1type hal_gnss_qti, domain; 2hal_server_domain(hal_gnss_qti, hal_gnss) 3 4type hal_gnss_qti_exec, exec_type, vendor_file_type, file_type; 5init_daemon_domain(hal_gnss_qti) 6 7r_dir_file(hal_gnss_qti, sysfs_msm_subsys) 8 9vndbinder_use(hal_gnss_qti) 10 11allow hal_gnss_qti sysfs_soc:dir r_dir_perms; 12allow hal_gnss_qti sysfs_soc:file r_file_perms; 13 14binder_call(hal_gnss_qti, per_mgr) 15allow hal_gnss_qti per_mgr_service:service_manager find; 16 17# /data/vendor/location 18allow hal_gnss_qti location_data_file:fifo_file { open read setattr write }; 19allow hal_gnss_qti location_data_file:dir create_dir_perms; 20allow hal_gnss_qti location_data_file:sock_file write; 21 22allow hal_gnss_qti location:unix_stream_socket connectto; 23 24allow hal_gnss_qti self:socket create_socket_perms; 25allowxperm hal_gnss_qti self:socket ioctl msm_sock_ipc_ioctls; 26 27unix_socket_connect(hal_gnss_qti, netmgrd, netmgrd) 28allow hal_gnss_qti netmgrd_socket:dir search; 29 30allow hal_gnss_qti self:netlink_generic_socket { bind create read }; 31allow hal_gnss_qti self:netlink_route_socket { bind create nlmsg_read read write }; 32 33userdebug_or_eng(` 34 allow hal_gnss_qti diag_device:chr_file rw_file_perms; 35 r_dir_file(hal_gnss_qti, sysfs_diag) 36 allow hal_gnss_qti sysfs_timestamp_switch:file r_file_perms; 37') 38dontaudit hal_gnss_qti diag_device:chr_file rw_file_perms; 39dontaudit hal_gnss_qti sysfs_diag:dir search; 40 41# Most HALs are not allowed to use network sockets. Qcom library 42# libqdi is used across multiple processes which are clients of 43# netmgrd including the GNSS HAL. libqdi first attempts to get the network 44# interface using an IOCTL on a UDP INET socket, which isn't allowed here. 45# If that fails, it falls back to using libc's if_nameindex() which requires 46# a netlink route socket, which HALs may use. Due to the initial 47# attempt to use a UDP socket, we still see a selinux denial, 48# but it is safe to ignore. 49# TODO (b/37730994) Remove udp_socket requirement from 50# libqdi and have all its clients use netlink route 51# sockets. 52dontaudit hal_gnss_qti self:udp_socket create; 53