08d4c8fa6e
This commit adds fake 31.0 prebuilt. The prebuilt is based on AOSP policy, but slightly modified so the set of types and attributes is a subset of real 31.0 prebuilt (sc-dev policy). Steps taken to make the fake prebuilt: 1) build plat_sepolicy.cil both on AOSP and sc-dev, with lunch target aosp_arm64-eng. 2) diff both outputs to find out which types and attributes don't exist. 3) remove all relevant files and statements. As a result, the following types are removed. artd artd_exec artd_service power_stats_service transformer_service virtualizationservice virtualizationservice_data_file virtualizationservice_exec Bug: 189161483 Test: N/A, will do after adding 31.0 mapping files. Change-Id: Ia957fc32b1838dae730d9dd7bd917d684d4a24cf Merged-In: Ia4ea2999f4bc8ae80f13e51d99fba3e98e293447
38 lines
1.4 KiB
Text
38 lines
1.4 KiB
Text
type system_suspend, domain, coredomain, system_suspend_server, system_suspend_internal_server;
|
|
|
|
type system_suspend_exec, system_file_type, exec_type, file_type;
|
|
init_daemon_domain(system_suspend)
|
|
|
|
# To serve ISuspendControlService.
|
|
binder_use(system_suspend)
|
|
add_service(system_suspend, system_suspend_control_service)
|
|
|
|
# Access to /sys/power/{ wakeup_count, state } suspend interface.
|
|
allow system_suspend sysfs_power:file rw_file_perms;
|
|
|
|
# Access to wakeup, suspend stats, and wakeup reasons.
|
|
r_dir_file(system_suspend, sysfs_suspend_stats)
|
|
r_dir_file(system_suspend, sysfs_wakeup)
|
|
r_dir_file(system_suspend, sysfs_wakeup_reasons)
|
|
# To resolve arbitrary sysfs paths from /sys/class/wakeup/* symlinks.
|
|
allow system_suspend sysfs_type:dir search;
|
|
|
|
# Access to suspend_hal system properties
|
|
get_prop(system_suspend, suspend_prop)
|
|
|
|
# To call BTAA registered callbacks
|
|
allow system_suspend bluetooth:binder call;
|
|
|
|
# For adding `dumpsys syspend_control` output to bugreport
|
|
allow system_suspend dumpstate:fd use;
|
|
allow system_suspend dumpstate:fifo_file write;
|
|
|
|
neverallow {
|
|
domain
|
|
-atrace # tracing
|
|
-bluetooth # support Bluetooth activity attribution (BTAA)
|
|
-dumpstate # bug reports
|
|
-system_suspend # implements system_suspend_control_service
|
|
-system_server # configures system_suspend via ISuspendControlService
|
|
-traceur_app # tracing
|
|
} system_suspend_control_service:service_manager find;
|