From 8fc79818854dffd133d2e40358a33cdd84f4d511 Mon Sep 17 00:00:00 2001 From: Steven Moreland Date: Wed, 30 May 2018 16:43:17 -0700 Subject: [PATCH] Find hal_foo_hwservice -> you are hal_foo_client. Before, it was possible to access a hwservice without declaring that you were a client. This introduces the following macro: hal_attribute_hwservice_client(hal_foo, hal_foo_hwservice) which makes sure the above implication holds using a neverallow rule. Bug: 80319537 Test: boot + sanity Change-Id: Iededae68f14f0f3bd412c1205aa3b650a54d55c6 --- private/technical_debt.cil | 4 ++++ public/app.te | 9 --------- public/hal_audio.te | 2 +- public/hal_audiocontrol.te | 3 +-- public/hal_authsecret.te | 2 +- public/hal_bluetooth.te | 2 +- public/hal_bootctl.te | 2 +- public/hal_broadcastradio.te | 2 +- public/hal_camera.te | 2 +- public/hal_cas.te | 2 +- public/hal_confirmationui.te | 2 +- public/hal_contexthub.te | 2 +- public/hal_drm.te | 2 +- public/hal_dumpstate.te | 2 +- public/hal_fingerprint.te | 2 +- public/hal_gatekeeper.te | 2 +- public/hal_gnss.te | 2 +- public/hal_graphics_allocator.te | 2 +- public/hal_graphics_composer.te | 2 +- public/hal_health.te | 2 +- public/hal_ir.te | 2 +- public/hal_keymaster.te | 2 +- public/hal_light.te | 2 +- public/hal_lowpan.te | 2 +- public/hal_memtrack.te | 2 +- public/hal_neuralnetworks.te | 2 +- public/hal_nfc.te | 2 +- public/hal_oemlock.te | 2 +- public/hal_omx.te | 6 ++++-- public/hal_power.te | 2 +- public/hal_secure_element.te | 2 +- public/hal_sensors.te | 2 +- public/hal_telephony.te | 2 +- public/hal_tetheroffload.te | 2 +- public/hal_thermal.te | 2 +- public/hal_tv_cec.te | 2 +- public/hal_tv_input.te | 2 +- public/hal_usb.te | 2 +- public/hal_usb_gadget.te | 2 +- public/hal_vehicle.te | 2 +- public/hal_vibrator.te | 2 +- public/hal_vr.te | 2 +- public/hal_weaver.te | 2 +- public/hal_wifi.te | 2 +- public/hal_wifi_hostapd.te | 2 +- public/hal_wifi_offload.te | 2 +- public/hal_wifi_supplicant.te | 2 +- public/te_macros | 12 ++++++++++++ 48 files changed, 64 insertions(+), 56 deletions(-) diff --git a/private/technical_debt.cil b/private/technical_debt.cil index 7f9d315ed..b04e5e076 100644 --- a/private/technical_debt.cil +++ b/private/technical_debt.cil @@ -12,6 +12,10 @@ (typeattributeset hal_allocator_client ((and (appdomain) ((not (isolated_app)))))) (typeattributeset halclientdomain (hal_allocator_client)) +; Apps, except isolated apps, are clients of OMX-related services +; Unfortunately, we can't currently express this in module policy language: +(typeattributeset hal_omx_client ((and (appdomain) ((not (isolated_app)))))) + ; Apps, except isolated apps, are clients of Configstore HAL ; Unfortunately, we can't currently express this in module policy language: ; typeattribute { appdomain -isolated_app } hal_configstore_client; diff --git a/public/app.te b/public/app.te index 35c200859..1dca49cb5 100644 --- a/public/app.te +++ b/public/app.te @@ -219,15 +219,6 @@ binder_call(appdomain, appdomain) # Perform binder IPC to ephemeral apps. binder_call(appdomain, ephemeral_app) -# TODO(b/80317992): use hal_client_domain on individual domains or have tests -# that the required individual permissions are all granted -hwbinder_use({ appdomain -isolated_app }) -allow { appdomain -isolated_app } hal_codec2_hwservice:hwservice_manager find; -allow { appdomain -isolated_app } hal_omx_hwservice:hwservice_manager find; -allow { appdomain -isolated_app } hidl_token_hwservice:hwservice_manager find; -get_prop({ appdomain -isolated_app }, hwservicemanager_prop); -binder_call({ appdomain -isolated_app }, hal_omx_server) - # Talk with graphics composer fences allow appdomain hal_graphics_composer:fd use; diff --git a/public/hal_audio.te b/public/hal_audio.te index 037066ea8..d97910389 100644 --- a/public/hal_audio.te +++ b/public/hal_audio.te @@ -3,7 +3,7 @@ binder_call(hal_audio_client, hal_audio_server) binder_call(hal_audio_server, hal_audio_client) add_hwservice(hal_audio_server, hal_audio_hwservice) -allow hal_audio_client hal_audio_hwservice:hwservice_manager find; +hal_attribute_hwservice_client(hal_audio, hal_audio_hwservice) allow hal_audio ion_device:chr_file r_file_perms; diff --git a/public/hal_audiocontrol.te b/public/hal_audiocontrol.te index 438db531f..dc4aaa0cc 100644 --- a/public/hal_audiocontrol.te +++ b/public/hal_audiocontrol.te @@ -3,5 +3,4 @@ binder_call(hal_audiocontrol_client, hal_audiocontrol_server) binder_call(hal_audiocontrol_server, hal_audiocontrol_client) add_hwservice(hal_audiocontrol_server, hal_audiocontrol_hwservice) - -allow hal_audiocontrol_client hal_audiocontrol_hwservice:hwservice_manager find; +hal_attribute_hwservice_client(hal_audiocontrol, hal_audiocontrol_hwservice) diff --git a/public/hal_authsecret.te b/public/hal_authsecret.te index 81b0c0445..f58b8aac9 100644 --- a/public/hal_authsecret.te +++ b/public/hal_authsecret.te @@ -2,4 +2,4 @@ binder_call(hal_authsecret_client, hal_authsecret_server) add_hwservice(hal_authsecret_server, hal_authsecret_hwservice) -allow hal_authsecret_client hal_authsecret_hwservice:hwservice_manager find; +hal_attribute_hwservice_client(hal_authsecret, hal_authsecret_hwservice) diff --git a/public/hal_bluetooth.te b/public/hal_bluetooth.te index 373dbec6b..b0c68bf72 100644 --- a/public/hal_bluetooth.te +++ b/public/hal_bluetooth.te @@ -3,7 +3,7 @@ binder_call(hal_bluetooth_client, hal_bluetooth_server) binder_call(hal_bluetooth_server, hal_bluetooth_client) add_hwservice(hal_bluetooth_server, hal_bluetooth_hwservice) -allow hal_bluetooth_client hal_bluetooth_hwservice:hwservice_manager find; +hal_attribute_hwservice_client(hal_bluetooth, hal_bluetooth_hwservice) wakelock_use(hal_bluetooth); diff --git a/public/hal_bootctl.te b/public/hal_bootctl.te index 181de4a9c..a901cf292 100644 --- a/public/hal_bootctl.te +++ b/public/hal_bootctl.te @@ -3,6 +3,6 @@ binder_call(hal_bootctl_client, hal_bootctl_server) binder_call(hal_bootctl_server, hal_bootctl_client) add_hwservice(hal_bootctl_server, hal_bootctl_hwservice) -allow hal_bootctl_client hal_bootctl_hwservice:hwservice_manager find; +hal_attribute_hwservice_client(hal_bootctl, hal_bootctl_hwservice) dontaudit hal_bootctl self:capability sys_rawio; diff --git a/public/hal_broadcastradio.te b/public/hal_broadcastradio.te index 24d4908e1..45adb4a7a 100644 --- a/public/hal_broadcastradio.te +++ b/public/hal_broadcastradio.te @@ -1,4 +1,4 @@ binder_call(hal_broadcastradio_client, hal_broadcastradio_server) add_hwservice(hal_broadcastradio_server, hal_broadcastradio_hwservice) -allow hal_broadcastradio_client hal_broadcastradio_hwservice:hwservice_manager find; +hal_attribute_hwservice_client(hal_broadcastradio, hal_broadcastradio_hwservice) diff --git a/public/hal_camera.te b/public/hal_camera.te index 43f74b488..4e8079484 100644 --- a/public/hal_camera.te +++ b/public/hal_camera.te @@ -3,7 +3,7 @@ binder_call(hal_camera_client, hal_camera_server) binder_call(hal_camera_server, hal_camera_client) add_hwservice(hal_camera_server, hal_camera_hwservice) -allow hal_camera_client hal_camera_hwservice:hwservice_manager