Various policy updates.
Assortment of policy changes include:
* Bluetooth domain to talk to init and procfs.
* New device node domains.
* Allow zygote to talk to its executable.
* Update system domain access to new device node domains.
* Create a post-process sepolicy with dontaudits removed.
* Allow rild to use the tty device.
Change-Id: Ibb96b590d0035b8f6d1606cd5e4393c174d10ffb
Signed-off-by: rpcraig <rpcraig@tycho.ncsc.mil>
diff --git a/Android.mk b/Android.mk
index 2a6751e..47b17a9 100644
--- a/Android.mk
+++ b/Android.mk
@@ -77,10 +77,12 @@
$(sepolicy_policy.conf) : $(call build_policy, security_classes initial_sids access_vectors global_macros mls_macros mls policy_capabilities te_macros attributes *.te roles users initial_sid_contexts fs_use genfs_contexts port_contexts)
@mkdir -p $(dir $@)
$(hide) m4 -D mls_num_sens=$(PRIVATE_MLS_SENS) -D mls_num_cats=$(PRIVATE_MLS_CATS) -s $^ > $@
+ $(hide) sed '/dontaudit/d' $@ > $@.dontaudit
$(LOCAL_BUILT_MODULE) : $(sepolicy_policy.conf) $(HOST_OUT_EXECUTABLES)/checkpolicy
@mkdir -p $(dir $@)
$(hide) $(HOST_OUT_EXECUTABLES)/checkpolicy -M -c $(POLICYVERS) -o $@ $<
+ $(hide) $(HOST_OUT_EXECUTABLES)/checkpolicy -M -c $(POLICYVERS) -o $(dir $<)/$(notdir $@).dontaudit $<.dontaudit
built_sepolicy := $(LOCAL_BUILT_MODULE)
sepolicy_policy.conf :=
diff --git a/bluetooth.te b/bluetooth.te
index cd17967..31ea064 100644
--- a/bluetooth.te
+++ b/bluetooth.te
@@ -26,3 +26,9 @@
# tethering
allow bluetooth self:{ tun_socket udp_socket } { ioctl create };
allow bluetooth efs_file:dir search;
+
+# Talk to init over the property socket.
+unix_socket_connect(bluetooth, property, init)
+
+# proc access.
+allow bluetooth proc_bluetooth_writable:file rw_file_perms;
diff --git a/device.te b/device.te
index 628d803..2aeeb16 100644
--- a/device.te
+++ b/device.te
@@ -30,8 +30,10 @@
type kmsg_device, dev_type;
type null_device, dev_type, mlstrustedobject;
type random_device, dev_type;
+type sensors_device, dev_type;
type serial_device, dev_type;
type socket_device, dev_type;
+type timerirq_device, dev_type;
type tty_device, dev_type;
type urandom_device, dev_type;
type video_device, dev_type;
@@ -46,6 +48,7 @@
type uhid_device, dev_type;
type tun_device, dev_type, mlstrustedobject;
type usbaccessory_device, dev_type;
+type usb_device, dev_type;
# All devices have a uart for the hci
# attach service. The uart dev node
@@ -53,6 +56,6 @@
# is used in per device policy
type hci_attach_dev, dev_type;
-# All devices have a rpmsg device for
+# All devices have a rpmsg device for
# achieving remoteproc and rpmsg modules
type rpmsg_device, dev_type;
diff --git a/file.te b/file.te
index cc196a3..a82945a 100644
--- a/file.te
+++ b/file.te
@@ -5,6 +5,7 @@
type rootfs, fs_type;
type proc, fs_type;
type qtaguid_proc, fs_type, mlstrustedobject;
+type proc_bluetooth_writable, fs_type;
type selinuxfs, fs_type;
type cgroup, fs_type, mlstrustedobject;
type sysfs, fs_type, mlstrustedobject;
diff --git a/file_contexts b/file_contexts
index 6501dfd..6e05edb 100644
--- a/file_contexts
+++ b/file_contexts
@@ -41,6 +41,7 @@
/dev/block/loop[0-9]* u:object_r:loop_device:s0
/dev/block/ram[0-9]* u:object_r:ram_device:s0
/dev/block/mtdblock5 u:object_r:radio_device:s0
+/dev/bus/usb(.*)? u:object_r:usb_device:s0
/dev/cam u:object_r:camera_device:s0
/dev/console u:object_r:console_device:s0
/dev/cpuctl(/.*)? u:object_r:cpuctl_device:s0
diff --git a/mediaserver.te b/mediaserver.te
index 0696331..85be2d5 100644
--- a/mediaserver.te
+++ b/mediaserver.te
@@ -49,4 +49,4 @@
allow mediaserver qtaguid_device:chr_file r_file_perms;
# Allow abstract socket connection
-allow mediaserver rild:unix_stream_socket connectto;
+allow mediaserver rild:unix_stream_socket { connectto read write setopt };
diff --git a/rild.te b/rild.te
index c331bb3..e8069bf 100644
--- a/rild.te
+++ b/rild.te
@@ -37,3 +37,5 @@
# Read/Write to uart driver (for GPS)
allow rild gps_device:chr_file rw_file_perms;
+
+allow rild tty_device:chr_file rw_file_perms;
diff --git a/system.te b/system.te
index eacd5fb..cf92bca 100644
--- a/system.te
+++ b/system.te
@@ -221,3 +221,10 @@
allow system cache_backup_file:file { relabelto relabelfrom };
# LocalTransport creates and relabels /cache/backup
allow system cache_backup_file:dir { relabelto relabelfrom create_dir_perms };
+
+# Allow system to talk to usb device
+allow system usb_device:chr_file rw_file_perms;
+allow system usb_device:dir r_dir_perms;
+
+# Allow system to talk to sensors and timer irq
+allow system { sensors_device timerirq_device }:chr_file rw_file_perms;
diff --git a/zygote.te b/zygote.te
index 9707082..33e8fe8 100644
--- a/zygote.te
+++ b/zygote.te
@@ -37,3 +37,6 @@
dontaudit zygote self:capability fsetid;
allow zygote tmpfs:dir { write create add_name setattr mounton search };
allow zygote tmpfs:filesystem mount;
+
+# Handle --invoke-with command when launching Zygote with a wrapper command.
+allow zygote zygote_exec:file { execute_no_trans open };