98620c3b10
1. Add init-check_ap_pd_auth-sh for the vendor daemon script
`/vendor/bin/init.check_ap_pd_auth.sh`.
2. Add policy for properties `ro.vendor.sjtag_{ap,gsa}_is_unlocked` for
init, init-check_ap_pd_auth-sh and ssr_detector to access them.
SjtagService: type=1400 audit(0.0:1005): avc: denied { open } for path="/dev/__properties__/u:object_r:vendor_default_prop:s0" dev="tmpfs" ino=379 scontext=u:r:ssr_detector_app:s0:c512,c768 tcontext=u:object_r:vendor_default_prop:s0 tclass=file permissive=1
SjtagService: type=1400 audit(0.0:1006): avc: denied { getattr } for path="/dev/__properties__/u:object_r:vendor_default_prop:s0" dev="tmpfs" ino=379 scontext=u:r:ssr_detector_app:s0:c512,c768 tcontext=u:object_r:vendor_default_prop:s0 tclass=file permissive=1
SjtagService: type=1400 audit(0.0:1007): avc: denied { map } for path="/dev/__properties__/u:object_r:vendor_default_prop:s0" dev="tmpfs" ino=379 scontext=u:r:ssr_detector_app:s0:c512,c768 tcontext=u:object_r:vendor_default_prop:s0 tclass=file permissive=1
SjtagService: type=1400 audit(0.0:1008): avc: denied { write } for name="property_service" dev="tmpfs" ino=446 scontext=u:r:ssr_detector_app:s0:c512,c768 tcontext=u:object_r:property_socket:s0 tclass=sock_file permissive=1
SjtagService: type=1400 audit(0.0:1009): avc: denied { connectto } for path="/dev/socket/property_service" scontext=u:r:ssr_detector_app:s0:c512,c768 tcontext=u:r:init:s0 tclass=unix_stream_socket permissive=1
Bug: 298314432
Change-Id: Ib5dbcc50e266e33797626280504ea9e2cdc9f942
26 lines
1.2 KiB
Text
26 lines
1.2 KiB
Text
type ssr_detector_app, domain;
|
|
|
|
app_domain(ssr_detector_app)
|
|
allow ssr_detector_app app_api_service:service_manager find;
|
|
allow ssr_detector_app radio_service:service_manager find;
|
|
|
|
allow ssr_detector_app system_app_data_file:dir create_dir_perms;
|
|
allow ssr_detector_app system_app_data_file:file create_file_perms;
|
|
|
|
allow ssr_detector_app sscoredump_vendor_data_crashinfo_file:dir r_dir_perms;
|
|
allow ssr_detector_app sscoredump_vendor_data_crashinfo_file:file r_file_perms;
|
|
userdebug_or_eng(`
|
|
allow ssr_detector_app sscoredump_vendor_data_coredump_file:dir r_dir_perms;
|
|
allow ssr_detector_app sscoredump_vendor_data_coredump_file:file r_file_perms;
|
|
get_prop(ssr_detector_app, vendor_aoc_prop)
|
|
set_prop(ssr_detector_app, vendor_sjtag_lock_state_prop)
|
|
allow ssr_detector_app sysfs_sjtag:dir r_dir_perms;
|
|
allow ssr_detector_app sysfs_sjtag:file rw_file_perms;
|
|
allow ssr_detector_app proc_vendor_sched:dir search;
|
|
allow ssr_detector_app proc_vendor_sched:file rw_file_perms;
|
|
allow ssr_detector_app cgroup:file write;
|
|
allow ssr_detector_app vendor_toolbox_exec:file execute_no_trans;
|
|
')
|
|
|
|
get_prop(ssr_detector_app, vendor_ssrdump_prop)
|
|
get_prop(ssr_detector_app, vendor_wifi_version)
|