From 1a96e0b036d985f43cb56e939fc7f3a44603d8e9 Mon Sep 17 00:00:00 2001 From: roynatech2544 Date: Sat, 30 Apr 2022 13:13:05 +0900 Subject: [PATCH] universal7885: Address various selinux denials Also fix some mistakes --- universal7885-common/health/HealthImpl.cpp | 5 ++--- universal7885-common/sepolicy/private/storaged.te | 1 + universal7885-common/sepolicy/vendor/file.te | 3 +++ universal7885-common/sepolicy/vendor/genfs_contexts | 8 +++++--- universal7885-common/sepolicy/vendor/hal_audio_default.te | 1 + .../sepolicy/vendor/hal_health_default.te | 5 +++++ .../sepolicy/vendor/hal_sensors_default.te | 1 + universal7885-common/sepolicy/vendor/hal_usb_default.te | 3 +++ universal7885-common/sepolicy/vendor/init.te | 5 +---- universal7885-common/sepolicy/vendor/rild.te | 2 ++ 10 files changed, 24 insertions(+), 10 deletions(-) create mode 100644 universal7885-common/sepolicy/private/storaged.te create mode 100644 universal7885-common/sepolicy/vendor/hal_usb_default.te diff --git a/universal7885-common/health/HealthImpl.cpp b/universal7885-common/health/HealthImpl.cpp index 4710760..0ae66fd 100644 --- a/universal7885-common/health/HealthImpl.cpp +++ b/universal7885-common/health/HealthImpl.cpp @@ -65,13 +65,12 @@ class HealthImpl : public Health { file.open(sysfs); Result result = Result::SUCCESS; if (file.is_open()){ - std::string value; - getline(file, value); + getline(file, ret); file.close(); } else { result = Result::NOT_FOUND; } - ALOGI ("%s: sysfs : %s, returns : %s", __func__, sysfs, ret.c_str()); + ALOGI ("%s: sysfs : %s, returns : %s", __func__, sysfs.c_str(), ret.c_str()); struct callBack cb = { result, ret }; return cb; } diff --git a/universal7885-common/sepolicy/private/storaged.te b/universal7885-common/sepolicy/private/storaged.te new file mode 100644 index 0000000..4ef82e9 --- /dev/null +++ b/universal7885-common/sepolicy/private/storaged.te @@ -0,0 +1 @@ +allow storaged debugfs_mmc:file read; diff --git a/universal7885-common/sepolicy/vendor/file.te b/universal7885-common/sepolicy/vendor/file.te index dbea522..d672624 100644 --- a/universal7885-common/sepolicy/vendor/file.te +++ b/universal7885-common/sepolicy/vendor/file.te @@ -27,6 +27,7 @@ type proc_last_kmsg, fs_type, proc_type; type epicd_socket, file_type, data_file_type; ### SYSFS +type sysfs_sec_ccic, sysfs_type, rw_fs_type, fs_type; type sysfs_argos, sysfs_type, r_fs_type, fs_type; type sysfs_bbd, sysfs_type, r_fs_type, fs_type; type sysfs_fingerprint, sysfs_type, r_fs_type, fs_type; @@ -39,8 +40,10 @@ type sysfs_sim, sysfs_type, r_fs_type, fs_type; type sysfs_sensors, sysfs_type, r_fs_type, fs_type; type sysfs_wifi, sysfs_type, r_fs_type, fs_type; type sysfs_gpu, sysfs_type, r_fs_type, fs_type; +type sysfs_mmc, sysfs_type, r_fs_type, fs_type; type sysfs_backlight_writable, sysfs_type, rw_fs_type, fs_type; type sysfs_bt_writable, sysfs_type, rw_fs_type, fs_type; +type sysfs_mmc_queue, sysfs_type, rw_fs_type, fs_type; type sysfs_gps_writable, sysfs_type, rw_fs_type, fs_type; type sysfs_lcd_writable, sysfs_type, rw_fs_type, fs_type; type sysfs_power_writable, sysfs_type, rw_fs_type, fs_type; diff --git a/universal7885-common/sepolicy/vendor/genfs_contexts b/universal7885-common/sepolicy/vendor/genfs_contexts index ea903a9..3edf22b 100644 --- a/universal7885-common/sepolicy/vendor/genfs_contexts +++ b/universal7885-common/sepolicy/vendor/genfs_contexts @@ -14,6 +14,7 @@ genfscon sysfs /class/input u:obje genfscon sysfs /class/power_supply u:object_r:sysfs_battery:s0 genfscon sysfs /class/rtc/rtc0 u:object_r:sysfs_rtc:s0 genfscon sysfs /class/sec/gps u:object_r:sysfs_sec_gps:s0 +genfscon sysfs /class/sec/ccic u:object_r:sysfs_sec_ccic:s0 genfscon sysfs /class/sec/sensors u:object_r:sysfs_sec_sensors:s0 genfscon sysfs /class/sensor_event u:object_r:sysfs_sensors:s0 genfscon sysfs /class/sensors u:object_r:sysfs_sensors:s0 @@ -22,15 +23,16 @@ genfscon sysfs /class/timed_output/vibrator/intensity u:obje genfscon sysfs /class/timed_output/vibrator/multi_freq u:object_r:sysfs_vibrator:s0 genfscon sysfs /devices/platform/argos u:object_r:sysfs_argos:s0 -genfscon sysfs /devices/platform/panel@0/backlight/panel/brightness u:object_r:sysfs_backlight_writable:s0 -genfscon sysfs /devices/platform/panel@0/backlight/panel/max_brightness u:object_r:sysfs_backlight_writable:s0 -genfscon sysfs /devices/platform/panel@0/lcd/panel u:object_r:sysfs_lcd_writable:s0 + +genfscon sysfs /devices/platform/13500000.dwmmc0/mmc_host/mmc0/ u:object_r:sysfs_mmc:s0 +genfscon sysfs /devices/platform/13500000.dwmmc0/mmc_host/mmc0/mmc0:0001/block/mmcblk0/queue/ u:object_r:sysfs_mmc_queue:s0 genfscon sysfs /devices/virtual/fingerprint/fingerprint u:object_r:sysfs_fingerprint:s0 genfscon sysfs /devices/virtual/input u:object_r:sysfs_input:s0 genfscon sysfs /devices/virtual/lcd/panel u:object_r:sysfs_lcd_writable:s0 genfscon sysfs /devices/virtual/sec/gps u:object_r:sysfs_sec_gps:s0 genfscon sysfs /devices/virtual/sec/sec_key u:object_r:sysfs_sec_key:s0 +genfscon sysfs /devices/virtual/sec/ccic u:object_r:sysfs_sec_ccic:s0 genfscon sysfs /devices/virtual/sensor_event u:object_r:sysfs_sensors:s0 genfscon sysfs /devices/virtual/sensors u:object_r:sysfs_sensors:s0 genfscon sysfs /devices/virtual/sensors/hidden_hole/hh_check_coef u:object_r:sysfs_sensors_writable:s0 diff --git a/universal7885-common/sepolicy/vendor/hal_audio_default.te b/universal7885-common/sepolicy/vendor/hal_audio_default.te index b68d4af..c8b16c5 100644 --- a/universal7885-common/sepolicy/vendor/hal_audio_default.te +++ b/universal7885-common/sepolicy/vendor/hal_audio_default.te @@ -13,3 +13,4 @@ get_prop(hal_audio_default, vendor_radio_prop) allow hal_audio_default init:unix_stream_socket connectto; +allow hal_audio_default efs_file:lnk_file read; diff --git a/universal7885-common/sepolicy/vendor/hal_health_default.te b/universal7885-common/sepolicy/vendor/hal_health_default.te index e8fad42..21a93fd 100644 --- a/universal7885-common/sepolicy/vendor/hal_health_default.te +++ b/universal7885-common/sepolicy/vendor/hal_health_default.te @@ -6,3 +6,8 @@ allow hal_health_default sysfs_battery:file r_file_perms; allow hal_health_default sysfs_battery_writable:dir search; allow