63 lines
3.3 KiB
Plaintext
63 lines
3.3 KiB
Plaintext
# vendor/oxmc/vesperprofiled/sepolicy/vesperprofiled.te
|
|
# SELinux policy for the vesperprofiled system daemon (Android/AOSP).
|
|
#
|
|
# To activate, add to your device's BoardConfig.mk:
|
|
# BOARD_SEPOLICY_DIRS += vendor/oxmc/vesperprofiled/sepolicy
|
|
|
|
# ── Type declarations ──────────────────────────────────────────────────────
|
|
|
|
type vesperprofiled, domain;
|
|
type vesperprofiled_exec, exec_type, file_type, system_file_type;
|
|
type vesperprofiled_data_file, file_type, data_file_type;
|
|
type vesperprofiled_service, service_manager_type;
|
|
|
|
# ── Domain transition ──────────────────────────────────────────────────────
|
|
|
|
init_daemon_domain(vesperprofiled)
|
|
|
|
# ── Binder IPC ────────────────────────────────────────────────────────────
|
|
|
|
binder_use(vesperprofiled)
|
|
add_service(vesperprofiled, vesperprofiled_service)
|
|
|
|
# Allow system apps and shell to call into vesperprofiled via Binder
|
|
binder_call(system_app, vesperprofiled)
|
|
binder_call(shell, vesperprofiled)
|
|
|
|
# ── Profile data directory ────────────────────────────────────────────────
|
|
|
|
allow vesperprofiled vesperprofiled_data_file:dir { create search getattr setattr add_name remove_name };
|
|
allow vesperprofiled vesperprofiled_data_file:file { create open read write getattr setattr unlink rename };
|
|
|
|
# ── System file access (CA certs for signature chain validation) ──────────
|
|
|
|
allow vesperprofiled system_file:dir { search getattr };
|
|
allow vesperprofiled system_file:file { open read getattr };
|
|
|
|
# ── Network (ZTE HTTPS lookups) ───────────────────────────────────────────
|
|
|
|
allow vesperprofiled self:tcp_socket { create connect read write shutdown };
|
|
allow vesperprofiled self:udp_socket { create connect read write };
|
|
allow vesperprofiled port:tcp_socket name_connect;
|
|
|
|
# ── Logging ───────────────────────────────────────────────────────────────
|
|
|
|
allow vesperprofiled log_device:chr_file { open read write };
|
|
|
|
# ── System properties (ZTE state and MDM enrollment state) ───────────────
|
|
|
|
set_prop(vesperprofiled, vesperos_prop)
|
|
get_prop(vesperprofiled, vesperos_prop)
|
|
|
|
# ── DevicePolicyManager / KeyStore Binder calls ───────────────────────────
|
|
|
|
allow vesperprofiled device_policy_service:service_manager { find };
|
|
allow vesperprofiled keystore_service:service_manager { find };
|
|
binder_call(vesperprofiled, system_server)
|
|
binder_call(vesperprofiled, keystore)
|
|
|
|
# ── Process self-permissions ──────────────────────────────────────────────
|
|
|
|
allow vesperprofiled self:process { fork sigchld };
|
|
allow vesperprofiled self:unix_stream_socket { create connect read write };
|