4a478c47f4
Vendor and system components are only allowed to share files by
passing open FDs over HIDL. Ban all directory access and all file
accesses other than what can be applied to an open file:
stat/read/write/append.
This commit marks core data types as core_data_file_type and bans
access to non-core domains with an exemption for apps. A temporary
exemption is also granted to domains that currently rely on
access with TODOs and bug number for each exemption.
Bug: 34980020
Test: Build and boot Marlin. Make phone call, watch youtube video.
No new denials observed.
Change-Id: I320dd30f9f0a5bf2f9bb218776b4bccdb529b197
9 lines
389 B
Text
9 lines
389 B
Text
type hal_fingerprint_default, domain;
|
|
hal_server_domain(hal_fingerprint_default, hal_fingerprint)
|
|
|
|
type hal_fingerprint_default_exec, exec_type, file_type;
|
|
init_daemon_domain(hal_fingerprint_default)
|
|
|
|
# TODO (b/36644492) move hal_fingerprint's data file to
|
|
# /data/vendor/. Remove coredata_in_vendor_violators attribute.
|
|
typeattribute hal_fingerprint_default coredata_in_vendor_violators;
|