1# HwBinder IPC from client to server
2binder_call(hal_configstore_client, hal_configstore_server)
3
4hal_attribute_hwservice(hal_configstore, hal_configstore_ISurfaceFlingerConfigs)
5
6# hal_configstore runs with a strict seccomp filter. Use crash_dump's
7# fallback path to collect crash data.
8crash_dump_fallback(hal_configstore_server)
9
10###
11### neverallow rules
12###
13
14# Should never execute an executable without a domain transition
15neverallow hal_configstore_server { file_type fs_type }:file execute_no_trans;
16
17# Should never need network access. Disallow sockets except for
18# for unix stream/dgram sockets used for logging/debugging.
19neverallow hal_configstore_server domain:{
20  rawip_socket tcp_socket udp_socket
21  netlink_route_socket netlink_selinux_socket
22  socket netlink_socket packet_socket key_socket appletalk_socket
23  netlink_tcpdiag_socket netlink_nflog_socket
24  netlink_xfrm_socket netlink_audit_socket
25  netlink_dnrt_socket netlink_kobject_uevent_socket tun_socket
26  netlink_iscsi_socket netlink_fib_lookup_socket netlink_connector_socket
27  netlink_netfilter_socket netlink_generic_socket netlink_scsitransport_socket
28  netlink_rdma_socket netlink_crypto_socket
29} *;
30neverallow hal_configstore_server {
31  domain
32  -hal_configstore_server
33  -logd
34  userdebug_or_eng(`-su')
35  -tombstoned
36  userdebug_or_eng(`-heapprofd')
37  userdebug_or_eng(`-traced_perf')
38}:{ unix_dgram_socket unix_stream_socket } *;
39
40# Should never need access to anything on /data
41neverallow hal_configstore_server {
42  data_file_type
43  -anr_data_file # for crash dump collection
44  -tombstone_data_file # for crash dump collection
45  -zoneinfo_data_file # granted to domain
46  with_native_coverage(`-method_trace_data_file')
47}:{ file fifo_file sock_file } *;
48
49# Should never need sdcard access
50neverallow hal_configstore_server {
51    sdcard_type
52    fuse sdcardfs vfat exfat        # manual expansion for completeness
53}:dir ~getattr;
54neverallow hal_configstore_server {
55    sdcard_type
56    fuse sdcardfs vfat exfat        # manual expansion for completeness
57}:file *;
58
59# Do not permit access to service_manager and vndservice_manager
60neverallow hal_configstore_server *:service_manager *;
61
62# No privileged capabilities
63neverallow hal_configstore_server self:capability_class_set *;
64
65# No ptracing other processes
66neverallow hal_configstore_server *:process ptrace;
67
68# no relabeling
69neverallow hal_configstore_server *:dir_file_class_set { relabelfrom relabelto };
70