1 vndbinder_use(hal_gnss_default) 2 binder_call(hal_gnss_default, per_mgr); 3 allow hal_gnss_default per_mgr_service:service_manager find; 4 5 allow hal_gnss_default location_data_file:dir { search write }; 6 allow hal_gnss_default location_data_file:fifo_file { open read setattr write }; 7 allow hal_gnss_default location:unix_stream_socket connectto; 8 allow hal_gnss_default location_data_file:dir rw_dir_perms; 9 allow hal_gnss_default location_data_file:sock_file write; 10 11 # for SUPL/911 related compliance cases 12 allow hal_gnss_default netmgrd:unix_stream_socket connectto; 13 allow hal_gnss_default netmgrd_socket:dir search; 14 allow hal_gnss_default netmgrd_socket:sock_file write; 15 allow hal_gnss_default self:netlink_route_socket { bind create nlmsg_read read write }; 16 17 # Most HALs are not allowed to use network sockets. Qcom library 18 # libqdi is used across multiple processes which are clients of 19 # netmgrd including the GNSS HAL. libqdi first attempts to get the network 20 # interface using an IOCTL on a UDP INET socket, which isn't allowed here. 21 # If that fails, it falls back to using libc's if_nameindex() which requires 22 # a netlink route socket, which HALs may use. Due to the initial 23 # attempt to use a UDP socket, we still see a selinux denial, 24 # but it is safe to ignore. 25 # TODO (b/37730994) Remove udp_socket requirement from 26 # libqdi and have all its clients use netlink route 27 # sockets. 28 dontaudit hal_gnss_default self:udp_socket create; 29
