Annotate most remaining HALs with _client/_server
This switches most remaining HALs to the _client/_server approach.
To unblock efforts blocked on majority of HALs having to use this
model, this change does not remove unnecessary rules from clients of
these HALs. That work will be performed in follow-up commits. This
commit only adds allow rules and thus does not break existing
functionality.
The HALs not yet on the _client/_server model after this commit are:
* Allocator HAL, because it's non-trivial to declare all apps except
isolated apps as clients of this HAL, which they are.
* Boot HAL, because it's still on the non-attributized model and I'm
waiting for update_engine folks to answer a couple of questions
which will let me refactor the policy of this HAL.
Test: mmm system/sepolicy
Test: Device boots, no new denials
Test: Device boots in recovery mode, no new denials
Bug: 34170079
Change-Id: I03e6bcec2fa02f14bdf17d11f7367b62c68a14b9
diff --git a/public/attributes b/public/attributes
index d26f7ee..a0c1f93 100644
--- a/public/attributes
+++ b/public/attributes
@@ -136,7 +136,11 @@
attribute hal_camera_client;
attribute hal_camera_server;
attribute hal_configstore;
+attribute hal_configstore_client;
+attribute hal_configstore_server;
attribute hal_contexthub;
+attribute hal_contexthub_client;
+attribute hal_contexthub_server;
attribute hal_drm;
attribute hal_drm_client;
attribute hal_drm_server;
@@ -147,26 +151,56 @@
attribute hal_fingerprint_client;
attribute hal_fingerprint_server;
attribute hal_gatekeeper;
+attribute hal_gatekeeper_client;
+attribute hal_gatekeeper_server;
attribute hal_gnss;
+attribute hal_gnss_client;
+attribute hal_gnss_server;
attribute hal_graphics_allocator;
+attribute hal_graphics_allocator_client;
+attribute hal_graphics_allocator_server;
attribute hal_graphics_composer;
+attribute hal_graphics_composer_client;
+attribute hal_graphics_composer_server;
attribute hal_health;
+attribute hal_health_client;
+attribute hal_health_server;
attribute hal_ir;
+attribute hal_ir_client;
+attribute hal_ir_server;
attribute hal_keymaster;
attribute hal_keymaster_client;
attribute hal_keymaster_server;
attribute hal_light;
+attribute hal_light_client;
+attribute hal_light_server;
attribute hal_memtrack;
+attribute hal_memtrack_client;
+attribute hal_memtrack_server;
attribute hal_nfc;
+attribute hal_nfc_client;
+attribute hal_nfc_server;
attribute hal_power;
+attribute hal_power_client;
+attribute hal_power_server;
attribute hal_sensors;
attribute hal_sensors_client;
attribute hal_sensors_server;
attribute hal_telephony;
+attribute hal_telephony_client;
+attribute hal_telephony_server;
attribute hal_thermal;
+attribute hal_thermal_client;
+attribute hal_thermal_server;
attribute hal_usb;
+attribute hal_usb_client;
+attribute hal_usb_server;
attribute hal_vibrator;
+attribute hal_vibrator_client;
+attribute hal_vibrator_server;
attribute hal_vr;
+attribute hal_vr_client;
+attribute hal_vr_server;
attribute hal_wifi;
attribute hal_wifi_client;
attribute hal_wifi_server;
diff --git a/public/dumpstate.te b/public/dumpstate.te
index 80161de..8e645b9 100644
--- a/public/dumpstate.te
+++ b/public/dumpstate.te
@@ -91,6 +91,7 @@
# For binderized mode:
hal_client_domain(dumpstate, hal_dumpstate)
binder_call(dumpstate, hal_vibrator)
+hal_client_domain(dumpstate, hal_vibrator)
# For passthrough mode:
allow dumpstate sysfs_vibrator:file { rw_file_perms getattr };
diff --git a/public/gatekeeperd.te b/public/gatekeeperd.te
index 94fb2b9..abecbda 100644
--- a/public/gatekeeperd.te
+++ b/public/gatekeeperd.te
@@ -16,6 +16,7 @@
### Rules needed when Gatekeeper HAL runs outside of gatekeeperd process.
### These rules should eventually be granted only when needed.
hwbinder_use(gatekeeperd)
+hal_client_domain(gatekeeperd, hal_gatekeeper)
###
# need to find KeyStore and add self
diff --git a/public/hal_gatekeeper.te b/public/hal_gatekeeper.te
index a17dbcd..c428eba 100644
--- a/public/hal_gatekeeper.te
+++ b/public/hal_gatekeeper.te
@@ -1,4 +1,6 @@
# call into gatekeeperd process (callbacks)
+# TODO: This rules is unlikely to be needed because Gatekeeper HIDL
+# says there are no callbacks
binder_call(hal_gatekeeper, gatekeeperd)
# TEE access.
diff --git a/public/healthd.te b/public/healthd.te
index 2f26b9e..8737dbe 100644
--- a/public/healthd.te
+++ b/public/healthd.te
@@ -26,6 +26,7 @@
binder_call(healthd, system_server)
binder_call(healthd, hwservicemanager)
binder_call(healthd, hal_health)
+hal_client_domain(healthd, hal_health)
# Write to state file.
# TODO: Split into a separate type?
diff --git a/public/nfc.te b/public/nfc.te
index 866180b..cb6a781 100644
--- a/public/nfc.te
+++ b/public/nfc.te
@@ -38,3 +38,4 @@
# allow NFC process to call into the NFC HAL
binder_call(nfc, hal_nfc)
+hal_client_domain(nfc, hal_nfc)
diff --git a/public/radio.te b/public/radio.te
index 953b59c..a896659 100644
--- a/public/radio.te
+++ b/public/radio.te
@@ -37,4 +37,4 @@
# Perform HwBinder IPC.
hwbinder_use(radio)
binder_call(radio, hal_telephony)
-
+hal_client_domain(radio, hal_telephony)
diff --git a/public/rild.te b/public/rild.te
index fd1ecca..e4b0186 100644
--- a/public/rild.te
+++ b/public/rild.te
@@ -1,6 +1,6 @@
# rild - radio interface layer daemon
type rild, domain, domain_deprecated;
-hal_impl_domain(rild, hal_telephony)
+hal_server_domain(rild, hal_telephony)
net_domain(rild)
allowxperm rild self:udp_socket ioctl priv_sock_ioctls;