From b75cc0ced3281d893a98a997c179988eb087b885 Mon Sep 17 00:00:00 2001 From: roynaetch2544 Date: Sat, 2 Apr 2022 15:10:30 +0900 Subject: [PATCH] universal7885: Address some denials * app_domain: Allow untrusted apps to get vendor.camera props such as vendor.camera.skip_unconfigure.packagelist * debug_daemon: Allow more perms to properly execute logcat, sepolicy neverallow passes still * Move vendor_camera_prop to vendor_public_prop, to resolve neverallow --- universal7885-common/sepolicy/private/debug_daemon.te | 2 +- universal7885-common/sepolicy/vendor/app.te | 2 +- universal7885-common/sepolicy/vendor/property.te | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/universal7885-common/sepolicy/private/debug_daemon.te b/universal7885-common/sepolicy/private/debug_daemon.te index 4d3dc90..f3732ef 100644 --- a/universal7885-common/sepolicy/private/debug_daemon.te +++ b/universal7885-common/sepolicy/private/debug_daemon.te @@ -10,7 +10,7 @@ allow debug_daemon logcat_exec:file rx_file_perms; allow debug_daemon self:capability2 syslog; allow debug_daemon kernel:system syslog_mod; allow debug_daemon debug_daemon_data_file:file create_file_perms; -allow debug_daemon shell_exec:file execute; +allow debug_daemon shell_exec:file rx_file_perms; allow debug_daemon self:capability sys_nice; allow debug_daemon logdr_socket:sock_file write; allow debug_daemon logd:unix_stream_socket connectto; diff --git a/universal7885-common/sepolicy/vendor/app.te b/universal7885-common/sepolicy/vendor/app.te index 9949db8..b510ce2 100644 --- a/universal7885-common/sepolicy/vendor/app.te +++ b/universal7885-common/sepolicy/vendor/app.te @@ -1 +1 @@ -get_prop(appdomain, exported_camera_prop) +get_prop(appdomain, vendor_camera_prop) diff --git a/universal7885-common/sepolicy/vendor/property.te b/universal7885-common/sepolicy/vendor/property.te index a8e2bca..8277f99 100644 --- a/universal7885-common/sepolicy/vendor/property.te +++ b/universal7885-common/sepolicy/vendor/property.te @@ -3,7 +3,7 @@ vendor_internal_prop(camera_prop) vendor_internal_prop(persist_rmnet_prop) vendor_internal_prop(persist_data_df_prop) vendor_internal_prop(persist_data_wda_prop) -vendor_internal_prop(vendor_camera_prop) +vendor_public_prop(vendor_camera_prop) vendor_internal_prop(vendor_factory_prop) vendor_internal_prop(vendor_gps_prop) vendor_internal_prop(vendor_nfc_prop)