blob: 7bd11f65ba1c408e19d8fe0b42c8fad2a7dff61f
1 | type system_control, domain; |
2 | type system_control_exec, exec_type, vendor_file_type, file_type; |
3 | |
4 | init_daemon_domain(system_control) |
5 | |
6 | allow system_control vndbinder_device:chr_file { read write open ioctl }; |
7 | allow system_control vndservicemanager:binder { call transfer }; |
8 | #allow system_control default_android_vndservice:service_manager { add }; |
9 | |
10 | allow system_control hwservicemanager:binder { call transfer }; |
11 | allow system_control { systemcontrol_hwservice hidl_base_hwservice }:hwservice_manager { add }; |
12 | |
13 | allow system_control sysfs:file rw_file_perms; |
14 | allow system_control sysfs_devices_system_cpu:file rw_file_perms; |
15 | |
16 | allow system_control system_control:netlink_kobject_uevent_socket { create setopt bind read shutdown }; |
17 | allow system_control self:capability { net_admin }; |
18 | |
19 | allow system_control unify_device:chr_file { ioctl open read write }; |
20 | |
21 | allow system_control vendor_shell_exec:file execute_no_trans; |
22 | allow system_control vendor_file:file execute_no_trans; |
23 | |
24 | allow system_control sysfs_display:dir search; |
25 | allow system_control sysfs_di:dir search; |
26 | #unix_socket_connect(system_control, vold, vold); |
27 | #unix_socket_connect(system_control, property, init); |
28 | |
29 | allow system_control mnt_vendor_file:dir { add_name write }; |
30 | allow system_control mnt_vendor_file:file { create open read write }; |
31 | allow system_control sysfs_amvdec:file { open read write }; |
32 | |
33 | allow system_control mnt_vendor_file:dir { search read open remove_name rmdir }; |
34 | allow system_control mnt_vendor_file:file { setattr getattr lock unlink }; |
35 | |
36 | # Property Service write |
37 | #--------------------------------------------------------------------# |
38 | # product_shipping_api_level=28 vendor/system cannot share prop |
39 | #--------------------------------------------------------------------# |
40 | get_prop(system_control, tv_config_prop) |
41 | get_prop(system_control, bcmdl_prop) |
42 | get_prop(system_control, safemode_prop) |
43 | get_prop(system_control, mmc_prop) |
44 | get_prop(system_control, device_logging_prop) |
45 | get_prop(system_control, vendor_platform_prop) |
46 | set_prop(system_control, vendor_platform_prop) |
47 | get_prop(system_control, vendor_default_prop) |
48 | |
49 | set_prop(system_control, media_prop) |
50 | get_prop(system_control, media_prop) |
51 | get_prop(system_control, aml_display_prop) |
52 | set_prop(system_control, uboot_prop) |
53 | get_prop(system_control, uboot_prop) |
54 | set_prop(system_control, tv_prop) |
55 | get_prop(system_control, tv_prop) |
56 | |
57 | set_prop(system_control, vendor_persist_prop) |
58 | get_prop(system_control, vendor_persist_prop) |
59 | |
60 | set_prop(system_control, netflix_prop) |
61 | get_prop(system_control, netflix_prop) |
62 | |
63 | #get_prop(system_control, wifi_prop) |
64 | set_prop(system_control, boottime_prop) |
65 | get_prop(system_control, boottime_prop) |
66 | |
67 | set_prop(system_control, overlay_prop) |
68 | get_prop(system_control, overlay_prop) |
69 | set_prop(system_control, net_dns_prop) |
70 | get_prop(system_control, net_dns_prop) |
71 | set_prop(system_control, logpersistd_logging_prop) |
72 | get_prop(system_control, logpersistd_logging_prop) |
73 | set_prop(system_control, hwservicemanager_prop) |
74 | get_prop(system_control, hwservicemanager_prop) |
75 | set_prop(system_control, dumpstate_options_prop) |
76 | #set_prop(system_control, bluetooth_prop) |
77 | #get_prop(system_control, bluetooth_prop) |
78 | |
