tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Merge "Add sepolicy for binderfs"

Browse source 
am: 50c5d731e0

Change-Id: I722059ccd8e312a2b5a2c7abaae04c751c2c2585
This commit is contained in:
Hridya Valsaraju 2020-01-06 08:39:50 -08:00 committed by android-build-merger
commit 14b07efeab
4 changed files with 16 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
private/compat/29.0/29.0.ignore.cil
View file

@ -12,6 +12,9 @@
auth_service auth_service
ashmem_libcutils_device ashmem_libcutils_device
blob_store_service blob_store_service
binderfs
binderfs_logs
binderfs_logs_proc
boringssl_self_test boringssl_self_test
charger_prop charger_prop
cold_boot_done_prop cold_boot_done_prop

6
private/genfs_contexts
View file

@ -290,9 +290,15 @@ genfscon debugfs /tracing/events/ftrace/print/
genfscon debugfs /kcov u:object_r:debugfs_kcov:s0 genfscon debugfs /kcov u:object_r:debugfs_kcov:s0
genfscon binder /binder u:object_r:binder_device:s0
genfscon binder /hwbinder u:object_r:hwbinder_device:s0
genfscon binder /vndbinder u:object_r:vndbinder_device:s0
genfscon binder /binder_logs u:object_r:binderfs_logs:s0
genfscon binder /binder_logs/proc u:object_r:binderfs_logs_proc:s0
genfscon inotifyfs / u:object_r:inotify:s0 genfscon inotifyfs / u:object_r:inotify:s0
genfscon vfat / u:object_r:vfat:s0 genfscon vfat / u:object_r:vfat:s0
genfscon binder / u:object_r:binderfs:s0
genfscon exfat / u:object_r:exfat:s0 genfscon exfat / u:object_r:exfat:s0
genfscon debugfs / u:object_r:debugfs:s0 genfscon debugfs / u:object_r:debugfs:s0
genfscon fuse / u:object_r:fuse:s0 genfscon fuse / u:object_r:fuse:s0

4
public/domain.te
View file

@ -80,6 +80,10 @@ allow domain ashmem_libcutils_device:chr_file rw_file_perms;
# /dev/binder can be accessed by ... everyone! :) # /dev/binder can be accessed by ... everyone! :)
allow { domain -hwservicemanager -vndservicemanager } binder_device:chr_file rw_file_perms; allow { domain -hwservicemanager -vndservicemanager } binder_device:chr_file rw_file_perms;
# /dev/binderfs needs to be accessed by everyone too!
allow domain binderfs:dir { getattr search };
allow domain binderfs_logs_proc:dir search;
allow { domain -servicemanager -vndservicemanager -isolated_app } hwbinder_device:chr_file rw_file_perms; allow { domain -servicemanager -vndservicemanager -isolated_app } hwbinder_device:chr_file rw_file_perms;
allow domain ptmx_device:chr_file rw_file_perms; allow domain ptmx_device:chr_file rw_file_perms;
allow domain random_device:chr_file rw_file_perms; allow domain random_device:chr_file rw_file_perms;

3
public/file.te
View file

@ -4,6 +4,9 @@ type pipefs, fs_type;
type sockfs, fs_type; type sockfs, fs_type;
type rootfs, fs_type; type rootfs, fs_type;
type proc, fs_type, proc_type; type proc, fs_type, proc_type;
type binderfs, fs_type;
type binderfs_logs, fs_type;
type binderfs_logs_proc, fs_type;
# Security-sensitive proc nodes that should not be writable to most. # Security-sensitive proc nodes that should not be writable to most.
type proc_security, fs_type, proc_type; type proc_security, fs_type, proc_type;
type proc_drop_caches, fs_type, proc_type; type proc_drop_caches, fs_type, proc_type;