tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Update sepolicy for adding nnapi_native namespace.

Browse source 
Test: mm
Bug: 201399117
Change-Id: I40a2431b6f5a54deae27fe68f503aff9b99e2793
This commit is contained in:
Ian Hua 2021-10-05 15:23:18 +01:00
parent aedd65ac20
commit 91d153e9b5
6 changed files with 10 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
private/compat/31.0/31.0.ignore.cil
View file

@ -7,6 +7,7 @@
( new_objects ( new_objects
artd_service artd_service
camera2_extensions_prop camera2_extensions_prop
device_config_nnapi_native_prop
extra_free_kbytes extra_free_kbytes
extra_free_kbytes_exec extra_free_kbytes_exec
hal_contexthub_service hal_contexthub_service

1
private/flags_health_check.te
View file

@ -9,6 +9,7 @@ set_prop(flags_health_check, device_config_runtime_native_prop)
set_prop(flags_health_check, device_config_input_native_boot_prop) set_prop(flags_health_check, device_config_input_native_boot_prop)
set_prop(flags_health_check, device_config_lmkd_native_prop) set_prop(flags_health_check, device_config_lmkd_native_prop)
set_prop(flags_health_check, device_config_netd_native_prop) set_prop(flags_health_check, device_config_netd_native_prop)
set_prop(flags_health_check, device_config_nnapi_native_prop)
set_prop(flags_health_check, device_config_activity_manager_native_boot_prop) set_prop(flags_health_check, device_config_activity_manager_native_boot_prop)
set_prop(flags_health_check, device_config_media_native_prop) set_prop(flags_health_check, device_config_media_native_prop)
set_prop(flags_health_check, device_config_profcollect_native_boot_prop) set_prop(flags_health_check, device_config_profcollect_native_boot_prop)

1
private/property_contexts
View file

@ -241,6 +241,7 @@ persist.device_config.input_native_boot. u:object_r:device_config_inp
persist.device_config.lmkd_native. u:object_r:device_config_lmkd_native_prop:s0 persist.device_config.lmkd_native. u:object_r:device_config_lmkd_native_prop:s0
persist.device_config.media_native. u:object_r:device_config_media_native_prop:s0 persist.device_config.media_native. u:object_r:device_config_media_native_prop:s0
persist.device_config.netd_native. u:object_r:device_config_netd_native_prop:s0 persist.device_config.netd_native. u:object_r:device_config_netd_native_prop:s0
persist.device_config.nnapi_native. u:object_r:device_config_nnapi_native_prop:s0
persist.device_config.profcollect_native_boot. u:object_r:device_config_profcollect_native_boot_prop:s0 persist.device_config.profcollect_native_boot. u:object_r:device_config_profcollect_native_boot_prop:s0
persist.device_config.runtime_native. u:object_r:device_config_runtime_native_prop:s0 persist.device_config.runtime_native. u:object_r:device_config_runtime_native_prop:s0
persist.device_config.runtime_native_boot. u:object_r:device_config_runtime_native_boot_prop:s0 persist.device_config.runtime_native_boot. u:object_r:device_config_runtime_native_boot_prop:s0

2
private/system_server.te
View file

@ -696,6 +696,7 @@ set_prop(system_server, cppreopt_prop)
# server configurable flags properties # server configurable flags properties
set_prop(system_server, device_config_input_native_boot_prop) set_prop(system_server, device_config_input_native_boot_prop)
set_prop(system_server, device_config_netd_native_prop) set_prop(system_server, device_config_netd_native_prop)
set_prop(system_server, device_config_nnapi_native_prop)
set_prop(system_server, device_config_activity_manager_native_boot_prop) set_prop(system_server, device_config_activity_manager_native_boot_prop)
set_prop(system_server, device_config_runtime_native_boot_prop) set_prop(system_server, device_config_runtime_native_boot_prop)
set_prop(system_server, device_config_runtime_native_prop) set_prop(system_server, device_config_runtime_native_prop)
@ -1217,6 +1218,7 @@ neverallow {
device_config_input_native_boot_prop device_config_input_native_boot_prop
device_config_lmkd_native_prop device_config_lmkd_native_prop
device_config_netd_native_prop device_config_netd_native_prop
device_config_nnapi_native_prop
device_config_runtime_native_boot_prop device_config_runtime_native_boot_prop
device_config_runtime_native_prop device_config_runtime_native_prop
device_config_media_native_prop device_config_media_native_prop

4
public/hal_neuralnetworks.te
View file

@ -28,6 +28,10 @@ allow hal_neuralnetworks_server apk_data_file:file { getattr map read };
# property to determine whether to deny NNAPI extensions use for apps # property to determine whether to deny NNAPI extensions use for apps
# on product partition (apps in GSI are not allowed to use NNAPI extensions). # on product partition (apps in GSI are not allowed to use NNAPI extensions).
get_prop(hal_neuralnetworks_client, nnapi_ext_deny_product_prop); get_prop(hal_neuralnetworks_client, nnapi_ext_deny_product_prop);
# Allow NN HAL client to read device_config_nnapi_native_prop.
get_prop(hal_neuralnetworks_client, device_config_nnapi_native_prop)
# This property is only expected to be found in /product/build.prop, # This property is only expected to be found in /product/build.prop,
# allow to be set only by init. # allow to be set only by init.
neverallow { domain -init } nnapi_ext_deny_product_prop:property_service set; neverallow { domain -init } nnapi_ext_deny_product_prop:property_service set;

1
public/property.te
View file

@ -65,6 +65,7 @@ system_restricted_prop(bq_config_prop)
system_restricted_prop(build_bootimage_prop) system_restricted_prop(build_bootimage_prop)
system_restricted_prop(build_prop) system_restricted_prop(build_prop)
system_restricted_prop(charger_status_prop) system_restricted_prop(charger_status_prop)
system_restricted_prop(device_config_nnapi_native_prop)
system_restricted_prop(device_config_runtime_native_boot_prop) system_restricted_prop(device_config_runtime_native_boot_prop)
system_restricted_prop(device_config_runtime_native_prop) system_restricted_prop(device_config_runtime_native_prop)
system_restricted_prop(fingerprint_prop) system_restricted_prop(fingerprint_prop)