From 87ef6049f6a477070696c469cc0d1dfb5848623c Mon Sep 17 00:00:00 2001
From: Yifan Hong <elsk@google.com>
Date: Tue, 24 Oct 2017 17:25:30 -0700
Subject: [PATCH] hal_health_default: permissions for default impl
Default health service needs following permissions to work:
- read /sys/class/power_supply
- uevent
- wakelock
Bug: 63702641
Test: no denials for health service
Change-Id: I2f3aed3ef3b5ac024da17d9d5400d9834038df9f
---
public/hal_health.te | 16 ++++++++++++++++
1 file changed, 16 insertions(+)
diff --git a/public/hal_health.te b/public/hal_health.te
index c19c5f1d7..068f23bf7 100644
--- a/public/hal_health.te
+++ b/public/hal_health.te
@@ -9,3 +9,19 @@ allow hal_health_client hal_health_hwservice:hwservice_manager find;
# /{system,vendor,odm}/lib[64]/hw/ in order
# to be able to open the hal implementation .so files
r_dir_file(hal_health, system_file)
+
+# Common rules for a health service.
+
+# Allow to listen to uevents for updates
+allow hal_health_server self:netlink_kobject_uevent_socket create_socket_perms_no_ioctl;
+
+# Allow to read /sys/class/power_supply directory
+allow hal_health_server sysfs:dir r_dir_perms;
+
+# Allow to read files under /sys/class/power_supply. Implementations typically have symlinks
+# to vendor specific files. Vendors should mark sysfs_batteryinfo on all files read by health
+# HAL service.
+r_dir_file(hal_health_server, sysfs_batteryinfo)
+
+# Allow to wake up to send periodic events
+wakelock_use(hal_health_server)
--
GitLab