universal7885: Adapt SELinux rules to match our A20/A20e's needs

* Additionally, adapt LineageOS's rules too

Change-Id: Ie253afd9052c700705861d618253445ef4b8c728
Signed-off-by: roynatech2544 <whiteshell2544@naver.com>

universal7885-common/sepolicy/samsung_slsi/private/file_contexts

@@ -0,0 +1,4 @@
+# file_contexts
+
+### DATA
+/data/zram(/.*)?                             u:object_r:zram_data_file:s0

universal7885-common/sepolicy/samsung_slsi/private/property_contexts

@@ -0,0 +1,35 @@
+### BLUETOOTH
+sys.bluetooth.tty                            u:object_r:exported_bluetooth_prop:s0
+
+### BUILD
+#ro.build.PDA                                 u:object_r:exported2_default_prop:s0
+
+### CAMERA
+system.camera.CC.                            u:object_r:exported_camera_prop:s0
+service.camera.                              u:object_r:exported_camera_prop:s0
+sys.cameramode.                              u:object_r:exported_camera_prop:s0
+ro.camera.req.fmq.size                       u:object_r:exported_camera_prop:s0
+ro.camera.res.fmq.size                       u:object_r:exported_camera_prop:s0
+
+### GFX
+#ro.gfx.driver.1                              u:object_r:exported3_default_prop:s0 exact string
+
+### CSC
+ro.csc.                                      u:object_r:exported_config_prop:s0
+
+### MDC
+mdc.                                         u:object_r:exported_config_prop:s0
+
+### OMC
+persist.sys.omc_support                      u:object_r:exported_config_prop:s0
+persist.sys.omc_etcpath                      u:object_r:exported_config_prop:s0
+ro.omc.                                      u:object_r:exported_config_prop:s0
+
+### RADIO
+ril.NwNmId                                   u:object_r:telephony_config_prop:s0
+ril.NwNmId2                                  u:object_r:telephony_config_prop:s0
+ro.boot.cpboot                               u:object_r:telephony_config_prop:s0
+ro.simbased.changetype                       u:object_r:exported_config_prop:s0
+
+### RFKILL
+ro.rfkilldisabled                            u:object_r:rfkilldisabled_prop:s0

universal7885-common/sepolicy/samsung_slsi/public/attributes

@@ -0,0 +1,8 @@
+# Tag for read only filesystem type
+attribute r_fs_type;
+
+# Tag for read/write filesystem type
+attribute rw_fs_type;
+
+# Tag for read/execute filesystem type
+attribute rx_fs_type;

universal7885-common/sepolicy/samsung_slsi/public/domain.te

@@ -0,0 +1,4 @@
+# domain.te
+
+# Make sure that labels are used correctly
+neverallow { domain -vendor_init -ueventd } r_fs_type:file write;

universal7885-common/sepolicy/samsung_slsi/public/file.te

@@ -0,0 +1,4 @@
+# file.te
+
+### DATA
+type zram_data_file, file_type, data_file_type, core_data_file_type;

universal7885-common/sepolicy/samsung_slsi/public/property.te

@@ -0,0 +1,2 @@
+### RFKILL
+type rfkilldisabled_prop, property_type;

universal7885-common/sepolicy/samsung_slsi/tee/public/te_macros

@@ -0,0 +1,8 @@
+# teegris_use(domain)
+#
+# Allow domain to use teegris
+define(`teegris_use', `
+get_prop($1, vendor_tztsdaemon_prop)
+# /dev/tzdev
+allow $1 tz_user_device:chr_file rw_file_perms;
+')

universal7885-common/sepolicy/samsung_slsi/tee/vendor/device.te

@@ -0,0 +1,4 @@
+# device.te
+
+type tz_device, dev_type;
+type tz_user_device, dev_type;

universal7885-common/sepolicy/samsung_slsi/tee/vendor/file.te

@@ -0,0 +1,7 @@
+# file.te
+
+# DATA
+type tee_vendor_data_file, file_type, data_file_type;
+
+# DEV SOCKET
+type tz_socket, file_type;

universal7885-common/sepolicy/samsung_slsi/tee/vendor/file_contexts

@@ -0,0 +1,18 @@
+# file_contexts
+
+# DATA
+/data/vendor/tee(/.*)?                       u:object_r:tee_vendor_data_file:s0
+
+# DEV
+/dev/socket/tz                               u:object_r:tz_socket:s0
+/dev/tuihw                                   u:object_r:tz_device:s0
+/dev/tzdev                                   u:object_r:tz_user_device:s0
+/dev/tzic                                    u:object_r:tz_device:s0
+/dev/tzirs                                   u:object_r:tz_device:s0
+/dev/tziwsock                                u:object_r:tz_user_device:s0
+
+# VENDOR
+/(vendor|system/vendor)/bin/tzdaemon         u:object_r:tzdaemon_exec:s0
+/(vendor|system/vendor)/bin/tzts_daemon      u:object_r:tztsdaemon_exec:s0
+
+/(vendor|system/vendor)/lib(64)?/libteecl\.so    u:object_r:same_process_hal_file:s0

universal7885-common/sepolicy/samsung_slsi/tee/vendor/hal_fingerprint_default.te

@@ -0,0 +1,3 @@
+# hal_fingerprint_default.te
+
+teegris_use(hal_fingerprint_default)

universal7885-common/sepolicy/samsung_slsi/tee/vendor/hal_gatekeeper_default.te

@@ -0,0 +1 @@
+teegris_use(hal_gatekeeper_default)

universal7885-common/sepolicy/samsung_slsi/tee/vendor/hal_keymaster_default.te

@@ -0,0 +1 @@
+teegris_use(hal_keymaster_default)

universal7885-common/sepolicy/samsung_slsi/tee/vendor/property.te

@@ -0,0 +1,4 @@
+# property.te
+type vendor_secureos_prop, property_type;
+type vendor_tzdaemon_prop, property_type;
+type vendor_tztsdaemon_prop, property_type;

universal7885-common/sepolicy/samsung_slsi/tee/vendor/property_contexts

@@ -0,0 +1,6 @@
+# property_contexts
+
+# TEEGRIS
+vendor.secureos.               u:object_r:vendor_secureos_prop:s0
+vendor.tzdaemon                u:object_r:vendor_tzdaemon_prop:s0
+vendor.tzts_daemon             u:object_r:vendor_tztsdaemon_prop:s0

universal7885-common/sepolicy/samsung_slsi/tee/vendor/tzdaemon.te

@@ -0,0 +1,33 @@
+type tzdaemon, domain;
+type tzdaemon_exec, exec_type, vendor_file_type, file_type;
+
+# tzdaemon is started by init, type transit from init domain to tzdaemon domain
+init_daemon_domain(tzdaemon)
+
+set_prop(tzdaemon, vendor_tzdaemon_prop)
+set_prop(tzdaemon, vendor_secureos_prop)
+
+allow tzdaemon tz_device:chr_file rw_file_perms;
+allow tzdaemon tz_user_device:chr_file rw_file_perms;
+allow tzdaemon tz_socket:sock_file { write };
+
+# /dev/kmsg
+allow tzdaemon kmsg_device:chr_file rw_file_perms;
+
+# /data/vendor/tee
+allow tzdaemon tee_vendor_data_file:dir create_dir_perms;
+allow tzdaemon tee_vendor_data_file:file create_file_perms;
+
+# /proc/stat
+allow tzdaemon proc_stat:file r_file_perms;
+
+# /efs
+allow tzdaemon efs_file:dir r_dir_perms;
+
+# /efs/tee/
+# /mnt/vendor/efs/tee/
+allow tzdaemon tee_efs_file:dir create_dir_perms;
+allow tzdaemon tee_efs_file:file create_file_perms;
+
+# /mnt/vendor/
+allow tzdaemon mnt_vendor_file:dir r_dir_perms;

universal7885-common/sepolicy/samsung_slsi/tee/vendor/tztsdaemon.te

@@ -0,0 +1,10 @@
+type tztsdaemon, domain;
+type tztsdaemon_exec, exec_type, vendor_file_type, file_type;
+
+# tztsdaemon is started by init, type transit from init domain to tztsdaemon domain
+init_daemon_domain(tztsdaemon)
+
+set_prop(tztsdaemon, vendor_tztsdaemon_prop)
+
+# /dev/tziwsock
+allow tztsdaemon tz_user_device:chr_file rw_file_perms;

universal7885-common/sepolicy/samsung_slsi/vendor/argosd.te

@@ -0,0 +1,25 @@
+# argosd.te
+
+type argosd, domain;
+type argosd_exec, exec_type, vendor_file_type, file_type;
+
+# argosd is started by init, type transit from init domain to gpsd domain
+init_daemon_domain(argosd)
+
+# /dev/network_throughput
+allow argosd radio_qos_device:chr_file rw_file_perms;
+
+# /proc/net/dev
+allow argosd proc_net:file r_file_perms;
+
+# /sys/
+allow argosd sysfs:dir r_dir_perms;
+
+# /sys/devices/platform/argos
+# /sys/firmware/devicetree/base/argos
+allow argosd sysfs_argos:dir r_dir_perms;
+allow argosd sysfs_argos:file r_file_perms;
+
+# /sys/class/scsi_host/host0
+allow argosd sysfs_scsi_host_writable:dir r_dir_perms;
+allow argosd sysfs_scsi_host_writable:file r_file_perms;

universal7885-common/sepolicy/samsung_slsi/vendor/cbd.te

@@ -0,0 +1,63 @@
+# cbd.te
+
+type cbd, domain;
+type cbd_exec, exec_type, vendor_file_type, file_type;
+
+allow cbd self:capability setuid;
+
+# cbd is started by init, type transit from init domain to cbd domain
+init_daemon_domain(cbd)
+
+# /dev/block/
+allow cbd block_device:dir search;
+
+# /data/vendor/log
+allow cbd log_vendor_data_file:dir search;
+
+# /data/vendor/log/cbd
+allow cbd log_cbd_vendor_data_file:dir create_dir_perms;
+allow cbd log_cbd_vendor_data_file:file create_file_perms;
+
+# /dev/block/platform/.+/by-name/radio
+allow cbd radio_block_device:blk_file r_file_perms;
+
+# /dev/kmsg
+allow cbd kmsg_device:chr_file rw_file_perms;
+
+# /dev/umts_*
+allow cbd vendor_radio_device:chr_file rw_file_perms;
+
+# /mnt/vendor/
+allow cbd mnt_vendor_file:dir search;
+
+# /mnt/vendor/efs/
+allow cbd efs_file:dir r_dir_perms;
+
+# /mnt/vendor/efs/factory.prop
+allow cbd efs_file:file r_file_perms;
+
+# /mnt/vendor/efs/nv_data.bin
+allow cbd bin_nv_data_efs_file:file r_file_perms;
+
+# /proc/cmdline
+allow cbd proc_cmdline:file r_file_perms;
+
+# /sys/power/wake_unlock
+allow cbd sysfs_wake_lock:file rw_file_perms;
+
+# /sys/devices/platform/10000.mif_pdata/sim/
+allow cbd sysfs_sim:dir r_dir_perms;
+allow cbd sysfs_sim:file r_file_perms;
+
+# /sys/devices/platform/10000.mif_pdata/sim/ds_detect
+allow cbd sysfs_sim_writable:file rw_file_perms;
+
+# kernel log
+allow cbd kernel:system syslog_read;
+
+# vendor.cbd.
+set_prop(cbd, vendor_cbd_prop)
+
+# FIXME: Can we be more specific?
+allow cbd vendor_shell_exec:file execute_no_trans;
+# FIXME END

