CNE: seandroid policy files

Adding seandroid policy files for CNE module.

Change-Id: I2e5a78c3dc9397d7eea14c52a30b728fd15e24ea

Android.mk

@@ -12,6 +12,11 @@ BOARD_SEPOLICY_UNION := \
        init.te \
        drmserver.te \
        adbd.te \
+       app.te \
+       cnd.te \
+       system_server.te \
+       wpa_supplicant.te \
+       mediaserver.te \
        qmuxd.te \
        netmgrd.te \
        atfwd.te \

app.te

@@ -0,0 +1,6 @@
+# Grant GPU access to all processes started by Zygote
+# They need that to render the standard UI
+allow appdomain gpu_device:chr_file rw_file_perms;
+
+# allow application to access cnd domain and socket
+unix_socket_connect(appdomain, cnd, cnd)

cnd.te

@@ -0,0 +1,67 @@
+#permissive cnd;
+type cnd, domain;
+type cnd_exec, exec_type, file_type;
+file_type_auto_trans(cnd, socket_device, cnd_socket);
+
+# cnd is started by init, type transit from init domain to cnd domain
+init_daemon_domain(cnd)
+# associate netdomain as an attribute of cnd domain
+net_domain(cnd)
+
+# allow cnd the following capability
+allow cnd self:capability { setuid setgid dac_override net_raw chown
+ fsetid net_admin sys_module };
+allow cnd self:capability2 block_suspend;
+
+# socket used to communicate with kernel via the netlink syscall
+allow cnd self:netlink_tcpdiag_socket { bind create write read
+ nlmsg_read };
+allow cnd self:netlink_route_socket { read bind create write
+ nlmsg_read };
+
+# allow cnd to set system property
+allow cnd system_prop:property_service set;
+allow cnd property_socket:sock_file write;
+allow cnd init:unix_stream_socket connectto;
+
+# allow cnd to communicate with wlan driver
+allow cnd kernel:system module_request;
+
+# allow cnd to access cnd_data_file
+allow cnd cnd_data_file:file create_file_perms;
+allow cnd cnd_data_file:sock_file { unlink create setattr };
+allow cnd cnd_data_file:dir { open read write add_name remove_name search };
+
+# allow cnd to access qmux_radio_socket
+allow cnd qmux_radio_socket:dir { write add_name };
+allow cnd qmux_radio_socket:sock_file { create write setattr};
+allow cnd qmuxd:unix_stream_socket connectto;
+
+# cnd access diag_device /dev/diag for logging
+allow cnd diag_device:chr_file { read write open ioctl };
+
+# allow cnd to access wpa_socket
+allow cnd wpa:unix_dgram_socket sendto;
+allow cnd wpa_socket:dir { write remove_name search add_name search };
+allow cnd wpa_socket:sock_file { write create unlink setattr };
+allow cnd wifi_data_file:dir search;
+# allow cnd to obtain wakelock
+allow cnd sysfs_wake_lock:file { open append };
+
+# allow cnd to communicate with all application
+allow cnd appdomain:dir search;
+allow cnd appdomain:fd use;
+allow cnd appdomain:file { read open };
+allow cnd appdomain:tcp_socket rw_socket_perms;
+
+# allow cnd to communicate with system_server
+allow cnd system_server:dir search;
+allow cnd system_server:file { read open };
+allow cnd system_server:tcp_socket { write getattr shutdown getopt read bind };
+
+# allow cnd to communicate with mediaserver
+allow cnd mediaserver:dir search;
+allow cnd mediaserver:fd use;
+allow cnd mediaserver:tcp_socket { read write bind getattr shutdown getopt };
+allow cnd mediaserver:file { open read };
+

file.te

@@ -9,6 +9,10 @@ type qmux_bluetooth_socket, file_type;
 type qmux_gps_socket, file_type;
 type qmux_radio_socket, file_type;
 
+# Define cnd socket and data file type
+type cnd_socket, file_type;
+type cnd_data_file, file_type;
+
 #Define the timeout for platform specific transports
 type sysfs_hsic_modem_wait, sysfs_type, file_type;
 type sysfs_smd_open_timeout, sysfs_type, file_type;

file_contexts

@@ -50,3 +50,8 @@
 /persist(/.*)?                    u:object_r:persist_file:s0
 
 /dev/subsys_esoc0  u:object_r:subsys_esoc0_device:s0
+#Context for cnd
+/dev/socket/cnd     u:object_r:cnd_socket:s0
+/system/bin/cnd     u:object_r:cnd_exec:s0
+/dev/socket/nims    u:object_r:cnd_socket:s0
+/data/connectivity(/.*)? u:object_r:cnd_data_file:s0

mediaserver.te

@@ -0,0 +1,2 @@
+# allow mediaserver to communicate with cnd
+unix_socket_connect(mediaserver, cnd, cnd)

system_server.te

@@ -0,0 +1,6 @@
+# allow system_server to communicate with cnd process over cnd_socket
+unix_socket_connect(system_server, cnd, cnd)
+# allow  system/framework applications to update the cnd configuration files
+allow system_server cnd_data_file:dir { read open write getattr add_name };
+allow system_server cnd_data_file:file { create write getattr setattr read lock open };
+

wpa_supplicant.te

@@ -0,0 +1,2 @@
+# allow wpa_supplicant to send back wifi information to cnd
+allow wpa cnd:unix_dgram_socket sendto;