common/perfd.te


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53

type perfd, domain, mlstrustedsubject;
type perfd_exec, exec_type, file_type;

init_daemon_domain(perfd)

allow perfd self:capability { net_admin chown dac_override fsetid kill };
allow perfd {
    sysfs_devices_system_cpu
    sysfs_cpu_online
    proc
    sysfs
}:file rw_file_perms;

allow perfd self:{ netlink_kobject_uevent_socket socket} create_socket_perms;

# mpctl socket
allow perfd mpctl_socket:dir rw_dir_perms;
allow perfd mpctl_socket:sock_file create_file_perms;
allow perfd mpctl_socket:sock_file rw_file_perms;

# default_values file
allow perfd mpctl_data_file:dir rw_dir_perms;
allow perfd mpctl_data_file:file create_file_perms;

# Allow poll of system_server status
r_dir_file(perfd, system_server)

# Allow perfd to check for existence of other processes
allow perfd domain:process signull;

# Allow access to thermal sysfs entry
r_dir_file(perfd, sysfs_thermal)
allow perfd sysfs_thermal:file write;

# IRQbalancer access
unix_socket_connect(perfd, msm_irqbalance, msm_irqbalanced);

# Thermal lib access
unix_socket_connect(perfd, thermal, thermal-engine);

# Access device nodes inside /dev/cpuctl
allow perfd cpuctl_device:chr_file rw_file_perms;

# Allow perfd to send signull
allow perfd {
    system_server
    system_app
    wfdservice
    mediaserver
    thermal-engine
    surfaceflinger
    appdomain
}:process signull;