diff --git a/universal7885-common/sepolicy/samsung_slsi/private/file_contexts b/universal7885-common/sepolicy/samsung_slsi/private/file_contexts new file mode 100644 index 0000000..d0618ad --- /dev/null +++ b/universal7885-common/sepolicy/samsung_slsi/private/file_contexts @@ -0,0 +1,4 @@ +# file_contexts + +### DATA +/data/zram(/.*)? u:object_r:zram_data_file:s0 diff --git a/universal7885-common/sepolicy/samsung_slsi/private/property_contexts b/universal7885-common/sepolicy/samsung_slsi/private/property_contexts new file mode 100644 index 0000000..3324ac8 --- /dev/null +++ b/universal7885-common/sepolicy/samsung_slsi/private/property_contexts @@ -0,0 +1,35 @@ +### BLUETOOTH +sys.bluetooth.tty u:object_r:exported_bluetooth_prop:s0 + +### BUILD +#ro.build.PDA u:object_r:exported2_default_prop:s0 + +### CAMERA +system.camera.CC. u:object_r:exported_camera_prop:s0 +service.camera. u:object_r:exported_camera_prop:s0 +sys.cameramode. u:object_r:exported_camera_prop:s0 +ro.camera.req.fmq.size u:object_r:exported_camera_prop:s0 +ro.camera.res.fmq.size u:object_r:exported_camera_prop:s0 + +### GFX +#ro.gfx.driver.1 u:object_r:exported3_default_prop:s0 exact string + +### CSC +ro.csc. u:object_r:exported_config_prop:s0 + +### MDC +mdc. u:object_r:exported_config_prop:s0 + +### OMC +persist.sys.omc_support u:object_r:exported_config_prop:s0 +persist.sys.omc_etcpath u:object_r:exported_config_prop:s0 +ro.omc. u:object_r:exported_config_prop:s0 + +### RADIO +ril.NwNmId u:object_r:telephony_config_prop:s0 +ril.NwNmId2 u:object_r:telephony_config_prop:s0 +ro.boot.cpboot u:object_r:telephony_config_prop:s0 +ro.simbased.changetype u:object_r:exported_config_prop:s0 + +### RFKILL +ro.rfkilldisabled u:object_r:rfkilldisabled_prop:s0 diff --git a/universal7885-common/sepolicy/samsung_slsi/public/attributes b/universal7885-common/sepolicy/samsung_slsi/public/attributes new file mode 100644 index 0000000..ef37023 --- /dev/null +++ b/universal7885-common/sepolicy/samsung_slsi/public/attributes @@ -0,0 +1,8 @@ +# Tag for read only filesystem type +attribute r_fs_type; + +# Tag for read/write filesystem type +attribute rw_fs_type; + +# Tag for read/execute filesystem type +attribute rx_fs_type; diff --git a/universal7885-common/sepolicy/samsung_slsi/public/domain.te b/universal7885-common/sepolicy/samsung_slsi/public/domain.te new file mode 100644 index 0000000..fb15fe7 --- /dev/null +++ b/universal7885-common/sepolicy/samsung_slsi/public/domain.te @@ -0,0 +1,4 @@ +# domain.te + +# Make sure that labels are used correctly +neverallow { domain -vendor_init -ueventd } r_fs_type:file write; diff --git a/universal7885-common/sepolicy/samsung_slsi/public/file.te b/universal7885-common/sepolicy/samsung_slsi/public/file.te new file mode 100644 index 0000000..05d43ab --- /dev/null +++ b/universal7885-common/sepolicy/samsung_slsi/public/file.te @@ -0,0 +1,4 @@ +# file.te + +### DATA +type zram_data_file, file_type, data_file_type, core_data_file_type; diff --git a/universal7885-common/sepolicy/samsung_slsi/public/property.te b/universal7885-common/sepolicy/samsung_slsi/public/property.te new file mode 100644 index 0000000..0b1e97c --- /dev/null +++ b/universal7885-common/sepolicy/samsung_slsi/public/property.te @@ -0,0 +1,2 @@ +### RFKILL +type rfkilldisabled_prop, property_type; diff --git a/universal7885-common/sepolicy/samsung_slsi/tee/public/te_macros b/universal7885-common/sepolicy/samsung_slsi/tee/public/te_macros new file mode 100644 index 0000000..b7ab51f --- /dev/null +++ b/universal7885-common/sepolicy/samsung_slsi/tee/public/te_macros @@ -0,0 +1,8 @@ +# teegris_use(domain) +# +# Allow domain to use teegris +define(`teegris_use', ` +get_prop($1, vendor_tztsdaemon_prop) +# /dev/tzdev +allow $1 tz_user_device:chr_file rw_file_perms; +') diff --git a/universal7885-common/sepolicy/samsung_slsi/tee/vendor/device.te b/universal7885-common/sepolicy/samsung_slsi/tee/vendor/device.te new file mode 100644 index 0000000..b9c83a5 --- /dev/null +++ b/universal7885-common/sepolicy/samsung_slsi/tee/vendor/device.te @@ -0,0 +1,4 @@ +# device.te + +type tz_device, dev_type; +type tz_user_device, dev_type; diff --git a/universal7885-common/sepolicy/samsung_slsi/tee/vendor/file.te b/universal7885-common/sepolicy/samsung_slsi/tee/vendor/file.te new file mode 100644 index 0000000..8acdd68 --- /dev/null +++ b/universal7885-common/sepolicy/samsung_slsi/tee/vendor/file.te @@ -0,0 +1,7 @@ +# file.te + +# DATA +type tee_vendor_data_file, file_type, data_file_type; + +# DEV SOCKET +type tz_socket, file_type; diff --git a/universal7885-common/sepolicy/samsung_slsi/tee/vendor/file_contexts b/universal7885-common/sepolicy/samsung_slsi/tee/vendor/file_contexts new file mode 100644 index 0000000..f66c3c6 --- /dev/null +++ b/universal7885-common/sepolicy/samsung_slsi/tee/vendor/file_contexts @@ -0,0 +1,18 @@ +# file_contexts + +# DATA +/data/vendor/tee(/.*)? u:object_r:tee_vendor_data_file:s0 + +# DEV +/dev/socket/tz u:object_r:tz_socket:s0 +/dev/tuihw u:object_r:tz_device:s0 +/dev/tzdev u:object_r:tz_user_device:s0 +/dev/tzic u:object_r:tz_device:s0 +/dev/tzirs u:object_r:tz_device:s0 +/dev/tziwsock u:object_r:tz_user_device:s0 + +# VENDOR +/(vendor|system/vendor)/bin/tzdaemon u:object_r:tzdaemon_exec:s0 +/(vendor|system/vendor)/bin/tzts_daemon u:object_r:tztsdaemon_exec:s0 + +/(vendor|system/vendor)/lib(64)?/libteecl\.so u:object_r:same_process_hal_file:s0 diff --git a/universal7885-common/sepolicy/samsung_slsi/tee/vendor/hal_fingerprint_default.te b/universal7885-common/sepolicy/samsung_slsi/tee/vendor/hal_fingerprint_default.te new file mode 100644 index 0000000..fcec9f8 --- /dev/null +++ b/universal7885-common/sepolicy/samsung_slsi/tee/vendor/hal_fingerprint_default.te @@ -0,0 +1,3 @@ +# hal_fingerprint_default.te + +teegris_use(hal_fingerprint_default) diff --git a/universal7885-common/sepolicy/samsung_slsi/tee/vendor/hal_gatekeeper_default.te b/universal7885-common/sepolicy/samsung_slsi/tee/vendor/hal_gatekeeper_default.te new file mode 100644 index 0000000..386284f --- /dev/null +++ b/universal7885-common/sepolicy/samsung_slsi/tee/vendor/hal_gatekeeper_default.te @@ -0,0 +1 @@ +teegris_use(hal_gatekeeper_default) diff --git a/universal7885-common/sepolicy/samsung_slsi/tee/vendor/hal_keymaster_default.te b/universal7885-common/sepolicy/samsung_slsi/tee/vendor/hal_keymaster_default.te new file mode 100644 index 0000000..7c3e33f --- /dev/null +++ b/universal7885-common/sepolicy/samsung_slsi/tee/vendor/hal_keymaster_default.te @@ -0,0 +1 @@ +teegris_use(hal_keymaster_default) diff --git a/universal7885-common/sepolicy/samsung_slsi/tee/vendor/property.te b/universal7885-common/sepolicy/samsung_slsi/tee/vendor/property.te new file mode 100644 index 0000000..231d68e --- /dev/null +++ b/universal7885-common/sepolicy/samsung_slsi/tee/vendor/property.te @@ -0,0 +1,4 @@ +# property.te +type vendor_secureos_prop, property_type; +type vendor_tzdaemon_prop, property_type; +type vendor_tztsdaemon_prop, property_type; diff --git a/universal7885-common/sepolicy/samsung_slsi/tee/vendor/property_contexts b/universal7885-common/sepolicy/samsung_slsi/tee/vendor/property_contexts new file mode 100644 index 0000000..7ce7710 --- /dev/null +++ b/universal7885-common/sepolicy/samsung_slsi/tee/vendor/property_contexts @@ -0,0 +1,6 @@ +# property_contexts + +# TEEGRIS +vendor.secureos. u:object_r:vendor_secureos_prop:s0 +vendor.tzdaemon u:object_r:vendor_tzdaemon_prop:s0 +vendor.tzts_daemon u:object_r:vendor_tztsdaemon_prop:s0 diff --git a/universal7885-common/sepolicy/samsung_slsi/tee/vendor/tzdaemon.te b/universal7885-common/sepolicy/samsung_slsi/tee/vendor/tzdaemon.te new file mode 100644 index 0000000..a600038 --- /dev/null +++ b/universal7885-common/sepolicy/samsung_slsi/tee/vendor/tzdaemon.te @@ -0,0 +1,33 @@ +type tzdaemon, domain; +type tzdaemon_exec, exec_type, vendor_file_type, file_type; + +# tzdaemon is started by init, type transit from init domain to tzdaemon domain +init_daemon_domain(tzdaemon) + +set_prop(tzdaemon, vendor_tzdaemon_prop) +set_prop(tzdaemon, vendor_secureos_prop) + +allow tzdaemon tz_device:chr_file rw_file_perms; +allow tzdaemon tz_user_device:chr_file rw_file_perms; +allow tzdaemon tz_socket:sock_file { write }; + +# /dev/kmsg +allow tzdaemon kmsg_device:chr_file rw_file_perms; + +# /data/vendor/tee +allow tzdaemon tee_vendor_data_file:dir create_dir_perms; +allow tzdaemon tee_vendor_data_file:file create_file_perms; + +# /proc/stat +allow tzdaemon proc_stat:file r_file_perms; + +# /efs +allow tzdaemon efs_file:dir r_dir_perms; + +# /efs/tee/ +# /mnt/vendor/efs/tee/ +allow tzdaemon tee_efs_file:dir create_dir_perms; +allow tzdaemon tee_efs_file:file create_file_perms; + +# /mnt/vendor/ +allow tzdaemon mnt_vendor_file:dir r_dir_perms; diff --git a/universal7885-common/sepolicy/samsung_slsi/tee/vendor/tztsdaemon.te b/universal7885-common/sepolicy/samsung_slsi/tee/vendor/tztsdaemon.te new file mode 100644 index 0000000..0a442c4 --- /dev/null +++ b/universal7885-common/sepolicy/samsung_slsi/tee/vendor/tztsdaemon.te @@ -0,0 +1,10 @@ +type tztsdaemon, domain; +type tztsdaemon_exec, exec_type, vendor_file_type, file_type; + +# tztsdaemon is started by init, type transit from init domain to tztsdaemon domain +init_daemon_domain(tztsdaemon) + +set_prop(tztsdaemon, vendor_tztsdaemon_prop) + +# /dev/tziwsock +allow tztsdaemon tz_user_device:chr_file rw_file_perms; diff --git a/universal7885-common/sepolicy/samsung_slsi/vendor/argosd.te b/universal7885-common/sepolicy/samsung_slsi/vendor/argosd.te new file mode 100644 index 0000000..3edf5c5 --- /dev/null +++ b/universal7885-common/sepolicy/samsung_slsi/vendor/argosd.te @@ -0,0 +1,25 @@ +# argosd.te + +type argosd, domain; +type argosd_exec, exec_type, vendor_file_type, file_type; + +# argosd is started by init, type transit from init domain to gpsd domain +init_daemon_domain(argosd) + +# /dev/network_throughput +allow argosd radio_qos_device:chr_file rw_file_perms; + +# /proc/net/dev +allow argosd proc_net:file r_file_perms; + +# /sys/ +allow argosd sysfs:dir r_dir_perms; + +# /sys/devices/platform/argos +# /sys/firmware/devicetree/base/argos +allow argosd sysfs_argos:dir r_dir_perms; +allow argosd sysfs_argos:file r_file_perms; + +# /sys/class/scsi_host/host0 +allow argosd sysfs_scsi_host_writable:dir r_dir_perms; +allow argosd sysfs_scsi_host_writable:file r_file_perms; diff --git a/universal7885-common/sepolicy/samsung_slsi/vendor/cbd.te b/universal7885-common/sepolicy/samsung_slsi/vendor/cbd.te new file mode 100644 index 0000000..b3fb0e1 --- /dev/null +++ b/universal7885-common/sepolicy/samsung_slsi/vendor/cbd.te @@ -0,0 +1,63 @@ +# cbd.te + +type cbd, domain; +type cbd_exec, exec_type, vendor_file_type, file_type; + +allow cbd self:capability setuid; + +# cbd is started by init, type transit from init domain to cbd domain +init_daemon_domain(cbd) + +# /dev/block/ +allow cbd block_device:dir search; + +# /data/vendor/log +allow cbd log_vendor_data_file:dir search; + +# /data/vendor/log/cbd +allow cbd log_cbd_vendor_data_file:dir create_dir_perms; +allow cbd log_cbd_vendor_data_file:file create_file_perms; + +# /dev/block/platform/.