From bc3150afd03f7c5e29048215229d9b47414653c6 Mon Sep 17 00:00:00 2001
From: Michael Schwartz <schwartzmi@google.com>
Date: Thu, 18 May 2017 09:59:05 -0700
Subject: [PATCH] Sepolicy changes for system_server to use libvintf
Test: Boot sailfish with shared system image
Bug: 36814984
Change-Id: I2937c20c3b6ca7bf4edab66a74742c48e76c7687
---
private/file_contexts | 1 +
private/system_server.te | 3 +++
2 files changed, 4 insertions(+)
diff --git a/private/file_contexts b/private/file_contexts
index b13807f79..7384ce8a6 100644
--- a/private/file_contexts
+++ b/private/file_contexts
@@ -282,6 +282,7 @@
# TODO: b/36790901 move this to /vendor/etc
/(vendor|system/vendor)/manifest.xml u:object_r:vendor_configs_file:s0
+/(vendor|system/vendor)/compatibility_matrix.xml u:object_r:vendor_configs_file:s0
/(vendor|system/vendor)/app(/.*)? u:object_r:vendor_app_file:s0
/(vendor|system/vendor)/overlay(/.*)? u:object_r:vendor_overlay_file:s0
/(vendor|system/vendor)/framework(/.*)? u:object_r:vendor_framework_file:s0
diff --git a/private/system_server.te b/private/system_server.te
index 925c82d8d..0e4ecdade 100644
--- a/private/system_server.te
+++ b/private/system_server.te
@@ -86,6 +86,9 @@ allow system_server self:netlink_kobject_uevent_socket create_socket_perms_no_io
allow system_server self:netlink_socket create_socket_perms_no_ioctl;
allow system_server self:netlink_generic_socket create_socket_perms_no_ioctl;
+# libvintf reads the kernel config to verify vendor interface compatibility.
+allow system_server config_gz:file { read open };
+
# Use generic "sockets" where the address family is not known
# to the kernel. The ioctl permission is specifically omitted here, but may
# be added to device specific policy along with the ioctl commands to be
--
GitLab