From 3b25e384108c20741313fb356ed25e0c515e5b6b Mon Sep 17 00:00:00 2001
From: Sandeep Patil <sspatil@google.com>
Date: Thu, 15 Dec 2016 12:36:45 -0800
Subject: [PATCH] healthd: restore healthd sepolicy for charger mode
Test: Boot charge-only and android on sailfish
Bug: https://b/33672744
Change-Id: I6a25e90a716ec0ca46b5ba5edad860aa0eebafef
Signed-off-by: Sandeep Patil <sspatil@google.com>
---
private/init.te | 1 +
public/healthd.te | 39 +++++++++++++++++++++++++++++++++++----
2 files changed, 36 insertions(+), 4 deletions(-)
diff --git a/private/init.te b/private/init.te
index c0e3d5f7e..a42b525fc 100644
--- a/private/init.te
+++ b/private/init.te
@@ -5,6 +5,7 @@ tmpfs_domain(init)
# Transitions to seclabel processes in init.rc
domain_trans(init, rootfs, adbd)
domain_trans(init, rootfs, charger)
+domain_trans(init, rootfs, healthd)
domain_trans(init, rootfs, slideshow)
recovery_only(`
domain_trans(init, rootfs, recovery)
diff --git a/public/healthd.te b/public/healthd.te
index 8d71cfd33..8add56116 100644
--- a/public/healthd.te
+++ b/public/healthd.te
@@ -15,19 +15,50 @@ r_dir_file(healthd, cgroup)
r_dir_file(healthd, system_file)
allow healthd self:capability { net_admin sys_tty_config };
-
-wakelock_use(healthd)
+allow healthd self:capability sys_boot;
allow healthd self:netlink_kobject_uevent_socket create_socket_perms_no_ioctl;
+wakelock_use(healthd)
+
binder_use(healthd)
binder_service(healthd)
binder_call(healthd, system_server)
binder_call(healthd, hwservicemanager)
binder_call(healthd, hal_health)
+# Write to state file.
+# TODO: Split into a separate type?
+allow healthd sysfs:file write;
+
+# TODO: added to match above sysfs rule. Remove me?
+allow healthd sysfs_usb:file write;
+
allow healthd sysfs_batteryinfo:file r_file_perms;
+
+r_dir_file(healthd, sysfs_type)
+
+###
+### healthd: charger mode
+###
+
+# Read /sys/fs/pstore/console-ramoops
+# Don't worry about overly broad permissions for now, as there's
+# only one file in /sys/fs/pstore
+allow healthd pstorefs:dir r_dir_perms;
+allow healthd pstorefs:file r_file_perms;
+
+allow healthd graphics_device:dir r_dir_perms;
+allow healthd graphics_device:chr_file rw_file_perms;
+allow healthd input_device:dir r_dir_perms;
+allow healthd input_device:chr_file r_file_perms;
+allow healthd tty_device:chr_file rw_file_perms;
+allow healthd ashmem_device:chr_file execute;
+allow healthd self:process execmem;
+allow healthd proc_sysrq:file rw_file_perms;
+
allow healthd batteryproperties_service:service_manager { add find };
-# healthd can fake the battery existense if ro.boot.fake_battery is set
-get_prop(healthd, system_prop)
+# Healthd needs to tell init to continue the boot
+# process when running in charger mode.
+set_prop(healthd, system_prop)
--
GitLab