1type keystore, domain, domain_deprecated;
2type keystore_exec, exec_type, file_type;
3
4# keystore daemon
5init_daemon_domain(keystore)
6typeattribute keystore mlstrustedsubject;
7binder_use(keystore)
8binder_service(keystore)
9allow keystore keystore_data_file:dir create_dir_perms;
10allow keystore keystore_data_file:notdevfile_class_set create_file_perms;
11allow keystore keystore_exec:file { getattr };
12allow keystore tee_device:chr_file rw_file_perms;
13allow keystore tee:unix_stream_socket connectto;
14
15allow keystore keystore_service:service_manager { add find };
16
17# Check SELinux permissions.
18selinux_check_access(keystore)
19
20###
21### Neverallow rules
22###
23### Protect ourself from others
24###
25
26neverallow { domain -keystore } keystore_data_file:dir ~{ open create read getattr setattr search relabelto ioctl };
27neverallow { domain -keystore } keystore_data_file:notdevfile_class_set ~{ relabelto getattr };
28
29neverallow { domain -keystore -init } keystore_data_file:dir *;
30neverallow { domain -keystore -init } keystore_data_file:notdevfile_class_set *;
31
32neverallow * keystore:process ptrace;
33