6914e7a49b
Add the sepolicy required to:
- Introduce modemml_tflite_service which runs on the system server.
- Allow modem_ml_svc_sit to access the new service.
- Allow system_server to access NNAPI TPU service.
Relevant logs before the sepolicy changes are made:
```
auditd : avc: denied { find } for pid=1000 uid=1001 name=com.android.server.modemml.ITFLiteService/default scontext=u:r:modem_ml_svc_sit:s0 tcontext=u:object_r:modemml_tflite_service:s0 tclass=service_manager permissive=1
```
```
11-14 03:03:44.392 1064 1064 I auditd : type=1400 audit(0.0:9): avc: denied { call } for comm="modem_ml_svc_si" scontext=u:r:modem_ml_svc_sit:s0 tcontext=u:r:system_server:s0 tclass=binder permissive=1
```
```
SELinux : avc: denied { find } for pid=1115 uid=1000 name=android.hardware.neuralnetworks.IDevice/google-edgetpu scontext=u:r:system_server:s0 tcontext=u:object_r:edgetpu_nnapi_service:s0 tclass=service_manager permissive=1
```
Bug: 307449478
Change-Id: I14c2aa02eca08a026d100af6eea11ac9ac9e4fc7
30 lines
1.1 KiB
Text
30 lines
1.1 KiB
Text
type modem_ml_svc_sit, domain;
|
|
type modem_ml_svc_sit_exec, vendor_file_type, exec_type, file_type;
|
|
init_daemon_domain(modem_ml_svc_sit)
|
|
|
|
binder_use(modem_ml_svc_sit)
|
|
|
|
# Grant radio device access
|
|
allow modem_ml_svc_sit radio_device:chr_file rw_file_perms;
|
|
|
|
# Grant vendor radio and modem file/dir creation permission
|
|
allow modem_ml_svc_sit radio_vendor_data_file:dir create_dir_perms;
|
|
allow modem_ml_svc_sit radio_vendor_data_file:file create_file_perms;
|
|
|
|
# Grant modem ml data file/dir creation permission
|
|
allow modem_ml_svc_sit modem_ml_data_file:dir create_dir_perms;
|
|
allow modem_ml_svc_sit modem_ml_data_file:file create_file_perms;
|
|
|
|
# Grant modem ml models config files access
|
|
allow modem_ml_svc_sit modem_config_file:file r_file_perms;
|
|
|
|
# RIL property
|
|
get_prop(modem_ml_svc_sit, vendor_rild_prop)
|
|
|
|
# Access to NNAPI service
|
|
hal_client_domain(modem_ml_svc_sit, hal_neuralnetworks)
|
|
allow modem_ml_svc_sit edgetpu_nnapi_service:service_manager find;
|
|
|
|
# Access to TFLite binder service
|
|
allow modem_ml_svc_sit modemml_tflite_service:service_manager find;
|
|
binder_call(modem_ml_svc_sit, system_server)
|