From 7329c87196c55620575c3479e6594c56fcc1beed Mon Sep 17 00:00:00 2001 From: Gabriel2392 Date: Tue, 26 Oct 2021 09:31:26 +0000 Subject: [PATCH] universal7885: Address SELinux denials * Now boots with enforcing kernel --- .../SamsungParts/jni/SELinuxBridge.cpp | 11 ----------- .../eurekateam/samsungextras/BootReceiver.java | 4 ++-- .../samsungextras/DeviceSettings.java | 17 ++++++++--------- .../samsungextras/battery/BatteryFragment.java | 4 ++-- .../samsungextras/interfaces/SELinux.java | 1 - universal7885-common/sepolicy/vendor/device.te | 4 ++++ .../sepolicy/vendor/file_contexts | 8 +++++++- .../sepolicy/vendor/hal_battery_default.te | 1 + .../sepolicy/vendor/hal_drm_widevine.te | 2 ++ .../sepolicy/vendor/hal_flashlight_default.te | 2 ++ .../sepolicy/vendor/hal_gpu_default.te | 4 ++-- .../sepolicy/vendor/hal_keymaster_default.te | 1 + .../sepolicy/vendor/hal_wifi_default.te | 2 ++ universal7885-common/sepolicy/vendor/init.te | 3 +++ universal7885-common/sepolicy/vendor/kernel.te | 2 ++ universal7885-common/sepolicy/vendor/rild.te | 2 -- .../sepolicy/vendor/system_app.te | 12 ++++++++++++ 17 files changed, 50 insertions(+), 30 deletions(-) diff --git a/universal7885-common/SamsungParts/jni/SELinuxBridge.cpp b/universal7885-common/SamsungParts/jni/SELinuxBridge.cpp index d1bd5c6..63b8103 100644 --- a/universal7885-common/SamsungParts/jni/SELinuxBridge.cpp +++ b/universal7885-common/SamsungParts/jni/SELinuxBridge.cpp @@ -16,14 +16,3 @@ Java_com_eurekateam_samsungextras_interfaces_SELinux_getSELinux(JNIEnv *env, jcl int ret = service->readSELinuxstats(); return ret; } -extern "C" -JNIEXPORT void JNICALL -Java_com_eurekateam_samsungextras_interfaces_SELinux_setSELinux(JNIEnv *env, jclass clazz, - jint enable) { - android::sp service = ISELinux::getService(); - if (enable == 1){ - service->setSELinuxWritable(Enable::ENABLE); - }else{ - service->setSELinuxWritable(Enable::DISABLE); - } -} \ No newline at end of file diff --git a/universal7885-common/SamsungParts/src/com/eurekateam/samsungextras/BootReceiver.java b/universal7885-common/SamsungParts/src/com/eurekateam/samsungextras/BootReceiver.java index b643bf9..510db51 100644 --- a/universal7885-common/SamsungParts/src/com/eurekateam/samsungextras/BootReceiver.java +++ b/universal7885-common/SamsungParts/src/com/eurekateam/samsungextras/BootReceiver.java @@ -23,7 +23,7 @@ import android.content.SharedPreferences; import androidx.preference.PreferenceManager; -import com.eurekateam.samsungextras.utils.FileUtilsWrapper; +import com.eurekateam.samsungextras.interfaces.GPU; public class BootReceiver extends BroadcastReceiver { @@ -37,7 +37,7 @@ public class BootReceiver extends BroadcastReceiver { } boolean gpuenabled = sharedPrefs.getBoolean(DeviceSettings.PREF_GPUEXYNOS, false); if (!gpuenabled){ - FileUtilsWrapper.writeLine(GlobalConstants.TMU_SYSFS, "0"); + GPU.setGPU(0); } } } diff --git a/universal7885-common/SamsungParts/src/com/eurekateam/samsungextras/DeviceSettings.java b/universal7885-common/SamsungParts/src/com/eurekateam/samsungextras/DeviceSettings.java index 4059cd1..6608aa7 100644 --- a/universal7885-common/SamsungParts/src/com/eurekateam/samsungextras/DeviceSettings.java +++ b/universal7885-common/SamsungParts/src/com/eurekateam/samsungextras/DeviceSettings.java @@ -69,10 +69,15 @@ public class DeviceSettings extends PreferenceFragment implements