Skip to content
Snippets Groups Projects
Commit 719cc896 authored by John Stultz's avatar John Stultz Committed by android-build-merger
Browse files

Merge "sepolicy: Define and allow map permission for vendor dir" into oc-mr1-dev

am: 9c66416f

Change-Id: Ia4bd460b21d04050958d64d8e2008a9a82f969ee
parents fa302518 9c66416f
No related branches found
No related tags found
No related merge requests found
......@@ -106,7 +106,7 @@ allow domain system_file:lnk_file { getattr read };
# devices
not_full_treble(`
allow domain vendor_file_type:dir { search getattr };
allow domain vendor_file_type:file { execute read open getattr };
allow domain vendor_file_type:file { execute read open getattr map };
allow domain vendor_file_type:lnk_file { getattr read };
')
......@@ -117,12 +117,12 @@ allow domain vendor_hal_file:dir r_dir_perms;
# Everyone can read and execute all same process HALs
allow domain same_process_hal_file:dir r_dir_perms;
allow domain same_process_hal_file:file { execute read open getattr };
allow domain same_process_hal_file:file { execute read open getattr map };
# Any process can load vndk-sp libraries, which are system libraries
# used by same process HALs
allow domain vndk_sp_file:dir r_dir_perms;
allow domain vndk_sp_file:file { execute read open getattr };
allow domain vndk_sp_file:file { execute read open getattr map };
# All domains get access to /vendor/etc
allow domain vendor_configs_file:dir r_dir_perms;
......@@ -139,7 +139,7 @@ full_treble_only(`
# Allow reading and executing out of /vendor to all vendor domains
allow { domain -coredomain } vendor_file_type:dir r_dir_perms;
allow { domain -coredomain } vendor_file_type:file { read open getattr execute };
allow { domain -coredomain } vendor_file_type:file { read open getattr execute map };
allow { domain -coredomain } vendor_file_type:lnk_file { getattr read };
')
......
......@@ -234,7 +234,7 @@ typeattribute $1 $2;
# Find passthrough HAL implementations
allow $2 system_file:dir r_dir_perms;
allow $2 vendor_file:dir r_dir_perms;
allow $2 vendor_file:file { read open getattr execute };
allow $2 vendor_file:file { read open getattr execute map };
')
')
......@@ -253,7 +253,7 @@ typeattribute $1 $2;
# Find passthrough HAL implementations
allow $2 system_file:dir r_dir_perms;
allow $2 vendor_file:dir r_dir_perms;
allow $2 vendor_file:file { read open getattr execute };
allow $2 vendor_file:file { read open getattr execute map };
')
#####################################
......
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment