tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Merge "Add sepolicy for binderfs" am: 50c5d731e0 am: 14b07efeab

Browse source 
Change-Id: Iaec254a18229c83394dd436806da576a8fdc4a6f
This commit is contained in:
Automerger Merge Worker 2020-01-06 17:02:10 +00:00
commit 25b59b848d
4 changed files with 16 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
private/compat/29.0/29.0.ignore.cil
View file

@ -12,6 +12,9 @@
auth_service
ashmem_libcutils_device
blob_store_service
binderfs
binderfs_logs
binderfs_logs_proc
boringssl_self_test
charger_prop
cold_boot_done_prop

6
private/genfs_contexts
View file

@ -290,9 +290,15 @@ genfscon debugfs /tracing/events/ftrace/print/
genfscon debugfs /kcov u:object_r:debugfs_kcov:s0
genfscon binder /binder u:object_r:binder_device:s0
genfscon binder /hwbinder u:object_r:hwbinder_device:s0
genfscon binder /vndbinder u:object_r:vndbinder_device:s0
genfscon binder /binder_logs u:object_r:binderfs_logs:s0
genfscon binder /binder_logs/proc u:object_r:binderfs_logs_proc:s0
genfscon inotifyfs / u:object_r:inotify:s0
genfscon vfat / u:object_r:vfat:s0
genfscon binder / u:object_r:binderfs:s0
genfscon exfat / u:object_r:exfat:s0
genfscon debugfs / u:object_r:debugfs:s0
genfscon fuse / u:object_r:fuse:s0

4
public/domain.te
View file

@ -80,6 +80,10 @@ allow domain ashmem_libcutils_device:chr_file rw_file_perms;
# /dev/binder can be accessed by ... everyone! :)
allow { domain -hwservicemanager -vndservicemanager } binder_device:chr_file rw_file_perms;
# /dev/binderfs needs to be accessed by everyone too!
allow domain binderfs:dir { getattr search };
allow domain binderfs_logs_proc:dir search;
allow { domain -servicemanager -vndservicemanager -isolated_app } hwbinder_device:chr_file rw_file_perms;
allow domain ptmx_device:chr_file rw_file_perms;
allow domain random_device:chr_file rw_file_perms;

3
public/file.te
View file

@ -4,6 +4,9 @@ type pipefs, fs_type;
type sockfs, fs_type;
type rootfs, fs_type;
type proc, fs_type, proc_type;
type binderfs, fs_type;
type binderfs_logs, fs_type;
type binderfs_logs_proc, fs_type;
# Security-sensitive proc nodes that should not be writable to most.
type proc_security, fs_type, proc_type;
type proc_drop_caches, fs_type, proc_type;