hal_health_default sysfs_battery_writable:file r_file_perms; allow hal_health_default sysfs_fuelgauge:file r_file_perms; +allow hal_health_default app_efs_file:file r_file_perms; +allow hal_health_default app_efs_file:dir search; +allow hal_health_default efs_file:lnk_file read; +allow hal_health_default efs_file:dir search; + diff --git a/universal7885-common/sepolicy/vendor/hal_sensors_default.te b/universal7885-common/sepolicy/vendor/hal_sensors_default.te index 2aedc5f..e1a1752 100644 --- a/universal7885-common/sepolicy/vendor/hal_sensors_default.te +++ b/universal7885-common/sepolicy/vendor/hal_sensors_default.te @@ -68,6 +68,7 @@ allow hal_sensors_default sysfs_input_writable:file rw_file_perms; allow hal_sensors_default sysfs_input:dir r_dir_perms; allow hal_sensors_default sysfs_sensor_writable:file rw_file_perms; allow hal_sensors_default sysfs_spi_writeable:file rw_file_perms; +allow hal_sensors_default efs_file:lnk_file read; # yas_lib allow hal_sensors_default vendor_data_file:file create_file_perms; diff --git a/universal7885-common/sepolicy/vendor/hal_usb_default.te b/universal7885-common/sepolicy/vendor/hal_usb_default.te new file mode 100644 index 0000000..4de8e54 --- /dev/null +++ b/universal7885-common/sepolicy/vendor/hal_usb_default.te @@ -0,0 +1,3 @@ +allow hal_usb_default sysfs_virtual:dir search; +allow hal_usb_default sysfs_sec_ccic:dir search; +allow hal_usb_default sysfs_sec_ccic:file r_file_perms; diff --git a/universal7885-common/sepolicy/vendor/init.te b/universal7885-common/sepolicy/vendor/init.te index 0c2b633..4c25238 100644 --- a/universal7885-common/sepolicy/vendor/init.te +++ b/universal7885-common/sepolicy/vendor/init.te @@ -40,8 +40,6 @@ allow init kernel:system module_request; allow init logd:unix_stream_socket connectto; allow init logdr_socket:sock_file write; allow init self:capability sys_nice; -allow init boot_logcat_file:file rw_file_perms; -allow init logcat_exec:file { execute getattr open read }; allow init proc:file setattr; allow init proc_swapiness:file write; @@ -49,7 +47,6 @@ allow init proc_extra:file setattr; allow init proc_reset_reason:file setattr; allow init proc_swapiness:file open; allow init self:netlink_generic_socket { bind create getattr read setopt write }; -# init.te allow init proc_last_kmsg:file setattr; allow init mnt_vendor_file:dir mounton; @@ -57,6 +54,6 @@ allow init mnt_vendor_file:dir mounton; unix_socket_connect(init, property, rild) allow init sec_efs_file:dir mounton; - +allow init sysfs_mmc_queue:file { open write }; get_prop(init, vendor_radio_prop) get_prop(init, radio_prop) diff --git a/universal7885-common/sepolicy/vendor/rild.te b/universal7885-common/sepolicy/vendor/rild.te index 27c276c..45ac239 100644 --- a/universal7885-common/sepolicy/vendor/rild.te +++ b/universal7885-common/sepolicy/vendor/rild.te @@ -91,6 +91,8 @@ allow rild hal_radio_default:binder call; # audio allow rild hal_audio_default:dir search; allow rild hal_audio_default:file r_file_perms; +allow rild efs_file:lnk_file read; + # hwservice add_hwservice(rild, rild_hwservice) set_prop(rild, radio_prop)