From 84d3db58791d1780b8384121ae5212587f911416 Mon Sep 17 00:00:00 2001 From: Michael Bestas Date: Wed, 19 Apr 2023 00:05:59 +0300 Subject: [PATCH] sm6375-common: sepolicy: Label init.mmi.boot.sh and resolve denials Change-Id: I78dcfb47e28a20304e64880aeae1876d566d7924 --- sepolicy/vendor/file_contexts | 1 + sepolicy/vendor/property_contexts | 4 ++++ sepolicy/vendor/vendor_mmi_boot.te | 15 +++++++++++++++ 3 files changed, 20 insertions(+) create mode 100644 sepolicy/vendor/vendor_mmi_boot.te diff --git a/sepolicy/vendor/file_contexts b/sepolicy/vendor/file_contexts index 7e3b976..ba21575 100644 --- a/sepolicy/vendor/file_contexts +++ b/sepolicy/vendor/file_contexts @@ -84,6 +84,7 @@ # Vendor init scripts /(vendor|system/vendor)/bin/load_touch\.sh u:object_r:vendor_qti_init_shell_exec:s0 +/(vendor|system/vendor)/bin/init\.mmi\.boot\.sh u:object_r:vendor_mmi_boot_exec:s0 /(vendor|system/vendor)/bin/init\.mmi\.laser\.sh u:object_r:vendor_mmi_laser_exec:s0 /(vendor|system/vendor)/bin/init\.mmi\.touch\.sh u:object_r:vendor_init_touch_exec:s0 /(vendor|system/vendor)/bin/init\.oem\.(fingerprint2|fingerprint\.overlay)\.sh u:object_r:vendor_init_fingerprint_exec:s0 diff --git a/sepolicy/vendor/property_contexts b/sepolicy/vendor/property_contexts index f1e63b1..c049381 100644 --- a/sepolicy/vendor/property_contexts +++ b/sepolicy/vendor/property_contexts @@ -7,7 +7,11 @@ ro.vendor.ril.svdo u:object_r:vendor_radio_prop:s0 # Motorola persist.vendor.nfc. u:object_r:vendor_mot_nfc_prop:s0 ro.vendor.hw. u:object_r:vendor_mot_hw_prop:s0 +ro.vendor.mot.cust_md5 u:object_r:vendor_mot_hw_prop:s0 ro.vendor.mot.gki. u:object_r:vendor_mot_hw_prop:s0 +ro.vendor.mot.iccid u:object_r:vendor_mot_hw_prop:s0 +ro.vendor.bootreason u:object_r:vendor_mot_hw_prop:s0 +ro.vendor.manufacturedate u:object_r:vendor_mot_hw_prop:s0 ro.vendor.product.device u:object_r:vendor_mot_hw_prop:s0 ro.vendor.product.display u:object_r:vendor_mot_hw_prop:s0 ro.vendor.product.hardware.sku.variant u:object_r:vendor_mot_hw_prop:s0 diff --git a/sepolicy/vendor/vendor_mmi_boot.te b/sepolicy/vendor/vendor_mmi_boot.te new file mode 100644 index 0000000..56d922b --- /dev/null +++ b/sepolicy/vendor/vendor_mmi_boot.te @@ -0,0 +1,15 @@ +type vendor_mmi_boot, domain; +type vendor_mmi_boot_exec, exec_type, vendor_file_type, file_type; +init_daemon_domain(vendor_mmi_boot) + +allow vendor_mmi_boot mnt_vendor_file:dir search; +allow vendor_mmi_boot mnt_vendor_file:file r_file_perms; + +allow vendor_mmi_boot proc_moto_boot:file r_file_perms; + +allow vendor_mmi_boot vendor_proc_hw:dir r_dir_perms; +allow vendor_mmi_boot vendor_proc_hw:file r_file_perms; + +allow vendor_mmi_boot vendor_toolbox_exec:file rx_file_perms; + +set_prop(vendor_mmi_boot, vendor_mot_hw_prop)