universal7885-common/sepolicy/samsung_slsi/vendor/device.te

@@ -0,0 +1,22 @@
+# device.te
+type efs_block_device, dev_type;
+type dqmdbg_block_device, dev_type;
+type dtbo_block_device, dev_type;
+type keydata_block_device, dev_type;
+type keyrefuge_block_device, dev_type;
+type modem_block_device, dev_type;
+type omr_block_device, dev_type;
+type radio_block_device, dev_type;
+type sec_efs_block_device, dev_type;
+
+type bbd_device, dev_type;
+type bt_device, dev_type;
+type cpu_dma_device, dev_type;
+type drb_device, dev_type;
+type epic_device, dev_type;
+type fp_sensor_device, dev_type;
+type io_device, dev_type;
+type pm_qos_device, dev_type;
+type radio_qos_device, dev_type;
+type ssp_device, dev_type;
+type vendor_radio_device, dev_type;

universal7885-common/sepolicy/samsung_slsi/vendor/epicd.te

@@ -0,0 +1,27 @@
+type epicd, domain;
+type epicd_exec, exec_type, vendor_file_type, file_type;
+
+# epicd is started by init, type transit from init domain to epicd domain
+init_daemon_domain(epicd)
+
+# WTF?
+# execve("/vendor/bin/sh", ["sh", "-c", "getprop ro.hardware"]
+allow epicd vendor_shell_exec:file execute_no_trans;
+
+# WTF?
+# execve("/vendor/bin/getprop", ["getprop", "ro.hardware"]
+allow epicd vendor_toolbox_exec:file execute_no_trans;
+
+# /dev/cluster[0-9]_freq_(max|min)
+# /dev/*_throughput*
+# /dev/gpu_freq_(max|min)
+allow epicd pm_qos_device:chr_file rw_file_perms;
+
+# /dev/socket/
+allow epicd socket_device:dir w_dir_perms;
+
+# /dev/socket/epic
+allow epicd epicd_socket:unix_dgram_socket { read write };
+
+# /dev/mode
+allow epicd epic_device:chr_file rw_file_perms;

universal7885-common/sepolicy/samsung_slsi/vendor/fastbootd.te

@@ -0,0 +1,7 @@
+# fastbootd.te
+
+allow fastbootd {
+    boot_block_device
+    dtbo_block_device
+    recovery_block_device
+}:blk_file rw_file_perms;

universal7885-common/sepolicy/samsung_slsi/vendor/file.te

@@ -0,0 +1,63 @@
+# file.te
+
+### DATA
+type biometrics_vendor_data_file, file_type, data_file_type;
+type conn_vendor_data_file, file_type, data_file_type;
+type gps_vendor_data_file, file_type, data_file_type;
+type log_vendor_data_file, file_type, data_file_type;
+type log_cbd_vendor_data_file, file_type, data_file_type;
+type radio_vendor_data_file, file_type, data_file_type;
+type wifi_vendor_data_file, file_type, data_file_type;
+
+# EFS
+type app_efs_file, file_type;
+type battery_efs_file, file_type;
+type bin_nv_data_efs_file, file_type;
+type cpk_efs_file, file_type;
+type imei_efs_file, file_type;
+type nfc_efs_file, file_type;
+type pfw_efs_file, file_type;
+type prov_efs_file, file_type;
+type sec_efs_file, file_type;
+type tee_efs_file, file_type;
+type wifi_efs_file, file_type;
+
+# PROC
+type proc_last_kmsg, fs_type, proc_type;
+
+# SOCKETS
+type epicd_socket, file_type, data_file_type;
+
+### SYSFS
+type sysfs_argos, sysfs_type, r_fs_type, fs_type;
+type sysfs_battery, sysfs_type, r_fs_type, fs_type;
+type sysfs_bbd, sysfs_type, r_fs_type, fs_type;
+type sysfs_fingerprint, sysfs_type, r_fs_type, fs_type;
+type sysfs_iio, sysfs_type, r_fs_type, fs_type;
+type sysfs_input, sysfs_type, r_fs_type, fs_type;
+type sysfs_sec_gps, sysfs_type, r_fs_type, fs_type;
+type sysfs_sec_key, sysfs_type, r_fs_type, fs_type;
+type sysfs_sec_sensors, sysfs_type, r_fs_type, fs_type;
+type sysfs_sec_switch, sysfs_type, r_fs_type, fs_type;
+type sysfs_sec_touchscreen, sysfs_type, r_fs_type, fs_type;
+type sysfs_sim, sysfs_type, r_fs_type, fs_type;
+type sysfs_sensors, sysfs_type, r_fs_type, fs_type;
+type sysfs_wifi, sysfs_type, r_fs_type, fs_type;
+
+type sysfs_backlight_writable, sysfs_type, rw_fs_type, fs_type;
+type sysfs_battery_writable, sysfs_type, rw_fs_type, fs_type;
+type sysfs_bt_writable, sysfs_type, rw_fs_type, fs_type;
+type sysfs_gps_writable, sysfs_type, rw_fs_type, fs_type;
+type sysfs_lcd_writable, sysfs_type, rw_fs_type, fs_type;
+type sysfs_power_writable, sysfs_type, rw_fs_type, fs_type;
+type sysfs_scsi_host_writable, sysfs_type, rw_fs_type, fs_type;
+type sysfs_sensorhub_writable, sysfs_type, rw_fs_type, fs_type;
+type sysfs_sensors_writable, sysfs_type, rw_fs_type, fs_type;
+type sysfs_sim_writable, sysfs_type, rw_fs_type, fs_type;
+type sysfs_spi_writeable, sysfs_type, rw_fs_type, fs_type;
+type sysfs_sec_switch_writable, sysfs_type, rw_fs_type, fs_type;
+type sysfs_touchscreen_writable, sysfs_type, rw_fs_type, fs_type;
+type sysfs_wifi_writable, sysfs_type, rw_fs_type, fs_type;
+
+### VENDOR
+type vendor_firmware_file, file_type, vendor_file_type;

