ea331aa7b8
The NeuralNetworks runtime is a library that communicates with NeuralNetworks HIDL services and is linked by applications. To enable the NN runtime to use these services, applications must have explicit sepolicy permissions to find the NN services and communicate across binder. This CL relaxes neverallow rules for hal_neuralnetworks_*. Because it is affecting pre-existing neverallow rules, this CL requires a CTS rebuild. Bug: 70340780 Test: mm Test: ran neuralnetworks vts and cts binaries Change-Id: I84f73ac77486681f91d1f8687268c0fa22a7ba0b (cherry picked from commit 598870bebc4bb34542df81799b46f3cdcfb6723b)
38 lines
2.1 KiB
Text
38 lines
2.1 KiB
Text
; THIS IS A WORKAROUND for the current limitations of the module policy language
|
|
; This should be used sparingly until we figure out a saner way to achieve the
|
|
; stuff below, for example, by improving typeattribute statement of module
|
|
; language.
|
|
;
|
|
; NOTE: This file has no effect on recovery policy.
|
|
|
|
; Apps, except isolated apps, are clients of Allocator HAL
|
|
; Unfortunately, we can't currently express this in module policy language:
|
|
; typeattribute { appdomain -isolated_app } hal_allocator_client;
|
|
; typeattribute hal_allocator_client halclientdomain;
|
|
(typeattributeset hal_allocator_client ((and (appdomain) ((not (isolated_app))))))
|
|
(typeattributeset halclientdomain (hal_allocator_client))
|
|
|
|
; Apps, except isolated apps, are clients of Configstore HAL
|
|
; Unfortunately, we can't currently express this in module policy language:
|
|
; typeattribute { appdomain -isolated_app } hal_configstore_client;
|
|
(typeattributeset hal_configstore_client ((and (appdomain) ((not (isolated_app))))))
|
|
|
|
; Apps, except isolated apps, are clients of Graphics Allocator HAL
|
|
; Unfortunately, we can't currently express this in module policy language:
|
|
; typeattribute { appdomain -isolated_app } hal_graphics_allocator_client;
|
|
(typeattributeset hal_graphics_allocator_client ((and (appdomain) ((not (isolated_app))))))
|
|
|
|
; Apps, except isolated apps, are clients of Cas HAL
|
|
; Unfortunately, we can't currently express this in module policy language:
|
|
; typeattribute { appdomain -isolated_app } hal_cas_client;
|
|
(typeattributeset hal_cas_client ((and (appdomain) ((not (isolated_app))))))
|
|
|
|
; Domains hosting Camera HAL implementations are clients of Allocator HAL
|
|
; Unfortunately, we can't currently express this in module policy language:
|
|
; typeattribute hal_camera hal_allocator_client;
|
|
(typeattributeset hal_allocator_client (hal_camera))
|
|
|
|
; Apps, except isolated apps, are clients of Neuralnetworks HAL
|
|
; Unfortunately, we can't currently express this in module policy language:
|
|
; typeattribute { appdomain -isolated_app } hal_neuralnetworks_client;
|
|
(typeattributeset hal_neuralnetworks_client ((and (appdomain) ((not (isolated_app))))))
|