find; +hal_attribute_hwservice_client(hal_camera, hal_camera_hwservice) allow hal_camera device:dir r_dir_perms; allow hal_camera video_device:dir r_dir_perms; diff --git a/public/hal_cas.te b/public/hal_cas.te index 7f6535858..0ba39edac 100644 --- a/public/hal_cas.te +++ b/public/hal_cas.te @@ -3,7 +3,7 @@ binder_call(hal_cas_client, hal_cas_server) binder_call(hal_cas_server, hal_cas_client) add_hwservice(hal_cas_server, hal_cas_hwservice) -allow hal_cas_client hal_cas_hwservice:hwservice_manager find; +hal_attribute_hwservice_client(hal_cas, hal_cas_hwservice) allow hal_cas_server hidl_memory_hwservice:hwservice_manager find; # Permit reading device's serial number from system properties diff --git a/public/hal_confirmationui.te b/public/hal_confirmationui.te index 228e86496..9a7e69783 100644 --- a/public/hal_confirmationui.te +++ b/public/hal_confirmationui.te @@ -2,4 +2,4 @@ binder_call(hal_confirmationui_client, hal_confirmationui_server) add_hwservice(hal_confirmationui_server, hal_confirmationui_hwservice) -allow hal_confirmationui_client hal_confirmationui_hwservice:hwservice_manager find; +hal_attribute_hwservice_client(hal_confirmationui, hal_confirmationui_hwservice) diff --git a/public/hal_contexthub.te b/public/hal_contexthub.te index f11bfc816..0f23ae51b 100644 --- a/public/hal_contexthub.te +++ b/public/hal_contexthub.te @@ -3,4 +3,4 @@ binder_call(hal_contexthub_client, hal_contexthub_server) binder_call(hal_contexthub_server, hal_contexthub_client) add_hwservice(hal_contexthub_server, hal_contexthub_hwservice) -allow hal_contexthub_client hal_contexthub_hwservice:hwservice_manager find; +hal_attribute_hwservice_client(hal_contexthub, hal_contexthub_hwservice) diff --git a/public/hal_drm.te b/public/hal_drm.te index a46dd9116..0a03a95a3 100644 --- a/public/hal_drm.te +++ b/public/hal_drm.te @@ -3,7 +3,7 @@ binder_call(hal_drm_client, hal_drm_server) binder_call(hal_drm_server, hal_drm_client) add_hwservice(hal_drm_server, hal_drm_hwservice) -allow hal_drm_client hal_drm_hwservice:hwservice_manager find; +hal_attribute_hwservice_client(hal_drm, hal_drm_hwservice) allow hal_drm hidl_memory_hwservice:hwservice_manager find; diff --git a/public/hal_dumpstate.te b/public/hal_dumpstate.te index 2853567e0..75e59f3b4 100644 --- a/public/hal_dumpstate.te +++ b/public/hal_dumpstate.te @@ -3,7 +3,7 @@ binder_call(hal_dumpstate_client, hal_dumpstate_server) binder_call(hal_dumpstate_server, hal_dumpstate_client) add_hwservice(hal_dumpstate_server, hal_dumpstate_hwservice) -allow hal_dumpstate_client hal_dumpstate_hwservice:hwservice_manager find; +hal_attribute_hwservice_client(hal_dumpstate, hal_dumpstate_hwservice) # write bug reports in /data/data/com.android.shell/files/bugreports/bugreport allow hal_dumpstate shell_data_file:file write; diff --git a/public/hal_fingerprint.te b/public/hal_fingerprint.te index ebe0b0c82..240f1ddad 100644 --- a/public/hal_fingerprint.te +++ b/public/hal_fingerprint.te @@ -3,7 +3,7 @@ binder_call(hal_fingerprint_client, hal_fingerprint_server) binder_call(hal_fingerprint_server, hal_fingerprint_client) add_hwservice(hal_fingerprint_server, hal_fingerprint_hwservice) -allow hal_fingerprint_client hal_fingerprint_hwservice:hwservice_manager find; +hal_attribute_hwservice_client(hal_fingerprint, hal_fingerprint_hwservice) # For memory allocation allow hal_fingerprint ion_device:chr_file r_file_perms; diff --git a/public/hal_gatekeeper.te b/public/hal_gatekeeper.te index 123acf567..0ff8f0844 100644 --- a/public/hal_gatekeeper.te +++ b/public/hal_gatekeeper.te @@ -1,7 +1,7 @@ binder_call(hal_gatekeeper_client, hal_gatekeeper_server) add_hwservice(hal_gatekeeper_server, hal_gatekeeper_hwservice) -allow hal_gatekeeper_client hal_gatekeeper_hwservice:hwservice_manager find; +hal_attribute_hwservice_client(hal_gatekeeper, hal_gatekeeper_hwservice) # TEE access. allow hal_gatekeeper tee_device:chr_file rw_file_perms; diff --git a/public/hal_gnss.te b/public/hal_gnss.te index b59cd1d5a..7e206a8ff 100644 --- a/public/hal_gnss.te +++ b/public/hal_gnss.te @@ -3,4 +3,4 @@ binder_call(hal_gnss_client, hal_gnss_server) binder_call(hal_gnss_server, hal_gnss_client) add_hwservice(hal_gnss_server, hal_gnss_hwservice) -allow hal_gnss_client hal_gnss_hwservice:hwservice_manager find; +hal_attribute_hwservice_client(hal_gnss, hal_gnss_hwservice) diff --git a/public/hal_graphics_allocator.te b/public/hal_graphics_allocator.te index e2b04ae83..753b816d7 100644 --- a/public/hal_graphics_allocator.te +++ b/public/hal_graphics_allocator.te @@ -2,7 +2,7 @@ binder_call(hal_graphics_allocator_client, hal_graphics_allocator_server) add_hwservice(hal_graphics_allocator_server, hal_graphics_allocator_hwservice) -allow hal_graphics_allocator_client hal_graphics_allocator_hwservice:hwservice_manager find; +hal_attribute_hwservice_client(hal_graphics_allocator, hal_graphics_allocator_hwservice) allow hal_graphics_allocator_client hal_graphics_mapper_hwservice:hwservice_manager find; # GPU device access diff --git a/public/hal_graphics_composer.te b/public/hal_graphics_composer.te index 2df461249..e6854f6f3 100644 --- a/public/hal_graphics_composer.te +++ b/public/hal_graphics_composer.te @@ -3,7 +3,7 @@ binder_call(hal_graphics_composer_client, hal_graphics_composer_server) binder_call(hal_graphics_composer_server, hal_graphics_composer_client) add_hwservice(hal_graphics_composer_server, hal_graphics_composer_hwservice) -allow hal_graphics_composer_client hal_graphics_composer_hwservice:hwservice_manager find; +hal_attribute_hwservice_client(hal_graphics_composer, hal_graphics_composer_hwservice) # Coordinate with hal_graphics_mapper allow hal_graphics_composer_server hal_graphics_mapper_hwservice:hwservice_manager find; diff --git a/public/hal_health.te b/public/hal_health.te index c0a0f804c..f6d5d3b8e 100644 --- a/public/hal_health.te +++ b/public/hal_health.te @@ -3,7 +3,7 @@ binder_call(hal_health_client, hal_health_server) binder_call(hal_health_server, hal_health_client) add_hwservice(hal_health_server, hal_health_hwservice) -allow hal_health_client hal_health_hwservice:hwservice_manager find; +hal_attribute_hwservice_client(hal_health, hal_health_hwservice) # Read access to system files for HALs in # /{system,vendor,odm}/lib[64]/hw/ in order diff --git a/public/hal_ir.te b/public/hal_ir.te index b1bfdd804..022d5eeb6 100644 --- a/public/hal_ir.te +++ b/public/hal_ir.te @@ -3,4 +3,4 @@ binder_call(hal_ir_client, hal_ir_server) binder_call(hal_ir_server, hal_ir_client) add_hwservice(hal_ir_server, hal_ir_hwservice) -allow hal_ir_client hal_ir_hwservice:hwservice_manager find; +hal_attribute_hwservice_client(hal_ir, hal_ir_hwservice) diff --git a/public/hal_keymaster.te b/public/hal_keymaster.te index dc5f6d01d..664f2774b 100644 --- a/public/hal_keymaster.te +++ b/public/hal_keymaster.te @@ -2,7 +2,7 @@ binder_call(hal_keymaster_client, hal_keymaster_server) add_hwservice(hal_keymaster_server, hal_keymaster_hwservice) -allow hal_keymaster_client hal_keymaster_hwservice:hwservice_manager find; +hal_attribute_hwservice_client(hal_keymaster, hal_keymaster_hwservice) allow