universal7885-common/sepolicy/samsung_slsi/vendor/file_contexts

@@ -0,0 +1,126 @@
+# file_contexts
+
+### DATA
+/data/vendor/biometrics(/.*)?                u:object_r:biometrics_vendor_data_file:s0
+/data/vendor/conn(/.*)?                      u:object_r:conn_vendor_data_file:s0
+/data/vendor/gps(/.*)?                       u:object_r:gps_vendor_data_file:s0
+/data/vendor/wifi(/.*)?                      u:object_r:wifi_vendor_data_file:s0
+/data/vendor/log(/.*)?                       u:object_r:log_vendor_data_file:s0
+/data/vendor/log/cbd(/.*)?                   u:object_r:log_cbd_vendor_data_file:s0
+/data/vendor/secradio(/.*)?                  u:object_r:radio_vendor_data_file:s0
+
+### DEV
+/dev/block/platform/.+/by-name/boot          u:object_r:boot_block_device:s0
+/dev/block/platform/.+/by-name/cache         u:object_r:cache_block_device:s0
+/dev/block/platform/.+/by-name/efs           u:object_r:efs_block_device:s0
+/dev/block/platform/.+/by-name/dqmdbg        u:object_r:dqmdbg_block_device:s0
+/dev/block/platform/.+/by-name/dtbo          u:object_r:dtbo_block_device:s0
+/dev/block/platform/.+/by-name/keydata       u:object_r:keydata_block_device:s0
+/dev/block/platform/.+/by-name/keyrefuge     u:object_r:keyrefuge_block_device:s0
+/dev/block/platform/.+/by-name/metadata      u:object_r:metadata_block_device:s0
+/dev/block/platform/.+/by-name/misc          u:object_r:misc_block_device:s0
+/dev/block/platform/.+/by-name/modem         u:object_r:modem_block_device:s0
+/dev/block/platform/.+/by-name/omr           u:object_r:omr_block_device:s0
+/dev/block/platform/.+/by-name/persistent    u:object_r:frp_block_device:s0
+/dev/block/platform/.+/by-name/radio         u:object_r:radio_block_device:s0
+/dev/block/platform/.+/by-name/recovery      u:object_r:recovery_block_device:s0
+/dev/block/platform/.+/by-name/sec_efs       u:object_r:sec_efs_block_device:s0
+/dev/block/platform/.+/by-name/super         u:object_r:super_block_device:s0
+/dev/block/platform/.+/by-name/userdata      u:object_r:userdata_block_device:s0
+
+/dev/esfp[0-9]                               u:object_r:fp_sensor_device:s0
+/dev/batch_io                                u:object_r:io_device:s0
+/dev/ssp_sensorhub                           u:object_r:ssp_device:s0
+
+# bluetooth
+/dev/ttySAC[0-9]                             u:object_r:bt_device:s0
+
+# cpu
+/dev/cpu_dma_latency                         u:object_r:cpu_dma_device:s0
+
+### epic
+/dev/mode                                    u:object_r:epic_device:s0
+/dev/socket/epic                             u:object_r:epicd_socket:s0
+
+### gnss/gps
+/dev/bbd_control                             u:object_r:bbd_device:s0
+/dev/bbd_packet                              u:object_r:bbd_device:s0
+/dev/bbd_patch                               u:object_r:bbd_device:s0
+/dev/bbd_reliable                            u:object_r:bbd_device:s0
+/dev/bbd_sensor                              u:object_r:bbd_device:s0
+/dev/bbd_sio                                 u:object_r:bbd_device:s0
+/dev/bbd_urgent_patch                        u:object_r:bbd_device:s0
+/dev/ttyBCM[0-9]*                            u:object_r:bbd_device:s0
+
+### qos
+/dev/bus_throughput                          u:object_r:pm_qos_device:s0
+/dev/bus_throughput_max                      u:object_r:pm_qos_device:s0
+/dev/cluster0_freq_max                       u:object_r:pm_qos_device:s0
+/dev/cluster0_freq_min                       u:object_r:pm_qos_device:s0
+/dev/cluster1_freq_max                       u:object_r:pm_qos_device:s0
+/dev/cluster1_freq_min                       u:object_r:pm_qos_device:s0
+/dev/cluster2_freq_max                       u:object_r:pm_qos_device:s0
+/dev/cluster2_freq_min                       u:object_r:pm_qos_device:s0
+/dev/cpu_online_max                          u:object_r:pm_qos_device:s0
+/dev/cpu_online_min                          u:object_r:pm_qos_device:s0
+/dev/device_throughput                       u:object_r:pm_qos_device:s0
+/dev/device_throughput_max                   u:object_r:pm_qos_device:s0
+/dev/gpu_freq_max                            u:object_r:pm_qos_device:s0
+/dev/gpu_freq_min                            u:object_r:pm_qos_device:s0
+/dev/mfc_throughput                          u:object_r:pm_qos_device:s0
+/dev/mfc_throughput_max                      u:object_r:pm_qos_device:s0
+/dev/network_throughput                      u:object_r:radio_qos_device:s0
+/dev/npu_throughput                          u:object_r:pm_qos_device:s0
+/dev/npu_throughput_max                      u:object_r:pm_qos_device:s0
+
+### radio
+# DRB
+/dev/drb                                     u:object_r:drb_device:s0
+
+# UMTS
+/dev/umts_boot0                              u:object_r:vendor_radio_device:s0
+/dev/umts_cass                               u:object_r:vendor_radio_device:s0
+/dev/umts_ipc[0-1]                           u:object_r:vendor_radio_device:s0
+/dev/umts_dm0                                u:object_r:vendor_radio_device:s0
+/dev/umts_rfs0                               u:object_r:vendor_radio_device:s0
+/dev/umts_router                             u:object_r:vendor_radio_device:s0
+
+### EFS
+/efs/Battery(/.*)?                           u:object_r:battery_efs_file:s0
+/efs/DAK(/.*)?                               u:object_r:prov_efs_file:s0
+/efs/afc(/.*)?                               u:object_r:sec_efs_file:s0
+/efs/bluetooth(/.*)?                         u:object_r:bluetooth_efs_file:s0
+/efs/cpk(/.*)?                               u:object_r:cpk_efs_file:s0
+/efs/imei(/.*)?                              u:object_r:imei_efs_file:s0
+/efs/nfc(/.*)?                               u:object_r:nfc_efs_file:s0
+/efs/nv_data\.bin(.*)                        u:object_r:bin_nv_data_efs_file:s0
+/efs/pfw_data(/.*)?                          u:object_r:pfw_efs_file:s0
+/efs/prov(/.*)?                              u:object_r:prov_efs_file:s0
+/efs/prov_data(/.*)?                         u:object_r:prov_efs_file:s0
+/efs/root(/.*)?                              u:object_r:app_efs_file:s0
+/efs/tee(/.*)?                               u:object_r:tee_efs_file:s0
+/efs/wifi(/.*)?                              u:object_r:wifi_efs_file:s0
+
+/mnt/vendor/efs(/.*)?                        u:object_r:efs_file:s0
+/mnt/vendor/efs/DAK(/.*)?                    u:object_r:prov_efs_file:s0
+/mnt/vendor/efs/afc(/.*)?                    u:object_r:sec_efs_file:s0
+/mnt/vendor/efs/bluetooth(/.*)?              u:object_r:bluetooth_efs_file:s0
+/mnt/vendor/efs/cpk(/.*)?                    u:object_r:cpk_efs_file:s0
+/mnt/vendor/efs/imei(/.*)?                   u:object_r:imei_efs_file:s0
+/mnt/vendor/efs/nv_data\.bin(.*)             u:object_r:bin_nv_data_efs_file:s0
+/mnt/vendor/efs/pfw_data(/.*)?               u:object_r:pfw_efs_file:s0
+/mnt/vendor/efs/prov(/.*)?                   u:object_r:prov_efs_file:s0
+/mnt/vendor/efs/prov_data(/.*)?              u:object_r:prov_efs_file:s0
+/mnt/vendor/efs/root(/.*)?                   u:object_r:app_efs_file:s0
+/mnt/vendor/efs/tee(/.*)?                    u:object_r:tee_efs_file:s0
+/mnt/vendor/efs/wifi(/.*)?                   u:object_r:wifi_efs_file:s0
+
+### VENDOR
+/(vendor|system/vendor)/bin/cbd              u:object_r:cbd_exec:s0
+/(vendor|system/vendor)/bin/secril_config_svc    u:object_r:secril_config_svc_exec:s0
+
+/(vendor|system/vendor)/bin/hw/android\.hardware\.biometrics\.fingerprint@[0-9].[0-9]-service\.samsung    u:object_r:hal_fingerprint_default_exec:s0
+/(vendor|system/vendor)/bin/hw/android\.hardware\.light@[0-9].[0-9]-service\.samsung              u:object_r:hal_light_default_exec:s0
+/(vendor|system/vendor)/bin/hw/android\.hardware\.thermal@[0-9].[0-9]-service\.samsung            u:object_r:hal_thermal_default_exec:s0
+
+/(vendor|system/vendor)/firmware(/.*)?       u:object_r:vendor_firmware_file:s0

universal7885-common/sepolicy/samsung_slsi/vendor/genfs_contexts

@@ -0,0 +1,64 @@
+# genfs_contexts
+
+### PROC
+genfscon proc /last_kmsg                                                  u:object_r:proc_last_kmsg:s0
+
+### SYSFS
+genfscon sysfs /bbd                                                       u:object_r:sysfs_bbd:s0
+
+genfscon sysfs /bus/iio/devices                                           u:object_r:sysfs_iio:s0
+
+genfscon sysfs /class/backlight/                                          u:object_r:sysfs_backlight_writable:s0
+genfscon sysfs /class/fingerprint/fingerprint                             u:object_r:sysfs_fingerprint:s0
+genfscon sysfs /class/input                                               u:object_r:sysfs_input:s0
+genfscon sysfs /class/power_supply                                        u:object_r:sysfs_battery:s0
+genfscon sysfs /class/rtc/rtc0                                            u:object_r:sysfs_rtc:s0
+genfscon sysfs /class/sec/gps                                             u:object_r:sysfs_sec_gps:s0
+genfscon sysfs /class/sec/sensors                                         u:object_r:sysfs_sec_sensors:s0
+genfscon sysfs /class/sec/tsp                                             u:object_r:sysfs_sec_touchscreen:s0
+genfscon sysfs /class/sensor_event                                        u:object_r:sysfs_sensors:s0
+genfscon sysfs /class/sensors                                             u:object_r:sysfs_sensors:s0
+genfscon sysfs /class/thermal                                             u:object_r:sysfs_thermal:s0
+genfscon sysfs /class/timed_output/vibrator/intensity                     u:object_r:sysfs_vibrator:s0
+genfscon sysfs /class/timed_output/vibrator/multi_freq                    u:object_r:sysfs_vibrator:s0
+
+genfscon sysfs /devices/platform/argos                                    u:object_r:sysfs_argos:s0
+genfscon sysfs /devices/platform/battery/power_supply                     u:object_r:sysfs_battery:s0
+genfscon sysfs /devices/platform/battery/power_supply/battery/lcd         u:object_r:sysfs_battery_writable:s0
+genfscon sysfs /devices/platform/panel@0/backlight/panel/brightness       u:object_r:sysfs_backlight_writable:s0
+genfscon sysfs /devices/platform/panel@0/backlight/panel/max_brightness   u:object_r:sysfs_backlight_writable:s0
+genfscon sysfs /devices/platform/panel@0/lcd/panel                        u:object_r:sysfs_lcd_writable:s0
+
+genfscon sysfs /devices/virtual/fingerprint/fingerprint                   u:object_r:sysfs_fingerprint:s0
+genfscon sysfs /devices/virtual/input                                     u:object_r:sysfs_input:s0
+genfscon sysfs /devices/virtual/lcd/panel                                 u:object_r:sysfs_lcd_writable:s0
+genfscon sysfs /devices/virtual/sec/gps                                   u:object_r:sysfs_sec_gps:s0
+genfscon sysfs /devices/virtual/sec/sec_key                               u:object_r:sysfs_sec_key:s0
+genfscon sysfs /devices/virtual/sec/tsp                                   u:object_r:sysfs_sec_touchscreen:s0
+genfscon sysfs /devices/virtual/sec/tsp/cmd                               u:object_r:sysfs_touchscreen_writable:s0
+genfscon sysfs /devices/virtual/sec/tsp/ear_detect_enable                 u:object_r:sysfs_touchscreen_writable:s0
+genfscon sysfs /devices/virtual/sec/tsp/prox_power_off                    u:object_r:sysfs_touchscreen_writable:s0
+genfscon sysfs /devices/virtual/sec/tsp/input/enabled                     u:object_r:sysfs_touchscreen_writable:s0
+genfscon sysfs /devices/virtual/sensor_event                              u:object_r:sysfs_sensors:s0
+genfscon sysfs /devices/virtual/sensors                                   u:object_r:sysfs_sensors:s0
+genfscon sysfs /devices/virtual/sensors/hidden_hole/hh_check_coef         u:object_r:sysfs_sensors_writable:s0
+genfscon sysfs /devices/virtual/sensors/ssp_sensor/enable                 u:object_r:sysfs_sensors_writable:s0
+genfscon sysfs /devices/virtual/sensors/ssp_sensor/ssp_flush              u:object_r:sysfs_sensors_writable:s0
+genfscon sysfs /devices/virtual/sec/switch                                u:object_r:sysfs_sec_switch:s0
+genfscon sysfs /devices/virtual/sec/switch/afc_disable                    u:object_r:sysfs_sec_switch_writable:s0
+genfscon sysfs /devices/virtual/thermal                                   u:object_r:sysfs_thermal:s0
+genfscon sysfs /devices/virtual/timed_output/vibrator/cp_trigger_index    u:object_r:sysfs_vibrator:s0
+genfscon sysfs /devices/virtual/timed_output/vibrator/intensity           u:object_r:sysfs_vibrator:s0
+genfscon sysfs /devices/virtual/timed_output/vibrator/multi_freq          u:object_r:sysfs_vibrator:s0
+
+genfscon sysfs /module/dhd/parameters                                     u:object_r:sysfs_wifi_writable:s0
+
+genfscon sysfs /power/cpufreq_max_limit                                   u:object_r:sysfs_power_writable:s0
+genfscon sysfs /power/cpufreq_min_limit                                   u:object_r:sysfs_power_writable:s0
+genfscon sysfs /power/cpuhotplug/max_online_cpu                           u:object_r:sysfs_power_writable:s0
+genfscon sysfs /power/rtc_status                                          u:object_r:sysfs_power_writable:s0
+
+genfscon sysfs /wifi                                                      u:object_r:sysfs_wifi:s0
+genfscon sysfs /wifi/cid                                                  u:object_r:sysfs_wifi_writable:s0
+genfscon sysfs /wifi/mac_addr                                             u:object_r:sysfs_wifi_writable:s0
+genfscon sysfs /wifi/memdump                                              u:object_r:sysfs_wifi_writable:s0

