device_google_gs101/usf/sensor_hal.te
Chia-Ching Yu 3f91d6417a Add sepolicy for sensor HAL to read lhbm
04-23 08:54:18.000   742   742 I /vendor/bin/hw/android.hardware.sensors@2.0-service.multihal: type=1400 audit(0.0:23): avc: denied { read } for comm=504F5349582074696D6572203430 name="local_hbm_mode" dev="sysfs" ino=70515 scontext=u:r:hal_sensors_default:s0 tcontext=u:object_r:sysfs_lhbm:s0 tclass=file permissive=1

Bug: 181617640
Test: Forrest build with this patch(ab/P22167685).
      No local_hbm_mode related avc deined log.
Change-Id: Ibac3317cbca8652885310b1f5af8f4ea4d44a5c4
2021-04-29 03:00:19 +00:00

59 lines
2 KiB
Text

#
# USF sensor HAL SELinux type enforcements.
#
# Allow reading of sensor registry persist files.
allow hal_sensors_default persist_file:dir search;
allow hal_sensors_default mnt_vendor_file:dir search;
r_dir_file(hal_sensors_default, persist_sensor_reg_file)
# Allow creation and writing of sensor registry data files.
allow hal_sensors_default sensor_reg_data_file:dir rw_dir_perms;
allow hal_sensors_default sensor_reg_data_file:file create_file_perms;
# Allow access to the AoC communication driver.
allow hal_sensors_default aoc_device:chr_file rw_file_perms;
# Allow access to the AoC clock and kernel boot time sys FS node. This is needed
# to synchronize the AP and AoC clock timestamps.
allow hal_sensors_default sysfs_aoc_boottime:file rw_file_perms;
# Allow create thread to watch AOC's device.
allow hal_sensors_default device:dir r_dir_perms;
# Allow access to the files of CDT information.
r_dir_file(hal_sensors_default, sysfs_chosen)
# Allow display_info_service access to the backlight driver.
allow hal_sensors_default sysfs_leds:dir search;
allow hal_sensors_default sysfs_leds:file rw_file_perms;
# Allow access to the power supply files for MagCC.
r_dir_file(hal_sensors_default, sysfs_batteryinfo)
allow hal_sensors_default sysfs_wlc:dir r_dir_perms;
# Allow access to sensor service for sensor_listener.
binder_call(hal_sensors_default, system_server);
# Allow access to the sysfs_aoc.
allow hal_sensors_default sysfs_aoc:dir search;
# Allow use of the USF low latency transport.
usf_low_latency_transport(hal_sensors_default)
# Allow sensor HAL to reset AOC.
allow hal_sensors_default sysfs_aoc_reset:file w_file_perms;
#
# Suez type enforcements.
#
# Allow SensorSuez to connect AIDL stats.
binder_use(hal_sensors_default);
allow hal_sensors_default fwk_stats_service:service_manager find;
# Allow access to CHRE socket to connect to nanoapps.
unix_socket_connect(hal_sensors_default, chre, chre)
# Allow sensor HAL to read lhbm.
allow hal_sensors_default sysfs_lhbm:file r_file_perms;