hal_keymaster tee_device:chr_file rw_file_perms; allow hal_keymaster ion_device:chr_file r_file_perms; diff --git a/public/hal_light.te b/public/hal_light.te index 5b93dd115..841b17ab0 100644 --- a/public/hal_light.te +++ b/public/hal_light.te @@ -3,7 +3,7 @@ binder_call(hal_light_client, hal_light_server) binder_call(hal_light_server, hal_light_client) add_hwservice(hal_light_server, hal_light_hwservice) -allow hal_light_client hal_light_hwservice:hwservice_manager find; +hal_attribute_hwservice_client(hal_light, hal_light_hwservice) allow hal_light sysfs_leds:lnk_file read; allow hal_light sysfs_leds:file rw_file_perms; diff --git a/public/hal_lowpan.te b/public/hal_lowpan.te index af491b159..5bb36f96f 100644 --- a/public/hal_lowpan.te +++ b/public/hal_lowpan.te @@ -5,7 +5,7 @@ binder_call(hal_lowpan_server, hal_lowpan_client) add_hwservice(hal_lowpan_server, hal_lowpan_hwservice) # Allow hal_lowpan_client to be able to find the hal_lowpan_server -allow hal_lowpan_client hal_lowpan_hwservice:hwservice_manager find; +hal_attribute_hwservice_client(hal_lowpan, hal_lowpan_hwservice) # hal_lowpan domain can write/read to/from lowpan_prop set_prop(hal_lowpan_server, lowpan_prop) diff --git a/public/hal_memtrack.te b/public/hal_memtrack.te index b2cc9cd1e..8185fd144 100644 --- a/public/hal_memtrack.te +++ b/public/hal_memtrack.te @@ -2,4 +2,4 @@ binder_call(hal_memtrack_client, hal_memtrack_server) add_hwservice(hal_memtrack_server, hal_memtrack_hwservice) -allow hal_memtrack_client hal_memtrack_hwservice:hwservice_manager find; +hal_attribute_hwservice_client(hal_memtrack, hal_memtrack_hwservice) diff --git a/public/hal_neuralnetworks.te b/public/hal_neuralnetworks.te index c697ac2f2..149f76811 100644 --- a/public/hal_neuralnetworks.te +++ b/public/hal_neuralnetworks.te @@ -3,6 +3,6 @@ binder_call(hal_neuralnetworks_client, hal_neuralnetworks_server) binder_call(hal_neuralnetworks_server, hal_neuralnetworks_client) add_hwservice(hal_neuralnetworks_server, hal_neuralnetworks_hwservice) -allow hal_neuralnetworks_client hal_neuralnetworks_hwservice:hwservice_manager find; +hal_attribute_hwservice_client(hal_neuralnetworks, hal_neuralnetworks_hwservice) allow hal_neuralnetworks hidl_memory_hwservice:hwservice_manager find; allow hal_neuralnetworks hal_allocator:fd use; diff --git a/public/hal_nfc.te b/public/hal_nfc.te index 3bcdf5ee1..caa4c823b 100644 --- a/public/hal_nfc.te +++ b/public/hal_nfc.te @@ -3,7 +3,7 @@ binder_call(hal_nfc_client, hal_nfc_server) binder_call(hal_nfc_server, hal_nfc_client) add_hwservice(hal_nfc_server, hal_nfc_hwservice) -allow hal_nfc_client hal_nfc_hwservice:hwservice_manager find; +hal_attribute_hwservice_client(hal_nfc, hal_nfc_hwservice) # Set NFC properties (used by bcm2079x HAL). set_prop(hal_nfc, nfc_prop) diff --git a/public/hal_oemlock.te b/public/hal_oemlock.te index 3fb5a1871..d118f43cd 100644 --- a/public/hal_oemlock.te +++ b/public/hal_oemlock.te @@ -2,4 +2,4 @@ binder_call(hal_oemlock_client, hal_oemlock_server) add_hwservice(hal_oemlock_server, hal_oemlock_hwservice) -allow hal_oemlock_client hal_oemlock_hwservice:hwservice_manager find; +hal_attribute_hwservice_client(hal_oemlock, hal_oemlock_hwservice) diff --git a/public/hal_omx.te b/public/hal_omx.te index cf036900e..375f386c3 100644 --- a/public/hal_omx.te +++ b/public/hal_omx.te @@ -27,11 +27,13 @@ crash_dump_fallback(hal_omx_server) # via PDX. Thus, there is no need to use pdx_client macro. allow hal_omx_server bufferhubd:fd use; -allow hal_omx_client