universal7885-common/sepolicy/samsung_slsi/vendor/gpsd.te

@@ -0,0 +1,37 @@
+type gpsd, domain, netdomain;
+type gpsd_exec, exec_type, vendor_file_type, file_type;
+
+# gpsd is started by init, type transit from init domain to gpsd domain
+init_daemon_domain(gpsd)
+
+allow gpsd rild:unix_stream_socket connectto;
+
+get_prop(gpsd, vendor_radio_prop)
+get_prop(gpsd, telephony_config_prop)
+get_prop(gpsd, exported_config_prop)
+
+get_prop(gpsd, hwservicemanager_prop)
+hwbinder_use(gpsd)
+allow gpsd system_suspend_hwservice:hwservice_manager { find };
+allow gpsd fwk_sensor_hwservice:hwservice_manager { find };
+
+binder_call(gpsd, system_suspend_server)
+binder_call(gpsd, system_server)
+binder_call(system_server, gpsd)
+
+allow gpsd self:netlink_kobject_uevent_socket create_socket_perms_no_ioctl;
+allow gpsd self:{ tcp_socket udp_socket } create_stream_socket_perms;
+allow gpsd port:tcp_socket { name_bind name_connect };
+allow gpsd port:udp_socket name_bind;
+allow gpsd node:{ tcp_socket udp_socket } node_bind;
+
+# /acct/tasks
+allow gpsd cgroup:file getattr;
+
+# /dev/socket/fwmarkd
+allow gpsd fwmarkd_socket:sock_file write;
+
+# /data/vendor/gps
+allow gpsd gps_vendor_data_file:dir rw_dir_perms;
+allow gpsd gps_vendor_data_file:file create_file_perms;
+allow gpsd gps_vendor_data_file:fifo_file create_file_perms;

universal7885-common/sepolicy/samsung_slsi/vendor/hal_bluetooth_default.te

@@ -0,0 +1,24 @@
+# hal_bluetooth_default.te
+
+# ro.rfkilldisabled
+get_prop(hal_bluetooth_default, rfkilldisabled_prop)
+# vendor.bluetooth_fw_ver
+set_prop(hal_bluetooth_default, wifi_log_prop)
+# sys.bluetooth.tty
+set_prop(hal_bluetooth_default, exported_bluetooth_prop)
+
+# /dev/ttySAC[0-9]
+allow hal_bluetooth_default bt_device:chr_file rw_file_perms;
+
+# /mnt/vendor
+allow hal_bluetooth_default mnt_vendor_file:dir search;
+
+# /mnt/vendor/efs/
+allow hal_bluetooth_default efs_file:dir r_dir_perms;
+
+# /mnt/vendor/conn
+allow hal_bluetooth_default conn_vendor_data_file:dir r_dir_perms;
+allow hal_bluetooth_default conn_vendor_data_file:file r_file_perms;
+
+# /sys/devices/platform/bluetooth/rfkill/rfkill0/state
+allow hal_bluetooth_default sysfs_bt_writable:file rw_file_perms;

universal7885-common/sepolicy/samsung_slsi/vendor/hal_fingerprint_default.te

@@ -0,0 +1,14 @@
+# hal_fingerprint_default.te
+
+# /dev/esfp[0-9]
+allow hal_fingerprint_default fp_sensor_device:chr_file rw_file_perms;
+
+# /data/vendor/ -> biometrics
+file_type_auto_trans(hal_fingerprint_default, vendor_data_file, biometrics_vendor_data_file)
+
+# /data/vendor/biometrics/*
+allow hal_fingerprint_default biometrics_vendor_data_file:file create_file_perms;
+
+# /sys/class/fingerprint/
+allow hal_fingerprint_default sysfs_fingerprint:dir r_dir_perms;
+allow hal_fingerprint_default sysfs_fingerprint:file r_file_perms;

universal7885-common/sepolicy/samsung_slsi/vendor/hal_gnss_default.te

@@ -0,0 +1,12 @@
+# hal_gnss_default.te
+
+# cgroups tasks
+allow hal_gnss_default cgroup:file getattr;
+
+# /data/vendor/gps
+allow hal_gnss_default gps_vendor_data_file:dir rw_dir_perms;
+allow hal_gnss_default gps_vendor_data_file:file create_file_perms;
+allow hal_gnss_default gps_vendor_data_file:fifo_file create_file_perms;
+
+# /mnt/vendor
+allow hal_gnss_default mnt_vendor_file:dir search;

universal7885-common/sepolicy/samsung_slsi/vendor/hal_keymaster_default.te

@@ -0,0 +1,7 @@
+# hal_keymaster_default
+
+# /mnt/vendor
+allow hal_keymaster_default mnt_vendor_file:dir search;
+
+# /mnt/vendor/efs
+allow hal_keymaster_default efs_file:dir search;

universal7885-common/sepolicy/samsung_slsi/vendor/hal_light_default.te

@@ -0,0 +1,5 @@
+# hal_light_default.te
+
+# /sys/devices/platform/panel@0/backlight/panel/brightness
+# /sys/devices/platform/panel@0/backlight/panel/max_brightness
+allow hal_light_default sysfs_backlight_writable:file rw_file_perms;

universal7885-common/sepolicy/samsung_slsi/vendor/hal_power_default.te

@@ -0,0 +1,25 @@
+# hal_power_default.te
+
+# /dev/cpu_dma_latency
+allow hal_power_default cpu_dma_device:chr_file rw_file_perms;
+
+# /dev/stune/top-app/schedtune.boost
+allow hal_power_default cgroup:file rw_file_perms;
+
+# /sys/class/input/
+allow hal_power_default sysfs_input:dir r_dir_perms;
+
+# /sys/class/power/
+allow hal_power_default sysfs_power:dir r_dir_perms;
+allow hal_power_default sysfs_power:file r_file_perms;
+allow hal_power_default sysfs_power_writable:file rw_file_perms;
+
+# /sys/class/sec/tsp/input/
+allow hal_power_default sysfs_sec_touchscreen:dir r_dir_perms;
+allow hal_power_default sysfs_sec_touchscreen:lnk_file r_file_perms;
+
+# /sys/class/sec/tsp/input/{cmd,enabled}
+allow hal_power_default sysfs_touchscreen_writable:file rw_file_perms;
+
+# /sys/devices/system/cpu/cpu[0-9]/cpufreq/scaling_max_freq
+allow hal_power_default sysfs_devices_system_cpu:file rw_file_perms;

universal7885-common/sepolicy/samsung_slsi/vendor/hal_sensors_default.te

@@ -0,0 +1,62 @@
+# hal_sensors_default.te
+
+# /dev/batch_io
+allow hal_sensors_default io_device:chr_file r_file_perms;
+
+# /dev/iio:device1
+allow hal_sensors_default iio_device:chr_file r_file_perms;
+
+# /dev/ssp_sensorhub
+allow hal_sensors_default ssp_device:chr_file rw_file_perms;
+
+# /efs
+allow hal_sensors_default efs_file:dir r_dir_perms;
+
+# /efs/FactoryApp/
+allow hal_sensors_default app_efs_file:dir rw_dir_perms;
+allow hal_sensors_default app_efs_file:file { setattr rw_file_perms };
+
+# /sys/bus/iio/devices
+allow hal_sensors_default sysfs_iio:dir r_dir_perms;
+allow hal_sensors_default sysfs_iio:file r_file_perms;
+
+# /sys/class/sec/sensors
+allow hal_sensors_default sysfs_sec_sensors:dir r_dir_perms;
+allow hal_sensors_default sysfs_sec_sensors:file r_file_perms;
+
+# /sys/class/sensors/ssp_sensor/enable
+allow hal_sensors_default sysfs_sensors_writable:dir r_dir_perms;
+allow hal_sensors_default sysfs_sensors_writable:file rw_file_perms;
+
+# /sys/devices/platform/10970000.spi/
+allow hal_sensors_default sysfs_spi_writeable:dir r_dir_perms;
+allow hal_sensors_default sysfs_spi_writeable:file rw_file_perms;
+
+# /sys/devices/platform/panel@0/lcd/panel/window_type
+allow hal_sensors_default sysfs_lcd_writable:dir r_dir_perms;
+allow hal_sensors_default sysfs_lcd_writable:file r_file_perms;
+
+# /sys/class/input
+allow hal_sensors_default sysfs_input:dir r_dir_perms;
+
+# /sys/devices/virtual/input/input4
+# /sys/devices/virtual/input/input6
+allow hal_sensors_default sysfs_sensors:dir r_dir_perms;
+allow hal_sensors_default sysfs_sensors:file r_file_perms;
+
+# /sys/devices/virtual/sensors/magnetic_sensor/vendor
+allow hal_sensors_default sysfs_sensors:dir r_dir_perms;
+allow hal_sensors_default sysfs_sensors:file r_file_perms;
+
+# /sys/devices/virtual/sec/sec_key/hall_detect
+allow hal_sensors_default sysfs_sec_key:dir r_dir_perms;
+allow hal_sensors_default sysfs_sec_key:file r_file_perms;
+
+# /sys/class/sec/tsp/
+allow hal_sensors_default sysfs_sec_touchscreen:dir r_dir_perms;
+allow hal_sensors_default sysfs_sec_touchscreen:file r_file_perms;
+allow hal_sensors_default sysfs_sec_touchscreen:lnk_file r_file_perms;
+
+# /sys/class/sec/tsp/ear_detect_enable
+# /sys/class/sec/tsp/cmd
+allow hal_sensors_default sysfs_touchscreen_writable:file rw_file_perms;

universal7885-common/sepolicy/samsung_slsi/vendor/hal_thermal_default.te

@@ -0,0 +1,8 @@
+# hal_thermal_default.te
+
+# /acct/tasks
+allow hal_thermal_default cgroup:file getattr;
+
+# /sys/devices/virtual/thermal/
+allow hal_thermal_default sysfs_thermal:dir r_dir_perms;
+allow hal_thermal_default sysfs_thermal:file r_file_perms;

universal7885-common/sepolicy/samsung_slsi/vendor/hal_wifi_hostapd_default.te

@@ -0,0 +1,4 @@
+# hal_wifi_hostapd_default.te
+
+# /data/vendor/wifi/hostapd/hostapd_wlan0.conf
+r_dir_file(hal_wifi_hostapd_default, wifi_vendor_data_file)

universal7885-common/sepolicy/samsung_slsi/vendor/hal_wifi_supplicant_default.te

@@ -0,0 +1,8 @@
+# hal_wifi_supplicant_default.te
+
+# /data/vendor/log
+allow hal_wifi_supplicant_default log_vendor_data_file:dir r_dir_perms;
+
+# /data/vendor/wifi
+allow hal_wifi_supplicant_default wifi_vendor_data_file:dir rw_dir_perms;
+allow hal_wifi_supplicant_default wifi_vendor_data_file:file rw_file_perms;

universal7885-common/sepolicy/samsung_slsi/vendor/init.te

@@ -0,0 +1,3 @@
+# init.te
+
+allow init proc_last_kmsg:file setattr;

universal7885-common/sepolicy/samsung_slsi/vendor/kernel.te

@@ -0,0 +1,5 @@
+# kernel.te
+
+# /vendor/firmware/
+allow kernel vendor_firmware_file:dir r_dir_perms;
+allow kernel vendor_firmware_file:file r_file_perms;

