platform_system_sepolicy/bootanim.te

# bootanimation oneshot service
type bootanim, domain, domain_deprecated;
type bootanim_exec, exec_type, file_type;

init_daemon_domain(bootanim)

binder_use(bootanim)
binder_call(bootanim, surfaceflinger)

allow bootanim gpu_device:chr_file rw_file_perms;

# /oem access
allow bootanim oemfs:dir search;
allow bootanim oemfs:file r_file_perms;

allow bootanim audio_device:dir r_dir_perms;
allow bootanim audio_device:chr_file rw_file_perms;

allow bootanim surfaceflinger_service:service_manager find;
Define a domain for the bootanim service. Leave the domain permissive initially until it gets more testing. Change-Id: I9d88d76d1ffdc79a2eff4545d37a9e615482df50 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov> 2013-12-11 21:17:53 +01:00			`# bootanimation oneshot service`
Create attribute for moving perms out of domain Motivation: Domain is overly permissive. Start removing permissions from domain and assign them to the domain_deprecated attribute. Domain_deprecated and domain can initially be assigned to all domains. The goal is to not assign domain_deprecated to new domains and to start removing domain_deprecated where it is not required or reassigning the appropriate permissions to the inheriting domain when necessary. Bug: 25433265 Change-Id: I8b11cb137df7bdd382629c98d916a73fe276413c 2015-11-03 18:54:39 +01:00			`type bootanim, domain, domain_deprecated;`
Define a domain for the bootanim service. Leave the domain permissive initially until it gets more testing. Change-Id: I9d88d76d1ffdc79a2eff4545d37a9e615482df50 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov> 2013-12-11 21:17:53 +01:00			`type bootanim_exec, exec_type, file_type;`

			`init_daemon_domain(bootanim)`

			`binder_use(bootanim)`
			`binder_call(bootanim, surfaceflinger)`

			`allow bootanim gpu_device:chr_file rw_file_perms;`
reconcile aosp (3a8c5dc05fb7696dd81b8a7c1b2524224154e8ea) after branching. Please do not merge. Change-Id: Ic8ee83ed6ffef02bddd17e1175416fc2481db7b2 2014-07-15 08:31:31 +02:00
			`# /oem access`
			`allow bootanim oemfs:dir search;`
sepolicy for oem cutomization Added read permissions for bootanimation Bug: 16635599 Change-Id: Ib5d0ba5a6d1144ff831f4f0eda092879f853c376 2014-09-22 22:03:52 +02:00			`allow bootanim oemfs:file r_file_perms;`
Resync lmp-dev-plus-aosp with master A DO NOT MERGE change merged from lmp-dev to lmp-dev-plus-aosp. This is expected, but it's causing unnecessary merge conflicts when handling AOSP contributions. Resolve those conflicts. This is essentially a revert of bf696327246833c9aba55a645e6c433e9f321e27 for lmp-dev-plus-aosp only. Change-Id: Icc66def7113ab45176ae015f659cb442d53bce5c 2014-07-26 00:19:47 +02:00
Give bootanimation access to /dev/snd files so it can use tinyalsa Bug: 17674304 Change-Id: Ide32833809bca8d3ed8ddc898748e25d7a692319 2014-09-29 15:18:19 +02:00			`allow bootanim audio_device:dir r_dir_perms;`
			`allow bootanim audio_device:chr_file rw_file_perms;`
resolved conflicts for merge of 0a52df50 to lmp-dev-plus-aosp Change-Id: I3c6af086fc8ca3e9600c2267c439718c9a572dfb 2014-10-06 20:56:31 +02:00
Restrict service_manager find and list access. All domains are currently granted list and find service_manager permissions, but this is not necessary. Pare the permissions which did not trigger any of the auditallow reporting. Bug: 18106000 Change-Id: Ie0ce8de2af8af2cbe4ce388a2dcf4534694c994a 2014-12-12 01:01:27 +01:00			`allow bootanim surfaceflinger_service:service_manager find;`