From e732699c277c4eda3e4e5db52ef6c178a6caa044 Mon Sep 17 00:00:00 2001 From: roynatech2544 Date: Sun, 26 Nov 2023 16:21:24 +0900 Subject: [PATCH] universal7885: Go back track slsi sepolicy - Also cleanup rebundant rules, duplicate rules --- universal7885-common/BoardConfigCommon.mk | 12 +- .../sepolicy/private/file_contexts | 4 - .../sepolicy/private/hal_fmradio_default.te | 1 - .../private/hal_samsung_battery_default.te | 5 +- .../hal_samsung_camera_flashlight_default.te | 5 +- .../sepolicy/private/property_contexts | 33 ---- .../sepolicy/public/attributes | 8 - .../sepolicy/public/domain.te | 4 - universal7885-common/sepolicy/public/file.te | 15 +- .../sepolicy/public/genfs_contexts | 19 -- .../sepolicy/public/property.te | 2 - .../sepolicy/public/te_macros | 8 - universal7885-common/sepolicy/vendor/adbd.te | 1 - universal7885-common/sepolicy/vendor/apexd.te | 1 - .../sepolicy/vendor/bootanim.te | 1 - .../sepolicy/vendor/cameraserver.te | 1 + universal7885-common/sepolicy/vendor/cbd.te | 65 ------ .../sepolicy/vendor/crash_dump.te | 5 - .../sepolicy/vendor/device.te | 31 +-- .../sepolicy/vendor/domain.te | 16 -- universal7885-common/sepolicy/vendor/file.te | 103 +--------- .../sepolicy/vendor/file_contexts | 185 ++---------------- universal7885-common/sepolicy/vendor/fsck.te | 2 - .../sepolicy/vendor/genfs_contexts | 142 +++----------- universal7885-common/sepolicy/vendor/gpsd.te | 49 +---- .../sepolicy/vendor/gpuservice.te | 1 - .../sepolicy/vendor/hal_bluetooth_default.te | 24 --- .../sepolicy/vendor/hal_camera_default.te | 20 +- .../sepolicy/vendor/hal_drm_clearkey.te | 14 -- .../sepolicy/vendor/hal_drm_widevine.te | 28 +-- .../vendor/hal_fingerprint_default.te | 21 -- .../sepolicy/vendor/hal_gatekeeper_default.te | 1 - .../sepolicy/vendor/hal_gnss_default.te | 15 -- .../vendor/hal_graphics_allocator_default.te | 7 - .../vendor/hal_graphics_composer_default.te | 19 +- .../sepolicy/vendor/hal_health_default.te | 12 +- .../sepolicy/vendor/hal_keymaster_default.te | 11 +- .../sepolicy/vendor/hal_light_default.te | 10 +- .../sepolicy/vendor/hal_memtrack_default.te | 4 - .../sepolicy/vendor/hal_power_default.te | 32 +-- .../sepolicy/vendor/hal_sensors_default.te | 70 +------ .../sepolicy/vendor/hal_thermal_default.te | 8 - .../sepolicy/vendor/hal_usb_default.te | 3 - .../sepolicy/vendor/hal_vibrator_default.te | 2 - .../sepolicy/vendor/hal_wifi_default.te | 11 +- .../vendor/hal_wifi_hostapd_default.te | 6 - .../vendor/hal_wifi_supplicant_default.te | 8 - .../sepolicy/vendor/hwservice.te | 3 - .../sepolicy/vendor/hwservice_contexts | 10 +- universal7885-common/sepolicy/vendor/init.te | 63 +----- .../sepolicy/vendor/kernel.te | 16 +- .../sepolicy/vendor/macloader.te | 41 ---- .../sepolicy/vendor/mediacodec.te | 2 +- .../sepolicy/vendor/multiclientd.te | 11 -- universal7885-common/sepolicy/vendor/netd.te | 2 - .../sepolicy/vendor/platform_app.te | 2 - .../sepolicy/vendor/priv_app.te | 10 - .../sepolicy/vendor/property.te | 15 -- .../sepolicy/vendor/property_contexts | 50 ++--- universal7885-common/sepolicy/vendor/radio.te | 3 - universal7885-common/sepolicy/vendor/rild.te | 95 +-------- .../sepolicy/vendor/secril_config_svc.te | 24 --- .../sepolicy/vendor/surfaceflinger.te | 8 +- .../sepolicy/vendor/system_app.te | 13 -- .../sepolicy/vendor/system_server.te | 18 +- universal7885-common/sepolicy/vendor/tee.te | 5 - .../sepolicy/vendor/toolbox.te | 1 - .../sepolicy/vendor/tzdaemon.te | 38 ---- .../sepolicy/vendor/tztsdaemon.te | 10 - .../sepolicy/vendor/ueventd.te | 1 - .../sepolicy/vendor/vendor_init.te | 13 +- .../sepolicy/vendor/vndservice.te | 1 - .../sepolicy/vendor/vndservice_contexts | 3 - universal7885-common/sepolicy/vendor/vold.te | 7 +- universal7885-common/sepolicy/vendor/wlbtd.te | 15 -- .../sepolicy/vendor/zygote.te | 5 - universal7885-common/vendor.prop | 5 - 77 files changed, 132 insertions(+), 1403 deletions(-) delete mode 100644 universal7885-common/sepolicy/private/property_contexts delete mode 100644 universal7885-common/sepolicy/public/attributes delete mode 100644 universal7885-common/sepolicy/public/domain.te delete mode 100644 universal7885-common/sepolicy/public/genfs_contexts delete mode 100644 universal7885-common/sepolicy/public/property.te delete mode 100644 universal7885-common/sepolicy/public/te_macros delete mode 100644 universal7885-common/sepolicy/vendor/adbd.te delete mode 100644 universal7885-common/sepolicy/vendor/apexd.te create mode 100644 universal7885-common/sepolicy/vendor/cameraserver.te delete mode 100644 universal7885-common/sepolicy/vendor/cbd.te delete mode 100644 universal7885-common/sepolicy/vendor/crash_dump.te