Skip to content
Snippets Groups Projects
Commit 67531bbd authored by Jeff Vander Stoep's avatar Jeff Vander Stoep
Browse files

Assign su as a client to all HAL domains

VTS testing is intended to be run on userdebug builds with:
1. Tests running in the permissive su domain.
2. HALs running in enforcing mode (i.e. setenforce 1).

As such su needs to be a client to every HAL.

Example:
hal_tetheroffload_server has permission to receive and use a
netlink_netfilter_socket from hal_tetheroffload_client (currently
system_server). Before declaring su as hal_tetheroffload_client
VTS tests were failing with the following denials:

avc: denied { setopt } for comm="HwBinder:843_1"
scontext=u:r:hal_tetheroffload_default:s0 tcontext=u:r:su:s0
tclass=netlink_netfilter_socket
avc: denied { read write } for comm="VtsHalTetheroff"
path="socket:[216191]" dev="sockfs" ino=216191
scontext=u:r:hal_tetheroffload_default:s0 tcontext=u:r:su:s0
tclass=netlink_netfilter_socket
avc: denied { getattr } for comm="HwBinder:843_1"
scontext=u:r:hal_tetheroffload_default:s0 tcontext=u:r:su:s0
tclass=netlink_netfilter_socketsu acting as client to hal_tetheroffload_server passes it
a netlink_netfilter_socket, permissions which are already granted to
hal_tetheroffload_client

With su declared as hal_tetheroffload_client tests pass as expected.

Bug: 36792117
Test: build
Change-Id: If2d3978eee0f96e50ad0c0cc6afc0f18b2d264f2
parent 6f92d408
No related branches found
No related tags found
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment