[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/contrib/

["Jason Zaman" <perfinion@gentoo.org>]

commit:     0e8ef804e3c6409094334dda3b320bcfd5bf29b8
Author:     Jason Zaman <jason <AT> perfinion <DOT> com>
AuthorDate: Tue Jul 28 14:46:43 2015 +0000
Commit:     Jason Zaman <perfinion <AT> gentoo <DOT> org>
CommitDate: Fri Jul 31 08:09:03 2015 +0000
URL:        https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=0e8ef804

android: add sdk in /opt and sysfs

adb needs to be able to read sysfs to find the USB device

 policy/modules/contrib/android.fc |  4 ++++
 policy/modules/contrib/android.if |  5 +++++
 policy/modules/contrib/android.te | 11 +++++++++--
 3 files changed, 18 insertions(+), 2 deletions(-)

diff --git a/policy/modules/contrib/android.fc b/policy/modules/contrib/android.fc
index a16fc47..af98311 100644
--- a/policy/modules/contrib/android.fc
+++ b/policy/modules/contrib/android.fc
@@ -4,3 +4,7 @@ HOME_DIR/\.gradle(/.*)?				gen_context(system_u:object_r:android_home_t,s0)
 
 /opt/android-studio/bin/studio.sh		gen_context(system_u:object_r:android_java_exec_t,s0)
 
+/opt/android-sdk-update-manager/platform-tools/adb	--	gen_context(system_u:object_r:android_tools_exec_t,s0)
+/opt/android-sdk-update-manager/platform-tools/fastboot	--	gen_context(system_u:object_r:android_tools_exec_t,s0)
+/opt/android-sdk-update-manager/tools/android		--	gen_context(system_u:object_r:android_java_exec_t,s0)
+/opt/android-sdk-update-manager(/.*)?				gen_context(system_u:object_r:android_sdk_t,s0)

diff --git a/policy/modules/contrib/android.if b/policy/modules/contrib/android.if
index f0173d5..a50093a 100644
--- a/policy/modules/contrib/android.if
+++ b/policy/modules/contrib/android.if
@@ -23,6 +23,7 @@ interface(`android_role',`
 		type android_tmp_t;
 		type android_java_t;
 		type android_java_exec_t;
+		type android_sdk_t;
 	')
 
 	role $1 types android_tools_t;
@@ -38,6 +39,10 @@ interface(`android_role',`
 	manage_files_pattern($2, android_home_t, android_home_t)
 	manage_lnk_files_pattern($2, android_home_t, android_home_t)
 
+	list_dirs_pattern($2, android_sdk_t, android_sdk_t)
+	read_files_pattern($2, android_sdk_t, android_sdk_t)
+	read_lnk_files_pattern($2, android_sdk_t, android_sdk_t)
+
 	userdom_user_home_dir_filetrans($2, android_home_t, dir, ".android")
 	userdom_user_home_dir_filetrans($2, android_home_t, dir, ".AndroidStudioBeta")
 	userdom_user_home_dir_filetrans($2, android_home_t, dir, ".AndroidStudio")

diff --git a/policy/modules/contrib/android.te b/policy/modules/contrib/android.te
index a76061f..930c6b3 100644
--- a/policy/modules/contrib/android.te
+++ b/policy/modules/contrib/android.te
@@ -28,6 +28,8 @@ type android_home_t; # customizable
 userdom_user_home_content(android_home_t)
 userdom_user_home_dir_filetrans(android_tools_t, android_home_t, { dir file })
 
+type android_sdk_t;
+files_type(android_sdk_t)
 
 ############################
 #
@@ -55,6 +57,7 @@ corenet_tcp_bind_adb_port(android_tools_t)
 corenet_tcp_bind_generic_node(android_tools_t)
 corenet_tcp_connect_adb_port(android_tools_t)
 
+dev_read_sysfs(android_tools_t)
 dev_rw_generic_usb_dev(android_tools_t)
 
 userdom_manage_user_home_content_dirs(android_tools_t)
@@ -75,10 +78,14 @@ allow android_java_t self:tcp_socket { accept listen };
 
 can_exec(android_java_t, android_home_t)
 can_exec(android_java_t, android_java_exec_t)
+can_exec(android_java_t, android_sdk_t)
 
 manage_dirs_pattern(android_java_t, android_home_t, android_home_t)
 manage_files_pattern(android_java_t, android_home_t, android_home_t)
 
+manage_dirs_pattern(android_java_t, android_sdk_t, android_sdk_t)
+manage_files_pattern(android_java_t, android_sdk_t, android_sdk_t)
+
 manage_dirs_pattern(android_java_t, android_tmp_t, android_tmp_t)
 manage_files_pattern(android_java_t, android_tmp_t, android_tmp_t)
 
@@ -87,8 +94,8 @@ corecmd_exec_shell(android_java_t)
 
 corenet_tcp_bind_all_unreserved_ports(android_java_t)
 corenet_tcp_bind_generic_node(android_java_t)
-corenet_tcp_connect_adb_port(android_tools_t)
-corenet_tcp_connect_http_port(android_tools_t)
+corenet_tcp_connect_adb_port(android_java_t)
+corenet_tcp_connect_http_port(android_java_t)
 corenet_udp_bind_generic_node(android_java_t)
 
 domain_dontaudit_getattr_all_domains(android_java_t)