diff options
author | Stephen Smalley <sds@tycho.nsa.gov> | 2013-10-29 14:42:39 -0400 |
---|---|---|
committer | Stephen Smalley <sds@tycho.nsa.gov> | 2013-11-13 16:32:22 -0500 |
commit | dcbab907eaf373c0633e15ece0c391d2dc0b55cf (patch) | |
tree | c7533a81eead1b66f6e7d38f2d128c368718a3de /rild.te | |
parent | 91ebcf33326418ed9603e618ad193550646c3b04 (diff) | |
download | android_external_sepolicy-dcbab907eaf373c0633e15ece0c391d2dc0b55cf.tar.gz android_external_sepolicy-dcbab907eaf373c0633e15ece0c391d2dc0b55cf.tar.bz2 android_external_sepolicy-dcbab907eaf373c0633e15ece0c391d2dc0b55cf.zip |
Confine rild, but leave it permissive for now.
Change-Id: I6df9981b2af0150c6379a0ebdbe0a8597c994f4a
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Diffstat (limited to 'rild.te')
-rw-r--r-- | rild.te | 39 |
1 files changed, 38 insertions, 1 deletions
@@ -1,10 +1,47 @@ # rild - radio interface layer daemon type rild, domain; +permissive rild; type rild_exec, exec_type, file_type; init_daemon_domain(rild) net_domain(rild) -unconfined_domain(rild) +allow rild self:netlink_route_socket { setopt write }; +allow rild kernel:system module_request; +unix_socket_connect(rild, property, init) +unix_socket_connect(rild, qemud, qemud) +allow rild self:capability { setuid net_admin net_raw }; +allow rild alarm_device:chr_file rw_file_perms; +allow rild cgroup:dir create_dir_perms; +allow rild radio_device:chr_file rw_file_perms; +allow rild radio_device:blk_file r_file_perms; +allow rild qemu_device:chr_file rw_file_perms; +allow rild mtd_device:dir search; +allow rild efs_file:dir create_dir_perms; +allow rild efs_file:file create_file_perms; +allow rild shell_exec:file rx_file_perms; +allow rild bluetooth_efs_file:file r_file_perms; +allow rild bluetooth_efs_file:dir r_dir_perms; +allow rild radio_data_file:dir rw_dir_perms; +allow rild radio_data_file:file create_file_perms; +allow rild sdcard_type:dir r_dir_perms; +allow rild system_data_file:dir create_dir_perms; +allow rild system_data_file:file create_file_perms; +allow rild system_file:file x_file_perms; +dontaudit rild self:capability sys_admin; + +# property service +allow rild rild_prop:property_service set; +allow rild radio_prop:property_service set; + +# Read/Write to uart driver (for GPS) +allow rild gps_device:chr_file rw_file_perms; + +allow rild tty_device:chr_file rw_file_perms; + +# Allow rild to create, bind, read, write to itself through a netlink socket +allow rild self:netlink_socket { create bind read write }; + +allow rild self:netlink_kobject_uevent_socket { bind create getopt read setopt }; # Access to wake locks allow rild sysfs_wake_lock:file rw_file_perms; |