common/sensors.te

# Policy for sensor daemon
type sensors, domain;
type sensors_exec, exec_type, file_type;

# Started by init
init_daemon_domain(sensors)

type_transition sensors system_data_file:{ dir file } sensors_data_file;

# Change own perms to (nobody,nobody)
allow sensors self:capability { setuid setgid };
# Chown /data/misc/sensors/debug/ to nobody
allow sensors self:capability chown;
dontaudit sensors self:capability fsetid;

# Access /data/misc/sensors/debug and /data/system/sensors/settings
allow sensors self:capability { dac_override dac_read_search net_bind_service };

# Sensors socket
allow sensors sensors_socket:sock_file create_file_perms;
type_transition sensors socket_device:sock_file sensors_socket "sensor_ctl_socket";
allow sensors socket_device:dir rw_dir_perms;

# Create directories and files under /data/misc/sensors
# and /data/system/sensors. Allow generic r/w file access.
allow sensors system_data_file:dir create_dir_perms;
allow sensors sensors_data_file:dir create_dir_perms;
allow sensors sensors_data_file:file create_file_perms;

# Access sensor nodes (/dev/msm_dsps, /dev/sensors)
allow sensors sensors_device:chr_file rw_file_perms;

# Access to /persist/sensors
allow sensors persist_file:dir r_dir_perms;
allow sensors sensors_persist_file:dir create_dir_perms;
allow sensors sensors_persist_file:file create_file_perms;
allow sensors persist_sns_file:file { read write open getattr };

# Access to execmem
allow sensors self:process execmem;

# Wake lock access
wakelock_use(sensors)

allow sensors cgroup:dir { create add_name };

allow sensors self:socket *;

# Access to other devices
allow sensors smd_device:chr_file rw_file_perms;
allow sensors smem_log_device:chr_file rw_file_perms;
allow sensors device_latency:chr_file w_file_perms;

#diag read/write
diag_rw(sensors);

# Access to tests from userdebug/eng builds
userdebug_or_eng(`
  domain_auto_trans(shell, sensors_exec, sensors)
  allow sensors diag_device:chr_file rw_file_perms;
')