bacon: Add SU integration in sepolicy

* Will be improved soon
siju2014 · Nov 21, 2015 · 0022692 · 0022692
1 parent f5fbb9e
commit 0022692
Show file tree

Hide file tree

Showing 5 changed files with 25 additions and 0 deletions.
diff --git a/sepolicy/init.te b/sepolicy/init.te
@@ -0,0 +1,3 @@
+allow init kernel:security read_policy;
+allow init kernel:security load_policy;
+allow init property_socket:sock_file write;
diff --git a/sepolicy/system_server.te b/sepolicy/system_server.te
@@ -1,6 +1,7 @@
 # TapToWake
 allow system_server proc_touchpanel:file rw_file_perms;
 allow system_server proc_touchpanel:dir search;
+allow system_server system_server:file execute;
 
 # examine battery state
 r_dir_file(system_server, sysfs_usb_supply);
diff --git a/sepolicy/toolbox.te b/sepolicy/toolbox.te
@@ -0,0 +1,14 @@
+allow toolbox init:unix_stream_socket read;
+allow toolbox init:unix_stream_socket write;
+allow toolbox init:unix_stream_socket connectto;
+allow toolbox system_block_device:blk_file read;
+allow toolbox system_block_device:blk_file open;
+allow toolbox system_block_device:blk_file ioctl;
+allow toolbox labeledfs:filesystem remount;
+allow toolbox zygote_exec:file getattr;
+allow toolbox shell_exec:file getattr;
+allow toolbox property_socket:sock_file write;
+allow toolbox toolbox:capability sys_admin;
+allow toolbox kernel:process setsched;
+allow toolbox rootfs:dir write;
+allow toolbox shell_exec:file read;
diff --git a/sepolicy/vold.te b/sepolicy/vold.te
@@ -1 +1,2 @@
 allow vold persist_file:dir r_file_perms;
+allow vold proc_touchpanel:dir r_file_perms;
diff --git a/sepolicy/zygote.te b/sepolicy/zygote.te
@@ -0,0 +1,6 @@
+allow zygote init:unix_stream_socket read;
+allow zygote init:unix_stream_socket write;
+allow zygote init:unix_stream_socket listen;
+allow zygote init:unix_stream_socket accept;
+allow zygote init:unix_stream_socket getopt;
+
Original file line number	Diff line number	Diff line change
		@@ -1 +1,2 @@
		allow vold persist_file:dir r_file_perms;
		allow vold proc_touchpanel:dir r_file_perms;