c113dff95b26461153501ad0528d10279
2021-10-26 06:56:29 +02:00
# When executing the service in offline-charging mode,
# allow to transition to charger_vendor domain.
domain_trans(init, hal_health_default_exec, charger_vendor)
Reference in a new issue Copy permalink