cc502045b7
Bug: 375335464
[ 68.189198] type=1400 audit(1722986580.568:59): avc: denied { unlink } for comm="binder:892_2" name="modem_svc_socket" dev="dm-52" ino=20239 scontext=u:r:modem_svc_sit:s0 tcontext=u:object_r:radio_vendor_data_file:s0 tclass=sock_file permissive=1
[ 68.189448] type=1400 audit(1722986580.568:60): avc: denied { create } for comm="binder:892_2" name="modem_svc_socket" scontext=u:r:modem_svc_sit:s0 tcontext=u:object_r:radio_vendor_data_file:s0 tclass=sock_file permissive=1
[ 68.189448] type=1400 audit(1722986580.568:60): avc: denied { write } for comm="binder:892_2" name="modem_svc_socket" scontext=u:r:modem_svc_sit:s0 tcontext=u:object_r:radio_vendor_data_file:s0 tclass=sock_file permissive=1
Flag: EXEMPT Critical modem system service
Change-Id: I43a3e33dc95eee8b06086ac438ce6d4cf038e2f5
52 lines
1.8 KiB
Text
52 lines
1.8 KiB
Text
# Selinux rule for modem_svc_sit daemon
|
|
type modem_svc_sit, domain;
|
|
type modem_svc_sit_exec, vendor_file_type, exec_type, file_type;
|
|
init_daemon_domain(modem_svc_sit)
|
|
|
|
hwbinder_use(modem_svc_sit)
|
|
binder_call(modem_svc_sit, rild)
|
|
|
|
# Grant sysfs_modem access
|
|
allow modem_svc_sit sysfs_modem:file rw_file_perms;
|
|
|
|
# Grant radio device access
|
|
allow modem_svc_sit radio_device:chr_file rw_file_perms;
|
|
|
|
# Grant vendor radio and modem file/dir creation permission
|
|
allow modem_svc_sit radio_vendor_data_file:dir create_dir_perms;
|
|
allow modem_svc_sit radio_vendor_data_file:file create_file_perms;
|
|
allow modem_svc_sit modem_stat_data_file:dir create_dir_perms;
|
|
allow modem_svc_sit modem_stat_data_file:file create_file_perms;
|
|
|
|
allow modem_svc_sit vendor_fw_file:dir search;
|
|
allow modem_svc_sit vendor_fw_file:file r_file_perms;
|
|
|
|
allow modem_svc_sit mnt_vendor_file:dir r_dir_perms;
|
|
allow modem_svc_sit modem_userdata_file:dir create_dir_perms;
|
|
allow modem_svc_sit modem_userdata_file:file create_file_perms;
|
|
|
|
# RIL property
|
|
get_prop(modem_svc_sit, vendor_rild_prop)
|
|
|
|
# Modem property
|
|
set_prop(modem_svc_sit, vendor_modem_prop)
|
|
|
|
# logging property
|
|
get_prop(modem_svc_sit, vendor_logger_prop)
|
|
|
|
# hwservice permission
|
|
allow modem_svc_sit hal_exynos_rild_hwservice:hwservice_manager find;
|
|
get_prop(modem_svc_sit, hwservicemanager_prop)
|
|
|
|
# Write trace data to the Perfetto traced daemon. This requires connecting to
|
|
# its producer socket and obtaining a (per-process) tmpfs fd.
|
|
perfetto_producer(modem_svc_sit)
|
|
|
|
# Allow modem_svc_sit to access modem image file/dir
|
|
allow modem_svc_sit modem_img_file:dir r_dir_perms;
|
|
allow modem_svc_sit modem_img_file:file r_file_perms;
|
|
allow modem_svc_sit modem_img_file:lnk_file r_file_perms;
|
|
|
|
# Allow modem_svc_sit to access socket for UMI
|
|
allow modem_svc_sit radio_vendor_data_file:sock_file { create write unlink };
|
|
|