09d13e734d
This switches Boot Control HAL policy to the design which enables us
to conditionally remove unnecessary rules from domains which are
clients of Boot Control HAL.
Domains which are clients of Boot Control HAL, such as update_server,
are granted rules targeting hal_bootctl only when the Boot Control HAL
runs in passthrough mode (i.e., inside the client's process). When the
HAL runs in binderized mode (i.e., in another process/domain, with
clients talking to the HAL over HwBinder IPC), rules targeting
hal_bootctl are not granted to client domains.
Domains which offer a binderized implementation of Boot Control HAL,
such as hal_bootctl_default domain, are always granted rules targeting
hal_bootctl.
P. S. This commit removes direct access to Boot Control HAL from
system_server because system_server is not a client of this HAL. This
commit also removes bootctrl_block_device type which is no longer
used. Finally, boot_control_hal attribute is removed because it is now
covered by the hal_bootctl attribute.
Test: Device boots up, no new denials
Test: Reboot into recovery, sideload OTA update succeeds
Test: Apply OTA update via update_engine:
1. make dist
2. Ensure device has network connectivity
3. ota_call.py -s <serial here> out/dist/sailfish-ota-*.zip
Bug: 34170079
Change-Id: I9c410c092069e431a3852b66c04c4d2a9f1a25cf
101 lines
3.1 KiB
Text
101 lines
3.1 KiB
Text
# Device types
|
|
type device, dev_type, fs_type;
|
|
type alarm_device, dev_type, mlstrustedobject;
|
|
type ashmem_device, dev_type, mlstrustedobject;
|
|
type audio_device, dev_type;
|
|
type audio_timer_device, dev_type;
|
|
type audio_seq_device, dev_type;
|
|
type binder_device, dev_type, mlstrustedobject;
|
|
type hwbinder_device, dev_type, mlstrustedobject;
|
|
type block_device, dev_type;
|
|
type camera_device, dev_type;
|
|
type dm_device, dev_type;
|
|
type keychord_device, dev_type;
|
|
type loop_device, dev_type;
|
|
type pmsg_device, dev_type, mlstrustedobject;
|
|
type radio_device, dev_type;
|
|
type ram_device, dev_type;
|
|
type rtc_device, dev_type;
|
|
type vold_device, dev_type;
|
|
type console_device, dev_type;
|
|
type cpuctl_device, dev_type;
|
|
type fscklogs, dev_type;
|
|
type full_device, dev_type;
|
|
# GPU (used by most UI apps)
|
|
type gpu_device, dev_type, mlstrustedobject;
|
|
type graphics_device, dev_type;
|
|
type hw_random_device, dev_type;
|
|
type input_device, dev_type;
|
|
type kmem_device, dev_type;
|
|
type port_device, dev_type;
|
|
type log_device, dev_type, mlstrustedobject;
|
|
type mtd_device, dev_type;
|
|
type mtp_device, dev_type, mlstrustedobject;
|
|
type nfc_device, dev_type;
|
|
type ptmx_device, dev_type, mlstrustedobject;
|
|
type kmsg_device, dev_type;
|
|
type null_device, dev_type, mlstrustedobject;
|
|
type random_device, dev_type, mlstrustedobject;
|
|
type sensors_device, dev_type;
|
|
type serial_device, dev_type;
|
|
type socket_device, dev_type;
|
|
type owntty_device, dev_type, mlstrustedobject;
|
|
type tty_device, dev_type;
|
|
type video_device, dev_type;
|
|
type vcs_device, dev_type;
|
|
type zero_device, dev_type, mlstrustedobject;
|
|
type fuse_device, dev_type, mlstrustedobject;
|
|
type iio_device, dev_type;
|
|
type ion_device, dev_type, mlstrustedobject;
|
|
type qtaguid_device, dev_type;
|
|
type watchdog_device, dev_type;
|
|
type uhid_device, dev_type;
|
|
type uio_device, dev_type;
|
|
type tun_device, dev_type, mlstrustedobject;
|
|
type usbaccessory_device, dev_type, mlstrustedobject;
|
|
type usb_device, dev_type, mlstrustedobject;
|
|
type properties_device, dev_type;
|
|
type properties_serial, dev_type;
|
|
type i2c_device, dev_type;
|
|
|
|
# All devices have a uart for the hci
|
|
# attach service. The uart dev node
|
|
# varies per device. This type
|
|
# is used in per device policy
|
|
type hci_attach_dev, dev_type;
|
|
|
|
# All devices have a rpmsg device for
|
|
# achieving remoteproc and rpmsg modules
|
|
type rpmsg_device, dev_type;
|
|
|
|
# Partition layout block device
|
|
type root_block_device, dev_type;
|
|
|
|
# factory reset protection block device
|
|
type frp_block_device, dev_type;
|
|
|
|
# System block device mounted on /system.
|
|
type system_block_device, dev_type;
|
|
|
|
# Recovery block device.
|
|
type recovery_block_device, dev_type;
|
|
|
|
# boot block device.
|
|
type boot_block_device, dev_type;
|
|
|
|
# Userdata block device mounted on /data.
|
|
type userdata_block_device, dev_type;
|
|
|
|
# Cache block device mounted on /cache.
|
|
type cache_block_device, dev_type;
|
|
|
|
# Block device for any swap partition.
|
|
type swap_block_device, dev_type;
|
|
|
|
# Metadata block device used for encryption metadata.
|
|
# Assign this type to the partition specified by the encryptable=
|
|
# mount option in your fstab file in the entry for userdata.
|
|
type metadata_block_device, dev_type;
|
|
|
|
# The 'misc' partition used by recovery and A/B.
|
|
type misc_block_device, dev_type;
|