hal_codec2_hwservice:hwservice_manager find; -allow hal_omx_client hal_omx_hwservice:hwservice_manager find; +hal_attribute_hwservice_client(hal_omx, hal_omx_hwservice) +hal_attribute_hwservice_client(hal_omx, hal_codec2_hwservice) + allow hal_omx_client hidl_token_hwservice:hwservice_manager find; binder_call(hal_omx_client, hal_omx_server) +binder_call(hal_omx_server, hal_omx_client) ### ### neverallow rules diff --git a/public/hal_power.te b/public/hal_power.te index fcba3d25d..26fbd4c30 100644 --- a/public/hal_power.te +++ b/public/hal_power.te @@ -3,4 +3,4 @@ binder_call(hal_power_client, hal_power_server) binder_call(hal_power_server, hal_power_client) add_hwservice(hal_power_server, hal_power_hwservice) -allow hal_power_client hal_power_hwservice:hwservice_manager find; +hal_attribute_hwservice_client(hal_power, hal_power_hwservice) diff --git a/public/hal_secure_element.te b/public/hal_secure_element.te index e3046d12e..8410c772d 100644 --- a/public/hal_secure_element.te +++ b/public/hal_secure_element.te @@ -3,4 +3,4 @@ binder_call(hal_secure_element_client, hal_secure_element_server) binder_call(hal_secure_element_server, hal_secure_element_client) add_hwservice(hal_secure_element_server, hal_secure_element_hwservice) -allow hal_secure_element_client hal_secure_element_hwservice:hwservice_manager find; +hal_attribute_hwservice_client(hal_secure_element, hal_secure_element_hwservice) diff --git a/public/hal_sensors.te b/public/hal_sensors.te index 9d7cbe913..603eead92 100644 --- a/public/hal_sensors.te +++ b/public/hal_sensors.te @@ -2,7 +2,7 @@ binder_call(hal_sensors_client, hal_sensors_server) add_hwservice(hal_sensors_server, hal_sensors_hwservice) -allow hal_sensors_client hal_sensors_hwservice:hwservice_manager find; +hal_attribute_hwservice_client(hal_sensors, hal_sensors_hwservice) # Allow sensor hals to access ashmem memory allocated by apps allow hal_sensors { appdomain -isolated_app }:fd use; diff --git a/public/hal_telephony.te b/public/hal_telephony.te index 21b6e0208..a20350b41 100644 --- a/public/hal_telephony.te +++ b/public/hal_telephony.te @@ -3,7 +3,7 @@ binder_call(hal_telephony_client, hal_telephony_server) binder_call(hal_telephony_server, hal_telephony_client) add_hwservice(hal_telephony_server, hal_telephony_hwservice) -allow hal_telephony_client hal_telephony_hwservice:hwservice_manager find; +hal_attribute_hwservice_client(hal_telephony, hal_telephony_hwservice) allowxperm hal_telephony_server self:udp_socket ioctl priv_sock_ioctls; diff --git a/public/hal_tetheroffload.te b/public/hal_tetheroffload.te index 48d67a29b..d44573a3e 100644 --- a/public/hal_tetheroffload.te +++ b/public/hal_tetheroffload.te @@ -2,7 +2,7 @@ binder_call(hal_tetheroffload_client, hal_tetheroffload_server) binder_call(hal_tetheroffload_server, hal_tetheroffload_client) -allow hal_tetheroffload_client hal_tetheroffload_hwservice:hwservice_manager find; +hal_attribute_hwservice_client(hal_tetheroffload, hal_tetheroffload_hwservice) # allow the client to pass the server already open netlink sockets allow hal_tetheroffload_server hal_tetheroffload_client:netlink_netfilter_socket { getattr read setopt write }; diff --git a/public/hal_thermal.te b/public/hal_thermal.te index b1764f114..105e882a4 100644 --- a/public/hal_thermal.te +++ b/public/hal_thermal.te @@ -3,4 +3,4 @@ binder_call(hal_thermal_client, hal_thermal_server) binder_call(hal_thermal_server, hal_thermal_client) add_hwservice(hal_thermal_server, hal_thermal_hwservice) -allow hal_thermal_client hal_thermal_hwservice:hwservice_manager