path: root/sepolicy/system_control.te (plain)
blob: 7aa57f182f542e9247bcec2319f53d86d7f86870

1	type system_control, domain;
2	type system_control_exec, exec_type, vendor_file_type, file_type;
3
4	init_daemon_domain(system_control)
5
6	allow system_control vndbinder_device:chr_file { read write open ioctl };
7	allow system_control vndservicemanager:binder { call transfer };
8	#allow system_control default_android_vndservice:service_manager { add };
9
10	allow system_control hwservicemanager:binder { call transfer };
11	allow system_control { systemcontrol_hwservice hidl_base_hwservice }:hwservice_manager { add };
12
13	allow system_control self:capability dac_override;
14
15	allow system_control sysfs:file rw_file_perms;
16	allow system_control sysfs_devices_system_cpu:file rw_file_perms;
17
18	allow system_control system_control:netlink_kobject_uevent_socket { create setopt bind read shutdown };
19	allow system_control self:capability { net_admin };
20
21	allow system_control vendor_shell_exec:file execute_no_trans;
22
23	#unix_socket_connect(system_control, vold, vold);
24	#unix_socket_connect(system_control, property, init);
25
26	# Property Service write
27	set_prop(system_control, system_prop)
28	set_prop(system_control, dhcp_prop)
29	set_prop(system_control, net_radio_prop)
30	set_prop(system_control, system_radio_prop)
31	set_prop(system_control, debug_prop)
32	set_prop(system_control, powerctl_prop)
33
34	get_prop(system_control, tv_config_prop)
35	get_prop(system_control, bcmdl_prop)
36	get_prop(system_control, safemode_prop)
37	get_prop(system_control, mmc_prop)
38	get_prop(system_control, device_logging_prop)
39
40	set_prop(system_control, media_prop)
41	get_prop(system_control, media_prop)
42	get_prop(system_control, aml_display_prop)
43	set_prop(system_control, uboot_prop)
44	get_prop(system_control, uboot_prop)
45	set_prop(system_control, tv_prop)
46	get_prop(system_control, tv_prop)
47
48	get_prop(system_control, wifi_prop)
49	set_prop(system_control, boottime_prop)
50	get_prop(system_control, boottime_prop)
51
52	#get_prop(system_control, firstboot_prop)
53	#get_prop(system_control, serialno_prop)
54	set_prop(system_control, overlay_prop)
55	get_prop(system_control, overlay_prop)
56	set_prop(system_control, net_dns_prop)
57	get_prop(system_control, net_dns_prop)
58	set_prop(system_control, logpersistd_logging_prop)
59	get_prop(system_control, logpersistd_logging_prop)
60	set_prop(system_control, hwservicemanager_prop)
61	get_prop(system_control, hwservicemanager_prop)
62	set_prop(system_control, dumpstate_options_prop)
63	get_prop(system_control, dumpstate_options_prop)
64	set_prop(system_control, bluetooth_prop)
65	get_prop(system_control, bluetooth_prop)
66
67	set_prop(system_control, persistent_properties_ready_prop)
68	get_prop(system_control, persistent_properties_ready_prop)
69
70	# ctl interface
71	set_prop(system_control, ctl_default_prop)
72	set_prop(system_control, ctl_dhcp_pan_prop)
73	set_prop(system_control, ctl_bugreport_prop)
74
75	allow system_control block_device:dir r_dir_perms;
76
77	allow system_control sysfs_audio_cap:file {open getattr read};
78	allow system_control sysfs_video:file rw_file_perms;
79	allow system_control app_data_file:file rw_file_perms;
80	#allow system_control system_control_service:service_manager add;
81	#allow system_control permission_service:service_manager find;
82	#allow system_control surfaceflinger_service:service_manager find;
83	# Allow system_control to read /proc/pid for all processes
84	r_dir_file(system_control, domain)
85	r_dir_file(system_control, binderservicedomain)
86	r_dir_file(system_control, appdomain)
87	r_dir_file(system_control, platform_app)
88
89
90	allow system_control appdomain:dir { getattr search };
91	allow system_control appdomain:file { r_file_perms };
92	allow system_control platform_app:dir { search };
93
94	allow system_control param_tv_file:dir { search read write open add_name remove_name rmdir };
95	allow system_control param_tv_file:file { create open read write setattr getattr lock unlink };
96
97	#allow system_control shell_exec:file { execute_no_trans execute open read getattr };
98	allow system_control sysfs_digital_codec:file { read write };
99	#allow system_control system_file:file execute_no_trans;
100
101	allow system_control env_device:blk_file { getattr read open write };
102	allow system_control self:capability sys_nice;
103
104	allow system_control system_app:binder { call };
105	allow system_control droidvold_hwservice:hwservice_manager { find };
106	allow system_control droidvold:binder { call };