You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
22 lines
1.0 KiB
22 lines
1.0 KiB
# Rules common to all binder service domains |
|
|
|
# Allow dumpstate and incidentd to collect information from binder services |
|
allow binderservicedomain { dumpstate incidentd }:fd use; |
|
allow binderservicedomain { dumpstate incidentd }:unix_stream_socket { read write getopt getattr }; |
|
allow binderservicedomain { dumpstate incidentd }:fifo_file { getattr write }; |
|
allow binderservicedomain shell_data_file:file { getattr write }; |
|
|
|
# Allow dumpsys to work from adb shell or the serial console |
|
allow binderservicedomain devpts:chr_file rw_file_perms; |
|
allow binderservicedomain console_device:chr_file rw_file_perms; |
|
|
|
# Receive and write to a pipe received over Binder from an app. |
|
allow binderservicedomain appdomain:fd use; |
|
allow binderservicedomain appdomain:fifo_file write; |
|
|
|
# allow all services to run permission checks |
|
allow binderservicedomain permission_service:service_manager find; |
|
|
|
allow binderservicedomain keystore:keystore_key { get_state get insert delete exist list sign verify }; |
|
|
|
use_keystore(binderservicedomain)
|
|
|