find; +hal_attribute_hwservice_client(hal_thermal, hal_thermal_hwservice) diff --git a/public/hal_tv_cec.te b/public/hal_tv_cec.te index 7719cae92..9ee2e3eed 100644 --- a/public/hal_tv_cec.te +++ b/public/hal_tv_cec.te @@ -3,4 +3,4 @@ binder_call(hal_tv_cec_client, hal_tv_cec_server) binder_call(hal_tv_cec_server, hal_tv_cec_client) add_hwservice(hal_tv_cec_server, hal_tv_cec_hwservice) -allow hal_tv_cec_client hal_tv_cec_hwservice:hwservice_manager find; +hal_attribute_hwservice_client(hal_tv_cec, hal_tv_cec_hwservice) diff --git a/public/hal_tv_input.te b/public/hal_tv_input.te index 31a006740..cee55bde3 100644 --- a/public/hal_tv_input.te +++ b/public/hal_tv_input.te @@ -3,4 +3,4 @@ binder_call(hal_tv_input_client, hal_tv_input_server) binder_call(hal_tv_input_server, hal_tv_input_client) add_hwservice(hal_tv_input_server, hal_tv_input_hwservice) -allow hal_tv_input_client hal_tv_input_hwservice:hwservice_manager find; +hal_attribute_hwservice_client(hal_tv_input, hal_tv_input_hwservice) diff --git a/public/hal_usb.te b/public/hal_usb.te index 9cfd5165d..52fdce224 100644 --- a/public/hal_usb.te +++ b/public/hal_usb.te @@ -3,7 +3,7 @@ binder_call(hal_usb_client, hal_usb_server) binder_call(hal_usb_server, hal_usb_client) add_hwservice(hal_usb_server, hal_usb_hwservice) -allow hal_usb_client hal_usb_hwservice:hwservice_manager find; +hal_attribute_hwservice_client(hal_usb, hal_usb_hwservice) allow hal_usb self:netlink_kobject_uevent_socket create; allow hal_usb self:netlink_kobject_uevent_socket setopt; diff --git a/public/hal_usb_gadget.te b/public/hal_usb_gadget.te index e412758a0..41683b0cd 100644 --- a/public/hal_usb_gadget.te +++ b/public/hal_usb_gadget.te @@ -3,7 +3,7 @@ binder_call(hal_usb_gadget_client, hal_usb_gadget_server) binder_call(hal_usb_gadget_server, hal_usb_gadget_client) add_hwservice(hal_usb_gadget_server, hal_usb_gadget_hwservice) -allow hal_usb_gadget_client hal_usb_gadget_hwservice:hwservice_manager find; +hal_attribute_hwservice_client(hal_usb_gadget, hal_usb_gadget_hwservice) # Configuring usb gadget functions allow hal_usb_gadget_server configfs:lnk_file { read create unlink}; diff --git a/public/hal_vehicle.te b/public/hal_vehicle.te index a59f8d2bd..d021da344 100644 --- a/public/hal_vehicle.te +++ b/public/hal_vehicle.te @@ -4,4 +4,4 @@ binder_call(hal_vehicle_server, hal_vehicle_client) add_hwservice(hal_vehicle_server, hal_vehicle_hwservice) -allow hal_vehicle_client hal_vehicle_hwservice:hwservice_manager find; +hal_attribute_hwservice_client(hal_vehicle, hal_vehicle_hwservice) diff --git a/public/hal_vibrator.te b/public/hal_vibrator.te index 9ce34cac2..ba6830d70 100644 --- a/public/hal_vibrator.te +++ b/public/hal_vibrator.te @@ -2,7 +2,7 @@ binder_call(hal_vibrator_client, hal_vibrator_server) add_hwservice(hal_vibrator_server, hal_vibrator_hwservice) -allow hal_vibrator_client hal_vibrator_hwservice:hwservice_manager find; +hal_attribute_hwservice_client(hal_vibrator, hal_vibrator_hwservice) # vibrator sysfs rw access allow hal_vibrator sysfs_vibrator:file rw_file_perms; diff --git a/public/hal_vr.te b/public/hal_vr.te index 3cb392d14..4afe3cdeb 100644 --- a/public/hal_vr.te +++ b/public/hal_vr.te @@ -3,4 +3,4 @@ binder_call(hal_vr_client, hal_vr_server) binder_call(hal_vr_server, hal_vr_client) add_hwservice(hal_vr_server, hal_vr_hwservice) -allow hal_vr_client hal_vr_hwservice:hwservice_manager find; +hal_attribute_hwservice_client(hal_vr, hal_vr_hwservice) diff --git a/public/hal_weaver.te b/public/hal_weaver.te index b80ba292c..405321def 