blob: f71c444496a4756ada9c6f6cbe35bc4e255d0331 [file] [log] [blame]
# Policy for sensor daemon
type sensors, domain;
type sensors_exec, exec_type, file_type;
# Started by init
init_daemon_domain(sensors)
type_transition sensors system_data_file:{ dir file } sensors_data_file;
# Change own perms to (nobody,nobody)
allow sensors self:capability { setuid setgid };
# Chown /data/misc/sensors/debug/ to nobody
allow sensors self:capability chown;
dontaudit sensors self:capability fsetid;
# Access /data/misc/sensors/debug and /data/system/sensors/settings
allow sensors self:capability { dac_override dac_read_search net_bind_service };
# Sensors socket
allow sensors sensors_socket:sock_file create_file_perms;
type_transition sensors socket_device:sock_file sensors_socket "sensor_ctl_socket";
allow sensors socket_device:dir rw_dir_perms;
# Create directories and files under /data/misc/sensors
# and /data/system/sensors. Allow generic r/w file access.
allow sensors system_data_file:dir create_dir_perms;
allow sensors sensors_data_file:dir create_dir_perms;
allow sensors sensors_data_file:file create_file_perms;
# Access sensor nodes (/dev/msm_dsps, /dev/sensors)
allow sensors sensors_device:chr_file rw_file_perms;
# Access to /persist/sensors
allow sensors persist_file:dir r_dir_perms;
allow sensors sensors_persist_file:dir create_dir_perms;
allow sensors sensors_persist_file:file create_file_perms;
# Wake lock access
wakelock_use(sensors)
allow sensors cgroup:dir { create add_name };
allow sensors self:socket *;
# Access to other devices
allow sensors smd_device:chr_file rw_file_perms;
allow sensors smem_log_device:chr_file rw_file_perms;
allow sensors device_latency:chr_file w_file_perms;
# Access to tests from userdebug/eng builds
userdebug_or_eng(`
domain_auto_trans(shell, sensors_exec, sensors)
allow sensors diag_device:chr_file rw_file_perms;
')