From 9e6b24c6a5dc026924b2ab983d6644063585cd9c Mon Sep 17 00:00:00 2001
From: Alex Klyubin <klyubin@google.com>
Date: Thu, 16 Mar 2017 18:48:40 -0700
Subject: [PATCH] Annotate most remaining HALs with _client/_server
This switches most remaining HALs to the _client/_server approach.
To unblock efforts blocked on majority of HALs having to use this
model, this change does not remove unnecessary rules from clients of
these HALs. That work will be performed in follow-up commits. This
commit only adds allow rules and thus does not break existing
functionality.
The HALs not yet on the _client/_server model after this commit are:
* Allocator HAL, because it's non-trivial to declare all apps except
isolated apps as clients of this HAL, which they are.
* Boot HAL, because it's still on the non-attributized model and I'm
waiting for update_engine folks to answer a couple of questions
which will let me refactor the policy of this HAL.
Test: mmm system/sepolicy
Test: Device boots, no new denials
Test: Device boots in recovery mode, no new denials
Bug: 34170079
Change-Id: I03e6bcec2fa02f14bdf17d11f7367b62c68a14b9
---
private/bluetooth.te | 1 +
private/surfaceflinger.te | 3 +++
private/system_server.te | 10 +++++++
public/attributes | 34 ++++++++++++++++++++++++
public/dumpstate.te | 1 +
public/gatekeeperd.te | 1 +
public/hal_gatekeeper.te | 2 ++
public/healthd.te | 1 +
public/nfc.te | 1 +
public/radio.te | 2 +-
public/rild.te | 2 +-
vendor/hal_configstore_default.te | 2 +-
vendor/hal_contexthub_default.te | 2 +-
vendor/hal_gatekeeper_default.te | 2 +-
vendor/hal_gnss_default.te | 2 +-
vendor/hal_graphics_allocator_default.te | 2 +-
vendor/hal_graphics_composer_default.te | 2 +-
vendor/hal_health_default.te | 2 +-
vendor/hal_ir_default.te | 2 +-
vendor/hal_light_default.te | 2 +-
vendor/hal_memtrack_default.te | 2 +-
vendor/hal_nfc_default.te | 2 +-
vendor/hal_power_default.te | 2 +-
vendor/hal_thermal_default.te | 2 +-
vendor/hal_usb_default.te | 3 ++-
vendor/hal_vibrator_default.te | 2 +-
vendor/hal_vr_default.te | 2 +-
27 files changed, 73 insertions(+), 18 deletions(-)
diff --git a/private/bluetooth.te b/private/bluetooth.te
index b2369c1c9..9c7182e6c 100644
--- a/private/bluetooth.te
+++ b/private/bluetooth.te
@@ -58,6 +58,7 @@ allow bluetooth shell_data_file:file read;
hal_client_domain(bluetooth, hal_bluetooth)
binder_call(bluetooth, hal_telephony)
+hal_client_domain(bluetooth, hal_telephony)
read_runtime_log_tags(bluetooth)
diff --git a/private/surfaceflinger.te b/private/surfaceflinger.te
index 5f7549d16..0aff9f505 100644
--- a/private/surfaceflinger.te
+++ b/private/surfaceflinger.te
@@ -10,8 +10,11 @@ read_runtime_log_tags(surfaceflinger)
# Perform HwBinder IPC.
hwbinder_use(surfaceflinger)
binder_call(surfaceflinger, hal_graphics_allocator)
+hal_client_domain(surfaceflinger, hal_graphics_allocator)
binder_call(surfaceflinger, hal_graphics_composer)
+hal_client_domain(surfaceflinger, hal_graphics_composer)
binder_call(surfaceflinger, hal_configstore)
+hal_client_domain(surfaceflinger, hal_configstore)