mGPUExynos.setChecked(GPU.getGPU() == 1); mGPUExynos.setOnPreferenceChangeListener(this); - SwitchPreference mSELinux = findPreference(PREF_SELINUX); + Preference mSELinux = findPreference(PREF_SELINUX); assert mSELinux != null; - mSELinux.setOnPreferenceChangeListener(this); - mSELinux.setEnabled(SELinux.getSELinux() != 0); + mSELinux.setOnPreferenceClickListener(preference -> { + Toast.makeText(getContext(), SELinux.getSELinux() == 1 ? + "SELinux is in enforcing state." : + "SELinux is in permissive state.", + Toast.LENGTH_SHORT).show(); + return true; + }); Preference mFlashLight = findPreference(PREF_FLASHLIGHT); assert mFlashLight != null; @@ -109,12 +114,6 @@ public class DeviceSettings extends PreferenceFragment implements Toast.makeText(getContext(), gpu_enabled ? "GPU Throttling is now enabled." : "GPU Throttling is now disabled.", Toast.LENGTH_SHORT).show(); - case PREF_SELINUX: - boolean selinux_enabled = (Boolean) value; - SELinux.setSELinux(selinux_enabled ? 1 : 0); - Toast.makeText(getContext(), selinux_enabled ? "SELinux is now in enforcing state." - : "SELinux is now in permissive state.", - Toast.LENGTH_SHORT).show(); default: break; } diff --git a/universal7885-common/SamsungParts/src/com/eurekateam/samsungextras/battery/BatteryFragment.java b/universal7885-common/SamsungParts/src/com/eurekateam/samsungextras/battery/BatteryFragment.java index 6d4b97b..81d6d67 100644 --- a/universal7885-common/SamsungParts/src/com/eurekateam/samsungextras/battery/BatteryFragment.java +++ b/universal7885-common/SamsungParts/src/com/eurekateam/samsungextras/battery/BatteryFragment.java @@ -69,12 +69,12 @@ public class BatteryFragment extends PreferenceFragment implements if (preference == mChargePref) { Boolean value = (Boolean) newValue; Battery.setChargeSysfs(value ? 0 : 1 ); - mFastChargePref.setChecked(Battery.getChargeSysfs() == 0); + mChargePref.setChecked(Battery.getChargeSysfs() == 0); return true; }else if (preference == mFastChargePref){ Boolean value = (Boolean) newValue; Battery.setFastCharge(value ? 0 : 1 ); - mChargePref.setChecked(Battery.getFastChargeSysfs() == 0); + mFastChargePref.setChecked(Battery.getFastChargeSysfs() == 0); return true; } return false; diff --git a/universal7885-common/SamsungParts/src/com/eurekateam/samsungextras/interfaces/SELinux.java b/universal7885-common/SamsungParts/src/com/eurekateam/samsungextras/interfaces/SELinux.java index 81ea105..4114947 100644 --- a/universal7885-common/SamsungParts/src/com/eurekateam/samsungextras/interfaces/SELinux.java +++ b/universal7885-common/SamsungParts/src/com/eurekateam/samsungextras/interfaces/SELinux.java @@ -1,6 +1,5 @@ package com.eurekateam.samsungextras.interfaces; public class SELinux { - public static native void setSELinux(int enable); public static native int getSELinux(); } diff --git a/universal7885-common/sepolicy/vendor/device.te b/universal7885-common/sepolicy/vendor/device.te index b891d94..536d9a8 100644 --- a/universal7885-common/sepolicy/vendor/device.te +++ b/universal7885-common/sepolicy/vendor/device.te @@ -33,3 +33,7 @@ type pm_qos_device, dev_type; type radio_qos_device, dev_type; type ssp_device, dev_type; type vendor_radio_device, dev_type; + +type drm_device, dev_type; +type custom_loop_device, dev_type; + diff --git a/universal7885-common/sepolicy/vendor/file_contexts b/universal7885-common/sepolicy/vendor/file_contexts index 2455005..ddd66bf 100644 --- a/universal7885-common/sepolicy/vendor/file_contexts +++ b/universal7885-common/sepolicy/vendor/file_contexts @@ -152,6 +152,12 @@ # camera /dev/m2m1shot_scaler0 u:object_r:m2m1shot_device:s0 + +# DRM +/dev/s5p-smem u:object_r:drm_device:s0 + +# Loop +/dev/block/loop* u:object_r:custom_loop_device:s0 # usb /dev/android_ssusbcon(/.*)? u:object_r:usb_device:s0 @@ -212,7 +218,7 @@ /(vendor|system/vendor)/bin/hw/android\.hardware\.usb@[0-9]\.[0-9]-service\.exynos7884B u:object_r:hal_usb_default_exec:s0 /(vendor|system/vendor)/bin/hw/vendor\.samsung\.hardware\.gnss@[0-9]\.[0-9]-service u:object_r:hal_gnss_default_exec:s0 /(vendor|system/vendor)/firmware(/.*)? u:object_r:vendor_firmware_file:s0 -/(vendor|system/vendor)/bin/hw/android\.hardware\.sensors@2.1-service\.samsung-multihal u:object_r:hal_sensors_default_exec:s0 + # SamsungParts /(vendor|system/vendor)/bin/hw/vendor\.eureka\.hardware\.battery@1\.0-service u:object_r:hal_battery_default_exec:s0 diff --git a/universal7885-common/sepolicy/vendor/hal_battery_default.te b/universal7885-common/sepolicy/vendor/hal_battery_default.te index 3164834..c1dbb29 100644 --- a/universal7885-common/sepolicy/vendor/hal_battery_default.te +++ b/universal7885-common/sepolicy/vendor/hal_battery_default.te @@ -12,3 +12,4 @@ allow hal_battery_default sysfs_battery_writable:file rw_file_perms; allow hal_battery_default sysfs_sec_switch_writable:dir { search }; allow hal_battery_default sysfs_battery_writable:dir { search }; allow hal_battery_default sysfs_battery:dir { search }; +allow hal_battery_default sysfs_virtual:dir { search }; diff --git a/universal7885-common/sepolicy/vendor/hal_drm_widevine.te b/universal7885-common/sepolicy/vendor/hal_drm_widevine.te index 01d02d5..410c50a 100644 --- a/universal7885-common/sepolicy/vendor/hal_drm_widevine.te +++ b/universal7885-common/sepolicy/vendor/hal_drm_widevine.te @@ -19,3 +19,5 @@ allow hal_drm_widevine vendor_data_file:file create_file_perms; allow hal_drm_widevine cpk_efs_file:file r_file_perms; allow hal_drm_widevine efs_file:dir search; + +allow hal_drm_widevine drm_device:chr_file { read write open ioctl }; diff --git a/universal7885-common/sepolicy/vendor/hal_flashlight_default.te b/universal7885-common/sepolicy/vendor/hal_flashlight_default.te index bc052b3..251e0df 100644 --- a/universal7885-common/sepolicy/vendor/hal_flashlight_default.te +++ b/universal7885-common/sepolicy/vendor/hal_flashlight_default.te @@ -7,3 +7,5 @@ hwbinder_use(hal_flashlight_default); get_prop(hal_flashlight_default, hwservicemanager_prop); allow hal_flashlight_default sysfs_flashlight:file { read open write getattr }; allow hal_flashlight_default sysfs_flashlight:dir search; + +allow hal_flashlight_default sysfs_virtual:dir { search }; diff --git a/universal7885-common/sepolicy/vendor/hal_gpu_default.te b/universal7885-common/sepolicy/vendor/hal_gpu_default.te index 597e062..2080737 100644 --- a/universal7885-common/sepolicy/vendor/hal_gpu_default.te +++ b/universal7885-common/sepolicy/vendor/hal_gpu_default.te @@ -5,5 +5,5 @@ init_daemon_domain(hal_gpu_default); hwbinder_use(hal_gpu_default); get_prop(hal_gpu_default, hwservicemanager_prop) -allow system_app sysfs_gpu_tmu:file { read open write getattr }; -allow system_app sysfs_gpu_tmu:dir search; +allow hal_gpu_default