diff options
Diffstat (limited to 'target/board/generic_x86/sepolicy')
| -rw-r--r-- | target/board/generic_x86/sepolicy/adbd.te | 1 | ||||
| -rw-r--r-- | target/board/generic_x86/sepolicy/device.te | 1 | ||||
| -rw-r--r-- | target/board/generic_x86/sepolicy/file.te | 1 | ||||
| -rw-r--r-- | target/board/generic_x86/sepolicy/file_contexts | 4 | ||||
| -rw-r--r-- | target/board/generic_x86/sepolicy/mediaserver.te | 1 | ||||
| -rw-r--r-- | target/board/generic_x86/sepolicy/qemud.te | 6 | ||||
| -rw-r--r-- | target/board/generic_x86/sepolicy/rild.te | 2 | ||||
| -rw-r--r-- | target/board/generic_x86/sepolicy/system_server.te | 2 |
8 files changed, 18 insertions, 0 deletions
diff --git a/target/board/generic_x86/sepolicy/adbd.te b/target/board/generic_x86/sepolicy/adbd.te new file mode 100644 index 0000000..f65cfb3 --- /dev/null +++ b/target/board/generic_x86/sepolicy/adbd.te @@ -0,0 +1 @@ +allow adbd qemu_device:chr_file rw_file_perms; diff --git a/target/board/generic_x86/sepolicy/device.te b/target/board/generic_x86/sepolicy/device.te new file mode 100644 index 0000000..e4af13c --- /dev/null +++ b/target/board/generic_x86/sepolicy/device.te @@ -0,0 +1 @@ +type qemu_device, dev_type; diff --git a/target/board/generic_x86/sepolicy/file.te b/target/board/generic_x86/sepolicy/file.te new file mode 100644 index 0000000..6fad80a --- /dev/null +++ b/target/board/generic_x86/sepolicy/file.te @@ -0,0 +1 @@ +type qemud_socket, file_type; diff --git a/target/board/generic_x86/sepolicy/file_contexts b/target/board/generic_x86/sepolicy/file_contexts new file mode 100644 index 0000000..f204cde --- /dev/null +++ b/target/board/generic_x86/sepolicy/file_contexts @@ -0,0 +1,4 @@ +/dev/qemu_.* u:object_r:qemu_device:s0 +/dev/socket/qemud u:object_r:qemud_socket:s0 +/system/bin/qemud u:object_r:qemud_exec:s0 +/sys/qemu_trace(/.*)? -- u:object_r:sysfs_writable:s0 diff --git a/target/board/generic_x86/sepolicy/mediaserver.te b/target/board/generic_x86/sepolicy/mediaserver.te new file mode 100644 index 0000000..90b8cf8 --- /dev/null +++ b/target/board/generic_x86/sepolicy/mediaserver.te @@ -0,0 +1 @@ +allow mediaserver qemu_device:chr_file rw_file_perms; diff --git a/target/board/generic_x86/sepolicy/qemud.te b/target/board/generic_x86/sepolicy/qemud.te new file mode 100644 index 0000000..4ff02ec --- /dev/null +++ b/target/board/generic_x86/sepolicy/qemud.te @@ -0,0 +1,6 @@ +# qemu support daemon +type qemud, domain; +type qemud_exec, exec_type, file_type; + +init_daemon_domain(qemud) +unconfined_domain(qemud) diff --git a/target/board/generic_x86/sepolicy/rild.te b/target/board/generic_x86/sepolicy/rild.te new file mode 100644 index 0000000..5de171a --- /dev/null +++ b/target/board/generic_x86/sepolicy/rild.te @@ -0,0 +1,2 @@ +allow rild qemu_device:chr_file rw_file_perms; +unix_socket_connect(rild, qemud, qemud) diff --git a/target/board/generic_x86/sepolicy/system_server.te b/target/board/generic_x86/sepolicy/system_server.te index 5d98a14..9bfe5fe 100644 --- a/target/board/generic_x86/sepolicy/system_server.te +++ b/target/board/generic_x86/sepolicy/system_server.te @@ -1 +1,3 @@ allow system_server self:process execmem; +unix_socket_connect(system_server, qemud, qemud) +allow system_server qemu_device:chr_file rw_file_perms; |