+/by-name/radio +allow cbd radio_block_device:blk_file r_file_perms; + +# /dev/kmsg +allow cbd kmsg_device:chr_file rw_file_perms; + +# /dev/umts_* +allow cbd vendor_radio_device:chr_file rw_file_perms; + +# /mnt/vendor/ +allow cbd mnt_vendor_file:dir search; + +# /mnt/vendor/efs/ +allow cbd efs_file:dir r_dir_perms; + +# /mnt/vendor/efs/factory.prop +allow cbd efs_file:file r_file_perms; + +# /mnt/vendor/efs/nv_data.bin +allow cbd bin_nv_data_efs_file:file r_file_perms; + +# /proc/cmdline +allow cbd proc_cmdline:file r_file_perms; + +# /sys/power/wake_unlock +allow cbd sysfs_wake_lock:file rw_file_perms; + +# /sys/devices/platform/10000.mif_pdata/sim/ +allow cbd sysfs_sim:dir r_dir_perms; +allow cbd sysfs_sim:file r_file_perms; + +# /sys/devices/platform/10000.mif_pdata/sim/ds_detect +allow cbd sysfs_sim_writable:file rw_file_perms; + +# kernel log +allow cbd kernel:system syslog_read; + +# vendor.cbd. +set_prop(cbd, vendor_cbd_prop) + +# FIXME: Can we be more specific? +allow cbd vendor_shell_exec:file execute_no_trans; +# FIXME END diff --git a/universal7885-common/sepolicy/samsung_slsi/vendor/device.te b/universal7885-common/sepolicy/samsung_slsi/vendor/device.te new file mode 100644 index 0000000..47639b2 --- /dev/null +++ b/universal7885-common/sepolicy/samsung_slsi/vendor/device.te @@ -0,0 +1,22 @@ +# device.te +type efs_block_device, dev_type; +type dqmdbg_block_device, dev_type; +type dtbo_block_device, dev_type; +type keydata_block_device, dev_type; +type keyrefuge_block_device, dev_type; +type modem_block_device, dev_type; +type omr_block_device, dev_type; +type radio_block_device, dev_type; +type sec_efs_block_device, dev_type; + +type bbd_device, dev_type; +type bt_device, dev_type; +type cpu_dma_device, dev_type; +type drb_device, dev_type; +type epic_device, dev_type; +type fp_sensor_device, dev_type; +type io_device, dev_type; +type pm_qos_device, dev_type; +type radio_qos_device, dev_type; +type ssp_device, dev_type; +type vendor_radio_device, dev_type; diff --git a/universal7885-common/sepolicy/samsung_slsi/vendor/epicd.te b/universal7885-common/sepolicy/samsung_slsi/vendor/epicd.te new file mode 100644 index 0000000..40aa60c --- /dev/null +++ b/universal7885-common/sepolicy/samsung_slsi/vendor/epicd.te @@ -0,0 +1,27 @@ +type epicd, domain; +type epicd_exec, exec_type, vendor_file_type, file_type; + +# epicd is started by init, type transit from init domain to epicd domain +init_daemon_domain(epicd) + +# WTF? +# execve("/vendor/bin/sh", ["sh", "-c", "getprop ro.hardware"] +allow epicd vendor_shell_exec:file execute_no_trans; + +# WTF? +# execve("/vendor/bin/getprop", ["getprop", "ro.hardware"] +allow epicd vendor_toolbox_exec:file execute_no_trans; + +# /dev/cluster[0-9]_freq_(max|min) +# /dev/*_throughput* +# /dev/gpu_freq_(max|min) +allow epicd pm_qos_device:chr_file rw_file_perms; + +# /dev/socket/ +allow epicd socket_device:dir w_dir_perms; + +# /dev/socket/epic +allow epicd epicd_socket:unix_dgram_socket { read write }; + +# /dev/mode +allow epicd epic_device:chr_file rw_file_perms; diff --git a/universal7885-common/sepolicy/samsung_slsi/vendor/fastbootd.te b/universal7885-common/sepolicy/samsung_slsi/vendor/fastbootd.te new file mode 100644 index 0000000..5435c6c --- /dev/null +++ b/universal7885-common/sepolicy/samsung_slsi/vendor/fastbootd.te @@ -0,0 +1,7 @@ +# fastbootd.te + +allow fastbootd { + boot_block_device + dtbo_block_device + recovery_block_device +}:blk_file rw_file_perms; diff --git a/universal7885-common/sepolicy/samsung_slsi/vendor/file.te b/universal7885-common/sepolicy/samsung_slsi/vendor/file.te new file mode 100644 index 0000000..1e450df --- /dev/null +++ b/universal7885-common/sepolicy/samsung_slsi/vendor/file.te @@ -0,0 +1,63 @@ +# file.te + +### DATA +type biometrics_vendor_data_file, file_type, data_file_type; +type conn_vendor_data_file, file_type, data_file_type; +type gps_vendor_data_file, file_type, data_file_type; +type log_vendor_data_file, file_type, data_file_type; +type log_cbd_vendor_data_file, file_type, data_file_type; +type radio_vendor_data_file, file_type, data_file_type; +type wifi_vendor_data_file, file_type, data_file_type; + +# EFS +type app_efs_file, file_type; +type battery_efs_file, file_type; +type bin_nv_data_efs_file, file_type; +type cpk_efs_file, file_type; +type imei_efs_file, file_type; +type nfc_efs_file, file_type; +type pfw_efs_file, file_type; +type prov_efs_file, file_type; +type sec_efs_file, file_type; +type tee_efs_file, file_type; +type wifi_efs_file, file_type; + +# PROC +type proc_last_kmsg, fs_type, proc_type; + +# SOCKETS +type epicd_socket, file_type, data_file_type; + +### SYSFS +type sysfs_argos, sysfs_type, r_fs_type, fs_type; +type sysfs_battery, sysfs_type, r_fs_type, fs_type; +type sysfs_bbd, sysfs_type, r_fs_type, fs_type; +type sysfs_fingerprint, sysfs_type, r_fs_type, fs_type; +type sysfs_iio, sysfs_type, r_fs_type, fs_type; +type sysfs_input, sysfs_type, r_fs_type, fs_type; +type sysfs_sec_gps, sysfs_type, r_fs_type, fs_type; +type sysfs_sec_key, sysfs_type, r_fs_type, fs_type; +type sysfs_sec_sensors, sysfs_type, r_fs_type, fs_type; +type sysfs_sec_switch, sysfs_type, r_fs_type, fs_type; +type sysfs_sec_touchscreen, sysfs_type, r_fs_type, fs_type; +type sysfs_sim, sysfs_type, r_fs_type, fs_type; +type sysfs_sensors, sysfs_type, r_fs_type, fs_type; +type sysfs_wifi, sysfs_type, r_fs_type, fs_type; + +type sysfs_backlight_writable, sysfs_type, rw_fs_type, fs_type; +type sysfs_battery_writable, sysfs_type, rw_fs_type, fs_type; +type sysfs_bt_writable, sysfs_type, rw_fs_type, fs_type; +type sysfs_gps_writable, sysfs_type, rw_fs_type, fs_type; +type sysfs_lcd_writable, sysfs_type, rw_fs_type, fs_type; +type sysfs_power_writable, sysfs_type, rw_fs_type, fs_type; +type sysfs_scsi_host_writable, sysfs_type, rw_fs_type, fs_type; +type sysfs_sensorhub_writable, sysfs_type, rw_fs_type, fs_type; +type sysfs_sensors_writable, sysfs_type, rw_fs_type, fs_type; +type sysfs_sim_writable, sysfs_type, rw_fs_type, fs_type; +type sysfs_spi_writeable, sysfs_type, rw_fs_type, fs_type; +type sysfs_sec_switch_writable, sysfs_type, rw_fs_type, fs_type; +type sysfs_touchscreen_writable, sysfs_type, rw_fs_type, fs_type; +type sysfs_wifi_writable, sysfs_type, rw_fs_type, fs_type; + +### VENDOR +type vendor_firmware_file, file_type, vendor_file_type; diff --git a/universal7885-common/sepolicy/samsung_slsi/vendor/file_contexts b/universal7885-common/sepolicy/samsung_slsi/vendor/file_contexts new file mode 100644 index 0000000..577db4f --- /dev/null +++ b/universal7885-common/sepolicy/samsung_slsi/vendor/file_contexts @@ -0,0 +1,126 @@ +# file_contexts + +### DATA +/data/vendor/biometrics(/.*)? u:object_r:biometrics_vendor_data_file:s0 +/data/vendor/conn(/.*)? u:object_r:conn_vendor_data_file:s0 +/data/vendor/gps(/.*)? u:object_r:gps_vendor_data_file:s0 +/data/vendor/wifi(/.*)? u:object_r:wifi_vendor_data_file:s0 +/data/vendor/log(/.*)? u:object_r:log_vendor_data_file:s0 +/data/vendor/log/cbd(/.*)? u:object_r:log_cbd_vendor_data_file:s0 +/data/vendor/secradio(/.*)? u:object_r:radio_vendor_data_file:s0 + +### DEV +/dev/block/platform/.+/by-name/boot u:object_r:boot_block_device:s0 +/dev/block/platform/.+/by-name/cache u:object_r:cache_block_device:s0 +/dev/block/platform/.+/by-name/efs u:object_r:efs_block_device:s0 +/dev/block/platform/.+/by-name/dqmdbg u:object_r:dqmdbg_block_device:s0 +/dev/block/platform/.+/by-name/dtbo u:object_r:dtbo_block_device:s0 +/dev/block/platform/.+/by-name/keydata u:object_r:keydata_block_device:s0 +/dev/block/platform/.+/by-name/keyrefuge u:object_r:keyrefuge_block_device:s0 +/dev/block/platform/.+/by-name/metadata u:object_r:metadata_block_device:s0 +/dev/block/platform/.+/by-name/misc u:object_r:misc_block_device:s0 +/dev/block/platform/.+/by-name/modem u:object_r:modem_block_device:s0 +/dev/block/platform/.+/by-name/omr u:object_r:omr_block_device:s0 +/dev/block/platform/.+/by-name/persistent u:object_r:frp_block_device:s0 +/dev/block/platform/.+/by-name/radio u:object_r:radio_block_device:s0 +/dev/block/platform/.+/by-name/recovery u:object_r:recovery_block_device:s0 +/dev/block/platform/.+/by-name/sec_efs u:object_r:sec_efs_block_device:s0 +/dev/block/platform/.+/by-name/super u:object_r:super_block_device:s0 +/dev/block/platform/.