tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

gatekeeper HAL service: add security policy

Browse source 
Change-Id: I79a305407c3a362d7be11f4c026f31f1e9666f1c
Signed-off-by: Alexey Polyudov <apolyudov@google.com>
This commit is contained in:
Alexey Polyudov 2016-10-20 11:20:25 -07:00
parent cdbb19f136
commit a9ce208680
5 changed files with 18 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
private/file_contexts
View file

@ -233,6 +233,7 @@
/system/bin/hw/android\.hardware\.boot@1\.0-service u:object_r:hal_boot_exec:s0
/system/bin/hw/android\.hardware\.contexthub@1\.0-service u:object_r:hal_contexthub_default_exec:s0
/system/bin/hw/android\.hardware\.dumpstate@1\.0-service u:object_r:hal_dumpstate_default_exec:s0
/system/bin/hw/android\.hardware\.gatekeeper@1\.0-service u:object_r:hal_gatekeeper_default_exec:s0
/system/bin/hw/android\.hardware\.graphics\.allocator@2\.0-service u:object_r:hal_graphics_allocator_default_exec:s0
/system/bin/hw/android\.hardware\.graphics\.composer@2\.1-service u:object_r:hal_graphics_composer_default_exec:s0
/system/bin/hw/android\.hardware\.health@1\.0-service u:object_r:hal_health_default_exec:s0

4
private/hal_gatekeeper_default.te Normal file
View file

@ -0,0 +1,4 @@
type hal_gatekeeper_default, hal_gatekeeper, domain;
type hal_gatekeeper_default_exec, exec_type, file_type;
init_daemon_domain(hal_gatekeeper_default);

1
public/attributes
View file

@ -117,6 +117,7 @@ attribute update_engine_common;
# HALs
attribute hal_audio;
attribute hal_dumpstate;
attribute hal_gatekeeper;
attribute hal_graphics_allocator;
attribute hal_graphics_composer;
attribute hal_health;

6
public/gatekeeperd.te
View file

@ -1,11 +1,10 @@
type gatekeeperd, domain;
# normally uses HAL; implements HAL in pass-through mode only
type gatekeeperd, hal_gatekeeper, domain;
type gatekeeperd_exec, exec_type, file_type;
# gatekeeperd
binder_service(gatekeeperd)
binder_use(gatekeeperd)
allow gatekeeperd tee_device:chr_file rw_file_perms;
allow gatekeeperd ion_device:chr_file r_file_perms;
# need to find KeyStore and add self
allow gatekeeperd gatekeeper_service:service_manager { add find };
@ -20,6 +19,7 @@ allow gatekeeperd keystore:keystore_key { add_auth };
# For permissions checking
allow gatekeeperd system_server:binder call;
allow gatekeeperd permission_service:service_manager find;
# For parent user ID lookup
allow gatekeeperd user_service:service_manager find;

9
public/hal_gatekeeper.te Normal file
View file

@ -0,0 +1,9 @@
# hwbinder access
hwbinder_use(hal_gatekeeper)
# call into gatekeeperd process (callbacks)
binder_call(hal_gatekeeper, gatekeeperd)
# TEE access.
allow hal_gatekeeper tee_device:chr_file rw_file_perms;
allow hal_gatekeeper ion_device:chr_file r_file_perms;