diff --git a/sepolicy/vendor/abox.te b/sepolicy/vendor/abox.te new file mode 100644 index 0000000..41f84e0 --- /dev/null +++ b/sepolicy/vendor/abox.te @@ -0,0 +1,7 @@ +type abox, domain, mlstrustedsubject; +type abox_exec, exec_type, file_type, vendor_file_type; +init_daemon_domain(abox) + +allow abox sysfs_abox_writable:file rw_file_perms; + +allow abox self:netlink_kobject_uevent_socket create_socket_perms_no_ioctl; diff --git a/sepolicy/vendor/app.te b/sepolicy/vendor/app.te new file mode 100644 index 0000000..f2f2bef --- /dev/null +++ b/sepolicy/vendor/app.te @@ -0,0 +1 @@ +get_prop(appdomain, exported_camera_prop); diff --git a/sepolicy/vendor/attributes b/sepolicy/vendor/attributes new file mode 100644 index 0000000..b19b41e --- /dev/null +++ b/sepolicy/vendor/attributes @@ -0,0 +1,6 @@ +attribute hal_tee_client; +attribute hal_tee_server; +attribute hal_tee; +attribute hal_teeregistry_client; +attribute hal_teeregistry_server; +attribute hal_teeregistry; diff --git a/sepolicy/vendor/bootanim.te b/sepolicy/vendor/bootanim.te new file mode 100644 index 0000000..79257f4 --- /dev/null +++ b/sepolicy/vendor/bootanim.te @@ -0,0 +1 @@ +get_prop(bootanim, userspace_reboot_exported_prop) diff --git a/sepolicy/vendor/device.te b/sepolicy/vendor/device.te index e7fb8fa..a9b6694 100644 --- a/sepolicy/vendor/device.te +++ b/sepolicy/vendor/device.te @@ -12,3 +12,5 @@ type m2m1shot_device, dev_type; # gps type gps_device, dev_type; + +type mobicore_vendor_file, dev_type; diff --git a/sepolicy/vendor/file.te b/sepolicy/vendor/file.te index c7b72ca..2e115f5 100644 --- a/sepolicy/vendor/file.te +++ b/sepolicy/vendor/file.te @@ -25,11 +25,11 @@ type fingerprintd_vendor_data_file, data_file_type, file_type; type mediadrm_data_file, file_type, data_file_type; # sysfs types +type sysfs_abox_writable, sysfs_type, rw_fs_type, fs_type; type sysfs_batteryinfo_charger_writable, sysfs_type, rw_fs_type, fs_type; type sysfs_camera_writable, sysfs_type, rw_fs_type, fs_type; type sysfs_decon, sysfs_type, r_fs_type, fs_type; type sysfs_gpu, sysfs_type, r_fs_type, fs_type; -type sysfs_sec_switch, sysfs_type, r_fs_type, fs_type; type sysfs_socinfo, sysfs_type, r_fs_type, fs_type; type sysfs_v4l, sysfs_type, r_fs_type, fs_type; type sysfs_v4l_mfc, sysfs_type, r_fs_type, fs_type; diff --git a/sepolicy/vendor/file_contexts b/sepolicy/vendor/file_contexts index 3424af5..8eebf6f 100644 --- a/sepolicy/vendor/file_contexts +++ b/sepolicy/vendor/file_contexts @@ -4,7 +4,6 @@ /dev/mali[0-9]* u:object_r:gpu_device:s0 /dev/umts_ipc0 u:object_r:radio_device:s0 /dev/fimg2d u:object_r:video_device:s0 -/dev/vfsspi u:object_r:fingerprint_device:s0 /dev/sec-nfc u:object_r:nfc_device:s0 /dev/cpuset(/.*)? u:object_r:cgroup:s0 @@ -23,16 +22,16 @@ # zram /dev/block/zram0 u:object_r:swap_block_device:s0 -/dev/block/platform/11120000\.ufs/by-name/CACHE u:object_r:cache_block_device:s0 -/dev/block/platform/11120000\.ufs/by-name/CPEFS u:object_r:efs_block_device:s0 -/dev/block/platform/11120000\.ufs/by-name/EFS u:object_r:efs_block_device:s0 -/dev/block/platform/11120000\.ufs/by-name/KEYREFUGE u:object_r:keyrefuge_block_device:s0 -/dev/block/platform/11120000\.ufs/by-name/MISC u:object_r:misc_block_device:s0 -/dev/block/platform/11120000\.ufs/by-name/OMR u:object_r:omr_block_device:s0 -/dev/block/platform/11120000\.ufs/by-name/PERSISTENT u:object_r:frp_block_device:s0 -/dev/block/platform/11120000\.ufs/by-name/RADIO u:object_r:radio_block_device:s0 -/dev/block/platform/11120000\.ufs/by-name/SYSTEM u:object_r:system_block_device:s0 -/dev/block/platform/11120000\.ufs/by-name/USERDATA u:object_r:userdata_block_device:s0 +/dev/block/platform/.+/by-name/(omr|OMR)? u:object_r:omr_block_device:s0 +/dev/block/platform/.+/by-name/(misc|MISC)? u:object_r:misc_block_device:s0 +/dev/block/platform/.+/by-name/(cpefs|CPEFS)? u:object_r:efs_block_device:s0 +/dev/block/platform/.+/by-name/(efs|EFS)? u:object_r:efs_block_device:s0 +/dev/block/platform/.+/by-name/(radio|RADIO)? u:object_r:radio_block_device:s0 +/dev/block/platform/.+/by-name/(cache|CACHE)? u:object_r:cache_block_device:s0 +/dev/block/platform/.+/by-name/(system|SYSTEM)? u:object_r:system_block_device:s0 +/dev/block/platform/.+/by-name/(userdata|USERDATA)? u:object_r:userdata_block_device:s0 +/dev/block/platform/.+/by-name/(keyrefuge|KEYREFUGE)? u:object_r:keyrefuge_block_device:s0 +/dev/block/platform/.+/by-name/(persistent|PERSISTENT)? u:object_r:frp_block_device:s0 #################################### # efs files @@ -76,16 +75,13 @@ /sys/class/power_supply/battery/music -- u:object_r:sysfs:s0 /sys/class/devfreq/17000010.devfreq_mif(/.