tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Merge "Use prefixes for binder cache SELinux properties." into rvc-dev

Browse source
This commit is contained in:
Collin Fijalkovich 2020-04-24 20:54:04 +00:00 committed by Android (Google) Code Review
commit a24d7ccd8f
5 changed files with 11 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
private/compat/29.0/29.0.ignore.cil
View file

@ -22,6 +22,7 @@
blob_store_service
binder_cache_bluetooth_server_prop
binder_cache_system_server_prop
binder_cache_telephony_server_prop
binderfs
binderfs_logs
binderfs_logs_proc

4
private/radio.te
View file

@ -19,3 +19,7 @@ allow radio emergency_data_file:file r_file_perms;
# allow sending pulled atoms to statsd
binder_call(radio, statsd)
# allow telephony to access related cache properties
set_prop(radio, binder_cache_telephony_server_prop);
neverallow { domain -radio -init }
binder_cache_telephony_server_prop:property_service set;

1
public/domain.te
View file

@ -112,6 +112,7 @@ get_prop(domain, vndk_prop)
# Binder cache properties are world-readable
get_prop(domain, binder_cache_bluetooth_server_prop)
get_prop(domain, binder_cache_system_server_prop)
get_prop(domain, binder_cache_telephony_server_prop)
# Let everyone read log properties, so that liblog can avoid sending unloggable
# messages to logd.

1
public/property.te
View file

@ -69,6 +69,7 @@ compatible_property_only(`
# Properties used by binder caches
system_restricted_prop(binder_cache_bluetooth_server_prop)
system_restricted_prop(binder_cache_system_server_prop)
system_restricted_prop(binder_cache_telephony_server_prop)
system_restricted_prop(boottime_public_prop)
system_restricted_prop(bq_config_prop)
system_restricted_prop(module_sdkextensions_prop)

8
public/property_contexts
View file

@ -452,10 +452,6 @@ ro.surface_flinger.refresh_rate_switching u:object_r:exported_default_prop:s0 ex
# Binder cache properties. These are world-readable
cache_key.app_inactive u:object_r:binder_cache_system_server_prop:s0
cache_key.is_compat_change_enabled u:object_r:binder_cache_system_server_prop:s0
cache_key.bluetooth.get_bond_state u:object_r:binder_cache_bluetooth_server_prop:s0
cache_key.bluetooth.get_profile_connection_state u:object_r:binder_cache_bluetooth_server_prop:s0
cache_key.bluetooth.get_state u:object_r:binder_cache_bluetooth_server_prop:s0
cache_key.bluetooth.is_offloaded_filtering_supported u:object_r:binder_cache_bluetooth_server_prop:s0
cache_key.get_packages_for_uid u:object_r:binder_cache_system_server_prop:s0
cache_key.has_system_feature u:object_r:binder_cache_system_server_prop:s0
cache_key.is_interactive u:object_r:binder_cache_system_server_prop:s0
@ -465,3 +461,7 @@ cache_key.volume_list u:object_r:binder_cache_system_server_p
cache_key.display_info u:object_r:binder_cache_system_server_prop:s0
cache_key.location_enabled u:object_r:binder_cache_system_server_prop:s0
cache_key.package_info u:object_r:binder_cache_system_server_prop:s0
cache_key.bluetooth. u:object_r:binder_cache_bluetooth_server_prop:s0 prefix string
cache_key.system_server. u:object_r:binder_cache_system_server_prop:s0 prefix string
cache_key.telephony. u:object_r:binder_cache_telephony_server_prop:s0 prefix string