drgreen/android_device_google_gs-common
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update common chre sepolicy for socket connection

Browse Source 
With multiclient HAL, the socket server domain changes from chre to
hal_contexthub_default.

Bug: 248615564
Test: updated the sepolicies and observed that avc violation logs
      disappears.
Change-Id: Ic5717cee6d2714bec49814a1b779266de79dc4f3
This commit is contained in:
Lei Ju 2023-12-26 17:25:29 -08:00
parent e40fe7223e
commit 35e5021597
2 changed files with 6 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
chre/sepolicy/hal_contexthub_default.te
View File

@ -1,5 +1,6 @@
# Allow context hub HAL to communicate with daemon via socket
unix_socket_connect(hal_contexthub_default, chre, chre)
#
# Context hub multiclient HAL common selinux policies
#
# Permit communication with AoC
allow hal_contexthub_default aoc_device:chr_file rw_file_perms;

3
sensors/sepolicy/hal_sensors_default.te
View File

@ -60,6 +60,9 @@ allow hal_sensors_default fwk_stats_service:service_manager find;
# Allow access to CHRE socket to connect to nanoapps.
unix_socket_connect(hal_sensors_default, chre, chre)
## TODO(b/248615564): Remove above rule after CHRE multiclient HAL is launched.
unix_socket_connect(hal_sensors_default, chre, hal_contexthub_default)
# Allow access to the power supply files for MagCC.
r_dir_file(hal_sensors_default, sysfs_batteryinfo)