tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
platform_system_sepolicy/public
History
Alex Klyubin ac2b4cd2cb Use _client and _server for Audio HAL policy 
This starts the switch for HAL policy to the approach where:
* domains which are clients of Foo HAL are associated with
  hal_foo_client attribute,
* domains which offer the Foo HAL service over HwBinder are
  associated with hal_foo_server attribute,
* policy needed by the implementation of Foo HAL service is written
  against the hal_foo attribute. This policy is granted to domains
  which offer the Foo HAL service over HwBinder and, if Foo HAL runs
  in the so-called passthrough mode (inside the process of each
  client), also granted to all domains which are clients of Foo HAL.
  hal_foo is there to avoid duplicating the rules for hal_foo_client
  and hal_foo_server to cover the passthrough/in-process Foo HAL and
  binderized/out-of-process Foo HAL cases.

A benefit of associating all domains which are clients of Foo HAL with
hal_foo (when Foo HAL is in passthrough mode) is that this removes the
need for device-specific policy to be able to reference these domains
directly (in order to add device-specific allow rules). Instead,
device-specific policy only needs to reference hal_foo and should no
longer need to care which particular domains on the device are clients
of Foo HAL. This can be seen in simplification of the rules for
audioserver domain which is a client of Audio HAL whose policy is
being restructured in this commit.

This commit uses Audio HAL as an example to illustrate the approach.
Once this commit lands, other HALs will also be switched to this
approach.

Test: Google Play Music plays back radios
Test: Google Camera records video with sound and that video is then
      successfully played back with sound
Test: YouTube app plays back clips with sound
Test: YouTube in Chrome plays back clips with sound
Bug: 34170079
Change-Id: I2597a046753edef06123f0476c2ee6889fc17f20
2017-02-15 13:32:14 -08:00
..
adbd.te Move adbd policy to private 2017-02-07 09:55:05 -08:00
attributes Use _client and _server for Audio HAL policy 2017-02-15 13:32:14 -08:00
audioserver.te Move audioserver policy to private 2017-02-07 10:47:18 -08:00
blkid.te Move blkid policy to private 2017-02-07 23:57:53 +00:00
blkid_untrusted.te Move blkid policy to private 2017-02-07 23:57:53 +00:00
bluetooth.te Move bluetooth policy to private 2017-02-06 15:29:10 -08:00
boot_control_hal.te Split general policy into public and private components. 2016-10-06 13:09:06 -07:00
bootanim.te Add sepolicy for hwcomposer HAL 2016-11-14 01:54:33 +00:00
bootstat.te logd: restrict access to /dev/event-log-tags 2017-01-31 15:50:15 +00:00
bufferhubd.te Add policies for new services. 2017-02-09 15:15:11 -08:00
cameraserver.te Camera: grant system file perm for Treble 2017-01-30 14:52:21 -08:00
charger.te healthd: create SEPolicy for 'charger' and reduce healthd's scope 2016-12-15 18:17:13 -08:00
clatd.te Split general policy into public and private components. 2016-10-06 13:09:06 -07:00
cppreopts.te Split general policy into public and private components. 2016-10-06 13:09:06 -07:00
crash_dump.te crash_dump: dontaudit CAP_SYS_PTRACE denial. 2017-02-01 17:56:07 -08:00
device.te Auditing init and ueventd access to chr device files. 2017-01-13 17:38:39 +00:00
dex2oat.te Merge ephemeral data and apk files into app 2017-02-06 10:16:50 -08:00
dhcp.te Split general policy into public and private components. 2016-10-06 13:09:06 -07:00
dnsmasq.te remove more domain_deprecated 2016-12-09 19:57:43 -08:00
domain.te untrusted_app: policy versioning based on targetSdkVersion 2017-02-14 13:30:12 -08:00
domain_deprecated.te domain_deprecated.te: remove auditallow statements on user builds 2017-02-10 12:58:41 -08:00
drmserver.te Merge ephemeral data and apk files into app 2017-02-06 10:16:50 -08:00
dumpstate.te Add policies for new services. 2017-02-09 15:15:11 -08:00
ephemeral_app.te Move ephemeral_app policy to private 2017-01-09 15:34:27 -08:00
file.te tracefs: avoid overly generic regexes 2017-02-12 08:40:32 -08:00
fingerprintd.te te_macros: introduce add_service() macro 2017-01-26 04:43:16 +00:00
fsck.te Remove logspam 2017-02-10 12:06:38 -08:00
fsck_untrusted.te Split general policy into public and private components. 2016-10-06 13:09:06 -07:00
gatekeeperd.te Remove hal_gatekeeper from gatekeeperd domain 2017-01-26 07:17:51 -08:00
global_macros Remove obsolete netlink_firewall_socket and netlink_ip6fw_socket classes. 2017-02-06 14:24:41 -05:00
hal_allocator.te haldomain: add hwbinder_use 2017-01-18 09:47:50 -08:00
hal_audio.te Use _client and _server for Audio HAL policy 2017-02-15 13:32:14 -08:00
hal_bluetooth.te Bluetooth: Enable /proc access for vendor library low power control 2017-02-08 04:31:53 +00:00
hal_boot.te Move hal_*_default policy to vendor image 2017-02-14 18:35:50 -08:00
hal_camera.te haldomain: search for passthrough hals 2017-01-24 16:41:00 -08:00
hal_contexthub.te haldomain: add hwbinder_use 2017-01-18 09:47:50 -08:00
hal_drm.te Add sepolicy for drm HALs 2017-01-25 11:21:03 -08:00
hal_dumpstate.te haldomain: add hwbinder_use 2017-01-18 09:47:50 -08:00
hal_fingerprint.te hal_fingerprint: grant read access to /sys 2017-02-10 13:20:52 -08:00
hal_gatekeeper.te haldomain: add hwbinder_use 2017-01-18 09:47:50 -08:00
hal_gnss.te haldomain: add hwbinder_use 2017-01-18 09:47:50 -08:00
hal_graphics_allocator.te haldomain: add hwbinder_use 2017-01-18 09:47:50 -08:00
hal_graphics_composer.te Allow hwcomposer to change scheduling policy 2017-02-13 09:02:04 -08:00
hal_health.te haldomain: add hwbinder_use 2017-01-18 09:47:50 -08:00
hal_ir.te haldomain: add hwbinder_use 2017-01-18 09:47:50 -08:00
hal_keymaster.te Preliminary policy for hal_keymaster (TREBLE) 2017-01-27 15:02:57 -08:00
hal_light.te hal_light: add permission to sys/class/leds. 2017-01-20 00:17:11 +00:00
hal_nfc.te haldomain: add hwbinder_use 2017-01-18 09:47:50 -08:00
hal_telephony.te haldomain: add hwbinder_use 2017-01-18 09:47:50 -08:00
hal_thermal.te haldomain: add hwbinder_use 2017-01-18 09:47:50 -08:00
hal_usb.te sepolicy for usb hal 2017-01-27 00:05:19 +00:00
hal_vibrator.te haldomain: add hwbinder_use 2017-01-18 09:47:50 -08:00
hal_vr.te haldomain: add hwbinder_use 2017-01-18 09:47:50 -08:00
hal_wifi.te haldomain: add hwbinder_use 2017-01-18 09:47:50 -08:00
healthd.te te_macros: introduce add_service() macro 2017-01-26 04:43:16 +00:00
hostapd.te Split general policy into public and private components. 2016-10-06 13:09:06 -07:00
hwservicemanager.te hwbinder_use: allow for hwservicemanager callbacks. 2016-12-15 14:17:27 -08:00
idmap.te remove more domain_deprecated 2016-12-09 19:57:43 -08:00
incident.te Add incident command and incidentd daemon se policy. 2017-02-07 15:52:07 -08:00
incidentd.te Add incident command and incidentd daemon se policy. 2017-02-07 15:52:07 -08:00
init.te tracefs: avoid overly generic regexes 2017-02-12 08:40:32 -08:00
inputflinger.te te_macros: introduce add_service() macro 2017-01-26 04:43:16 +00:00
install_recovery.te install_recovery.te: remove domain_deprecated 2017-01-09 16:47:36 +00:00
installd.te Merge ephemeral data and apk files into app 2017-02-06 10:16:50 -08:00
ioctl_defines Split general policy into public and private components. 2016-10-06 13:09:06 -07:00
ioctl_macros Add TCSETS to unpriv_tty_ioctls 2016-12-07 15:59:34 -08:00
isolated_app.te Move isolated_app policy to private 2017-01-05 16:06:54 -08:00
kernel.te kernel.te: tighten entrypoint / execute_no_trans neverallow 2016-10-30 18:46:44 -07:00
keystore.te Remove logspam 2017-02-10 12:06:38 -08:00
lmkd.te more ephemeral_app cleanup 2017-01-20 14:35:17 +00:00
logd.te logd: add getEventTag command and service 2017-01-31 15:50:42 +00:00
logpersist.te logpersist: do not permit dynamic transition to domain 2016-12-29 09:29:36 -08:00
mdnsd.te Move mdnsd policy to private 2017-02-06 15:02:32 -08:00
mediacodec.te Sepolicy for OMX hal. 2017-02-11 00:12:00 -08:00
mediadrmserver.te Fix selinux denial for binderized drm hal 2017-02-08 20:48:18 +00:00
mediaextractor.te te_macros: introduce add_service() macro 2017-01-26 04:43:16 +00:00
mediametrics.te te_macros: introduce add_service() macro 2017-01-26 04:43:16 +00:00
mediaserver.te Sepolicy for OMX hal. 2017-02-11 00:12:00 -08:00
mtp.te Split general policy into public and private components. 2016-10-06 13:09:06 -07:00
net.te Move netdomain policy to private 2017-02-06 15:02:00 -08:00
netd.te te_macros: introduce add_service() macro 2017-01-26 04:43:16 +00:00
neverallow_macros Split general policy into public and private components. 2016-10-06 13:09:06 -07:00
nfc.te te_macros: introduce add_service() macro 2017-01-26 04:43:16 +00:00
