sdm845-common: Start using vendor_overlay

* This lets us override files in /vendor without
  relying on bind mounts ^.^

Change-Id: Ib0b173682a48836aeac97e2c3691176a44f13aab

BoardConfigCommon.mk

@@ -90,6 +90,9 @@ TARGET_USES_HWC2 := true
 # DRM
 TARGET_ENABLE_MEDIADRM_64 := true
 
+# Filesystem
+TARGET_FS_CONFIG_GEN := $(COMMON_PATH)/config.fs
+
 # HIDL
 DEVICE_FRAMEWORK_MANIFEST_FILE := $(COMMON_PATH)/framework_manifest.xml
 
@@ -122,9 +125,6 @@ BOARD_ROOT_EXTRA_SYMLINKS := \
 # Telephony
 TARGET_PROVIDES_QTI_TELEPHONY_JAR := true
 
-# SELinux
-PRIVATE_EXCLUDE_BUILD_TEST := true
-
 # Sepolicy
 BOARD_PLAT_PRIVATE_SEPOLICY_DIR += $(COMMON_PATH)/sepolicy/private
 

common.mk

@@ -30,6 +30,9 @@ DEVICE_PACKAGE_OVERLAYS += \
 
 PRODUCT_COMPATIBLE_PROPERTY_OVERRIDE := true
 
+# VNDK
+PRODUCT_TARGET_VNDK_VERSION := 28
+
 # Permissions
 PRODUCT_COPY_FILES += \
     frameworks/native/data/etc/handheld_core_hardware.xml:system/etc/permissions/handheld_core_hardware.xml
@@ -62,7 +65,8 @@ PRODUCT_PACKAGES += \
     libaacwrapper
 
 PRODUCT_COPY_FILES += \
-    $(LOCAL_PATH)/audio/audio_policy_configuration.xml:system/etc/audio_policy_configuration.xml
+    $(LOCAL_PATH)/audio/audio_policy_configuration.xml:$(TARGET_COPY_OUT_PRODUCT)/vendor_overlay/$(PRODUCT_TARGET_VNDK_VERSION)/etc/audio/audio_policy_configuration.xml \
+    $(LOCAL_PATH)/audio/audio_policy_configuration.xml:$(TARGET_COPY_OUT_PRODUCT)/vendor_overlay/$(PRODUCT_TARGET_VNDK_VERSION)/etc/audio_policy_configuration.xml
 
 # Boot control
 PRODUCT_PACKAGES += \

config.fs

@@ -0,0 +1,5 @@
+[system/product/vendor_overlay/*/bin/*]
+mode: 0755
+user: AID_ROOT
+group: AID_SHELL
+caps: 0

lights/Android.bp

@@ -1,32 +0,0 @@
-//
-// Copyright (C) 2018 The LineageOS Project
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//      http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-cc_binary {
-    relative_install_path: "hw",
-    defaults: ["hidl_defaults"],
-    name: "android.hardware.light@2.0-service.oneplus_sdm845",
-    init_rc: ["android.hardware.light@2.0-service.oneplus_sdm845.rc"],
-    srcs: ["service.cpp", "Light.cpp"],
-    shared_libs: [
-        "libbase",
-        "libhardware",
-        "libhidlbase",
-        "libhidltransport",
-        "liblog",
-        "libhwbinder",
-        "libutils",
-        "android.hardware.light@2.0",
-    ],
-}

lights/Android.mk

@@ -0,0 +1,42 @@
+LOCAL_PATH := $(call my-dir)
+
+include $(CLEAR_VARS)
+
+LOCAL_MODULE := android.hardware.light@2.0-service.oneplus_sdm845
+LOCAL_MODULE_TAGS  := optional
+
+LOCAL_MODULE_PATH := $(TARGET_OUT_PRODUCT)/vendor_overlay/$(PRODUCT_TARGET_VNDK_VERSION)/bin
+LOCAL_MODULE_RELATIVE_PATH := hw
+LOCAL_MODULE_STEM := android.hardware.light@2.0-service
+
+LOCAL_SRC_FILES := \
+    service.cpp \
+    Light.cpp
+
+LOCAL_REQUIRED_MODULES := \
+    android.hardware.light@2.0-service.oneplus_sdm845.rc
+
+LOCAL_SHARED_LIBRARIES := \
+    libbase \
+    libhardware \
+    libhidlbase \
+    libhidltransport \
+    liblog \
+    libhwbinder \
+    libutils \
+    android.hardware.light@2.0
+
+include $(BUILD_EXECUTABLE)
+
+include $(CLEAR_VARS)
+
+LOCAL_MODULE := android.hardware.light@2.0-service.oneplus_sdm845.rc
+LOCAL_MODULE_TAGS  := optional
+LOCAL_MODULE_CLASS := ETC
+
+LOCAL_MODULE_PATH := $(TARGET_OUT_PRODUCT)/vendor_overlay/$(PRODUCT_TARGET_VNDK_VERSION)/etc/init
+LOCAL_MODULE_STEM := android.hardware.light@2.0-service.rc
+
+LOCAL_SRC_FILES := android.hardware.light@2.0-service.oneplus_sdm845.rc
+
+include $(BUILD_PREBUILT)

lights/android.hardware.light@2.0-service.oneplus_sdm845.rc

@@ -6,7 +6,7 @@ on boot
     chown system system /sys/class/leds/green/lut_flags
     chown system system /sys/class/leds/blue/lut_flags
 