*)? -- u:object_r:sysfs:s0 -# gps -/sys/class/sec/gps/GPS_PWR_EN/value u:object_r:sysfs_gps:s0 - # charger /sys/devices/battery/power_supply(/.*) u:object_r:sysfs_charger:s0 -/sys/class/power_supply/max77865-charger(/.*) u:object_r:sysfs_charger:s0 -/sys/devices/platform/10940000\.hsi2c/i2c-11/11-003b/power_supply/mfc-charger(/.*) u:object_r:sysfs_charger:s0 -/sys/devices/platform/10970000\.hsi2c/i2c-13/13-0066/max77865-charger/power_supply/otg(/.*)? u:object_r:sysfs_charger:s0 -/sys/devices/platform/10970000\.hsi2c/i2c-13/13-0066/max77865-charger/power_supply/max77865-charger(/.*)? u:object_r:sysfs_charger:s0 -/sys/devices/platform/10970000\.hsi2c/i2c-13/13-0066/max77865-fuelgauge/power_supply/max77865-fuelgauge(/.*)? u:object_r:sysfs_charger:s0 +/sys/devices/platform/13840000\.i2c/i2c-10/10-003d/s2mu004-charger/power_supply/s2mu004-charger(/.*) u:object_r:sysfs_charger:s0 +/sys/devices/platform/13840000\.i2c/i2c-10/10-003d/s2mu004-charger/power_supply/otg(/.*)? u:object_r:sysfs_charger:s0 +/sys/devices/platform/13840000\.i2c/i2c-10/10-003d/s2mu004-charger/power_supply/s2mu004-charger(/.*)? u:object_r:sysfs_charger:s0 +/sys/devices/platform/13830000\.i2c/i2c-9/9-003b/power_supply/s2mu004-fuelgauge(/.*)? u:object_r:sysfs_charger:s0 +/sys/devices/platform/13840000\.i2c/i2c-10/10-003d/s2mu004-muic/power_supply/muic-manager(/.*)? u:object_r:sysfs_charger:s0 # sec /sys/class/sec(/.*)? -- u:object_r:sysfs_sec:s0 @@ -94,12 +90,11 @@ /sys/devices/virtual(/.*)? u:object_r:sysfs_virtual:s0 # iio -/sys/devices/platform/15b70000\.adc/iio:device[0-9](/.*)? u:object_r:sysfs_iio:s0 /sys/bus/iio/devices(/.*)? u:object_r:sysfs_iio:s0 # Backlight/Notification LED control -/sys/devices/platform/panel_drv@001/backlight/panel/brightness u:object_r:sysfs_graphics:s0 -/sys/devices/platform/panel_drv@001/backlight/panel/max_brightness u:object_r:sysfs_graphics:s0 +/sys/class/backlight/panel/brightness u:object_r:sysfs_graphics:s0 +/sys/class/backlight/panel/max_brightness u:object_r:sysfs_graphics:s0 # camera /sys/devices/virtual/camera(/.*)? u:object_r:sysfs_camera:s0 @@ -107,54 +102,45 @@ # rild /sys/devices/virtual/misc/multipdp(/.*) u:object_r:sysfs_multipdp:s0 -# mDNIe -/sys/devices/platform/panel_drv@001/lcd/panel/mdnie/mode u:object_r:sysfs_mdnie:s0 -/sys/devices/platform/panel_drv@001/lcd/panel/mdnie/scenario u:object_r:sysfs_mdnie:s0 -/sys/devices/platform/panel_drv@001/lcd/panel/mdnie/lux u:object_r:sysfs_mdnie:s0 -/sys/devices/platform/panel_drv@001/lcd/panel/mdnie/sensorRGB u:object_r:sysfs_mdnie:s0 -/sys/devices/platform/panel_drv@001/lcd/panel/mdnie/accessibility u:object_r:sysfs_mdnie:s0 -/sys/devices/platform/panel_drv@001/lcd/panel/mdnie/night_mode u:object_r:sysfs_mdnie:s0 -/sys/devices/platform/panel_drv@001/lcd/panel/mdnie/mdnie_ldu u:object_r:sysfs_mdnie:s0 -/sys/devices/platform/panel_drv@001/lcd/panel/mdnie/whiteRGB u:object_r:sysfs_mdnie:s0 - # input -/sys/devices/platform/gpio_keys/input/input6(/.*)? u:object_r:sysfs_input:s0 -/sys/devices/platform/hall/input/input7(/.*)? u:object_r:sysfs_input:s0 -/sys/devices/platform/certify_hall/input/input8(/.*)? u:object_r:sysfs_input:s0 - -# lcd -/sys/devices/platform/panel_drv@001/lcd/panel/adaptive_control u:object_r:sysfs_lcd:s0 -/sys/devices/platform/panel_drv@001/lcd/panel/alpm u:object_r:sysfs_lcd:s0 -/sys/devices/platform/panel_drv@001/lcd/panel/dpui u:object_r:sysfs_lcd:s0 -/sys/devices/platform/panel_drv@001/lcd/panel/dpui_dbg u:object_r:sysfs_lcd:s0 -/sys/devices/platform/panel_drv@001/lcd/panel/lcd_type u:object_r:sysfs_lcd:s0 -/sys/devices/platform/panel_drv@001/lcd/panel/lux u:object_r:sysfs_lcd:s0 -/sys/devices/platform/panel_drv@001/lcd/panel/manufacture_code u:object_r:sysfs_lcd:s0 -/sys/devices/platform/panel_drv@001/lcd/panel/temperature u:object_r:sysfs_lcd:s0 -/sys/devices/platform/panel_drv@001/lcd/panel/window_type u:object_r:sysfs_lcd:s0 +/sys/devices/platform/gpio_keys/input/input12(/.*)? u:object_r:sysfs_input:s0 # modem /sys/module/modem_ctrl_ss310ap/parameters/ds_detect u:object_r:sysfs_modem:s0 +# gps +/sys/devices/soc0/machine u:object_r:sysfs_sec_gps:s0 +/sys/devices/soc0/revision u:object_r:sysfs_sec_gps:s0 +/dev/gnss_ipc u:object_r:gps_device:s0 + +# bt +/dev/scsc_h4_0 u:object_r:bt_device:s0 + # ZRAM /sys/devices/virtual/block/zram0/mm_stat u:object_r:sysfs_zram:s0 - -# Lineage hals -/(vendor|system/vendor)/bin/hw/vendor\.lineage\.livedisplay@[0-9]\.[0-9]-service\.universal8895 u:object_r:hal_lineage_livedisplay_sysfs_exec:s0 - ### VENDOR -/(vendor|system/vendor)/bin/vendor\.samsung\.hardware\.security\.widevine\.keyprovisioning@[0-9]\.[0-9]-service u:object_r:hal_drm_widevine_exec:s0 +/(vendor|system/vendor)/lib(64)?/hw/android\.hardware\.renderscript@[0-9]\.