tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

dumpstate: talk to vibrator hal

Browse source 
Bug: 33067126
Test: Dumpstate vibrator works.
Change-Id: I46ff453218ba77f156e13b448e3cba9a291df0e7
This commit is contained in:
Steven Moreland 2016-11-29 13:54:56 -08:00
parent 7b6dbd7360
commit 839c7ded30
1 changed files with 11 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

16
public/dumpstate.te
View file

@ -79,11 +79,6 @@ allow dumpstate {
surfaceflinger surfaceflinger
}:debuggerd dump_backtrace; }:debuggerd dump_backtrace;
# Vibrate the device after we're done collecting the bugreport
# /sys/class/timed_output/vibrator/enable
# TODO: create a new file class, instead of allowing write access to all of /sys
allow dumpstate sysfs:file w_file_perms;
# TODO: added to match above sysfs rule. Remove me? # TODO: added to match above sysfs rule. Remove me?
allow dumpstate sysfs_usb:file w_file_perms; allow dumpstate sysfs_usb:file w_file_perms;
@ -102,6 +97,13 @@ r_dir_file(dumpstate, cgroup)
binder_call(dumpstate, binderservicedomain) binder_call(dumpstate, binderservicedomain)
binder_call(dumpstate, { appdomain ephemeral_app netd wificond }) binder_call(dumpstate, { appdomain ephemeral_app netd wificond })
# Vibrate the device after we are done collecting the bugreport
# For binderized mode:
binder_call(dumpstate, hal_vibrator)
binder_call(dumpstate, hwservicemanager)
# For passthrough mode:
allow dumpstate sysfs_vibrator:file { rw_file_perms getattr };
# Reading /proc/PID/maps of other processes # Reading /proc/PID/maps of other processes
allow dumpstate self:capability sys_ptrace; allow dumpstate self:capability sys_ptrace;
@ -210,3 +212,7 @@ neverallow { domain -dumpstate } dumpstate_service:service_manager add;
# only system_server and shell can find the dumpstate service # only system_server and shell can find the dumpstate service
neverallow { domain -system_server -shell } dumpstate_service:service_manager find; neverallow { domain -system_server -shell } dumpstate_service:service_manager find;
# Dumpstate should not be writing to any generically labeled sysfs files.
# Create a specific label for the file type
neverallow dumpstate sysfs:file no_w_file_perms;