1# HwBinder IPC from client to server 2binder_call(hal_configstore_client, hal_configstore_server) 3 4hal_attribute_hwservice(hal_configstore, hal_configstore_ISurfaceFlingerConfigs) 5 6# hal_configstore runs with a strict seccomp filter. Use crash_dump's 7# fallback path to collect crash data. 8crash_dump_fallback(hal_configstore_server) 9 10### 11### neverallow rules 12### 13 14# Should never execute an executable without a domain transition 15neverallow hal_configstore_server { file_type fs_type }:file execute_no_trans; 16 17# Should never need network access. Disallow sockets except for 18# for unix stream/dgram sockets used for logging/debugging. 19neverallow hal_configstore_server domain:{ 20 rawip_socket tcp_socket udp_socket 21 netlink_route_socket netlink_selinux_socket 22 socket netlink_socket packet_socket key_socket appletalk_socket 23 netlink_tcpdiag_socket netlink_nflog_socket 24 netlink_xfrm_socket netlink_audit_socket 25 netlink_dnrt_socket netlink_kobject_uevent_socket tun_socket 26 netlink_iscsi_socket netlink_fib_lookup_socket netlink_connector_socket 27 netlink_netfilter_socket netlink_generic_socket netlink_scsitransport_socket 28 netlink_rdma_socket netlink_crypto_socket 29} *; 30neverallow hal_configstore_server { 31 domain 32 -hal_configstore_server 33 -logd 34 -prng_seeder 35 userdebug_or_eng(`-su') 36 -tombstoned 37 userdebug_or_eng(`-heapprofd') 38 userdebug_or_eng(`-traced_perf') 39}:{ unix_dgram_socket unix_stream_socket } *; 40 41# Should never need access to anything on /data 42neverallow hal_configstore_server { 43 data_file_type 44 -anr_data_file # for crash dump collection 45 -tombstone_data_file # for crash dump collection 46 -zoneinfo_data_file # granted to domain 47 with_native_coverage(`-method_trace_data_file') 48}:{ file fifo_file sock_file } *; 49 50# Should never need sdcard access 51neverallow hal_configstore_server { 52 sdcard_type 53 fuse sdcardfs vfat exfat # manual expansion for completeness 54}:dir ~getattr; 55neverallow hal_configstore_server { 56 sdcard_type 57 fuse sdcardfs vfat exfat # manual expansion for completeness 58}:file *; 59 60# Do not permit access to service_manager and vndservice_manager 61neverallow hal_configstore_server *:service_manager *; 62 63# No privileged capabilities 64neverallow hal_configstore_server self:capability_class_set *; 65 66# No ptracing other processes 67neverallow hal_configstore_server *:process ptrace; 68 69# no relabeling 70neverallow hal_configstore_server *:dir_file_class_set { relabelfrom relabelto }; 71