5849c224e3
1. Mark polices which accessing proc/sysfs file system
2. Add violator attribute to modules violate vendor/system rule.
MTK-Commit-Id: 3954cad7a1428cda694d8428c2235a78aa6e7cc8
Change-Id: I401ae5b87eb9a03f324bef83c6678149606b15a8
CR-Id: ALPS03825066
Feature: [Android Default] SELinux, SEAndroid, and SE-MTK
51 lines
1.9 KiB
Plaintext
51 lines
1.9 KiB
Plaintext
# ==============================================
|
|
# Policy File of /system/binboot_logo_updater Executable File
|
|
|
|
# New added for move to /system
|
|
typeattribute boot_logo_updater coredomain;
|
|
type boot_logo_updater_exec , exec_type, file_type;
|
|
|
|
# ==============================================
|
|
# MTK Policy Rule
|
|
# ==============================================
|
|
|
|
init_daemon_domain(boot_logo_updater)
|
|
|
|
# Date : WK14.32
|
|
# Operation : Migration
|
|
# Puration : set boot reason
|
|
allow boot_logo_updater system_prop:property_service set;
|
|
|
|
allow boot_logo_updater graphics_device:chr_file rw_file_perms;
|
|
|
|
# For IPC communication
|
|
allow boot_logo_updater init:unix_stream_socket connectto;
|
|
allow boot_logo_updater property_socket:sock_file write;
|
|
#allow boot_logo_updater self:capability dac_override;
|
|
# To access some boot_mode infornation
|
|
#allow boot_logo_updater sysfs:file rw_file_perms;
|
|
# To access directory /dev/block/mmcblk0 or /dev/block/sdc
|
|
allow boot_logo_updater block_device:dir search;
|
|
allow boot_logo_updater graphics_device:dir search;
|
|
# to access file at /dev/block/mtd
|
|
allow boot_logo_updater mtd_device:chr_file r_file_perms;
|
|
allow boot_logo_updater mtd_device:dir search;
|
|
#To access the file at /dev/kmsg
|
|
allow boot_logo_updater device:dir write;
|
|
allow boot_logo_updater kmsg_device:chr_file w_file_perms;
|
|
#To the access /fstab mount point
|
|
allow boot_logo_updater rootfs:file r_file_perms;
|
|
#To access linux filesystem
|
|
allow boot_logo_updater sysfs:dir read;
|
|
# sanity fail for ALPS03604686:
|
|
# for path="/sys/firmware/devicetree/base/firmware/android/fstab" andfor name = "cmdline" and "mtdblock14"
|
|
allow boot_logo_updater mtd_device:blk_file read;
|
|
#allow boot_logo_updater proc:file read;
|
|
allow boot_logo_updater sysfs:dir open;
|
|
# for path="/proc/cmdline and ="/dev/block/mtdblock14"
|
|
#allow boot_logo_updater proc:file open;
|
|
allow boot_logo_updater system_data_file:dir write;
|
|
allow boot_logo_updater mtd_device:blk_file open;
|
|
|
|
|