tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Further refined service_manager auditallow statements.

Browse source 
Further refined auditallow statements associated with
service_manager and added dumpstate to the
service_manager_local_audit_domain.

Change-Id: I2ecc42c8660de6a91f3b4e56268344fbd069ccc0
This commit is contained in:
Riley Spahn 2014-07-18 09:24:13 -07:00
parent 26d6371c5a
commit 603bc20509
8 changed files with 32 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
bluetooth.te
View file

@ -54,6 +54,7 @@ service_manager_local_audit_domain(bluetooth)
auditallow bluetooth {
service_manager_type
-bluetooth_service
-radio_service
-system_server_service
}:service_manager find;

6
drmserver.te
View file

@ -49,4 +49,8 @@ allow drmserver drmserver_service:service_manager add;
# Audited locally.
service_manager_local_audit_domain(drmserver)
auditallow drmserver { service_manager_type -drmserver_service }:service_manager find;
auditallow drmserver {
service_manager_type
-drmserver_service
-system_server_service
}:service_manager find;

15
dumpstate.te
View file

@ -96,3 +96,18 @@ control_logd(dumpstate)
# Read network state info files.
allow dumpstate net_data_file:dir search;
allow dumpstate net_data_file:file r_file_perms;
service_manager_local_audit_domain(dumpstate)
auditallow dumpstate {
service_manager_type
-drmserver_service
-healthd_service
-inputflinger_service
-keystore_service
-mediaserver_service
-nfc_service
-radio_service
-surfaceflinger_service
-system_app_service
-system_server_service
}:service_manager find;

7
isolated_app.te
View file

@ -21,4 +21,9 @@ allow isolated_app app_data_file:file execute;
# Audited locally.
service_manager_local_audit_domain(isolated_app)
auditallow isolated_app service_manager_type:service_manager find;
auditallow isolated_app {
service_manager_type
-radio_service
-surfaceflinger_service
-system_server_service
}:service_manager find;

1
nfc.te
View file

@ -21,5 +21,6 @@ service_manager_local_audit_domain(nfc)
auditallow nfc {
service_manager_type
-mediaserver_service
-surfaceflinger_service
-system_server_service
}:service_manager find;

1
radio.te
View file

@ -35,5 +35,6 @@ auditallow radio {
service_manager_type
-mediaserver_service
-radio_service
-surfaceflinger_service
-system_server_service
}:service_manager find;

2
system_app.te
View file

@ -69,7 +69,9 @@ control_logd(system_app)
service_manager_local_audit_domain(system_app)
auditallow system_app {
service_manager_type
-keystore_service
-nfc_service
-radio_service
-surfaceflinger_service
-system_server_service
}:service_manager find;

1
untrusted_app.te
View file

@ -69,6 +69,7 @@ service_manager_local_audit_domain(untrusted_app)
auditallow untrusted_app {
service_manager_type
-drmserver_service
-keystore_service
-mediaserver_service
-nfc_service
-radio_service