Add policy for IKeystoreAuthorization AIDL service.
The interaface now provided by IKeystoreAuthorization AIDL interface was
previously provided by Keystore AIDL interface.
This CL adds policy to allow Keystore2 to register
IKeystoreAuthorization aidl service and to allow service manager to
look up and connect to the service.
Bug: 159475191
Test: Needs to be tested in runtime
Change-Id: I56829a8764e0efe55efdc92b75d7a3d918a20dae
diff --git a/private/compat/30.0/30.0.ignore.cil b/private/compat/30.0/30.0.ignore.cil
index a77ac01..6934b16 100644
--- a/private/compat/30.0/30.0.ignore.cil
+++ b/private/compat/30.0/30.0.ignore.cil
@@ -10,6 +10,7 @@
apc_service
apex_info_file
arm64_memtag_prop
+ authorization_service
cgroup_desc_api_file
cgroup_v2
ctl_snapuserd_prop
diff --git a/private/service_contexts b/private/service_contexts
index dd27bcf..0d6e037 100644
--- a/private/service_contexts
+++ b/private/service_contexts
@@ -25,6 +25,7 @@
android.os.UpdateEngineService u:object_r:update_engine_service:s0
android.os.UpdateEngineStableService u:object_r:update_engine_stable_service:s0
android.security.apc u:object_r:apc_service:s0
+android.security.authorization u:object_r:authorization_service:s0
android.security.compat u:object_r:keystore_compat_hal_service:s0
android.security.identity u:object_r:credstore_service:s0
android.security.keystore u:object_r:keystore_service:s0
diff --git a/private/system_server.te b/private/system_server.te
index 69e04d9..893ea11 100644
--- a/private/system_server.te
+++ b/private/system_server.te
@@ -762,6 +762,7 @@
add_service(system_server, system_server_service);
allow system_server audioserver_service:service_manager find;
+allow system_server authorization_service:service_manager find;
allow system_server batteryproperties_service:service_manager find;
allow system_server cameraserver_service:service_manager find;
allow system_server dataloader_manager_service:service_manager find;
diff --git a/public/gatekeeperd.te b/public/gatekeeperd.te
index 6ab9727..7295c24 100644
--- a/public/gatekeeperd.te
+++ b/public/gatekeeperd.te
@@ -24,6 +24,8 @@
use_keystore(gatekeeperd)
allow gatekeeperd keystore:keystore_key { add_auth };
allow gatekeeperd keystore:keystore2 { add_auth };
+allow gatekeeperd authorization_service:service_manager find;
+
# For permissions checking
allow gatekeeperd system_server:binder call;
diff --git a/public/keystore.te b/public/keystore.te
index 564e9f3..8c64090 100644
--- a/public/keystore.te
+++ b/public/keystore.te
@@ -17,6 +17,7 @@
allow keystore dropbox_service:service_manager find;
add_service(keystore, apc_service)
add_service(keystore, keystore_compat_hal_service)
+add_service(keystore, authorization_service)
# Check SELinux permissions.
selinux_check_access(keystore)
diff --git a/public/service.te b/public/service.te
index 072de79..27e7704 100644
--- a/public/service.te
+++ b/public/service.te
@@ -2,6 +2,7 @@
type apc_service, service_manager_type;
type apex_service, service_manager_type;
type audioserver_service, service_manager_type;
+type authorization_service, service_manager_type;
type batteryproperties_service, app_api_service, ephemeral_app_api_service, service_manager_type;
type bluetooth_service, service_manager_type;
type cameraserver_service, service_manager_type;