[0-9]-impl\.so u:object_r:same_process_hal_file:s0 +/(vendor|system/vendor)/lib(64)?/egl/libGLES_mali\.so u:object_r:same_process_hal_file:s0 +/(vendor|system/vendor)/lib(64)?/hw/gralloc\.[a-z0-9]*\.so u:object_r:same_process_hal_file:s0 +/(vendor|system/vendor)/lib(64)?/libion_exynos\.so u:object_r:same_process_hal_file:s0 +/(vendor|system/vendor)/lib(64)?/vulkan\.[a-z0-9]*\.so u:object_r:same_process_hal_file:s0 + +/(vendor|system\/vendor)/app/mcRegistry(/.*)? u:object_r:mobicore_vendor_file:s0 + +/(vendor|system/vendor)/bin/main_abox u:object_r:abox_exec:s0 +/(vendor|system/vendor)/bin/wlbtd u:object_r:wlbtd_exec:s0 /(vendor|system/vendor)/bin/hw/gpsd u:object_r:gpsd_exec:s0 -/(vendor|system/vendor)/bin/hw/lhd u:object_r:lhd_exec:s0 /(vendor|system/vendor)/bin/hw/macloader u:object_r:macloader_exec:s0 /(vendor|system/vendor)/bin/mcDriverDaemon u:object_r:tee_exec:s0 +/(vendor|system/vendor)/bin/hw/android\.hardware\.power@[0-9]\.[0-9]-service\.universal7904 u:object_r:hal_power_default_exec:s0 +/(vendor|system/vendor)/bin/hw/android\.hardware\.vibrator@[0-9]\.[0-9]-service\.samsung u:object_r:hal_vibrator_default_exec:s0 /(vendor|system/vendor)/bin/hw/android\.hardware\.drm@[0-9]\.[0-9]-service\.clearkey u:object_r:hal_drm_clearkey_exec:s0 /(vendor|system/vendor)/bin/hw/android\.hardware\.drm@[0-9]\.[0-9]-service\.widevine u:object_r:hal_drm_widevine_exec:s0 /(vendor|system/vendor)/bin/hw/android\.hardware\.keymaster@[0-9]\.[0-9]-service\.samsung u:object_r:hal_keymaster_default_exec:s0 /(vendor|system/vendor)/bin/hw/android\.hardware\.usb@[0-9]\.[0-9]-service\.basic u:object_r:hal_usb_default_exec:s0 -/(vendor|system/vendor)/bin/hw/android\.hardware\.camera\.provider@[0-9]\.[0-9]-service u:object_r:hal_camera_default_exec:s0 -/(vendor|system/vendor)/bin/hw/sec\.android\.hardware\.nfc@[0-9]\.[0-9]-service u:object_r:hal_nfc_default_exec:s0 /(vendor|system/vendor)/bin/hw/vendor\.samsung\.hardware\.gnss@[0-9]\.[0-9]-service u:object_r:hal_gnss_default_exec:s0 +/(vendor|system/vendor)/bin/hw/vendor\.trustonic\.tee@[0-9]\.[0-9]-service u:object_r:hal_tee_default_exec:s0 +/(vendor|system/vendor)/bin/hw/vendor\.trustonic\.teeregistry@[0-9]\.[0-9]-service u:object_r:hal_teeregistry_default_exec:s0 diff --git a/sepolicy/vendor/genfs_contexts b/sepolicy/vendor/genfs_contexts index 5952cbf..e87b373 100644 --- a/sepolicy/vendor/genfs_contexts +++ b/sepolicy/vendor/genfs_contexts @@ -18,38 +18,24 @@ genfscon sysfs /class/camera u:object_r:sysfs_camera:s0 genfscon sysfs /class/input/input4 u:object_r:sysfs_sensors:s0 genfscon sysfs /class/input/input6 u:object_r:sysfs_sensors:s0 genfscon sysfs /class/video4linux u:object_r:sysfs_v4l:s0 +genfscon sysfs /class/input/input1 u:object_r:sysfs_input:s0 # devices -genfscon sysfs /devices/virtual/sec/led/led_blink u:object_r:sysfs_graphics:s0 -genfscon sysfs /devices/platform/108e0000.hsi2c/i2c-5/5-0049/input/ u:object_r:sysfs_touchscreen_writable:s0 -genfscon sysfs /devices/platform/10970000.spi/ u:object_r:sysfs_spi_writeable:s0 -genfscon sysfs /devices/platform/108c0000.spi/ u:object_r:sysfs_spi_writeable:s0 -genfscon sysfs /devices/platform/10460000.spi/ u:object_r:sysfs_spi_writeable:s0 -genfscon sysfs /devices/platform/164b0000.pinctrl/gpio/gpio13/value u:object_r:sysfs_gps_writable:s0 -genfscon sysfs /devices/platform/11430000.pinctrl/gpio/gpio81/value u:object_r:sysfs_gps_writable:s0 -genfscon sysfs /devices/platform/10980000.pinctrl/gpio/gpio216/value u:object_r:sysfs_gps_writable:s0 genfscon sysfs /module/modem_ctrl_ss310ap/parameters/ds_detect u:object_r:sysfs_sim_writable:s0 -genfscon sysfs /devices/platform/11500000.dwmmc2/mmc_host u:object_r:sysfs_mmc_host_writable:s0 -genfscon sysfs /devices/platform/11120000.ufs/host0 u:object_r:sysfs_scsi_host_writable:s0 -genfscon sysfs /devices/platform/15b50000.speedy/i2c-14/14-0000/s2mps17-rtc/rtc u:object_r:sysfs_rtc:s0 -genfscon sysfs /devices/platform/10970000.hsi2c/i2c-13/13-0066/max77865-charger/power_supply/max77865-charger/type u:object_r:sysfs_batteryinfo_charger_writable:s0 -genfscon sysfs /devices/platform/10970000.hsi2c/i2c-13/13-0066/max77865-charger/power_supply/max77865-charger/chip_id u:object_r:sysfs_batteryinfo_charger_writable:s0 -genfscon sysfs /devices/platform/10970000.hsi2c/i2c-13/13-0066/max77865-charger/power_supply/otg/type u:object_r:sysfs_batteryinfo_charger_writable:s0 -genfscon sysfs /devices/platform/10970000.hsi2c/i2c-13/13-0066/max77865-fuelgauge/power_supply/max77865-fuelgauge/type u:object_r:sysfs_batteryinfo_charger_writable:s0 -genfscon sysfs /devices/platform/10940000.hsi2c/i2c-11/11-003b/power_supply/mfc-charger u:object_r:sysfs_batteryinfo_charger_writable:s0 -genfscon sysfs /devices/platform/12ca0000.fimc_is_sensor/video4linux