Merge "Add sepolicies to allow hal_health_default to load BPFs."

private/bpfloader.te

@@ -40,7 +40,17 @@ neverallow domain { fs_bpf fs_bpf_tethering }:file ~{ create map open read setat
 
 neverallow { domain -bpfloader } *:bpf { map_create prog_load };
 
-neverallow { domain -bpfloader -gpuservice -mediaprovider_app -netd -netutils_wrapper -network_stack -system_server } *:bpf prog_run;
+neverallow {
+  domain
+  -bpfloader
+  -gpuservice
+  -hal_health_server
+  -mediaprovider_app
+  -netd
+  -netutils_wrapper
+  -network_stack
+  -system_server
+} *:bpf prog_run;
 neverallow { domain -bpfloader -gpuservice -lmkd -mediaprovider_app -netd -network_stack -system_server } *:bpf { map_read map_write };
 neverallow { domain -bpfloader -init } bpfloader_exec:file { execute execute_no_trans };
 

public/charger_vendor.te

@@ -2,3 +2,5 @@
 
 type charger_vendor, charger_type, domain;
 hal_server_domain(charger_vendor, hal_health)
+
+typeattribute charger_vendor bpfdomain;

public/hal_health.te

@@ -26,3 +26,9 @@ allow hal_health_server kmsg_device:chr_file { getattr w_file_perms };
 
 # Allow to use timerfd to wake itself up periodically to send health info.
 allow hal_health_server self:capability2 wake_alarm;
+
+# Use bpf programs
+allow hal_health_server fs_bpf:dir search;
+allow hal_health_server fs_bpf_vendor:dir search;
+allow hal_health_server fs_bpf_vendor:file read;
+allow hal_health_server bpfloader:bpf prog_run;

vendor/hal_health_default.te

@@ -1,5 +1,8 @@
 # health info abstraction
 type hal_health_default, domain;
+
+typeattribute hal_health_default bpfdomain;
+
 hal_server_domain(hal_health_default, hal_health)
 
 type hal_health_default_exec, exec_type, vendor_file_type, file_type;