From 62b750c2e95e296adb183a1bde42d83a0f210c6e Mon Sep 17 00:00:00 2001 From: Kevios12 Date: Wed, 1 Dec 2021 00:53:59 +0000 Subject: [PATCH] universal7885: Add some rules to make ds work on enforcing --- a20e/AndroidProducts.mk | 2 -- .../sepolicy/vendor/argosd.te | 25 ------------------- .../sepolicy/vendor/fastbootd.te | 7 ------ universal7885-common/sepolicy/vendor/gpsd.te | 2 ++ .../sepolicy/vendor/hal_power_default.te | 1 + .../sepolicy/vendor/property_contexts | 4 ++- universal7885-common/sepolicy/vendor/radio.te | 2 ++ universal7885-common/sepolicy/vendor/rild.te | 2 ++ .../sepolicy/vendor/secril_config_svc.te | 1 + .../sepolicy/vendor/vendor_init.te | 2 +- universal7885-common/vendor_detect/main.py | 2 +- universal7885-common/vendor_name | 2 +- 12 files changed, 14 insertions(+), 38 deletions(-) delete mode 100644 a20e/AndroidProducts.mk delete mode 100644 universal7885-common/sepolicy/vendor/argosd.te delete mode 100644 universal7885-common/sepolicy/vendor/fastbootd.te diff --git a/a20e/AndroidProducts.mk b/a20e/AndroidProducts.mk deleted file mode 100644 index 27de13f..0000000 --- a/a20e/AndroidProducts.mk +++ /dev/null @@ -1,2 +0,0 @@ -# Auto-Generated by device/samsung/a20e/setup.sh -PRODUCT_MAKEFILES += $(LOCAL_DIR)/aosp_a20e.mk diff --git a/universal7885-common/sepolicy/vendor/argosd.te b/universal7885-common/sepolicy/vendor/argosd.te deleted file mode 100644 index 3edf5c5..0000000 --- a/universal7885-common/sepolicy/vendor/argosd.te +++ /dev/null @@ -1,25 +0,0 @@ -# argosd.te - -type argosd, domain; -type argosd_exec, exec_type, vendor_file_type, file_type; - -# argosd is started by init, type transit from init domain to gpsd domain -init_daemon_domain(argosd) - -# /dev/network_throughput -allow argosd radio_qos_device:chr_file rw_file_perms; - -# /proc/net/dev -allow argosd proc_net:file r_file_perms; - -# /sys/ -allow argosd sysfs:dir r_dir_perms; - -# /sys/devices/platform/argos -# /sys/firmware/devicetree/base/argos -allow argosd sysfs_argos:dir r_dir_perms; -allow argosd sysfs_argos:file r_file_perms; - -# /sys/class/scsi_host/host0 -allow argosd sysfs_scsi_host_writable:dir r_dir_perms; -allow argosd sysfs_scsi_host_writable:file r_file_perms; diff --git a/universal7885-common/sepolicy/vendor/fastbootd.te b/universal7885-common/sepolicy/vendor/fastbootd.te deleted file mode 100644 index 5435c6c..0000000 --- a/universal7885-common/sepolicy/vendor/fastbootd.te +++ /dev/null @@ -1,7 +0,0 @@ -# fastbootd.te - -allow fastbootd { - boot_block_device - dtbo_block_device - recovery_block_device -}:blk_file rw_file_perms; diff --git a/universal7885-common/sepolicy/vendor/gpsd.te b/universal7885-common/sepolicy/vendor/gpsd.te index a568c41..c3f4ee5 100644 --- a/universal7885-common/sepolicy/vendor/gpsd.te +++ b/universal7885-common/sepolicy/vendor/gpsd.te @@ -7,6 +7,8 @@ init_daemon_domain(gpsd) allow gpsd rild:unix_stream_socket connectto; get_prop(gpsd, vendor_radio_prop) +allow gpsd system_data_file:dir search; + get_prop(gpsd, telephony_config_prop) get_prop(gpsd, exported_config_prop) diff --git a/universal7885-common/sepolicy/vendor/hal_power_default.te b/universal7885-common/sepolicy/vendor/hal_power_default.te index 45e0e07..a7bea85 100644 --- a/universal7885-common/sepolicy/vendor/hal_power_default.te +++ b/universal7885-common/sepolicy/vendor/hal_power_default.te @@ -33,3 +33,4 @@ allow hal_power_default sysfs_sec_touchscreen:dir { read open }; allow hal_power_default sysfs_sec_touchscreen:file r_file_perms; type hal_lineage_power_hwservice, hwservice_manager_type; add_hwservice(hal_power_default, hal_power_hwservice) +allow hal_power_default sysfs_decon:dir search; diff --git a/universal7885-common/sepolicy/vendor/property_contexts