xref: /aosp_15_r20/system/sepolicy/private/system_suspend.te (revision e4a36f4174b17bbab9dc043f4a65dc8d87377290)
1*e4a36f41SAndroid Build Coastguard Workertype system_suspend, domain, coredomain, system_suspend_server, system_suspend_internal_server;
2*e4a36f41SAndroid Build Coastguard Worker
3*e4a36f41SAndroid Build Coastguard Workertype system_suspend_exec, system_file_type, exec_type, file_type;
4*e4a36f41SAndroid Build Coastguard Workerinit_daemon_domain(system_suspend)
5*e4a36f41SAndroid Build Coastguard Worker
6*e4a36f41SAndroid Build Coastguard Worker# To serve ISuspendControlService.
7*e4a36f41SAndroid Build Coastguard Workerbinder_use(system_suspend)
8*e4a36f41SAndroid Build Coastguard Workeradd_service(system_suspend, system_suspend_control_service)
9*e4a36f41SAndroid Build Coastguard Worker
10*e4a36f41SAndroid Build Coastguard Workeradd_service(system_suspend, hal_system_suspend_service)
11*e4a36f41SAndroid Build Coastguard Worker
12*e4a36f41SAndroid Build Coastguard Worker# Access to /sys/power/{ wakeup_count, state } suspend interface.
13*e4a36f41SAndroid Build Coastguard Workerallow system_suspend sysfs_power:file rw_file_perms;
14*e4a36f41SAndroid Build Coastguard Worker
15*e4a36f41SAndroid Build Coastguard Worker# Access to wakeup, suspend stats, and wakeup reasons.
16*e4a36f41SAndroid Build Coastguard Workerr_dir_file(system_suspend, sysfs_suspend_stats)
17*e4a36f41SAndroid Build Coastguard Workerr_dir_file(system_suspend, sysfs_wakeup)
18*e4a36f41SAndroid Build Coastguard Workerr_dir_file(system_suspend, sysfs_wakeup_reasons)
19*e4a36f41SAndroid Build Coastguard Worker# To resolve arbitrary sysfs paths from /sys/class/wakeup/* symlinks.
20*e4a36f41SAndroid Build Coastguard Workerallow system_suspend sysfs_type:dir search;
21*e4a36f41SAndroid Build Coastguard Worker
22*e4a36f41SAndroid Build Coastguard Worker# Access to suspend_hal system properties
23*e4a36f41SAndroid Build Coastguard Workerget_prop(system_suspend, suspend_prop)
24*e4a36f41SAndroid Build Coastguard Worker
25*e4a36f41SAndroid Build Coastguard Worker# Access to system_suspend debug system properties
26*e4a36f41SAndroid Build Coastguard Workeruserdebug_or_eng(`
27*e4a36f41SAndroid Build Coastguard Worker  get_prop(system_suspend, suspend_debug_prop)
28*e4a36f41SAndroid Build Coastguard Worker')
29*e4a36f41SAndroid Build Coastguard Worker
30*e4a36f41SAndroid Build Coastguard Worker# To call BTAA registered callbacks
31*e4a36f41SAndroid Build Coastguard Workerallow system_suspend bluetooth:binder call;
32*e4a36f41SAndroid Build Coastguard Worker
33*e4a36f41SAndroid Build Coastguard Worker# For adding `dumpsys syspend_control` output to bugreport
34*e4a36f41SAndroid Build Coastguard Workerallow system_suspend dumpstate:fd use;
35*e4a36f41SAndroid Build Coastguard Workerallow system_suspend dumpstate:fifo_file write;
36*e4a36f41SAndroid Build Coastguard Worker
37*e4a36f41SAndroid Build Coastguard Worker# Allow init to take kernel wakelock and system suspend to
38*e4a36f41SAndroid Build Coastguard Worker# remove kenel wakelocks and the capability to access these
39*e4a36f41SAndroid Build Coastguard Worker# files
40*e4a36f41SAndroid Build Coastguard Workerallow init sysfs_wake_lock:file rw_file_perms;
41*e4a36f41SAndroid Build Coastguard Workerallow init self:global_capability2_class_set block_suspend;
42*e4a36f41SAndroid Build Coastguard Workerallow system_suspend sysfs_wake_lock:file rw_file_perms;
43*e4a36f41SAndroid Build Coastguard Workerallow system_suspend self:global_capability2_class_set block_suspend;
44*e4a36f41SAndroid Build Coastguard Worker
45*e4a36f41SAndroid Build Coastguard Worker# Allow init to set /sys/power/sync_on_suspend.
46*e4a36f41SAndroid Build Coastguard Workerallow init sysfs_sync_on_suspend:file w_file_perms;
47*e4a36f41SAndroid Build Coastguard Worker
48*e4a36f41SAndroid Build Coastguard Workerneverallow {
49*e4a36f41SAndroid Build Coastguard Worker    domain
50*e4a36f41SAndroid Build Coastguard Worker    -atrace # tracing
51*e4a36f41SAndroid Build Coastguard Worker    -bluetooth # support Bluetooth activity attribution (BTAA)
52*e4a36f41SAndroid Build Coastguard Worker    -dumpstate # bug reports
53*e4a36f41SAndroid Build Coastguard Worker    -system_suspend # implements system_suspend_control_service
54*e4a36f41SAndroid Build Coastguard Worker    -system_server # configures system_suspend via ISuspendControlService
55*e4a36f41SAndroid Build Coastguard Worker    -traceur_app # tracing
56*e4a36f41SAndroid Build Coastguard Worker} system_suspend_control_service:service_manager find;
57