universal7885-common/sepolicy/samsung_slsi/vendor/lhd.te

@@ -0,0 +1,38 @@
+type lhd, domain;
+type lhd_exec, exec_type, vendor_file_type, file_type;
+
+# lhd is started by init, type transit from init domain to lhd domain
+init_daemon_domain(lhd)
+
+get_prop(lhd, hwservicemanager_prop)
+hwbinder_use(lhd)
+allow lhd system_suspend_hwservice:hwservice_manager { find };
+binder_call(lhd, system_suspend_server)
+
+allow lhd self:tcp_socket create_stream_socket_perms;
+allow lhd port:tcp_socket { name_bind name_connect };
+allow lhd node:tcp_socket node_bind;
+
+# /data/vendor/gps
+allow lhd gps_vendor_data_file:dir rw_dir_perms;
+allow lhd gps_vendor_data_file:file create_file_perms;
+allow lhd gps_vendor_data_file:fifo_file create_file_perms;
+
+# /dev/bbd_control
+allow lhd bbd_device:chr_file rw_file_perms;
+
+# /dev/socket/fwmarkd
+allow lhd fwmarkd_socket:sock_file write;
+
+# /sys/bbd/lk_enable
+r_dir_file(lhd, sysfs_bbd)
+
+# /sys/class/sec/gps
+allow lhd sysfs_sec_gps:dir r_dir_perms;
+allow lhd sysfs_sec_gps:file r_file_perms;
+
+# /sys/devices/virtual/sec/sensorhub/mcu_power
+allow lhd sysfs_sensorhub_writable:file rw_file_perms;
+
+# /sys/class/sec/gps/GPS_PWR_EN/value
+allow lhd sysfs_gps_writable:file rw_file_perms;

universal7885-common/sepolicy/samsung_slsi/vendor/macloader.te

@@ -0,0 +1,40 @@
+# macloader.te
+
+type macloader, domain;
+type macloader_exec, exec_type, vendor_file_type, file_type;
+
+# macloader is started by init, type transit from init domain to macloader domain
+init_daemon_domain(macloader)
+
+set_prop(macloader, vendor_wifi_prop);
+
+allow macloader self:capability { net_admin };
+
+allow macloader self:udp_socket create_socket_perms;
+allowxperm macloader self:udp_socket ioctl { 0x8913 0x8914 };
+
+# /data/vendor/conn
+allow macloader conn_vendor_data_file:dir rw_dir_perms;
+allow macloader conn_vendor_data_file:file create_file_perms;
+
+# /mnt/vendor
+allow macloader mnt_vendor_file:dir search;
+
+# /mnt/vendor/efs
+allow macloader efs_file:dir rw_dir_perms;
+
+# /mnt/vendor/efs/wifi
+allow macloader wifi_efs_file:dir rw_dir_perms;
+allow macloader wifi_efs_file:file rw_file_perms;
+
+# /sys/class/net
+allow macloader sysfs_net:dir r_dir_perms;
+allow macloader sysfs_net:file r_file_perms;
+
+# /sys/module/dhd/parameters/firmware_path
+allow macloader sysfs_wifi_writable:dir r_dir_perms;
+allow macloader sysfs_wifi_writable:file rw_file_perms;
+
+# /sys/wifi
+allow macloader sysfs_wifi:dir r_dir_perms;
+allow macloader sysfs_wifi:file r_file_perms;

universal7885-common/sepolicy/samsung_slsi/vendor/property.te

@@ -0,0 +1,6 @@
+# property.te
+
+type vendor_cbd_prop, property_type;
+type vendor_radio_prop, property_type;
+type vendor_fastcharge_prop, property_type;
+type vendor_wifi_prop, property_type;

universal7885-common/sepolicy/samsung_slsi/vendor/property_contexts

@@ -0,0 +1,13 @@
+### cbd
+vendor.cbd.                    u:object_r:vendor_cbd_prop:s0
+persist.vendor.cbd.            u:object_r:vendor_radio_prop:s0
+
+### radio
+ro.multisim.                   u:object_r:vendor_radio_prop:s0
+ro.vendor.multisim.            u:object_r:vendor_radio_prop:s0
+ro.vendor.radio.               u:object_r:vendor_radio_prop:s0
+
+### wifi
+vendor.wifi.                   u:object_r:vendor_wifi_prop:s0
+ro.vendor.wifi.                u:object_r:vendor_wifi_prop:s0
+

universal7885-common/sepolicy/samsung_slsi/vendor/rild.te

@@ -0,0 +1,68 @@
+# rild.te
+
+get_prop(rild, vendor_radio_prop)
+
+allow rild block_device:dir search;
+allow rild mnt_vendor_file:dir { getattr search };
+
+# audio hal
+allow rild hal_audio_default:dir search;
+allow rild hal_audio_default:file r_file_perms;
+
+# gps
+allow rild gpsd:dir search;
+allow rild gpsd:file r_file_perms;
+
+# /data
+allow rild system_data_file:dir getattr;
+
+# /data/vendor/log
+allow rild log_vendor_data_file:dir rw_dir_perms;
+allow rild log_vendor_data_file:file create_file_perms;
+
+# /dev/block/platform/.+/by-name/radio
+allow rild radio_block_device:blk_file r_file_perms;
+
+# /dev/drb
+allow rild drb_device:chr_file rw_file_perms;
+
+# /dev/umts_*
+# /dev/umts_ipc*
+allow rild vendor_radio_device:chr_file rw_file_perms;
+
+# /data/vendor/secradio
+allow rild radio_vendor_data_file:dir rw_dir_perms;
+allow rild radio_vendor_data_file:file create_file_perms;
+
+# /efs/FactoryApp/
+# /mnt/vendor/efs/root
+allow rild app_efs_file:dir r_dir_perms;
+allow rild app_efs_file:file { rw_file_perms setattr };
+
+# /efs/imei
+allow rild imei_efs_file:dir r_dir_perms;
+allow rild imei_efs_file:file r_file_perms;
+
+# /mnt/vendor/efs/
+allow rild prov_efs_file:dir r_dir_perms;
+allow rild prov_efs_file:file r_file_perms;
+
+# /mnt/vendor/efs/nv_data.bin
+allow rild bin_nv_data_efs_file:file { rw_file_perms setattr unlink };
+
+# /proc/net/xt_qtaguid/iface_stat_fmt
+allow rild proc_qtaguid_stat:file r_file_perms;
+
+# /proc/sys/net/ipv6/conf/*/accept_ra_defrtr
+allow rild proc_net:file rw_file_perms;
+
+# mdc.
+# persist.sys.omc_support
+# ro.csc.
+get_prop(rild, exported_config_prop);
+
+# ro.boot.cpboot, ril.NwNmId[0-9]
+get_prop(rild, telephony_config_prop)
+
+# vendor.cbd.
+set_prop(rild, vendor_cbd_prop)

universal7885-common/sepolicy/samsung_slsi/vendor/secril_config_svc.te

@@ -0,0 +1,20 @@
+# secril_config_svc.te
+
+type secril_config_svc, domain;
+type secril_config_svc_exec, exec_type, vendor_file_type, file_type;
+
+# secril_config_svc is started by init, type transit from init domain to secril_config_svc domain
+init_daemon_domain(secril_config_svc)
+
+# /mnt/vendor/
+allow secril_config_svc mnt_vendor_file:dir search;
+
+# /mnt/vendor/efs/factory.prop
+# /mnt/vendor/efs/telephony.prop
+allow secril_config_svc efs_file:dir search;
+allow secril_config_svc efs_file:file r_file_perms;
+
+# ro.multisim.
+# ro.vendor.multisim.
+# ro.vendor.radio.default_network
+set_prop(secril_config_svc, vendor_radio_prop)

universal7885-common/sepolicy/samsung_slsi/vendor/system_server.te

@@ -0,0 +1,3 @@
+# system_server.te
+
+allow system_server proc_last_kmsg:file r_file_perms;

universal7885-common/sepolicy/samsung_slsi/vendor/vndservice.te

@@ -0,0 +1 @@
+type vendor_surfaceflinger_vndservice, vndservice_manager_type;

universal7885-common/sepolicy/samsung_slsi/vendor/vndservice_contexts

@@ -0,0 +1,3 @@
+# vndservice_contexts
+
+Exynos.HWCService                      u:object_r:vendor_surfaceflinger_vndservice:s0

universal7885-common/sepolicy/vendor/app.te

@@ -1 +1 @@
-get_prop(appdomain, exported_camera_prop);
+get_prop(appdomain, exported_camera_prop)

universal7885-common/sepolicy/vendor/bootanim.te

@@ -1 +1,2 @@
 get_prop(bootanim, userspace_reboot_exported_prop) 
+allow bootanim system_data_file:dir read;

universal7885-common/sepolicy/vendor/crash_dump.te

@@ -1,4 +1,5 @@
 get_prop(crash_dump, hwservicemanager_prop)
 get_prop(crash_dump, exported_camera_prop)
+#get_prop(crash_dump, vendor_default_prop)
 
 allow crash_dump app_data_file:file read;

universal7885-common/sepolicy/vendor/file.te

@@ -14,6 +14,9 @@ type debugfs_mali_mem, fs_type, debugfs_type;
 type debugfs_ion, fs_type, debugfs_type;
 type debugfs_ion_dma, fs_type, debugfs_type;
 
+# cache
+type boot_logcat_file, file_type, data_file_type;
+
 # proc
 type proc_extra, fs_type, proc_type;
 type proc_reset_reason, fs_type, proc_type;
@@ -26,7 +29,11 @@ type mediadrm_data_file, file_type, data_file_type;
 type nfc_vendor_data_file, file_type, data_file_type;
 
 # sysfs types
+type sysfs_battery_info, sysfs_type, fs_type;
+type sysfs_battery_supply, sysfs_type, rw_fs_type, fs_type;
 type sysfs_abox_writable, sysfs_type, rw_fs_type, fs_type;
+type sysfs_sensor_writable, sysfs_type, rw_fs_type, fs_type;
+type sysfs_input_writable, sysfs_type, rw_fs_type, fs_type;
 type sysfs_batteryinfo_charger_writable, sysfs_type, rw_fs_type, fs_type;
 type sysfs_camera_writable, sysfs_type, rw_fs_type, fs_type;
 type sysfs_decon, sysfs_type, r_fs_type, fs_type;
@@ -42,6 +49,7 @@ type sysfs_sec, fs_type, sysfs_type, mlstrustedobject;
 type sysfs_gps, fs_type, sysfs_type, mlstrustedobject;
 type sysfs_brightness, fs_type, sysfs_type, mlstrustedobject;
 type sysfs_virtual, fs_type, sysfs_type, mlstrustedobject;
+type sysfs_fuelgauge, fs_type, sysfs_type, mlstrustedobject;
 type sysfs_charger, fs_type, sysfs_type, mlstrustedobject;
 type sysfs_modem, fs_type, sysfs_type, mlstrustedobject;
 type sysfs_camera, fs_type, sysfs_type, mlstrustedobject;

universal7885-common/sepolicy/vendor/file_contexts

@@ -4,8 +4,9 @@
 /dev/umts_ipc0                                              u:object_r:radio_device:s0
 /dev/fimg2d                                                 u:object_r:video_device:s0
 /dev/sec-nfc                                                u:object_r:nfc_device:s0
-/dev/goodix_fp                                              u:object_r:goodix_device:s0
+/dev/esfp0                                              u:object_r:goodix_device:s0
-
+/dev/gnss_ipc                                               u:object_r:gps_device:s0
+/dev/scsc_h4_0                                              u:object_r:bt_device:s0
 /dev/cpuset(/.*)?                                           u:object_r:cgroup:s0
 
