1 # Integrated qualcomm sensor process 2 type sensors, domain; 3 type sensors_exec, exec_type, file_type; 4 5 # Started by init 6 init_daemon_domain(sensors) 7 8 # Change own perms to (nobody,nobody) 9 allow sensors self:capability { setuid setgid }; 10 # Chown /data/misc/sensors/debug/ to nobody 11 allow sensors self:capability chown; 12 dontaudit sensors self:capability fsetid; 13 14 # Access /data/misc/sensors/debug and /data/system/sensors/settings 15 allow sensors self:capability dac_read_search; 16 dontaudit sensors self:capability dac_override; 17 18 # Create /data/app/sensor_ctl_socket (Might want to change location). 19 type_transition sensors apk_data_file:sock_file sensors_socket "sensor_ctl_socket"; 20 allow sensors sensors_socket:sock_file create_file_perms; 21 # Trying to be restrictive with perms on apk_data_file 22 allow sensors apk_data_file:dir { add_name write }; 23 # Socket can be deleted. So might have to keep in order to work. 24 allow sensors apk_data_file:dir remove_name; 25 26 # Create directories and files under /data/misc/sensors 27 # and /data/system/sensors. Allow generic r/w file access. 28 allow sensors sensors_data_file:dir create_dir_perms; 29 allow sensors sensors_data_file:file create_file_perms; 30 31 # Access sensor nodes (/dev/msm_dsps) 32 allow sensors sensors_device:chr_file rw_file_perms; 33 34 # Access power management controls 35 allow sensors power_control_device:chr_file w_file_perms; 36 37 # Access to /persist/sensors 38 allow sensors persist_file:dir r_dir_perms; 39 allow sensors persist_sensors_file:dir r_dir_perms; 40 allow sensors persist_sensors_file:file rw_file_perms; 41 42 # Wake lock access 43 wakelock_use(sensors) 44 45 allow sensors cgroup:dir { create add_name }; 46
