Merge "Set up access control rule for aocxd" into main

2025-01-19 19:15:30 -08:00 · 2025-01-19 19:15:30 -08:00 · f23d87650d
commit f23d87650d
parent 3d542c3f96 cb1a8297c3
4 changed files with 22 additions and 1 deletions
--- a/aoc/aoc.mk
+++ b/aoc/aoc.mk
@ -1,4 +1,6 @@
-BOARD_VENDOR_SEPOLICY_DIRS += device/google/gs-common/aoc/sepolicy
+BOARD_VENDOR_SEPOLICY_DIRS += \
+    device/google/gs-common/aoc/sepolicy \
+    device/google/gs-common/aoc/sepolicy/allowlist

 PRODUCT_PACKAGES += dump_aoc \
 		    aocd \
--- a/aoc/sepolicy/allowlist/aocxd_neverallow.te
+++ b/aoc/sepolicy/allowlist/aocxd_neverallow.te
@ -0,0 +1,11 @@
+# set up rule to control the access to aocxd
+neverallow {
+  domain
+  -hwservicemanager
+  -servicemanager
+  -vndservicemanager
+  -system_suspend_server
+  -dumpstate
+  -hal_audio_default
+  -aocxdallowdomain
+} aocxd:binder { call transfer };
--- a/aoc/sepolicy/allowlist/aocxdallowdomain.te
+++ b/aoc/sepolicy/allowlist/aocxdallowdomain.te
@ -0,0 +1,6 @@
+# Aocx AIDL service
+allow aocxdallowdomain aocx:service_manager find;
+
+binder_call(aocxdallowdomain, aocxd)
+# Allow aocxd asynchronous callback to aocxdallowdomain
+binder_call(aocxd, aocxdallowdomain)
--- a/aoc/sepolicy/allowlist/attributes
+++ b/aoc/sepolicy/allowlist/attributes
@ -0,0 +1,2 @@
+# Allow domain to access aocx HAL API
+attribute aocxdallowdomain;