100644 --- a/public/hal_weaver.te +++ b/public/hal_weaver.te @@ -2,4 +2,4 @@ binder_call(hal_weaver_client, hal_weaver_server) add_hwservice(hal_weaver_server, hal_weaver_hwservice) -allow hal_weaver_client hal_weaver_hwservice:hwservice_manager find; +hal_attribute_hwservice_client(hal_weaver, hal_weaver_hwservice) diff --git a/public/hal_wifi.te b/public/hal_wifi.te index 8f5b77b86..45738e209 100644 --- a/public/hal_wifi.te +++ b/public/hal_wifi.te @@ -3,7 +3,7 @@ binder_call(hal_wifi_client, hal_wifi_server) binder_call(hal_wifi_server, hal_wifi_client) add_hwservice(hal_wifi_server, hal_wifi_hwservice) -allow hal_wifi_client hal_wifi_hwservice:hwservice_manager find; +hal_attribute_hwservice_client(hal_wifi, hal_wifi_hwservice) r_dir_file(hal_wifi, proc_net_type) r_dir_file(hal_wifi, sysfs_type) diff --git a/public/hal_wifi_hostapd.te b/public/hal_wifi_hostapd.te index 73bf037b1..ea84a36e2 100644 --- a/public/hal_wifi_hostapd.te +++ b/public/hal_wifi_hostapd.te @@ -3,7 +3,7 @@ binder_call(hal_wifi_hostapd_client, hal_wifi_hostapd_server) binder_call(hal_wifi_hostapd_server, hal_wifi_hostapd_client) add_hwservice(hal_wifi_hostapd_server, hal_wifi_hostapd_hwservice) -allow hal_wifi_hostapd_client hal_wifi_hostapd_hwservice:hwservice_manager find; +hal_attribute_hwservice_client(hal_wifi_hostapd, hal_wifi_hostapd_hwservice) allow hal_wifi_hostapd_server self:global_capability_class_set { net_admin net_raw }; diff --git a/public/hal_wifi_offload.te b/public/hal_wifi_offload.te index f74ed05ff..1b75711d7 100644 --- a/public/hal_wifi_offload.te +++ b/public/hal_wifi_offload.te @@ -3,7 +3,7 @@ binder_call(hal_wifi_offload_client, hal_wifi_offload_server) binder_call(hal_wifi_offload_server, hal_wifi_offload_client) add_hwservice(hal_wifi_offload_server, hal_wifi_offload_hwservice) -allow hal_wifi_offload_client hal_wifi_offload_hwservice:hwservice_manager find; +hal_attribute_hwservice_client(hal_wifi_offload, hal_wifi_offload_hwservice) r_dir_file(hal_wifi_offload, proc_net_type) r_dir_file(hal_wifi_offload, sysfs_type) diff --git a/public/hal_wifi_supplicant.te b/public/hal_wifi_supplicant.te index 3d617661f..87a061f4d 100644 --- a/public/hal_wifi_supplicant.te +++ b/public/hal_wifi_supplicant.te @@ -3,7 +3,7 @@ binder_call(hal_wifi_supplicant_client, hal_wifi_supplicant_server) binder_call(hal_wifi_supplicant_server, hal_wifi_supplicant_client) add_hwservice(hal_wifi_supplicant_server, hal_wifi_supplicant_hwservice) -allow hal_wifi_supplicant_client hal_wifi_supplicant_hwservice:hwservice_manager find; +hal_attribute_hwservice_client(hal_wifi_supplicant, hal_wifi_supplicant_hwservice) # in addition to ioctls whitelisted for all domains, grant hal_wifi_supplicant priv_sock_ioctls. allowxperm hal_wifi_supplicant self:udp_socket ioctl priv_sock_ioctls; diff --git a/public/te_macros b/public/te_macros index e5c476a35..ffb84281f 100644 --- a/public/te_macros +++ b/public/te_macros @@ -603,3 +603,15 @@ define(`add_hwservice', ` allow $1 hidl_base_hwservice:hwservice_manager add; neverallow { domain -$1 } $2:hwservice_manager add; ') + +########################################### +# hal_attribute_hwservice_client(attribute, service) +# Ability for domain to get a service to hwservice_manager +# and find it. It also creates a neverallow preventing +# others from adding it. +# +# Used to pair hal_foo_client with hal_foo_hwservice +define(`hal_attribute_hwservice_client', ` + allow $1_client $2:hwservice_manager find; + neverallow { domain -$1_client -$1_server } $2:hwservice_manager find; +')