5849c224e3
1. Mark polices which accessing proc/sysfs file system
2. Add violator attribute to modules violate vendor/system rule.
MTK-Commit-Id: 3954cad7a1428cda694d8428c2235a78aa6e7cc8
Change-Id: I401ae5b87eb9a03f324bef83c6678149606b15a8
CR-Id: ALPS03825066
Feature: [Android Default] SELinux, SEAndroid, and SE-MTK
41 lines
1.8 KiB
Plaintext
41 lines
1.8 KiB
Plaintext
# =============================================================================
|
|
# MTK Policy Rule
|
|
# =============================================================================
|
|
|
|
# New added for move to /system
|
|
type thermalindicator_exec, exec_type, file_type;
|
|
typeattribute thermalindicator coredomain;
|
|
|
|
init_daemon_domain(thermalindicator)
|
|
|
|
allow thermalindicator gpu_device:chr_file { getattr read write ioctl open };
|
|
allow thermalindicator surfaceflinger:fd use;
|
|
allow thermalindicator surfaceflinger:binder call;
|
|
allow thermalindicator surfaceflinger:binder transfer;
|
|
allow thermalindicator surfaceflinger_service:service_manager find;
|
|
allow thermalindicator servicemanager:binder call;
|
|
allow thermalindicator property_socket:sock_file write;
|
|
allow thermalindicator init:unix_stream_socket connectto;
|
|
|
|
allow surfaceflinger thermalindicator:fd use;
|
|
allow surfaceflinger thermalindicator:binder call;
|
|
allow surfaceflinger thermalindicator:binder transfer;
|
|
allow surfaceflinger thermalindicator:file { getattr read open };
|
|
allow surfaceflinger thermalindicator:dir search;
|
|
|
|
allow servicemanager thermalindicator:dir search;
|
|
allow servicemanager thermalindicator:file { read open };
|
|
allow servicemanager thermalindicator:process { getattr };
|
|
|
|
# For /proc/[pid]/cmdline accessing
|
|
typeattribute thermalindicator mlstrustedsubject;
|
|
|
|
allow thermalindicator proc:dir {search getattr};
|
|
#allow thermalindicator proc:file read;
|
|
allow thermalindicator shell:dir search;
|
|
allow thermalindicator platform_app:dir search;
|
|
allow thermalindicator platform_app:file {open read getattr};
|
|
allow thermalindicator untrusted_app:dir search;
|
|
allow thermalindicator untrusted_app:file {open read getattr};
|
|
allow thermalindicator mediaserver:dir search;
|
|
allow thermalindicator mediaserver:file {open read getattr}; |