| Zvikomborero VIncent Zvikaramba | 3927d12 | 2016-08-21 22:49:17 -0400 | [diff] [blame^] | 1 | #===============insthk==================== |
| 2 | type insthk, domain; |
| 3 | type insthk_exec, exec_type, file_type; |
| 4 | init_daemon_domain(insthk) |
| 5 | net_domain(insthk) |
| 6 | |
| 7 | # To make VT call |
| 8 | binder_use(insthk) |
| 9 | |
| 10 | allow insthk drm_efs_file:dir { rename search setattr read create reparent getattr write ioctl link rmdir remove_name unlink open add_name }; |
| 11 | allow insthk drm_efs_file:file { rename setattr read lock create getattr write ioctl link unlink open append }; |
| 12 | allow insthk drm_efs_file:lnk_file { rename setattr read lock create getattr write ioctl link unlink open append }; |
| 13 | allow insthk firmware_file:file { read lock ioctl open getattr }; |
| 14 | allow insthk init:process sigchld; |
| 15 | allow insthk insthk:appletalk_socket { lock accept connect shutdown append create write relabelfrom getattr getopt listen setopt read ioctl recv_msg name_bind send_msg setattr bind recvfrom sendto relabelto }; |
| 16 | allow insthk insthk:capability { sys_nice chown ipc_lock dac_override }; |
| 17 | allow insthk insthk:dir { read search ioctl open getattr }; |
| 18 | allow insthk insthk:fd use; |
| 19 | allow insthk insthk:fifo_file { read lock getattr write ioctl open append }; |
| 20 | allow insthk insthk:file { read lock getattr write ioctl open append }; |
| 21 | allow insthk insthk:ipc { unix_read setattr associate read create write getattr unix_write destroy }; |
| 22 | allow insthk insthk:key { search setattr read create write link view }; |
| 23 | allow insthk insthk:key_socket { lock accept connect shutdown append create write relabelfrom getattr getopt listen setopt read ioctl recv_msg name_bind send_msg setattr bind recvfrom sendto relabelto }; |
| 24 | allow insthk insthk:lnk_file { read lock ioctl open getattr }; |
| 25 | allow insthk insthk:msg { receive send }; |
| 26 | allow insthk insthk:msgq { unix_read setattr associate read create write enqueue getattr unix_write destroy }; |
| 27 | allow insthk insthk:netlink_route_socket { nlmsg_write lock accept connect shutdown append create nlmsg_read write relabelfrom getattr getopt listen setopt read ioctl recv_msg name_bind send_msg setattr bind recvfrom sendto relabelto }; |
| 28 | allow insthk insthk:netlink_selinux_socket { lock accept connect shutdown append create write relabelfrom getattr getopt listen setopt read ioctl recv_msg name_bind send_msg setattr bind recvfrom sendto relabelto }; |
| 29 | allow insthk insthk:packet_socket { lock accept connect shutdown append create write relabelfrom getattr getopt listen setopt read ioctl recv_msg name_bind send_msg setattr bind recvfrom sendto relabelto }; |
| 30 | allow insthk insthk:process { sigkill share getpgid signull setkeycreate siginh getattr setcurrent setrlimit rlimitinh fork getsession setexec setpgid setsched sigstop ptrace noatsecure setsockcreate setfscreate execheap sigchld execstack signal transition setcap execmem getcap getsched dyntransition }; |
| 31 | allow insthk insthk:rawip_socket { lock accept connect shutdown append create write relabelfrom getattr getopt listen setopt read ioctl recv_msg name_bind send_msg setattr bind recvfrom sendto relabelto node_bind }; |
| 32 | allow insthk insthk:sem { unix_read setattr associate read create write getattr unix_write destroy }; |
| 33 | allow insthk insthk:shm { unix_read setattr associate read lock create write getattr unix_write destroy }; |
| 34 | allow insthk insthk:socket { lock accept connect shutdown append create write relabelfrom getattr getopt listen setopt read ioctl recv_msg name_bind send_msg setattr bind recvfrom sendto relabelto }; |
| 35 | allow insthk insthk:tcp_socket { lock accept connect shutdown append connectto create write relabelfrom getattr getopt listen acceptfrom setopt read newconn ioctl recv_msg name_bind name_connect send_msg setattr bind recvfrom sendto relabelto node_bind }; |
| 36 | allow insthk insthk:tun_socket { lock accept connect shutdown append create write relabelfrom getattr getopt listen setopt read attach_queue ioctl recv_msg name_bind send_msg setattr bind recvfrom sendto relabelto }; |
| 37 | allow insthk insthk:udp_socket { lock accept connect shutdown append create write relabelfrom getattr getopt listen setopt read ioctl recv_msg name_bind send_msg setattr bind recvfrom sendto relabelto node_bind }; |
| 38 | allow insthk insthk:unix_dgram_socket { lock accept connect shutdown append create write relabelfrom getattr getopt listen setopt read ioctl recv_msg name_bind send_msg setattr bind recvfrom sendto relabelto }; |
| 39 | allow insthk insthk:unix_stream_socket { lock accept connect shutdown append connectto create write relabelfrom getattr getopt listen acceptfrom setopt read newconn ioctl recv_msg name_bind send_msg setattr bind recvfrom sendto relabelto }; |
| 40 | allow insthk insthk_exec:file { read open getattr entrypoint execute }; |
| 41 | allow insthk insthk_tmpfs:file { read write }; |
| 42 | allow insthk qseecom_device:chr_file { read lock getattr write ioctl open append }; |