Create sysfs_hwrandom type.
HwRngTest needs access to the hwrandom sysfs files, but untrused_app
does not have access to sysfs. Give these files their own label and
allow the needed read access.
(cherry-pick from internal commit: 85c0f8affa4d3aa3c50331e272327e360eb8bed9)
Bug: 27263241
Change-Id: If572ad0931a534d76e148b688b76687460e99af9
diff --git a/file.te b/file.te
index 2dcce5a..15ed536 100644
--- a/file.te
+++ b/file.te
@@ -25,6 +25,7 @@
type sysfs_writable, fs_type, sysfs_type, mlstrustedobject;
type sysfs_batteryinfo, fs_type, sysfs_type;
type sysfs_bluetooth_writable, fs_type, sysfs_type, mlstrustedobject;
+type sysfs_hwrandom, fs_type, sysfs_type;
type sysfs_nfc_power_writable, fs_type, sysfs_type, mlstrustedobject;
type sysfs_wake_lock, fs_type, sysfs_type;
type sysfs_mac_address, fs_type, sysfs_type;
diff --git a/file_contexts b/file_contexts
index c06fcbd..785dc9e 100644
--- a/file_contexts
+++ b/file_contexts
@@ -327,6 +327,7 @@
/sys/devices/system/cpu(/.*)? u:object_r:sysfs_devices_system_cpu:s0
/sys/devices/virtual/block/zram\d+(/.*)? u:object_r:sysfs_zram:s0
/sys/devices/virtual/block/zram\d+/uevent u:object_r:sysfs_zram_uevent:s0
+/sys/devices/virtual/misc/hw_random(/.*)? u:object_r:sysfs_hwrandom:s0
/sys/power/wake_lock -- u:object_r:sysfs_wake_lock:s0
/sys/power/wake_unlock -- u:object_r:sysfs_wake_lock:s0
/sys/kernel/uevent_helper -- u:object_r:usermodehelper:s0
diff --git a/ueventd.te b/ueventd.te
index 003b0e6..f67c0db 100644
--- a/ueventd.te
+++ b/ueventd.te
@@ -13,6 +13,7 @@
allow ueventd device:file create_file_perms;
allow ueventd device:chr_file rw_file_perms;
allow ueventd sysfs:file rw_file_perms;
+allow ueventd sysfs_hwrandom:file w_file_perms;
allow ueventd sysfs_zram_uevent:file w_file_perms;
allow ueventd sysfs_type:{ file lnk_file } { relabelfrom relabelto setattr getattr };
allow ueventd sysfs_type:dir { relabelfrom relabelto setattr r_dir_perms };
diff --git a/untrusted_app.te b/untrusted_app.te
index 9c2855d..6979651 100644
--- a/untrusted_app.te
+++ b/untrusted_app.te
@@ -95,6 +95,10 @@
# access /proc/net/xt_qtguid/stats
r_dir_file(untrusted_app, proc_net)
+# Cts: HwRngTest
+allow untrusted_app sysfs_hwrandom:dir search;
+allow untrusted_app sysfs_hwrandom:file r_file_perms;
+
###
### neverallow rules
###
