platform_system_sepolicy/public/hal_keymaster.te

# HwBinder IPC from client to server
binder_call(hal_keymaster_client, hal_keymaster_server)

allow hal_keymaster tee_device:chr_file rw_file_perms;
allow hal_keymaster tee:unix_stream_socket connectto;

allow hal_keymaster ion_device:chr_file r_file_perms;
Switch Keymaster HAL policy to _client/_server This switches Keymaster HAL policy to the design which enables us to conditionally remove unnecessary rules from domains which are clients of Keymaster HAL. Domains which are clients of Keymaster HAL, such as keystore and vold domains, are granted rules targeting hal_keymaster only when the Keymaster HAL runs in passthrough mode (i.e., inside the client's process). When the HAL runs in binderized mode (i.e., in another process/domain, with clients talking to the HAL over HwBinder IPC), rules targeting hal_keymaster are not granted to client domains. Domains which offer a binderized implementation of Keymaster HAL, such as hal_keymaster_default domain, are always granted rules targeting hal_keymaster. Test: Password-protected sailfish boots up and lock screen unlocks -- this exercises vold -> Keymaster HAL interaction Test: All Android Keystore CTS tests pass -- this exercises keystore -> Keymaster HAL interaction: make cts cts-tradefed cts-tradefed run singleCommand cts --skip-device-info \ --skip-preconditions --skip-connectivity-check --abi arm64-v8a \ --module CtsKeystoreTestCases Bug: 34170079 Change-Id: I2254d0fdee72145721654d6c9e6e8d3331920ec7 2017-02-23 04:48:17 +01:00			`# HwBinder IPC from client to server`
			`binder_call(hal_keymaster_client, hal_keymaster_server)`
Preliminary policy for hal_keymaster (TREBLE) This adds the premissions required for android.hardware.keymaster@2.0-service to access the keymaster TA as well as for keystore and vold to lookup and use android.hardware.keymaster@2.0-service. IT DOES NOT remove the privileges from keystore and vold to access the keymaster TA directly. Test: Run keystore CTS tests Bug: 32020919 (cherry picked from commit 5090d6f3241ffbd96f5a0b24df602bd2559f3cf4) Change-Id: Ib02682da26e2dbcabd81bc23169f9bd0e832eb19 2017-01-28 00:00:27 +01:00
			`allow hal_keymaster tee_device:chr_file rw_file_perms;`
			`allow hal_keymaster tee:unix_stream_socket connectto;`

			`allow hal_keymaster ion_device:chr_file r_file_perms;`