am bf696327: DO NOT MERGE: Remove service_manager audit_allows.

* commit 'bf696327':
  DO NOT MERGE: Remove service_manager audit_allows.

adbd.te

@@ -68,9 +68,3 @@ allow adbd appdomain:unix_stream_socket connectto;
 # ndk-gdb invokes adb pull of app_process, linker, and libc.so.
 allow adbd zygote_exec:file r_file_perms;
 allow adbd system_file:file r_file_perms;
-
-service_manager_local_audit_domain(adbd)
-auditallow adbd {
-    service_manager_type
-    -surfaceflinger_service
-}:service_manager find;

attributes

@@ -67,6 +67,3 @@ attribute bluetoothdomain;
 
 # All domains used for binder service domains.
 attribute binderservicedomain;
-
-# All domains that are excluded from the domain.te auditallow.
-attribute service_manager_local_audit;

bluetooth.te

@@ -49,15 +49,6 @@ allow bluetooth bluetooth_prop:property_service set;
 allow bluetooth pan_result_prop:property_service set;
 allow bluetooth ctl_dhcp_pan_prop:property_service set;
 
-# Audited locally.
-service_manager_local_audit_domain(bluetooth)
-auditallow bluetooth {
-    service_manager_type
-    -bluetooth_service
-    -radio_service
-    -system_server_service
-}:service_manager find;
-
 ###
 ### Neverallow rules
 ###

bootanim.te

@@ -11,7 +11,3 @@ allow bootanim gpu_device:chr_file rw_file_perms;
 
 # /oem access
 allow bootanim oemfs:dir search;
-
-# Audited locally.
-service_manager_local_audit_domain(bootanim)
-auditallow bootanim { service_manager_type -surfaceflinger_service }:service_manager find;

domain.te

@@ -159,9 +159,7 @@ allow domain asec_public_file:file r_file_perms;
 allow domain { asec_public_file asec_apk_file }:dir r_dir_perms;
 
 allow domain servicemanager:service_manager list;
-auditallow domain servicemanager:service_manager list;
 allow domain service_manager_type:service_manager find;
-auditallow { domain -service_manager_local_audit } service_manager_type:service_manager find;
 
 ###
 ### neverallow rules

drmserver.te

@@ -46,11 +46,3 @@ allow drmserver asec_apk_file:file { read getattr };
 allow drmserver radio_data_file:file { read getattr };
 
 allow drmserver drmserver_service:service_manager add;
-
-# Audited locally.
-service_manager_local_audit_domain(drmserver)
-auditallow drmserver {
-    service_manager_type
-    -drmserver_service
-    -system_server_service
-}:service_manager find;

dumpstate.te

@@ -96,18 +96,3 @@ control_logd(dumpstate)
 # Read network state info files.
 allow dumpstate net_data_file:dir search;
 allow dumpstate net_data_file:file r_file_perms;
-
-service_manager_local_audit_domain(dumpstate)
-auditallow dumpstate {
-    service_manager_type
-    -drmserver_service
-    -healthd_service
-    -inputflinger_service
-    -keystore_service
-    -mediaserver_service
-    -nfc_service
-    -radio_service
-    -surfaceflinger_service
-    -system_app_service
-    -system_server_service
-}:service_manager find;

healthd.te

@@ -34,10 +34,6 @@ allow healthd self:capability sys_boot;
 
 allow healthd healthd_service:service_manager add;
 
-# Audited locally.
-service_manager_local_audit_domain(healthd)
-auditallow healthd { service_manager_type -healthd_service }:service_manager find;
-
 # Healthd needs to tell init to continue the boot
 # process when running in charger mode.
 unix_socket_connect(healthd, property, init)

inputflinger.te

@@ -9,7 +9,3 @@ binder_service(inputflinger)
 binder_call(inputflinger, system_server)
 
 allow inputflinger inputflinger_service:service_manager add;
-
-# Audited locally.
-service_manager_local_audit_domain(inputflinger)
-auditallow inputflinger { service_manager_type -inputflinger_service }:service_manager find;

isolated_app.te

@@ -18,12 +18,3 @@ net_domain(isolated_app)
 # Needed to allow dlopen() from Chrome renderer processes.
 # See b/15902433 for details.
 allow isolated_app app_data_file:file execute;
-
-# Audited locally.
-service_manager_local_audit_domain(isolated_app)
-auditallow isolated_app {
-    service_manager_type
-    -radio_service
-    -surfaceflinger_service
-    -system_server_service
-}:service_manager find;

keystore.te

@@ -28,9 +28,5 @@ neverallow domain keystore:process ptrace;
 
 allow keystore keystore_service:service_manager add;
 
