tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

sepolicy: make exec_types in /vendor a subset of vendor_file_type

Browse source 
We install all default hal implementations in /vendor/bin/hw along with
a few domains that are defined in vendor policy and installed in
/vendor. These files MUST be a subset of the global 'vendor_file_type'
which is used to address *all files installed in /vendor* throughout the
policy.

Bug: 36463595
Test: Boot sailfish without any new denials

Change-Id: I3d26778f9a26f9095f49d8ecc12f2ec9d2f4cb41
Signed-off-by: Sandeep Patil <sspatil@google.com>
This commit is contained in:
Sandeep Patil 2017-04-10 13:03:28 -07:00
parent c051300e5e
commit 2ee66e7d14
33 changed files with 33 additions and 33 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
public/mediacodec.te
View file

@ -1,6 +1,6 @@
# mediacodec - audio and video codecs live here
type mediacodec, domain;
type mediacodec_exec, exec_type, file_type;
type mediacodec_exec, exec_type, vendor_file_type, file_type;
typeattribute mediacodec mlstrustedsubject;

2
vendor/hal_audio_default.te vendored
View file

@ -1,7 +1,7 @@
type hal_audio_default, domain;
hal_server_domain(hal_audio_default, hal_audio)
type hal_audio_default_exec, exec_type, file_type;
type hal_audio_default_exec, exec_type, vendor_file_type, file_type;
init_daemon_domain(hal_audio_default)
hal_client_domain(hal_audio_default, hal_allocator)

2
vendor/hal_bluetooth_default.te vendored
View file

@ -1,5 +1,5 @@
type hal_bluetooth_default, domain;
hal_server_domain(hal_bluetooth_default, hal_bluetooth)
type hal_bluetooth_default_exec, exec_type, file_type;
type hal_bluetooth_default_exec, exec_type, vendor_file_type, file_type;
init_daemon_domain(hal_bluetooth_default)

2
vendor/hal_bootctl_default.te vendored
View file

@ -2,5 +2,5 @@
type hal_bootctl_default, domain;
hal_server_domain(hal_bootctl_default, hal_bootctl)
type hal_bootctl_default_exec, exec_type, file_type;
type hal_bootctl_default_exec, exec_type, vendor_file_type, file_type;
init_daemon_domain(hal_bootctl_default)

2
vendor/hal_camera_default.te vendored
View file

@ -1,7 +1,7 @@
type hal_camera_default, domain;
hal_server_domain(hal_camera_default, hal_camera)
type hal_camera_default_exec, exec_type, file_type;
type hal_camera_default_exec, exec_type, vendor_file_type, file_type;
init_daemon_domain(hal_camera_default)
# TODO (b/36601397) move hal_camera's data file to

2
vendor/hal_configstore_default.te vendored
View file

@ -1,5 +1,5 @@
type hal_configstore_default, domain;
hal_server_domain(hal_configstore_default, hal_configstore)
type hal_configstore_default_exec, exec_type, file_type;
type hal_configstore_default_exec, exec_type, vendor_file_type, file_type;
init_daemon_domain(hal_configstore_default)

2
vendor/hal_contexthub_default.te vendored
View file

@ -1,5 +1,5 @@
type hal_contexthub_default, domain;
hal_server_domain(hal_contexthub_default, hal_contexthub)
type hal_contexthub_default_exec, exec_type, file_type;
type hal_contexthub_default_exec, exec_type, vendor_file_type, file_type;
init_daemon_domain(hal_contexthub_default)

2
vendor/hal_drm_default.te vendored
View file

@ -1,7 +1,7 @@
type hal_drm_default, domain;
hal_server_domain(hal_drm_default, hal_drm)
type hal_drm_default_exec, exec_type, file_type;
type hal_drm_default_exec, exec_type, vendor_file_type, file_type;
init_daemon_domain(hal_drm_default)
allow hal_drm_default mediacodec:fd use;

2
vendor/hal_dumpstate_default.te vendored
View file

@ -1,5 +1,5 @@
type hal_dumpstate_default, domain;
hal_server_domain(hal_dumpstate_default, hal_dumpstate)
type hal_dumpstate_default_exec, exec_type, file_type;
type hal_dumpstate_default_exec, exec_type, vendor_file_type, file_type;
init_daemon_domain(hal_dumpstate_default)

2
vendor/hal_fingerprint_default.te vendored
View file

@ -1,7 +1,7 @@
type hal_fingerprint_default, domain;
hal_server_domain(hal_fingerprint_default, hal_fingerprint)
type hal_fingerprint_default_exec, exec_type, file_type;
type hal_fingerprint_default_exec, exec_type, vendor_file_type, file_type;
init_daemon_domain(hal_fingerprint_default)
# TODO (b/36644492) move hal_fingerprint's data file to

2
vendor/hal_gatekeeper_default.te vendored
View file

@ -1,5 +1,5 @@
type hal_gatekeeper_default, domain;
hal_server_domain(hal_gatekeeper_default, hal_gatekeeper)
type hal_gatekeeper_default_exec, exec_type, file_type;
type hal_gatekeeper_default_exec, exec_type, vendor_file_type, file_type;
init_daemon_domain(hal_gatekeeper_default);

2
vendor/hal_gnss_default.te vendored
View file

@ -1,7 +1,7 @@
type hal_gnss_default, domain;
hal_server_domain(hal_gnss_default, hal_gnss)
type hal_gnss_default_exec, exec_type, file_type;
type hal_gnss_default_exec, exec_type, vendor_file_type, file_type;
init_daemon_domain(hal_gnss_default)
# Read access to system files for HALs in

2
vendor/hal_graphics_allocator_default.te vendored
View file

@ -1,5 +1,5 @@
type hal_graphics_allocator_default, domain;
hal_server_domain(hal_graphics_allocator_default, hal_graphics_allocator)
type hal_graphics_allocator_default_exec, exec_type, file_type;
type hal_graphics_allocator_default_exec, exec_type, vendor_file_type, file_type;
init_daemon_domain(hal_graphics_allocator_default)

2
vendor/hal_graphics_composer_default.te vendored
View file

@ -1,5 +1,5 @@
type hal_graphics_composer_default, domain;
hal_server_domain(hal_graphics_composer_default, hal_graphics_composer)
type hal_graphics_composer_default_exec, exec_type, file_type;
type hal_graphics_composer_default_exec, exec_type, vendor_file_type, file_type;
init_daemon_domain(hal_graphics_composer_default)

2
vendor/hal_health_default.te vendored
View file

@ -2,5 +2,5 @@
type hal_health_default, domain;
hal_server_domain(hal_health_default, hal_health)
type hal_health_default_exec, exec_type, file_type;
type hal_health_default_exec, exec_type, vendor_file_type, file_type;
init_daemon_domain(hal_health_default)

2
vendor/hal_ir_default.te vendored
View file

@ -1,5 +1,5 @@
type hal_ir_default, domain;
hal_server_domain(hal_ir_default, hal_ir)
type hal_ir_default_exec, exec_type, file_type;
type hal_ir_default_exec, exec_type, vendor_file_type, file_type;
init_daemon_domain(hal_ir_default)

2
vendor/hal_keymaster_default.te vendored
View file

@ -1,5 +1,5 @@
type hal_keymaster_default, domain;
hal_server_domain(hal_keymaster_default, hal_keymaster)
type hal_keymaster_default_exec, exec_type, file_type;
type hal_keymaster_default_exec, exec_type, vendor_file_type, file_type;
init_daemon_domain(hal_keymaster_default)

2
vendor/hal_light_default.te vendored
View file

@ -1,5 +1,5 @@
type hal_light_default, domain;
hal_server_domain(hal_light_default, hal_light)
type hal_light_default_exec, exec_type, file_type;
type hal_light_default_exec, exec_type, vendor_file_type, file_type;
init_daemon_domain(hal_light_default)

2
vendor/hal_memtrack_default.te vendored
View file

@ -1,5 +1,5 @@
type hal_memtrack_default, domain;
hal_server_domain(hal_memtrack_default, hal_memtrack)
type hal_memtrack_default_exec, exec_type, file_type;
type hal_memtrack_default_exec, exec_type, vendor_file_type, file_type;
init_daemon_domain(hal_memtrack_default)

2
vendor/hal_nfc_default.te vendored
View file

@ -1,7 +1,7 @@
type hal_nfc_default, domain;
hal_server_domain(hal_nfc_default, hal_nfc)
type hal_nfc_default_exec, exec_type, file_type;
type hal_nfc_default_exec, exec_type, vendor_file_type, file_type;
init_daemon_domain(hal_nfc_default)
# TODO (b/36645109) Remove hal_nfc's access to the nfc app's

2
vendor/hal_power_default.te vendored
View file

@ -1,5 +1,5 @@
type hal_power_default, domain;
hal_server_domain(hal_power_default, hal_power)
type hal_power_default_exec, exec_type, file_type;
type hal_power_default_exec, exec_type, vendor_file_type, file_type;
init_daemon_domain(hal_power_default)

