tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Merge "Treble devices use binderized HALs" into oc-dev

Browse source 
am: 8015cfd532

Change-Id: I32a9fb6593773701bb1a617a4899e100e3e1b1ce
This commit is contained in:
Alex Klyubin 2017-04-13 17:56:39 +00:00 committed by android-build-merger
commit 129eec0771
2 changed files with 5 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
private/system_server.te
View file

@ -197,11 +197,6 @@ binder_call(system_server, hal_vr)
hal_client_domain(system_server, hal_vr)
hal_client_domain(system_server, hal_wifi)
# TODO(b/34274385): Remove this once Wi-Fi Supplicant HAL is guaranteed to be binderized on full
# Treble devices. Passthrough Wi-Fi Supplicant HAL makes system_server touch wpa_socket which is a
# vendor type. system_server, being a non-vendor component, is not permitted to touch that socket.
typeattribute system_server socket_between_core_and_vendor_violators;
hal_client_domain(system_server, hal_wifi_supplicant)
# Talk to tombstoned to get ANR traces.

8
public/te_macros
View file

@ -175,15 +175,17 @@ define(`hal_client_domain', `
typeattribute $1 halclientdomain;
typeattribute $1 $2_client;
# TODO(b/34170079): Make the inclusion of the rules below conditional,
# once we know at build time whether a HAL is going to run in
# passthrough or binderized mode.
# TODO(b/34170079): Make the inclusion of the rules below conditional also on
# non-Treble devices. For now, on non-Treble device, always grant clients of a
# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process).
not_full_treble(`
typeattribute $1 $2;
# Find passthrough HAL implementations
allow $2 system_file:dir r_dir_perms;
allow $2 vendor_file:dir r_dir_perms;
allow $2 vendor_file:file { read open getattr execute };
')
')
#####################################
# passthrough_hal_client_domain(domain, hal_type)