Fix SE policy violation of Wi-Fi vendor AIDL service
Wi-Fi vendor AIDL service uses NDK to register itself to service
manager. AServiceManager_registerLazyService registers an
IClientCallback to service manager. The callback is invoked when there
is a transition between having >= 1 clients and having 0 clients (or
vice versa). Please check IClientCallback.aidl. As a result servicemanager may
make binder call to Wi-Fi vendor AIDL service. Since this is not allowed
per current SE policies, "avc denied" occurred:
servicemanager: type=1400 audit(0.0:248): avc: denied { call } for scontext=u:r:servicemanager:s0 tcontext=u:r:hal_wifi_default:s0 tclass=binder permissive=0
We add SE policy for hal_wifi_default to allow binder call like this.
Bug: 270511173
Test: manually build and test, check logs for avc denied
Change-Id: Ia6fcf5fc1cafff0381fc9857805bdc61cc838c1e
diff --git a/public/hal_wifi.te b/public/hal_wifi.te
index e4f1d21..a0826bb 100644
--- a/public/hal_wifi.te
+++ b/public/hal_wifi.te
@@ -5,7 +5,7 @@
hal_attribute_hwservice(hal_wifi, hal_wifi_hwservice)
hal_attribute_service(hal_wifi, hal_wifi_service)
-binder_call(hal_wifi_server, servicemanager)
+binder_use(hal_wifi_server)
r_dir_file(hal_wifi, proc_net_type)
r_dir_file(hal_wifi, sysfs_type)