606d2fd665
Introduce the add_service() macro which wraps up add/find
permissions for the source domain with a neverallow preventing
others from adding it. Only a particular domain should
add a particular service.
Use the add_service() macro to automatically add a neverallow
that prevents other domains from adding the service.
mediadrmserver was adding services labeled mediaserver_service.
Drop the add permission as it should just need the find
permission.
Additionally, the macro adds the { add find } permission which
causes some existing neverallow's to assert. Adjust those
neverallow's so "self" can always find.
Test: compile and run on hikey and emulator. No new denials were
found, and all services, where applicable, seem to be running OK.
Change-Id: Ibbd2a5304edd5f8b877bc86852b0694732be993c
Signed-off-by: William Roberts <william.c.roberts@intel.com>
26 lines
740 B
Text
26 lines
740 B
Text
# mediametrics - daemon for collecting media.metrics data
|
|
type mediametrics, domain;
|
|
type mediametrics_exec, exec_type, file_type;
|
|
|
|
|
|
binder_use(mediametrics)
|
|
binder_call(mediametrics, binderservicedomain)
|
|
binder_service(mediametrics)
|
|
|
|
add_service(mediametrics, mediametrics_service)
|
|
|
|
allow mediametrics system_server:fd use;
|
|
|
|
r_dir_file(mediametrics, cgroup)
|
|
allow mediametrics proc_meminfo:file r_file_perms;
|
|
|
|
###
|
|
### neverallow rules
|
|
###
|
|
|
|
# mediametrics should never execute any executable without a
|
|
# domain transition
|
|
neverallow mediametrics { file_type fs_type }:file execute_no_trans;
|
|
|
|
# mediametrics should never need network access. Disallow network sockets.
|
|
neverallow mediametrics domain:{ tcp_socket udp_socket rawip_socket } *;
|