sepolicy/nvram_daemon.te


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73

# ==============================================
# Policy File of /system/binnvram_daemon Executable File 


# ==============================================
# Type Declaration
# ==============================================

type nvram_daemon_exec , exec_type, file_type;
type nvram_daemon ,domain;

# ==============================================
# Android Policy Rule
# ==============================================

# ==============================================
# NSA Policy Rule
# ==============================================

# ==============================================
# MTK Policy Rule
# ==============================================

# permissive nvram_daemon;
init_daemon_domain(nvram_daemon)


# Date : WK14.31
# Operation : Migration 
# Purpose : the device is used to store Nvram backup data that can not be lost. 
allow nvram_daemon mmcblk_device:blk_file rw_file_perms;
allow nvram_daemon platformblk_device:blk_file rw_file_perms;


# Date : WK14.34
# Operation : Migration 
# Purpose : the option is used to tell that if other processes can access nvram. 
allow nvram_daemon system_prop:property_service set;


# Date : WK14.35
# Operation : chown folder and file permission 
# Purpose : ensure nvram user can access nvram file normally when upgrade from KK/KK.AOSP to L. 
allow nvram_daemon shell_exec:file { x_file_perms read open };
allow nvram_daemon nvram_data_file:dir create_dir_perms;
allow nvram_daemon nvram_data_file:file create_file_perms;
allow nvram_daemon nvram_data_file:lnk_file read;
allow nvram_daemon nvdata_file:dir create_dir_perms;
allow nvram_daemon nvdata_file:file create_file_perms;

allow nvram_daemon system_file:file execute_no_trans;

# Date : WK14.43
allow nvram_daemon als_ps_device:chr_file { read ioctl open };
allow nvram_daemon mtk-adc-cali_device:chr_file { read write ioctl open };
allow nvram_daemon gsensor_device:chr_file { read ioctl open };
allow nvram_daemon gyroscope_device:chr_file { read ioctl open };
allow nvram_daemon init:unix_stream_socket connectto;
allow nvram_daemon platformblk_device:dir search;

# Purpose: for property set
allow nvram_daemon property_socket:sock_file write;
allow nvram_daemon sysfs:file write;
allow nvram_daemon self:capability { fowner chown dac_override fsetid };

allow nvram_daemon system_data_file:dir {create write add_name};

# Purpose: for backup
allow nvram_daemon nvram_device:chr_file {read write open ioctl};
allow nvram_daemon pro_info_device:chr_file {read write open ioctl};

allow nvram_daemon block_device:dir search;