sepolicy/at_distributor.te

#===================at_distributor============================
type at_distributor, domain;
type at_distributor_exec, exec_type, file_type;
init_daemon_domain(at_distributor)
net_domain(at_distributor)

# To make VT call
binder_use(at_distributor)

allow at_distributor adbd:dir { read search ioctl open getattr };
allow at_distributor alarm_device:chr_file { read lock getattr write ioctl open append };
allow at_distributor app_efs_file:dir { rename search setattr read create reparent getattr write ioctl link rmdir remove_name unlink open add_name };
allow at_distributor app_efs_file:file { rename setattr read lock create getattr write ioctl link unlink open append };
allow at_distributor ashmem_device:chr_file { getattr execute execute_no_trans };
allow at_distributor at_distributor:appletalk_socket { lock accept connect shutdown append create write relabelfrom getattr getopt listen setopt read ioctl recv_msg name_bind send_msg setattr bind recvfrom sendto relabelto };
allow at_distributor at_distributor:capability { setuid dac_override sys_nice chown fsetid fowner };
allow at_distributor at_distributor:dir { read search ioctl open getattr };
allow at_distributor at_distributor:fd use;
allow at_distributor at_distributor:fifo_file { read lock getattr write ioctl open append };
allow at_distributor at_distributor:file { read lock getattr write ioctl open append };
allow at_distributor at_distributor:ipc { unix_read setattr associate read create write getattr unix_write destroy };
allow at_distributor at_distributor:key { search setattr read create write link view };
allow at_distributor at_distributor:key_socket { lock accept connect shutdown append create write relabelfrom getattr getopt listen setopt read ioctl recv_msg name_bind send_msg setattr bind recvfrom sendto relabelto };
allow at_distributor at_distributor:lnk_file { read lock ioctl open getattr };
allow at_distributor at_distributor:msg { receive send };
allow at_distributor at_distributor:msgq { unix_read setattr associate read create write enqueue getattr unix_write destroy };
allow at_distributor at_distributor:netlink_route_socket { nlmsg_write lock accept connect shutdown append create nlmsg_read write relabelfrom getattr getopt listen setopt read ioctl recv_msg name_bind send_msg setattr bind recvfrom sendto relabelto };
allow at_distributor at_distributor:netlink_selinux_socket { lock accept connect shutdown append create write relabelfrom getattr getopt listen setopt read ioctl recv_msg name_bind send_msg setattr bind recvfrom sendto relabelto };
allow at_distributor at_distributor:packet_socket { lock accept connect shutdown append create write relabelfrom getattr getopt listen setopt read ioctl recv_msg name_bind send_msg setattr bind recvfrom sendto relabelto };
allow at_distributor at_distributor:process { sigkill share getpgid signull setkeycreate siginh getattr setcurrent setrlimit rlimitinh fork getsession setexec setpgid setsched sigstop ptrace noatsecure setsockcreate setfscreate execheap sigchld execstack signal transition setcap execmem getcap getsched dyntransition };
allow at_distributor at_distributor:rawip_socket { lock accept connect shutdown append create write relabelfrom getattr getopt listen setopt read ioctl recv_msg name_bind send_msg setattr bind recvfrom sendto relabelto node_bind };
allow at_distributor at_distributor:sem { unix_read setattr associate read create write getattr unix_write destroy };
allow at_distributor at_distributor:shm { unix_read setattr associate read lock create write getattr unix_write destroy };
allow at_distributor at_distributor:socket { lock accept connect shutdown append create write relabelfrom getattr getopt listen setopt read ioctl recv_msg name_bind send_msg setattr bind recvfrom sendto relabelto };
allow at_distributor at_distributor:tcp_socket { lock accept connect shutdown append connectto create write relabelfrom getattr getopt listen acceptfrom setopt read newconn ioctl recv_msg name_bind name_connect send_msg setattr bind recvfrom sendto relabelto node_bind };
allow at_distributor at_distributor:tun_socket { lock accept connect shutdown append create write relabelfrom getattr getopt listen setopt read attach_queue ioctl recv_msg name_bind send_msg setattr bind recvfrom sendto relabelto };
allow at_distributor at_distributor:udp_socket { lock accept connect shutdown append create write relabelfrom getattr getopt listen setopt read ioctl recv_msg name_bind send_msg setattr bind recvfrom sendto relabelto node_bind };
allow at_distributor at_distributor:unix_dgram_socket { lock accept connect shutdown append create write relabelfrom getattr getopt listen setopt read ioctl recv_msg name_bind send_msg setattr bind recvfrom sendto relabelto };