-service vendor.light-hal-2-0 /system/bin/hw/android.hardware.light@2.0-service.oneplus_sdm845
+service vendor.light-hal-2-0 /vendor/bin/hw/android.hardware.light@2.0-service
     interface android.hardware.light@2.0::ILight default
     class hal
     user system

power/Android.mk

@@ -3,6 +3,8 @@ LOCAL_PATH := $(call my-dir)
 include $(CLEAR_VARS)
 
 LOCAL_MODULE := power.qcom
+LOCAL_MODULE_PATH_32 := $(TARGET_OUT_PRODUCT)/vendor_overlay/$(PRODUCT_TARGET_VNDK_VERSION)/lib
+LOCAL_MODULE_PATH_64 := $(TARGET_OUT_PRODUCT)/vendor_overlay/$(PRODUCT_TARGET_VNDK_VERSION)/lib64
 LOCAL_MODULE_RELATIVE_PATH := hw
 LOCAL_MODULE_TAGS := optional
 

rootdir/etc/init.qcom.rc

@@ -1,7 +1,4 @@
 on post-fs
-    mount none /system/etc/audio_policy_configuration.xml /vendor/etc/audio/audio_policy_configuration.xml bind
-    mount none /system/etc/audio_policy_configuration.xml /vendor/etc/audio_policy_configuration.xml bind
-    mount none /system/lib64/hw/power.qcom.so /vendor/lib64/hw/power.qcom.so bind
     mount none /system/lib/modules/wlan.ko /vendor/lib/modules-aging/qca_cld3_wlan.ko bind
     mount none /system/lib/modules/wlan.ko /vendor/lib/modules/qca_cld3_wlan.ko bind
 

sepolicy/private/audioserver.te

@@ -1,2 +0,0 @@
-# Allow audioserver to read system_configs_file
-allow audioserver system_configs_file:file r_file_perms;

sepolicy/private/file.te

@@ -18,6 +18,3 @@ type sysfs_oem, sysfs_type, fs_type;
 
 # data
 type display_misc_file, file_type, data_file_type, core_data_file_type;
-
-# system
-type system_configs_file, system_file_type, file_type;

sepolicy/private/file_contexts

@@ -12,11 +12,8 @@
 # Files in sysfs
 /sys/devices/platform/soc/soc:goodix_fp/proximity_state    u:object_r:sysfs_fpc_proximity:s0
 
-# Audio
-/system/etc/audio_policy_configuration.xml    u:object_r:system_configs_file:s0
-
 # HALs
-/system/bin/hw/android\.hardware\.light@2\.0-service\.oneplus_sdm845    u:object_r:hal_light_sdm845_exec:s0
+/(product|system/product)/vendor_overlay/[0-9]+/bin/hw/android\.hardware\.light@2\.0-service    u:object_r:hal_light_default_exec:s0
 /system/bin/hw/lineage\.biometrics\.fingerprint\.inscreen@1.0-service\.oneplus_fajita    u:object_r:hal_fod_sdm845_exec:s0
 /system/bin/hw/lineage\.livedisplay@2\.0-service\.oneplus_sdm845    u:object_r:hal_livedisplay_sdm845_exec:s0
 /system/bin/hw/lineage\.touch@1\.0-service\.oneplus_sdm845    u:object_r:hal_touch_sdm845_exec:s0
@@ -27,3 +24,7 @@
 
 # tri-state-key
 /system/bin/tri-state-key_daemon          u:object_r:tri-state-key_daemon_exec:s0
+
+# Vendor overlay
+/(product|system/product)/vendor_overlay/[0-9]+/etc(/.*)?      u:object_r:vendor_configs_file:s0
+/(product|system/product)/vendor_overlay/[0-9]+/lib(64)?/hw    u:object_r:vendor_hal_file:s0

sepolicy/private/hal_light.te

@@ -0,0 +1 @@
+allow hal_light sysfs_oem:file getattr;

sepolicy/private/hal_light_sdm845.te

@@ -1,20 +0,0 @@
-type hal_light_sdm845, coredomain, domain;
-
-# Allow a base set of permissions required for a domain to offer a
-# HAL implementation of the specified type over HwBinder.
-typeattribute hal_light_sdm845 halserverdomain;
-typeattribute hal_light_sdm845 hal_light_server;
-
-# HwBinder IPC from client to server, and callbacks
-binder_call(hal_light_client, hal_light_server)
-binder_call(hal_light_server, hal_light_client)
-
-add_hwservice(hal_light_server, hal_light_hwservice)
-allow hal_light_client hal_light_hwservice:hwservice_manager find;
-
-type hal_light_sdm845_exec, system_file_type, exec_type, file_type;
-init_daemon_domain(hal_light_sdm845)
-
-allow hal_light_sdm845 { sysfs_graphics sysfs_oem }:lnk_file read;
-allow hal_light_sdm845 { sysfs_graphics sysfs_oem }:file rw_file_perms;
-allow hal_light_sdm845 { sysfs_graphics sysfs_leds sysfs_oem }:dir r_dir_perms;

sepolicy/private/init.te

@@ -2,7 +2,7 @@
 allow init { system_file vendor_file }:file mounton;
 
 # Allow init to mount vendor configs
-allow init { system_configs_file vendor_configs_file }:file mounton;
+allow init vendor_configs_file:dir mounton;
 
 # Allow init to chown/chmod on pseudo files in /sys
 allow init {