commit 13abb1701b1888a793e4d22e59d780779bd175f7
author Andres Morales <anmorales@google.com> Wed Apr 08 19:52:19 2015 -0700
committer Andres Morales <anmorales@google.com> Thu Apr 09 04:06:36 2015 +0000
tree 69648094a5b38e7a1a1268f107208ed6f50df6e4
parent e207986ea08feebd04f32cd2beff0b1602d08074

Allow gatekeeperd to check Android permissions

Change-Id: Ie88568c43642505f68d137843a1f6b7a3de481e5

gatekeeperd.te

diff --git a/gatekeeperd.te b/gatekeeperd.te
index 45bf7d9..dfb2c7f 100644
--- a/gatekeeperd.te
+++ b/gatekeeperd.te
@@ -7,9 +7,15 @@
 binder_service(gatekeeperd)
 allow gatekeeperd tee_device:chr_file rw_file_perms;
 
+# need to find KeyStore and add self
 allow gatekeeperd gatekeeper_service:service_manager { add find };
 
+# Need to add auth tokens to KeyStore
 allow gatekeeperd keystore:keystore_key { add_auth };
 
+# For permissions checking
+allow gatekeeperd system_server:binder call;
+allow gatekeeperd permission_service:service_manager find;
+
 neverallow { domain -gatekeeperd -system_server } gatekeeper_service:service_manager find;
 neverallow { domain -gatekeeperd } gatekeeper_service:service_manager add;