sysfs_gpu_tmu:file { read open write getattr }; +allow hal_gpu_default sysfs_gpu_tmu:dir search; diff --git a/universal7885-common/sepolicy/vendor/hal_keymaster_default.te b/universal7885-common/sepolicy/vendor/hal_keymaster_default.te index 16eb14f..506bb1c 100644 --- a/universal7885-common/sepolicy/vendor/hal_keymaster_default.te +++ b/universal7885-common/sepolicy/vendor/hal_keymaster_default.te @@ -7,3 +7,4 @@ allow hal_keymaster_default mnt_vendor_file:dir search; allow hal_keymaster_default efs_file:dir search; teegris_use(hal_keymaster_default) allow hal_keymaster_default prov_efs_file:file r_file_perms; +allow hal_keymaster_default prov_efs_file:dir search; diff --git a/universal7885-common/sepolicy/vendor/hal_wifi_default.te b/universal7885-common/sepolicy/vendor/hal_wifi_default.te index 7f22e8e..3f20462 100644 --- a/universal7885-common/sepolicy/vendor/hal_wifi_default.te +++ b/universal7885-common/sepolicy/vendor/hal_wifi_default.te @@ -5,3 +5,5 @@ allow hal_wifi_default conn_vendor_data_file:dir search; allow hal_wifi_default conn_vendor_data_file:file rw_file_perms; allow hal_wifi_default wifi_vendor_data_file:dir search; +get_prop(hal_wifi_default, persist_vendor_debug_wifi_prop) + diff --git a/universal7885-common/sepolicy/vendor/init.te b/universal7885-common/sepolicy/vendor/init.te index 3161c7f..fd75180 100644 --- a/universal7885-common/sepolicy/vendor/init.te +++ b/universal7885-common/sepolicy/vendor/init.te @@ -55,3 +55,6 @@ allow init proc_last_kmsg:file setattr; allow init mnt_vendor_file:dir mounton; unix_socket_connect(init, property, rild) + +get_prop(init, vendor_radio_prop) +get_prop(init, radio_prop) diff --git a/universal7885-common/sepolicy/vendor/kernel.te b/universal7885-common/sepolicy/vendor/kernel.te index b6ef8ec..a8de462 100644 --- a/universal7885-common/sepolicy/vendor/kernel.te +++ b/universal7885-common/sepolicy/vendor/kernel.te @@ -16,3 +16,5 @@ allow kernel block_device:dir search; allow kernel sysfs_sec_key:dir search; r_dir_file(kernel, sysfs_virtual) + +allow kernel loop_device:blk_file { create setattr }; diff --git a/universal7885-common/sepolicy/vendor/rild.te b/universal7885-common/sepolicy/vendor/rild.te index 5675eaf..c0b5540 100644 --- a/universal7885-common/sepolicy/vendor/rild.te +++ b/universal7885-common/sepolicy/vendor/rild.te @@ -93,5 +93,3 @@ allow rild hal_audio_default:file r_file_perms; # hwservice add_hwservice(rild, rild_hwservice) - - diff --git a/universal7885-common/sepolicy/vendor/system_app.te b/universal7885-common/sepolicy/vendor/system_app.te index 90cfb9b..1f547e7 100644 --- a/universal7885-common/sepolicy/vendor/system_app.te +++ b/universal7885-common/sepolicy/vendor/system_app.te @@ -10,3 +10,15 @@ allow system_app sysfs_battery_info:dir { search }; allow system_app sysfs_battery_info:file { read open getattr }; r_dir_file(system_app, sysfs_battery_info) + +# SamsungParts +# +allow system_app hal_battery_hwservice:hwservice_manager find; +allow system_app hal_flashlight_hwservice:hwservice_manager find; +allow system_app hal_selinux_hwservice:hwservice_manager find; +allow system_app hal_gpu_hwservice:hwservice_manager find; + +allow system_app hal_battery_default:binder call; +allow system_app hal_flashlight_default:binder call; +allow system_app hal_selinux_default:binder call; +allow system_app hal_gpu_default:binder call;