4a478c47f4
Vendor and system components are only allowed to share files by
passing open FDs over HIDL. Ban all directory access and all file
accesses other than what can be applied to an open file:
stat/read/write/append.
This commit marks core data types as core_data_file_type and bans
access to non-core domains with an exemption for apps. A temporary
exemption is also granted to domains that currently rely on
access with TODOs and bug number for each exemption.
Bug: 34980020
Test: Build and boot Marlin. Make phone call, watch youtube video.
No new denials observed.
Change-Id: I320dd30f9f0a5bf2f9bb218776b4bccdb529b197
16 lines
797 B
Text
16 lines
797 B
Text
# wpa supplicant or equivalent
|
|
type hal_wifi_supplicant_default, domain;
|
|
hal_server_domain(hal_wifi_supplicant_default, hal_wifi_supplicant)
|
|
type hal_wifi_supplicant_default_exec, exec_type, file_type;
|
|
init_daemon_domain(hal_wifi_supplicant_default)
|
|
|
|
net_domain(hal_wifi_supplicant_default)
|
|
# Create a socket for receiving info from wpa
|
|
type_transition hal_wifi_supplicant_default wifi_data_file:dir wpa_socket "sockets";
|
|
|
|
# TODO(b/34603782): Remove this once Wi-Fi Supplicant HAL stops using Binder
|
|
typeattribute hal_wifi_supplicant_default binder_in_vendor_violators;
|
|
# TODO (b/36645291) Move hal_wifi_supplicant's data access to /data/vendor
|
|
# Remove coredata_in_vendor_violators attribute.
|
|
# wpa supplicant or equivalent
|
|
typeattribute hal_wifi_supplicant_default coredata_in_vendor_violators;
|