 # camera
@@ -42,9 +43,6 @@
 ####################################
 # data files
 /data/vendor/nfc(/.*)?                                      u:object_r:nfc_vendor_data_file:s0
-
-/data/misc/radio(/.*)?                                      u:object_r:radio_data_file:s0
-
 # drm
 /data/vendor/mediadrm(/.*)?                                 u:object_r:mediadrm_data_file:s0
 
@@ -52,66 +50,23 @@
 /data/camera(/.*)?                                          u:object_r:camera_data_file:s0
 
 ####################################
-# sysfs files
+### CACHE
-
+/cache/boot_log.txt					      u:object_r:boot_logcat_file:s0
-# charger
-/sys/devices/battery/power_supply(/.*)                                                                u:object_r:sysfs_charger:s0
-/sys/devices/platform/13840000\.i2c/i2c-10/10-003d/s2mu004-charger/power_supply/s2mu004-charger(/.*)  u:object_r:sysfs_charger:s0
-/sys/devices/platform/13840000\.i2c/i2c-10/10-003d/s2mu004-charger/power_supply/otg(/.*)?             u:object_r:sysfs_charger:s0
-/sys/devices/platform/13840000\.i2c/i2c-10/10-003d/s2mu004-charger/power_supply/s2mu004-charger(/.*)? u:object_r:sysfs_charger:s0
-/sys/devices/platform/13830000\.i2c/i2c-9/9-003b/power_supply/s2mu004-fuelgauge(/.*)?                 u:object_r:sysfs_charger:s0
-/sys/devices/platform/13840000\.i2c/i2c-10/10-003d/s2mu004-muic/power_supply/muic-manager(/.*)?       u:object_r:sysfs_charger:s0
-/sys/devices/platform/13830000\.i2c/i2c-8/8-003b/power_supply/s2mu106-fuelgauge(/.*)?                 u:object_r:sysfs_charger:s0
-/sys/devices/platform/13830000\.i2c/i2c-8/8-003c/power_supply/s2mu106-usbpd(/.*)?                     u:object_r:sysfs_charger:s0
-/sys/devices/platform/13840000\.i2c/i2c-9/9-003d/s2mu106-powermeter/power_supply/s2mu106_pmeter(/.*)? u:object_r:sysfs_charger:s0
-/sys/devices/platform/13840000\.i2c/i2c-9/9-003d/s2mu106-muic/power_supply/muic-manager(/.*)?         u:object_r:sysfs_charger:s0
-/sys/devices/platform/13840000\.i2c/i2c-9/9-003d/s2mu106-charger/power_supply/otg(/.*)?               u:object_r:sysfs_charger:s0
-/sys/devices/platform/13840000\.i2c/i2c-9/9-003d/s2mu106-charger/power_supply/s2mu106-charger(/.*)?   u:object_r:sysfs_charger:s0
-
-# virtual
-/sys/devices/virtual(/.*)?                                  u:object_r:sysfs_virtual:s0
-
-# iio
-/sys/bus/iio/devices(/.*)?                                  u:object_r:sysfs_iio:s0
-
-# Backlight/Notification LED control
-/sys/class/backlight/panel/brightness                       u:object_r:sysfs_graphics:s0
-/sys/class/backlight/panel/max_brightness                   u:object_r:sysfs_graphics:s0
-
-# rild
-/sys/devices/virtual/misc/multipdp(/.*)                     u:object_r:sysfs_multipdp:s0
-
-# input
-/sys/devices/platform/gpio_keys/input/input12(/.*)?         u:object_r:sysfs_input:s0
-
-# modem
-/sys/module/modem_ctrl_ss310ap/parameters/ds_detect         u:object_r:sysfs_modem:s0
-
-# gps
-/sys/devices/soc0/machine                                   u:object_r:sysfs_sec_gps:s0
-/sys/devices/soc0/revision                                  u:object_r:sysfs_sec_gps:s0
-/dev/gnss_ipc                                               u:object_r:gps_device:s0
-
-# bt
-/dev/scsc_h4_0                                              u:object_r:bt_device:s0
-
-# ZRAM
-/sys/devices/virtual/block/zram0/mm_stat                    u:object_r:sysfs_zram:s0
 
 ### VENDOR
-/(vendor|system/vendor)/lib(64)?/hw/gralloc\.[a-z0-9]*\.so  u:object_r:same_process_hal_file:s0
+/(vendor|system/vendor)/lib(64)?/hw/gralloc\.exynos7884B\.so  u:object_r:same_process_hal_file:s0
 /(vendor|system/vendor)/lib(64)?/libion_exynos\.so          u:object_r:same_process_hal_file:s0
-
 /(vendor|system/vendor)/bin/main_abox                       u:object_r:abox_exec:s0
 /(vendor|system/vendor)/bin/wlbtd                           u:object_r:wlbtd_exec:s0
 /(vendor|system/vendor)/bin/hw/gpsd                         u:object_r:gpsd_exec:s0
 /(vendor|system/vendor)/bin/hw/macloader                    u:object_r:macloader_exec:s0
 /(vendor|system/vendor)/bin/mcDriverDaemon                  u:object_r:tee_exec:s0
-
 /(vendor|system/vendor)/bin/hw/android\.hardware\.power@[0-9]\.[0-9]-service\.universal7884B   u:object_r:hal_power_default_exec:s0
+/(vendor|system/vendor)/bin/hw/android\.hardware\.power\.stats@[0-9]\.[0-9]-service\.mock             u:object_r:hal_power_stats_default_exec:s0
 /(vendor|system/vendor)/bin/hw/android\.hardware\.vibrator@[0-9]\.[0-9]-service\.samsung      u:object_r:hal_vibrator_default_exec:s0
 /(vendor|system/vendor)/bin/hw/android\.hardware\.drm@[0-9]\.[0-9]-service\.clearkey          u:object_r:hal_drm_clearkey_exec:s0
 /(vendor|system/vendor)/bin/hw/android\.hardware\.drm@[0-9]\.[0-9]-service\.widevine          u:object_r:hal_drm_widevine_exec:s0
 /(vendor|system/vendor)/bin/hw/android\.hardware\.keymaster@[0-9]\.[0-9]-service\.samsung     u:object_r:hal_keymaster_default_exec:s0
 /(vendor|system/vendor)/bin/hw/android\.hardware\.nfc@[0-9]\.[0-9]-service\.samsung           u:object_r:hal_nfc_default_exec:s0
+/(vendor|system/vendor)/bin/hw/android\.hardware\.usb@[0-9]\.[0-9]-service\.exynos7884B          u:object_r:hal_usb_default_exec:s0
 /(vendor|system/vendor)/bin/hw/vendor\.samsung\.hardware\.gnss@[0-9]\.[0-9]-service           u:object_r:hal_gnss_default_exec:s0

universal7885-common/sepolicy/vendor/genfs_contexts

@@ -14,16 +14,44 @@ genfscon proc /sys/vm/swappiness                  u:object_r:proc_swapiness:s0
 # SYSFS
 
 # class
-genfscon sysfs /class/video4linux                 u:object_r:sysfs_v4l:s0
+genfscon sysfs /class/video4linux                                                 u:object_r:sysfs_v4l:s0
-genfscon sysfs /class/input/input1                u:object_r:sysfs_input:s0
+genfscon sysfs /class/input/input1                                                u:object_r:sysfs_input:s0
+genfscon sysfs /class/backlight/panel/brightness                                  u:object_r:sysfs_graphics:s0
+genfscon sysfs /class/backlight/panel/max_brightness                              u:object_r:sysfs_graphics:s0
+
+# battery
+genfscon sysfs /class/power_supply/battery/                                       u:object_r:sysfs_battery_info:s0
 
