1# HwBinder IPC from client to server
2binder_call(hal_configstore_client, hal_configstore_server)
3
4allow hal_configstore_client hal_configstore_ISurfaceFlingerConfigs:hwservice_manager find;
5
6add_hwservice(hal_configstore_server, hal_configstore_ISurfaceFlingerConfigs)
7# As opposed to the rules of most other HALs, the different services exposed by
8# this HAL should be restricted to different clients. Thus, the allow rules for
9# clients are defined in the .te files of the clients.
10
11# hal_configstore runs with a strict seccomp filter. Use crash_dump's
12# fallback path to collect crash data.
13crash_dump_fallback(hal_configstore_server)
14
15###
16### neverallow rules
17###
18
19# Should never execute an executable without a domain transition
20neverallow hal_configstore_server { file_type fs_type }:file execute_no_trans;
21
22# Should never need network access. Disallow sockets except for
23# for unix stream/dgram sockets used for logging/debugging.
24neverallow hal_configstore_server domain:{
25  rawip_socket tcp_socket udp_socket
26  netlink_route_socket netlink_selinux_socket
27  socket netlink_socket packet_socket key_socket appletalk_socket
28  netlink_tcpdiag_socket netlink_nflog_socket
29  netlink_xfrm_socket netlink_audit_socket
30  netlink_dnrt_socket netlink_kobject_uevent_socket tun_socket
31  netlink_iscsi_socket netlink_fib_lookup_socket netlink_connector_socket
32  netlink_netfilter_socket netlink_generic_socket netlink_scsitransport_socket
33  netlink_rdma_socket netlink_crypto_socket
34} *;
35neverallow hal_configstore_server {
36  domain
37  -hal_configstore_server
38  -logd
39  userdebug_or_eng(`-su')
40  -tombstoned
41}:{ unix_dgram_socket unix_stream_socket } *;
42
43# Should never need access to anything on /data
44neverallow hal_configstore_server {
45  data_file_type
46  -anr_data_file # for crash dump collection
47  -tombstone_data_file # for crash dump collection
48  -zoneinfo_data_file # granted to domain
49}:{ file fifo_file sock_file } *;
50
51# Should never need sdcard access
52neverallow hal_configstore_server { fuse sdcardfs vfat }:file *;
53
54# Do not permit access to service_manager and vndservice_manager
55neverallow hal_configstore_server *:service_manager *;
56
57# No privileged capabilities
58neverallow hal_configstore_server self:capability_class_set *;
59
60# No ptracing other processes
61neverallow hal_configstore_server *:process ptrace;
62
63# no relabeling
64neverallow hal_configstore_server *:dir_file_class_set { relabelfrom relabelto };
65