From f98650e4abbb3b258a3fab24de83c0e849c0ecb7 Mon Sep 17 00:00:00 2001 From: Alex Klyubin Date: Tue, 21 Feb 2017 15:35:16 -0800 Subject: [PATCH] Switch Fingerprint HAL policy to _client/_server This switches Fingerprint HAL policy to the design which enables us to conditionally remove unnecessary rules from domains which are clients of Bluetooth HAL. Domains which are clients of Fingerprint HAL, such as system_server domain, are granted rules targeting hal_fingerprint only when the Fingerprint HAL runs in passthrough mode (i.e., inside the client's process). When the HAL runs in binderized mode (i.e., in another process/domain, with clients talking to the HAL over HwBinder IPC), rules targeting hal_fingerprint are not granted to client domains. Domains which offer a binderized implementation of Fingerprint HAL, such as hal_fingerprint_default domain, are always granted rules targeting hal_fingerprint. NOTE: This commit also removes unnecessary allow rules from Fingerprint HAL, such access to servicemanager (not hwservicemanager) and access to keystore daemon over Binder IPC. Fingerprint HAL does not use this functionality anyway and shouldn't use it either. Test: Enable fingerprint + PIN secure lock screen, confirm it unlocks with fingerprint or PIN Test: Disable PIN (and thus fingerprint) secure lock screen Test: make FingerprintDialog, install, make a fake purchase Test: Add fingerprint_hidl_hal_test to device.mk, build & add to device, adb shell stop, adb shell /data/nativetest64/fingerprint_hidl_hal_test/fingerprint_hidl_hal_test -- all tests pass Bug: 34170079 Change-Id: I6951c0f0640194c743ff7049357c77f5f21b71a1 --- private/system_server.te | 3 +-- public/attributes | 2 ++ public/hal_fingerprint.te | 15 ++++----------- vendor/hal_fingerprint_default.te | 2 +- 4 files changed, 8 insertions(+), 14 deletions(-) diff --git a/private/system_server.te b/private/system_server.te index 738a84eeb..a1f989935 100644 --- a/private/system_server.te +++ b/private/system_server.te @@ -170,7 +170,6 @@ binder_call(system_server, appdomain) binder_call(system_server, binderservicedomain) binder_call(system_server, dumpstate) binder_call(system_server, fingerprintd) -binder_call(system_server, hal_fingerprint) binder_call(system_server, gatekeeperd) binder_call(system_server, installd) binder_call(system_server, incidentd) @@ -183,7 +182,7 @@ hwbinder_use(system_server) hwallocator_use(system_server) binder_call(system_server, hal_boot) binder_call(system_server, hal_contexthub) -binder_call(system_server, hal_fingerprint) +hal_client_domain(system_server, hal_fingerprint) binder_call(system_server, hal_gnss); binder_call(system_server, hal_ir) binder_call(system_server, hal_light) diff --git a/public/attributes b/public/attributes index 281724e14..033592255 100644 --- a/public/attributes +++ b/public/attributes @@ -139,6 +139,8 @@ attribute hal_drm_client; attribute hal_drm_server; attribute hal_dumpstate; attribute hal_fingerprint; +attribute hal_fingerprint_client; +attribute hal_fingerprint_server; attribute hal_gatekeeper; attribute hal_gnss; attribute hal_graphics_allocator; diff --git a/public/hal_fingerprint.te b/public/hal_fingerprint.te index 8405a7ea8..580ef3796 100644 --- a/public/hal_fingerprint.te +++ b/public/hal_fingerprint.te @@ -1,22 +1,15 @@ +# HwBinder IPC from client to server, and callbacks +binder_call(hal_fingerprint_client, hal_fingerprint_server) +binder_call(hal_fingerprint_server, hal_fingerprint_client) + # allow HAL module to read dir contents allow hal_fingerprint fingerprintd_data_file:file create_file_perms; # allow HAL module to read/write/unlink contents of this dir allow hal_fingerprint fingerprintd_data_file:dir rw_dir_perms; -# Need to add auth tokens to KeyStore -use_keystore(hal_fingerprint) -allow hal_fingerprint keystore:keystore_key add_auth; - -# For permissions checking -binder_call(hal_fingerprint, system_server); -allow hal_fingerprint permission_service:service_manager find; - # For memory allocation allow hal_fingerprint ion_device:chr_file r_file_perms; -# Allow fingerprint to find and call keystore binder interfaces -binder_use(hal_fingerprint); - r_dir_file(hal_fingerprint, cgroup) r_dir_file(hal_fingerprint, sysfs) diff --git a/vendor/hal_fingerprint_default.te b/vendor/hal_fingerprint_default.te index c392a8583..2b9001ebd 100644 --- a/vendor/hal_fingerprint_default.te +++ b/vendor/hal_fingerprint_default.te @@ -1,5 +1,5 @@ type hal_fingerprint_default, domain; -hal_impl_domain(hal_fingerprint_default, hal_fingerprint) +hal_server_domain(hal_fingerprint_default, hal_fingerprint) type hal_fingerprint_default_exec, exec_type, file_type; init_daemon_domain(hal_fingerprint_default)