31f4d86bf1
[Detail] 1. using set_prop for SEPolicy optimize. 2. modify high risk sysfs write operation for security. MTK-Commit-Id: 48b34c3013d5402a3d6253945d3b41a148f0d167 Change-Id: I9657ab3f5eee2616f452a442fb6201779edd831c Signed-off-by: jerry-sc.wu <jerry-sc.wu@mediatek.com> CR-Id: ALPS04763250 Feature: Thermal Management
60 lines
2.0 KiB
Plaintext
60 lines
2.0 KiB
Plaintext
# ==============================================
|
|
# Policy File of /system/bin/thermal_manager Executable File
|
|
|
|
# ==============================================
|
|
# Type Declaration
|
|
# ==============================================
|
|
type thermal_manager_exec , exec_type, file_type, vendor_file_type;
|
|
type thermal_manager ,domain;
|
|
|
|
# ==============================================
|
|
# MTK Policy Rule
|
|
# ==============================================
|
|
init_daemon_domain(thermal_manager)
|
|
|
|
allow thermal_manager proc_mtkcooler:dir search;
|
|
allow thermal_manager proc_mtktz:dir search;
|
|
allow thermal_manager proc_thermal:dir search;
|
|
allow thermal_manager proc_mtkcooler:file rw_file_perms;
|
|
allow thermal_manager proc_mtktz:file rw_file_perms;
|
|
allow thermal_manager proc_thermal:file rw_file_perms;
|
|
|
|
|
|
# Date : WK15.30
|
|
# Operation : Migration
|
|
# Purpose : Use file_type_auto_trans to specify label to avoid violated(never allow)
|
|
|
|
allow thermal_manager thermal_manager_data_file:file create_file_perms;
|
|
allow thermal_manager thermal_manager_data_file:dir { rw_dir_perms setattr };
|
|
|
|
|
|
allow thermal_manager mediaserver:fd use;
|
|
allow thermal_manager mediaserver:fifo_file { read write };
|
|
allow thermal_manager mediaserver:tcp_socket { read write };
|
|
|
|
# Date : WK16.30
|
|
# Operation : Migration
|
|
# Purpose : Use file_type_auto_trans to specify label to avoid violated(never allow)
|
|
allow thermal_manager camera_isp_device:chr_file { read write };
|
|
allow thermal_manager cameraserver:fd use;
|
|
allow thermal_manager kd_camera_hw_device:chr_file { read write };
|
|
allow thermal_manager MTK_SMI_device:chr_file read;
|
|
allow thermal_manager surfaceflinger:fd use;
|
|
set_prop(thermal_manager ,mtk_thermal_config_prop)
|
|
|
|
# Date : 2019/09/12
|
|
# Operation : Migration
|
|
# Purpose : add sysfs permission
|
|
# path = " sys/devices/virtual/thermal/"
|
|
# path = " sys/class/thermal/"
|
|
allow thermal_manager sysfs_therm:file w_file_perms;
|
|
|
|
|
|
|
|
# Date : WK18.18
|
|
# Operation : P Migration
|
|
# Purpose : Allow thermal_manager to access vendor data file.
|
|
|
|
allow thermal_manager self:capability { fowner chown };
|
|
|