79 | set_prop(system_control, persistent_properties_ready_prop) |
80 | get_prop(system_control, persistent_properties_ready_prop) |
81 | |
82 | get_prop(system_control, system_boot_reason_prop) |
83 | # ctl interface |
84 | set_prop(system_control, ctl_default_prop) |
85 | set_prop(system_control, ctl_dhcp_pan_prop) |
86 | set_prop(system_control, ctl_bugreport_prop) |
87 | |
88 | allow system_control block_device:dir r_dir_perms; |
89 | |
90 | allow system_control sysfs_audio_cap:file {open getattr read}; |
91 | allow system_control sysfs_audio:file {open getattr read}; |
92 | allow system_control sysfs_video:file rw_file_perms; |
93 | allow system_control { sysfs_video sysfs_cec sysfs_am_vecm }:dir { search }; |
94 | allow system_control sysfs_cec:file rw_file_perms; |
95 | |
96 | #allow system_control app_data_file:file rw_file_perms; |
97 | |
98 | r_dir_file(system_control, domain) |
99 | r_dir_file(system_control, binderservicedomain) |
100 | r_dir_file(system_control, appdomain) |
101 | r_dir_file(system_control, platform_app) |
102 | |
103 | |
104 | allow system_control appdomain:dir { getattr search }; |
105 | allow system_control appdomain:file { r_file_perms }; |
106 | allow system_control platform_app:dir { search }; |
107 | |
108 | allow system_control param_tv_file:dir { search read write open add_name remove_name rmdir create }; |
109 | allow system_control param_tv_file:file { create open read write setattr getattr lock unlink }; |
110 | |
111 | #allow system_control shell_exec:file { execute_no_trans execute open read getattr }; |
112 | allow system_control sysfs_digital_codec:file { read write }; |
113 | #allow system_control system_file:file execute_no_trans; |
114 | |
115 | allow system_control { env_device cri_block_device }:blk_file { getattr read open write }; |
116 | allow system_control self:capability sys_nice; |
117 | |
118 | allow system_control system_app:binder { call }; |
119 | allow system_control droidvold_hwservice:hwservice_manager { find }; |
120 | allow system_control droidvold:binder { call }; |
121 | |
122 | |
123 | allow system_control { video_device amvecm_device }:chr_file { read write open ioctl getattr }; |
124 | allow system_control di0_device:chr_file { read write open ioctl }; |
125 | allow system_control param_tv_file:dir { write search add_name create }; |
126 | allow system_control param_tv_file:file { create read write open getattr ioctl}; |
127 | allow system_control sysfs_amhdmitx:dir search; |
128 | allow system_control sysfs_amvdec:file { create open read write getattr}; |
129 | allow system_control sysfs_xbmc:file { read open }; |
130 | |
131 | allow system_control vendor_configs_file:file { ioctl lock }; |
132 | allow system_control sysfs_display:lnk_file { read write open getattr }; |
133 | allow system_control { sysfs_display sysfs_am_vecm sysfs_display sysfs_amhdmitx }:file { read write open getattr }; |
134 | |
135 | allow system_control sysfs_unifykey:dir { search }; |
136 | allow system_control sysfs_unifykey:file { read write open }; |
137 | allow system_control unlabeled:dir search; |
138 | allow system_control sysfs_mpgpu:file rw_file_perms ; |
139 | allow system_control hdmirx0_device:chr_file { read write open ioctl getattr }; |
140 | |
141 | allow system_control exported_system_prop:file { read } ; |
142 | get_prop(system_control, exported_system_prop); |
143 | |
144 | allow system_control tvserver:binder { call transfer }; |
145 | allow system_control tvserver_hwservice:hwservice_manager find; |
146 | allow system_control sysfs_leds:dir search; |
147 | |
148 | allow system_control hal_keymaster_hwservice:hwservice_manager { find }; |
149 | allow system_control hal_keymaster_default:binder { call }; |
150 |