 # devices
+genfscon sysfs /devices/virtual                                                   u:object_r:sysfs_virtual:s0
+genfscon sysfs /devices/virtual/misc/multipdp                                     u:object_r:sysfs_multipdp:s0
+genfscon sysfs /devices/virtual/sensors/sensor_dev/flush                          u:object_r:sysfs_sensor_writable:s0
+genfscon sysfs /devices/virtual/input/input2/enable                               u:object_r:sysfs_input_writable:s0
+genfscon sysfs /devices/virtual/input/input3/enable                               u:object_r:sysfs_input_writable:s0
+genfscon sysfs /devices/virtual/input/input4/enable                               u:object_r:sysfs_input_writable:s0
+genfscon sysfs /devices/virtual/input/input5/enable                               u:object_r:sysfs_input_writable:s0
+genfscon sysfs /devices/virtual/input/input6/enable                               u:object_r:sysfs_input_writable:s0
+genfscon sysfs /devices/virtual/input/input7/enable                               u:object_r:sysfs_input_writable:s0
+genfscon sysfs /devices/virtual/input/input8/enable                               u:object_r:sysfs_input_writable:s0
+genfscon sysfs /devices/virtual/input/input9/enable                               u:object_r:sysfs_input_writable:s0
+genfscon sysfs /devices/virtual/input/input10/enable                              u:object_r:sysfs_input_writable:s0
+genfscon sysfs /devices/virtual/input/input2/poll_delay                           u:object_r:sysfs_input_writable:s0
+genfscon sysfs /devices/virtual/input/input3/poll_delay                           u:object_r:sysfs_input_writable:s0
+genfscon sysfs /devices/virtual/input/input8/poll_delay                           u:object_r:sysfs_input_writable:s0
+genfscon sysfs /devices/platform/gpio_keys/input/input12                          u:object_r:sysfs_input:s0
+genfscon sysfs /devices/platform/flip_cover/input/input13                         u:object_r:sysfs_input:s0
 genfscon sysfs /devices/platform/10000.mif_pdata/sim/ds_detect                    u:object_r:sysfs_sim_writable:s0
-genfscon sysfs /module/scsc_bt/parameters/bluetooth_address                       u:object_r:sysfs_bt_writable:s0
+# A20e RTC
-genfscon sysfs /devices/platform/11ce0000.speedy/i2c-7/7-0000/s2mpu08-rtc/rtc     u:object_r:sysfs_rtc:s0
+genfscon sysfs /devices/platform/11ce0000.speedy/i2c-5/5-0000/s2mpu08-rtc/rtc    u:object_r:sysfs_rtc:s0
+# A20 RTC
 genfscon sysfs /devices/platform/11ce0000.speedy/i2c-6/6-0000/s2mpu08-rtc/rtc     u:object_r:sysfs_rtc:s0
-genfscon sysfs /devices/platform/11ce0000.speedy/i2c-7/7-0003/input/input11       u:object_r:sysfs_touchscreen_writable:s0
+
-genfscon sysfs /devices/platform/13930000.hsi2c/i2c-5/5-0048/input/               u:object_r:sysfs_touchscreen_writable:s0
+# A20e Display
+genfscon sysfs /devices/platform/13870000.i2c/i2c-11/11-0048/input/            u:object_r:sysfs_touchscreen_writable:s0
+genfscon sysfs /devices/platform/11ce0000.speedy/i2c-5/5-0003/input/input11		  u:object_r:sysfs_touchscreen_writable:s0
+# A20 Display
+genfscon sysfs /devices/platform/13870000.i2c/i2c-11/11-0020/input/            u:object_r:sysfs_touchscreen_writable:s0
+
 genfscon sysfs /devices/platform/14870000.dsim/backlight/panel                    u:object_r:sysfs_graphics:s0
 genfscon sysfs /devices/platform/14a50000.abox/service                            u:object_r:sysfs_abox_writable:s0
 genfscon sysfs /devices/platform/14860000.decon_f                                 u:object_r:sysfs_decon:s0
@@ -33,6 +61,11 @@ genfscon sysfs /devices/platform/14400000.fimc_is_sensor/video4linux
 genfscon sysfs /devices/platform/14440000.fimc_is/video4linux                     u:object_r:sysfs_v4l_fimc:s0
 genfscon sysfs /devices/platform/12c30000.mfc0/video4linux                        u:object_r:sysfs_v4l_mfc:s0
 genfscon sysfs /devices/platform/12c00000.smfc/video4linux                        u:object_r:sysfs_v4l_smfc:s0
+genfscon sysfs /devices/soc0/soc_id                                               u:object_r:sysfs_socinfo:s0
+genfscon sysfs /devices/soc0/machine                                              u:object_r:sysfs_sec_gps:s0
+genfscon sysfs /devices/soc0/revision                                             u:object_r:sysfs_sec_gps:s0
+genfscon sysfs /devices/virtual/block/zram0/mm_stat                               u:object_r:sysfs_zram:s0
+genfscon sysfs /devices/system/chip-id/revision                                   u:object_r:sysfs_ss_writable:s0
 genfscon sysfs /devices/platform/battery/power_supply/battery                     u:object_r:sysfs_battery_writable:s0
 genfscon sysfs /devices/platform/battery/power_supply/battery/batt_capacity_max   u:object_r:sysfs_battery_writable:s0
 genfscon sysfs /devices/platform/battery/power_supply/battery/status              u:object_r:sysfs_battery_writable:s0
@@ -42,17 +75,29 @@ genfscon sysfs /devices/platform/battery/power_supply/wireless/type
 genfscon sysfs /devices/platform/battery/power_supply/ps/type                     u:object_r:sysfs_battery_writable:s0
 genfscon sysfs /devices/platform/battery/power_supply/ps/status                   u:object_r:sysfs_battery_writable:s0
 
-genfscon sysfs /devices/soc0/soc_id                          u:object_r:sysfs_socinfo:s0
+# S2MU005 CHARGER (A10)
-genfscon sysfs /devices/system/chip-id/revision              u:object_r:sysfs_ss_writable:s0
+genfscon sysfs /devices/platform/13840000.i2c/i2c-9/9-003d/s2mu004-charger/power_supply/s2mu004-charger u:object_r:sysfs_charger:s0
+genfscon sysfs /devices/platform/13840000.i2c/i2c-9/9-003d/s2mu004-muic/power_supply/muic-manager       u:object_r:sysfs_charger:s0
 
-genfscon sysfs /devices/virtual/android_usb/android0         u:object_r:sysfs_android_usb:s0
+# S2MU106 CHARGER (A20e)
-genfscon sysfs /devices/virtual/camera                       u:object_r:sysfs_camera:s0
+genfscon sysfs /devices/platform/13840000.i2c/i2c-8/8-003d/s2mu106-powermeter/power_supply/s2mu106_pmeter u:object_r:sysfs_charger:s0
-genfscon sysfs /devices/virtual/camera/rear/fw_update        u:object_r:sysfs_camera_writable:s0
+genfscon sysfs /devices/platform/13840000.i2c/i2c-8/8-003d/s2mu106-muic/power_supply/muic-manager         u:object_r:sysfs_charger:s0
-genfscon sysfs /devices/virtual/camera/rear/ssrm_camera_info u:object_r:sysfs_camera_writable:s0
+genfscon sysfs /devices/platform/13840000.i2c/i2c-8/8-003d/s2mu106-charger/power_supply/otg               u:object_r:sysfs_charger:s0
-genfscon sysfs /devices/virtual/camera/flash/rear_flash      u:object_r:sysfs_camera_writable:s0
+genfscon sysfs /devices/platform/13840000.i2c/i2c-8/8-003d/s2mu106-charger/power_supply/s2mu106-charger   u:object_r:sysfs_charger:s0
+genfscon sysfs /devices/platform/13830000.i2c/i2c-7/7-003c/power_supply/s2mu106-usbpd/type		  u:object_r:sysfs_charger:s0
+genfscon sysfs /devices/platform/13830000.i2c/i2c-7/7-003b/power_supply/s2mu106-fuelgauge/type	      u:object_r:sysfs_fuelgauge:s0
 
-genfscon sysfs /firmware/devicetree/base/model_info-system_rev u:object_r:sysfs_info:s0
+# S2MU106 CHARGER (A20)
+genfscon sysfs /devices/platform/13840000.i2c/i2c-9/9-003d/s2mu106-powermeter/power_supply/s2mu106_pmeter u:object_r:sysfs_charger:s0
+genfscon sysfs /devices/platform/13840000.i2c/i2c-9/9-003d/s2mu106-muic/power_supply/muic-manager         u:object_r:sysfs_charger:s0
+genfscon sysfs /devices/platform/13840000.i2c/i2c-9/9-003d/s2mu106-charger/power_supply/otg               u:object_r:sysfs_charger:s0
+genfscon sysfs /devices/platform/13840000.i2c/i2c-9/9-003d/s2mu106-charger/power_supply/s2mu106-charger   u:object_r:sysfs_charger:s0
+genfscon sysfs /devices/platform/13830000.i2c/i2c-8/8-003b/power_supply/s2mu106-fuelgauge/                 u:object_r:sysfs_fuelgauge:s0
 
-genfscon sysfs /kernel/gpu/                    u:object_r:sysfs_gpu:s0
+genfscon sysfs /class/input/input1/enabled					     u:object_r:sysfs_sec_touchscreen:s0
-genfscon sysfs /kernel/gpu/gpu_max_clock       u:object_r:sysfs_gpu_writable:s0
+genfscon sysfs /module/modem_ctrl_ss310ap/parameters/ds_detect                    u:object_r:sysfs_modem:s0
-genfscon sysfs /kernel/gpu/gpu_min_clock       u:object_r:sysfs_gpu_writable:s0
+genfscon sysfs /module/scsc_bt/parameters/bluetooth_address                       u:object_r:sysfs_bt_writable:s0
+genfscon sysfs /firmware/devicetree/base/model_info-system_rev                    u:object_r:sysfs_info:s0
+genfscon sysfs /kernel/gpu/                                                       u:object_r:sysfs_gpu:s0
+genfscon sysfs /kernel/gpu/gpu_max_clock                                          u:object_r:sysfs_gpu_writable:s0
+genfscon sysfs /kernel/gpu/gpu_min_clock                                          u:object_r:sysfs_gpu_writable:s0

universal7885-common/sepolicy/vendor/gpsd.te

@@ -1,4 +1,4 @@
-r_dir_file(gpsd, sysfs_sec_gps);
+r_dir_file(gpsd, sysfs_sec_gps)
 
 allow gpsd sysfs_gps_writable:file rw_file_perms;
 allow gpsd sysfs_wake_lock:file rw_file_perms;
@@ -10,3 +10,5 @@ allow gpsd bt_device:chr_file rw_file_perms;
 allow gpsd gps_device:chr_file rw_file_perms;
 
 allow gpsd gpsd_exec:file execute_no_trans;
+
+allow gpsd bootanim_system_prop:file { read open getattr };

universal7885-common/sepolicy/vendor/hal_camera_default.te

@@ -7,8 +7,14 @@ allow hal_camera_default sysfs_virtual:dir search;
 allow hal_camera_default sysfs_virtual:file rw_file_perms;
 allow hal_camera_default sysfs_camera:dir search;
 allow hal_camera_default sysfs_camera:file rw_file_perms;
+allow hal_camera_default sysfs_battery:dir search;
+allow hal_camera_default sysfs_battery_writable:dir search;
+allow hal_camera_default sysfs_battery_writable:file r_file_perms;
 
 get_prop(hal_camera_default, exported_camera_prop)
 
 binder_call(hal_camera_default, system_server)
 binder_call(system_server, hal_camera_default)
+
+r_dir_file(hal_camera_default, sysfs_decon)
+set_prop(hal_camera_default, camera_prop)

universal7885-common/sepolicy/vendor/hal_graphics_composer_default.te

@@ -1,11 +1,9 @@
-hal_client_domain(hal_graphics_composer_default, hal_graphics_allocator);
+hal_client_domain(hal_graphics_composer_default, hal_graphics_allocator)
 
 vndbinder_use(hal_graphics_composer_default)
 
 allow hal_graphics_composer_default self:netlink_kobject_uevent_socket create_socket_perms_no_ioctl;
 
