Assign su as a client to all HAL domains
VTS testing is intended to be run on userdebug builds with: 1. Tests running in the permissive su domain. 2. HALs running in enforcing mode (i.e. setenforce 1). As such su needs to be a client to every HAL. Example: hal_tetheroffload_server has permission to receive and use a netlink_netfilter_socket from hal_tetheroffload_client (currently system_server). Before declaring su as hal_tetheroffload_client VTS tests were failing with the following denials: avc: denied { setopt } for comm="HwBinder:843_1" scontext=u:r:hal_tetheroffload_default:s0 tcontext=u:r:su:s0 tclass=netlink_netfilter_socket avc: denied { read write } for comm="VtsHalTetheroff" path="socket:[216191]" dev="sockfs" ino=216191 scontext=u:r:hal_tetheroffload_default:s0 tcontext=u:r:su:s0 tclass=netlink_netfilter_socket avc: denied { getattr } for comm="HwBinder:843_1" scontext=u:r:hal_tetheroffload_default:s0 tcontext=u:r:su:s0 tclass=netlink_netfilter_socketsu acting as client to hal_tetheroffload_server passes it a netlink_netfilter_socket, permissions which are already granted to hal_tetheroffload_client With su declared as hal_tetheroffload_client tests pass as expected. Bug: 36792117 Test: build Change-Id: If2d3978eee0f96e50ad0c0cc6afc0f18b2d264f2
Loading
Please register or sign in to comment