2
vendor/hal_sensors_default.te vendored
View file

@ -1,5 +1,5 @@
type hal_sensors_default, domain;
hal_server_domain(hal_sensors_default, hal_sensors)
type hal_sensors_default_exec, exec_type, file_type;
type hal_sensors_default_exec, exec_type, vendor_file_type, file_type;
init_daemon_domain(hal_sensors_default)

2
vendor/hal_thermal_default.te vendored
View file

@ -1,5 +1,5 @@
type hal_thermal_default, domain;
hal_server_domain(hal_thermal_default, hal_thermal)
type hal_thermal_default_exec, exec_type, file_type;
type hal_thermal_default_exec, exec_type, vendor_file_type, vendor_file_type, file_type;
init_daemon_domain(hal_thermal_default)

2
vendor/hal_tv_input_default.te vendored
View file

@ -1,6 +1,6 @@
type hal_tv_input_default, domain;
hal_server_domain(hal_tv_input_default, hal_tv_input)
type hal_tv_input_default_exec, exec_type, file_type;
type hal_tv_input_default_exec, exec_type, vendor_file_type, file_type;
init_daemon_domain(hal_tv_input_default)

2
vendor/hal_usb_default.te vendored
View file

@ -1,5 +1,5 @@
type hal_usb_default, domain;
hal_server_domain(hal_usb_default, hal_usb)
type hal_usb_default_exec, exec_type, file_type;
type hal_usb_default_exec, exec_type, vendor_file_type, file_type;
init_daemon_domain(hal_usb_default)

2
vendor/hal_vibrator_default.te vendored
View file

@ -1,5 +1,5 @@
type hal_vibrator_default, domain;
hal_server_domain(hal_vibrator_default, hal_vibrator)
type hal_vibrator_default_exec, exec_type, file_type;
type hal_vibrator_default_exec, exec_type, vendor_file_type, file_type;
init_daemon_domain(hal_vibrator_default)

2
vendor/hal_vr_default.te vendored
View file

@ -1,5 +1,5 @@
type hal_vr_default, domain;
hal_server_domain(hal_vr_default, hal_vr)
type hal_vr_default_exec, exec_type, file_type;
type hal_vr_default_exec, exec_type, vendor_file_type, file_type;
init_daemon_domain(hal_vr_default)

2
vendor/hal_wifi_default.te vendored
View file

@ -1,5 +1,5 @@
type hal_wifi_default, domain;
hal_server_domain(hal_wifi_default, hal_wifi)
type hal_wifi_default_exec, exec_type, file_type;
type hal_wifi_default_exec, exec_type, vendor_file_type, file_type;
init_daemon_domain(hal_wifi_default)

2
vendor/hal_wifi_supplicant_default.te vendored
View file

@ -1,7 +1,7 @@
# wpa supplicant or equivalent
type hal_wifi_supplicant_default, domain;
hal_server_domain(hal_wifi_supplicant_default, hal_wifi_supplicant)
type hal_wifi_supplicant_default_exec, exec_type, file_type;
type hal_wifi_supplicant_default_exec, exec_type, vendor_file_type, file_type;
init_daemon_domain(hal_wifi_supplicant_default)
net_domain(hal_wifi_supplicant_default)

2
vendor/hostapd.te vendored
View file

@ -1,6 +1,6 @@
# userspace wifi access points
type hostapd, domain;
type hostapd_exec, exec_type, file_type;
type hostapd_exec, exec_type, vendor_file_type, file_type;
init_daemon_domain(hostapd)

2
vendor/rild.te vendored
View file

@ -1,6 +1,6 @@
# type_transition must be private policy the domain_trans rules could stay
# public, but conceptually should go with this
type rild_exec, exec_type, file_type;
type rild_exec, exec_type, vendor_file_type, file_type;
init_daemon_domain(rild)
# TODO(b/36613472), TODO(b/36718031): Remove this once rild no longer

2
vendor/tee.te vendored
View file

@ -3,7 +3,7 @@
#
typeattribute tee domain_deprecated;
type tee_exec, exec_type, file_type;
type tee_exec, exec_type, vendor_file_type, file_type;
init_daemon_domain(tee)
allow tee self:capability { dac_override };

2
vendor/vndservicemanager.te vendored
View file

@ -1,5 +1,5 @@
# vndservicemanager - the Binder context manager for vendor processes
type vndservicemanager_exec, exec_type, file_type;
type vndservicemanager_exec, exec_type, vendor_file_type, file_type;
init_daemon_domain(vndservicemanager);