Add sepolicy for the Thread Network property
This CL adds sepolicy for the system property
threadnetwork.country_code. This system property
is set by init and be read by the ThreadNetworkService.
Bug: b/309357909
Test: Configure the system property in ini.product.rc and
check the configured country code via the command
`dumpsys thread_network`.
Change-Id: I6f067ced24842755f2c5519169ba9a94df17829f
diff --git a/private/compat/34.0/34.0.ignore.cil b/private/compat/34.0/34.0.ignore.cil
index 583b249..1d953eb 100644
--- a/private/compat/34.0/34.0.ignore.cil
+++ b/private/compat/34.0/34.0.ignore.cil
@@ -35,4 +35,5 @@
drm_forcel3_prop
proc_percpu_pagelist_high_fraction
vendor_microdroid_file
+ threadnetwork_config_prop
))
diff --git a/private/property_contexts b/private/property_contexts
index 8860024..9031b28 100644
--- a/private/property_contexts
+++ b/private/property_contexts
@@ -1624,3 +1624,5 @@
# Properties for app archiving
pm.archiving.enabled u:object_r:pm_archiving_enabled_prop:s0 exact bool
+# Properties for ThreadNetworkService
+threadnetwork.country_code u:object_r:threadnetwork_config_prop:s0 exact string
diff --git a/private/system_server.te b/private/system_server.te
index decabe1..6ba7d4a 100644
--- a/private/system_server.te
+++ b/private/system_server.te
@@ -1565,3 +1565,14 @@
# Allow GameManagerService to read and write persist.graphics.game_default_frame_rate.enabled
set_prop(system_server, game_manager_config_prop)
+# ThreadNetworkService reads Thread Network properties
+get_prop(system_server, threadnetwork_config_prop)
+
+# Do not allow any domain other than init and system server to set the property
+neverallow {
+ domain
+ -init
+ -vendor_init
+ -dumpstate
+ -system_server
+} threadnetwork_config_prop:file no_rw_file_perms;
diff --git a/public/property.te b/public/property.te
index b072b5b..c513434 100644
--- a/public/property.te
+++ b/public/property.te
@@ -181,6 +181,7 @@
system_vendor_config_prop(suspend_prop)
system_vendor_config_prop(systemsound_config_prop)
system_vendor_config_prop(telephony_config_prop)
+system_vendor_config_prop(threadnetwork_config_prop)
system_vendor_config_prop(tombstone_config_prop)
system_vendor_config_prop(usb_config_prop)
system_vendor_config_prop(userspace_reboot_config_prop)