# Perform Binder IPC.
binder_use(surfaceflinger)
diff --git a/private/system_server.te b/private/system_server.te
index 516ace48b..58a25e29c 100644
--- a/private/system_server.te
+++ b/private/system_server.te
@@ -176,18 +176,28 @@ hwbinder_use(system_server)
hwallocator_use(system_server)
binder_call(system_server, hal_boot)
binder_call(system_server, hal_contexthub)
+hal_client_domain(system_server, hal_contexthub)
hal_client_domain(system_server, hal_fingerprint)
binder_call(system_server, hal_gnss)
+hal_client_domain(system_server, hal_gnss)
binder_call(system_server, hal_graphics_allocator)
binder_call(system_server, hal_ir)
+hal_client_domain(system_server, hal_ir)
binder_call(system_server, hal_light)
+hal_client_domain(system_server, hal_light)
binder_call(system_server, hal_memtrack)
+hal_client_domain(system_server, hal_memtrack)
binder_call(system_server, hal_power)
+hal_client_domain(system_server, hal_power)
hal_client_domain(system_server, hal_sensors)
binder_call(system_server, hal_thermal)
+hal_client_domain(system_server, hal_thermal)
binder_call(system_server, hal_usb)
+hal_client_domain(system_server, hal_usb)
binder_call(system_server, hal_vibrator)
+hal_client_domain(system_server, hal_vibrator)
binder_call(system_server, hal_vr)
+hal_client_domain(system_server, hal_vr)
hal_client_domain(system_server, hal_wifi)
hal_client_domain(system_server, hal_wifi_supplicant)
diff --git a/public/attributes b/public/attributes
index d26f7eee8..a0c1f9397 100644
--- a/public/attributes
+++ b/public/attributes
@@ -136,7 +136,11 @@ attribute hal_camera;
attribute hal_camera_client;
attribute hal_camera_server;
attribute hal_configstore;
+attribute hal_configstore_client;
+attribute hal_configstore_server;
attribute hal_contexthub;
+attribute hal_contexthub_client;
+attribute hal_contexthub_server;
attribute hal_drm;
attribute hal_drm_client;
attribute hal_drm_server;
@@ -147,26 +151,56 @@ attribute hal_fingerprint;
attribute hal_fingerprint_client;
attribute hal_fingerprint_server;
attribute hal_gatekeeper;
+attribute hal_gatekeeper_client;
+attribute hal_gatekeeper_server;
attribute hal_gnss;
+attribute hal_gnss_client;
+attribute hal_gnss_server;
attribute hal_graphics_allocator;
+attribute hal_graphics_allocator_client;
+attribute hal_graphics_allocator_server;
attribute hal_graphics_composer;
+attribute hal_graphics_composer_client;
+attribute hal_graphics_composer_server;
attribute hal_health;
+attribute hal_health_client;
+attribute hal_health_server;
attribute hal_ir;
+attribute hal_ir_client;
+attribute hal_ir_server;
attribute hal_keymaster;
attribute hal_keymaster_client;
attribute hal_keymaster_server;
attribute hal_light;
+attribute hal_light_client;
+attribute hal_light_server;
attribute hal_memtrack;
+attribute hal_memtrack_client;
+attribute hal_memtrack_server;
attribute hal_nfc;
+attribute hal_nfc_client;
+attribute hal_nfc_server;
attribute hal_power;
+attribute hal_power_client;
+attribute hal_power_server;
attribute hal_sensors;
attribute hal_sensors_client;
attribute hal_sensors_server;
attribute hal_telephony;
+attribute hal_telephony_client;
+attribute hal_telephony_server;
attribute hal_thermal;
+attribute hal_thermal_client;
+attribute hal_thermal_server;
attribute hal_usb;
+attribute hal_usb_client;
+attribute hal_usb_server;
attribute hal_vibrator;
+attribute hal_vibrator_client;
+attribute hal_vibrator_server;
attribute hal_vr;
+attribute hal_vr_client;
+attribute hal_vr_server;
attribute hal_wifi;
attribute hal_wifi_client;
attribute hal_wifi_server;
diff --git a/public/dumpstate.te b/public/dumpstate.te
index 80161deb0..8e645b9db 100644
--- a/public/dumpstate.te
+++ b/public/dumpstate.te
@@ -91,6 +91,7 @@ binder_call(dumpstate, { appdomain netd wificond })
# For binderized mode:
hal_client_domain(dumpstate, hal_dumpstate)
binder_call(dumpstate, hal_vibrator)
+hal_client_domain(dumpstate, hal_vibrator)
# For passthrough mode:
allow dumpstate sysfs_vibrator:file { rw_file_perms getattr };
diff --git a/public/gatekeeperd.te b/public/gatekeeperd.te
index 94fb2b937..abecbda24 100644
--- a/public/gatekeeperd.te
+++ b/public/gatekeeperd.te
@@ -16,6 +16,7 @@ allow gatekeeperd system_file:dir r_dir_perms;
