port-bridge: Fix denials seen on startup.
Move port-bridge to confined domain and add policies for denials seen
on startup
Allow operations on sockets
[ 21.705807] type=1400 audit(1637.259:22): avc: denied { create } for
pid=993 comm="port-bridge" scontext=u:r:port-bridge:s0 tcontext=
u:r:port-bridge:s0 tclass=netlink_kobject_uevent_socket permissive=1
[ 21.707349] type=1400 audit(1637.259:23): avc: denied { bind } for
pid=993 comm="port-bridge" scontext=u:r:port-bridge:s0 tcontext=
u:r:port-bridge:s0 tclass=netlink_kobject_uevent_socket permissive=1
[ 26.487757] type=1400 audit(1642.049:33): avc: denied { read } for
pid=1681 comm="port-bridge" scontext=u:r:port-bridge:s0 tcontext=
u:r:port-bridge:s0 tclass=netlink_kobject_uevent_socket permissive=1
Allow capabilities
[ 26.487857] type=1400 audit(1642.049:34): avc: denied { dac_override }
for pid=1679 comm="port-bridge" capability=1 scontext=u:r:port-bridge:s0
tcontext=u:r:port-bridge:s0 tclass=capability permissive=1
Allow operations on mhi transport
[ 26.488010] type=1400 audit(1642.049:35): avc: denied { read write }
for pid=1679 comm="port-bridge" name="mhi_pipe_32" dev="tmpfs" ino=12840
scontext=u:r:port-bridge:s0 tcontext=u:object_r:mhi_device:s0
tclass=chr_file permissive=1
[ 26.488093] type=1400 audit(1642.049:36): avc: denied { open } for
pid=1679 comm="port-bridge" path="/dev/mhi_pipe_32" dev="tmpfs" ino=12840
scontext=u:r:port-bridge:s0 tcontext=u:object_r:mhi_device:s0
tclass=chr_file permissive=1
Allow operations on gadget serial device
[ 26.488203] type=1400 audit(1642.049:37): avc: denied { read write }
for pid=1679 comm="port-bridge" name="ttyGS0" dev="tmpfs" ino=10594
scontext=u:r:port-bridge:s0 tcontext=u:object_r:device:s0 tclass=chr_file
permissive=1
[ 26.488267] type=1400 audit(1642.049:38): avc: denied { open } for
pid=1679 comm="port-bridge" path="/dev/ttyGS0" dev="tmpfs" ino=10594
scontext=u:r:port-bridge:s0 tcontext=u:object_r:device:s0 tclass=chr_file
permissive=1
[ 26.488333] type=1400 audit(1642.049:39): avc: denied { ioctl } for
pid=1679 comm="port-bridge" path="/dev/ttyGS0" dev="tmpfs" ino=10594
scontext=u:r:port-bridge:s0 tcontext=u:object_r:device:s0 tclass=chr_file
permissive=1
Change-Id: I7744f75943ebbd4e88193e7d34c9bbd1bf3e4478
diff --git a/common/port-bridge.te b/common/port-bridge.te
new file mode 100644
index 0000000..3a737d7
--- /dev/null
+++ b/common/port-bridge.te
@@ -0,0 +1,20 @@
+type port-bridge, domain;
+type port-bridge_exec, exec_type, file_type;
+init_daemon_domain(port-bridge)
+
+userdebug_or_eng(`
+ domain_auto_trans(shell, port-bridge_exec, netmgrd)
+ domain_auto_trans(adbd, port-bridge_exec, netmgrd)
+')
+
+#Allow operations on different types of sockets
+allow port-bridge port-bridge:netlink_kobject_uevent_socket { create bind read };
+
+#Allow process capabilities
+allow port-bridge port-bridge:capability { dac_override };
+
+#Allow operations on mhi transport
+allow port-bridge mhi_device:chr_file rw_file_perms;
+
+#Allow operations on gadget serial device
+allow port-bridge gadget_serial_device:chr_file { rw_file_perms };