-allow hal_graphics_composer_default vendor_surfaceflinger_vndservice:service_manager { add find };
-
 # cgroup tasks
 allow hal_graphics_composer_default cgroup:file getattr;
 

universal7885-common/sepolicy/vendor/hal_health_default.te

@@ -5,3 +5,4 @@ allow hal_health_default sysfs_battery:dir r_dir_perms;
 allow hal_health_default sysfs_battery:file r_file_perms;
 allow hal_health_default sysfs_battery_writable:dir search;
 allow hal_health_default sysfs_battery_writable:file r_file_perms;
+allow hal_health_default sysfs_fuelgauge:file r_file_perms;

universal7885-common/sepolicy/vendor/hal_keymaster_default.te

@@ -0,0 +1 @@
+allow hal_keymaster_default prov_efs_file r_file_perms;

universal7885-common/sepolicy/vendor/hal_lineage_fastcharge_default.te

@@ -1,2 +0,0 @@
-allow hal_lineage_fastcharge_default sysfs_virtual:dir search;
-allow hal_lineage_fastcharge_default sysfs_virtual:file rw_file_perms;

universal7885-common/sepolicy/vendor/hal_lineage_touch_default.te

@@ -1,2 +0,0 @@
-allow hal_lineage_touch_default sysfs_virtual:dir search;
-allow hal_lineage_touch_default sysfs_virtual:file rw_file_perms;

universal7885-common/sepolicy/vendor/hal_nfc_default.te

@@ -1,4 +1,3 @@
 allow hal_nfc_default nfc_vendor_data_file:dir w_dir_perms;
 allow hal_nfc_default nfc_vendor_data_file:file create_file_perms;
-
 set_prop(hal_nfc_default, vendor_nfc_prop)

universal7885-common/sepolicy/vendor/hal_power_default.te

@@ -4,3 +4,6 @@ allow hal_power_default sysfs_input:file r_file_perms;
 allow hal_power_default sysfs_virtual:dir r_dir_perms;
 allow hal_power_default sysfs_virtual:file r_file_perms;
 allow hal_power_default sysfs_touchscreen_writable:dir r_dir_perms;
+allow hal_power_default sysfs_sec_touchscreen:dir read;
+type hal_lineage_power_hwservice, hwservice_manager_type; 
+add_hwservice(hal_power_default, hal_power_hwservice)

universal7885-common/sepolicy/vendor/hal_power_stats_default.te

@@ -0,0 +1,2 @@
+allow hal_power_stats_default sysfs_iio:dir r_dir_perms;
+allow hal_power_stats_default sysfs_iio:file r_file_perms;

universal7885-common/sepolicy/vendor/hal_sensors_default.te

@@ -4,7 +4,10 @@ allow hal_sensors_default sysfs_virtual:dir r_dir_perms;
 allow hal_sensors_default sysfs_virtual:file rw_file_perms;
 allow hal_sensors_default sysfs_virtual:lnk_file read;
 allow hal_sensors_default baro_delta_factoryapp_efs_file:file r_file_perms;
-allow hal_sensors_default sysfs_input:file read;
+allow hal_sensors_default sysfs_input:file r_file_perms;
+allow hal_sensors_default sysfs_input_writable:file rw_file_perms;
+allow hal_sensors_default sysfs_input:dir r_dir_perms;
+allow hal_sensors_default sysfs_sensor_writable:file rw_file_perms;
 allow hal_sensors_default sysfs_spi_writeable:file rw_file_perms;
 
 # yas_lib

universal7885-common/sepolicy/vendor/hal_wifi_default.te

@@ -1,4 +1,4 @@
-set_prop(hal_wifi_default, vendor_wlan_prop);
+set_prop(hal_wifi_default, vendor_wlan_prop)
 get_prop(hal_wifi_default, vendor_wifi_prop)
 
 allow hal_wifi_default conn_vendor_data_file:dir search;

universal7885-common/sepolicy/vendor/hwservice.te

@@ -1,3 +1 @@
-type hal_sec_radio_hwservice, hwservice_manager_type;
+type rild_hwservice, hwservice_manager_type;
-type hal_sec_radio_bridge_hwservice, hwservice_manager_type;
-type hal_sec_radio_channel_hwservice, hwservice_manager_type;

universal7885-common/sepolicy/vendor/hwservice_contexts

@@ -1,4 +1,6 @@
 vendor.samsung.hardware.gnss::ISehGnss                      u:object_r:hal_gnss_hwservice:s0
-vendor.samsung.hardware.radio::ISehRadio                    u:object_r:hal_sec_radio_hwservice:s0
+vendor.samsung.hardware.radio::ISehRadio                    u:object_r:rild_hwservice:s0
-vendor.samsung.hardware.radio.bridge::ISehBridge            u:object_r:hal_sec_radio_bridge_hwservice:s0
+vendor.samsung.hardware.radio.bridge::ISehBridge            u:object_r:rild_hwservice:s0
-vendor.samsung.hardware.radio.channel::ISehChannel          u:object_r:hal_sec_radio_channel_hwservice:s0
+vendor.samsung.hardware.radio.channel::ISehChannel          u:object_r:rild_hwservice:s0
+vendor.lineage.power::ILineagePower			      u:object_r:hal_power_hwservice:s0
+

universal7885-common/sepolicy/vendor/init.te

@@ -37,6 +37,12 @@ allow init gps_vendor_data_file:file lock;
 allow init socket_device:sock_file create_file_perms;
 allow init kernel:system module_request;
 
+allow init logd:unix_stream_socket connectto;
+allow init logdr_socket:sock_file write;
+allow init self:capability sys_nice;
+allow init boot_logcat_file:file rw_file_perms;
+allow init logcat_exec:file { execute getattr open read };
+
 allow init proc:file setattr;
 allow init proc_swapiness:file write;
 allow init proc_extra:file setattr;

universal7885-common/sepolicy/vendor/kernel.te

@@ -9,4 +9,5 @@ allow kernel self:capability { sys_rawio mknod };
 
 allow kernel block_device:dir search;
 
+allow kernel sysfs_sec_key:dir search;
 r_dir_file(kernel, sysfs_virtual)

universal7885-common/sepolicy/vendor/mediacodec.te

@@ -3,4 +3,4 @@ allow mediacodec sysfs_v4l:dir r_dir_perms;
 allow mediacodec sysfs_v4l_mfc:dir search;
 allow mediacodec sysfs_v4l_mfc:file r_file_perms;
 
-hal_client_domain(mediacodec, hal_power);
+hal_client_domain(mediacodec, hal_power)

universal7885-common/sepolicy/vendor/mediaserver.te

@@ -0,0 +1 @@
+get_prop(mediaserver, exported_camera_prop)

universal7885-common/sepolicy/vendor/priv_app.te

@@ -6,3 +6,5 @@ allow priv_app debugfs_mali:dir search;
 allow priv_app debugfs_mali_mem:dir search;
 
 allow priv_app sysfs_zram:file r_file_perms;
+
+#get_prop(priv_app, vendor_default_prop)

universal7885-common/sepolicy/vendor/property.te

@@ -1,5 +1,6 @@
 # modemloader
 type modemloader_prop, property_type;
+type camera_prop, property_type;
 
 type persist_rmnet_prop, property_type;
 type persist_data_df_prop, property_type;

universal7885-common/sepolicy/vendor/property_contexts

@@ -14,6 +14,7 @@ persist.data.df.            u:object_r:persist_data_df_prop:s0
 persist.data.wda.           u:object_r:persist_data_wda_prop:s0
 
 # CAMERA
+persist.sys.camera.         u:object_r:camera_prop:s0
 persist.vendor.sys.camera.  u:object_r:vendor_camera_prop:s0
 
 # GPS

universal7885-common/sepolicy/vendor/rild.te

@@ -5,6 +5,7 @@ allow rild vendor_data_file:file create_file_perms;
 allow rild radio_device:chr_file ioctl;
 
 allow rild bin_nv_data_efs_file:file create_file_perms;
+dontaudit rild bin_nv_data_efs_file:file ioctl;
 
 allow rild radio_vendor_data_file:file create_file_perms;
 allow rild radio_vendor_data_file:dir rw_dir_perms;
@@ -23,6 +24,6 @@ allow rild hal_audio_default:dir search;
 allow rild hal_audio_default:file r_file_perms;
 
 # hwservice
-add_hwservice(rild, hal_sec_radio_hwservice)
+add_hwservice(rild, rild_hwservice)
-add_hwservice(rild, hal_sec_radio_bridge_hwservice)
+
-add_hwservice(rild, hal_sec_radio_channel_hwservice)
+

universal7885-common/sepolicy/vendor/secril_config_svc.te

@@ -1 +1 @@
-dontaudit secril_config_svc exported3_radio_prop:property_service set;
+dontaudit secril_config_svc radio_control_prop:property_service set;

universal7885-common/sepolicy/vendor/system_app.te

@@ -3,3 +3,10 @@ allow system_app gpu_device:chr_file rw_file_perms;
 
 allow system_app proc_pagetypeinfo:file r_file_perms;
 allow system_app sysfs_virtual:dir search;
+
+# battery sysfs
+
+allow system_app sysfs_battery_info:dir { search };
+allow system_app sysfs_battery_info:file { read open getattr };
+
+r_dir_file(system_app, sysfs_battery_info)

universal7885-common/sepolicy/vendor/system_server.te

@@ -11,11 +11,14 @@ allow system_server frp_block_device:blk_file rw_file_perms;
 
 allow system_server sysfs_rtc:file r_file_perms;
 
+allow system_server sysfs_battery_writable:dir r_dir_perms;
+allow system_server sysfs_battery_writable:file rw_file_perms;
+
 get_prop(system_server, vendor_radio_prop)
 
 r_dir_file(system_server, sysfs_virtual)
 
-get_prop(system_server, exported_camera_prop);
+get_prop(system_server, exported_camera_prop)
 get_prop(system_server, userspace_reboot_config_prop)
 get_prop(system_server, userspace_reboot_exported_prop)
 

universal7885-common/sepolicy/vendor/tzdaemon.te

@@ -0,0 +1,4 @@
+allow tzdaemon mnt_vendor_file:dir rw_dir_perms;
+allow tzdaemon efs_file:dir search;
+allow tzdaemon tee_efs_file:dir { add_name remove_name open create read search write };
+allow tzdaemon tee_efs_file:file { getattr open create read rename unlink write };

universal7885-common/sepolicy/vendor/vendor_init.te

@@ -10,3 +10,10 @@ allow vendor_init wifi_data_file:dir search;
 allow vendor_init system_data_file:dir create_dir_perms;
 # mkdir /data/camera/*
 allow vendor_init camera_data_file:dir create_dir_perms;
+allow vendor_init cache_file:dir { remove_name write };
+allow vendor_init boot_logcat_file:file unlink;
+set_prop(vendor_init, persist_data_df_prop)
+set_prop(vendor_init, persist_data_wda_prop)
+set_prop(vendor_init, persist_rmnet_prop)
+get_prop(vendor_init, system_prop)
+

universal7885-common/sepolicy/vendor/wlbtd.te

@@ -1,7 +1,7 @@
 type wlbtd, domain;
 
 type wlbtd_exec, exec_type, vendor_file_type, file_type;
-init_daemon_domain(wlbtd);
+init_daemon_domain(wlbtd)
 
 allow wlbtd conn_vendor_data_file:dir search;
 allow wlbtd conn_vendor_data_file:file rw_file_perms;
@@ -9,7 +9,7 @@ allow wlbtd self:netlink_generic_socket { create setopt bind getattr read write
 
 allow wlbtd init:unix_stream_socket connectto;
 
-r_dir_file(wlbtd, sysfs_wifi);
+r_dir_file(wlbtd, sysfs_wifi)
 allow wlbtd sysfs_wifi_writable:file rw_file_perms;
 
-set_prop(wlbtd, vendor_wlbtd_prop);
+set_prop(wlbtd, vendor_wlbtd_prop)

universal7885-common/sepolicy/vendor/zygote.te

@@ -1,3 +1,3 @@
-get_prop(zygote, exported_camera_prop); 
+get_prop(zygote, exported_camera_prop)
 
 allow zygote proc_cmdline:file r_file_perms;