diff options
author | Siddharth Ray <siddharthr@google.com> | 2017-06-26 11:09:16 -0700 |
---|---|---|
committer | Jibu Joseph <jibu@google.com> | 2017-06-29 01:58:58 +0000 |
commit | eb6f000bffa01aa340f2821c27563d4a02f98188 (patch) | |
tree | 294a9ef2d4e934a67d21fa1abe217c517170b562 /sepolicy/vendor/hal_gnss_qti.te | |
parent | 12fddd67f7e46252b5ee11df572526d73920150d (diff) | |
download | wahoo-eb6f000bffa01aa340f2821c27563d4a02f98188.tar.gz |
Wahoo sepolicy changes
Wahoo's sepolicy is changed to mirror Marlin's. Marlin's sepolicy can be
found at device/google/marlin/sepolicy/hal_gnss_default.te
BUG: 37409476
Change-Id: Id6f49defd70923c56da2dfd68f55cf3dfc2e62fc
Diffstat (limited to 'sepolicy/vendor/hal_gnss_qti.te')
-rw-r--r-- | sepolicy/vendor/hal_gnss_qti.te | 32 |
1 files changed, 18 insertions, 14 deletions
diff --git a/sepolicy/vendor/hal_gnss_qti.te b/sepolicy/vendor/hal_gnss_qti.te index 8f0acc84..7b519591 100644 --- a/sepolicy/vendor/hal_gnss_qti.te +++ b/sepolicy/vendor/hal_gnss_qti.te @@ -7,23 +7,27 @@ init_daemon_domain(hal_gnss_qti) r_dir_file(hal_gnss_qti, sysfs_msm_subsys) vndbinder_use(hal_gnss_qti) +binder_call(hal_gnss_qti, per_mgr) +allow hal_gnss_qti per_mgr_service:service_manager find; -allow hal_gnss_qti sysfs_soc:dir r_dir_perms; -allow hal_gnss_qti sysfs_soc:file r_file_perms; - +allow hal_gnss_qti location_data_file:fifo_file { open read setattr write }; +allow hal_gnss_qti location:unix_stream_socket connectto; allow hal_gnss_qti location_data_file:dir create_dir_perms; -allow hal_gnss_qti location_data_file:file create_file_perms; allow hal_gnss_qti location_data_file:sock_file write; -allow hal_gnss_qti location:unix_stream_socket connectto; unix_socket_connect(hal_gnss_qti, netmgrd, netmgrd) allow hal_gnss_qti netmgrd_socket:dir search; - -allow hal_gnss_qti self:socket create_socket_perms; -allowxperm hal_gnss_qti self:socket ioctl msm_sock_ipc_ioctls; -allow hal_gnss_qti self:netlink_generic_socket { bind create read }; - -vndbinder_use(hal_gnss_qti) -binder_call(hal_gnss_qti, per_mgr) - -allow hal_gnss_qti per_mgr_service:service_manager find; +allow hal_gnss_qti self:netlink_route_socket { bind create nlmsg_read read write }; + +# Most HALs are not allowed to use network sockets. Qcom library +# libqdi is used across multiple processes which are clients of +# netmgrd including the GNSS HAL. libqdi first attempts to get the network +# interface using an IOCTL on a UDP INET socket, which isn't allowed here. +# If that fails, it falls back to using libc's if_nameindex() which requires +# a netlink route socket, which HALs may use. Due to the initial +# attempt to use a UDP socket, we still see a selinux denial, +# but it is safe to ignore. +# TODO (b/37730994) Remove udp_socket requirement from +# libqdi and have all its clients use netlink route +# sockets. +dontaudit hal_gnss_qti self:udp_socket create; |