You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
113 lines
5.7 KiB
113 lines
5.7 KiB
type teecd_auth_exec, exec_type, file_type,system_file_type;
|
|
typeattribute system_teecd mlstrustedsubject;
|
|
init_daemon_domain(system_teecd)
|
|
domain_trans(init, teecd_auth_exec, system_teecd)
|
|
|
|
allow system_teecd system_data_file:file { getattr read };
|
|
allow system_teecd system_data_file:lnk_file r_file_perms;
|
|
allow system_teecd system_data_file:file r_file_perms;
|
|
allow system_teecd system_data_file:dir rw_dir_perms;
|
|
|
|
allow system_teecd self:netlink_socket create_socket_perms_no_ioctl;
|
|
allow system_teecd self:netlink_generic_socket create_socket_perms_no_ioctl;
|
|
r_dir_file(system_teecd, sysfs_tee)
|
|
allow system_teecd self:global_capability_class_set { sys_admin chown };
|
|
allow system_teecd kernel:process setsched;
|
|
#allow system_teecd tee_device:chr_file rw_file_perms;
|
|
allow system_teecd self:filesystem { associate };
|
|
allow system_teecd keystore:dir search;
|
|
allow system_teecd keystore:file r_file_perms;
|
|
|
|
#{ search } for pid=2893 comm="teecd" name="3273" dev="proc" ino=14400 scontext=u:r:tee:s0 tcontext=u:r:system_server:s0 tclass=dir
|
|
allow system_teecd system_server:dir { search };
|
|
|
|
# { read } for pid=2949 comm="teecd" name="cmdline" dev="proc" ino=10299 scontext=u:r:tee:s0 tcontext=u:r:system_server:s0 tclass=file
|
|
# { getattr } for pid=2783 comm="teecd" path="/proc/3273/cmdline" dev="proc" ino=11314 scontext=u:r:tee:s0 tcontext=u:r:system_server:s0 tclass=file
|
|
# { open } for pid=2783 comm="teecd" path="/proc/3273/cmdline" dev="proc" ino=11314 scontext=u:r:tee:s0 tcontext=u:r:system_server:s0 tclass=file
|
|
allow system_teecd system_server:file r_file_perms;
|
|
|
|
# { fowner } for pid=2769 comm="teecd" capability=3 scontext=u:r:tee:s0 tcontext=u:r:tee:s0 tclass=capability
|
|
# { fsetid } for pid=2769 comm="teecd" capability=4 scontext=u:r:tee:s0 tcontext=u:r:tee:s0 tclass=capability
|
|
allow system_teecd self:global_capability_class_set { fowner fsetid net_raw };
|
|
|
|
allow system_teecd self:tcp_socket { create connect name_connect ioctl getopt setopt read write };
|
|
allow system_teecd port:tcp_socket { name_connect };
|
|
allow system_teecd self:udp_socket { create connect ioctl getopt setopt read write };
|
|
allow system_teecd dnsproxyd_socket:sock_file { write };
|
|
|
|
allow system_teecd domain:dir { search };
|
|
allow system_teecd domain:file r_file_perms;
|
|
|
|
userdebug_or_eng(`
|
|
allow system_teecd su:dir { search };
|
|
allow system_teecd su:file r_file_perms;
|
|
')
|
|
allow { coredomain -app_zygote } system_teecd:unix_stream_socket connectto;
|
|
allow domain system_teecd:fd {use};
|
|
|
|
#{ setattr } for pid=2797 comm="init" ppid=1 ppid_comm="init" name="tee-multi-user" dev="tmpfs" ino=11687 scontext=u:r:init:s0 tcontext=u:object_r:socket_device:s0 tclass=sock_file permissive=0
|
|
allow tee_multi_user_socket socket_device:dir { write add_name };
|
|
allow tee_multi_user_socket socket_device:sock_file { create setattr };
|
|
|
|
allow system_teecd logd_prop:file { getattr open read };
|
|
allow system_teecd init:unix_stream_socket {read write listen accept connectto};
|
|
#allow system_teecd cpuctl_device:dir { search };
|
|
allow system_teecd self:global_capability_class_set { sys_nice };
|
|
|
|
#avc: denied { read } scontext=u:r:tui_daemon:s0 tcontext=u:object_r:sysfs:s0 tclass=file permissive=0
|
|
allow system_teecd sysfs_tee:file {r_file_perms};
|
|
allow system_teecd hwservicemanager:binder { call transfer };
|
|
allow hwservicemanager system_teecd:binder { call transfer };
|
|
|
|
get_prop(system_teecd,hwservicemanager_prop)
|
|
|
|
allow system_teecd hal_libteec:binder { call transfer };
|
|
allow system_teecd hal_ext_libteec_hwservice_attr:hwservice_manager { find };
|
|
|
|
allow system_teecd hidl_memory_hwservice:hwservice_manager { find };
|
|
allow system_teecd servicemanager:binder { call transfer };
|
|
|
|
allow system_teecd system_server:binder { call transfer };
|
|
allow system_server system_teecd:binder { call transfer };
|
|
|
|
#allow fbe_ca system_teecd:binder { call transfer };
|
|
|
|
allow radio system_teecd:binder { call transfer };
|
|
allow system_teecd radio_data_file:file { append getattr ioctl read write };
|
|
|
|
allow priv_app system_teecd:binder { call transfer };
|
|
allow untrusted_app system_teecd:binder { call transfer };
|
|
allow untrusted_app_25 system_teecd:binder { call transfer };
|
|
allow untrusted_app_27 system_teecd:binder { call transfer };
|
|
allow platform_app system_teecd:binder { call transfer };
|
|
allow system_app system_teecd:binder { call transfer };
|
|
|
|
allow system_teecd priv_app:binder { call transfer };
|
|
allow system_teecd untrusted_app:binder { call transfer };
|
|
allow system_teecd untrusted_app_25:binder { call transfer };
|
|
allow system_teecd untrusted_app_27:binder { call transfer };
|
|
allow system_teecd platform_app:binder { call transfer };
|
|
allow system_teecd system_app:binder { call transfer };
|
|
|
|
allow priv_app system_teecd:fd { use };
|
|
allow untrusted_app system_teecd:fd { use };
|
|
allow untrusted_app_25 system_teecd:fd { use };
|
|
allow untrusted_app_27 system_teecd:fd { use };
|
|
allow platform_app system_teecd:fd { use };
|
|
allow system_app system_teecd:fd { use };
|
|
|
|
allow system_teecd app_data_file:file { append getattr ioctl read write };
|
|
allow system_teecd system_app_data_file:file { getattr read };
|
|
allow system_teecd priv_app:fd { use };
|
|
allow system_teecd platform_app:fd { use };
|
|
allow system_teecd system_app:fd { use };
|
|
allow system_teecd untrusted_app:fd { use };
|
|
allow system_teecd untrusted_app_25:fd { use };
|
|
allow system_teecd untrusted_app_27:fd { use };
|
|
allow nfc system_teecd:binder { call transfer };
|
|
|
|
#avc: denied { call } for dsm=Q pid=864 comm="NetworkSessionS" scontext=u:r:mediaserver:s0 tcontext=u:r:system_teecd:s0 tclass=binder permissive=0 CMD=/system/bin/mediaserver
|
|
#avc: denied { transfer } for dsm=Q pid=876 comm="wfd_looper" scontext=u:r:mediaserver:s0 tcontext=u:r:system_teecd:s0 tclass=binder permissive=0 CMD=/system/bin/mediaserver
|
|
allow mediaserver system_teecd:binder { call transfer };
|
|
allow system_teecd tee:fd { use };
|