806c7eb133
Additionally, remove the obsolete permission which allows keystore to register callbacks with statsd. There's no direct communication between keystore and statsd now. Ignore-AOSP-First: Resolving merge conflicts. Bug: 188590587 Test: statsd TestDrive script. Merged-In: I31d202751ba78bb547822020260a7e366cb8826e Change-Id: I31d202751ba78bb547822020260a7e366cb8826e
35 lines
1.1 KiB
Text
35 lines
1.1 KiB
Text
typeattribute keystore coredomain;
|
|
|
|
init_daemon_domain(keystore)
|
|
|
|
# talk to keymaster
|
|
hal_client_domain(keystore, hal_keymaster)
|
|
|
|
# talk to confirmationui
|
|
hal_client_domain(keystore, hal_confirmationui)
|
|
|
|
# talk to keymint
|
|
hal_client_domain(keystore, hal_keymint)
|
|
|
|
# This is used for the ConfirmationUI async callback.
|
|
allow keystore platform_app:binder call;
|
|
|
|
# Allow to check whether security logging is enabled.
|
|
get_prop(keystore, device_logging_prop)
|
|
|
|
# Allow keystore to write to statsd.
|
|
unix_socket_send(keystore, statsdw, statsd)
|
|
|
|
# Keystore need access to the keystore_key context files to load the keystore key backend.
|
|
allow keystore keystore2_key_contexts_file:file r_file_perms;
|
|
|
|
get_prop(keystore, keystore_listen_prop)
|
|
|
|
# Keystore needs to transfer binder references to vold so that it
|
|
# can call keystore methods on those references.
|
|
allow keystore vold:binder transfer;
|
|
|
|
# Only keystore can set keystore.crash_count system property. Since init is allowed to set any
|
|
# system property, an exception is added for init as well.
|
|
set_prop(keystore, keystore_crash_prop)
|
|
neverallow { domain -keystore -init } keystore_crash_prop:property_service set;
|