f90c41f6e8
Add a service_mananger class with the verb add. Add a type that groups the services for each of the processes that is allowed to start services in service.te and an attribute for all services controlled by the service manager. Add the service_contexts file which maps service name to target label. Bug: 12909011 Change-Id: I017032a50bc90c57b536e80b972118016d340c7d
21 lines
864 B
Text
21 lines
864 B
Text
# servicemanager - the Binder context manager
|
|
type servicemanager, domain;
|
|
type servicemanager_exec, exec_type, file_type;
|
|
|
|
init_daemon_domain(servicemanager)
|
|
|
|
# Note that we do not use the binder_* macros here.
|
|
# servicemanager is unique in that it only provides
|
|
# name service (aka context manager) for Binder.
|
|
# As such, it only ever receives and transfers other references
|
|
# created by other domains. It never passes its own references
|
|
# or initiates a Binder IPC.
|
|
allow servicemanager self:binder set_context_mgr;
|
|
allow servicemanager domain:binder transfer;
|
|
|
|
# Get contexts of binder services that call servicemanager.
|
|
allow servicemanager binderservicedomain:dir search;
|
|
allow servicemanager binderservicedomain:file { read open };
|
|
allow servicemanager binderservicedomain:process getattr;
|
|
# Check SELinux permissions.
|
|
selinux_check_access(servicemanager)
|