### Rules needed when Gatekeeper HAL runs outside of gatekeeperd process.
### These rules should eventually be granted only when needed.
hwbinder_use(gatekeeperd)
+hal_client_domain(gatekeeperd, hal_gatekeeper)
###
# need to find KeyStore and add self
diff --git a/public/hal_gatekeeper.te b/public/hal_gatekeeper.te
index a17dbcd56..c428ebaf0 100644
--- a/public/hal_gatekeeper.te
+++ b/public/hal_gatekeeper.te
@@ -1,4 +1,6 @@
# call into gatekeeperd process (callbacks)
+# TODO: This rules is unlikely to be needed because Gatekeeper HIDL
+# says there are no callbacks
binder_call(hal_gatekeeper, gatekeeperd)
# TEE access.
diff --git a/public/healthd.te b/public/healthd.te
index 2f26b9e28..8737dbe5f 100644
--- a/public/healthd.te
+++ b/public/healthd.te
@@ -26,6 +26,7 @@ binder_service(healthd)
binder_call(healthd, system_server)
binder_call(healthd, hwservicemanager)
binder_call(healthd, hal_health)
+hal_client_domain(healthd, hal_health)
# Write to state file.
# TODO: Split into a separate type?
diff --git a/public/nfc.te b/public/nfc.te
index 866180bdb..cb6a78198 100644
--- a/public/nfc.te
+++ b/public/nfc.te
@@ -38,3 +38,4 @@ allow nfc shell_data_file:file read;
# allow NFC process to call into the NFC HAL
binder_call(nfc, hal_nfc)
+hal_client_domain(nfc, hal_nfc)
diff --git a/public/radio.te b/public/radio.te
index 953b59ca2..a8966599b 100644
--- a/public/radio.te
+++ b/public/radio.te
@@ -37,4 +37,4 @@ allow radio system_api_service:service_manager find;
# Perform HwBinder IPC.
hwbinder_use(radio)
binder_call(radio, hal_telephony)
-
+hal_client_domain(radio, hal_telephony)
diff --git a/public/rild.te b/public/rild.te
index fd1eccaa4..e4b018690 100644
--- a/public/rild.te
+++ b/public/rild.te
@@ -1,6 +1,6 @@
# rild - radio interface layer daemon
type rild, domain, domain_deprecated;
-hal_impl_domain(rild, hal_telephony)
+hal_server_domain(rild, hal_telephony)
net_domain(rild)
allowxperm rild self:udp_socket ioctl priv_sock_ioctls;
diff --git a/vendor/hal_configstore_default.te b/vendor/hal_configstore_default.te
index b3ca6c2ff..e8930ca8d 100644
--- a/vendor/hal_configstore_default.te
+++ b/vendor/hal_configstore_default.te
@@ -1,5 +1,5 @@
type hal_configstore_default, domain;
-hal_impl_domain(hal_configstore_default, hal_configstore)
+hal_server_domain(hal_configstore_default, hal_configstore)
type hal_configstore_default_exec, exec_type, file_type;
init_daemon_domain(hal_configstore_default)
diff --git a/vendor/hal_contexthub_default.te b/vendor/hal_contexthub_default.te
index abf5b0e3b..67dd53020 100644
--- a/vendor/hal_contexthub_default.te
+++ b/vendor/hal_contexthub_default.te
@@ -1,5 +1,5 @@
type hal_contexthub_default, domain;
-hal_impl_domain(hal_contexthub_default, hal_contexthub)
+hal_server_domain(hal_contexthub_default, hal_contexthub)
type hal_contexthub_default_exec, exec_type, file_type;
init_daemon_domain(hal_contexthub_default)
diff --git a/vendor/hal_gatekeeper_default.te b/vendor/hal_gatekeeper_default.te
