platform_system_sepolicy/public/lmkd.te
dcashman cc39f63773 Split general policy into public and private components.
Divide policy into public and private components.  This is the first
step in splitting the policy creation for platform and non-platform
policies.  The policy in the public directory will be exported for use
in non-platform policy creation.  Backwards compatibility with it will
be achieved by converting the exported policy into attribute-based
policy when included as part of the non-platform policy and a mapping
file will be maintained to be included with the platform policy that
maps exported attributes of previous versions to the current platform
version.

Eventually we would like to create a clear interface between the
platform and non-platform device components so that the exported policy,
and the need for attributes is minimal.  For now, almost all types and
avrules are left in public.

Test: Tested by building policy and running on device.

Change-Id: Idef796c9ec169259787c3f9d8f423edf4ce27f8c
2016-10-06 13:09:06 -07:00

40 lines
1.1 KiB
Text

# lmkd low memory killer daemon
type lmkd, domain, domain_deprecated, mlstrustedsubject;
type lmkd_exec, exec_type, file_type;
allow lmkd self:capability { dac_override sys_resource kill };
# lmkd locks itself in memory, to prevent it from being
# swapped out and unable to kill other memory hogs.
# system/core commit b28ff9131363f7b4a698990da5748b2a88c3ed35
# b/16236289
allow lmkd self:capability ipc_lock;
## Open and write to /proc/PID/oom_score_adj
## TODO: maybe scope this down?
r_dir_file(lmkd, appdomain)
allow lmkd appdomain:file write;
r_dir_file(lmkd, autoplay_app)
allow lmkd autoplay_app:file write;
r_dir_file(lmkd, system_server)
allow lmkd system_server:file write;
## Writes to /sys/module/lowmemorykiller/parameters/minfree
r_dir_file(lmkd, sysfs_type)
allow lmkd sysfs_lowmemorykiller:file w_file_perms;
# Send kill signals
allow lmkd appdomain:process sigkill;
# Clean up old cgroups
allow lmkd cgroup:dir { remove_name rmdir };
# Set self to SCHED_FIFO
allow lmkd self:capability sys_nice;
allow lmkd proc_zoneinfo:file r_file_perms;
### neverallow rules
# never honor LD_PRELOAD
neverallow * lmkd:process noatsecure;