diff --git a/public/property.te b/public/property.te index f757936d7b669c1cbfb5546f9a948fa1e34cb9b6..0e298098885945e466c5130a7a3977d20b4a6059 100644 --- a/public/property.te +++ b/public/property.te @@ -154,7 +154,6 @@ compatible_property_only(` -coredomain -appdomain -hal_nfc_server - -vendor_init } { nfc_prop }:property_service set; @@ -167,11 +166,57 @@ compatible_property_only(` -vendor_init } { exported_radio_prop - exported2_radio_prop exported3_radio_prop + }:property_service set; + + neverallow { + domain + -coredomain + -appdomain + -hal_telephony_server + } { + exported2_radio_prop radio_prop }:property_service set; + neverallow { + domain + -coredomain + -bluetooth + -hal_bluetooth + } { + bluetooth_prop + }:property_service set; + + neverallow { + domain + -coredomain + -bluetooth + -hal_bluetooth + -vendor_init + } { + exported_bluetooth_prop + }:property_service set; + + neverallow { + domain + -coredomain + -hal_wifi + -wificond + } { + wifi_prop + }:property_service set; + + neverallow { + domain + -coredomain + -hal_wifi + -wificond + -vendor_init + } { + exported_wifi_prop + }:property_service set; + # Prevent properties from being read neverallow { domain @@ -200,7 +245,6 @@ compatible_property_only(` -coredomain -appdomain -hal_nfc_server - -vendor_init } { nfc_prop }:file no_rw_file_perms; @@ -210,8 +254,25 @@ compatible_property_only(` -coredomain -appdomain -hal_telephony_server - -vendor_init } { radio_prop }:file no_rw_file_perms; + + neverallow { + domain + -coredomain + -bluetooth + -hal_bluetooth + } { + bluetooth_prop + }:file no_rw_file_perms; + + neverallow { + domain + -coredomain + -hal_wifi + -wificond + } { + wifi_prop + }:file no_rw_file_perms; ')