From e07b8a56b9ce87733024797018543c7faf7e6aa2 Mon Sep 17 00:00:00 2001
From: rpcraig <rpcraig@tycho.ncsc.mil>
Date: Mon, 13 Aug 2012 06:09:39 -0400
Subject: [PATCH] Trusted Execution Environment policy.
---
drmserver.te | 1 +
gpsd.te | 2 ++
keystore.te | 1 +
mediaserver.te | 2 ++
tee.te | 13 +++++++++++++
5 files changed, 19 insertions(+)
create mode 100644 tee.te
diff --git a/drmserver.te b/drmserver.te
index f30033a2f..63286d558 100644
--- a/drmserver.te
+++ b/drmserver.te
@@ -18,3 +18,4 @@ allow drmserver sdcard:dir search;
allow drmserver drm_data_file:dir create_dir_perms;
allow drmserver drm_data_file:file create_file_perms;
allow drmserver self:{ tcp_socket udp_socket } *;
+allow drmserver tee_device:chr_file rw_file_perms;
diff --git a/gpsd.te b/gpsd.te
index bc2893d1e..8010efa0d 100644
--- a/gpsd.te
+++ b/gpsd.te
@@ -12,3 +12,5 @@ type_transition gpsd gps_data_file:sock_file gps_socket;
allow gpsd gps_socket:sock_file create_file_perms;
# XXX Label sysfs files with a specific type?
allow gpsd sysfs:file rw_file_perms;
+
+allow gpsd gps_device:chr_file rw_file_perms;
diff --git a/keystore.te b/keystore.te
index 6c4d61026..20e7222f7 100644
--- a/keystore.te
+++ b/keystore.te
@@ -6,3 +6,4 @@ init_daemon_domain(keystore)
allow keystore keystore_data_file:dir create_dir_perms;
allow keystore keystore_data_file:notdevfile_class_set create_file_perms;
allow keystore keystore_exec:file { getattr };
+allow keystore tee_device:chr_file rw_file_perms;
diff --git a/mediaserver.te b/mediaserver.te
index c8adf3ac1..e124db052 100644
--- a/mediaserver.te
+++ b/mediaserver.te
@@ -42,3 +42,5 @@ allow mediaserver qtaguid_proc:file rw_file_perms;
allow mediaserver qtaguid_device:chr_file r_file_perms;
# Allow abstract socket connection
allow mediaserver rild:unix_stream_socket connectto;
+
+allow mediaserver tee_device:chr_file rw_file_perms;
diff --git a/tee.te b/tee.te
new file mode 100644
index 000000000..ce4e2b6f7
--- /dev/null
+++ b/tee.te
@@ -0,0 +1,13 @@
+##
+# trusted execution environment (tee) daemon
+#
+type tee, domain;
+type tee_exec, exec_type, file_type;
+type tee_device, dev_type;
+type tee_data_file, file_type, data_file_type;
+
+init_daemon_domain(tee)
+allow tee self:capability { dac_override };
+allow tee tee_device:chr_file rw_file_perms;
+allow tee tee_data_file:dir { getattr write add_name };
+allow tee tee_data_file:file create_file_perms;
--
GitLab