| Andres Morales | e207986 | 2015-04-03 16:46:33 -0700 | [diff] [blame] | 1 | type gatekeeperd, domain; |
| 2 | type gatekeeperd_exec, exec_type, file_type; |
| 3 | |
| 4 | # gatekeeperd |
| 5 | init_daemon_domain(gatekeeperd) |
| Alex Klyubin | ab5cf66 | 2015-04-28 16:51:26 -0700 | [diff] [blame] | 6 | binder_service(gatekeeperd) |
| Andres Morales | e207986 | 2015-04-03 16:46:33 -0700 | [diff] [blame] | 7 | binder_use(gatekeeperd) |
| Andres Morales | e207986 | 2015-04-03 16:46:33 -0700 | [diff] [blame] | 8 | allow gatekeeperd tee_device:chr_file rw_file_perms; |
| 9 | |
| Andres Morales | 13abb17 | 2015-04-08 19:52:19 -0700 | [diff] [blame] | 10 | # need to find KeyStore and add self |
| Andres Morales | e207986 | 2015-04-03 16:46:33 -0700 | [diff] [blame] | 11 | allow gatekeeperd gatekeeper_service:service_manager { add find }; |
| 12 | |
| Andres Morales | 13abb17 | 2015-04-08 19:52:19 -0700 | [diff] [blame] | 13 | # Need to add auth tokens to KeyStore |
| Andres Morales | dd156fc | 2015-04-13 12:21:08 -0700 | [diff] [blame] | 14 | use_keystore(gatekeeperd) |
| Andres Morales | e207986 | 2015-04-03 16:46:33 -0700 | [diff] [blame] | 15 | allow gatekeeperd keystore:keystore_key { add_auth }; |
| 16 | |
| Andres Morales | 13abb17 | 2015-04-08 19:52:19 -0700 | [diff] [blame] | 17 | # For permissions checking |
| 18 | allow gatekeeperd system_server:binder call; |
| 19 | allow gatekeeperd permission_service:service_manager find; |
| Andres Morales | 54a4aab | 2015-08-04 17:42:22 -0700 | [diff] [blame] | 20 | # For parent user ID lookup |
| 21 | allow gatekeeperd user_service:service_manager find; |
| Andres Morales | 13abb17 | 2015-04-08 19:52:19 -0700 | [diff] [blame] | 22 | |
| Andres Morales | b348f8f | 2015-04-16 13:40:57 -0700 | [diff] [blame] | 23 | # for SID file access |
| Nick Kralevich | 367757d | 2015-04-17 17:56:31 -0700 | [diff] [blame] | 24 | allow gatekeeperd gatekeeper_data_file:dir rw_dir_perms; |
| 25 | allow gatekeeperd gatekeeper_data_file:file create_file_perms; |
| Andres Morales | b348f8f | 2015-04-16 13:40:57 -0700 | [diff] [blame] | 26 | |
| Andres Morales | e207986 | 2015-04-03 16:46:33 -0700 | [diff] [blame] | 27 | neverallow { domain -gatekeeperd } gatekeeper_service:service_manager add; |