53656c1742
This adds fine-grained policy about who can register and find which
HwBinder services in hwservicemanager.
Test: Play movie in Netflix and Google Play Movies
Test: Play video in YouTube app and YouTube web page
Test: In Google Camera app, take photo (HDR+ and conventional),
record video (slow motion and normal), and check that photos
look fine and videos play back with sound.
Test: Cast screen to a Google Cast device
Test: Get location fix in Google Maps
Test: Make and receive a phone call, check that sound works both ways
and that disconnecting the call frome either end works fine.
Test: Run RsHelloCompute RenderScript demo app
Test: Run fast subset of media CTS tests:
make and install CtsMediaTestCases.apk
adb shell am instrument -e size small \
-w 'android.media.cts/android.support.test.runner.AndroidJUnitRunner'
Test: Play music using Google Play music
Test: Adjust screen brightness via the slider in Quick Settings
Test: adb bugreport
Test: Enroll in fingerprint screen unlock, unlock screen using
fingerprint
Test: Apply OTA update:
Make some visible change, e.g., rename Settings app.
make otatools && \
make dist
Ensure device has network connectivity
ota_call.py -s <serial here> --file out/dist/sailfish-ota-*.zip
Confirm the change is now live on the device
Bug: 34454312
(cherry picked from commit 632bc494f1)
Merged-In: Iecf74000e6c68f01299667486f3c767912c076d3
Change-Id: I7a9a487beaf6f30c52ce08e04d415624da49dd31
41 lines
1.9 KiB
Text
41 lines
1.9 KiB
Text
# HwBinder IPC from client to server
|
|
binder_call(hal_wifi_supplicant_client, hal_wifi_supplicant_server)
|
|
binder_call(hal_wifi_supplicant_server, hal_wifi_supplicant_client)
|
|
|
|
add_hwservice(hal_wifi_supplicant_server, hal_wifi_supplicant_hwservice)
|
|
allow hal_wifi_supplicant_client hal_wifi_supplicant_hwservice:hwservice_manager find;
|
|
|
|
# in addition to ioctls whitelisted for all domains, grant hal_wifi_supplicant priv_sock_ioctls.
|
|
allowxperm hal_wifi_supplicant self:udp_socket ioctl priv_sock_ioctls;
|
|
|
|
r_dir_file(hal_wifi_supplicant, sysfs_type)
|
|
r_dir_file(hal_wifi_supplicant, proc_net)
|
|
|
|
allow hal_wifi_supplicant kernel:system module_request;
|
|
allow hal_wifi_supplicant self:capability { setuid net_admin setgid net_raw };
|
|
allow hal_wifi_supplicant cgroup:dir create_dir_perms;
|
|
allow hal_wifi_supplicant self:netlink_route_socket nlmsg_write;
|
|
allow hal_wifi_supplicant self:netlink_socket create_socket_perms_no_ioctl;
|
|
allow hal_wifi_supplicant self:netlink_generic_socket create_socket_perms_no_ioctl;
|
|
allow hal_wifi_supplicant self:packet_socket create_socket_perms;
|
|
allowxperm hal_wifi_supplicant self:packet_socket ioctl { unpriv_sock_ioctls priv_sock_ioctls unpriv_tty_ioctls };
|
|
allow hal_wifi_supplicant wifi_data_file:dir create_dir_perms;
|
|
allow hal_wifi_supplicant wifi_data_file:file create_file_perms;
|
|
|
|
# Create a socket for receiving info from wpa
|
|
allow hal_wifi_supplicant wpa_socket:dir create_dir_perms;
|
|
allow hal_wifi_supplicant wpa_socket:sock_file create_file_perms;
|
|
|
|
# Allow wpa_cli to work. wpa_cli creates a socket in
|
|
# /data/misc/wifi/sockets which hal_wifi_supplicant supplicant communicates with.
|
|
userdebug_or_eng(`
|
|
unix_socket_send(hal_wifi_supplicant, wpa, su)
|
|
')
|
|
|
|
###
|
|
### neverallow rules
|
|
###
|
|
|
|
# wpa_supplicant should not trust any data from sdcards
|
|
neverallow hal_wifi_supplicant_server sdcard_type:dir ~getattr;
|
|
neverallow hal_wifi_supplicant_server sdcard_type:file *;
|