+/by-name/userdata u:object_r:userdata_block_device:s0 + +/dev/esfp[0-9] u:object_r:fp_sensor_device:s0 +/dev/batch_io u:object_r:io_device:s0 +/dev/ssp_sensorhub u:object_r:ssp_device:s0 + +# bluetooth +/dev/ttySAC[0-9] u:object_r:bt_device:s0 + +# cpu +/dev/cpu_dma_latency u:object_r:cpu_dma_device:s0 + +### epic +/dev/mode u:object_r:epic_device:s0 +/dev/socket/epic u:object_r:epicd_socket:s0 + +### gnss/gps +/dev/bbd_control u:object_r:bbd_device:s0 +/dev/bbd_packet u:object_r:bbd_device:s0 +/dev/bbd_patch u:object_r:bbd_device:s0 +/dev/bbd_reliable u:object_r:bbd_device:s0 +/dev/bbd_sensor u:object_r:bbd_device:s0 +/dev/bbd_sio u:object_r:bbd_device:s0 +/dev/bbd_urgent_patch u:object_r:bbd_device:s0 +/dev/ttyBCM[0-9]* u:object_r:bbd_device:s0 + +### qos +/dev/bus_throughput u:object_r:pm_qos_device:s0 +/dev/bus_throughput_max u:object_r:pm_qos_device:s0 +/dev/cluster0_freq_max u:object_r:pm_qos_device:s0 +/dev/cluster0_freq_min u:object_r:pm_qos_device:s0 +/dev/cluster1_freq_max u:object_r:pm_qos_device:s0 +/dev/cluster1_freq_min u:object_r:pm_qos_device:s0 +/dev/cluster2_freq_max u:object_r:pm_qos_device:s0 +/dev/cluster2_freq_min u:object_r:pm_qos_device:s0 +/dev/cpu_online_max u:object_r:pm_qos_device:s0 +/dev/cpu_online_min u:object_r:pm_qos_device:s0 +/dev/device_throughput u:object_r:pm_qos_device:s0 +/dev/device_throughput_max u:object_r:pm_qos_device:s0 +/dev/gpu_freq_max u:object_r:pm_qos_device:s0 +/dev/gpu_freq_min u:object_r:pm_qos_device:s0 +/dev/mfc_throughput u:object_r:pm_qos_device:s0 +/dev/mfc_throughput_max u:object_r:pm_qos_device:s0 +/dev/network_throughput u:object_r:radio_qos_device:s0 +/dev/npu_throughput u:object_r:pm_qos_device:s0 +/dev/npu_throughput_max u:object_r:pm_qos_device:s0 + +### radio +# DRB +/dev/drb u:object_r:drb_device:s0 + +# UMTS +/dev/umts_boot0 u:object_r:vendor_radio_device:s0 +/dev/umts_cass u:object_r:vendor_radio_device:s0 +/dev/umts_ipc[0-1] u:object_r:vendor_radio_device:s0 +/dev/umts_dm0 u:object_r:vendor_radio_device:s0 +/dev/umts_rfs0 u:object_r:vendor_radio_device:s0 +/dev/umts_router u:object_r:vendor_radio_device:s0 + +### EFS +/efs/Battery(/.*)? u:object_r:battery_efs_file:s0 +/efs/DAK(/.*)? u:object_r:prov_efs_file:s0 +/efs/afc(/.*)? u:object_r:sec_efs_file:s0 +/efs/bluetooth(/.*)? u:object_r:bluetooth_efs_file:s0 +/efs/cpk(/.*)? u:object_r:cpk_efs_file:s0 +/efs/imei(/.*)? u:object_r:imei_efs_file:s0 +/efs/nfc(/.*)? u:object_r:nfc_efs_file:s0 +/efs/nv_data\.bin(.*) u:object_r:bin_nv_data_efs_file:s0 +/efs/pfw_data(/.*)? u:object_r:pfw_efs_file:s0 +/efs/prov(/.*)? u:object_r:prov_efs_file:s0 +/efs/prov_data(/.*)? u:object_r:prov_efs_file:s0 +/efs/root(/.*)? u:object_r:app_efs_file:s0 +/efs/tee(/.*)? u:object_r:tee_efs_file:s0 +/efs/wifi(/.*)? u:object_r:wifi_efs_file:s0 + +/mnt/vendor/efs(/.*)? u:object_r:efs_file:s0 +/mnt/vendor/efs/DAK(/.*)? u:object_r:prov_efs_file:s0 +/mnt/vendor/efs/afc(/.*)? u:object_r:sec_efs_file:s0 +/mnt/vendor/efs/bluetooth(/.*)? u:object_r:bluetooth_efs_file:s0 +/mnt/vendor/efs/cpk(/.*)? u:object_r:cpk_efs_file:s0 +/mnt/vendor/efs/imei(/.*)? u:object_r:imei_efs_file:s0 +/mnt/vendor/efs/nv_data\.bin(.*) u:object_r:bin_nv_data_efs_file:s0 +/mnt/vendor/efs/pfw_data(/.*)? u:object_r:pfw_efs_file:s0 +/mnt/vendor/efs/prov(/.*)? u:object_r:prov_efs_file:s0 +/mnt/vendor/efs/prov_data(/.*)? u:object_r:prov_efs_file:s0 +/mnt/vendor/efs/root(/.*)? u:object_r:app_efs_file:s0 +/mnt/vendor/efs/tee(/.*)? u:object_r:tee_efs_file:s0 +/mnt/vendor/efs/wifi(/.*)? u:object_r:wifi_efs_file:s0 + +### VENDOR +/(vendor|system/vendor)/bin/cbd u:object_r:cbd_exec:s0 +/(vendor|system/vendor)/bin/secril_config_svc u:object_r:secril_config_svc_exec:s0 + +/(vendor|system/vendor)/bin/hw/android\.hardware\.biometrics\.fingerprint@[0-9].[0-9]-service\.samsung u:object_r:hal_fingerprint_default_exec:s0 +/(vendor|system/vendor)/bin/hw/android\.hardware\.light@[0-9].[0-9]-service\.samsung u:object_r:hal_light_default_exec:s0 +/(vendor|system/vendor)/bin/hw/android\.hardware\.thermal@[0-9].[0-9]-service\.samsung u:object_r:hal_thermal_default_exec:s0 + +/(vendor|system/vendor)/firmware(/.*)? u:object_r:vendor_firmware_file:s0 diff --git a/universal7885-common/sepolicy/samsung_slsi/vendor/genfs_contexts b/universal7885-common/sepolicy/samsung_slsi/vendor/genfs_contexts new file mode 100644 index 0000000..b051a52 --- /dev/null +++ b/universal7885-common/sepolicy/samsung_slsi/vendor/genfs_contexts @@ -0,0 +1,64 @@ +# genfs_contexts + +### PROC +genfscon proc /last_kmsg u:object_r:proc_last_kmsg:s0 + +### SYSFS +genfscon sysfs /bbd u:object_r:sysfs_bbd:s0 + +genfscon sysfs /bus/iio/devices u:object_r:sysfs_iio:s0 + +genfscon sysfs /class/backlight/ u:object_r:sysfs_backlight_writable:s0 +genfscon sysfs /class/fingerprint/fingerprint u:object_r:sysfs_fingerprint:s0 +genfscon sysfs /class/input u:object_r:sysfs_input:s0 +genfscon sysfs /class/power_supply u:object_r:sysfs_battery:s0 +genfscon sysfs /class/rtc/rtc0 u:object_r:sysfs_rtc:s0 +genfscon sysfs /class/sec/gps u:object_r:sysfs_sec_gps:s0 +genfscon sysfs /class/sec/sensors u:object_r:sysfs_sec_sensors:s0 +genfscon sysfs /class/sec/tsp u:object_r:sysfs_sec_touchscreen:s0 +genfscon sysfs /class/sensor_event u:object_r:sysfs_sensors:s0 +genfscon sysfs /class/sensors u:object_r:sysfs_sensors:s0 +genfscon sysfs /class/thermal u:object_r:sysfs_thermal:s0 +genfscon sysfs /class/timed_output/vibrator/intensity u:object_r:sysfs_vibrator:s0 +genfscon sysfs /class/timed_output/vibrator/multi_freq u:object_r:sysfs_vibrator:s0 + +genfscon sysfs /devices/platform/argos u:object_r:sysfs_argos:s0 +genfscon sysfs /devices/platform/battery/power_supply u:object_r:sysfs_battery:s0 +genfscon sysfs /devices/platform/battery/power_supply/battery/lcd u:object_r:sysfs_battery_writable:s0 +genfscon sysfs /devices/platform/panel@0/backlight/panel/brightness u:object_r:sysfs_backlight_writable:s0 +genfscon sysfs /devices/platform/panel@0/backlight/panel/max_brightness u:object_r:sysfs_backlight_writable:s0 +genfscon sysfs /devices/platform/panel@0/lcd/panel u:object_r:sysfs_lcd_writable:s0 + +genfscon sysfs /devices/virtual/fingerprint/fingerprint u:object_r:sysfs_fingerprint:s0 +genfscon sysfs /devices/virtual/input u:object_r:sysfs_input:s0 +genfscon sysfs /devices/virtual/lcd/panel u:object_r:sysfs_lcd_writable:s0 +genfscon sysfs /devices/virtual/sec/gps u:object_r:sysfs_sec_gps:s0 +genfscon sysfs /devices/virtual/sec/sec_key u:object_r:sysfs_sec_key:s0 +genfscon sysfs /devices/virtual/sec/tsp u:object_r:sysfs_sec_touchscreen:s0 +genfscon sysfs /devices/virtual/sec/tsp/cmd u:object_r:sysfs_touchscreen_writable:s0 +genfscon sysfs /devices/virtual/sec/tsp/ear_detect_enable u:object_r:sysfs_touchscreen_writable:s0 +genfscon sysfs /devices/virtual/sec/tsp/prox_power_off u:object_r:sysfs_touchscreen_writable:s0 +genfscon sysfs /devices/virtual/sec/tsp/input/enabled u:object_r:sysfs_touchscreen_writable:s0 +genfscon sysfs /devices/virtual/sensor_event u:object_r:sysfs_sensors:s0 +genfscon sysfs /devices/virtual/sensors u:object_r:sysfs_sensors:s0 +genfscon sysfs /devices/virtual/sensors/hidden_hole/hh_check_coef u:object_r:sysfs_sensors_writable:s0 +genfscon sysfs /devices/virtual/sensors/ssp_sensor/enable u:object_r:sysfs_sensors_writable:s0 +genfscon sysfs /devices/virtual/sensors/ssp_sensor/ssp_flush u:object_r:sysfs_sensors_writable:s0 +genfscon sysfs /devices/virtual/sec/switch u:object_r:sysfs_sec_switch:s0 +genfscon sysfs /devices/virtual/sec/switch/afc_disable u:object_r:sysfs_sec_switch_writable:s0 +genfscon sysfs /devices/virtual/thermal u:object_r:sysfs_thermal:s0 +genfscon sysfs /devices/virtual/timed_output/vibrator/cp_trigger_index u:object_r:sysfs_vibrator:s0 +genfscon sysfs /devices/virtual/timed_output/vibrator/intensity u:object_r:sysfs_vibrator:s0 +genfscon sysfs /devices/virtual/timed_output/vibrator/multi_freq u:object_r:sysfs_vibrator:s0 + +genfscon sysfs /module/dhd/parameters u:object_r:sysfs_wifi_writable:s0 + +genfscon sysfs /power/cpufreq_max_limit u:object_r:sysfs_power_writable:s0 +genfscon sysfs /power/cpufreq_min_limit u:object_r:sysfs_power_writable:s0 +genfscon sysfs /power/cpuhotplug/max_online_cpu u:object_r:sysfs_power_writable:s0 +genfscon sysfs /power/rtc_status u:object_r:sysfs_power_writable:s0 + +genfscon sysfs /wifi u:object_r:sysfs_wifi:s0 +genfscon sysfs /wifi/cid u:object_r:sysfs_wifi_writable:s0 +genfscon sysfs /wifi/mac_addr u:object_r:sysfs_wifi_writable:s0 +genfscon sysfs /wifi/memdump u:object_r:sysfs_wifi_writable:s0 diff --git a/universal7885-common/sepolicy/samsung_slsi/vendor/gpsd.te b/universal7885-common/sepolicy/samsung_slsi/vendor/gpsd.te new file mode 100644 index 0000000..6e89239 --- /dev/null +++ b/universal7885-common/sepolicy/samsung_slsi/vendor/gpsd.te @@ -0,0 +1,37 @@ +type gpsd, domain, netdomain; +type gpsd_exec, exec_type, vendor_file_type, file_type; + +# gpsd is started by init, type transit from init domain to gpsd domain +init_daemon_domain(gpsd) + +allow gpsd rild:unix_stream_socket connectto; + +get_prop(gpsd, vendor_radio_prop) +get_prop(gpsd, telephony_config_prop) +get_prop(gpsd, exported_config_prop) + +get_prop(gpsd, hwservicemanager_prop) +hwbinder_use(gpsd) +allow gpsd system_suspend_hwservice:hwservice_manager { find }; +allow gpsd fwk_sensor_hwservice:hwservice_manager { find }; + +binder_call(gpsd, system_suspend_server) +binder_call(gpsd, system_server) +binder_call(system_server, gpsd) + +allow gpsd self:netlink_kobject_uevent_socket create_socket_perms_no_ioctl; +allow gpsd self:{ tcp_socket udp_socket } create_stream_socket_perms; +allow gpsd port:tcp_socket { name_bind name_connect }; +allow gpsd port:udp_socket name_bind; +allow gpsd node:{ tcp_socket udp_socket } node_bind; + +# /acct/tasks +allow gpsd cgroup:file getattr; + +# /dev/socket/fwmarkd +allow gpsd fwmarkd_socket:sock_file write; + +# /data/vendor/gps +allow gpsd gps_vendor_data_file:dir rw_dir_perms; +allow gpsd gps_vendor_data_file:file create_file_perms; +allow gpsd gps_vendor_data_file:fifo_file create_file_perms; diff --git a/universal7885-common/sepolicy/samsung_slsi/vendor/hal_bluetooth_default.te b/universal7885-common/sepolicy/samsung_slsi/vendor/hal_bluetooth_default.te new file mode 100644 index 0000000..d04de81 --- /dev/null +++ b/universal7885-common/sepolicy/samsung_slsi/vendor/hal_bluetooth_default.te @@ -0,0 +1,24 @@ +# hal_bluetooth_default.te + +# ro.rfkilldisabled +get_prop(hal_bluetooth_default, rfkilldisabled_prop) +# vendor.bluetooth_fw_ver +set_prop(hal_bluetooth_default, wifi_log_prop) +# sys.bluetooth.tty +set_prop(hal_bluetooth_default, exported_bluetooth_prop) + +# /dev/ttySAC[0-9] +allow hal_bluetooth_default bt_device:chr_file rw_file_perms; + +# /mnt/vendor +allow hal_bluetooth_default mnt_vendor_file:dir search; + +# /mnt/vendor/efs/ +allow hal_bluetooth_default efs_file:dir r_dir_perms; + +# /mnt/vendor/conn +allow hal_bluetooth_default conn_vendor_data_file:dir r_dir_perms; +allow hal_bluetooth_default conn_vendor_data_file:file r_file_perms; + +# /sys/devices/platform/bluetooth/rfkill/rfkill0/state +allow hal_bluetooth_default sysfs_bt_writable:file rw_file_perms; diff --git a/universal7885-common/sepolicy/samsung_slsi/vendor/hal_fingerprint_default.te b/universal7885-common/sepolicy/samsung_slsi/vendor/hal_fingerprint_default.te new file mode 100644 index 0000000..cce1395 --- /dev/null +++ b/universal7885-common/sepolicy/samsung_slsi/vendor/hal_fingerprint_default.te @@ -0,0 +1,14 @@ +# hal_fingerprint_default.te + +# /dev/esfp[0-9] +allow hal_fingerprint_default fp_sensor_device:chr_file rw_file_perms; + +# /data/vendor/ -> biometrics +file_type_auto_trans(hal_fingerprint_default, vendor_data_file, biometrics_vendor_data_file) + +# /data/vendor/biometrics/* +allow hal_fingerprint_default biometrics_vendor_data_file:file create_file_perms; + +# /sys/class/fingerprint/ +allow hal_fingerprint_default sysfs_fingerprint:dir r_dir_perms; +allow hal_fingerprint_default sysfs_fingerprint:file r_file_perms; diff --git a/universal7885-common/sepolicy/samsung_slsi/vendor/hal_gnss_default.te b/universal7885-common/sepolicy/samsung_slsi/vendor/hal_gnss_default.te new file mode 100644 index 0000000..5911960 --- /dev/null +++ b/universal7885-common/sepolicy/samsung_slsi/vendor/hal_gnss_default.te @@ -0,0 +1,12 @@ +# hal_gnss_default.te + +# cgroups tasks +allow hal_gnss_default cgroup:file getattr; + +# /data/vendor/gps +allow hal_gnss_default gps_vendor_data_file:dir rw_dir_perms; +allow hal_gnss_default gps_vendor_data_file:file create_file_perms; +allow hal_gnss_default gps_vendor_data_file:fifo_file create_file_perms; + +# /mnt/vendor +allow hal_gnss_default mnt_vendor_file:dir search; diff --git a/universal7885-common/sepolicy/samsung_slsi/vendor/hal_keymaster_default.te b/universal7885-common/sepolicy/samsung_slsi/vendor/hal_keymaster_default.te new file mode 100644 index 0000000..1d91a5d --- /dev/null +++ b/universal7885-common/sepolicy/samsung_slsi/vendor/hal_keymaster_default.te @@ -0,0 +1,7 @@ +# hal_keymaster_default + +# /mnt/vendor +allow hal_keymaster_default mnt_vendor_file:dir search; + +# /mnt/vendor/efs +allow hal_keymaster_default efs_file:dir search; diff --git a/universal7885-common/sepolicy/samsung_slsi/vendor/hal_light_default.te b/universal7885-common/sepolicy/samsung_slsi/vendor/hal_light_default.te new file mode 100644 index 0000000..dab24d3 --- /dev/null +++ b/universal7885-common/sepolicy/samsung_slsi/vendor/hal_light_default.te @@ -0,0 +1,5 @@ +# hal_light_default.te + +# /sys/devices/platform/panel@0/backlight/panel/brightness +# /sys/devices/platform/panel@0/backlight/panel/max_brightness +allow hal_light_default sysfs_backlight_writable:file rw_file_perms; diff --git a/universal7885-common/sepolicy/samsung_slsi/vendor/hal_power_default.te b/universal7885-common/sepolicy/samsung_slsi/vendor/hal_power_default.te new file mode 100644 index 0000000..cd4df7d --- /dev/null +++ b/universal7885-common/sepolicy/samsung_slsi/vendor/hal_power_default.te @@ -0,0 +1,25 @@ +# hal_power_default.te + +# /dev/cpu_dma_latency +allow hal_power_default cpu_dma_device:chr_file rw_file_perms; + +# /dev/stune/top-app/schedtune.boost +allow hal_power_default cgroup:file rw_file_perms; + +# /sys/class/input/ +allow hal_power_default sysfs_input:dir r_dir_perms; + +# /sys/class/power/ +allow hal_power_default sysfs_power:dir r_dir_perms; +allow hal_power_default sysfs_power:file r_file_perms; +allow hal_power_default sysfs_power_writable:file rw_file_perms; + +# /sys/class/sec/tsp/input/ +allow hal_power_default sysfs_sec_touchscreen:dir r_dir_perms; +allow hal_power_default sysfs_sec_touchscreen:lnk_file r_file_perms; + +# /sys/class/sec/tsp/input/{cmd,enabled} +allow hal_power_default sysfs_touchscreen_writable:file rw_file_perms; + +# /sys/devices/system/cpu/cpu[0-9]/cpufreq/scaling_max_freq +allow hal_power_default sysfs_devices_system_cpu:file rw_file_perms; diff --git a/universal7885-common/sepolicy/samsung_slsi/vendor/hal_sensors_default.te b/universal7885-common/sepolicy/samsung_slsi/vendor/hal_sensors_default.te new file mode 100644 index 0000000..0c2cbef --- /dev/null +++ b/universal7885-common/sepolicy/samsung_slsi/vendor/hal_sensors_default.te @@ -0,0 +1,62 @@ +# hal_sensors_default.te + +# /dev/batch_io +allow hal_sensors_default io_device:chr_file r_file_perms; + +# /dev/iio:device1 +allow hal_sensors_default iio_device:chr_file r_file_perms; + +# /dev/ssp_sensorhub +allow hal_sensors_default ssp_device:chr_file rw_file_perms; + +# /efs +allow hal_sensors_default efs_file:dir r_dir_perms; + +# /efs/FactoryApp/ +allow hal_sensors_default app_efs_file:dir rw_dir_perms; +allow hal_sensors_default app_efs_file:file { setattr rw_file_perms }; + +# /sys/bus/iio/devices +allow hal_sensors_default sysfs_iio:dir r_dir_perms; +allow hal_sensors_default sysfs_iio:file r_file_perms; + +# /sys/class/sec/sensors +allow hal_sensors_default sysfs_sec_sensors:dir r_dir_perms; +allow hal_sensors_default sysfs_sec_sensors:file r_file_perms; + +# /sys/class/sensors/ssp_sensor/enable +allow hal_sensors_default sysfs_sensors_writable:dir r_dir_perms; +allow hal_sensors_default sysfs_sensors_writable:file rw_file_perms; + +# /sys/devices/platform/10970000.spi/ +allow hal_sensors_default sysfs_spi_writeable:dir r_dir_perms; +allow hal_sensors_default sysfs_spi_writeable:file rw_file_perms; + +# /sys/devices/platform/panel@0/lcd/panel/window_type +allow hal_sensors_default sysfs_lcd_writable:dir r_dir_perms; +allow hal_sensors_default sysfs_lcd_writable:file r_file_perms; + +# /sys/class/input +allow hal_sensors_default sysfs_input:dir r_dir_perms; + +# /sys/devices/virtual/input/input4 +# /sys/devices/virtual/input/input6 +allow hal_sensors_default sysfs_sensors:dir r_dir_perms; +allow hal_sensors_default sysfs_sensors:file r_file_perms; + +# /sys/devices/virtual/sensors/magnetic_sensor/vendor +allow hal_sensors_default sysfs_sensors:dir r_dir_perms; +allow hal_sensors_default sysfs_sensors:file r_file_perms; + +# /sys/devices/virtual/sec/sec_key/hall_detect +allow hal_sensors_default sysfs_sec_key:dir r_dir_perms; +allow hal_sensors_default sysfs_sec_key:file r_file_perms; + +# /sys/class/sec/tsp/ +allow hal_sensors_default sysfs_sec_touchscreen:dir r_dir_perms; +allow hal_sensors_default sysfs_sec_touchscreen:file r_file_perms; +allow hal_sensors_default sysfs_sec_touchscreen:lnk_file r_file_perms; + +# /sys/class/sec/tsp/ear_detect_enable +# /sys/class/sec/tsp/cmd +allow hal_sensors_default sysfs_touchscreen_writable:file rw_file_perms; diff --git a/universal7885-common/sepolicy/samsung_slsi/vendor/hal_thermal_default.te b/universal7885-common/sepolicy/samsung_slsi/vendor/hal_thermal_default.te new file mode 100644 index 0000000..7cd9ba0 --- /dev/null +++ b/universal7885-common/sepolicy/samsung_slsi/vendor/hal_thermal_default.te @@ -0,0 +1,8 @@ +# hal_thermal_default.te + +# /acct/tasks +allow hal_thermal_default cgroup:file getattr; + +# /sys/devices/virtual/thermal/ +allow hal_thermal_default sysfs_thermal:dir r_dir_perms; +allow hal_thermal_default sysfs_thermal:file r_file_perms; diff --git a/universal7885-common/sepolicy/samsung_slsi/vendor/hal_wifi_hostapd_default.te b/universal7885-common/sepolicy/samsung_slsi/vendor/hal_wifi_hostapd_default.te new file mode 100644 index 0000000..fc048fd --- /dev/null +++ b/universal7885-common/sepolicy/samsung_slsi/vendor/hal_wifi_hostapd_default.te @@ -0,0 +1,4 @@ +# hal_wifi_hostapd_default.te + +# /data/vendor/wifi/hostapd/hostapd_wlan0.conf +r_dir_file(hal_wifi_hostapd_default, wifi_vendor_data_file) diff --git a/universal7885-common/sepolicy/samsung_slsi/vendor/hal_wifi_supplicant_default.te b/universal7885-common/sepolicy/samsung_slsi/vendor/hal_wifi_supplicant_default.te new file mode 100644 index 0000000..17ec008 --- /dev/null +++ b/universal7885-common/sepolicy/samsung_slsi/vendor/hal_wifi_supplicant_default.te @@ -0,0 +1,8 @@ +# hal_wifi_supplicant_default.te + +# /data/vendor/log +allow hal_wifi_supplicant_default log_vendor_data_file:dir r_dir_perms; + +# /data/vendor/wifi +allow hal_wifi_supplicant_default wifi_vendor_data_file:dir rw_dir_perms; +allow hal_wifi_supplicant_default wifi_vendor_data_file:file rw_file_perms; diff --git a/universal7885-common/sepolicy/samsung_slsi/vendor/init.te b/universal7885-common/sepolicy/samsung_slsi/vendor/init.te new file mode 100644 index 0000000..490913e --- /dev/null +++ b/universal7885-common/sepolicy/samsung_slsi/vendor/init.te @@ -0,0 +1,3 @@ +# init.te + +allow init proc_last_kmsg:file setattr; diff --git a/universal7885-common/sepolicy/samsung_slsi/vendor/kernel.te b/universal7885-common/sepolicy/samsung_slsi/vendor/kernel.te new file mode 100644 index 0000000..b016aad --- /dev/null +++ b/universal7885-common/sepolicy/samsung_slsi/vendor/kernel.te @@ -0,0 +1,5 @@ +# kernel.te + +# /vendor/firmware/ +allow kernel vendor_firmware_file:dir r_dir_perms; +allow kernel vendor_firmware_file:file r_file_perms; diff --git a/universal7885-common/sepolicy/samsung_slsi/vendor/lhd.te b/universal7885-common/sepolicy/samsung_slsi/vendor/lhd.te new file mode 100644 index 0000000..12e28c0 --- /dev/null +++ b/universal7885-common/sepolicy/samsung_slsi/vendor/lhd.te @@ -0,0 +1,38 @@ +type lhd, domain; +type lhd_exec, exec_type, vendor_file_type, file_type; + +# lhd is started by init, type transit from init domain to lhd domain +init_daemon_domain(lhd) + +get_prop(lhd, hwservicemanager_prop) +hwbinder_use(lhd) +allow lhd system_suspend_hwservice:hwservice_manager { find }; +binder_call(lhd, system_suspend_server) + +allow lhd self:tcp_socket create_stream_socket_perms; +allow lhd port:tcp_socket { name_bind name_connect }; +allow lhd node:tcp_socket node_bind; + +# /data/vendor/gps +allow lhd gps_vendor_data_file:dir rw_dir_perms; +allow lhd gps_vendor_data_file:file create_file_perms; +allow lhd gps_vendor_data_file:fifo_file create_file_perms; + +# /dev/bbd_control +allow lhd bbd_device:chr_file rw_file_perms; + +# /dev/socket/fwmarkd +allow lhd fwmarkd_socket:sock_file write; + +# /sys/bbd/lk_enable +r_dir_file(lhd, sysfs_bbd) + +# /sys/class/sec/gps +allow lhd sysfs_sec_gps:dir r_dir_perms; +allow lhd sysfs_sec_gps:file r_file_perms; + +# /sys/devices/virtual/sec/sensorhub/mcu_power +allow lhd sysfs_sensorhub_writable:file rw_file_perms; + +# /sys/class/sec/gps/GPS_PWR_EN/value +allow lhd sysfs_gps_writable:file rw_file_perms; diff --git a/universal7885-common/sepolicy/samsung_slsi/vendor/macloader.te b/universal7885-common/sepolicy/samsung_slsi/vendor/macloader.te new file mode 100644 index 0000000..d1f3d0c --- /dev/null +++ b/universal7885-common/sepolicy/samsung_slsi/vendor/macloader.te @@ -0,0 +1,40 @@ +# macloader.te + +type macloader, domain; +type macloader_exec, exec_type, vendor_file_type, file_type; + +# macloader is started by init, type transit from init domain to macloader domain +init_daemon_domain(macloader) + +set_prop(macloader, vendor_wifi_prop); + +allow macloader self:capability { net_admin }; + +allow macloader self:udp_socket create_socket_perms; +allowxperm macloader self:udp_socket ioctl { 0x8913 0x8914 }; + +# /data/vendor/conn +allow macloader conn_vendor_data_file:dir rw_dir_perms; +allow macloader conn_vendor_data_file:file create_file_perms; + +# /mnt/vendor +allow macloader mnt_vendor_file:dir search; + +# /mnt/vendor/efs +allow macloader efs_file:dir rw_dir_perms; + +# /mnt/vendor/efs/wifi +allow macloader wifi_efs_file:dir rw_dir_perms; +allow macloader wifi_efs_file:file rw_file_perms; + +# /sys/class/net +allow macloader sysfs_net:dir r_dir_perms; +allow macloader sysfs_net:file r_file_perms; + +# /sys/module/dhd/parameters/firmware_path +allow macloader sysfs_wifi_writable:dir r_dir_perms; +allow macloader sysfs_wifi_writable:file rw_file_perms; + +# /sys/wifi +allow macloader sysfs_wifi:dir r_dir_perms; +allow macloader sysfs_wifi:file r_file_perms; diff --git a/universal7885-common/sepolicy/samsung_slsi/vendor/property.te b/universal7885-common/sepolicy/samsung_slsi/vendor/property.te new file mode 100644 index 0000000..98639bd --- /dev/null +++ b/universal7885-common/sepolicy/samsung_slsi/vendor/property.te @@ -0,0 +1,6 @@ +# property.te + +type vendor_cbd_prop, property_type; +type vendor_radio_prop, property_type; +type vendor_fastcharge_prop, property_type; +type vendor_wifi_prop, property_type; diff --git a/universal7885-common/sepolicy/samsung_slsi/vendor/property_contexts b/universal7885-common/sepolicy/samsung_slsi/vendor/property_contexts new file mode 100644 index 0000000..039d872 --- /dev/null +++ b/universal7885-common/sepolicy/samsung_slsi/vendor/property_contexts @@ -0,0 +1,13 @@ +### cbd +vendor.cbd. u:object_r:vendor_cbd_prop:s0 +persist.vendor.cbd. u:object_r:vendor_radio_prop:s0 + +### radio +ro.multisim. u:object_r:vendor_radio_prop:s0 +ro.vendor.multisim. u:object_r:vendor_radio_prop:s0 +ro.vendor.radio. u:object_r:vendor_radio_prop:s0 + +### wifi +vendor.wifi. u:object_r:vendor_wifi_prop:s0 +ro.vendor.wifi. u:object_r:vendor_wifi_prop:s0 + diff --git a/universal7885-common/sepolicy/samsung_slsi/vendor/rild.te b/universal7885-common/sepolicy/samsung_slsi/vendor/rild.te new file mode 100644 index 0000000..6bfdc95 --- /dev/null +++ b/universal7885-common/sepolicy/samsung_slsi/vendor/rild.te @@ -0,0 +1,68 @@ +# rild.te + +get_prop(rild, vendor_radio_prop) + +allow rild block_device:dir search; +allow rild mnt_vendor_file:dir { getattr search }; + +# audio hal +allow rild hal_audio_default:dir search; +allow rild hal_audio_default:file r_file_perms; + +# gps +allow rild gpsd:dir search; +allow rild gpsd:file r_file_perms; + +# /data +allow rild system_data_file:dir getattr; + +# /data/vendor/log +allow rild log_vendor_data_file:dir rw_dir_perms; +allow rild log_vendor_data_file:file create_file_perms; + +# /dev/block/platform/.+/by-name/radio +allow rild radio_block_device:blk_file r_file_perms; + +# /dev/drb +allow rild drb_device:chr_file rw_file_perms; + +# /dev/umts_* +# /dev/umts_ipc* +allow rild vendor_radio_device:chr_file rw_file_perms; + +# /data/vendor/secradio +allow rild radio_vendor_data_file:dir rw_dir_perms; +allow rild radio_vendor_data_file:file create_file_perms; + +# /efs/FactoryApp/ +# /mnt/vendor/efs/root +allow rild app_efs_file:dir r_dir_perms; +allow rild app_efs_file:file { rw_file_perms setattr }; + +# /efs/imei +allow rild imei_efs_file:dir r_dir_perms; +allow rild imei_efs_file:file r_file_perms; + +# /mnt/vendor/efs/ +allow rild prov_efs_file:dir r_dir_perms; +allow rild prov_efs_file:file r_file_perms; + +# /mnt/vendor/efs/nv_data.bin +allow rild bin_nv_data_efs_file:file { rw_file_perms setattr unlink }; + +# /proc/net/xt_qtaguid/iface_stat_fmt +allow rild proc_qtaguid_stat:file r_file_perms; + +# /proc/sys/net/ipv6/conf/*/accept_ra_defrtr +allow rild proc_net:file rw_file_perms; + +# mdc. +# persist.sys.omc_support +# ro.csc. +get_prop(rild, exported_config_prop); + +# ro.boot.cpboot, ril.NwNmId[0-9] +get_prop(rild, telephony_config_prop) + +# vendor.cbd. +set_prop(rild, vendor_cbd_prop) diff --git a/universal7885-common/sepolicy/samsung_slsi/vendor/secril_config_svc.te b/universal7885-common/sepolicy/samsung_slsi/vendor/secril_config_svc.te new file mode 100644 index 0000000..3b83705 --- /dev/null +++ b/universal7885-common/sepolicy/samsung_slsi/vendor/secril_config_svc.te @@ -0,0 +1,20 @@ +# secril_config_svc.te + +type secril_config_svc, domain; +type secril_config_svc_exec, exec_type, vendor_file_type, file_type; + +# secril_config_svc is started by init, type transit from init domain to secril_config_svc domain +init_daemon_domain(secril_config_svc) + +# /mnt/vendor/ +allow secril_config_svc mnt_vendor_file:dir search; + +# /mnt/vendor/efs/factory.prop +# /mnt/vendor/efs/telephony.prop +allow secril_config_svc efs_file:dir search; +allow secril_config_svc efs_file:file r_file_perms; + +# ro.multisim. +# ro.vendor.multisim. +# ro.vendor.radio.default_network +set_prop(secril_config_svc, vendor_radio_prop) diff --git a/universal7885-common/sepolicy/samsung_slsi/vendor/system_server.te b/universal7885-common/sepolicy/samsung_slsi/vendor/system_server.te new file mode 100644 index 0000000..2bae9a7 --- /dev/null +++ b/universal7885-common/sepolicy/samsung_slsi/vendor/system_server.te @@ -0,0 +1,3 @@ +# system_server.te + +allow system_server proc_last_kmsg:file r_file_perms; diff --git a/universal7885-common/sepolicy/samsung_slsi/vendor/vndservice.te b/universal7885-common/sepolicy/samsung_slsi/vendor/vndservice.te new file mode 100644 index 0000000..12a4819 --- /dev/null +++ b/universal7885-common/sepolicy/samsung_slsi/vendor/vndservice.te @@ -0,0 +1 @@ +type vendor_surfaceflinger_vndservice, vndservice_manager_type; diff --git a/universal7885-common/sepolicy/samsung_slsi/vendor/vndservice_contexts b/universal7885-common/sepolicy/samsung_slsi/vendor/vndservice_contexts new file mode 100644 index 0000000..f088001 --- /dev/null +++ b/universal7885-common/sepolicy/samsung_slsi/vendor/vndservice_contexts @@ -0,0 +1,3 @@ +# vndservice_contexts + +Exynos.HWCService u:object_r:vendor_surfaceflinger_vndservice:s0 diff --git a/universal7885-common/sepolicy/vendor/app.te b/universal7885-common/sepolicy/vendor/app.te index f2f2bef..9949db8 100644 --- a/universal7885-common/sepolicy/vendor/app.te +++ b/universal7885-common/sepolicy/vendor/app.te @@ -1 +1 @@ -get_prop(appdomain, exported_camera_prop); +get_prop(appdomain, exported_camera_prop) diff --git a/universal7885-common/sepolicy/vendor/bootanim.te b/universal7885-common/sepolicy/vendor/bootanim.te index 79257f4..b3f2ac8 100644 --- a/universal7885-common/sepolicy/vendor/bootanim.te +++ b/universal7885-common/sepolicy/vendor/bootanim.te @@ -1 +1,2 @@ get_prop(bootanim, userspace_reboot_exported_prop) +allow bootanim system_data_file:dir read; diff --git a/universal7885-common/sepolicy/vendor/crash_dump.te b/universal7885-common/sepolicy/vendor/crash_dump.te index 138407f..578bee5 100644 --- a/universal7885-common/sepolicy/vendor/crash_dump.te +++ b/universal7885-common/sepolicy/vendor/crash_dump.te @@ -1,4 +1,5 @@ get_prop(crash_dump, hwservicemanager_prop) get_prop(crash_dump, exported_camera_prop) +#get_prop(crash_dump, vendor_default_prop) allow crash_dump app_data_file:file read; diff --git a/universal7885-common/sepolicy/vendor/file.te b/universal7885-common/sepolicy/vendor/file.te index ea81315..94c367f 100644 --- a/universal7885-common/sepolicy/vendor/file.te +++ b/universal7885-common/sepolicy/vendor/file.te @@ -14,6 +14,9 @@ type debugfs_mali_mem, fs_type, debugfs_type; type debugfs_ion, fs_type, debugfs_type; type debugfs_ion_dma, fs_type, debugfs_type; +# cache +type boot_logcat_file, file_type, data_file_type; + # proc type proc_extra, fs_type, proc_type; type proc_reset_reason, fs_type, proc_type; @@ -26,7 +29,11 @@ type mediadrm_data_file, file_type, data_file_type; type nfc_vendor_data_file, file_type, data_file_type; # sysfs types +type sysfs_battery_info, sysfs_type, fs_type; +type sysfs_battery_supply, sysfs_type, rw_fs_type, fs_type; type sysfs_abox_writable, sysfs_type, rw_fs_type, fs_type; +type sysfs_sensor_writable, sysfs_type, rw_fs_type, fs_type; +type sysfs_input_writable, sysfs_type, rw_fs_type, fs_type; type sysfs_batteryinfo_charger_writable, sysfs_type, rw_fs_type, fs_type; type sysfs_camera_writable, sysfs_type, rw_fs_type, fs_type; type sysfs_decon, sysfs_type, r_fs_type, fs_type; @@ -42,6 +49,7 @@ type sysfs_sec, fs_type, sysfs_type, mlstrustedobject; type sysfs_gps, fs_type, sysfs_type, mlstrustedobject; type sysfs_brightness, fs_type, sysfs_type, mlstrustedobject; type sysfs_virtual, fs_type, sysfs_type, mlstrustedobject; +type sysfs_fuelgauge, fs_type, sysfs_type, mlstrustedobject; type sysfs_charger, fs_type, sysfs_type, mlstrustedobject; type sysfs_modem, fs_type, sysfs_type, mlstrustedobject; type sysfs_camera, fs_type, sysfs_type, mlstrustedobject; diff --git a/universal7885-common/sepolicy/vendor/file_contexts b/universal7885-common/sepolicy/vendor/file_contexts index 6ed3a6c..73e66fa 100644 --- a/universal7885-common/sepolicy/vendor/file_contexts +++ b/universal7885-common/sepolicy/vendor/file_contexts @@ -4,8 +4,9 @@ /dev/umts_ipc0 u:object_r:radio_device:s0 /dev/fimg2d u:object_r:video_device:s0 /dev/sec-nfc u:object_r:nfc_device:s0 -/dev/goodix_fp u:object_r:goodix_device:s0 - +/dev/esfp0 u:object_r:goodix_device:s0 +/dev/gnss_ipc u:object_r:gps_device:s0 +/dev/scsc_h4_0 u:object_r:bt_device:s0 /dev/cpuset(/.