index 3c84b1378..d48af1650 100644
--- a/vendor/hal_gatekeeper_default.te
+++ b/vendor/hal_gatekeeper_default.te
@@ -1,5 +1,5 @@
type hal_gatekeeper_default, domain;
-hal_impl_domain(hal_gatekeeper_default, hal_gatekeeper)
+hal_server_domain(hal_gatekeeper_default, hal_gatekeeper)
type hal_gatekeeper_default_exec, exec_type, file_type;
init_daemon_domain(hal_gatekeeper_default);
diff --git a/vendor/hal_gnss_default.te b/vendor/hal_gnss_default.te
index 78f85bcf1..18da09080 100644
--- a/vendor/hal_gnss_default.te
+++ b/vendor/hal_gnss_default.te
@@ -1,5 +1,5 @@
type hal_gnss_default, domain;
-hal_impl_domain(hal_gnss_default, hal_gnss)
+hal_server_domain(hal_gnss_default, hal_gnss)
type hal_gnss_default_exec, exec_type, file_type;
init_daemon_domain(hal_gnss_default)
diff --git a/vendor/hal_graphics_allocator_default.te b/vendor/hal_graphics_allocator_default.te
index 6b3672cf9..f47a60477 100644
--- a/vendor/hal_graphics_allocator_default.te
+++ b/vendor/hal_graphics_allocator_default.te
@@ -1,5 +1,5 @@
type hal_graphics_allocator_default, domain;
-hal_impl_domain(hal_graphics_allocator_default, hal_graphics_allocator)
+hal_server_domain(hal_graphics_allocator_default, hal_graphics_allocator)
type hal_graphics_allocator_default_exec, exec_type, file_type;
init_daemon_domain(hal_graphics_allocator_default)
diff --git a/vendor/hal_graphics_composer_default.te b/vendor/hal_graphics_composer_default.te
index 99bf690fc..b65b8fe14 100644
--- a/vendor/hal_graphics_composer_default.te
+++ b/vendor/hal_graphics_composer_default.te
@@ -1,5 +1,5 @@
type hal_graphics_composer_default, domain;
-hal_impl_domain(hal_graphics_composer_default, hal_graphics_composer)
+hal_server_domain(hal_graphics_composer_default, hal_graphics_composer)
type hal_graphics_composer_default_exec, exec_type, file_type;
init_daemon_domain(hal_graphics_composer_default)
diff --git a/vendor/hal_health_default.te b/vendor/hal_health_default.te
index 0496cdf01..3add20bca 100644
--- a/vendor/hal_health_default.te
+++ b/vendor/hal_health_default.te
@@ -1,6 +1,6 @@
# health info abstraction
type hal_health_default, domain;
-hal_impl_domain(hal_health_default, hal_health)
+hal_server_domain(hal_health_default, hal_health)
type hal_health_default_exec, exec_type, file_type;
init_daemon_domain(hal_health_default)
diff --git a/vendor/hal_ir_default.te b/vendor/hal_ir_default.te
index 2de1b9285..e43bf076a 100644
--- a/vendor/hal_ir_default.te
+++ b/vendor/hal_ir_default.te
@@ -1,5 +1,5 @@
type hal_ir_default, domain;
-hal_impl_domain(hal_ir_default, hal_ir)
+hal_server_domain(hal_ir_default, hal_ir)
type hal_ir_default_exec, exec_type, file_type;
init_daemon_domain(hal_ir_default)
diff --git a/vendor/hal_light_default.te b/vendor/hal_light_default.te
index bee7c8a53..8c1bfb690 100644
--- a/vendor/hal_light_default.te
+++ b/vendor/hal_light_default.te
@@ -1,5 +1,5 @@
type hal_light_default, domain;
-hal_impl_domain(hal_light_default, hal_light)
+hal_server_domain(hal_light_default, hal_light)