otapreopt_chroot.te Split general policy into public and private components. 2016-10-06 13:09:06 -07:00
otapreopt_slot.te Split general policy into public and private components. 2016-10-06 13:09:06 -07:00
performanced.te Add policies for new services. 2017-02-09 15:15:11 -08:00
perfprofd.te Fix build. 2016-12-06 16:49:25 -08:00
platform_app.te Move platform_app policy to private 2017-01-09 14:52:59 -08:00
postinstall.te Split general policy into public and private components. 2016-10-06 13:09:06 -07:00
postinstall_dexopt.te Split general policy into public and private components. 2016-10-06 13:09:06 -07:00
ppp.te domain_deprecated.te: remove /proc/net access 2016-11-30 15:23:26 -08:00
preopt2cachename.te Split general policy into public and private components. 2016-10-06 13:09:06 -07:00
priv_app.te Move priv_app policy to private 2017-01-05 15:44:32 -08:00
profman.te Remove SElinux audit to libart_file 2017-01-31 23:43:14 +00:00
property.te Move net.dns* to it's own label. 2017-02-09 16:14:05 -08:00
racoon.te racoon: Add SIOCSIFNETMASK 2017-01-24 17:12:58 -08:00
radio.te te_macros: introduce add_service() macro 2017-01-26 04:43:16 +00:00
recovery.te Remove SElinux audit to libart_file 2017-01-31 23:43:14 +00:00
recovery_persist.te sepolicy: add version_policy tool and version non-platform policy. 2016-12-06 08:56:02 -08:00
recovery_refresh.te sepolicy: add version_policy tool and version non-platform policy. 2016-12-06 08:56:02 -08:00
rild.te Grant rild and gatekeeperd access to hwservicemanager 2017-01-20 13:01:47 -08:00
roles sepolicy: add version_policy tool and version non-platform policy. 2016-12-06 08:56:02 -08:00
runas.te Split general policy into public and private components. 2016-10-06 13:09:06 -07:00
sdcardd.te Remove logspam 2017-02-10 12:06:38 -08:00
sensord.te Add policies for new services. 2017-02-09 15:15:11 -08:00
service.te Add policies for new services. 2017-02-09 15:15:11 -08:00
servicemanager.te Remove domain_deprecated from some domains. 2016-11-25 17:37:30 -08:00
sgdisk.te remove more domain_deprecated 2016-12-09 19:57:43 -08:00
shared_relro.te Restore app_domain macro and move to private use. 2016-12-08 14:42:43 -08:00
shell.te shell.te: hwbinder for lshal 2017-02-13 15:42:42 -08:00
slideshow.te Split general policy into public and private components. 2016-10-06 13:09:06 -07:00
su.te Introduce crash_dump debugging helper. 2017-01-18 15:03:24 -08:00
surfaceflinger.te Move surfaceflinger policy to private 2017-02-07 10:06:12 -08:00
system_app.te Move system_app policy to private 2017-01-05 17:20:28 -08:00
system_server.te Move system_server policy to private 2017-02-07 20:24:05 +00:00
te_macros Use _client and _server for Audio HAL policy 2017-02-15 13:32:14 -08:00
tee.te Split general policy into public and private components. 2016-10-06 13:09:06 -07:00
tombstoned.te tombstoned: temporarily allow write to anr_data_file. 2017-01-23 12:54:03 -08:00
toolbox.te Split general policy into public and private components. 2016-10-06 13:09:06 -07:00
tzdatacheck.te remove more domain_deprecated 2016-12-09 19:57:43 -08:00
ueventd.te Removing init and ueventd access to generic char files 2017-02-01 21:35:08 +00:00
uncrypt.te Split general policy into public and private components. 2016-10-06 13:09:06 -07:00
untrusted_app.te Move untrusted_app policy to private 2017-01-05 14:39:52 -08:00
untrusted_app_25.te untrusted_app: policy versioning based on targetSdkVersion 2017-02-14 13:30:12 -08:00
update_engine.te te_macros: introduce add_service() macro 2017-01-26 04:43:16 +00:00
update_engine_common.te Remove logspam 2017-02-10 12:06:38 -08:00
update_verifier.te Allow update_verifier to read dm blocks 2017-02-03 21:00:30 +00:00
vdc.te remove more domain_deprecated 2016-12-09 19:57:43 -08:00
virtual_touchpad.te Add policies for new services. 2017-02-09 15:15:11 -08:00
vold.te Remove logspam 2017-02-10 12:06:38 -08:00
watchdogd.te Split general policy into public and private components. 2016-10-06 13:09:06 -07:00
webview_zygote.te Move webview_zygote policy to private 2017-01-27 17:01:43 +00:00
wificond.te te_macros: introduce add_service() macro 2017-01-26 04:43:16 +00:00
wpa.te hal_wifi: Allow system_server to access wifi HIDL services 2016-12-12 10:40:14 -08:00
zygote.te Move zygote policy to private 2017-01-26 13:31:16 -08:00