tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

sepolicy: allow access to binderfs feature files

Browse source 
The binder driver now advertises the features it supports through
individual files under /dev/binderfs/features/*. Let all domains have
access to these files to determine how to interact with the driver.

Bug: 191910201
Tested: clients are able to read feature files via libbinder
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Change-Id: Ice5de9efee74e571ef0a23ce093af162fc3b276e
This commit is contained in:
Carlos Llamas 2022-02-24 08:15:56 -08:00
parent b02ac32420
commit 75821321c7
4 changed files with 5 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
private/compat/32.0/32.0.ignore.cil
View file

@ -9,6 +9,7 @@
artd_service
attestation_verification_service
bluetooth_config_prop
binderfs_features
charger_vendor
cloudsearch
cloudsearch_service

1
private/genfs_contexts
View file

@ -377,6 +377,7 @@ genfscon binder /hwbinder u:object_r:hwbinder_device:s0
genfscon binder /vndbinder u:object_r:vndbinder_device:s0
genfscon binder /binder_logs u:object_r:binderfs_logs:s0
genfscon binder /binder_logs/proc u:object_r:binderfs_logs_proc:s0
genfscon binder /features u:object_r:binderfs_features:s0
genfscon inotifyfs / u:object_r:inotify:s0
genfscon vfat / u:object_r:vfat:s0

2
public/domain.te
View file

@ -88,6 +88,8 @@ allowxperm domain binder_device:chr_file ioctl { unpriv_binder_ioctls };
# /dev/binderfs needs to be accessed by everyone too!
allow domain binderfs:dir { getattr search };
allow domain binderfs_logs_proc:dir search;
allow domain binderfs_features:dir search;
allow domain binderfs_features:file r_file_perms;
allow { domain -servicemanager -vndservicemanager -isolated_app } hwbinder_device:chr_file rw_file_perms;
allow domain ptmx_device:chr_file rw_file_perms;

1
public/file.te
View file

@ -7,6 +7,7 @@ type proc, fs_type, proc_type;
type binderfs, fs_type;
type binderfs_logs, fs_type;
type binderfs_logs_proc, fs_type;
type binderfs_features, fs_type;
# Security-sensitive proc nodes that should not be writable to most.
type proc_security, fs_type, proc_type;
type proc_drop_caches, fs_type, proc_type;