delete mode 100644 universal7885-common/sepolicy/vendor/domain.te delete mode 100644 universal7885-common/sepolicy/vendor/gpuservice.te delete mode 100644 universal7885-common/sepolicy/vendor/hal_bluetooth_default.te delete mode 100644 universal7885-common/sepolicy/vendor/hal_drm_clearkey.te delete mode 100644 universal7885-common/sepolicy/vendor/hal_graphics_allocator_default.te delete mode 100644 universal7885-common/sepolicy/vendor/hal_thermal_default.te delete mode 100644 universal7885-common/sepolicy/vendor/hal_usb_default.te delete mode 100644 universal7885-common/sepolicy/vendor/hal_vibrator_default.te delete mode 100644 universal7885-common/sepolicy/vendor/hal_wifi_hostapd_default.te delete mode 100644 universal7885-common/sepolicy/vendor/hal_wifi_supplicant_default.te delete mode 100644 universal7885-common/sepolicy/vendor/hwservice.te delete mode 100644 universal7885-common/sepolicy/vendor/macloader.te delete mode 100644 universal7885-common/sepolicy/vendor/multiclientd.te delete mode 100644 universal7885-common/sepolicy/vendor/platform_app.te delete mode 100644 universal7885-common/sepolicy/vendor/priv_app.te delete mode 100644 universal7885-common/sepolicy/vendor/radio.te delete mode 100644 universal7885-common/sepolicy/vendor/secril_config_svc.te delete mode 100644 universal7885-common/sepolicy/vendor/system_app.te delete mode 100644 universal7885-common/sepolicy/vendor/tee.te delete mode 100644 universal7885-common/sepolicy/vendor/toolbox.te delete mode 100644 universal7885-common/sepolicy/vendor/tzdaemon.te delete mode 100644 universal7885-common/sepolicy/vendor/tztsdaemon.te delete mode 100644 universal7885-common/sepolicy/vendor/vndservice.te delete mode 100644 universal7885-common/sepolicy/vendor/vndservice_contexts delete mode 100644 universal7885-common/sepolicy/vendor/wlbtd.te delete mode 100644 universal7885-common/sepolicy/vendor/zygote.te diff --git a/universal7885-common/BoardConfigCommon.mk b/universal7885-common/BoardConfigCommon.mk index c1bfc8f..1063f7f 100644 --- a/universal7885-common/BoardConfigCommon.mk +++ b/universal7885-common/BoardConfigCommon.mk @@ -116,18 +116,20 @@ ENABLE_VENDOR_RIL_SERVICE := true BOARD_ROOT_EXTRA_FOLDERS := factory BOARD_ROOT_EXTRA_SYMLINKS := /factory:/efs -# Sepolicy -SYSTEM_EXT_PUBLIC_SEPOLICY_DIRS += \ - $(COMMON_PATH)/sepolicy/public +BOARD_SEPOLICY_TEE_FLAVOR := teegris +include device/samsung_slsi/sepolicy/sepolicy.mk +# Sepolicy BOARD_VENDOR_SEPOLICY_DIRS += \ $(COMMON_PATH)/sepolicy/vendor \ hardware/samsung-ext/interfaces/sepolicy/vendor - +SYSTEM_EXT_PUBLIC_SEPOLICY_DIRS += \ + $(COMMON_PATH)/sepolicy/public \ + hardware/samsung-ext/interfaces/sepolicy/public SYSTEM_EXT_PRIVATE_SEPOLICY_DIRS += \ $(COMMON_PATH)/sepolicy/private \ hardware/samsung-ext/interfaces/sepolicy/private - + # Vendor TARGET_COPY_OUT_VENDOR := vendor VENDOR_SECURITY_PATCH := 2023-02-05 diff --git a/universal7885-common/sepolicy/private/file_contexts b/universal7885-common/sepolicy/private/file_contexts index d335e4c..8620ec2 100644 --- a/universal7885-common/sepolicy/private/file_contexts +++ b/universal7885-common/sepolicy/private/file_contexts @@ -1,7 +1,3 @@ -# file_contexts - -### DATA -/data/zram(/.*)? u:object_r:zram_data_file:s0 # FMRadio /system/bin/vendor\.eureka\.hardware\.fmradio-service u:object_r:hal_fmradio_default_exec:s0 diff --git a/universal7885-common/sepolicy/private/hal_fmradio_default.te b/universal7885-common/sepolicy/private/hal_fmradio_default.te index cd8ef75..7f094c4 100644 --- a/universal7885-common/sepolicy/private/hal_fmradio_default.te +++ b/universal7885-common/sepolicy/private/hal_fmradio_default.te @@ -9,7 +9,6 @@ binder_use(hal_fmradio_default); allow hal_fmradio_default sysfs_fmradio_tune:file rw_file_perms; allow hal_fmradio_default sysfs_fmradio_tune:dir search; -allow hal_fmradio_default sysfs_virtual:dir search; allow hal_fmradio_default fm_radio_device:chr_file { read write open ioctl }; allow hal_fmradio_default hal_audio_route_service:service_manager find; diff --git a/universal7885-common/sepolicy/private/hal_samsung_battery_default.te b/universal7885-common/sepolicy/private/hal_samsung_battery_default.te index c7920b3..a57953d 100644 --- a/universal7885-common/sepolicy/private/hal_samsung_battery_default.te +++ b/universal7885-common/sepolicy/private/hal_samsung_battery_default.te @@ -1,3 +1,2 @@ -allow hal_samsung_battery_default { sysfs_battery sysfs_battery_writable }:dir search; -allow hal_samsung_battery_default sysfs_battery_writable:file rw_file_perms; -allow hal_samsung_battery_default sysfs_battery:file