u:object_r:sysfs_v4l_fimc:s0 -genfscon sysfs /devices/platform/12cb0000.fimc_is_sensor/video4linux u:object_r:sysfs_v4l_fimc:s0 -genfscon sysfs /devices/platform/12cc0000.fimc_is_sensor/video4linux u:object_r:sysfs_v4l_fimc:s0 -genfscon sysfs /devices/platform/12cd0000.fimc_is_sensor/video4linux u:object_r:sysfs_v4l_fimc:s0 -genfscon sysfs /devices/platform/12ce0000.fimc_is/video4linux u:object_r:sysfs_v4l_fimc:s0 -genfscon sysfs /devices/platform/13ce0000.mfc0/video4linux u:object_r:sysfs_v4l_mfc:s0 -genfscon sysfs /devices/platform/13b00000.smfc/video4linux u:object_r:sysfs_v4l_smfc:s0 -genfscon sysfs /devices/platform/12860000.decon_f u:object_r:sysfs_decon:s0 -genfscon sysfs /devices/platform/12860000.decon_f/vsync u:object_r:sysfs_ss_writable:s0 -genfscon sysfs /devices/platform/12a30000.decon_s u:object_r:sysfs_decon:s0 -genfscon sysfs /devices/platform/12a30000.decon_s/vsync u:object_r:sysfs_ss_writable:s0 -genfscon sysfs /devices/platform/12a40000.decon_t u:object_r:sysfs_decon:s0 -genfscon sysfs /devices/platform/12a40000.decon_t/vsync u:object_r:sysfs_ss_writable:s0 +genfscon sysfs /devices/platform/10000.mif_pdata/sim/ds_detect u:object_r:sysfs_sim_writable:s0 +genfscon sysfs /module/scsc_bt/parameters/bluetooth_address u:object_r:sysfs_bt_writable:s0 +genfscon sysfs /devices/platform/11ce0000.speedy/i2c-7/7-0000/s2mpu08-rtc/rtc u:object_r:sysfs_rtc:s0 +genfscon sysfs /devices/platform/11ce0000.speedy/i2c-7/7-0003/input/input11 u:object_r:sysfs_touchscreen_writable:s0 +genfscon sysfs /devices/platform/13930000.hsi2c/i2c-5/5-0048/input/ u:object_r:sysfs_touchscreen_writable:s0 +genfscon sysfs /devices/platform/14870000.dsim/backlight/panel u:object_r:sysfs_graphics:s0 +genfscon sysfs /devices/platform/14a50000.abox/service u:object_r:sysfs_abox_writable:s0 +genfscon sysfs /devices/platform/14860000.decon_f u:object_r:sysfs_decon:s0 +genfscon sysfs /devices/platform/14410000.fimc_is_sensor/video4linux u:object_r:sysfs_v4l_fimc:s0 +genfscon sysfs /devices/platform/14430000.fimc_is_sensor/video4linux u:object_r:sysfs_v4l_fimc:s0 +genfscon sysfs /devices/platform/14400000.fimc_is_sensor/video4linux u:object_r:sysfs_v4l_fimc:s0 +genfscon sysfs /devices/platform/14440000.fimc_is/video4linux u:object_r:sysfs_v4l_fimc:s0 +genfscon sysfs /devices/platform/12c30000.mfc0/video4linux u:object_r:sysfs_v4l_mfc:s0 +genfscon sysfs /devices/platform/12c00000.smfc/video4linux u:object_r:sysfs_v4l_smfc:s0 genfscon sysfs /devices/platform/bluetooth/rfkill/rfkill0/state u:object_r:sysfs_bt_writable:s0 genfscon sysfs /devices/platform/battery/power_supply/battery u:object_r:sysfs_battery_writable:s0 genfscon sysfs /devices/platform/battery/power_supply/battery/batt_capacity_max u:object_r:sysfs_battery_writable:s0 @@ -71,7 +57,6 @@ genfscon sysfs /devices/virtual/camera/flash/rear_flash u:object_r:sysfs_ca genfscon sysfs /devices/virtual/input/input3 u:object_r:sysfs_sensors_writable:s0 genfscon sysfs /devices/virtual/input/input4 u:object_r:sysfs_sensors_writable:s0 -genfscon sysfs /devices/virtual/sec/switch u:object_r:sysfs_sec_switch:s0 genfscon sysfs /devices/virtual/sec/sensorhub/mcu_power u:object_r:sysfs_sensorhub_writable:s0 genfscon sysfs /devices/virtual/usb_notify/usb_control/usb_hw_param u:object_r:sysfs_usb_writable:s0 diff --git a/sepolicy/vendor/gpsd.te b/sepolicy/vendor/gpsd.te new file mode 100644 index 0000000..f04ffac --- /dev/null +++ b/sepolicy/vendor/gpsd.te @@ -0,0 +1,12 @@ +r_dir_file(gpsd, sysfs_sec_gps); + +allow gpsd sysfs_gps_writable:file rw_file_perms; +allow gpsd sysfs_wake_lock:file rw_file_perms; + +allow gpsd self:capability net_raw; +allow gpsd self:capability2 block_suspend; + +allow gpsd bt_device:chr_file rw_file_perms; +allow gpsd gps_device:chr_file rw_file_perms; + +allow gpsd gpsd_exec:file execute_no_trans; diff --git a/sepolicy/vendor/hal_fingerprint_default.te b/sepolicy/vendor/hal_fingerprint_default.te index 7a5a796..00aa5bc 100644 --- a/sepolicy/vendor/hal_fingerprint_default.te +++ b/sepolicy/vendor/hal_fingerprint_default.te @@ -2,3 +2,5 @@ allow hal_fingerprint_default fingerprintd_data_file:dir write; allow hal_fingerprint_default fingerprint_device:chr_file rw_file_perms; allow hal_fingerprint_default sysfs_virtual:dir search; allow hal_fingerprint_default sysfs_virtual:file r_file_perms; +allow hal_fingerprint_default mobicore_vendor_file:file r_file_perms; +allow hal_fingerprint_default mobicore_vendor_file:dir search; diff --git a/sepolicy/vendor/hal_gatekeeper_default.te b/sepolicy/vendor/hal_gatekeeper_default.te index c9c3b96..b267f40 100644 --- a/sepolicy/vendor/hal_gatekeeper_default.te +++ b/sepolicy/vendor/hal_gatekeeper_default.te @@ -1,3 +1,7 @@ allow hal_gatekeeper_default gatekeeper_efs_file:file rw_file_perms; allow hal_gatekeeper_default gatekeeper_efs_file:dir search; allow hal_gatekeeper_default efs_file:dir search; +allow hal_gatekeeper_default efs_file:file rw_file_perms; +allow hal_gatekeeper_default mobicore_vendor_file:dir search; +allow hal_gatekeeper_default mobicore_vendor_file:file rw_file_perms; +allow hal_gatekeeper_default mnt_vendor_file:dir search; diff --git a/sepolicy/vendor/hal_gnss_default.te b/sepolicy/vendor/hal_gnss_default.te index c78bb6e..573b370 100644 --- a/sepolicy/vendor/hal_gnss_default.te +++ b/sepolicy/vendor/hal_gnss_default.te @@ -14,3 +14,6 @@ allow hal_gnss_default vndbinder_device:chr_file rw_file_perms; # Connect to socket allow hal_gnss_default gpsd:unix_stream_socket connectto; + +add_hwservice(hal_gnss_default, hal_gnss_hwservice) +allow hal_gnss_default fwk_sensor_hwservice:hwservice_manager find; diff --git a/sepolicy/vendor/hal_graphics_composer_default.te b/sepolicy/vendor/hal_graphics_composer_default.te index d91b790..a73b218 100644 --- a/sepolicy/vendor/hal_graphics_composer_default.te +++ b/sepolicy/vendor/hal_graphics_composer_default.te @@ -23,14 +23,13 @@ allow hal_graphics_composer_default video_device:chr_file rw_file_perms; allow hal_graphics_composer_default sysfs_socinfo:dir r_dir_perms; allow hal_graphics_composer_default sysfs_socinfo:file r_file_perms; -# /sys/devices/platform/12860000.decon_f/psr_info -allow hal_graphics_composer_default sysfs_decon:dir r_dir_perms; -allow hal_graphics_composer_default sysfs_decon:file r_file_perms; - -# /sys/devices/platform/12860000.decon_f/vsync -allow hal_graphics_composer_default sysfs_ss_writable:dir r_dir_perms; -allow hal_graphics_composer_default sysfs_ss_writable:file r_file_perms; # /sys/kernel/debug/dma_buf/footprint/[0-9]+ allow hal_graphics_composer_default debugfs_ion_dma:dir r_dir_perms; allow hal_graphics_composer_default debugfs_ion_dma:file r_file_perms; + +allow hal_graphics_composer_default sysfs_decon:dir r_dir_perms; +allow hal_graphics_composer_default sysfs_decon:file r_file_perms; + +allow hal_graphics_composer_default sysfs_ss_writable:dir r_dir_perms; +allow hal_graphics_composer_default sysfs_ss_writable:file r_file_perms; diff --git a/sepolicy/vendor/hal_health_default.te b/sepolicy/vendor/hal_health_default.te index d8b9c55..65859ee 100644 --- a/sepolicy/vendor/hal_health_default.te +++ b/sepolicy/vendor/hal_health_default.te @@ -5,4 +5,3 @@ allow hal_health_default sysfs_battery:dir r_dir_perms; allow hal_health_default sysfs_battery:file r_file_perms; allow hal_health_default sysfs_battery_writable:dir search; allow hal_health_default sysfs_battery_writable:file r_file_perms; -allow hal_health_default sysfs_batteryinfo_charger_writable:dir search; diff --git a/sepolicy/vendor/hal_keymaster_default.te b/sepolicy/vendor/hal_keymaster_default.te new file mode 100644 index 0000000..29652aa --- /dev/null +++ b/sepolicy/vendor/hal_keymaster_default.te @@ -0,0 +1,2 @@ +allow hal_keymaster_default mobicore_vendor_file:dir search; +allow hal_keymaster_default mobicore_vendor_file:file rw_file_perms; diff --git a/sepolicy/vendor/hal_light_default.te b/sepolicy/vendor/hal_light_default.te index 8fc3fe3..d9dfb63 100644 --- a/sepolicy/vendor/hal_light_default.te +++ b/sepolicy/vendor/hal_light_default.te @@ -1,3 +1,4 @@ +allow hal_light_default sysfs_graphics:dir search; allow hal_light_default sysfs_graphics:file rw_file_perms; allow hal_light_default sysfs_virtual:dir search; allow hal_light_default sysfs_virtual:file rw_file_perms; diff --git a/sepolicy/vendor/hal_lineage_fastcharge_default.te b/sepolicy/vendor/hal_lineage_fastcharge_default.te new file mode 100644 index 0000000..31fc983 --- /dev/null +++ b/sepolicy/vendor/hal_lineage_fastcharge_default.te @@ -0,0 +1,2 @@ +allow hal_lineage_fastcharge_default sysfs_virtual:dir search; +allow hal_lineage_fastcharge_default sysfs_virtual:file rw_file_perms; diff --git a/sepolicy/vendor/hal_lineage_livedisplay_sysfs.te b/sepolicy/vendor/hal_lineage_livedisplay_sysfs.te deleted file mode 100644 index cef5b99..0000000 --- a/sepolicy/vendor/hal_lineage_livedisplay_sysfs.te +++ /dev/null @@ -1,7 +0,0 @@ -# Allow LiveDisplay to store files under /data/vendor/display and access them -allow hal_lineage_livedisplay_sysfs display_vendor_data_file:dir rw_dir_perms; -allow hal_lineage_livedisplay_sysfs display_vendor_data_file:file create_file_perms; - -# Allow LiveDisplay to read and write to files in sysfs_graphics, sysfs_mdnie -allow hal_lineage_livedisplay_sysfs sysfs_mdnie:dir search; -allow hal_lineage_livedisplay_sysfs sysfs_mdnie:file rw_file_perms; diff --git a/sepolicy/vendor/hal_lineage_touch_default.te b/sepolicy/vendor/hal_lineage_touch_default.te new file mode 100644 index 0000000..8d63eb2 --- /dev/null +++ b/sepolicy/vendor/hal_lineage_touch_default.te @@ -0,0 +1,2 @@ +allow hal_lineage_touch_default sysfs_virtual:dir search; +allow hal_lineage_touch_default sysfs_virtual:file rw_file_perms; diff --git a/sepolicy/vendor/hal_memtrack_default.te b/sepolicy/vendor/hal_memtrack_default.te new file mode 100644 index 0000000..991453a --- /dev/null +++ b/sepolicy/vendor/hal_memtrack_default.te @@ -0,0 +1,4 @@ +r_dir_file(hal_memtrack_default, debugfs_mali); +r_dir_file(hal_memtrack_default, debugfs_mali_mem); +r_dir_file(hal_memtrack_default, debugfs_ion); +r_dir_file(hal_memtrack_default, debugfs_ion_dma); diff --git a/sepolicy/vendor/hal_power_default.te b/sepolicy/vendor/hal_power_default.te index dbc59b0..76145fc 100644 --- a/sepolicy/vendor/hal_power_default.te +++ b/sepolicy/vendor/hal_power_default.te @@ -1,7 +1,6 @@ +allow hal_power_default sysfs_graphics:dir search; allow hal_power_default sysfs_graphics:file r_file_perms; allow hal_power_default sysfs_input:file r_file_perms; allow hal_power_default sysfs_virtual:dir r_dir_perms; allow hal_power_default sysfs_virtual:file r_file_perms; -allow hal_power_default sysfs_spi_writeable:dir r_dir_perms; -allow hal_power_default sysfs_spi_writeable:file rw_file_perms; allow hal_power_default sysfs_touchscreen_writable:dir r_dir_perms; diff --git a/sepolicy/vendor/hal_sensors_default.te b/sepolicy/vendor/hal_sensors_default.te index ac1475d..c732d71 100644 --- a/sepolicy/vendor/hal_sensors_default.te +++ b/sepolicy/vendor/hal_sensors_default.te @@ -3,7 +3,10 @@ allow hal_sensors_default sysfs_iio:lnk_file read; allow hal_sensors_default sysfs_virtual:dir r_dir_perms; allow hal_sensors_default sysfs_virtual:file rw_file_perms; allow hal_sensors_default sysfs_virtual:lnk_file read; -allow hal_sensors_default sysfs_lcd:file r_file_perms; allow hal_sensors_default baro_delta_factoryapp_efs_file:file r_file_perms; allow hal_sensors_default sysfs_input:file read; allow hal_sensors_default sysfs_spi_writeable:file rw_file_perms; + +# yas_lib +allow hal_sensors_default vendor_data_file:file create_file_perms; +allow hal_sensors_default vendor_data_file:dir create_dir_perms; diff --git a/sepolicy/vendor/hal_tee_default.te b/sepolicy/vendor/hal_tee_default.te new file mode 100644 index 0000000..100dc7c --- /dev/null +++ b/sepolicy/vendor/hal_tee_default.te @@ -0,0 +1,17 @@ +type hal_tee_default, domain; +type hal_tee_default_exec, exec_type, vendor_file_type, file_type; + +binder_call(hal_tee_client, hal_tee_server) +binder_call(hal_tee_server, hal_tee_client) + +add_hwservice(hal_tee_server, hal_tee_hwservice) +allow hal_tee_client hal_tee_hwservice:hwservice_manager find; + +init_daemon_domain(hal_tee_default); + +hal_server_domain(hal_tee_default, hal_tee) + +hal_client_domain(hal_tee_default, hal_allocator) +allow hal_tee_default hidl_memory_hwservice:hwservice_manager find; + +allow hal_tee_default tee_device:chr_file rw_file_perms; diff --git a/sepolicy/vendor/hal_teeregistry_default.te b/sepolicy/vendor/hal_teeregistry_default.te new file mode 100644 index 0000000..d1e629d --- /dev/null +++ b/sepolicy/vendor/hal_teeregistry_default.te @@ -0,0 +1,21 @@ +type hal_teeregistry_default, domain; +type hal_teeregistry_default_exec, exec_type, vendor_file_type, file_type; + +binder_call(hal_teeregistry_client, hal_teeregistry_server) +binder_call(hal_teeregistry_server, hal_teeregistry_client) + +add_hwservice(hal_teeregistry_server, hal_teeregistry_hwservice) +allow hal_teeregistry_client hal_teeregistry_hwservice:hwservice_manager find; + +hal_server_domain(hal_teeregistry_default, hal_teeregistry) + +hal_client_domain(hal_teeregistry_default, hal_allocator) +allow hal_teeregistry_default hidl_memory_hwservice:hwservice_manager find; + +allow hal_teeregistry_default tee_device:chr_file rw_file_perms; + +allow hal_teeregistry_default mobicore_vendor_data_file:dir { rw_dir_perms create rename rmdir }; +allow hal_teeregistry_default mobicore_vendor_data_file:file { rw_file_perms rename create }; +allow hal_teeregistry_default mobicore_vendor_file:file { r_file_perms }; + +init_daemon_domain(hal_teeregistry_default); diff --git a/sepolicy/vendor/hal_thermal_default.te b/sepolicy/vendor/hal_thermal_default.te new file mode 100644 index 0000000..14f013d --- /dev/null +++ b/sepolicy/vendor/hal_thermal_default.te @@ -0,0 +1 @@ +r_dir_file(hal_thermal_default, sysfs_virtual) diff --git a/sepolicy/vendor/hal_wifi_default.te b/sepolicy/vendor/hal_wifi_default.te index 381a04d..0e07da4 100644 --- a/sepolicy/vendor/hal_wifi_default.te +++ b/sepolicy/vendor/hal_wifi_default.te @@ -1 +1,6 @@ +set_prop(hal_wifi_default, vendor_wlan_prop); + allow hal_wifi_default conn_vendor_data_file:dir search; +allow hal_wifi_default conn_vendor_data_file:file rw_file_perms; +allow hal_wifi_default wifi_vendor_data_file:dir search; + diff --git a/sepolicy/vendor/hwservice.te b/sepolicy/vendor/hwservice.te index c96ce33..937ae9d 100644 --- a/sepolicy/vendor/hwservice.te +++ b/sepolicy/vendor/hwservice.te @@ -5,3 +5,6 @@ type hal_sec_radio_channel_hwservice, hwservice_manager_type; type hal_vendor_eden_runtime_hwservice, hwservice_manager_type; type hal_vendor_multiframeprocessing_hwservice, hwservice_manager_type; type hal_vendor_iva_hwservice, hwservice_manager_type; + +type hal_tee_hwservice, hwservice_manager_type; +type hal_teeregistry_hwservice, hwservice_manager_type; diff --git a/sepolicy/vendor/hwservice_contexts b/sepolicy/vendor/hwservice_contexts index 9f2c841..8614dd5 100644 --- a/sepolicy/vendor/hwservice_contexts +++ b/sepolicy/vendor/hwservice_contexts @@ -3,8 +3,12 @@ vendor.samsung.hardware.radio.bridge::ISehBridge u:object_r:hal_sec_r vendor.samsung.hardware.radio.channel::ISehChannel u:object_r:hal_sec_radio_channel_hwservice:s0 vendor.samsung.hardware.camera.provider::ISehCameraProvider u:object_r:hal_camera_hwservice:s0 -vendor.samsung.hardware.gnss::ISecGnss u:object_r:hal_gnss_hwservice:s0 +vendor.samsung.hardware.gnss::ISehGnss u:object_r:hal_gnss_hwservice:s0 vendor.samsung.hardware.nfc::ISecNfc u:object_r:hal_nfc_hwservice:s0 vendor.samsung_slsi.hardware.MultiFrameProcessing20::IMultiFrameProcessing20 u:object_r:hal_vendor_multiframeprocessing_hwservice:s0 vendor.samsung_slsi.hardware.eden_runtime::IEdenruntime u:object_r:hal_vendor_eden_runtime_hwservice:s0 vendor.samsung_slsi.hardware.iva::IIvaService u:object_r:hal_vendor_iva_hwservice:s0 + +vendor.trustonic.tee::ITee u:object_r:hal_tee_hwservice:s0 +vendor.trustonic.tee.tui::ITui u:object_r:hal_tee_hwservice:s0 +vendor.trustonic.teeregistry::ITeeRegistry u:object_r:hal_teeregistry_hwservice:s0 diff --git a/sepolicy/vendor/init.te b/sepolicy/vendor/init.te index 531b33e..4670784 100644 --- a/sepolicy/vendor/init.te +++ b/sepolicy/vendor/init.te @@ -26,12 +26,9 @@ allow init sysfs_lcd:file setattr; allow init sysfs_mdnie:file setattr; allow init sysfs_modem:file w_file_perms; allow init sysfs_battery_writable:file setattr; -allow init sysfs_mmc_host_writable:file setattr; -allow init sysfs_scsi_host_writable:file setattr; allow init sysfs_power_writable:file setattr; allow init sysfs_bt_writable:file setattr; allow init sysfs_graphics:file create_file_perms; -allow init sysfs_touchscreen_writable:file setattr; allow init system_server:binder { transfer call }; allow init device:chr_file ioctl; @@ -48,5 +45,7 @@ allow init proc_swapiness:file write; allow init proc_extra:file setattr; allow init proc_reset_reason:file setattr; allow init proc_swapiness:file open; +allow init self:netlink_generic_socket { bind create getattr read setopt write }; +allow init mnt_vendor_file:dir mounton; unix_socket_connect(init, property, rild) diff --git a/sepolicy/vendor/kernel.te b/sepolicy/vendor/kernel.te index a544b68..a144f38 100644 --- a/sepolicy/vendor/kernel.te +++ b/sepolicy/vendor/kernel.te @@ -5,4 +5,7 @@ allow kernel efs_file:dir search; allow kernel device:chr_file { getattr setattr unlink create }; allow kernel device:dir create_dir_perms; -allow kernel self:capability { mknod }; +allow kernel self:capability { sys_rawio mknod }; + +allow kernel sysfs_virtual:dir search; +allow kernel block_device:dir search; diff --git a/sepolicy/vendor/mediacodec.te b/sepolicy/vendor/mediacodec.te index c07136f..433a7ff 100644 --- a/sepolicy/vendor/mediacodec.te +++ b/sepolicy/vendor/mediacodec.te @@ -2,3 +2,8 @@ allow mediacodec sysfs_v4l:dir r_dir_perms; allow mediacodec sysfs_v4l_mfc:dir search; allow mediacodec sysfs_v4l_mfc:file r_file_perms; + +binder_call(mediacodec, hal_power_default) +binder_call(hal_power_default, mediacodec) + +add_hwservice(mediacodec, hal_power_hwservice) diff --git a/sepolicy/vendor/property.te b/sepolicy/vendor/property.te index 99ad75c..45721ca 100644 --- a/sepolicy/vendor/property.te +++ b/sepolicy/vendor/property.te @@ -9,3 +9,5 @@ type vendor_camera_prop, property_type; type vendor_factory_prop, property_type; type vendor_gps_prop, property_type; type vendor_nfc_prop, property_type; +type vendor_wlbtd_prop, property_type; +type vendor_wlan_prop, property_type; diff --git a/sepolicy/vendor/property_contexts b/sepolicy/vendor/property_contexts index 19182c5..ffc3588 100644 --- a/sepolicy/vendor/property_contexts +++ b/sepolicy/vendor/property_contexts @@ -28,3 +28,9 @@ vendor.gsm. u:object_r:vendor_radio_prop:s0 # FACTORY ro.factory.factory_binary u:object_r:vendor_factory_prop:s0 + +# wlbtd +vendor.wlbtd. u:object_r:vendor_wlbtd_prop:s0 + +# Wlan +vendor.wlan. u:object_r:vendor_wlan_prop:s0 diff --git a/sepolicy/vendor/rild.te b/sepolicy/vendor/rild.te index eef06d8..8ad6313 100644 --- a/sepolicy/vendor/rild.te +++ b/sepolicy/vendor/rild.te @@ -25,6 +25,6 @@ allow rild hal_audio_default:dir search; allow rild hal_audio_default:file r_file_perms; # hwservice -allow rild hal_sec_radio_hwservice:hwservice_manager add; -allow rild hal_sec_radio_bridge_hwservice:hwservice_manager add; -allow rild hal_sec_radio_channel_hwservice:hwservice_manager add; +add_hwservice(rild, hal_sec_radio_hwservice) +add_hwservice(rild, hal_sec_radio_bridge_hwservice) +add_hwservice(rild, hal_sec_radio_channel_hwservice) diff --git a/sepolicy/vendor/secril_config_svc.te b/sepolicy/vendor/secril_config_svc.te new file mode 100644 index 0000000..0b354f6 --- /dev/null +++ b/sepolicy/vendor/secril_config_svc.te @@ -0,0 +1 @@ +dontaudit secril_config_svc exported3_radio_prop:property_service set; diff --git a/sepolicy/vendor/surfaceflinger.te b/sepolicy/vendor/surfaceflinger.te index 04ef544..19a6b58 100644 --- a/sepolicy/vendor/surfaceflinger.te +++ b/sepolicy/vendor/surfaceflinger.te @@ -1,2 +1,5 @@ # /dev/mali0 allow surfaceflinger gpu_device:chr_file rw_file_perms; + +# libion_exynos +allow surfaceflinger same_process_hal_file:file rx_file_perms; diff --git a/sepolicy/vendor/system_server.te b/sepolicy/vendor/system_server.te index e771758..9d0cea0 100644 --- a/sepolicy/vendor/system_server.te +++ b/sepolicy/vendor/system_server.te @@ -9,4 +9,15 @@ allow system_server debugfs_mali_mem:file r_file_perms; allow system_server frp_block_device:blk_file rw_file_perms; +allow system_server mobicore_vendor_file:dir r_dir_perms; +allow system_server sysfs_rtc:file r_file_perms; + get_prop(system_server, vendor_radio_prop) + +r_dir_file(system_server, sysfs_virtual) + +get_prop(system_server, exported_camera_prop); +get_prop(system_server, userspace_reboot_config_prop) +get_prop(system_server, userspace_reboot_exported_prop) + +# allow system_server unlabeled:file { write setattr }; diff --git a/sepolicy/vendor/tee.te b/sepolicy/vendor/tee.te new file mode 100644 index 0000000..6c1b3c5 --- /dev/null +++ b/sepolicy/vendor/tee.te @@ -0,0 +1,9 @@ +allow tee efs_file:dir r_dir_perms; +allow tee mnt_vendor_file:dir search; + +allow tee mobicore_vendor_data_file:dir create_dir_perms; +allow tee mobicore_vendor_data_file:file create_file_perms; + +r_dir_file(tee, mobicore_vendor_file) + +set_prop(tee, system_prop) diff --git a/sepolicy/vendor/vendor_init.te b/sepolicy/vendor/vendor_init.te new file mode 100644 index 0000000..6fc9b37 --- /dev/null +++ b/sepolicy/vendor/vendor_init.te @@ -0,0 +1,12 @@ +typeattribute vendor_init data_between_core_and_vendor_violators; + +allow vendor_init proc_swapiness:file rw_file_perms; +allow vendor_init cgroup:file getattr; +allow vendor_init tmpfs:dir { add_name write }; +allow vendor_init wifi_data_file:dir { getattr setattr }; +allow vendor_init wpa_socket:dir getattr; +allow vendor_init wifi_data_file:dir search; +# mkdir /data/hostapd +allow vendor_init system_data_file:dir create_dir_perms; +# mkdir /data/camera/* +allow vendor_init camera_data_file:dir create_dir_perms; diff --git a/sepolicy/vendor/vold.te b/sepolicy/vendor/vold.te index 0d68e6f..91c1afc 100644 --- a/sepolicy/vendor/vold.te +++ b/sepolicy/vendor/vold.te @@ -1,6 +1,4 @@ # /efs allow vold efs_file:dir r_dir_perms; -allow vold sysfs_mmc_host_writable:file write; -allow vold sysfs_scsi_host_writable:file write; allow vold sysfs_virtual:file write; diff --git a/sepolicy/vendor/wlbtd.te b/sepolicy/vendor/wlbtd.te new file mode 100644 index 0000000..e0d0a45 --- /dev/null +++ b/sepolicy/vendor/wlbtd.te @@ -0,0 +1,15 @@ +type wlbtd, domain; + +type wlbtd_exec, exec_type, vendor_file_type, file_type; +init_daemon_domain(wlbtd); + +allow wlbtd conn_vendor_data_file:dir search; +allow wlbtd conn_vendor_data_file:file rw_file_perms; +allow wlbtd self:netlink_generic_socket { create setopt bind getattr read write }; + +allow wlbtd init:unix_stream_socket connectto; + +r_dir_file(wlbtd, sysfs_wifi); +allow wlbtd sysfs_wifi_writable:file rw_file_perms; + +set_prop(wlbtd, vendor_wlbtd_prop); diff --git a/sepolicy/vendor/zygote.te b/sepolicy/vendor/zygote.te new file mode 100644 index 0000000..84b4e2a --- /dev/null +++ b/sepolicy/vendor/zygote.te @@ -0,0 +1,3 @@ +get_prop(zygote, exported_camera_prop); +# allow zygote system_file:dir write; +allow zygote vendor_file:file read;