type hal_light_default_exec, exec_type, file_type;
init_daemon_domain(hal_light_default)
diff --git a/vendor/hal_memtrack_default.te b/vendor/hal_memtrack_default.te
index 1c5ca99de..0e3ba21a0 100644
--- a/vendor/hal_memtrack_default.te
+++ b/vendor/hal_memtrack_default.te
@@ -1,5 +1,5 @@
type hal_memtrack_default, domain;
-hal_impl_domain(hal_memtrack_default, hal_memtrack)
+hal_server_domain(hal_memtrack_default, hal_memtrack)
type hal_memtrack_default_exec, exec_type, file_type;
init_daemon_domain(hal_memtrack_default)
diff --git a/vendor/hal_nfc_default.te b/vendor/hal_nfc_default.te
index b6abb1958..b155f27d3 100644
--- a/vendor/hal_nfc_default.te
+++ b/vendor/hal_nfc_default.te
@@ -1,5 +1,5 @@
type hal_nfc_default, domain;
-hal_impl_domain(hal_nfc_default, hal_nfc)
+hal_server_domain(hal_nfc_default, hal_nfc)
type hal_nfc_default_exec, exec_type, file_type;
init_daemon_domain(hal_nfc_default)
diff --git a/vendor/hal_power_default.te b/vendor/hal_power_default.te
index c8977eedb..47065ea45 100644
--- a/vendor/hal_power_default.te
+++ b/vendor/hal_power_default.te
@@ -1,5 +1,5 @@
type hal_power_default, domain;
-hal_impl_domain(hal_power_default, hal_power)
+hal_server_domain(hal_power_default, hal_power)
type hal_power_default_exec, exec_type, file_type;
init_daemon_domain(hal_power_default)
diff --git a/vendor/hal_thermal_default.te b/vendor/hal_thermal_default.te
index baa3b97ab..9a777e062 100644
--- a/vendor/hal_thermal_default.te
+++ b/vendor/hal_thermal_default.te
@@ -1,5 +1,5 @@
type hal_thermal_default, domain;
-hal_impl_domain(hal_thermal_default, hal_thermal)
+hal_server_domain(hal_thermal_default, hal_thermal)
type hal_thermal_default_exec, exec_type, file_type;
init_daemon_domain(hal_thermal_default)
diff --git a/vendor/hal_usb_default.te b/vendor/hal_usb_default.te
index 24017f9e0..cc28a65f3 100644
--- a/vendor/hal_usb_default.te
+++ b/vendor/hal_usb_default.te
@@ -1,4 +1,5 @@
type hal_usb_default, domain;
-hal_impl_domain(hal_usb_default, hal_usb)
+hal_server_domain(hal_usb_default, hal_usb)
+
type hal_usb_default_exec, exec_type, file_type;
init_daemon_domain(hal_usb_default)
diff --git a/vendor/hal_vibrator_default.te b/vendor/hal_vibrator_default.te
index c185e0862..8bc8a724c 100644
--- a/vendor/hal_vibrator_default.te
+++ b/vendor/hal_vibrator_default.te
@@ -1,5 +1,5 @@
type hal_vibrator_default, domain;
-hal_impl_domain(hal_vibrator_default, hal_vibrator)
+hal_server_domain(hal_vibrator_default, hal_vibrator)
type hal_vibrator_default_exec, exec_type, file_type;
init_daemon_domain(hal_vibrator_default)
diff --git a/vendor/hal_vr_default.te b/vendor/hal_vr_default.te
index f32c737c1..7475524a1 100644
--- a/vendor/hal_vr_default.te
+++ b/vendor/hal_vr_default.te
@@ -1,5 +1,5 @@
type hal_vr_default, domain;
-hal_impl_domain(hal_vr_default, hal_vr)
+hal_server_domain(hal_vr_default, hal_vr)
type hal_vr_default_exec, exec_type, file_type;
init_daemon_domain(hal_vr_default)
--
GitLab