55e5c9b513
public/property split is landed to selectively export public types to
vendors. So rules happening within system should be in private. This
introduces private/property.te and moves all allow and neverallow rules
from any coredomains to system defiend properties.
Bug: 150331497
Test: system/sepolicy/tools/build_policies.sh
Change-Id: I0d929024ae9f4ae3830d4bf3d59e999febb22cbe
Merged-In: I0d929024ae9f4ae3830d4bf3d59e999febb22cbe
(cherry picked from commit 42c7d8966c)
27 lines
1.6 KiB
Text
27 lines
1.6 KiB
Text
typeattribute flags_health_check coredomain;
|
|
|
|
init_daemon_domain(flags_health_check)
|
|
|
|
set_prop(flags_health_check, device_config_boot_count_prop)
|
|
set_prop(flags_health_check, device_config_reset_performed_prop)
|
|
set_prop(flags_health_check, device_config_runtime_native_boot_prop)
|
|
set_prop(flags_health_check, device_config_runtime_native_prop)
|
|
set_prop(flags_health_check, device_config_input_native_boot_prop)
|
|
set_prop(flags_health_check, device_config_netd_native_prop)
|
|
set_prop(flags_health_check, device_config_activity_manager_native_boot_prop)
|
|
set_prop(flags_health_check, device_config_media_native_prop)
|
|
set_prop(flags_health_check, device_config_storage_native_boot_prop)
|
|
set_prop(flags_health_check, device_config_sys_traced_prop)
|
|
set_prop(flags_health_check, device_config_window_manager_native_boot_prop)
|
|
set_prop(flags_health_check, device_config_configuration_prop)
|
|
|
|
# system property device_config_boot_count_prop is used for deciding when to perform server
|
|
# configurable flags related disaster recovery. Mistakenly set up by unrelated components can, at a
|
|
# wrong timing, trigger server configurable flag related disaster recovery, which will override
|
|
# server configured values of all flags with default values.
|
|
neverallow { domain -init -flags_health_check } device_config_boot_count_prop:property_service set;
|
|
|
|
# system property device_config_reset_performed_prop is used for indicating whether server
|
|
# configurable flags have been reset during booting. Mistakenly modified by unrelated components can
|
|
# cause bad server configurable flags synced back to device.
|
|
neverallow { domain -init -flags_health_check } device_config_reset_performed_prop:property_service set;
|