platform_system_sepolicy/private/ashmemd.te
Tri Vo 73d0a67b06 sepolicy for ashmemd
all_untrusted_apps apart from untrusted_app_{25, 27} and mediaprovider
are now expected to go to ashmemd for /dev/ashmem fds.

Give coredomain access to ashmemd, because ashmemd is the default way
for coredomain to get a /dev/ashmem fd.

Bug: 113362644
Test: device boots, ashmemd running
Test: Chrome app works
Test: "lsof /system/lib64/libashmemd_client.so" shows
libashmemd_client.so being loaded into apps.
Change-Id: I279448c3104c5d08a1fefe31730488924ce1b37a
2019-02-05 21:38:14 +00:00

9 lines
240 B
Text

typeattribute ashmemd coredomain;
type ashmemd_exec, exec_type, file_type, system_file_type;
init_daemon_domain(ashmemd)
binder_use(ashmemd)
add_service(ashmemd, ashmem_device_service)
allow ashmemd ashmem_device:chr_file rw_file_perms;