*)? u:object_r:cgroup:s0 # camera @@ -42,9 +43,6 @@ #################################### # data files /data/vendor/nfc(/.*)? u:object_r:nfc_vendor_data_file:s0 - -/data/misc/radio(/.*)? u:object_r:radio_data_file:s0 - # drm /data/vendor/mediadrm(/.*)? u:object_r:mediadrm_data_file:s0 @@ -52,66 +50,23 @@ /data/camera(/.*)? u:object_r:camera_data_file:s0 #################################### -# sysfs files - -# charger -/sys/devices/battery/power_supply(/.*) u:object_r:sysfs_charger:s0 -/sys/devices/platform/13840000\.i2c/i2c-10/10-003d/s2mu004-charger/power_supply/s2mu004-charger(/.*) u:object_r:sysfs_charger:s0 -/sys/devices/platform/13840000\.i2c/i2c-10/10-003d/s2mu004-charger/power_supply/otg(/.*)? u:object_r:sysfs_charger:s0 -/sys/devices/platform/13840000\.i2c/i2c-10/10-003d/s2mu004-charger/power_supply/s2mu004-charger(/.*)? u:object_r:sysfs_charger:s0 -/sys/devices/platform/13830000\.i2c/i2c-9/9-003b/power_supply/s2mu004-fuelgauge(/.*)? u:object_r:sysfs_charger:s0 -/sys/devices/platform/13840000\.i2c/i2c-10/10-003d/s2mu004-muic/power_supply/muic-manager(/.*)? u:object_r:sysfs_charger:s0 -/sys/devices/platform/13830000\.i2c/i2c-8/8-003b/power_supply/s2mu106-fuelgauge(/.*)? u:object_r:sysfs_charger:s0 -/sys/devices/platform/13830000\.i2c/i2c-8/8-003c/power_supply/s2mu106-usbpd(/.*)? u:object_r:sysfs_charger:s0 -/sys/devices/platform/13840000\.i2c/i2c-9/9-003d/s2mu106-powermeter/power_supply/s2mu106_pmeter(/.*)? u:object_r:sysfs_charger:s0 -/sys/devices/platform/13840000\.i2c/i2c-9/9-003d/s2mu106-muic/power_supply/muic-manager(/.*)? u:object_r:sysfs_charger:s0 -/sys/devices/platform/13840000\.i2c/i2c-9/9-003d/s2mu106-charger/power_supply/otg(/.*)? u:object_r:sysfs_charger:s0 -/sys/devices/platform/13840000\.i2c/i2c-9/9-003d/s2mu106-charger/power_supply/s2mu106-charger(/.*)? u:object_r:sysfs_charger:s0 - -# virtual -/sys/devices/virtual(/.*)? u:object_r:sysfs_virtual:s0 - -# iio -/sys/bus/iio/devices(/.*)? u:object_r:sysfs_iio:s0 - -# Backlight/Notification LED control -/sys/class/backlight/panel/brightness u:object_r:sysfs_graphics:s0 -/sys/class/backlight/panel/max_brightness u:object_r:sysfs_graphics:s0 - -# rild -/sys/devices/virtual/misc/multipdp(/.*) u:object_r:sysfs_multipdp:s0 - -# input -/sys/devices/platform/gpio_keys/input/input12(/.*)? u:object_r:sysfs_input:s0 - -# modem -/sys/module/modem_ctrl_ss310ap/parameters/ds_detect u:object_r:sysfs_modem:s0 - -# gps -/sys/devices/soc0/machine u:object_r:sysfs_sec_gps:s0 -/sys/devices/soc0/revision u:object_r:sysfs_sec_gps:s0 -/dev/gnss_ipc u:object_r:gps_device:s0 - -# bt -/dev/scsc_h4_0 u:object_r:bt_device:s0 - -# ZRAM -/sys/devices/virtual/block/zram0/mm_stat u:object_r:sysfs_zram:s0 +### CACHE +/cache/boot_log.txt u:object_r:boot_logcat_file:s0 ### VENDOR -/(vendor|system/vendor)/lib(64)?/hw/gralloc\.[a-z0-9]*\.so u:object_r:same_process_hal_file:s0 +/(vendor|system/vendor)/lib(64)?/hw/gralloc\.exynos7884B\.so u:object_r:same_process_hal_file:s0 /(vendor|system/vendor)/lib(64)?/libion_exynos\.so u:object_r:same_process_hal_file:s0 - /(vendor|system/vendor)/bin/main_abox u:object_r:abox_exec:s0 /(vendor|system/vendor)/bin/wlbtd u:object_r:wlbtd_exec:s0 /(vendor|system/vendor)/bin/hw/gpsd u:object_r:gpsd_exec:s0 /(vendor|system/vendor)/bin/hw/macloader u:object_r:macloader_exec:s0 /(vendor|system/vendor)/bin/mcDriverDaemon u:object_r:tee_exec:s0 - /(vendor|system/vendor)/bin/hw/android\.hardware\.power@[0-9]\.[0-9]-service\.universal7884B u:object_r:hal_power_default_exec:s0 +/(vendor|system/vendor)/bin/hw/android\.hardware\.power\.stats@[0-9]\.[0-9]-service\.mock u:object_r:hal_power_stats_default_exec:s0 /(vendor|system/vendor)/bin/hw/android\.hardware\.vibrator@[0-9]\.[0-9]-service\.samsung u:object_r:hal_vibrator_default_exec:s0 /(vendor|system/vendor)/bin/hw/android\.hardware\.drm@[0-9]\.[0-9]-service\.clearkey u:object_r:hal_drm_clearkey_exec:s0 /(vendor|system/vendor)/bin/hw/android\.hardware\.drm@[0-9]\.[0-9]-service\.widevine u:object_r:hal_drm_widevine_exec:s0 /(vendor|system/vendor)/bin/hw/android\.hardware\.keymaster@[0-9]\.[0-9]-service\.samsung u:object_r:hal_keymaster_default_exec:s0 /(vendor|system/vendor)/bin/hw/android\.hardware\.nfc@[0-9]\.[0-9]-service\.samsung u:object_r:hal_nfc_default_exec:s0 +/(vendor|system/vendor)/bin/hw/android\.hardware\.usb@[0-9]\.[0-9]-service\.exynos7884B u:object_r:hal_usb_default_exec:s0 /(vendor|system/vendor)/bin/hw/vendor\.samsung\.hardware\.gnss@[0-9]\.[0-9]-service u:object_r:hal_gnss_default_exec:s0 diff --git a/universal7885-common/sepolicy/vendor/genfs_contexts b/universal7885-common/sepolicy/vendor/genfs_contexts index 2c36b5e..c983a13 100644 --- a/universal7885-common/sepolicy/vendor/genfs_contexts +++ b/universal7885-common/sepolicy/vendor/genfs_contexts @@ -14,16 +14,44 @@ genfscon proc /sys/vm/swappiness u:object_r:proc_swapiness:s0 # SYSFS # class -genfscon sysfs /class/video4linux u:object_r:sysfs_v4l:s0 -genfscon sysfs /class/input/input1 u:object_r:sysfs_input:s0 +genfscon sysfs /class/video4linux u:object_r:sysfs_v4l:s0 +genfscon sysfs /class/input/input1 u:object_r:sysfs_input:s0 +genfscon sysfs /class/backlight/panel/brightness u:object_r:sysfs_graphics:s0 +genfscon sysfs /class/backlight/panel/max_brightness u:object_r:sysfs_graphics:s0 + +# battery +genfscon sysfs /class/power_supply/battery/ u:object_r:sysfs_battery_info:s0 # devices +genfscon sysfs /devices/virtual u:object_r:sysfs_virtual:s0 +genfscon sysfs /devices/virtual/misc/multipdp u:object_r:sysfs_multipdp:s0 +genfscon sysfs /devices/virtual/sensors/sensor_dev/flush u:object_r:sysfs_sensor_writable:s0 +genfscon sysfs /devices/virtual/input/input2/enable u:object_r:sysfs_input_writable:s0 +genfscon sysfs /devices/virtual/input/input3/enable u:object_r:sysfs_input_writable:s0 +genfscon sysfs /devices/virtual/input/input4/enable u:object_r:sysfs_input_writable:s0 +genfscon sysfs /devices/virtual/input/input5/enable u:object_r:sysfs_input_writable:s0 +genfscon sysfs /devices/virtual/input/input6/enable u:object_r:sysfs_input_writable:s0 +genfscon sysfs /devices/virtual/input/input7/enable u:object_r:sysfs_input_writable:s0 +genfscon sysfs /devices/virtual/input/input8/enable u:object_r:sysfs_input_writable:s0 +genfscon sysfs /devices/virtual/input/input9/enable u:object_r:sysfs_input_writable:s0 +genfscon sysfs /devices/virtual/input/input10/enable u:object_r:sysfs_input_writable:s0 +genfscon sysfs /devices/virtual/input/input2/poll_delay u:object_r:sysfs_input_writable:s0 +genfscon sysfs /devices/virtual/input/input3/poll_delay u:object_r:sysfs_input_writable:s0 +genfscon sysfs /devices/virtual/input/input8/poll_delay u:object_r:sysfs_input_writable:s0 +genfscon sysfs /devices/platform/gpio_keys/input/input12 u:object_r:sysfs_input:s0 +genfscon sysfs /devices/platform/flip_cover/input/input13 u:object_r:sysfs_input:s0 genfscon sysfs /devices/platform/10000.mif_pdata/sim/ds_detect u:object_r:sysfs_sim_writable:s0 -genfscon sysfs /module/scsc_bt/parameters/bluetooth_address u:object_r:sysfs_bt_writable:s0 -genfscon sysfs /devices/platform/11ce0000.speedy/i2c-7/7-0000/s2mpu08-rtc/rtc u:object_r:sysfs_rtc:s0 +# A20e RTC +genfscon sysfs /devices/platform/11ce0000.speedy/i2c-5/5-0000/s2mpu08-rtc/rtc u:object_r:sysfs_rtc:s0 +# A20 RTC genfscon sysfs /devices/platform/11ce0000.speedy/i2c-6/6-0000/s2mpu08-rtc/rtc u:object_r:sysfs_rtc:s0 -genfscon sysfs /devices/platform/11ce0000.speedy/i2c-7/7-0003/input/input11 u:object_r:sysfs_touchscreen_writable:s0 -genfscon sysfs /devices/platform/13930000.hsi2c/i2c-5/5-0048/input/ u:object_r:sysfs_touchscreen_writable:s0 + +# A20e Display +genfscon sysfs /devices/platform/13870000.i2c/i2c-11/11-0048/input/ u:object_r:sysfs_touchscreen_writable:s0 +genfscon sysfs /devices/platform/11ce0000.speedy/i2c-5/5-0003/input/input11 u:object_r:sysfs_touchscreen_writable:s0 +# A20 Display +genfscon sysfs /devices/platform/13870000.i2c/i2c-11/11-0020/input/ u:object_r:sysfs_touchscreen_writable:s0 + genfscon sysfs /devices/platform/14870000.dsim/backlight/panel u:object_r:sysfs_graphics:s0 genfscon sysfs /devices/platform/14a50000.abox/service u:object_r:sysfs_abox_writable:s0 genfscon sysfs /devices/platform/14860000.decon_f u:object_r:sysfs_decon:s0 @@ -33,6 +61,11 @@ genfscon sysfs /devices/platform/14400000.fimc_is_sensor/video4linux genfscon sysfs /devices/platform/14440000.fimc_is/video4linux u:object_r:sysfs_v4l_fimc:s0 genfscon sysfs /devices/platform/12c30000.mfc0/video4linux u:object_r:sysfs_v4l_mfc:s0 genfscon sysfs /devices/platform/12c00000.smfc/video4linux u:object_r:sysfs_v4l_smfc:s0 +genfscon sysfs /devices/soc0/soc_id u:object_r:sysfs_socinfo:s0 +genfscon sysfs /devices/soc0/machine u:object_r:sysfs_sec_gps:s0 +genfscon sysfs /devices/soc0/revision u:object_r:sysfs_sec_gps:s0 +genfscon sysfs /devices/virtual/block/zram0/mm_stat u:object_r:sysfs_zram:s0 +genfscon sysfs /devices/system/chip-id/revision u:object_r:sysfs_ss_writable:s0 genfscon sysfs /devices/platform/battery/power_supply/battery u:object_r:sysfs_battery_writable:s0 genfscon sysfs /devices/platform/battery/power_supply/battery/batt_capacity_max u:object_r:sysfs_battery_writable:s0 genfscon sysfs /devices/platform/battery/power_supply/battery/status u:object_r:sysfs_battery_writable:s0 @@ -42,17 +75,29 @@ genfscon sysfs /devices/platform/battery/power_supply/wireless/type genfscon sysfs /devices/platform/battery/power_supply/ps/type u:object_r:sysfs_battery_writable:s0 genfscon sysfs /devices/platform/battery/power_supply/ps/status u:object_r:sysfs_battery_writable:s0 -genfscon sysfs /devices/soc0/soc_id u:object_r:sysfs_socinfo:s0 -genfscon sysfs /devices/system/chip-id/revision u:object_r:sysfs_ss_writable:s0 +# S2MU005 CHARGER (A10) +genfscon sysfs /devices/platform/13840000.i2c/i2c-9/9-003d/s2mu004-charger/power_supply/s2mu004-charger u:object_r:sysfs_charger:s0 +genfscon sysfs /devices/platform/13840000.i2c/i2c-9/9-003d/s2mu004-muic/power_supply/muic-manager u:object_r:sysfs_charger:s0 -genfscon sysfs /devices/virtual/android_usb/android0 u:object_r:sysfs_android_usb:s0 -genfscon sysfs /devices/virtual/camera u:object_r:sysfs_camera:s0 -genfscon sysfs /devices/virtual/camera/rear/fw_update u:object_r:sysfs_camera_writable:s0 -genfscon sysfs /devices/virtual/camera/rear/ssrm_camera_info u:object_r:sysfs_camera_writable:s0 -genfscon sysfs /devices/virtual/camera/flash/rear_flash u:object_r:sysfs_camera_writable:s0 +# S2MU106 CHARGER (A20e) +genfscon sysfs /devices/platform/13840000.i2c/i2c-8/8-003d/s2mu106-powermeter/power_supply/s2mu106_pmeter u:object_r:sysfs_charger:s0 +genfscon sysfs /devices/platform/13840000.i2c/i2c-8/8-003d/s2mu106-muic/power_supply/muic-manager u:object_r:sysfs_charger:s0 +genfscon sysfs /devices/platform/13840000.i2c/i2c-8/8-003d/s2mu106-charger/power_supply/otg u:object_r:sysfs_charger:s0 +genfscon sysfs /devices/platform/13840000.i2c/i2c-8/8-003d/s2mu106-charger/power_supply/s2mu106-charger u:object_r:sysfs_charger:s0 +genfscon sysfs /devices/platform/13830000.i2c/i2c-7/7-003c/power_supply/s2mu106-usbpd/type u:object_r:sysfs_charger:s0 +genfscon sysfs /devices/platform/13830000.i2c/i2c-7/7-003b/power_supply/s2mu106-fuelgauge/type u:object_r:sysfs_fuelgauge:s0 -genfscon sysfs /firmware/devicetree/base/model_info-system_rev u:object_r:sysfs_info:s0 +# S2MU106 CHARGER (A20) +genfscon sysfs /devices/platform/13840000.i2c/i2c-9/9-003d/s2mu106-powermeter/power_supply/s2mu106_pmeter u:object_r:sysfs_charger:s0 +genfscon sysfs /devices/platform/13840000.i2c/i2c-9/9-003d/s2mu106-muic/power_supply/muic-manager u:object_r:sysfs_charger:s0 +genfscon sysfs /devices/platform/13840000.i2c/i2c-9/9-003d/s2mu106-charger/power_supply/otg u:object_r:sysfs_charger:s0 +genfscon sysfs /devices/platform/13840000.i2c/i2c-9/9-003d/s2mu106-charger/power_supply/s2mu106-charger u:object_r:sysfs_charger:s0 +genfscon sysfs /devices/platform/13830000.i2c/i2c-8/8-003b/power_supply/s2mu106-fuelgauge/ u:object_r:sysfs_fuelgauge:s0 -genfscon sysfs /kernel/gpu/ u:object_r:sysfs_gpu:s0 -genfscon sysfs /kernel/gpu/gpu_max_clock u:object_r:sysfs_gpu_writable:s0 -genfscon sysfs /kernel/gpu/gpu_min_clock u:object_r:sysfs_gpu_writable:s0 +genfscon sysfs /class/input/input1/enabled u:object_r:sysfs_sec_touchscreen:s0 +genfscon sysfs /module/modem_ctrl_ss310ap/parameters/ds_detect u:object_r:sysfs_modem:s0 +genfscon sysfs /module/scsc_bt/parameters/bluetooth_address u:object_r:sysfs_bt_writable:s0 +genfscon sysfs /firmware/devicetree/base/model_info-system_rev u:object_r:sysfs_info:s0 +genfscon sysfs /kernel/gpu/ u:object_r:sysfs_gpu:s0 +genfscon sysfs /kernel/gpu/gpu_max_clock u:object_r:sysfs_gpu_writable:s0 +genfscon sysfs /kernel/gpu/gpu_min_clock u:object_r:sysfs_gpu_writable:s0 diff --git a/universal7885-common/sepolicy/vendor/gpsd.te b/universal7885-common/sepolicy/vendor/gpsd.te index f04ffac..b2a5c45 100644 --- a/universal7885-common/sepolicy/vendor/gpsd.te +++ b/universal7885-common/sepolicy/vendor/gpsd.te @@ -1,4 +1,4 @@ -r_dir_file(gpsd, sysfs_sec_gps); +r_dir_file(gpsd, sysfs_sec_gps) allow gpsd sysfs_gps_writable:file rw_file_perms; allow gpsd sysfs_wake_lock:file rw_file_perms; @@ -10,3 +10,5 @@ allow gpsd bt_device:chr_file rw_file_perms; allow gpsd gps_device:chr_file rw_file_perms; allow gpsd gpsd_exec:file execute_no_trans; + +allow gpsd bootanim_system_prop:file { read open getattr }; diff --git a/universal7885-common/sepolicy/vendor/hal_camera_default.te b/universal7885-common/sepolicy/vendor/hal_camera_default.te index 274d1e8..c9dfc13 100644 --- a/universal7885-common/sepolicy/vendor/hal_camera_default.te +++ b/universal7885-common/sepolicy/vendor/hal_camera_default.te @@ -7,8 +7,14 @@ allow hal_camera_default sysfs_virtual:dir search; allow hal_camera_default sysfs_virtual:file rw_file_perms; allow hal_camera_default sysfs_camera:dir search; allow hal_camera_default sysfs_camera:file rw_file_perms; +allow hal_camera_default sysfs_battery:dir search; +allow hal_camera_default sysfs_battery_writable:dir search; +allow hal_camera_default sysfs_battery_writable:file r_file_perms; get_prop(hal_camera_default, exported_camera_prop) binder_call(hal_camera_default, system_server) binder_call(system_server, hal_camera_default) + +r_dir_file(hal_camera_default, sysfs_decon) +set_prop(hal_camera_default, camera_prop) diff --git a/universal7885-common/sepolicy/vendor/hal_graphics_composer_default.te b/universal7885-common/sepolicy/vendor/hal_graphics_composer_default.te index 762ade8..8986d4c 100644 --- a/universal7885-common/sepolicy/vendor/hal_graphics_composer_default.te +++ b/universal7885-common/sepolicy/vendor/hal_graphics_composer_default.te @@ -1,11 +1,9 @@ -hal_client_domain(hal_graphics_composer_default, hal_graphics_allocator); +hal_client_domain(hal_graphics_composer_default, hal_graphics_allocator) vndbinder_use(hal_graphics_composer_default) allow hal_graphics_composer_default self:netlink_kobject_uevent_socket create_socket_perms_no_ioctl; -allow hal_graphics_composer_default vendor_surfaceflinger_vndservice:service_manager { add find }; - # cgroup tasks allow hal_graphics_composer_default cgroup:file getattr; diff --git a/universal7885-common/sepolicy/vendor/hal_health_default.te b/universal7885-common/sepolicy/vendor/hal_health_default.te index 65859ee..e8fad42 100644 --- a/universal7885-common/sepolicy/vendor/hal_health_default.te +++ b/universal7885-common/sepolicy/vendor/hal_health_default.te @@ -5,3 +5,4 @@ allow hal_health_default sysfs_battery:dir r_dir_perms; allow hal_health_default sysfs_battery:file r_file_perms; allow hal_health_default sysfs_battery_writable:dir search; allow hal_health_default sysfs_battery_writable:file r_file_perms; +allow hal_health_default sysfs_fuelgauge:file r_file_perms; diff --git a/universal7885-common/sepolicy/vendor/hal_keymaster_default.te b/universal7885-common/sepolicy/vendor/hal_keymaster_default.te new file mode 100644 index 0000000..31462c9 --- /dev/null +++ b/universal7885-common/sepolicy/vendor/hal_keymaster_default.te @@ -0,0 +1 @@ +allow hal_keymaster_default prov_efs_file r_file_perms; \ No newline at end of file diff --git a/universal7885-common/sepolicy/vendor/hal_lineage_fastcharge_default.te b/universal7885-common/sepolicy/vendor/hal_lineage_fastcharge_default.te deleted file mode 100644 index 31fc983..0000000 --- a/universal7885-common/sepolicy/vendor/hal_lineage_fastcharge_default.te +++ /dev/null @@ -1,2 +0,0 @@ -allow hal_lineage_fastcharge_default sysfs_virtual:dir search; -allow hal_lineage_fastcharge_default sysfs_virtual:file rw_file_perms; diff --git a/universal7885-common/sepolicy/vendor/hal_lineage_touch_default.te b/universal7885-common/sepolicy/vendor/hal_lineage_touch_default.te deleted file mode 100644 index 8d63eb2..0000000 --- a/universal7885-common/sepolicy/vendor/hal_lineage_touch_default.te +++ /dev/null @@ -1,2 +0,0 @@ -allow hal_lineage_touch_default sysfs_virtual:dir search; -allow hal_lineage_touch_default sysfs_virtual:file rw_file_perms; diff --git a/universal7885-common/sepolicy/vendor/hal_nfc_default.te b/universal7885-common/sepolicy/vendor/hal_nfc_default.te index fde8ff2..67bc424 100644 --- a/universal7885-common/sepolicy/vendor/hal_nfc_default.te +++ b/universal7885-common/sepolicy/vendor/hal_nfc_default.te @@ -1,4 +1,3 @@ allow hal_nfc_default nfc_vendor_data_file:dir w_dir_perms; allow hal_nfc_default nfc_vendor_data_file:file create_file_perms; - set_prop(hal_nfc_default, vendor_nfc_prop) diff --git a/universal7885-common/sepolicy/vendor/hal_power_default.te b/universal7885-common/sepolicy/vendor/hal_power_default.te index 76145fc..d84b692 100644 --- a/universal7885-common/sepolicy/vendor/hal_power_default.te +++ b/universal7885-common/sepolicy/vendor/hal_power_default.te @@ -4,3 +4,6 @@ allow hal_power_default sysfs_input:file r_file_perms; allow hal_power_default sysfs_virtual:dir r_dir_perms; allow hal_power_default sysfs_virtual:file r_file_perms; allow hal_power_default sysfs_touchscreen_writable:dir r_dir_perms; +allow hal_power_default sysfs_sec_touchscreen:dir read; +type hal_lineage_power_hwservice, hwservice_manager_type; +add_hwservice(hal_power_default, hal_power_hwservice) diff --git a/universal7885-common/sepolicy/vendor/hal_power_stats_default.te b/universal7885-common/sepolicy/vendor/hal_power_stats_default.te new file mode 100644 index 0000000..4218be1 --- /dev/null +++ b/universal7885-common/sepolicy/vendor/hal_power_stats_default.te @@ -0,0 +1,2 @@ +allow hal_power_stats_default sysfs_iio:dir r_dir_perms; +allow hal_power_stats_default sysfs_iio:file r_file_perms; diff --git a/universal7885-common/sepolicy/vendor/hal_sensors_default.te b/universal7885-common/sepolicy/vendor/hal_sensors_default.te index c732d71..01d5b5a 100644 --- a/universal7885-common/sepolicy/vendor/hal_sensors_default.te +++ b/universal7885-common/sepolicy/vendor/hal_sensors_default.te @@ -4,7 +4,10 @@ allow hal_sensors_default sysfs_virtual:dir r_dir_perms; allow hal_sensors_default sysfs_virtual:file rw_file_perms; allow hal_sensors_default sysfs_virtual:lnk_file read; allow hal_sensors_default baro_delta_factoryapp_efs_file:file r_file_perms; -allow hal_sensors_default sysfs_input:file read; +allow hal_sensors_default sysfs_input:file r_file_perms; +allow hal_sensors_default sysfs_input_writable:file rw_file_perms; +allow hal_sensors_default sysfs_input:dir r_dir_perms; +allow hal_sensors_default sysfs_sensor_writable:file rw_file_perms; allow hal_sensors_default sysfs_spi_writeable:file rw_file_perms; # yas_lib diff --git a/universal7885-common/sepolicy/vendor/hal_wifi_default.te b/universal7885-common/sepolicy/vendor/hal_wifi_default.te index 8a7493c..7f22e8e 100644 --- a/universal7885-common/sepolicy/vendor/hal_wifi_default.te +++ b/universal7885-common/sepolicy/vendor/hal_wifi_default.te @@ -1,4 +1,4 @@ -set_prop(hal_wifi_default, vendor_wlan_prop); +set_prop(hal_wifi_default, vendor_wlan_prop) get_prop(hal_wifi_default, vendor_wifi_prop) allow