Expand access to gatekeeperd.
This enables access to gatekeeperd for anybody who invokes Android
framework APIs. This is necessary because the AndroidKeyStore
abstraction offered by the framework API occasionally communicates
with gatekeeperd from the calling process.
(cherry picked from commit effcac7d7eddded5fa31d294dfe3fd1757de51c7)
Bug: 20526234
Change-Id: I450242cd085259b3f82f36f359ee65ff27bebd13
diff --git a/gatekeeperd.te b/gatekeeperd.te
index 39d9d21..4d62ce4 100644
--- a/gatekeeperd.te
+++ b/gatekeeperd.te
@@ -3,6 +3,7 @@
# gatekeeperd
init_daemon_domain(gatekeeperd)
+binder_service(gatekeeperd)
binder_use(gatekeeperd)
allow gatekeeperd tee_device:chr_file rw_file_perms;
diff --git a/service.te b/service.te
index da01071..3dfa296 100644
--- a/service.te
+++ b/service.te
@@ -1,10 +1,10 @@
type bluetooth_service, service_manager_type;
type default_android_service, service_manager_type;
type drmserver_service, service_manager_type;
+type gatekeeper_service, app_api_service, service_manager_type;
type healthd_service, service_manager_type;
type inputflinger_service, service_manager_type;
type keystore_service, service_manager_type;
-type gatekeeper_service, service_manager_type;
type mediaserver_service, service_manager_type;
type nfc_service, service_manager_type;
type radio_service, service_manager_type;
diff --git a/untrusted_app.te b/untrusted_app.te
index 1b7aaee..5ad8c79 100644
--- a/untrusted_app.te
+++ b/untrusted_app.te
@@ -93,10 +93,6 @@
allow untrusted_app { apk_tmp_file apk_private_tmp_file }:dir r_dir_perms;
allow untrusted_app { apk_tmp_file apk_private_tmp_file }:file r_file_perms;
-# Apps using KeyStore API will request the SID from GateKeeper
-allow untrusted_app gatekeeper_service:service_manager find;
-binder_call(untrusted_app, gatekeeperd)
-
###
### neverallow rules
###