Add selinux policy for Bluetooth HAL
Bug: 31972505
Test: VTS test passes, Bluetooth starts/stops
Change-Id: Ic068c9fca7c50e63c5b6e3d86a2ee6cc53207e08
diff --git a/public/attributes b/public/attributes
index 9bed18d..6c29042 100644
--- a/public/attributes
+++ b/public/attributes
@@ -116,6 +116,7 @@
# HALs
attribute hal_audio;
+attribute hal_bluetooth;
attribute hal_dumpstate;
attribute hal_gatekeeper;
attribute hal_graphics_allocator;
diff --git a/public/bluetooth.te b/public/bluetooth.te
index 9f21676..209a68b 100644
--- a/public/bluetooth.te
+++ b/public/bluetooth.te
@@ -60,6 +60,7 @@
# Perform HwBinder IPC.
hwbinder_use(bluetooth)
+binder_call(bluetooth, hal_bluetooth)
binder_call(bluetooth, hal_telephony)
###
diff --git a/public/hal_bluetooth.te b/public/hal_bluetooth.te
new file mode 100644
index 0000000..d061471
--- /dev/null
+++ b/public/hal_bluetooth.te
@@ -0,0 +1,25 @@
+# hwbinder access
+hwbinder_use(hal_bluetooth)
+
+r_dir_file(hal_bluetooth, system_file)
+
+# call into the Bluetooth process (callbacks)
+binder_call(hal_bluetooth, bluetooth)
+
+wakelock_use(hal_bluetooth);
+
+# bluetooth factory file accesses.
+r_dir_file(hal_bluetooth, bluetooth_efs_file)
+
+allow hal_bluetooth { uhid_device hci_attach_dev }:chr_file rw_file_perms;
+
+# Access to config files to look for a Bluetooth address
+r_dir_file(hal_bluetooth, bluetooth_data_file)
+
+# sysfs access.
+r_dir_file(hal_bluetooth, sysfs_type)
+allow hal_bluetooth sysfs_bluetooth_writable:file rw_file_perms;
+allow hal_bluetooth self:capability2 wake_alarm;
+
+# Allow write access to bluetooth-specific properties
+set_prop(hal_bluetooth, bluetooth_prop)
diff --git a/public/system_server.te b/public/system_server.te
index b77cf15..aa09679 100644
--- a/public/system_server.te
+++ b/public/system_server.te
@@ -159,6 +159,7 @@
# Perform HwBinder IPC.
hwbinder_use(system_server)
+binder_call(system_server, hal_bluetooth)
binder_call(system_server, hal_boot)
binder_call(system_server, hal_contexthub)
binder_call(system_server, hal_ir)