te_macros: introduce add_service() macro
Introduce the add_service() macro which wraps up add/find
permissions for the source domain with a neverallow preventing
others from adding it. Only a particular domain should
add a particular service.
Use the add_service() macro to automatically add a neverallow
that prevents other domains from adding the service.
mediadrmserver was adding services labeled mediaserver_service.
Drop the add permission as it should just need the find
permission.
Additionally, the macro adds the { add find } permission which
causes some existing neverallow's to assert. Adjust those
neverallow's so "self" can always find.
Test: compile and run on hikey and emulator. No new denials were
found, and all services, where applicable, seem to be running OK.
Change-Id: Ibbd2a5304edd5f8b877bc86852b0694732be993c
Signed-off-by: William Roberts <william.c.roberts@intel.com>
diff --git a/private/storaged.te b/private/storaged.te
index c6276a3..1d87251 100644
--- a/private/storaged.te
+++ b/private/storaged.te
@@ -24,7 +24,7 @@
')
# Binder permissions
-allow storaged storaged_service:service_manager add;
+add_service(storaged, storaged_service)
binder_use(storaged)
binder_call(storaged, system_server)