r_file_perms; +r_file_recursive(hal_samsung_battery_default, sysfs_battery) +rw_file_recursive(hal_samsung_battery_default, sysfs_battery_writable) diff --git a/universal7885-common/sepolicy/private/hal_samsung_camera_flashlight_default.te b/universal7885-common/sepolicy/private/hal_samsung_camera_flashlight_default.te index d291b6d..ac5c7fd 100644 --- a/universal7885-common/sepolicy/private/hal_samsung_camera_flashlight_default.te +++ b/universal7885-common/sepolicy/private/hal_samsung_camera_flashlight_default.te @@ -1,3 +1,2 @@ -allow hal_samsung_camera_flashlight_default sysfs_flashlight:file rw_file_perms; -allow hal_samsung_camera_flashlight_default sysfs_flashlight:dir search; -allow hal_samsung_camera_flashlight_default sysfs_virtual:dir search; +allow hal_samsung_camera_flashlight_default sysfs_camera:file rw_file_perms; +allow hal_samsung_camera_flashlight_default sysfs_camera:dir search; diff --git a/universal7885-common/sepolicy/private/property_contexts b/universal7885-common/sepolicy/private/property_contexts deleted file mode 100644 index 499ae18..0000000 --- a/universal7885-common/sepolicy/private/property_contexts +++ /dev/null @@ -1,33 +0,0 @@ -### BLUETOOTH -sys.bluetooth.tty u:object_r:exported_bluetooth_prop:s0 - -### BUILD -#ro.build.PDA u:object_r:exported2_default_prop:s0 - -### CAMERA -system.camera.CC. u:object_r:exported_camera_prop:s0 -service.camera. u:object_r:exported_camera_prop:s0 -sys.cameramode. u:object_r:exported_camera_prop:s0 -ro.camera.req.fmq.size u:object_r:exported_camera_prop:s0 -ro.camera.res.fmq.size u:object_r:exported_camera_prop:s0 - -### GFX -#ro.gfx.driver.1 u:object_r:exported3_default_prop:s0 exact string - -### MDC -mdc. u:object_r:exported_config_prop:s0 - -### OMC -persist.sys.omc_support u:object_r:exported_config_prop:s0 -persist.sys.omc_etcpath u:object_r:exported_config_prop:s0 -ro.omc. u:object_r:exported_config_prop:s0 -ro.csc. u:object_r:exported_config_prop:s0 - -### RADIO -ril.NwNmId u:object_r:telephony_config_prop:s0 -ril.NwNmId2 u:object_r:telephony_config_prop:s0 -ro.boot.cpboot u:object_r:telephony_config_prop:s0 -ro.simbased.changetype u:object_r:exported_config_prop:s0 - -### RFKILL -ro.rfkilldisabled u:object_r:rfkilldisabled_prop:s0 diff --git a/universal7885-common/sepolicy/public/attributes b/universal7885-common/sepolicy/public/attributes deleted file mode 100644 index ef37023..0000000 --- a/universal7885-common/sepolicy/public/attributes +++ /dev/null @@ -1,8 +0,0 @@ -# Tag for read only filesystem type -attribute r_fs_type; - -# Tag for read/write filesystem type -attribute rw_fs_type; - -# Tag for read/execute filesystem type -attribute rx_fs_type; diff --git a/universal7885-common/sepolicy/public/domain.te b/universal7885-common/sepolicy/public/domain.te deleted file mode 100644 index fb15fe7..0000000 --- a/universal7885-common/sepolicy/public/domain.te +++ /dev/null @@ -1,4 +0,0 @@ -# domain.te - -# Make sure that labels are used correctly -neverallow { domain -vendor_init -ueventd } r_fs_type:file write; diff --git a/universal7885-common/sepolicy/public/file.te b/universal7885-common/sepolicy/public/file.te index c5e8fd0..37d8dcd 100644 --- a/universal7885-common/sepolicy/public/file.te +++ b/universal7885-common/sepolicy/public/file.te @@ -1,14 +1 @@ -# file.te - -### DATA -type zram_data_file, file_type, data_file_type, core_data_file_type; - -## SYSFS -type sysfs_virtual, fs_type, sysfs_type, mlstrustedobject; -type sysfs_sec_switch, sysfs_type, r_fs_type, fs_type; -type sysfs_battery, sysfs_type, r_fs_type, fs_type; -type sysfs_sec_touchscreen, sysfs_type, r_fs_type, fs_type; -type sysfs_sec_switch_writable, sysfs_type, rw_fs_type, fs_type; -type sysfs_touchscreen_writable, sysfs_type, rw_fs_type, fs_type; -type sysfs_battery_writable, sysfs_type, rw_fs_type, fs_type; -type sysfs_flashlight, sysfs_type, rw_fs_type, fs_type; +type sysfs_camera, fs_type, sysfs_type, mlstrustedobject; diff --git a/universal7885-common/sepolicy/public/genfs_contexts b/universal7885-common/sepolicy/public/genfs_contexts deleted file mode 100644 index f60641c..0000000 --- a/universal7885-common/sepolicy/public/genfs_contexts +++ /dev/null @@ -1,19 +0,0 @@ -genfscon sysfs /devices/virtual u:object_r:sysfs_virtual:s0 -genfscon sysfs /devices/virtual/camera/flash/torch_brightness_lvl u:object_r:sysfs_flashlight:s0 -genfscon sysfs /devices/virtual/camera/flash/torch_brightness_lvl_enable u:object_r:sysfs_flashlight:s0 -genfscon sysfs /class/sec/tsp u:object_r:sysfs_sec_touchscreen:s0 - -genfscon sysfs /devices/virtual/sec/tsp u:object_r:sysfs_sec_touchscreen:s0 -genfscon sysfs /devices/virtual/sec/tsp/cmd u:object_r:sysfs_touchscreen_writable:s0 -genfscon sysfs /devices/virtual/sec/tsp/cmd_result u:object_r:sysfs_touchscreen_writable:s0 -genfscon sysfs /devices/virtual/sec/tsp/ear_detect_enable u:object_r:sysfs_touchscreen_writable:s0 -genfscon sysfs /devices/virtual/sec/tsp/prox_power_off u:object_r:sysfs_touchscreen_writable:s0 -genfscon sysfs /devices/virtual/sec/tsp/input/enabled u:object_r:sysfs_touchscreen_writable:s0 -genfscon sysfs /devices/virtual/sec/switch u:object_r:sysfs_sec_switch:s0 -genfscon sysfs /devices/virtual/sec/switch/afc_disable u:object_r:sysfs_sec_switch_writable:s0 -genfscon sysfs /devices/platform/battery/power_supply/battery u:object_r:sysfs_battery_writable:s0 -genfscon sysfs /devices/platform/battery/power_supply/ac/type u:object_r:sysfs_battery_writable:s0 -genfscon sysfs /devices/platform/battery/power_supply/wireless/type u:object_r:sysfs_battery_writable:s0 -genfscon sysfs /devices/platform/battery/power_supply/ps/type u:object_r:sysfs_battery_writable:s0 -genfscon sysfs /devices/platform/battery/power_supply/ps/status u:object_r:sysfs_battery_writable:s0 -genfscon sysfs /devices/platform/battery/power_supply u:object_r:sysfs_battery:s0 diff --git a/universal7885-common/sepolicy/public/property.te b/universal7885-common/sepolicy/public/property.te deleted file mode 100644 index 0b1e97c..0000000 --- a/universal7885-common/sepolicy/public/property.te +++ /dev/null @@ -1,2 +0,0 @@ -### RFKILL -type rfkilldisabled_prop, property_type; diff --git a/universal7885-common/sepolicy/public/te_macros b/universal7885-common/sepolicy/public/te_macros deleted file mode 100644 index b7ab51f..0000000 --- a/universal7885-common/sepolicy/public/te_macros +++ /dev/null @@ -1,8 +0,0 @@ -# teegris_use(domain) -# -# Allow domain to use teegris -define(`teegris_use', ` -get_prop($1, vendor_tztsdaemon_prop) -# /dev/tzdev -allow $1 tz_user_device:chr_file rw_file_perms; -') diff --git a/universal7885-common/sepolicy/vendor/adbd.te b/universal7885-common/sepolicy/vendor/adbd.te deleted file mode 100644 index 9becff0..0000000 --- a/universal7885-common/sepolicy/vendor/adbd.te +++ /dev/null @@ -1 +0,0 @@ -allow adbd proc_last_kmsg:file r_file_perms; diff --git a/universal7885-common/sepolicy/vendor/apexd.te b/universal7885-common/sepolicy/vendor/apexd.te deleted file mode 100644 index 25801cb..0000000 --- a/universal7885-common/sepolicy/vendor/apexd.te +++ /dev/null @@ -1 +0,0 @@ -allow apexd sysfs_virtual:file rw_file_perms; diff --git a/universal7885-common/sepolicy/vendor/bootanim.te b/universal7885-common/sepolicy/vendor/bootanim.te index b3f2ac8..79257f4 100644 --- a/universal7885-common/sepolicy/vendor/bootanim.te +++ b/universal7885-common/sepolicy/vendor/bootanim.te @@ -1,2 +1 @@ get_prop(bootanim, userspace_reboot_exported_prop) -allow bootanim system_data_file:dir read; diff --git a/universal7885-common/sepolicy/vendor/cameraserver.te b/universal7885-common/sepolicy/vendor/cameraserver.te new file mode 100644 index 0000000..cf538e9 --- /dev/null +++ b/universal7885-common/sepolicy/vendor/cameraserver.te @@ -0,0 +1 @@ +get_prop(cameraserver, vendor_camera_prop) diff --git a/universal7885-common/sepolicy/vendor/cbd.te b/universal7885-common/sepolicy/vendor/cbd.te deleted file mode 100644 index 4b34374..0000000 --- a/universal7885-common/sepolicy/vendor/cbd.te +++ /dev/null @@ -1,65 +0,0 @@ -# cbd.te - -type cbd, domain; -type cbd_exec, exec_type, vendor_file_type, file_type; - -allow cbd self:capability setuid; - -# cbd is started by init, type transit from init domain to cbd domain -init_daemon_domain(cbd) - -# /dev/block/ -allow cbd block_device:dir search; - -# /data/vendor/log -allow cbd log_vendor_data_file:dir search; - -# /data/vendor/log/cbd -allow cbd log_cbd_vendor_data_file:dir create_dir_perms; -allow cbd log_cbd_vendor_data_file:file create_file_perms; - -# /dev/block/platform/.+/by-name/radio -allow cbd radio_block_device:blk_file r_file_perms; - -# /dev/kmsg -allow cbd kmsg_device:chr_file rw_file_perms; - -# /dev/umts_* -allow cbd vendor_radio_device:chr_file rw_file_perms; - -# /mnt/vendor/ -allow cbd mnt_vendor_file:dir search; - -# /mnt/vendor/efs/ -allow cbd efs_file:dir r_dir_perms; - -# /mnt/vendor/efs/factory.prop -allow cbd efs_file:file r_file_perms; - -# /mnt/vendor/efs/nv_data.bin -allow cbd bin_nv_data_efs_file:file r_file_perms; - -# /proc/cmdline -allow cbd proc_cmdline:file r_file_perms; - -# /sys/power/wake_unlock -allow cbd sysfs_wake_lock:file rw_file_perms; - -# /sys/devices/platform/10000.mif_pdata/sim/ -allow cbd sysfs_sim:dir r_dir_perms; -allow cbd sysfs_sim:file r_file_perms; - -# /sys/devices/platform/10000.mif_pdata/sim/ds_detect -allow cbd sysfs_sim_writable:file rw_file_perms; - -# kernel log -allow cbd kernel:system syslog_read; - -# vendor.cbd. -set_prop(cbd, vendor_cbd_prop) - -# FIXME: Can we be more specific? -allow cbd vendor_shell_exec:file execute_no_trans; -# FIXME END -allow cbd factoryprop_efs_file:file r_file_perms; -allow cbd sysfs_info:file r_file_perms; diff --git a/universal7885-common/sepolicy/vendor/crash_dump.te b/universal7885-common/sepolicy/vendor/crash_dump.te deleted file mode 100644 index 578bee5..0000000 --- a/universal7885-common/sepolicy/vendor/crash_dump.te +++ /dev/null @@ -1,5 +0,0 @@ -get_prop(crash_dump, hwservicemanager_prop) -get_prop(crash_dump, exported_camera_prop) -#get_prop(crash_dump, vendor_default_prop) - -allow crash_dump app_data_file:file read; diff --git a/universal7885-common/sepolicy/vendor/device.te b/universal7885-common/sepolicy/vendor/device.te index 56b3f6a..e35c595 100644 --- a/universal7885-common/sepolicy/vendor/device.te +++ b/universal7885-common/sepolicy/vendor/device.te @@ -1,36 +1,7 @@ -# device.te - -type tz_device, dev_type; -type tz_user_device, dev_type; # /dev/m2m1shot_scaler0 type m2m1shot_device, dev_type; - # gps type gps_device, dev_type; -# /dev/goodix_fp -type goodix_device, dev_type; - -# device.te -type efs_block_device, dev_type; -type dqmdbg_block_device, dev_type; -type dtbo_block_device, dev_type; -type keydata_block_device, dev_type; -type keyrefuge_block_device, dev_type; -type modem_block_device, dev_type; -type omr_block_device, dev_type; -type radio_block_device, dev_type; -type sec_efs_block_device, dev_type; - -type bbd_device, dev_type; -type cpu_dma_device, dev_type; -type drb_device, dev_type; -type epic_device, dev_type; -type fp_sensor_device, dev_type; -type io_device, dev_type; -type pm_qos_device, dev_type; -type radio_qos_device, dev_type; -type ssp_device, dev_type; -type vendor_radio_device, dev_type; - +# /dev/goodix_fp, /dev/egis0 type drm_device, dev_type; diff --git a/universal7885-common/sepolicy/vendor/domain.te b/universal7885-common/sepolicy/vendor/domain.te deleted file mode 100644 index 95e5380..0000000 --- a/universal7885-common/sepolicy/vendor/domain.te +++ /dev/null @@ -1,16 +0,0 @@ -# domain.te - -# /sys/kernel/debug/mali -allow domain debugfs_mali:dir search; - -# /sys/kernel/debug/mali/mem -allow domain debugfs_mali_mem:dir search; - -# /sys/kernel/debug/dma_buf -allow domain debugfs_ion_dma:dir search; - -# /sys/kernel/debug/ion -allow domain debugfs_ion:dir search; - -# /sys/kernel/debug/tracing/trace_marker -allow domain debugfs_trace_marker:file getattr; diff --git a/universal7885-common/sepolicy/vendor/file.te b/universal7885-common/sepolicy/vendor/file.te index bc10f8f..e899b08 100644 --- a/universal7885-common/sepolicy/vendor/file.te +++ b/universal7885-common/sepolicy/vendor/file.te @@ -1,121 +1,26 @@ -### DATA -type biometrics_vendor_data_file, file_type, data_file_type; -type conn_vendor_data_file, file_type, data_file_type; -type gps_vendor_data_file, file_type, data_file_type; -type log_vendor_data_file, file_type, data_file_type; -type log_cbd_vendor_data_file, file_type, data_file_type; -type radio_vendor_data_file, file_type, data_file_type; -type wifi_vendor_data_file, file_type, data_file_type; - -# EFS -type app_efs_file, file_type; -type battery_efs_file, file_type; -type bin_nv_data_efs_file, file_type; -type cpk_efs_file, file_type; -type imei_efs_file, file_type; -type nfc_efs_file, file_type; -type pfw_efs_file, file_type; -type prov_efs_file, file_type; -type sec_efs_file, file_type; -type tee_efs_file, file_type; -type wifi_efs_file, file_type; - -# PROC -type proc_last_kmsg, fs_type, proc_type; - -# SOCKETS -type epicd_socket, file_type, data_file_type; - -### SYSFS -type sysfs_sec_ccic, sysfs_type, rw_fs_type, fs_type; -type sysfs_argos, sysfs_type, r_fs_type, fs_type; -type sysfs_bbd, sysfs_type, r_fs_type, fs_type; -type sysfs_fingerprint, sysfs_type, r_fs_type, fs_type; -type sysfs_iio, sysfs_type, r_fs_type, fs_type; -type sysfs_input, sysfs_type, r_fs_type, fs_type; -type sysfs_sec_gps, sysfs_type, r_fs_type, fs_type; -type sysfs_sec_key, sysfs_type, r_fs_type, fs_type; -type sysfs_sec_sensors, sysfs_type, r_fs_type, fs_type; -type sysfs_sim, sysfs_type, r_fs_type, fs_type; -type sysfs_sensors, sysfs_type, r_fs_type, fs_type; -type sysfs_wifi, sysfs_type, r_fs_type, fs_type; -type sysfs_mmc, sysfs_type, r_fs_type, fs_type; -type sysfs_backlight_writable, sysfs_type, rw_fs_type, fs_type; -type sysfs_bt_writable, sysfs_type, rw_fs_type, fs_type; -type sysfs_mmc_uevent, sysfs_type, rw_fs_type, fs_type; -type