From 238ce796a41738f1265290c6d6439485112bc0b2 Mon Sep 17 00:00:00 2001
From: Alex Klyubin <klyubin@google.com>
Date: Tue, 7 Feb 2017 10:47:18 -0800
Subject: [PATCH] Move audioserver policy to private

This leaves only the existence of audioserver domain as public API.
All other rules are implementation details of this domain's policy
and are thus now private.

Test: No change to policy according to sesearch, except for
      disappearance of all allow rules to do with audioserver_current
      except those created by other domains' allow rules referencing
      audioserver domain from public and vendor policies.
Bug: 31364497

Change-Id: I6662394d8318781de6e3b0c125435b66581363af
---
 private/audioserver.te | 59 ++++++++++++++++++++++++++++++++++++++++--
 public/audioserver.te  | 55 ---------------------------------------
 2 files changed, 57 insertions(+), 57 deletions(-)

diff --git a/private/audioserver.te b/private/audioserver.te
index 64178583a..88007aaa5 100644
--- a/private/audioserver.te
+++ b/private/audioserver.te
@@ -1,3 +1,58 @@
-# type_transition must be private policy the domain_trans rules could stay
-# public, but conceptually should go with this
+# audioserver - audio services daemon
+
+type audioserver_exec, exec_type, file_type;
 init_daemon_domain(audioserver)
+
+r_dir_file(audioserver, sdcard_type)
+
+binder_use(audioserver)
+binder_call(audioserver, binderservicedomain)
+binder_call(audioserver, appdomain)
+binder_service(audioserver)
+
+hwbinder_use(audioserver)
+binder_call(audioserver, hal_audio)
+hwallocator_use(audioserver)
+
+r_dir_file(audioserver, proc)
+allow audioserver ion_device:chr_file r_file_perms;
+allow audioserver system_file:dir r_dir_perms;
+
+userdebug_or_eng(`
+  # used for TEE sink - pcm capture for debug.
+  allow audioserver media_data_file:dir create_dir_perms;
+  allow audioserver audioserver_data_file:dir create_dir_perms;
+  allow audioserver audioserver_data_file:file create_file_perms;
+
+  # ptrace to processes in the same domain for memory leak detection
+  allow audioserver self:process ptrace;
+')
+
+allow audioserver audio_device:dir r_dir_perms;
+allow audioserver audio_device:chr_file rw_file_perms;
+
+add_service(audioserver, audioserver_service)
+allow audioserver appops_service:service_manager find;
+allow audioserver batterystats_service:service_manager find;
+allow audioserver permission_service:service_manager find;
+allow audioserver power_service:service_manager find;
+allow audioserver scheduling_policy_service:service_manager find;
+
+# Grant access to audio files to audioserver
+allow audioserver audio_data_file:dir ra_dir_perms;
+allow audioserver audio_data_file:file create_file_perms;
+
+# Needed on some devices for playing audio on paired BT device,
+# but seems appropriate for all devices.
+unix_socket_connect(audioserver, bluetooth, bluetooth)
+
+###
+### neverallow rules
+###
+
+# audioserver should never execute any executable without a
+# domain transition
+neverallow audioserver { file_type fs_type }:file execute_no_trans;
+
+# audioserver should never need network access. Disallow network sockets.
+neverallow audioserver domain:{ tcp_socket udp_socket rawip_socket } *;
diff --git a/public/audioserver.te b/public/audioserver.te
index bc0b989ff..9a7285821 100644
--- a/public/audioserver.te
+++ b/public/audioserver.te
@@ -1,57 +1,2 @@
 # audioserver - audio services daemon
 type audioserver, domain;
-type audioserver_exec, exec_type, file_type;
-
-r_dir_file(audioserver, sdcard_type)
-
-binder_use(audioserver)
-binder_call(audioserver, binderservicedomain)
-binder_call(audioserver, appdomain)
-binder_service(audioserver)
-
-hwbinder_use(audioserver)
-binder_call(audioserver, hal_audio)
-hwallocator_use(audioserver)
-
-r_dir_file(audioserver, proc)
-allow audioserver ion_device:chr_file r_file_perms;
-allow audioserver system_file:dir r_dir_perms;
-
-userdebug_or_eng(`
-  # used for TEE sink - pcm capture for debug.
-  allow audioserver media_data_file:dir create_dir_perms;
-  allow audioserver audioserver_data_file:dir create_dir_perms;
-  allow audioserver audioserver_data_file:file create_file_perms;
-
-  # ptrace to processes in the same domain for memory leak detection
-  allow audioserver self:process ptrace;
-')
-
-allow audioserver audio_device:dir r_dir_perms;
-allow audioserver audio_device:chr_file rw_file_perms;
-
-add_service(audioserver, audioserver_service)
-allow audioserver appops_service:service_manager find;
-allow audioserver batterystats_service:service_manager find;
-allow audioserver permission_service:service_manager find;
-allow audioserver power_service:service_manager find;
-allow audioserver scheduling_policy_service:service_manager find;
-
-# Grant access to audio files to audioserver
-allow audioserver audio_data_file:dir ra_dir_perms;
-allow audioserver audio_data_file:file create_file_perms;
-
-# Needed on some devices for playing audio on paired BT device,
-# but seems appropriate for all devices.
-unix_socket_connect(audioserver, bluetooth, bluetooth)
-
-###
-### neverallow rules
-###
-
-# audioserver should never execute any executable without a
-# domain transition
-neverallow audioserver { file_type fs_type }:file execute_no_trans;
-
-# audioserver should never need network access. Disallow network sockets.
-neverallow audioserver domain:{ tcp_socket udp_socket rawip_socket } *;
-- 
GitLab