diff --git a/private/property_contexts b/private/property_contexts index 4eda4a169..2a46b1a8f 100644 --- a/private/property_contexts +++ b/private/property_contexts @@ -1341,3 +1341,6 @@ ro.gms.dck.eligible_wcc u:object_r:dck_prop:s0 exact int # virtualization service properties virtualizationservice.state.last_cid u:object_r:virtualizationservice_prop:s0 exact uint + +# Adaptive haptics settings property +vibrator.adaptive_haptics.enabled u:object_r:adaptive_haptics_prop:s0 exact string diff --git a/private/system_app.te b/private/system_app.te index 77cca3d01..76e5f7dac 100644 --- a/private/system_app.te +++ b/private/system_app.te @@ -34,6 +34,7 @@ allow system_app wallpaper_file:file r_file_perms; allow system_app icon_file:file r_file_perms; # Write to properties +set_prop(system_app, adaptive_haptics_prop) set_prop(system_app, arm64_memtag_prop) set_prop(system_app, bluetooth_a2dp_offload_prop) set_prop(system_app, bluetooth_audio_hal_prop) @@ -189,3 +190,6 @@ neverallow system_app fuse_device:chr_file *; # bug reports, but not reads. neverallow system_app shell_data_file:dir { no_w_dir_perms open search read }; neverallow system_app shell_data_file:file { open read ioctl lock }; + +# system_app should be the only domain writing the adaptive haptics prop +neverallow { domain -init -system_app } adaptive_haptics_prop:property_service set; diff --git a/public/property.te b/public/property.te index 42fe9798f..763a80a59 100644 --- a/public/property.te +++ b/public/property.te @@ -52,6 +52,7 @@ compatible_property_only(` # Properties which can't be written outside system system_restricted_prop(aac_drc_prop) +system_restricted_prop(adaptive_haptics_prop) system_restricted_prop(arm64_memtag_prop) system_restricted_prop(binder_cache_bluetooth_server_prop) system_restricted_prop(binder_cache_system_server_prop)