PawletOS/FrameworkAPI
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update sepolicy/pawlet_device.te

Browse Source
This commit is contained in:
oxmc
2025-08-19 12:52:20 -07:00
parent f48e987043
commit 91e088d936
1 changed files with 10 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
sepolicy/pawlet_device.te
View File

@@ -5,13 +5,17 @@ type pawlet_device_exec, exec_type, file_type, system_file_type;
# Inherit from core domain
typeattribute pawlet_device coredomain;
# Property access
# Property access - use proper macros ONLY
get_prop(pawlet_device, vendor_default_prop)
set_prop(pawlet_device, vendor_default_prop)
# Framework interactions - use standard types
allow pawlet_device system_file:file { read getattr };
allow pawlet_device system_server:service_manager find;
# Framework interactions - use proper macros
# REMOVE direct service_manager access
# allow pawlet_device system_server:service_manager find;
# File access for properties
allow pawlet_device vendor_default_prop:file { getattr open read map };
# REMOVE all direct file access to properties
# allow pawlet_device vendor_default_prop:file { getattr open read map };
# If you need to interact with system services, use proper domains:
allow pawlet_device system_server:binder { call transfer };
allow pawlet_device servicemanager:binder { call transfer };