sysfs_mmc_queue, sysfs_type, rw_fs_type, fs_type; -type sysfs_gps_writable, sysfs_type, rw_fs_type, fs_type; -type sysfs_lcd_writable, sysfs_type, rw_fs_type, fs_type; -type sysfs_power_writable, sysfs_type, rw_fs_type, fs_type; -type sysfs_scsi_host_writable, sysfs_type, rw_fs_type, fs_type; -type sysfs_sensorhub_writable, sysfs_type, rw_fs_type, fs_type; -type sysfs_sensors_writable, sysfs_type, rw_fs_type, fs_type; -type sysfs_sim_writable, sysfs_type, rw_fs_type, fs_type; -type sysfs_spi_writeable, sysfs_type, rw_fs_type, fs_type; -type sysfs_wifi_writable, sysfs_type, rw_fs_type, fs_type; -type sysfs_printk, sysfs_type, rw_fs_type, fs_type; -type sysfs_devfreq, sysfs_type, r_fs_type, fs_type; - -### VENDOR -type vendor_firmware_file, file_type, vendor_file_type; - -# DATA -type tee_vendor_data_file, file_type, data_file_type; - -# DEV SOCKET -type tz_socket, file_type; - -### efs types -type radio_factoryapp_efs_file, file_type; -type factoryprop_efs_file, file_type; -type sensor_factoryapp_efs_file, file_type; -type factorymode_factoryapp_efs_file, file_type; -type baro_delta_factoryapp_efs_file, file_type; -# gps -type gps_socket, file_type; -# debugfs types -type debugfs_mali, fs_type, debugfs_type; -type debugfs_mali_mem, fs_type, debugfs_type; -type debugfs_ion, fs_type, debugfs_type; -type debugfs_ion_dma, fs_type, debugfs_type; -# cache -type boot_logcat_file, file_type, data_file_type; # proc -type proc_extra, fs_type, proc_type; -type proc_reset_reason, fs_type, proc_type; -type proc_swapiness, fs_type, proc_type; +type proc_swappiness, fs_type, proc_type; # data types -type display_vendor_data_file, file_type, data_file_type; -type fingerprintd_vendor_data_file, data_file_type, file_type; type mediadrm_data_file, file_type, data_file_type; type nfc_vendor_data_file, file_type, data_file_type; +type sensors_data_file, file_type, data_file_type; # sysfs types -type sysfs_battery_info, sysfs_type, fs_type; -type sysfs_battery_supply, sysfs_type, rw_fs_type, fs_type; type sysfs_abox_writable, sysfs_type, rw_fs_type, fs_type; -type sysfs_sensor_writable, sysfs_type, rw_fs_type, fs_type; type sysfs_input_writable, sysfs_type, rw_fs_type, fs_type; -type sysfs_batteryinfo_charger_writable, sysfs_type, rw_fs_type, fs_type; type sysfs_camera_writable, sysfs_type, rw_fs_type, fs_type; type sysfs_decon, sysfs_type, r_fs_type, fs_type; type sysfs_socinfo, sysfs_type, r_fs_type, fs_type; -type sysfs_v4l, sysfs_type, r_fs_type, fs_type; type sysfs_v4l_mfc, sysfs_type, r_fs_type, fs_type; type sysfs_v4l_smfc, sysfs_type, r_fs_type, fs_type; +type sysfs_devfreq, sysfs_type, r_fs_type, fs_type; type sysfs_v4l_fimc, sysfs_type, r_fs_type, fs_type; type sysfs_graphics, fs_type, sysfs_type; type sysfs_multipdp, fs_type, sysfs_type, mlstrustedobject; -type sysfs_sec, fs_type, sysfs_type, mlstrustedobject; -type sysfs_gps, fs_type, sysfs_type, mlstrustedobject; -type sysfs_brightness, fs_type, sysfs_type, mlstrustedobject; type sysfs_fuelgauge, fs_type, sysfs_type, mlstrustedobject; type sysfs_charger, fs_type, sysfs_type, mlstrustedobject; type sysfs_modem, fs_type, sysfs_type, mlstrustedobject; -type sysfs_camera, fs_type, sysfs_type, mlstrustedobject; -type sysfs_mmc_host_writable, sysfs_type, rw_fs_type, fs_type; +type sysfs_mmc, sysfs_type, rw_fs_type, fs_type; type sysfs_ss_writable, sysfs_type, rw_fs_type, fs_type; -type sysfs_usb_writable, sysfs_type, rw_fs_type, fs_type; type sysfs_gpu_writable, sysfs_type, rw_fs_type, fs_type; -type sysfs_info, sysfs_type, r_fs_type, fs_type; diff --git a/universal7885-common/sepolicy/vendor/file_contexts b/universal7885-common/sepolicy/vendor/file_contexts index ad8dac3..a67e41d 100644 --- a/universal7885-common/sepolicy/vendor/file_contexts +++ b/universal7885-common/sepolicy/vendor/file_contexts @@ -1,152 +1,11 @@ -# file_contexts - -# DATA -/data/vendor/tee(/.*)? u:object_r:tee_vendor_data_file:s0 - -# DEV -/dev/socket/tz u:object_r:tz_socket:s0 -/dev/tuihw u:object_r:tz_device:s0 -/dev/tzdev u:object_r:tz_user_device:s0 -/dev/tzic u:object_r:tz_device:s0 -/dev/tzirs u:object_r:tz_device:s0 -/dev/tziwsock u:object_r:tz_user_device:s0 - -# VENDOR -/(vendor|system/vendor)/bin/tzdaemon u:object_r:tzdaemon_exec:s0 -/(vendor|system/vendor)/bin/tzts_daemon u:object_r:tztsdaemon_exec:s0 - -/(vendor|system/vendor)/lib(64)?/libteecl\.so u:object_r:same_process_hal_file:s0 -### DATA -/data/vendor/biometrics(/.*)? u:object_r:biometrics_vendor_data_file:s0 -/data/vendor/conn(/.*)? u:object_r:conn_vendor_data_file:s0 -/data/vendor/gps(/.*)? u:object_r:gps_vendor_data_file:s0 -/data/vendor/wifi(/.*)? u:object_r:wifi_vendor_data_file:s0 -/data/vendor/log(/.