From bac9992e860f634ef32354b4a0bcf39b300b059a Mon Sep 17 00:00:00 2001
From: rpcraig <rpcraig@tycho.ncsc.mil>
Date: Mon, 3 Dec 2012 06:07:45 -0500
Subject: [PATCH] watchdog security policy.
Initial policy for software watchdog daemon
which is started by init.
Change-Id: I042a5b1698bf53ce2e50ea06851c374e5123ee2c
Signed-off-by: rpcraig <rpcraig@tycho.ncsc.mil>
---
device.te | 1 +
file_contexts | 1 +
watchdogd.te | 8 ++++++++
3 files changed, 10 insertions(+)
create mode 100644 watchdogd.te
diff --git a/device.te b/device.te
index 7818ce870..ecb7c10c3 100644
--- a/device.te
+++ b/device.te
@@ -41,6 +41,7 @@ type fuse_device, dev_type;
type ion_device, dev_type;
type gps_device, dev_type;
type qtaguid_device, dev_type;
+type watchdog_device, dev_type;
# All devices have a uart for the hci
# attach service. The uart dev node
diff --git a/file_contexts b/file_contexts
index 3b207c9f0..c47b44b5c 100644
--- a/file_contexts
+++ b/file_contexts
@@ -104,6 +104,7 @@
/dev/urandom u:object_r:urandom_device:s0
/dev/vcs[0-9a-z]* u:object_r:vcs_device:s0
/dev/video[0-9]* u:object_r:video_device:s0
+/dev/watchdog u:object_r:watchdog_device:s0
/dev/xt_qtaguid u:object_r:qtaguid_device:s0
/dev/zero u:object_r:zero_device:s0
#############################
diff --git a/watchdogd.te b/watchdogd.te
new file mode 100644
index 000000000..18824ccf2
--- /dev/null
+++ b/watchdogd.te
@@ -0,0 +1,8 @@
+# watchdogd seclabel is specified in init.<board>.rc
+type watchdogd, domain;
+allow watchdogd rootfs:file { entrypoint r_file_perms };
+allow watchdogd self:capability mknod;
+allow watchdogd device:dir { add_name write remove_name };
+allow watchdogd watchdog_device:chr_file rw_file_perms;
+# because of /dev/__kmsg__ and /dev/__null__
+allow watchdogd device:chr_file create_file_perms;
--
GitLab