3aa1c1725e
Move wifi services out of system_server into a separate APK/process. Changes: a) Created sepolicy for the new wifi apk. b) The new APK will run with network_stack uid (eventually will be moved to the same process). Used 'audit2allow' tool to gather list of permissions required. Note: The existing wifi related permissions in system_server is left behind to allow the module to be loaded into system_server or network_stack process depending on device configuration. Bug: 113174748 Test: Device boots up and able to make wifi connection. Test: Tested hotspot functionality. Test: Ran WifiManagerTest & WifiSoftApTest ACTS tests locally. Test: Will send for wifi regression tests. Change-Id: Id19643a235bf0c28238f2729926b893ac2025b97 (cherry-picked from c7aa90091e6bec70a31a643cc4519a9a86fb0b38)
39 lines
834 B
Text
39 lines
834 B
Text
typeattribute logd coredomain;
|
|
|
|
init_daemon_domain(logd)
|
|
|
|
# logd is not allowed to write anywhere other than /data/misc/logd, and then
|
|
# only on userdebug or eng builds
|
|
neverallow logd {
|
|
file_type
|
|
-runtime_event_log_tags_file
|
|
userdebug_or_eng(`-coredump_file -misc_logd_file')
|
|
with_native_coverage(`-method_trace_data_file')
|
|
}:file { create write append };
|
|
|
|
# protect the event-log-tags file
|
|
neverallow {
|
|
domain
|
|
-appdomain # covered below
|
|
-bootstat
|
|
-dumpstate
|
|
-init
|
|
-logd
|
|
userdebug_or_eng(`-logpersist')
|
|
-servicemanager
|
|
-system_server
|
|
-surfaceflinger
|
|
-zygote
|
|
} runtime_event_log_tags_file:file no_rw_file_perms;
|
|
|
|
neverallow {
|
|
appdomain
|
|
-bluetooth
|
|
-platform_app
|
|
-priv_app
|
|
-radio
|
|
-shell
|
|
userdebug_or_eng(`-su')
|
|
-system_app
|
|
-wifi_stack
|
|
} runtime_event_log_tags_file:file no_rw_file_perms;
|