*)? u:object_r:log_vendor_data_file:s0 -/data/vendor/log/cbd(/.*)? u:object_r:log_cbd_vendor_data_file:s0 -/data/vendor/secradio(/.*)? u:object_r:radio_vendor_data_file:s0 - -### DEV -/dev/block/platform/.+/by-name/boot u:object_r:boot_block_device:s0 -/dev/block/platform/.+/by-name/cache u:object_r:cache_block_device:s0 -/dev/block/platform/.+/by-name/efs u:object_r:efs_block_device:s0 -/dev/block/platform/.+/by-name/dqmdbg u:object_r:dqmdbg_block_device:s0 -/dev/block/platform/.+/by-name/dtbo u:object_r:dtbo_block_device:s0 -/dev/block/platform/.+/by-name/keydata u:object_r:keydata_block_device:s0 -/dev/block/platform/.+/by-name/keyrefuge u:object_r:keyrefuge_block_device:s0 -/dev/block/platform/.+/by-name/metadata u:object_r:metadata_block_device:s0 -/dev/block/platform/.+/by-name/misc u:object_r:misc_block_device:s0 -/dev/block/platform/.+/by-name/modem u:object_r:modem_block_device:s0 -/dev/block/platform/.+/by-name/persistent u:object_r:frp_block_device:s0 -/dev/block/platform/.+/by-name/radio u:object_r:radio_block_device:s0 -/dev/block/platform/.+/by-name/recovery u:object_r:recovery_block_device:s0 -/dev/block/platform/.+/by-name/sec_efs u:object_r:sec_efs_block_device:s0 -/dev/block/platform/.+/by-name/super u:object_r:super_block_device:s0 -/dev/block/platform/.+/by-name/userdata u:object_r:userdata_block_device:s0 -/dev/block/platform/.+/by-name/omr u:object_r:metadata_block_device:s0 - -/dev/esfp[0-9] u:object_r:fp_sensor_device:s0 -/dev/batch_io u:object_r:io_device:s0 -/dev/ssp_sensorhub u:object_r:ssp_device:s0 - -# bluetooth -/dev/ttySAC[0-9] u:object_r:bt_device:s0 - -# cpu -/dev/cpu_dma_latency u:object_r:cpu_dma_device:s0 - -### epic -/dev/mode u:object_r:epic_device:s0 -/dev/socket/epic u:object_r:epicd_socket:s0 - -### gnss/gps -/dev/bbd_control u:object_r:bbd_device:s0 -/dev/bbd_packet u:object_r:bbd_device:s0 -/dev/bbd_patch u:object_r:bbd_device:s0 -/dev/bbd_reliable u:object_r:bbd_device:s0 -/dev/bbd_sensor u:object_r:bbd_device:s0 -/dev/bbd_sio u:object_r:bbd_device:s0 -/dev/bbd_urgent_patch u:object_r:bbd_device:s0 -/dev/ttyBCM[0-9]* u:object_r:bbd_device:s0 - -### qos -/dev/bus_throughput u:object_r:pm_qos_device:s0 -/dev/bus_throughput_max u:object_r:pm_qos_device:s0 -/dev/cluster0_freq_max u:object_r:pm_qos_device:s0 -/dev/cluster0_freq_min u:object_r:pm_qos_device:s0 -/dev/cluster1_freq_max u:object_r:pm_qos_device:s0 -/dev/cluster1_freq_min u:object_r:pm_qos_device:s0 -/dev/cluster2_freq_max u:object_r:pm_qos_device:s0 -/dev/cluster2_freq_min u:object_r:pm_qos_device:s0 -/dev/cpu_online_max u:object_r:pm_qos_device:s0 -/dev/cpu_online_min u:object_r:pm_qos_device:s0 -/dev/device_throughput u:object_r:pm_qos_device:s0 -/dev/device_throughput_max u:object_r:pm_qos_device:s0 -/dev/gpu_freq_max u:object_r:pm_qos_device:s0 -/dev/gpu_freq_min u:object_r:pm_qos_device:s0 -/dev/mfc_throughput u:object_r:pm_qos_device:s0 -/dev/mfc_throughput_max u:object_r:pm_qos_device:s0 -/dev/network_throughput u:object_r:radio_qos_device:s0 -/dev/npu_throughput u:object_r:pm_qos_device:s0 -/dev/npu_throughput_max u:object_r:pm_qos_device:s0 - -### radio -# DRB -/dev/drb u:object_r:drb_device:s0 - -# UMTS -/dev/umts_boot0 u:object_r:vendor_radio_device:s0 -/dev/umts_cass u:object_r:vendor_radio_device:s0 -/dev/umts_ipc[0-1] u:object_r:vendor_radio_device:s0 -/dev/umts_dm0 u:object_r:vendor_radio_device:s0 -/dev/umts_rfs0 u:object_r:vendor_radio_device:s0 -/dev/umts_router u:object_r:vendor_radio_device:s0 - -### EFS -/efs/Battery(/.*)? u:object_r:battery_efs_file:s0 -/efs/DAK(/.*)? u:object_r:prov_efs_file:s0 -/efs/afc(/.*)? u:object_r:sec_efs_file:s0 -/efs/bluetooth(/.*)? u:object_r:bluetooth_efs_file:s0 -/efs/cpk(/.*)? u:object_r:cpk_efs_file:s0 -/efs/imei(/.*)? u:object_r:imei_efs_file:s0 -/efs/nfc(/.*)? u:object_r:nfc_efs_file:s0 -/efs/nv_data\.bin(.*) u:object_r:bin_nv_data_efs_file:s0 -/efs/pfw_data(/.*)? u:object_r:pfw_efs_file:s0 -/efs/prov(/.*)? u:object_r:prov_efs_file:s0 -/efs/prov_data(/.*)? u:object_r:prov_efs_file:s0 -/efs/root(/.*)? u:object_r:app_efs_file:s0 -/efs/tee(/.*)? u:object_r:tee_efs_file:s0 -/efs/wifi(/.*)? u:object_r:wifi_efs_file:s0 - -/mnt/vendor/efs(/.*)? u:object_r:efs_file:s0 -/mnt/vendor/efs/DAK(/.*)? u:object_r:prov_efs_file:s0 -/mnt/vendor/efs/afc(/.*)? u:object_r:sec_efs_file:s0 -/mnt/vendor/efs/bluetooth(/.*)? u:object_r:bluetooth_efs_file:s0 -/mnt/vendor/efs/cpk(/.*)? u:object_r:cpk_efs_file:s0 -/mnt/vendor/efs/imei(/.*)? u:object_r:imei_efs_file:s0 -/mnt/vendor/efs/nv_data\.bin(.*) u:object_r:bin_nv_data_efs_file:s0 -/mnt/vendor/efs/pfw_data(/.*)? u:object_r:pfw_efs_file:s0 -/mnt/vendor/efs/prov(/.