dd958e5a21
Allow SurfaceFlinger to call into IAllocator, and allow everyone to access
IAllocator's fd.
Specifically,
hwbinder_use(...) for
avc: denied { call } for scontext=u:r:hal_graphics_allocator:s0 tcontext=u:r:hwservicemanager:s0 tclass=binder permissive=1
avc: denied { transfer } for scontext=u:r:hal_graphics_allocator:s0 tcontext=u:r:hwservicemanager:s0 tclass=binder permissive=1
allow ... ion_device:chr_file r_file_perms for
avc: denied { read } for name="ion" dev="tmpfs" ino=15014 scontext=u:r:hal_graphics_allocator:s0 tcontext=u:object_r:ion_device:s0 tclass=chr_file permissive=1
avc: denied { open } for path="/dev/ion" dev="tmpfs" ino=15014 scontext=u:r:hal_graphics_allocator:s0 tcontext=u:object_r:ion_device:s0 tclass=chr_file permissive=1
avc: denied { ioctl } for path="/dev/ion" dev="tmpfs" ino=15014 ioctlcmd=4900 scontext=u:r:hal_graphics_allocator:s0 tcontext=u:object_r:ion_device:s0 tclass=chr_file permissive=1
allow ... gpu_device:chr_file rw_file_perms; for
avc: denied { read write } for name="kgsl-3d0" dev="tmpfs" ino=14956 scontext=u:r:hal_graphics_allocator:s0 tcontext=u:object_r:gpu_device:s0 tclass=chr_file permissive=1
avc: denied { open } for path="/dev/kgsl-3d0" dev="tmpfs" ino=14956 scontext=u:r:hal_graphics_allocator:s0 tcontext=u:object_r:gpu_device:s0 tclass=chr_file permissive=1
avc: denied { ioctl } for path="/dev/kgsl-3d0" dev="tmpfs" ino=14956 ioctlcmd=940 scontext=u:r:hal_graphics_allocator:s0 tcontext=u:object_r:gpu_device:s0 tclass=chr_file permissive=1
binder_call(surfaceflinger, ...) for
avc: denied { call } for scontext=u:r:surfaceflinger:s0 tcontext=u:r:hal_graphics_allocator:s0 tclass=binder permissive=1
allow ... ...:fd use for
avc: denied { use } for path="anon_inode:dmabuf" dev="anon_inodefs" ino=12794 scontext=u:r:surfaceflinger:s0 tcontext=u:r:hal_graphics_allocator:s0 tclass=fd permissive=1
Bug: 32021161
Test: make bootimage
Change-Id: Ie7700142313407ac438c43dd1a85544dc4c67f13
32 lines
929 B
Text
32 lines
929 B
Text
# bootanimation oneshot service
|
|
type bootanim, domain;
|
|
type bootanim_exec, exec_type, file_type;
|
|
|
|
binder_use(bootanim)
|
|
binder_call(bootanim, surfaceflinger)
|
|
binder_call(bootanim, audioserver)
|
|
|
|
allow bootanim gpu_device:chr_file rw_file_perms;
|
|
|
|
# /oem access
|
|
allow bootanim oemfs:dir search;
|
|
allow bootanim oemfs:file r_file_perms;
|
|
|
|
allow bootanim audio_device:dir r_dir_perms;
|
|
allow bootanim audio_device:chr_file rw_file_perms;
|
|
|
|
allow bootanim audioserver_service:service_manager find;
|
|
allow bootanim surfaceflinger_service:service_manager find;
|
|
|
|
# Allow access to ion memory allocation device
|
|
allow bootanim ion_device:chr_file rw_file_perms;
|
|
allow bootanim hal_graphics_allocator:fd use;
|
|
|
|
# Read access to pseudo filesystems.
|
|
r_dir_file(bootanim, proc)
|
|
allow bootanim proc_meminfo:file r_file_perms;
|
|
r_dir_file(bootanim, sysfs)
|
|
r_dir_file(bootanim, cgroup)
|
|
|
|
# System file accesses.
|
|
allow bootanim system_file:dir r_dir_perms;
|