1 # Integrated qualcomm sensor process 2 type sensors, domain; 3 type sensors_exec, exec_type, file_type; 4 5 # Started by init 6 init_daemon_domain(sensors) 7 8 # Change own perms to (nobody,nobody) 9 allow sensors self:capability { setuid setgid }; 10 # Chown /data/misc/sensors/debug/ to nobody 11 allow sensors self:capability chown; 12 dontaudit sensors self:capability fsetid; 13 14 # Access /data/misc/sensors/debug and /data/system/sensors/settings 15 allow sensors self:capability { dac_read_search dac_override }; 16 17 # Create /data/app/sensor_ctl_socket (Might want to change location). 18 type_transition sensors apk_data_file:sock_file sensors_socket "sensor_ctl_socket"; 19 allow sensors sensors_socket:sock_file create_file_perms; 20 # Trying to be restrictive with perms on apk_data_file 21 allow sensors apk_data_file:dir { add_name write }; 22 # Socket can be deleted. So might have to keep in order to work. 23 allow sensors apk_data_file:dir remove_name; 24 25 # Create directories and files under /data/misc/sensors 26 # and /data/system/sensors. Allow generic r/w file access. 27 allow sensors sensors_data_file:dir create_dir_perms; 28 allow sensors sensors_data_file:file create_file_perms; 29 30 # Access sensor nodes (/dev/msm_dsps) 31 allow sensors sensors_device:chr_file rw_file_perms; 32 33 # Access power management controls 34 allow sensors power_control_device:chr_file w_file_perms; 35 36 # Access to /persist/sensors 37 allow sensors persist_file:dir r_dir_perms; 38 allow sensors persist_sensors_file:dir r_dir_perms; 39 allow sensors persist_sensors_file:file rw_file_perms; 40 41 # Wake lock access 42 wakelock_use(sensors) 43 44 allow sensors cgroup:dir { create add_name }; 45
