SELinux policies for PDX services
Specify per-service rules for PDX transport. Now being able to
grant permissions to individual services provided by processes,
not all services of a process.
Also tighter control over which permissions are required for
client and server for individual components of IPC (endpoints,
channels, etc).
Bug: 37646189
Change-Id: I78eb8ae8b6e08105666445a66bfcbd2f1d69d0ea
diff --git a/public/sensord.te b/public/sensord.te
index 3211f81..c9749cb 100644
--- a/public/sensord.te
+++ b/public/sensord.te
@@ -5,9 +5,10 @@
hal_client_domain(sensord, hal_graphics_allocator)
allow sensord hal_graphics_allocator:fd use;
-pdx_server(sensord)
-use_pdx(sensord, bufferhubd)
-use_pdx(sensord, performanced)
+pdx_server(sensord, sensors_client)
+pdx_server(sensord, pose_client)
+pdx_client(sensord, bufferhub_client)
+pdx_client(sensord, performance_client)
# Access /dev/ion
allow sensord ion_device:chr_file r_file_perms;