tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Merge "binder_use: Allow servicemanager callbacks" am: a2f0fdfddd am: 7f2d67e039 am: 8c9b9e4fff

Browse source 
Change-Id: Id822ed49e77e8bfdc5bcd0c1869b31940f95c992
This commit is contained in:
Automerger Merge Worker 2019-12-23 20:42:58 +00:00
commit 9ce7870f3d
4 changed files with 6 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
private/lpdumpd.te
View file

@ -38,4 +38,5 @@ neverallow {
-dumpstate
-lpdumpd
-shell
-servicemanager
} lpdumpd:binder call;

2
public/apexd.te
View file

@ -7,7 +7,7 @@ add_service(apexd, apex_service)
set_prop(apexd, apexd_prop)
neverallow { domain -init -apexd -system_server } apex_service:service_manager find;
neverallow { domain -init -apexd -system_server } apexd:binder call;
neverallow { domain -init -apexd -system_server -servicemanager } apexd:binder call;
neverallow { domain userdebug_or_eng(`-crash_dump') } apexd:process ptrace;

4
public/installd.te
View file

@ -173,9 +173,9 @@ allow installd preloads_media_file:dir { r_dir_perms write remove_name rmdir };
### Neverallow rules
###
# only system_server, installd and dumpstate may interact with installd over binder
# only system_server, installd, dumpstate, and servicemanager may interact with installd over binder
neverallow { domain -system_server -dumpstate -installd } installd_service:service_manager find;
neverallow { domain -system_server -dumpstate } installd:binder call;
neverallow { domain -system_server -dumpstate -servicemanager } installd:binder call;
neverallow installd {
domain
-system_server

2
public/te_macros
View file

@ -337,6 +337,8 @@ allow $1 $3:unix_dgram_socket sendto;
define(`binder_use', `
# Call the servicemanager and transfer references to it.
allow $1 servicemanager:binder { call transfer };
# Allow servicemanager to send out callbacks
allow servicemanager $1:binder { call transfer };
# servicemanager performs getpidcon on clients.
allow servicemanager $1:dir search;
allow servicemanager $1:file { read open };