1# ==============================================
2# Policy File of /vendor/bin/nvram_agent_binder Executable File
3
4# ==============================================
5# Type Declaration
6# ==============================================
7type nvram_agent_binder_exec , exec_type, file_type, vendor_file_type;
8type nvram_agent_binder ,domain;
9
10# ==============================================
11# MTK Policy Rule
12# ==============================================
13init_daemon_domain(nvram_agent_binder)
14
15# Date : WK14.35
16# Operation : access nvram by binder
17# Purpose : ensure nvram user can access nvram file normally.
18#allow nvram_agent_binder nvram_agent_service:service_manager add;
19
20# Date : WK14.43
21# Operation : 2rd Selinux Migration
22# Purpose : the role of nvram_agent_binder is same with nvram_daemon except property_set & exect permission
23allow nvram_agent_binder nvram_device:blk_file rw_file_perms;
24allow nvram_agent_binder nvdata_device:blk_file rw_file_perms;
25allow nvram_agent_binder nvram_data_file:dir create_dir_perms;
26allow nvram_agent_binder nvram_data_file:file create_file_perms;
27allow nvram_agent_binder nvram_data_file:lnk_file read;
28allow nvram_agent_binder nvdata_file:lnk_file read;
29allow nvram_agent_binder nvdata_file:dir create_dir_perms;
30allow nvram_agent_binder nvdata_file:file create_file_perms;
31
32allow nvram_agent_binder als_ps_device:chr_file r_file_perms;
33allow nvram_agent_binder mtk-adc-cali_device:chr_file rw_file_perms;
34allow nvram_agent_binder gsensor_device:chr_file r_file_perms;
35allow nvram_agent_binder gyroscope_device:chr_file r_file_perms;
36allow nvram_agent_binder self:capability { fowner chown fsetid };
37
38# Purpose: for backup
39allow nvram_agent_binder nvram_device:chr_file rw_file_perms;
40allow nvram_agent_binder pro_info_device:chr_file rw_file_perms;
41allow nvram_agent_binder block_device:dir search;
42
43# for MLC device
44allow nvram_agent_binder mtd_device:dir search;
45allow nvram_agent_binder mtd_device:chr_file rw_file_perms;
46
47#for nvram agent hidl
48get_prop(nvram_agent_binder, hwservicemanager_prop)
49
50# Allow to use HWBinder IPC
51hwbinder_use(nvram_agent_binder);
52
53# Allow a set of permissions required for a domain to be a server which provides a HAL implementation over HWBinder.
54hal_server_domain(nvram_agent_binder, hal_nvramagent)
55
56# Date : WK18.16
57# Operation: P migration
58# Purpose: Allow nvram_daemon to get tel_switch_prop
59get_prop(nvram_daemon, tel_switch_prop)
60
61# Date : WK18.21
62# Operation: P migration
63# Purpose: Allow to search /mnt/vendor/nvdata when using nvram function
64allow nvram_agent_binder mnt_vendor_file:dir search;
65
66allow nvram_agent_binder sysfs_boot_mode:file r_file_perms;
67