allow at_distributor at_distributor:unix_stream_socket { lock accept connect shutdown append connectto create write relabelfrom getattr getopt listen acceptfrom setopt read newconn ioctl recv_msg name_bind send_msg setattr bind recvfrom sendto relabelto };
allow at_distributor at_distributor_exec:file { read open getattr entrypoint execute };
allow at_distributor at_distributor_tmpfs:file { read write };
allow at_distributor binderservicedomain:binder { transfer call };
allow at_distributor binderservicedomain:fd use;
allow at_distributor block_device:dir { read search ioctl open getattr };
allow at_distributor carrier_efs_file:dir { rename search setattr read create reparent getattr write ioctl link rmdir remove_name unlink open add_name };
allow at_distributor carrier_efs_file:file { rename setattr read lock create getattr write ioctl link unlink open append };
allow at_distributor cgroup:dir { rename search setattr read create reparent getattr write ioctl link rmdir remove_name unlink open add_name };
allow at_distributor cgroup:file { rename setattr read lock create getattr write ioctl link unlink open append };
allow at_distributor dumplog_data_file:dir { rename search setattr read create reparent getattr write ioctl link rmdir remove_name unlink open add_name };
allow at_distributor dumplog_data_file:file { rename setattr read lock create getattr write ioctl link unlink open append };
allow at_distributor dumplog_data_file:sock_file { rename setattr read lock create getattr write ioctl link unlink open append };
allow at_distributor dumpstate_exec:file { execute execute_no_trans };
allow at_distributor dumpsys_exec:file { execute execute_no_trans };
allow at_distributor efs_file:dir { rename search setattr read create reparent getattr write ioctl link rmdir remove_name unlink open add_name };
allow at_distributor efs_file:file { rename setattr read lock create getattr write ioctl link unlink open append };
allow at_distributor firmware_file:dir { read search ioctl open getattr };
allow at_distributor firmware_file:file { read lock ioctl open getattr };
allow at_distributor imei_efs_file:dir { rename search setattr read create reparent getattr write ioctl link rmdir remove_name unlink open add_name };
allow at_distributor imei_efs_file:file { rename setattr read lock create getattr write ioctl link unlink open append };
allow at_distributor init:process sigchld;
allow at_distributor init:unix_stream_socket connectto;
allow at_distributor kernel:system syslog_read;
allow at_distributor nfc:binder { transfer call };
allow at_distributor nfc:fd use;
allow at_distributor property_socket:sock_file write;
allow at_distributor qseecom_device:chr_file { read lock getattr write ioctl open append };
allow at_distributor radio:binder { transfer call };
allow at_distributor radio:fd use;
allow at_distributor radio_data_file:dir { search read getattr write ioctl remove_name open add_name };
allow at_distributor radio_data_file:file { rename setattr read lock create getattr write ioctl link unlink open append };
allow at_distributor radio_device:chr_file { read lock getattr write ioctl open append };
allow at_distributor radio_prop:property_service set;
allow at_distributor rild:unix_stream_socket connectto;
allow at_distributor sec-ril:unix_stream_socket connectto;
allow at_distributor sec_efs_file:dir { rename search setattr read create reparent getattr write ioctl link rmdir remove_name unlink open add_name };
allow at_distributor sec_efs_file:file { rename setattr read lock create getattr write ioctl link unlink open append };
allow at_distributor sensorhubservice:binder { transfer call };
allow at_distributor sensorhubservice:fd use;
allow at_distributor servicemanager:binder { transfer call };
allow at_distributor servicemanager:fd use;
allow at_distributor shell_exec:file { execute read lock getattr execute_no_trans ioctl open };
allow at_distributor su_exec:file { execute read lock getattr execute_no_trans ioctl open };
allow at_distributor sysfs:file { write open append };
allow at_distributor sysfs_sec:file { setattr read lock getattr write ioctl open append };
allow at_distributor sysfs_ss_writable:file { read lock getattr write ioctl open append };
allow at_distributor sysfs_wake_lock:file { read lock getattr write ioctl open append };
allow at_distributor system_app:binder { transfer call };
allow at_distributor system_app:fd use;
allow at_distributor system_data_file:dir { rename search setattr read create reparent getattr write ioctl link rmdir remove_name unlink open add_name };
allow at_distributor system_data_file:file { rename setattr read lock create getattr write ioctl link unlink open append };
allow at_distributor system_file:file { getattr execute execute_no_trans };
allow at_distributor system_server:binder transfer;
allow at_distributor uart_device:chr_file { read lock getattr write ioctl open append };
allow at_distributor zygote_exec:file { execute read lock getattr execute_no_trans ioctl open };