Gitiles
Code Review Sign In
gerrit.omnirom.org / android_system_sepolicy / e55a74bdffcdbbc8809a27215df9d3fd38965a93 / . / private / bluetooth.te
blob: b96fc58f255888550737e0d5323c1592815915e8 [file] [log] [blame]
Jeff Vander Stoepff1e0182017-04-13 07:51:36 -0700[diff] [blame]1# bluetooth app
Alex Klyubin801b5ec2017-02-06 15:27:19 -0800[diff] [blame]2
Alex Klyubinf5446eb2017-03-23 14:27:32 -0700[diff] [blame]3typeattribute bluetooth coredomain;
Alex Klyubin801b5ec2017-02-06 15:27:19 -0800[diff] [blame]4
5app_domain(bluetooth)
6net_domain(bluetooth)
7
dcashmancc39f632016-07-22 13:13:11 -0700[diff] [blame]8# Socket creation under /data/misc/bluedroid.
9type_transition bluetooth bluetooth_data_file:sock_file bluetooth_socket;
dcashman2e00e632016-10-12 14:58:09 -0700[diff] [blame]10
Alex Klyubin801b5ec2017-02-06 15:27:19 -0800[diff] [blame]11# Allow access to net_admin ioctls
12allowxperm bluetooth self:udp_socket ioctl priv_sock_ioctls;
13
14wakelock_use(bluetooth);
15
16# Data file accesses.
17allow bluetooth bluetooth_data_file:dir create_dir_perms;
18allow bluetooth bluetooth_data_file:notdevfile_class_set create_file_perms;
19allow bluetooth bluetooth_logs_data_file:dir rw_dir_perms;
20allow bluetooth bluetooth_logs_data_file:file create_file_perms;
21
22# Socket creation under /data/misc/bluedroid.
23allow bluetooth bluetooth_socket:sock_file create_file_perms;
24
Benjamin Gordon9b2e0cb2017-11-09 15:51:26 -0700[diff] [blame]25allow bluetooth self:global_capability_class_set net_admin;
26allow bluetooth self:global_capability2_class_set wake_alarm;
Alex Klyubin801b5ec2017-02-06 15:27:19 -0800[diff] [blame]27
28# tethering
29allow bluetooth self:packet_socket create_socket_perms_no_ioctl;
Benjamin Gordon9b2e0cb2017-11-09 15:51:26 -0700[diff] [blame]30allow bluetooth self:global_capability_class_set { net_admin net_raw net_bind_service };
Alex Klyubin801b5ec2017-02-06 15:27:19 -0800[diff] [blame]31allow bluetooth self:tun_socket create_socket_perms_no_ioctl;
32allow bluetooth tun_device:chr_file rw_file_perms;
Nick Kralevich049c03d2018-11-10 09:03:10 -0800[diff] [blame]33allowxperm bluetooth tun_device:chr_file ioctl { TUNGETIFF TUNSETIFF };
Alex Klyubin801b5ec2017-02-06 15:27:19 -0800[diff] [blame]34allow bluetooth efs_file:dir search;
35
Jack Hea61f7f62017-04-18 18:06:41 -0700[diff] [blame]36# allow Bluetooth to access uhid device for HID profile
37allow bluetooth uhid_device:chr_file rw_file_perms;
38
Alex Klyubin801b5ec2017-02-06 15:27:19 -0800[diff] [blame]39# proc access.
40allow bluetooth proc_bluetooth_writable:file rw_file_perms;
41
42# Allow write access to bluetooth specific properties
Jaekyun Seok224921d2018-04-09 12:07:32 +0900[diff] [blame]43set_prop(bluetooth, bluetooth_a2dp_offload_prop)
Cheney Nie55a74b2019-03-18 11:07:32 +0800[diff] [blame^]44set_prop(bluetooth, bluetooth_audio_hal_prop)
Alex Klyubin801b5ec2017-02-06 15:27:19 -0800[diff] [blame]45set_prop(bluetooth, bluetooth_prop)
Jaekyun Seok224921d2018-04-09 12:07:32 +0900[diff] [blame]46set_prop(bluetooth, exported_bluetooth_prop)
Alex Klyubin801b5ec2017-02-06 15:27:19 -0800[diff] [blame]47set_prop(bluetooth, pan_result_prop)
48
49allow bluetooth audioserver_service:service_manager find;
50allow bluetooth bluetooth_service:service_manager find;
51allow bluetooth drmserver_service:service_manager find;
52allow bluetooth mediaserver_service:service_manager find;
53allow bluetooth radio_service:service_manager find;
Alex Klyubin801b5ec2017-02-06 15:27:19 -0800[diff] [blame]54allow bluetooth app_api_service:service_manager find;
55allow bluetooth system_api_service:service_manager find;
Remi NGUYEN VAN44fd8852019-01-13 15:41:48 +0900[diff] [blame]56allow bluetooth network_stack_service:service_manager find;
Alex Klyubin801b5ec2017-02-06 15:27:19 -0800[diff] [blame]57
Alex Klyubin801b5ec2017-02-06 15:27:19 -0800[diff] [blame]58# already open bugreport file descriptors may be shared with
59# the bluetooth process, from a file in
60# /data/data/com.android.shell/files/bugreports/bugreport-*.
61allow bluetooth shell_data_file:file read;
62
Philip Cuadra6eee6eb2017-03-23 10:03:49 -0700[diff] [blame]63# Bluetooth audio needs RT scheduling to meet deadlines, allow sys_nice
Benjamin Gordon9b2e0cb2017-11-09 15:51:26 -0700[diff] [blame]64allow bluetooth self:global_capability_class_set sys_nice;
Philip Cuadra6eee6eb2017-03-23 10:03:49 -0700[diff] [blame]65
Alex Klyubin168435f2017-02-16 20:14:56 -0800[diff] [blame]66hal_client_domain(bluetooth, hal_bluetooth)
Alex Klyubin9e6b24c2017-03-16 18:48:40 -0700[diff] [blame]67hal_client_domain(bluetooth, hal_telephony)
Alex Klyubin801b5ec2017-02-06 15:27:19 -0800[diff] [blame]68
Sunny Kapdibc0c88f2017-10-30 12:58:20 -0700[diff] [blame]69# Bluetooth A2DP offload requires binding with audio HAL
70hal_client_domain(bluetooth, hal_audio)
71
Alex Klyubin801b5ec2017-02-06 15:27:19 -0800[diff] [blame]72read_runtime_log_tags(bluetooth)
73
74###
75### Neverallow rules
76###
77### These are things that the bluetooth app should NEVER be able to do
78###
79
80# Superuser capabilities.
Philip Cuadra6eee6eb2017-03-23 10:03:49 -0700[diff] [blame]81# Bluetooth requires net_{admin,raw,bind_service} and wake_alarm and block_suspend and sys_nice.
Benjamin Gordon9b2e0cb2017-11-09 15:51:26 -0700[diff] [blame]82neverallow bluetooth self:global_capability_class_set ~{ net_admin net_raw net_bind_service sys_nice};
83neverallow bluetooth self:global_capability2_class_set ~{ wake_alarm block_suspend };