From ae0130bb1337a291ba37a9b3117a744565246c70 Mon Sep 17 00:00:00 2001 From: SamarV-121 Date: Wed, 14 Jul 2021 23:42:06 +0530 Subject: [PATCH] universal7885: sepolicy: Resolve neverallows libsepol.report_failure: neverallow on line 9 of device/samsung/universal7885-common/sepolicy/vendor/mediacodec.te (or line 60921 of policy.conf) violated by allow hal_power_default hal_power_hwservice:hwservice_manager { add }; libsepol.report_failure: neverallow on line 5 of system/sepolicy/public/hal_power.te (or line 19140 of policy.conf) violated by allow mediacodec hal_power_hwservice:hwservice_manager { find }; libsepol.report_failure: neverallow on line 5 of system/sepolicy/public/hal_power.te (or line 19132 of policy.conf) violated by allow mediacodec hal_power_hwservice:hwservice_manager { add }; libsepol.report_failure: neverallow on line 990 of system/sepolicy/public/domain.te (or line 13095 of policy.conf) violated by allow zygote vendor_file:file { read }; libsepol.report_failure: neverallow on line 861 of system/sepolicy/public/domain.te (or line 12818 of policy.conf) violated by allow hal_fingerprint_default fingerprintd_data_file:dir { write }; libsepol.report_failure: neverallow on line 861 of system/sepolicy/public/domain.te (or line 12818 of policy.conf) violated by allow rild radio_data_file:dir { search }; libsepol.report_failure: neverallow on line 861 of system/sepolicy/public/domain.te (or line 12818 of policy.conf) violated by allow hal_camera_default camera_data_file:dir { search }; libsepol.report_failure: neverallow on line 861 of system/sepolicy/public/domain.te (or line 12818 of policy.conf) violated by allow hal_drm_widevine media_data_file:dir { search }; libsepol.report_failure: neverallow on line 831 of system/sepolicy/public/domain.te (or line 12761 of policy.conf) violated by allow rild radio_data_file:file { lock open watch watch_reads }; Change-Id: I47cc5117dda055ca4041e666bb7ffa8a51f9a3d9 Signed-off-by: SamarV-121 --- sepolicy/vendor/hal_camera_default.te | 1 - sepolicy/vendor/hal_drm_widevine.te | 1 - sepolicy/vendor/hal_fingerprint_default.te | 2 ++ sepolicy/vendor/mediacodec.te | 5 +---- sepolicy/vendor/rild.te | 2 -- sepolicy/vendor/zygote.te | 2 -- 6 files changed, 3 insertions(+), 10 deletions(-) diff --git a/sepolicy/vendor/hal_camera_default.te b/sepolicy/vendor/hal_camera_default.te index 313e7bc..274d1e8 100644 --- a/sepolicy/vendor/hal_camera_default.te +++ b/sepolicy/vendor/hal_camera_default.te @@ -7,7 +7,6 @@ allow hal_camera_default sysfs_virtual:dir search; allow hal_camera_default sysfs_virtual:file rw_file_perms; allow hal_camera_default sysfs_camera:dir search; allow hal_camera_default sysfs_camera:file rw_file_perms; -allow hal_camera_default camera_data_file:dir search; get_prop(hal_camera_default, exported_camera_prop) diff --git a/sepolicy/vendor/hal_drm_widevine.te b/sepolicy/vendor/hal_drm_widevine.te index 97c6652..fee899d 100644 --- a/sepolicy/vendor/hal_drm_widevine.te +++ b/sepolicy/vendor/hal_drm_widevine.te @@ -14,7 +14,6 @@ allow hal_drm_widevine hal_allocator_server:fd use; allow hal_drm_widevine mediadrm_data_file:dir create_dir_perms; allow hal_drm_widevine mediadrm_data_file:file create_file_perms; -allow hal_drm_widevine media_data_file:dir search; allow hal_drm_widevine vendor_data_file:dir create_dir_perms; allow hal_drm_widevine vendor_data_file:file create_file_perms; diff --git a/sepolicy/vendor/hal_fingerprint_default.te b/sepolicy/vendor/hal_fingerprint_default.te index 00aa5bc..a5fa396 100644 --- a/sepolicy/vendor/hal_fingerprint_default.te +++ b/sepolicy/vendor/hal_fingerprint_default.te @@ -1,3 +1,5 @@ +typeattribute hal_fingerprint_default data_between_core_and_vendor_violators; + allow hal_fingerprint_default fingerprintd_data_file:dir write; allow hal_fingerprint_default fingerprint_device:chr_file rw_file_perms; allow hal_fingerprint_default sysfs_virtual:dir search; diff --git a/sepolicy/vendor/mediacodec.te b/sepolicy/vendor/mediacodec.te index 433a7ff..ec2a674 100644 --- a/sepolicy/vendor/mediacodec.te +++ b/sepolicy/vendor/mediacodec.te @@ -3,7 +3,4 @@ allow mediacodec sysfs_v4l:dir r_dir_perms; allow mediacodec sysfs_v4l_mfc:dir search; allow mediacodec sysfs_v4l_mfc:file r_file_perms; -binder_call(mediacodec, hal_power_default) -binder_call(hal_power_default, mediacodec) - -add_hwservice(mediacodec, hal_power_hwservice) +hal_client_domain(mediacodec, hal_power); diff --git a/sepolicy/vendor/rild.te b/sepolicy/vendor/rild.te index 8ad6313..250b090 100644 --- a/sepolicy/vendor/rild.te +++ b/sepolicy/vendor/rild.te @@ -8,8 +8,6 @@ allow rild bin_nv_data_efs_file:file create_file_perms; allow rild radio_vendor_data_file:file create_file_perms; allow rild radio_vendor_data_file:dir rw_dir_perms; -allow rild radio_data_file:file rw_file_perms; -allow rild radio_data_file:dir search; allow rild proc_qtaguid_stat:file read; diff --git a/sepolicy/vendor/zygote.te b/sepolicy/vendor/zygote.te index 84b4e2a..01d0350 100644 --- a/sepolicy/vendor/zygote.te +++ b/sepolicy/vendor/zygote.te @@ -1,3 +1 @@ get_prop(zygote, exported_camera_prop); -# allow zygote system_file:dir write; -allow zygote vendor_file:file read;