1 vndbinder_use(hal_gnss_default) 2 binder_call(hal_gnss_default, per_mgr); 3 allow hal_gnss_default per_mgr_service:service_manager find; 4 5 typeattribute hal_gnss_default data_between_core_and_vendor_violators; 6 allow hal_gnss_default location_data_file:dir { search write }; 7 allow hal_gnss_default location_data_file:fifo_file create_file_perms; 8 allow hal_gnss_default location:unix_stream_socket connectto; 9 allow hal_gnss_default location_data_file:dir rw_dir_perms; 10 allow hal_gnss_default location_data_file:sock_file write; 11 12 # for SUPL/911 related compliance cases 13 allow hal_gnss_default netmgrd:unix_stream_socket connectto; 14 allow hal_gnss_default netmgrd_socket:dir search; 15 allow hal_gnss_default netmgrd_socket:sock_file write; 16 allow hal_gnss_default self:netlink_route_socket { bind create nlmsg_read read write }; 17 18 # Most HALs are not allowed to use network sockets. Qcom library 19 # libqdi is used across multiple processes which are clients of 20 # netmgrd including the GNSS HAL. libqdi first attempts to get the network 21 # interface using an IOCTL on a UDP INET socket, which isn't allowed here. 22 # If that fails, it falls back to using libc's if_nameindex() which requires 23 # a netlink route socket, which HALs may use. Due to the initial 24 # attempt to use a UDP socket, we still see a selinux denial, 25 # but it is safe to ignore. 26 # TODO (b/37730994) Remove udp_socket requirement from 27 # libqdi and have all its clients use netlink route 28 # sockets. 29 dontaudit hal_gnss_default self:udp_socket create; 30
