sepolicy: create qtitetherservice_app context
Move QtiTetherService back out of SystemServer and into it's
own context. Craft SELinux rules accordingly.
Change-Id: I5a20d3358cc113a3c597c9181ae40ec9e9e3a3e3
CRs-Fixed: 901501
diff --git a/common/file.te b/common/file.te
index 66e7b58..e3f1b3a 100644
--- a/common/file.te
+++ b/common/file.te
@@ -170,3 +170,6 @@
# subsystem_ramdump files
type ssr_ramdump_data_file, file_type, data_file_type;
+
+# qtitetherservice files
+type qtitetherservice_app_data_file, file_type, data_file_type;
diff --git a/common/installd.te b/common/installd.te
index a337fb9..b59cff6 100644
--- a/common/installd.te
+++ b/common/installd.te
@@ -1,3 +1,3 @@
-allow installd { dpmd_app_data_file location_app_data_file qsee_svc_app_data_file mdtp_svc_app_data_file} :dir { create_dir_perms relabelfrom relabelto };
-allow installd { dpmd_app_data_file location_app_data_file qsee_svc_app_data_file mdtp_svc_app_data_file} :lnk_file { create_file_perms relabelfrom relabelto };
-allow installd { dpmd_app_data_file location_app_data_file qsee_svc_app_data_file mdtp_svc_app_data_file} :{ file sock_file fifo_file } { getattr unlink rename relabelfrom relabelto setattr };
+allow installd { dpmd_app_data_file location_app_data_file qsee_svc_app_data_file mdtp_svc_app_data_file qtitetherservice_app_data_file} :dir { create_dir_perms relabelfrom relabelto };
+allow installd { dpmd_app_data_file location_app_data_file qsee_svc_app_data_file mdtp_svc_app_data_file qtitetherservice_app_data_file} :lnk_file { create_file_perms relabelfrom relabelto };
+allow installd { dpmd_app_data_file location_app_data_file qsee_svc_app_data_file mdtp_svc_app_data_file qtitetherservice_app_data_file} :{ file sock_file fifo_file } { getattr unlink rename relabelfrom relabelto setattr };
diff --git a/common/netd.te b/common/netd.te
index 7074114..680d499 100644
--- a/common/netd.te
+++ b/common/netd.te
@@ -10,7 +10,7 @@
allow netd wfdservice:tcp_socket rw_socket_perms;
binder_use(netd);
-binder_call(netd, system_app);
+binder_call(netd, qtitetherservice_app);
# allow to read /data/misc/ipa/tether_stats file
allow netd ipacm_data_file:dir r_dir_perms;
diff --git a/common/qtitetherservice_app.te b/common/qtitetherservice_app.te
new file mode 100644
index 0000000..24f35e8
--- /dev/null
+++ b/common/qtitetherservice_app.te
@@ -0,0 +1,45 @@
+# Copyright (c) 2015, The Linux Foundation. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+# * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+# * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following
+# disclaimer in the documentation and/or other materials provided
+# with the distribution.
+# * Neither the name of The Linux Foundation nor the names of its
+# contributors may be used to endorse or promote products derived
+# from this software without specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED "AS IS" AND ANY EXPRESS OR IMPLIED
+# WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT
+# ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS
+# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
+# BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
+# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
+# OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
+# IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+type qtitetherservice_app, domain;
+app_domain(qtitetherservice_app)
+
+allow qtitetherservice_app qtitetherservices_service:service_manager add;
+allow qtitetherservice_app { app_api_service system_api_service }:service_manager find;
+
+allow qtitetherservice_app self:socket create_socket_perms;
+
+allow qtitetherservice_app ipa_dev:chr_file rw_file_perms;
+
+unix_socket_connect(qtitetherservice_app, netd, netd);
+
+qmux_socket(qtitetherservice_app);
+
+allow qtitetherservice_app qtitetherservice_app_data_file:dir create_dir_perms;
+allow qtitetherservice_app qtitetherservice_app_data_file:{ file lnk_file } create_file_perms;
+
+allow qtitetherservice_app wcnss_service_exec:file rx_file_perms;
diff --git a/common/seapp_contexts b/common/seapp_contexts
index 27f8514..3bf7e05 100644
--- a/common/seapp_contexts
+++ b/common/seapp_contexts
@@ -12,3 +12,6 @@
#Add new domain for MDTP services
user=system seinfo=platform name=com.qualcomm.qti.securemsm.mdtp.MdtpService domain=mdtpservice_app type=mdtp_svc_app_data_file
+
+#Add new domain for QtiTetherService
+user=system seinfo=platform name=com.qualcomm.qti.tetherservice domain=qtitetherservice_app type=qtitetherservice_app_data_file
diff --git a/common/system_app.te b/common/system_app.te
index b40bd27..8673d1e 100644
--- a/common/system_app.te
+++ b/common/system_app.te
@@ -16,7 +16,6 @@
# access to color service SDK
color_service
STAProxyService
- qtitetherservices_service
}:service_manager add;
# access to perflock
@@ -96,15 +95,10 @@
# allow gba auth service to add itself as system service
allow system_app gba_auth_service:service_manager add;
-#allow access to netd
-allow system_app netd_socket:sock_file write;
-allow system_app wcnss_service_exec:file rx_file_perms;
# allow access to system_app for wbc_service
allow system_app wbc_service:service_manager add;
allow system_app self:netlink_kobject_uevent_socket { read bind setopt create };
-#allow access to ipa
-allow system_app ipa_dev:chr_file rw_file_perms;
# allow system_app to interact with mdtp daemon
binder_call(system_app, mdtpdaemon)
diff --git a/common/system_server.te b/common/system_server.te
index 07a288f..86888b0 100644
--- a/common/system_server.te
+++ b/common/system_server.te
@@ -25,7 +25,6 @@
# Allow system_server to add digital pen system service
usf_service
dpmservice
- qtitetherservices_service
}:service_manager add;
allow system_server qtitetherservices_service:service_manager{add find};
@@ -55,8 +54,8 @@
allow system_server location:unix_stream_socket connectto;
allow system_server location_data_file:{ file fifo_file } create_file_perms;
allow system_server location_data_file:dir create_dir_perms;
-allow system_server { dpmd_app_data_file location_app_data_file mdtp_svc_app_data_file } :file rw_file_perms;
-allow system_server { dpmd_app_data_file location_app_data_file mdtp_svc_app_data_file } :dir r_dir_perms;
+allow system_server { dpmd_app_data_file location_app_data_file mdtp_svc_app_data_file qtitetherservice_app_data_file } :file rw_file_perms;
+allow system_server { dpmd_app_data_file location_app_data_file mdtp_svc_app_data_file qtitetherservice_app_data_file } :dir r_dir_perms;
allow system_server location_socket:sock_file create_file_perms;
allow system_server location_prop:property_service set;