-# Audited locally.
-service_manager_local_audit_domain(keystore)
-auditallow keystore { service_manager_type -keystore_service }:service_manager find;
-
 # Check SELinux permissions.
 selinux_check_access(keystore)

mediaserver.te

@@ -79,13 +79,3 @@ unix_socket_connect(mediaserver, bluetooth, bluetooth)
 allow mediaserver tee:unix_stream_socket connectto;
 
 allow mediaserver mediaserver_service:service_manager add;
-
-# Audited locally.
-service_manager_local_audit_domain(mediaserver)
-auditallow mediaserver {
-    service_manager_type
-    -drmserver_service
-    -mediaserver_service
-    -system_server_service
-    -surfaceflinger_service
-}:service_manager find;

nfc.te

@@ -15,12 +15,3 @@ allow nfc sysfs_nfc_power_writable:file rw_file_perms;
 allow nfc sysfs:file write;
 
 allow nfc nfc_service:service_manager add;
-
-# Audited locally.
-service_manager_local_audit_domain(nfc)
-auditallow nfc {
-    service_manager_type
-    -mediaserver_service
-    -surfaceflinger_service
-    -system_server_service
-}:service_manager find;

platform_app.te

@@ -27,13 +27,3 @@ allow platform_app media_rw_data_file:file create_file_perms;
 # Write to /cache.
 allow platform_app cache_file:dir create_dir_perms;
 allow platform_app cache_file:file create_file_perms;
-
-# Audited locally.
-service_manager_local_audit_domain(platform_app)
-auditallow platform_app {
-    service_manager_type
-    -mediaserver_service
-    -radio_service
-    -surfaceflinger_service
-    -system_server_service
-}:service_manager find;

radio.te

@@ -28,13 +28,3 @@ auditallow radio system_radio_prop:property_service set;
 allow radio ctl_rildaemon_prop:property_service set;
 
 allow radio radio_service:service_manager add;
-
-# Audited locally.
-service_manager_local_audit_domain(radio)
-auditallow radio {
-    service_manager_type
-    -mediaserver_service
-    -radio_service
-    -surfaceflinger_service
-    -system_server_service
-}:service_manager find;

surfaceflinger.te

@@ -59,14 +59,6 @@ allow surfaceflinger tee_device:chr_file rw_file_perms;
 
 allow surfaceflinger surfaceflinger_service:service_manager add;
 
-# Audited locally.
-service_manager_local_audit_domain(surfaceflinger)
-auditallow surfaceflinger {
-    service_manager_type
-    -surfaceflinger_service
-    -system_server_service
-}:service_manager find;
-
 ###
 ### Neverallow rules
 ###

system_app.te

@@ -64,14 +64,3 @@ allow system_app keystore:keystore_key {
 };
 
 control_logd(system_app)
-
-# Audited locally.
-service_manager_local_audit_domain(system_app)
-auditallow system_app {
-    service_manager_type
-    -keystore_service
-    -nfc_service
-    -radio_service
-    -surfaceflinger_service
-    -system_server_service
-}:service_manager find;

system_server.te

@@ -362,9 +362,6 @@ allow system_server pstorefs:file r_file_perms;
 
 allow system_server system_server_service:service_manager add;
 
-# Audited locally.
-service_manager_local_audit_domain(system_server)
-
 allow system_server keystore:keystore_key {
 	test
 	get

te_macros

@@ -109,7 +109,6 @@ typeattribute $1 appdomain;
 tmpfs_domain($1)
 # Map with PROT_EXEC.
 allow $1 $1_tmpfs:file execute;
-service_manager_local_audit_domain($1)
 ')
 
 #####################################
@@ -359,11 +358,3 @@ define(`use_keystore', `
   allow keystore $1:process getattr;
   binder_call($1, keystore)
 ')
-
-###########################################
-# service_manager_local_audit_domain(domain)
-# Has its own auditallow rule on service_manager
-# and should be excluded from the domain.te auditallow.
-define(`service_manager_local_audit_domain', `
-  typeattribute $1 service_manager_local_audit;
-')

untrusted_app.te

@@ -64,19 +64,6 @@ allow untrusted_app media_rw_data_file:file create_file_perms;
 allow untrusted_app cache_file:dir create_dir_perms;
 allow untrusted_app cache_file:file create_file_perms;
 
-# Audited locally.
-service_manager_local_audit_domain(untrusted_app)
-auditallow untrusted_app {
-    service_manager_type
-    -drmserver_service
-    -keystore_service
-    -mediaserver_service
-    -nfc_service
-    -radio_service
-    -surfaceflinger_service
-    -system_server_service
-}:service_manager find;
-
 ###
 ### neverallow rules
 ###