tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

DO NOT MERGE: Remove duplicate neverallow for hal_audio_server

Browse source 
Cherry picked from commit 996059 (rvc-dev-plus-aosp), which is
auto merged from aosp/1290960 (master).

In addition, 'prebuilts/api/30.0/public/hal_audio.te' is updated to
be consistent with 'public/hal_audio.te'.

Bug: 155306710
Test: tested with the following rules in 'vendor/hal_audio_default.te'
Test: type hal_audio_socket, domain;
Test: typeattribute hal_audio_default hal_automotive_socket_exemption;
Test: allow hal_audio_default hal_audio_socket:tcp_socket connect;
Test: m -j should compile sepolicy without complaints

Change-Id: I0b8a5f9c9d826680223dbb9204862ea46c557856
(cherry picked from commit 9960590f8d)
This commit is contained in:
Yiming Jing 2020-04-23 16:18:58 +00:00
parent 9436677538
commit 8df611bb46
2 changed files with 0 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
prebuilts/api/30.0/public/hal_audio.te
View file

@ -30,10 +30,6 @@ vndbinder_use(hal_audio)
# Should never execute any executable without a domain transition
neverallow hal_audio_server { file_type fs_type }:file execute_no_trans;
# Should never need network access.
# Disallow network sockets.
neverallow hal_audio_server domain:{ tcp_socket udp_socket rawip_socket } *;
# Only audio HAL may directly access the audio hardware
neverallow { halserverdomain -hal_audio_server -hal_omx_server } audio_device:chr_file *;

4
public/hal_audio.te
View file

@ -30,10 +30,6 @@ vndbinder_use(hal_audio)
# Should never execute any executable without a domain transition
neverallow hal_audio_server { file_type fs_type }:file execute_no_trans;
# Should never need network access.
# Disallow network sockets.
neverallow hal_audio_server domain:{ tcp_socket udp_socket rawip_socket } *;
# Only audio HAL may directly access the audio hardware
neverallow { halserverdomain -hal_audio_server -hal_omx_server } audio_device:chr_file *;