tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
platform_system_sepolicy/vendor/hal_camera_default.te

12 lines
389 B
Text
Raw Normal View History

DO NOT MERGE: Camera: Add initial Treble camera HAL sepolicy - Allow cameraservice to talk to hwbinder, hwservicemanager - Allow hal_camera to talk to the same interfaces as cameraservice Test: Compiles, confirmed that cameraservice can call hwservicemanager Bug: 32991422 Change-Id: Ied0a3f5f7149e29c468a13887510c78d555dcb2a
2016-12-22 21:55:02 +01:00
type hal_camera_default, domain;
Switch Camera HAL policy to _client/_server This switches Camera HAL policy to the design which enables us to conditionally remove unnecessary rules from domains which are clients of Camera HAL. Domains which are clients of Camera HAL, such as cameraserver domain, are granted rules targeting hal_camera only when the Camera HAL runs in passthrough mode (i.e., inside the client's process). When the HAL runs in binderized mode (i.e., in another process/domain, with clients talking to the HAL over HwBinder IPC), rules targeting hal_camera are not granted to client domains. Domains which offer a binderized implementation of Camera HAL, such as hal_camera_default domain, are always granted rules targeting hal_camera. Test: Take non-HDR photo using Google Camera app Test: Take HDR photo using Google Camera app Test: Record video using Google Camera app Bug: 34170079 Change-Id: I463646cf79fede57f11ccd4ec2cbc37a4fff141e
2017-02-17 01:08:22 +01:00
hal_server_domain(hal_camera_default, hal_camera)
DO NOT MERGE: Camera: Add initial Treble camera HAL sepolicy - Allow cameraservice to talk to hwbinder, hwservicemanager - Allow hal_camera to talk to the same interfaces as cameraservice Test: Compiles, confirmed that cameraservice can call hwservicemanager Bug: 32991422 Change-Id: Ied0a3f5f7149e29c468a13887510c78d555dcb2a
2016-12-22 21:55:02 +01:00
sepolicy: make exec_types in /vendor a subset of vendor_file_type We install all default hal implementations in /vendor/bin/hw along with a few domains that are defined in vendor policy and installed in /vendor. These files MUST be a subset of the global 'vendor_file_type' which is used to address *all files installed in /vendor* throughout the policy. Bug: 36463595 Test: Boot sailfish without any new denials Change-Id: I3d26778f9a26f9095f49d8ecc12f2ec9d2f4cb41 Signed-off-by: Sandeep Patil <sspatil@google.com>
2017-04-10 22:03:28 +02:00
type hal_camera_default_exec, exec_type, vendor_file_type, file_type;
DO NOT MERGE: Camera: Add initial Treble camera HAL sepolicy - Allow cameraservice to talk to hwbinder, hwservicemanager - Allow hal_camera to talk to the same interfaces as cameraservice Test: Compiles, confirmed that cameraservice can call hwservicemanager Bug: 32991422 Change-Id: Ied0a3f5f7149e29c468a13887510c78d555dcb2a
2016-12-22 21:55:02 +01:00
init_daemon_domain(hal_camera_default)
Restrict access to hwservicemanager This adds fine-grained policy about who can register and find which HwBinder services in hwservicemanager. Test: Play movie in Netflix and Google Play Movies Test: Play video in YouTube app and YouTube web page Test: In Google Camera app, take photo (HDR+ and conventional), record video (slow motion and normal), and check that photos look fine and videos play back with sound. Test: Cast screen to a Google Cast device Test: Get location fix in Google Maps Test: Make and receive a phone call, check that sound works both ways and that disconnecting the call frome either end works fine. Test: Run RsHelloCompute RenderScript demo app Test: Run fast subset of media CTS tests: make and install CtsMediaTestCases.apk adb shell am instrument -e size small \ -w 'android.media.cts/android.support.test.runner.AndroidJUnitRunner' Test: Play music using Google Play music Test: Adjust screen brightness via the slider in Quick Settings Test: adb bugreport Test: Enroll in fingerprint screen unlock, unlock screen using fingerprint Test: Apply OTA update: Make some visible change, e.g., rename Settings app. make otatools && \ make dist Ensure device has network connectivity ota_call.py -s <serial here> --file out/dist/sailfish-ota-*.zip Confirm the change is now live on the device Bug: 34454312 (cherry picked from commit 632bc494f199d9d85c37c1751667fe41f4b094cb) Merged-In: Iecf74000e6c68f01299667486f3c767912c076d3 Change-Id: I7a9a487beaf6f30c52ce08e04d415624da49dd31
2017-04-14 04:05:27 +02:00
allow hal_camera_default fwk_sensor_hwservice:hwservice_manager find;
Ensure taking a bugreport generates no denials. This commit adds new SELinux permissions and neverallow rules so that taking a bugreport does not produce any denials. Bug: 73256908 Test: Captured bugreports on Sailfish and Walleye and verified that there were no denials. Merged-In: If3f2093a2b51934938e3d7e5c42036b2e2bf6de9 Change-Id: I10882e7adda0bb51bf373e0e62fda0acc8ad34eb
2018-02-14 23:32:38 +01:00
# For collecting bugreports.
allow hal_camera_default dumpstate:fd use;
allow hal_camera_default dumpstate:fifo_file write;
Reference in a new issue Copy permalink