tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

sepolicy: Create new attribute to serve ISuspendControlServiceInternal

Browse source 
Bug: 178417023
Test: Verified manually
Change-Id: Ie058ecf6b31c260e7788cbf0e74fa4182129d3e1
Signed-off-by: Darren Hsu <darrenhsu@google.com>
This commit is contained in:
Darren Hsu 2021-02-25 18:02:53 +08:00
parent a18cf7ed0c
commit 70ae5f4c34
3 changed files with 14 additions and 12 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

14
private/system_suspend.te
View file

@ -1,11 +1,10 @@
type system_suspend, domain, coredomain, system_suspend_server;
type system_suspend, domain, coredomain, system_suspend_server, system_suspend_internal_server;
type system_suspend_exec, system_file_type, exec_type, file_type;
init_daemon_domain(system_suspend)
# To serve ISuspendControlService and ISuspendControlServiceInternal.
# To serve ISuspendControlService.
binder_use(system_suspend)
add_service(system_suspend, system_suspend_control_internal_service)
add_service(system_suspend, system_suspend_control_service)
# Access to /sys/power/{ wakeup_count, state } suspend interface.
@ -28,15 +27,6 @@ allow system_suspend bluetooth:binder call;
allow system_suspend dumpstate:fd use;
allow system_suspend dumpstate:fifo_file write;
neverallow {
domain
-atrace # tracing
-dumpstate # bug reports
-system_suspend # implements system_suspend_control_internal_service
-system_server # configures system_suspend via ISuspendControlServiceInternal
-traceur_app # tracing
} system_suspend_control_internal_service:service_manager find;
neverallow {
domain
-atrace # tracing

1
public/attributes
View file

@ -376,6 +376,7 @@ attribute display_service_server;
attribute scheduler_service_server;
attribute sensor_service_server;
attribute stats_service_server;
attribute system_suspend_internal_server;
attribute system_suspend_server;
attribute wifi_keystore_service_server;

11
public/system_suspend_internal_server.te Normal file
View file

@ -0,0 +1,11 @@
# To serve ISuspendControlServiceInternal.
add_service(system_suspend_internal_server, system_suspend_control_internal_service)
neverallow {
domain
-atrace # tracing
-dumpstate # bug reports
-system_suspend_internal_server # implements system_suspend_control_internal_service
-system_server # configures system_suspend via ISuspendControlServiceInternal
-traceur_app # tracing
} system_suspend_control_internal_service:service_manager find;