02df74af6d
The process has the exclusive access to /dev/hw_random. It instead opens
provides a socket (/dev/prng_seeder/socket) which any process can
connect to to get random numbers.
This CL is basically a Microdroid version of aosp/2215051
Bug: 247781653
Test: same as aosp/I0a7e339115a2cf6b819730dcf5f8b189a339c57d
* Verify prng_seeder daemon is running and has the
correct label (via ps -Z)
* Verify prng_seeder socket present and has correct
label (via ls -Z)
* Verify no SELinux denials
* strace a libcrypto process and verify it reads seeding
data from prng_seeder (e.g. strace bssl rand -hex 1024)
* strace seeder daemon to observe incoming connections
(e.g. strace -f -p `pgrep prng_seeder`)
Change-Id: I3483132ead0f5d101b5b3365f78cc36d89528f0e
29 lines
1.2 KiB
Text
29 lines
1.2 KiB
Text
allow fs_type self:filesystem associate;
|
|
allow cgroup tmpfs:filesystem associate;
|
|
allow cgroup_v2 tmpfs:filesystem associate;
|
|
allow cgroup_rc_file tmpfs:filesystem associate;
|
|
allow debugfs_type { debugfs debugfs_tracing debugfs_tracing_debug }:filesystem associate;
|
|
allow dev_type tmpfs:filesystem associate;
|
|
allow encryptedstore_file encryptedstore_fs:filesystem associate;
|
|
allow extra_apk_file zipfusefs:filesystem associate;
|
|
allow file_type labeledfs:filesystem associate;
|
|
allow file_type tmpfs:filesystem associate;
|
|
allow file_type rootfs:filesystem associate;
|
|
allow proc_net proc:filesystem associate;
|
|
allow sysfs_type sysfs:filesystem associate;
|
|
allow system_data_file tmpfs:filesystem associate;
|
|
|
|
type authfs_fuse, fs_type, contextmount_type;
|
|
|
|
# /dev/selinux/test - used to verify that apex sepolicy is loaded and
|
|
# property labeled.
|
|
type sepolicy_test_file, file_type;
|
|
|
|
# /system/bin/mke2fs - used to format encryptedstore block device
|
|
type e2fs_exec, system_file_type, exec_type, file_type;
|
|
|
|
type encryptedstore_file, file_type;
|
|
type encryptedstore_fs, fs_type, contextmount_type;
|
|
|
|
# Filesystem entry for for PRNG seeder socket.
|
|
type prng_seeder_socket, file_type, coredomain_socket;
|