tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

healthd: restore healthd sepolicy for charger mode

Browse source 
Test: Boot charge-only and android on sailfish

Bug: https://b/33672744

Change-Id: I6a25e90a716ec0ca46b5ba5edad860aa0eebafef
Signed-off-by: Sandeep Patil <sspatil@google.com>
This commit is contained in:
Sandeep Patil 2016-12-15 12:36:45 -08:00
parent e8dbdfa88e
commit 3b25e38410
2 changed files with 36 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
private/init.te
View file

@ -5,6 +5,7 @@ tmpfs_domain(init)
# Transitions to seclabel processes in init.rc # Transitions to seclabel processes in init.rc
domain_trans(init, rootfs, adbd) domain_trans(init, rootfs, adbd)
domain_trans(init, rootfs, charger) domain_trans(init, rootfs, charger)
domain_trans(init, rootfs, healthd)
domain_trans(init, rootfs, slideshow) domain_trans(init, rootfs, slideshow)
recovery_only(` recovery_only(`
domain_trans(init, rootfs, recovery) domain_trans(init, rootfs, recovery)

39
public/healthd.te
View file

@ -15,19 +15,50 @@ r_dir_file(healthd, cgroup)
r_dir_file(healthd, system_file) r_dir_file(healthd, system_file)
allow healthd self:capability { net_admin sys_tty_config }; allow healthd self:capability { net_admin sys_tty_config };
allow healthd self:capability sys_boot;
wakelock_use(healthd)
allow healthd self:netlink_kobject_uevent_socket create_socket_perms_no_ioctl; allow healthd self:netlink_kobject_uevent_socket create_socket_perms_no_ioctl;
wakelock_use(healthd)
binder_use(healthd) binder_use(healthd)
binder_service(healthd) binder_service(healthd)
binder_call(healthd, system_server) binder_call(healthd, system_server)
binder_call(healthd, hwservicemanager) binder_call(healthd, hwservicemanager)
binder_call(healthd, hal_health) binder_call(healthd, hal_health)
# Write to state file.
# TODO: Split into a separate type?
allow healthd sysfs:file write;
# TODO: added to match above sysfs rule. Remove me?
allow healthd sysfs_usb:file write;
allow healthd sysfs_batteryinfo:file r_file_perms; allow healthd sysfs_batteryinfo:file r_file_perms;
r_dir_file(healthd, sysfs_type)
###
### healthd: charger mode
###
# Read /sys/fs/pstore/console-ramoops
# Don't worry about overly broad permissions for now, as there's
# only one file in /sys/fs/pstore
allow healthd pstorefs:dir r_dir_perms;
allow healthd pstorefs:file r_file_perms;
allow healthd graphics_device:dir r_dir_perms;
allow healthd graphics_device:chr_file rw_file_perms;
allow healthd input_device:dir r_dir_perms;
allow healthd input_device:chr_file r_file_perms;
allow healthd tty_device:chr_file rw_file_perms;
allow healthd ashmem_device:chr_file execute;
allow healthd self:process execmem;
allow healthd proc_sysrq:file rw_file_perms;
allow healthd batteryproperties_service:service_manager { add find }; allow healthd batteryproperties_service:service_manager { add find };
# healthd can fake the battery existense if ro.boot.fake_battery is set # Healthd needs to tell init to continue the boot
get_prop(healthd, system_prop) # process when running in charger mode.
set_prop(healthd, system_prop)