b/universal7885-common/sepolicy/vendor/property_contexts index 070dfd4..61d7007 100644 --- a/universal7885-common/sepolicy/vendor/property_contexts +++ b/universal7885-common/sepolicy/vendor/property_contexts @@ -3,7 +3,7 @@ vendor.cbd. u:object_r:vendor_cbd_prop:s0 persist.vendor.cbd. u:object_r:vendor_radio_prop:s0 ### radio -ro.multisim. u:object_r:vendor_radio_prop:s0 +ro.multisim. u:object_r:radio_prop:s0 ro.vendor.multisim. u:object_r:vendor_radio_prop:s0 ro.vendor.radio. u:object_r:vendor_radio_prop:s0 @@ -39,6 +39,8 @@ vendor.nfc.fw. u:object_r:vendor_nfc_prop:s0 # RADIO persist.ril. u:object_r:radio_prop:s0 vendor.gsm. u:object_r:vendor_radio_prop:s0 +persist.radio. u:object_r:radio_prop:s0 +ril.clatd. u:object_r:vendor_radio_prop:s0 # FACTORY ro.factory.factory_binary u:object_r:vendor_factory_prop:s0 diff --git a/universal7885-common/sepolicy/vendor/radio.te b/universal7885-common/sepolicy/vendor/radio.te index 8984885..5a6d645 100644 --- a/universal7885-common/sepolicy/vendor/radio.te +++ b/universal7885-common/sepolicy/vendor/radio.te @@ -1 +1,3 @@ binder_call(radio, gpuservice) +get_prop(radio, radio_prop) + diff --git a/universal7885-common/sepolicy/vendor/rild.te b/universal7885-common/sepolicy/vendor/rild.te index 2b2726b..27c276c 100644 --- a/universal7885-common/sepolicy/vendor/rild.te +++ b/universal7885-common/sepolicy/vendor/rild.te @@ -64,6 +64,7 @@ get_prop(rild, exported_config_prop); # ro.boot.cpboot, ril.NwNmId[0-9] get_prop(rild, telephony_config_prop) +get_prop(rild, vendor_radio_prop) # vendor.cbd. set_prop(rild, vendor_cbd_prop) allow rild proc_net:file write; @@ -92,3 +93,4 @@ allow rild hal_audio_default:dir search; allow rild hal_audio_default:file r_file_perms; # hwservice add_hwservice(rild, rild_hwservice) +set_prop(rild, radio_prop) diff --git a/universal7885-common/sepolicy/vendor/secril_config_svc.te b/universal7885-common/sepolicy/vendor/secril_config_svc.te index af594cf..247556b 100644 --- a/universal7885-common/sepolicy/vendor/secril_config_svc.te +++ b/universal7885-common/sepolicy/vendor/secril_config_svc.te @@ -20,3 +20,4 @@ allow secril_config_svc efs_file:file r_file_perms; set_prop(secril_config_svc, vendor_radio_prop) dontaudit secril_config_svc radio_control_prop:property_service set; get_prop(secril_config_svc, exported_config_prop) +get_prop(secril_config_svc, vendor_radio_prop) diff --git a/universal7885-common/sepolicy/vendor/vendor_init.te b/universal7885-common/sepolicy/vendor/vendor_init.te index e06ce92..53db827 100644 --- a/universal7885-common/sepolicy/vendor/vendor_init.te +++ b/universal7885-common/sepolicy/vendor/vendor_init.te @@ -16,4 +16,4 @@ set_prop(vendor_init, persist_data_df_prop) set_prop(vendor_init, persist_data_wda_prop) set_prop(vendor_init, persist_rmnet_prop) get_prop(vendor_init, system_prop) - +get_prop(vendor_init, vendor_radio_prop) diff --git a/universal7885-common/vendor_detect/main.py b/universal7885-common/vendor_detect/main.py index 25ee2a6..4dfd771 100644 --- a/universal7885-common/vendor_detect/main.py +++ b/universal7885-common/vendor_detect/main.py @@ -5,7 +5,7 @@ parser.add_argument("-d", help="Debug", type=int) args = parser.parse_args() var = vars(args) DEBUG = var['d'] == 1 -blacklist = ["qcom", "nxp","pixel-framework" ,"samsung", "gapps", "google", "gms", "codeaurora"] +blacklist = ["qcom", "nxp","pixel-framework" ,"support", "overlay","samsung", "gapps", "google", "gms", "codeaurora"] vendors = os.listdir("vendor") for vendor in vendors: if DEBUG: diff --git a/universal7885-common/vendor_name b/universal7885-common/vendor_name index a1709ea..7c29013 100644 --- a/universal7885-common/vendor_name +++ b/universal7885-common/vendor_name @@ -1 +1 @@ -aosp \ No newline at end of file +derp \ No newline at end of file