1*e4a36f41SAndroid Build Coastguard Worker# servicemanager - the Binder context manager 2*e4a36f41SAndroid Build Coastguard Workertype servicemanager, domain, mlstrustedsubject; 3*e4a36f41SAndroid Build Coastguard Workertype servicemanager_exec, system_file_type, exec_type, file_type; 4*e4a36f41SAndroid Build Coastguard Worker 5*e4a36f41SAndroid Build Coastguard Worker# Note that we do not use the binder_* macros here. 6*e4a36f41SAndroid Build Coastguard Worker# servicemanager is unique in that it only provides 7*e4a36f41SAndroid Build Coastguard Worker# name service (aka context manager) for Binder. 8*e4a36f41SAndroid Build Coastguard Worker# As such, it only ever receives and transfers other references 9*e4a36f41SAndroid Build Coastguard Worker# created by other domains. It never passes its own references 10*e4a36f41SAndroid Build Coastguard Worker# or initiates a Binder IPC. 11*e4a36f41SAndroid Build Coastguard Workerallow servicemanager self:binder set_context_mgr; 12*e4a36f41SAndroid Build Coastguard Workerallow servicemanager { 13*e4a36f41SAndroid Build Coastguard Worker domain 14*e4a36f41SAndroid Build Coastguard Worker -init 15*e4a36f41SAndroid Build Coastguard Worker -vendor_init 16*e4a36f41SAndroid Build Coastguard Worker -hwservicemanager 17*e4a36f41SAndroid Build Coastguard Worker -vndservicemanager 18*e4a36f41SAndroid Build Coastguard Worker}:binder transfer; 19*e4a36f41SAndroid Build Coastguard Worker 20*e4a36f41SAndroid Build Coastguard Workerallow servicemanager service_contexts_file:file r_file_perms; 21*e4a36f41SAndroid Build Coastguard Worker 22*e4a36f41SAndroid Build Coastguard Workerallow servicemanager vendor_service_contexts_file:file r_file_perms; 23*e4a36f41SAndroid Build Coastguard Worker 24*e4a36f41SAndroid Build Coastguard Worker# nonplat_service_contexts only accessible on non full-treble devices 25*e4a36f41SAndroid Build Coastguard Workernot_full_treble(`allow servicemanager nonplat_service_contexts_file:file r_file_perms;') 26*e4a36f41SAndroid Build Coastguard Worker 27*e4a36f41SAndroid Build Coastguard Workeradd_service(servicemanager, service_manager_service) 28*e4a36f41SAndroid Build Coastguard Workerallow servicemanager dumpstate:fd use; 29*e4a36f41SAndroid Build Coastguard Workerallow servicemanager dumpstate:fifo_file write; 30*e4a36f41SAndroid Build Coastguard Worker 31*e4a36f41SAndroid Build Coastguard Worker# Check SELinux permissions. 32*e4a36f41SAndroid Build Coastguard Workerselinux_check_access(servicemanager) 33