hal_wifi_default conn_vendor_data_file:dir search; diff --git a/universal7885-common/sepolicy/vendor/hwservice.te b/universal7885-common/sepolicy/vendor/hwservice.te index 699ccce..53ac5a0 100644 --- a/universal7885-common/sepolicy/vendor/hwservice.te +++ b/universal7885-common/sepolicy/vendor/hwservice.te @@ -1,3 +1 @@ -type hal_sec_radio_hwservice, hwservice_manager_type; -type hal_sec_radio_bridge_hwservice, hwservice_manager_type; -type hal_sec_radio_channel_hwservice, hwservice_manager_type; +type rild_hwservice, hwservice_manager_type; diff --git a/universal7885-common/sepolicy/vendor/hwservice_contexts b/universal7885-common/sepolicy/vendor/hwservice_contexts index 523b607..f575dbe 100644 --- a/universal7885-common/sepolicy/vendor/hwservice_contexts +++ b/universal7885-common/sepolicy/vendor/hwservice_contexts @@ -1,4 +1,6 @@ vendor.samsung.hardware.gnss::ISehGnss u:object_r:hal_gnss_hwservice:s0 -vendor.samsung.hardware.radio::ISehRadio u:object_r:hal_sec_radio_hwservice:s0 -vendor.samsung.hardware.radio.bridge::ISehBridge u:object_r:hal_sec_radio_bridge_hwservice:s0 -vendor.samsung.hardware.radio.channel::ISehChannel u:object_r:hal_sec_radio_channel_hwservice:s0 +vendor.samsung.hardware.radio::ISehRadio u:object_r:rild_hwservice:s0 +vendor.samsung.hardware.radio.bridge::ISehBridge u:object_r:rild_hwservice:s0 +vendor.samsung.hardware.radio.channel::ISehChannel u:object_r:rild_hwservice:s0 +vendor.lineage.power::ILineagePower u:object_r:hal_power_hwservice:s0 + diff --git a/universal7885-common/sepolicy/vendor/init.te b/universal7885-common/sepolicy/vendor/init.te index fbd0b42..c737257 100644 --- a/universal7885-common/sepolicy/vendor/init.te +++ b/universal7885-common/sepolicy/vendor/init.te @@ -37,6 +37,12 @@ allow init gps_vendor_data_file:file lock; allow init socket_device:sock_file create_file_perms; allow init kernel:system module_request; +allow init logd:unix_stream_socket connectto; +allow init logdr_socket:sock_file write; +allow init self:capability sys_nice; +allow init boot_logcat_file:file rw_file_perms; +allow init logcat_exec:file { execute getattr open read }; + allow init proc:file setattr; allow init proc_swapiness:file write; allow init proc_extra:file setattr; diff --git a/universal7885-common/sepolicy/vendor/kernel.te b/universal7885-common/sepolicy/vendor/kernel.te index 29d0781..90c0d90 100644 --- a/universal7885-common/sepolicy/vendor/kernel.te +++ b/universal7885-common/sepolicy/vendor/kernel.te @@ -9,4 +9,5 @@ allow kernel self:capability { sys_rawio mknod }; allow kernel block_device:dir search; +allow kernel sysfs_sec_key:dir search; r_dir_file(kernel, sysfs_virtual) diff --git a/universal7885-common/sepolicy/vendor/mediacodec.te b/universal7885-common/sepolicy/vendor/mediacodec.te index ec2a674..9bd5632 100644 --- a/universal7885-common/sepolicy/vendor/mediacodec.te +++ b/universal7885-common/sepolicy/vendor/mediacodec.te @@ -3,4 +3,4 @@ allow mediacodec sysfs_v4l:dir r_dir_perms; allow mediacodec sysfs_v4l_mfc:dir search; allow mediacodec sysfs_v4l_mfc:file r_file_perms; -hal_client_domain(mediacodec, hal_power); +hal_client_domain(mediacodec, hal_power) diff --git a/universal7885-common/sepolicy/vendor/mediaserver.te b/universal7885-common/sepolicy/vendor/mediaserver.te new file mode 100644 index 0000000..7f99b54 --- /dev/null +++ b/universal7885-common/sepolicy/vendor/mediaserver.te @@ -0,0 +1 @@ +get_prop(mediaserver, exported_camera_prop) diff --git a/universal7885-common/sepolicy/vendor/priv_app.te b/universal7885-common/sepolicy/vendor/priv_app.te index 85dbf18..d37cf17 100644 --- a/universal7885-common/sepolicy/vendor/priv_app.te +++ b/universal7885-common/sepolicy/vendor/priv_app.te @@ -6,3 +6,5 @@ allow priv_app debugfs_mali:dir search; allow priv_app debugfs_mali_mem:dir search; allow priv_app sysfs_zram:file r_file_perms; + +#get_prop(priv_app, vendor_default_prop) diff --git a/universal7885-common/sepolicy/vendor/property.te b/universal7885-common/sepolicy/vendor/property.te index a6d0375..4ed6c15 100644 --- a/universal7885-common/sepolicy/vendor/property.te +++ b/universal7885-common/sepolicy/vendor/property.te @@ -1,5 +1,6 @@ # modemloader type modemloader_prop, property_type; +type camera_prop, property_type; type persist_rmnet_prop, property_type; type persist_data_df_prop, property_type; diff --git a/universal7885-common/sepolicy/vendor/property_contexts b/universal7885-common/sepolicy/vendor/property_contexts index 3069d08..83c1393 100644 --- a/universal7885-common/sepolicy/vendor/property_contexts +++ b/universal7885-common/sepolicy/vendor/property_contexts @@ -14,6 +14,7 @@ persist.data.df. u:object_r:persist_data_df_prop:s0 persist.data.wda. u:object_r:persist_data_wda_prop:s0 # CAMERA +persist.sys.camera. u:object_r:camera_prop:s0 persist.vendor.sys.camera. u:object_r:vendor_camera_prop:s0 # GPS diff --git a/universal7885-common/sepolicy/vendor/rild.te b/universal7885-common/sepolicy/vendor/rild.te index 250b090..0c258e0 100644 --- a/universal7885-common/sepolicy/vendor/rild.te +++ b/universal7885-common/sepolicy/vendor/rild.te @@ -5,6 +5,7 @@ allow rild vendor_data_file:file create_file_perms; allow rild radio_device:chr_file ioctl; allow rild bin_nv_data_efs_file:file create_file_perms; +dontaudit rild bin_nv_data_efs_file:file ioctl; allow rild radio_vendor_data_file:file create_file_perms; allow rild radio_vendor_data_file:dir rw_dir_perms; @@ -23,6 +24,6 @@ allow rild hal_audio_default:dir search; allow rild hal_audio_default:file r_file_perms; # hwservice -add_hwservice(rild, hal_sec_radio_hwservice) -add_hwservice(rild, hal_sec_radio_bridge_hwservice) -add_hwservice(rild, hal_sec_radio_channel_hwservice) +add_hwservice(rild, rild_hwservice) + + diff --git a/universal7885-common/sepolicy/vendor/secril_config_svc.te b/universal7885-common/sepolicy/vendor/secril_config_svc.te index 0b354f6..99da270 100644 --- a/universal7885-common/sepolicy/vendor/secril_config_svc.te +++ b/universal7885-common/sepolicy/vendor/secril_config_svc.te @@ -1 +1 @@ -dontaudit secril_config_svc exported3_radio_prop:property_service set; +dontaudit secril_config_svc radio_control_prop:property_service set; diff --git a/universal7885-common/sepolicy/vendor/system_app.te b/universal7885-common/sepolicy/vendor/system_app.te index 373b1cc..90cfb9b 100644 --- a/universal7885-common/sepolicy/vendor/system_app.te +++ b/universal7885-common/sepolicy/vendor/system_app.te @@ -3,3 +3,10 @@ allow system_app gpu_device:chr_file rw_file_perms; allow system_app proc_pagetypeinfo:file r_file_perms; allow system_app sysfs_virtual:dir search; + +# battery sysfs + +allow system_app sysfs_battery_info:dir { search }; +allow system_app sysfs_battery_info:file { read open getattr }; + +r_dir_file(system_app, sysfs_battery_info) diff --git a/universal7885-common/sepolicy/vendor/system_server.te b/universal7885-common/sepolicy/vendor/system_server.te index 9577018..754fd4c 100644 --- a/universal7885-common/sepolicy/vendor/system_server.te +++ b/universal7885-common/sepolicy/vendor/system_server.te @@ -11,11 +11,14 @@ allow system_server frp_block_device:blk_file rw_file_perms; allow system_server sysfs_rtc:file r_file_perms; +allow system_server sysfs_battery_writable:dir r_dir_perms; +allow system_server sysfs_battery_writable:file rw_file_perms; + get_prop(system_server, vendor_radio_prop) r_dir_file(system_server, sysfs_virtual) -get_prop(system_server, exported_camera_prop); +get_prop(system_server, exported_camera_prop) get_prop(system_server, userspace_reboot_config_prop) get_prop(system_server, userspace_reboot_exported_prop) diff --git a/universal7885-common/sepolicy/vendor/tzdaemon.te b/universal7885-common/sepolicy/vendor/tzdaemon.te new file mode 100644 index 0000000..548349c --- /dev/null +++ b/universal7885-common/sepolicy/vendor/tzdaemon.te @@ -0,0 +1,4 @@ +allow tzdaemon mnt_vendor_file:dir rw_dir_perms; +allow tzdaemon efs_file:dir search; +allow tzdaemon tee_efs_file:dir { add_name remove_name open create read search write }; +allow tzdaemon tee_efs_file:file { getattr open create read rename unlink write }; diff --git a/universal7885-common/sepolicy/vendor/vendor_init.te b/universal7885-common/sepolicy/vendor/vendor_init.te index 6fc9b37..e06ce92 100644 --- a/universal7885-common/sepolicy/vendor/vendor_init.te +++ b/universal7885-common/sepolicy/vendor/vendor_init.te @@ -10,3 +10,10 @@ allow vendor_init wifi_data_file:dir search; allow vendor_init system_data_file:dir create_dir_perms; # mkdir /data/camera/* allow vendor_init camera_data_file:dir create_dir_perms; +allow vendor_init cache_file:dir { remove_name write }; +allow vendor_init boot_logcat_file:file unlink; +set_prop(vendor_init, persist_data_df_prop) +set_prop(vendor_init, persist_data_wda_prop) +set_prop(vendor_init, persist_rmnet_prop) +get_prop(vendor_init, system_prop) + diff --git a/universal7885-common/sepolicy/vendor/wlbtd.te b/universal7885-common/sepolicy/vendor/wlbtd.te index e0d0a45..8d202fb 100644 --- a/universal7885-common/sepolicy/vendor/wlbtd.te +++ b/universal7885-common/sepolicy/vendor/wlbtd.te @@ -1,7 +1,7 @@ type wlbtd, domain; type wlbtd_exec, exec_type, vendor_file_type, file_type; -init_daemon_domain(wlbtd); +init_daemon_domain(wlbtd) allow wlbtd conn_vendor_data_file:dir search; allow wlbtd conn_vendor_data_file:file rw_file_perms; @@ -9,7 +9,7 @@ allow wlbtd self:netlink_generic_socket { create setopt bind getattr read write allow wlbtd init:unix_stream_socket connectto; -r_dir_file(wlbtd, sysfs_wifi); +r_dir_file(wlbtd, sysfs_wifi) allow wlbtd sysfs_wifi_writable:file rw_file_perms; -set_prop(wlbtd, vendor_wlbtd_prop); +set_prop(wlbtd, vendor_wlbtd_prop) diff --git a/universal7885-common/sepolicy/vendor/zygote.te b/universal7885-common/sepolicy/vendor/zygote.te index 05134ce..e852beb 100644 --- a/universal7885-common/sepolicy/vendor/zygote.te +++ b/universal7885-common/sepolicy/vendor/zygote.te @@ -1,3 +1,3 @@ -get_prop(zygote, exported_camera_prop); +get_prop(zygote, exported_camera_prop) allow zygote proc_cmdline:file r_file_perms;