diff options
author | sbrissen <sbrissen@hotmail.com> | 2013-11-13 09:01:02 -0500 |
---|---|---|
committer | sbrissen <sbrissen@hotmail.com> | 2013-11-13 09:12:59 -0500 |
commit | 7fb9174903c3415abc027c9d4de508946c3011e5 (patch) | |
tree | 05de01c6e9845aa212e8832ba75681bfb35f0b1f /selinux/kickstart.te | |
parent | 0dc75f6b11c6cb5cb40bfda497269ae2d4718446 (diff) | |
download | device_samsung_kona-common-7fb9174903c3415abc027c9d4de508946c3011e5.zip device_samsung_kona-common-7fb9174903c3415abc027c9d4de508946c3011e5.tar.gz device_samsung_kona-common-7fb9174903c3415abc027c9d4de508946c3011e5.tar.bz2 |
kona-common: 4.4 updates
Change-Id: I99fae341e0f1e827608f43a14c9648a9476721ed
Diffstat (limited to 'selinux/kickstart.te')
-rwxr-xr-x | selinux/kickstart.te | 44 |
1 files changed, 44 insertions, 0 deletions
diff --git a/selinux/kickstart.te b/selinux/kickstart.te new file mode 100755 index 0000000..14e1ad5 --- /dev/null +++ b/selinux/kickstart.te @@ -0,0 +1,44 @@ +# kickstart processes and scripts +type kickstart, domain; +type kickstart_exec, exec_type, file_type; + +# kickstart_checker.sh talks to init over the property socket +unix_socket_connect(kickstart, property, init) + +# Start /system/bin/qcks from init +init_daemon_domain(kickstart) + +# Spawn /system/bin/efsks and /system/bin/ks +allow kickstart kickstart_exec:file { open execute_no_trans getattr }; + +# Run dd on m9kefs[123] block devices; write to /data/qcks/ +# Run cat on firmware and m9kefs[123] data; write to /data/qcks/ +allow kickstart efs_block_device:blk_file rw_file_perms; +allow kickstart kickstart_data_file:file create_file_perms; +allow kickstart kickstart_data_file:dir rw_dir_perms; +allow kickstart radio_efs_file:file r_file_perms; +allow kickstart radio_efs_file:dir search; + +# Let qcks access /dev/mdm node (modem driver) +allow kickstart radio_device:chr_file rw_file_perms; + +# Allow /dev/ttyUSB0 access +allow kickstart radio_device:chr_file { write ioctl getattr }; + +# Allow to run toolbox commands +allow kickstart shell_exec:file rx_file_perms; +# Toolbox commands for firmware dd +allow kickstart system_file:file execute_no_trans; + +# Access to /dev/block/platform/msm_sdcc.1/by-name/m9kefs2 +allow kickstart block_device:dir { getattr write search }; + +# Set system property key +allow kickstart radio_prop:property_service set; + +allow kickstart shell_exec:file entrypoint; +# ls on /data/qcks/ +allow kickstart self:capability { dac_override setuid }; + +# XXX Label sysfs files with a specific type? +allow kickstart sysfs:file rw_file_perms;
\ No newline at end of file |