1# ============================================== 2# Policy File of /vendor/bin/nvram_agent_binder Executable File 3 4# ============================================== 5# Type Declaration 6# ============================================== 7type nvram_agent_binder_exec , exec_type, file_type, vendor_file_type; 8type nvram_agent_binder ,domain; 9 10# ============================================== 11# MTK Policy Rule 12# ============================================== 13init_daemon_domain(nvram_agent_binder) 14 15# Date : WK14.35 16# Operation : access nvram by binder 17# Purpose : ensure nvram user can access nvram file normally. 18#allow nvram_agent_binder nvram_agent_service:service_manager add; 19 20# Date : WK14.43 21# Operation : 2rd Selinux Migration 22# Purpose : the role of nvram_agent_binder is same with nvram_daemon except property_set & exect permission 23allow nvram_agent_binder nvram_device:blk_file rw_file_perms; 24allow nvram_agent_binder nvdata_device:blk_file rw_file_perms; 25allow nvram_agent_binder nvram_data_file:dir create_dir_perms; 26allow nvram_agent_binder nvram_data_file:file create_file_perms; 27allow nvram_agent_binder nvram_data_file:lnk_file read; 28allow nvram_agent_binder nvdata_file:lnk_file read; 29allow nvram_agent_binder nvdata_file:dir create_dir_perms; 30allow nvram_agent_binder nvdata_file:file create_file_perms; 31 32allow nvram_agent_binder als_ps_device:chr_file r_file_perms; 33allow nvram_agent_binder mtk-adc-cali_device:chr_file rw_file_perms; 34allow nvram_agent_binder gsensor_device:chr_file r_file_perms; 35allow nvram_agent_binder gyroscope_device:chr_file r_file_perms; 36allow nvram_agent_binder self:capability { fowner chown fsetid }; 37 38# Purpose: for backup 39allow nvram_agent_binder nvram_device:chr_file rw_file_perms; 40allow nvram_agent_binder pro_info_device:chr_file rw_file_perms; 41allow nvram_agent_binder block_device:dir search; 42 43# for MLC device 44allow nvram_agent_binder mtd_device:dir search; 45allow nvram_agent_binder mtd_device:chr_file rw_file_perms; 46 47#for nvram agent hidl 48get_prop(nvram_agent_binder, hwservicemanager_prop) 49 50# Allow to use HWBinder IPC 51hwbinder_use(nvram_agent_binder); 52 53# Allow a set of permissions required for a domain to be a server which provides a HAL implementation over HWBinder. 54hal_server_domain(nvram_agent_binder, hal_nvramagent) 55 56# Date : WK18.16 57# Operation: P migration 58# Purpose: Allow nvram_daemon to get tel_switch_prop 59get_prop(nvram_daemon, tel_switch_prop) 60 61# Date : WK18.21 62# Operation: P migration 63# Purpose: Allow to search /mnt/vendor/nvdata when using nvram function 64allow nvram_agent_binder mnt_vendor_file:dir search; 65 66allow nvram_agent_binder sysfs_boot_mode:file r_file_perms; 67