diff options
author | Roberto Gibellini <gibellini.roberto@gmail.com> | 2016-11-19 17:21:50 -0700 |
---|---|---|
committer | Gerrit Code Review <gerrit@cyanogenmod.org> | 2016-11-19 16:36:52 -0800 |
commit | f2a3063bc88ee0a075c04fa274c10c39c7abfc9b (patch) | |
tree | 0042544658ce6961403f6eac79ca6217b8efc5cc /selinux/kickstart.te | |
parent | b8ca7e9e41daaab93c33b136dd8f238606bf9352 (diff) | |
download | device_samsung_i9305-f2a3063bc88ee0a075c04fa274c10c39c7abfc9b.zip device_samsung_i9305-f2a3063bc88ee0a075c04fa274c10c39c7abfc9b.tar.gz device_samsung_i9305-f2a3063bc88ee0a075c04fa274c10c39c7abfc9b.tar.bz2 |
Revert "i9305 : second cleanup"
I'll push single commits
This reverts commit 2f6c7f36412046bd8b67ffbf511ffa74d7cc6842.
Change-Id: I147666b0637e2950612653ad680b7a1f33e173f0
Diffstat (limited to 'selinux/kickstart.te')
-rwxr-xr-x | selinux/kickstart.te | 44 |
1 files changed, 44 insertions, 0 deletions
diff --git a/selinux/kickstart.te b/selinux/kickstart.te new file mode 100755 index 0000000..14e1ad5 --- /dev/null +++ b/selinux/kickstart.te @@ -0,0 +1,44 @@ +# kickstart processes and scripts +type kickstart, domain; +type kickstart_exec, exec_type, file_type; + +# kickstart_checker.sh talks to init over the property socket +unix_socket_connect(kickstart, property, init) + +# Start /system/bin/qcks from init +init_daemon_domain(kickstart) + +# Spawn /system/bin/efsks and /system/bin/ks +allow kickstart kickstart_exec:file { open execute_no_trans getattr }; + +# Run dd on m9kefs[123] block devices; write to /data/qcks/ +# Run cat on firmware and m9kefs[123] data; write to /data/qcks/ +allow kickstart efs_block_device:blk_file rw_file_perms; +allow kickstart kickstart_data_file:file create_file_perms; +allow kickstart kickstart_data_file:dir rw_dir_perms; +allow kickstart radio_efs_file:file r_file_perms; +allow kickstart radio_efs_file:dir search; + +# Let qcks access /dev/mdm node (modem driver) +allow kickstart radio_device:chr_file rw_file_perms; + +# Allow /dev/ttyUSB0 access +allow kickstart radio_device:chr_file { write ioctl getattr }; + +# Allow to run toolbox commands +allow kickstart shell_exec:file rx_file_perms; +# Toolbox commands for firmware dd +allow kickstart system_file:file execute_no_trans; + +# Access to /dev/block/platform/msm_sdcc.1/by-name/m9kefs2 +allow kickstart block_device:dir { getattr write search }; + +# Set system property key +allow kickstart radio_prop:property_service set; + +allow kickstart shell_exec:file entrypoint; +# ls on /data/qcks/ +allow kickstart self:capability { dac_override setuid }; + +# XXX Label sysfs files with a specific type? +allow kickstart sysfs:file rw_file_perms;
\ No newline at end of file |