diff options
| author | Riley Spahn <rileyspahn@google.com> | 2014-06-05 15:52:02 -0700 |
|---|---|---|
| committer | Riley Spahn <rileyspahn@google.com> | 2014-06-12 20:46:07 +0000 |
| commit | f90c41f6e8d5c1266e154f46586a2ceb260f1be6 (patch) | |
| tree | 738e3eb5edacaa0edeb7afbd74cf66cc2b043e87 /servicemanager.te | |
| parent | 62af83810baa7a6c07a8673136c1cdf5a6763b48 (diff) | |
| download | android_external_sepolicy-f90c41f6e8d5c1266e154f46586a2ceb260f1be6.tar.gz android_external_sepolicy-f90c41f6e8d5c1266e154f46586a2ceb260f1be6.tar.bz2 android_external_sepolicy-f90c41f6e8d5c1266e154f46586a2ceb260f1be6.zip | |
Add SELinux rules for service_manager.
Add a service_mananger class with the verb add.
Add a type that groups the services for each of the
processes that is allowed to start services in service.te
and an attribute for all services controlled by the service
manager. Add the service_contexts file which maps service
name to target label.
Bug: 12909011
Change-Id: I017032a50bc90c57b536e80b972118016d340c7d
Diffstat (limited to 'servicemanager.te')
| -rw-r--r-- | servicemanager.te | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/servicemanager.te b/servicemanager.te index a78a485..f3dbca8 100644 --- a/servicemanager.te +++ b/servicemanager.te @@ -12,3 +12,10 @@ init_daemon_domain(servicemanager) # or initiates a Binder IPC. allow servicemanager self:binder set_context_mgr; allow servicemanager domain:binder transfer; + +# Get contexts of binder services that call servicemanager. +allow servicemanager binderservicedomain:dir search; +allow servicemanager binderservicedomain:file { read open }; +allow servicemanager binderservicedomain:process getattr; +# Check SELinux permissions. +selinux_check_access(servicemanager) |