Record observed system_server servicemanager service requests.
Also formally allow dumpstate access to all services and grant system_server
access to address the following non-system_server_service entries:
avc: granted { find } for service=drm.drmManager scontext=u:r:system_server:s0 tcontext=u:object_r:drmserver_service:s0 tclass=service_manager
avc: granted { find } for service=nfc scontext=u:r:system_server:s0 tcontext=u:object_r:nfc_service:s0 tclass=service_manager
Bug: 18106000
Change-Id: Iad16b36acf44bce52c4824f8b53c0e7731c25602
diff --git a/drmserver.te b/drmserver.te
index 482c218..e52d679 100644
--- a/drmserver.te
+++ b/drmserver.te
@@ -53,4 +53,10 @@
allow drmserver system_server_service:service_manager find;
allow drmserver tmp_system_server_service:service_manager find;
+service_manager_local_audit_domain(drmserver)
+auditallow drmserver {
+ tmp_system_server_service
+ -permission_service
+}:service_manager find;
+
selinux_check_access(drmserver)