75806ef3c5
Ideally, public should only contain APIs (types / attributes) for
vendor. The other statements like allow/neverallow/typeattributes are
regarded as implementation detail for platform and should be in private.
Bug: 232023812
Test: m selinux_policy
Test: diff <(git diff --staged | grep "^-" | cut -b2- | sort) \
<(git diff --staged | grep "^+" | cut -b2- | sort)
Test: remove comments on plat_sepolicy.cil, replace base_typeattr_*
to base_typeattr and then compare old and new plat_sepolicy.cil
Change-Id: I5e7d2da4465ab0216de6bacdf03077d37f6ffe12
44 lines
2.7 KiB
Text
44 lines
2.7 KiB
Text
type adaptive_auth_service, system_server_service, service_manager_type;
|
|
type ambient_context_service, app_api_service, system_server_service, service_manager_type;
|
|
type attention_service, system_server_service, service_manager_type;
|
|
type bg_install_control_service, system_api_service, system_server_service, service_manager_type;
|
|
type compos_service, service_manager_type;
|
|
type communal_service, app_api_service, system_server_service, service_manager_type;
|
|
type dynamic_system_service, system_api_service, system_server_service, service_manager_type;
|
|
type feature_flags_service, app_api_service, system_server_service, service_manager_type;
|
|
type gsi_service, service_manager_type;
|
|
type incidentcompanion_service, app_api_service, system_api_service, system_server_service, service_manager_type;
|
|
type logcat_service, system_server_service, service_manager_type;
|
|
type logd_service, service_manager_type;
|
|
type mediatuner_service, app_api_service, service_manager_type;
|
|
type on_device_intelligence_service, app_api_service, system_server_service, service_manager_type, isolated_compute_allowed_service;
|
|
type profcollectd_service, service_manager_type;
|
|
type resolver_service, system_server_service, service_manager_type;
|
|
type rkpd_registrar_service, service_manager_type;
|
|
type rkpd_refresh_service, service_manager_type;
|
|
type safety_center_service, app_api_service, system_api_service, system_server_service, service_manager_type;
|
|
type stats_service, service_manager_type;
|
|
type statsbootstrap_service, system_server_service, service_manager_type;
|
|
type statscompanion_service, system_server_service, service_manager_type;
|
|
type statsmanager_service, system_api_service, system_server_service, service_manager_type;
|
|
type tracingproxy_service, system_server_service, service_manager_type;
|
|
type transparency_service, system_server_service, service_manager_type;
|
|
|
|
is_flag_enabled(RELEASE_AVF_ENABLE_DEVICE_ASSIGNMENT, `
|
|
type vfio_handler_service, service_manager_type;
|
|
')
|
|
is_flag_enabled(RELEASE_AVF_ENABLE_LLPVM_CHANGES, `
|
|
type virtualization_maintenance_service, service_manager_type;
|
|
')
|
|
|
|
type uce_service, service_manager_type;
|
|
type wearable_sensing_service, app_api_service, system_server_service, service_manager_type;
|
|
|
|
###
|
|
### Neverallow rules
|
|
###
|
|
|
|
# servicemanager handles registering or looking up named services.
|
|
# It does not make sense to register or lookup something which is not a service.
|
|
# Trigger a compile error if this occurs.
|
|
neverallow domain ~{ service_manager_type vndservice_manager_type }:service_manager { add find };
|