platform_system_sepolicy/prebuilts/api/31.0/public/iorapd.te
Inseob Kim 08d4c8fa6e Add fake 31.0 prebuilt
This commit adds fake 31.0 prebuilt. The prebuilt is based on AOSP
policy, but slightly modified so the set of types and attributes is a
subset of real 31.0 prebuilt (sc-dev policy).

Steps taken to make the fake prebuilt:

1) build plat_sepolicy.cil both on AOSP and sc-dev, with lunch target
aosp_arm64-eng.
2) diff both outputs to find out which types and attributes don't exist.
3) remove all relevant files and statements.

As a result, the following types are removed.

artd
artd_exec
artd_service
power_stats_service
transformer_service
virtualizationservice
virtualizationservice_data_file
virtualizationservice_exec

Bug: 189161483
Test: N/A, will do after adding 31.0 mapping files.
Change-Id: Ia957fc32b1838dae730d9dd7bd917d684d4a24cf
Merged-In: Ia4ea2999f4bc8ae80f13e51d99fba3e98e293447
2021-06-15 12:08:00 +00:00

97 lines
2.9 KiB
Text

# volume manager
type iorapd, domain;
type iorapd_exec, exec_type, file_type, system_file_type;
type iorapd_tmpfs, file_type;
r_dir_file(iorapd, rootfs)
# Allow read/write /proc/sys/vm/drop/caches
allow iorapd proc_drop_caches:file rw_file_perms;
# Give iorapd a place where only iorapd can store files; everyone else is off limits
allow iorapd iorapd_data_file:dir create_dir_perms;
allow iorapd iorapd_data_file:file create_file_perms;
# Allow iorapd to publish a binder service and make binder calls.
binder_use(iorapd)
add_service(iorapd, iorapd_service)
# Allow iorapd to call into the system server so it can check permissions.
binder_call(iorapd, system_server)
allow iorapd permission_service:service_manager find;
# IUserManager
allow iorapd user_service:service_manager find;
# IPackageManagerNative
allow iorapd package_native_service:service_manager find;
# Allow dumpstate (bugreport) to call into iorapd.
allow iorapd dumpstate:fd use;
allow iorapd dumpstate:fifo_file write;
# talk to batteryservice
binder_call(iorapd, healthd)
# TODO: does each of the service_manager allow finds above need the binder_call?
# iorapd temporarily changes its priority when running benchmarks
allow iorapd self:global_capability_class_set sys_nice;
# Allow to access Perfetto traced's privileged consumer socket to start/stop
# tracing sessions and read trace data.
unix_socket_connect(iorapd, traced_consumer, traced)
# Allow iorapd to execute compilation (iorap.cmd.compiler) in idle time.
allow iorapd system_file:file rx_file_perms;
# Allow iorapd to send signull to iorap_inode2filename and iorap_prefetcherd.
allow iorapd iorap_inode2filename:process signull;
allow iorapd iorap_prefetcherd:process signull;
# Allowing system_server to check for the existence and size of files under iorapd
# dir without collecting any sensitive app data.
# This is used to predict if iorapd is doing prefetching or not.
allow system_server iorapd_data_file:dir { getattr open read search };
allow system_server iorapd_data_file:file getattr;
###
### neverallow rules
###
neverallow {
domain
-iorapd
} iorapd_data_file:dir ~{ open create read getattr setattr search relabelto ioctl };
neverallow {
domain
-init
-iorapd
-system_server
} iorapd_data_file:dir *;
neverallow {
domain
-kernel
-iorapd
} iorapd_data_file:notdevfile_class_set ~{ relabelto getattr };
neverallow {
domain
-init
-kernel
-vendor_init
-iorapd
-system_server
} { iorapd_data_file }:notdevfile_class_set *;
# Only system_server and shell (for dumpsys) can interact with iorapd over binder
neverallow { domain -dumpstate -system_server -iorapd } iorapd_service:service_manager find;
neverallow iorapd {
domain
-healthd
-servicemanager
-system_server
userdebug_or_eng(`-su')
}:binder call;
neverallow { domain -init } iorapd:process { transition dyntransition };
neverallow iorapd domain:{ tcp_socket udp_socket rawip_socket } *;