1vndbinder_use(hal_gnss_default) 2binder_call(hal_gnss_default, per_mgr); 3allow hal_gnss_default per_mgr_service:service_manager find; 4 5allow hal_gnss_default location_data_file:dir { search write }; 6allow hal_gnss_default location_data_file:fifo_file { open read setattr write }; 7allow hal_gnss_default location:unix_stream_socket connectto; 8allow hal_gnss_default location_data_file:dir rw_dir_perms; 9allow hal_gnss_default location_data_file:sock_file write; 10 11# for SUPL/911 related compliance cases 12allow hal_gnss_default netmgrd:unix_stream_socket connectto; 13allow hal_gnss_default netmgrd_socket:dir search; 14allow hal_gnss_default netmgrd_socket:sock_file write; 15allow hal_gnss_default self:netlink_route_socket { bind create nlmsg_read read write }; 16 17# Most HALs are not allowed to use network sockets. Qcom library 18# libqdi is used across multiple processes which are clients of 19# netmgrd including the GNSS HAL. libqdi first attempts to get the network 20# interface using an IOCTL on a UDP INET socket, which isn't allowed here. 21# If that fails, it falls back to using libc's if_nameindex() which requires 22# a netlink route socket, which HALs may use. Due to the initial 23# attempt to use a UDP socket, we still see a selinux denial, 24# but it is safe to ignore. 25# TODO (b/37730994) Remove udp_socket requirement from 26# libqdi and have all its clients use netlink route 27# sockets. 28dontaudit hal_gnss_default self:udp_socket create; 29