tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Fix SE policy violation of Wi-Fi vendor AIDL service

Browse source 
Wi-Fi vendor AIDL service uses NDK to register itself to service
manager. AServiceManager_registerLazyService registers an
IClientCallback to service manager. The callback is invoked when there
is a transition between having >= 1 clients and having 0 clients (or
vice versa). Please check IClientCallback.aidl. As a result servicemanager may
make binder call to Wi-Fi vendor AIDL service. Since this is not allowed
per current SE policies, "avc denied" occurred:

servicemanager: type=1400 audit(0.0:248): avc: denied { call } for scontext=u:r:servicemanager:s0 tcontext=u:r:hal_wifi_default:s0 tclass=binder permissive=0

We add SE policy for hal_wifi_default to allow binder call like this.

Bug: 270511173
Test: manually build and test, check logs for avc denied

Change-Id: Ia6fcf5fc1cafff0381fc9857805bdc61cc838c1e
This commit is contained in:
Ye Jiao 2023-02-23 12:23:33 +08:00 committed by chuanghua zhao
parent fcf62c8cf4
commit 10a639613a
1 changed files with 1 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
public/hal_wifi.te
View file

@ -5,7 +5,7 @@ binder_call(hal_wifi_server, hal_wifi_client)
hal_attribute_hwservice(hal_wifi, hal_wifi_hwservice)
hal_attribute_service(hal_wifi, hal_wifi_service)
binder_call(hal_wifi_server, servicemanager)
binder_use(hal_wifi_server)
r_dir_file(hal_wifi, proc_net_type)
r_dir_file(hal_wifi, sysfs_type)