From 737f9a167a9fc43d9ef6dc8bdc9b44d831f4713a Mon Sep 17 00:00:00 2001
From: Stephen Smalley <sds@tycho.nsa.gov>
Date: Fri, 20 Dec 2013 13:26:11 -0500
Subject: [PATCH] Add policy for x86 emulator.

---
 target/board/generic_x86/BoardConfig.mk            | 8 ++++++++
 target/board/generic_x86/sepolicy/domain.te        | 1 +
 target/board/generic_x86/sepolicy/healthd.te       | 1 +
 target/board/generic_x86/sepolicy/installd.te      | 1 +
 target/board/generic_x86/sepolicy/system_server.te | 1 +
 target/board/generic_x86/sepolicy/zygote.te        | 2 ++
 6 files changed, 14 insertions(+)
 create mode 100644 target/board/generic_x86/sepolicy/domain.te
 create mode 100644 target/board/generic_x86/sepolicy/healthd.te
 create mode 100644 target/board/generic_x86/sepolicy/installd.te
 create mode 100644 target/board/generic_x86/sepolicy/system_server.te
 create mode 100644 target/board/generic_x86/sepolicy/zygote.te

diff --git a/target/board/generic_x86/BoardConfig.mk b/target/board/generic_x86/BoardConfig.mk
index ed7da3856..2381fea27 100644
--- a/target/board/generic_x86/BoardConfig.mk
+++ b/target/board/generic_x86/BoardConfig.mk
@@ -41,3 +41,11 @@ BOARD_CACHEIMAGE_PARTITION_SIZE := 69206016
 BOARD_CACHEIMAGE_FILE_SYSTEM_TYPE := ext4
 BOARD_FLASH_BLOCK_SIZE := 512
 TARGET_USERIMAGES_SPARSE_EXT_DISABLED := true
+
+BOARD_SEPOLICY_DIRS += build/target/board/generic_x86/sepolicy
+BOARD_SEPOLICY_UNION += \
+        domain.te \
+        healthd.te \
+        installd.te \
+        system_server.te \
+        zygote.te
diff --git a/target/board/generic_x86/sepolicy/domain.te b/target/board/generic_x86/sepolicy/domain.te
new file mode 100644
index 000000000..0bc8d871f
--- /dev/null
+++ b/target/board/generic_x86/sepolicy/domain.te
@@ -0,0 +1 @@
+allow domain cpuctl_device:dir search;
diff --git a/target/board/generic_x86/sepolicy/healthd.te b/target/board/generic_x86/sepolicy/healthd.te
new file mode 100644
index 000000000..95fa8079b
--- /dev/null
+++ b/target/board/generic_x86/sepolicy/healthd.te
@@ -0,0 +1 @@
+allow healthd self:capability sys_nice;
diff --git a/target/board/generic_x86/sepolicy/installd.te b/target/board/generic_x86/sepolicy/installd.te
new file mode 100644
index 000000000..7a558b129
--- /dev/null
+++ b/target/board/generic_x86/sepolicy/installd.te
@@ -0,0 +1 @@
+allow installd self:process execmem;
diff --git a/target/board/generic_x86/sepolicy/system_server.te b/target/board/generic_x86/sepolicy/system_server.te
new file mode 100644
index 000000000..5d98a14a9
--- /dev/null
+++ b/target/board/generic_x86/sepolicy/system_server.te
@@ -0,0 +1 @@
+allow system_server self:process execmem;
diff --git a/target/board/generic_x86/sepolicy/zygote.te b/target/board/generic_x86/sepolicy/zygote.te
new file mode 100644
index 000000000..93993a47f
--- /dev/null
+++ b/target/board/generic_x86/sepolicy/zygote.te
@@ -0,0 +1,2 @@
+allow zygote self:process execmem;
+allow zygote self:capability sys_nice;