tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Allow the framework to communicate with netd via a binder service

Browse source 
This will allow us to provide a better interface between Java
services (e.g., ConnectivityService) and netd than the current
FrameworkListener / NativeDaemonConnector interface which uses
text strings over a Unix socket.

Bug: 27239233
Change-Id: If40582ae2820e54f1960556b7bf7e88d98c525af
This commit is contained in:
Lorenzo Colitti 2016-02-18 23:55:51 +09:00
parent db8d34495f
commit 24dcc8b1ce
4 changed files with 13 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
netd.te
View file

@ -64,10 +64,19 @@ allow netd clatd:process signal;
set_prop(netd, ctl_mdnsd_prop) set_prop(netd, ctl_mdnsd_prop)
# Allow netd to publish a binder service and make binder calls.
binder_use(netd)
binder_service(netd)
allow netd netd_service:service_manager add;
# Allow netd to call into the system server so it can check permissions.
allow netd system_server:binder call;
# Allow netd to operate on sockets that are passed to it. # Allow netd to operate on sockets that are passed to it.
allow netd netdomain:{tcp_socket udp_socket rawip_socket dccp_socket tun_socket} {read write getattr setattr getopt setopt}; allow netd netdomain:{tcp_socket udp_socket rawip_socket dccp_socket tun_socket} {read write getattr setattr getopt setopt};
allow netd netdomain:fd use; allow netd netdomain:fd use;
### ###
### Neverallow rules ### Neverallow rules
### ###

1
service.te
View file

@ -12,6 +12,7 @@ type mediaserver_service, service_manager_type;
type mediaextractor_service, service_manager_type; type mediaextractor_service, service_manager_type;
type mediacodec_service, service_manager_type; type mediacodec_service, service_manager_type;
type mediadrmserver_service, service_manager_type; type mediadrmserver_service, service_manager_type;
type netd_service, service_manager_type;
type nfc_service, service_manager_type; type nfc_service, service_manager_type;
type radio_service, service_manager_type; type radio_service, service_manager_type;
type surfaceflinger_service, service_manager_type; type surfaceflinger_service, service_manager_type;

1
service_contexts
View file

@ -2,6 +2,7 @@ accessibility u:object_r:accessibility_service:s0
account u:object_r:account_service:s0 account u:object_r:account_service:s0
activity u:object_r:activity_service:s0 activity u:object_r:activity_service:s0
alarm u:object_r:alarm_service:s0 alarm u:object_r:alarm_service:s0
android.net.INetd u:object_r:netd_service:s0
android.os.UpdateEngineService u:object_r:update_engine_service:s0 android.os.UpdateEngineService u:object_r:update_engine_service:s0
android.security.keystore u:object_r:keystore_service:s0 android.security.keystore u:object_r:keystore_service:s0
android.service.gatekeeper.IGateKeeperService u:object_r:gatekeeper_service:s0 android.service.gatekeeper.IGateKeeperService u:object_r:gatekeeper_service:s0

2
system_server.te
View file

@ -136,6 +136,7 @@ binder_call(system_server, gatekeeperd)
binder_call(system_server, fingerprintd) binder_call(system_server, fingerprintd)
binder_call(system_server, { appdomain autoplay_app }) binder_call(system_server, { appdomain autoplay_app })
binder_call(system_server, dumpstate) binder_call(system_server, dumpstate)
binder_call(system_server, netd)
binder_service(system_server) binder_service(system_server)
# Ask debuggerd to dump backtraces for native stacks of interest. # Ask debuggerd to dump backtraces for native stacks of interest.
@ -396,6 +397,7 @@ allow system_server mediaserver_service:service_manager find;
allow system_server mediaextractor_service:service_manager find; allow system_server mediaextractor_service:service_manager find;
allow system_server mediacodec_service:service_manager find; allow system_server mediacodec_service:service_manager find;
allow system_server mediadrmserver_service:service_manager find; allow system_server mediadrmserver_service:service_manager find;
allow system_server netd_service:service_manager find;
allow system_server nfc_service:service_manager find; allow system_server nfc_service:service_manager find;
allow system_server radio_service:service_manager find; allow system_server radio_service:service_manager find;
allow system_server system_server_service:service_manager { add find }; allow system_server system_server_service:service_manager { add find };