From e539570694170353ecede5843015b0565f903e6f Mon Sep 17 00:00:00 2001
From: Alex Klyubin <klyubin@google.com>
Date: Wed, 22 Mar 2017 16:08:41 -0700
Subject: [PATCH] Remove unnecessary rules from NFC HAL clients
Rules in clients of NFC HAL due to the HAL running (or previously
running) in passthrough mode are now targeting hal_nfc. Domains which
are clients of NFC HAL are associated with hal_nfc only the the HAL
runs in passthrough mode. NFC HAL server domains are always associated
with hal_nfc and thus get these rules unconditionally.
This commit also moves the policy of nfc domain to private. The only
thing remaining in the public policy is the existence of this domain.
This is needed because there are references to this domain in public
and vendor policy.
Test: Open a URL in Chrome, NFC-tap Android to another Android and
observe that the same URL is opened in a web browser on the
destination device. Do the same reversing the roles of the two
Androids.
Test: Install an NFC reader app, tap a passive NFC tag with the
Android and observe that the app is displaying information about
the tag.
Test: No SELinux denials to do with NFC before and during and after
the above tests on sailfish, bullhead, and angler.
Bug: 34170079
Change-Id: I29fe43f63d64b286c28eb19a3a9fe4f630612226
---
private/nfc.te | 29 +++++++++++++++++++++++++++++
public/hal_nfc.te | 5 +++--
public/nfc.te | 39 ---------------------------------------
3 files changed, 32 insertions(+), 41 deletions(-)
diff --git a/private/nfc.te b/private/nfc.te
index bcfae5b4e..4d1f2ce29 100644
--- a/private/nfc.te
+++ b/private/nfc.te
@@ -1 +1,30 @@
+# nfc subsystem
app_domain(nfc)
+net_domain(nfc)
+
+binder_service(nfc)
+add_service(nfc, nfc_service)
+
+hal_client_domain(nfc, hal_nfc)
+
+# Data file accesses.
+allow nfc nfc_data_file:dir create_dir_perms;
+allow nfc nfc_data_file:notdevfile_class_set create_file_perms;
+
+# SoundPool loading and playback
+allow nfc audioserver_service:service_manager find;
+allow nfc drmserver_service:service_manager find;
+allow nfc mediacodec_service:service_manager find;
+allow nfc mediametrics_service:service_manager find;
+allow nfc mediaextractor_service:service_manager find;
+allow nfc mediaserver_service:service_manager find;
+
+allow nfc radio_service:service_manager find;
+allow nfc surfaceflinger_service:service_manager find;
+allow nfc app_api_service:service_manager find;
+allow nfc system_api_service:service_manager find;
+
+# already open bugreport file descriptors may be shared with
+# the nfc process, from a file in
+# /data/data/com.android.shell/files/bugreports/bugreport-*.
+allow nfc shell_data_file:file read;
diff --git a/public/hal_nfc.te b/public/hal_nfc.te
index 0c4bd9c01..d289ef7f7 100644
--- a/public/hal_nfc.te
+++ b/public/hal_nfc.te
@@ -1,5 +1,6 @@
-# call into NFC process (callbacks)
-binder_call(hal_nfc, nfc)
+# HwBinder IPC from client to server, and callbacks
+binder_call(hal_nfc_client, hal_nfc_server)
+binder_call(hal_nfc_server, hal_nfc_client)
# Set NFC properties (used by bcm2079x HAL).
set_prop(hal_nfc, nfc_prop)
diff --git a/public/nfc.te b/public/nfc.te
index cb6a78198..e3a03e796 100644
--- a/public/nfc.te
+++ b/public/nfc.te
@@ -1,41 +1,2 @@
# nfc subsystem
type nfc, domain;
-
-net_domain(nfc)
-binder_service(nfc)
-
-# hwbinder access
-hwbinder_use(nfc)
-
-# Set NFC properties
-set_prop(nfc, nfc_prop)
-
-# NFC device access.
-allow nfc nfc_device:chr_file rw_file_perms;
-
-# Data file accesses.
-allow nfc nfc_data_file:dir create_dir_perms;
-allow nfc nfc_data_file:notdevfile_class_set create_file_perms;
-
-# SoundPool loading and playback
-allow nfc audioserver_service:service_manager find;
-allow nfc drmserver_service:service_manager find;
-allow nfc mediacodec_service:service_manager find;
-allow nfc mediametrics_service:service_manager find;
-allow nfc mediaextractor_service:service_manager find;
-allow nfc mediaserver_service:service_manager find;
-
-add_service(nfc, nfc_service)
-allow nfc radio_service:service_manager find;
-allow nfc surfaceflinger_service:service_manager find;
-allow nfc app_api_service:service_manager find;
-allow nfc system_api_service:service_manager find;
-
-# already open bugreport file descriptors may be shared with
-# the nfc process, from a file in
-# /data/data/com.android.shell/files/bugreports/bugreport-*.
-allow nfc shell_data_file:file read;
-
-# allow NFC process to call into the NFC HAL
-binder_call(nfc, hal_nfc)
-hal_client_domain(nfc, hal_nfc)
--
GitLab