Merge "WFD : Add WFD specific security policies"
diff --git a/Android.mk b/Android.mk
index e4c204a..1e6ffbf 100644
--- a/Android.mk
+++ b/Android.mk
@@ -86,7 +86,8 @@
installd.te \
wcnss_service.te \
mmi.te \
- dhcp.te
+ dhcp.te \
+ wfd_app.te
# Compile sensor pilicy only for SSC targets
SSC_TARGET_LIST := apq8084
diff --git a/common/netd.te b/common/netd.te
index a5e70fa..124178a 100644
--- a/common/netd.te
+++ b/common/netd.te
@@ -1,6 +1,8 @@
#Policies for IPv6 tethering
allow netd netd:capability { setgid setuid };
allow netd netd:packet_socket { create bind setopt read ioctl };
+allow netd wfd_app:fd use;
+allow netd wfd_app:tcp_socket { read write setopt getopt };
dontaudit netd self:capability sys_module;
diff --git a/common/wfd_app.te b/common/wfd_app.te
new file mode 100644
index 0000000..f9b1733
--- /dev/null
+++ b/common/wfd_app.te
@@ -0,0 +1,23 @@
+allow wfd_app init:unix_stream_socket connectto;
+allow wfd_app node:tcp_socket node_bind;
+allow wfd_app port:tcp_socket { name_bind name_connect };
+allow wfd_app self:tcp_socket { bind create setopt listen write read getopt connect accept getattr };
+allow wfd_app dalvikcache_data_file:file { write setattr };
+allow wfd_app graphics_device:chr_file rw_file_perms;
+allow wfd_app graphics_device:dir r_dir_perms;
+allow wfd_app node:udp_socket node_bind;
+allow wfd_app port:udp_socket name_bind;
+allow wfd_app self:udp_socket { bind create getattr write setopt ioctl read getopt };
+allow wfd_app video_device:dir r_dir_perms;
+allow wfd_app video_device:chr_file rw_file_perms;
+allow wfd_app audio_device:dir r_dir_perms;
+allow wfd_app audio_device:chr_file rw_file_perms;
+allow wfd_app fwmarkd_socket:sock_file write;
+allow wfd_app netd:unix_stream_socket connectto;
+allow wfd_app firmware_file:dir r_dir_perms;
+allow wfd_app firmware_file:file r_file_perms;
+allow wfd_app tee_device:chr_file rw_file_perms;
+allow wfd_app media_rw_data_file:dir rw_dir_perms;
+allow wfd_app media_rw_data_file:file create_file_perms;
+allow wfd_app system_app_data_file:dir create_dir_perms;
+allow wfd_app uhid_device:chr_file rw_file_perms;