-
Max Bires authored
There were some auditallow rules left around in rild.te that had logs showing nothing was triggering them. Thus the rules they were auditing could be removed, as that's clear indication there's no use for them. Having rules around that aren't being used does nothing except increase attack surface and bloat sepolicy, and so should always be removed if possible. Test: The device boots Change-Id: I906ffc493807fbae90593548d478643cda4864eb
8aef51e7
rild.te 1.71 KiB
# rild - radio interface layer daemon
type rild, domain, domain_deprecated, hal_telephony;
type rild_exec, exec_type, file_type;
net_domain(rild)
allowxperm rild self:udp_socket ioctl priv_sock_ioctls;
allow rild self:netlink_route_socket nlmsg_write;
allow rild kernel:system module_request;
allow rild self:capability { setpcap setgid setuid net_admin net_raw };
allow rild alarm_device:chr_file rw_file_perms;
allow rild cgroup:dir create_dir_perms;
allow rild cgroup:{ file lnk_file } r_file_perms;
allow rild radio_device:chr_file rw_file_perms;
allow rild radio_device:blk_file r_file_perms;
allow rild mtd_device:dir search;
allow rild efs_file:dir create_dir_perms;
allow rild efs_file:file create_file_perms;
allow rild shell_exec:file rx_file_perms;
allow rild bluetooth_efs_file:file r_file_perms;
allow rild bluetooth_efs_file:dir r_dir_perms;
allow rild radio_data_file:dir rw_dir_perms;
allow rild radio_data_file:file create_file_perms;
allow rild sdcard_type:dir r_dir_perms;
allow rild system_data_file:dir r_dir_perms;
allow rild system_data_file:file r_file_perms;
allow rild system_file:file x_file_perms;
# property service
set_prop(rild, radio_prop)
allow rild tty_device:chr_file rw_file_perms;
# Allow rild to create and use netlink sockets.
allow rild self:netlink_socket create_socket_perms_no_ioctl;
allow rild self:netlink_generic_socket create_socket_perms_no_ioctl;
allow rild self:netlink_kobject_uevent_socket create_socket_perms_no_ioctl;
# Access to wake locks
wakelock_use(rild)
r_dir_file(rild, proc)
r_dir_file(rild, proc_net)
r_dir_file(rild, sysfs_type)
r_dir_file(rild, system_file)
# granting the ioctl permission for rild should be device specific
allow rild self:socket create_socket_perms_no_ioctl;