*)? u:object_r:prov_efs_file:s0 -/mnt/vendor/efs/prov_data(/.*)? u:object_r:prov_efs_file:s0 -/mnt/vendor/efs/root(/.*)? u:object_r:app_efs_file:s0 -/mnt/vendor/efs/tee(/.*)? u:object_r:tee_efs_file:s0 -/mnt/vendor/efs/wifi(/.*)? u:object_r:wifi_efs_file:s0 - -### VENDOR -/(vendor|system/vendor)/bin/cbd u:object_r:cbd_exec:s0 -/(vendor|system/vendor)/bin/secril_config_svc u:object_r:secril_config_svc_exec:s0 - -/(vendor|system/vendor)/bin/hw/android\.hardware\.biometrics\.fingerprint@[0-9].[0-9]-service\.samsung u:object_r:hal_fingerprint_default_exec:s0 -/(vendor|system/vendor)/bin/hw/android\.hardware\.light(@[0-9].[0-9])?-service\.samsung u:object_r:hal_light_default_exec:s0 -/(vendor|system/vendor)/bin/hw/android\.hardware\.thermal@[0-9].[0-9]-service\.samsung u:object_r:hal_thermal_default_exec:s0 - #################################### # Devices /dev/mali[0-9]* u:object_r:gpu_device:s0 /dev/umts_ipc0 u:object_r:radio_device:s0 /dev/fimg2d u:object_r:video_device:s0 /dev/sec-nfc u:object_r:nfc_device:s0 -/dev/esfp0 u:object_r:goodix_device:s0 -/dev/goodix_fp u:object_r:goodix_device:s0 +/dev/esfp0 u:object_r:fp_sensor_device:s0 +/dev/goodix_fp u:object_r:fp_sensor_device:s0 /dev/gnss_ipc u:object_r:gps_device:s0 /dev/scsc_h4_0 u:object_r:bt_device:s0 /dev/cpuset(/.*)? u:object_r:cgroup:s0 @@ -155,7 +14,7 @@ /dev/m2m1shot_scaler0 u:object_r:m2m1shot_device:s0 # DRM -/dev/s5p-smem u:object_r:drm_device:s0 +/dev/s5p-smem u:object_r:drm_device:s0 # usb /dev/android_ssusbcon(/.*)? u:object_r:usb_device:s0 @@ -176,7 +35,6 @@ /dev/block/platform/.+/by-name/(cache|CACHE)? u:object_r:cache_block_device:s0 /dev/block/platform/.+/by-name/(system|SYSTEM)? u:object_r:system_block_device:s0 /dev/block/platform/.+/by-name/(userdata|USERDATA)? u:object_r:userdata_block_device:s0 -/dev/block/platform/.+/by-name/(keyrefuge|KEYREFUGE)? u:object_r:keyrefuge_block_device:s0 /dev/block/platform/.+/by-name/(persistent|PERSISTENT)? u:object_r:frp_block_device:s0 /dev/block/platform/.+/by-name/(boot|BOOT)? u:object_r:boot_block_device:s0 /dev/block/platform/.+/by-name/(recovery|RECOVERY)? u:object_r:recovery_block_device:s0 @@ -184,40 +42,21 @@ #################################### # efs /mnt/vendor/cpefs(/.*)? u:object_r:efs_file:s0 +/factory(/.*)? u:object_r:sec_efs_file:s0 #################################### # data files /data/vendor/nfc(/.*)? u:object_r:nfc_vendor_data_file:s0 -# drm /data/vendor/mediadrm(/.*)? u:object_r:mediadrm_data_file:s0 - -# camera -/data/camera(/.*)? u:object_r:camera_data_file:s0 +/data/vendor/yas_lib(/.*)? u:object_r:sensors_data_file:s0 #################################### ### VENDOR -/(vendor|system/vendor)/lib(64)?/hw/gralloc\.exynos7884B\.so u:object_r:same_process_hal_file:s0 -/(vendor|system/vendor)/lib(64)?/hw/gralloc\.exynos7904\.so u:object_r:same_process_hal_file:s0 -/(vendor|system/vendor)/lib(64)?/libion_exynos\.so u:object_r:same_process_hal_file:s0 -/(vendor|system/vendor)/bin/main_abox u:object_r:abox_exec:s0 -/(vendor|system/vendor)/bin/wlbtd u:object_r:wlbtd_exec:s0 -/system/bin/multiclientd u:object_r:multiclientd_exec:s0 -/(vendor|system/vendor)/bin/hw/gpsd u:object_r:gpsd_exec:s0 -/(vendor|system/vendor)/bin/hw/macloader u:object_r:macloader_exec:s0 -/(vendor|system/vendor)/bin/hw/android\.hardware\.power(@[0-9]\.[0-9])?-service\.samsung-libperfmgr u:object_r:hal_power_default_exec:s0 -/(vendor|system/vendor)/bin/hw/android\.hardware\.vibrator(@[0-9].[0-9])?-service\.samsung u:object_r:hal_vibrator_default_exec:s0 -/(vendor|system/vendor)/bin/hw/android\.hardware\.drm@[0-9]\.[0-9]-service\.clearkey u:object_r:hal_drm_clearkey_exec:s0 -/(vendor|system/vendor)/bin/hw/android\.hardware\.drm@[0-9]\.[0-9]-service\.widevine u:object_r:hal_drm_widevine_exec:s0 -/(vendor|system/vendor)/bin/hw/android\.hardware\.memtrack-service\.samsung-mali u:object_r:hal_memtrack_default_exec:s0 -/(vendor|system/vendor)/bin/hw/android\.hardware\.keymaster@[0-9]\.[0-9]-service\.samsung u:object_r:hal_keymaster_default_exec:s0 -/(vendor|system/vendor)/bin/hw/android\.hardware\.nfc@[0-9]\.[0-9]-service\.samsung u:object_r:hal_nfc_default_exec:s0 -/(vendor|system/vendor)/bin/hw/android\.hardware\.usb(@[0-9]\.[0-9])?-service\.samsung u:object_r:hal_usb_default_exec:s0 -/(vendor|system/vendor)/bin/hw/android\.hardware\.camera\.provider@[0-9]\.[0-9]-service\.exynos7885 u:object_r:hal_camera_default_exec:s0 +# Exynos7884'B' +/(vendor|system/vendor)/lib(64)?/hw/gralloc\.exynos[0-9]*B\.so u:object_r:same_process_hal_file:s0 + +/(vendor|system/vendor)/bin/main_abox u:object_r:abox_exec:s0 +/(vendor|system/vendor)/bin/hw/android\.hardware\.camera\.provider@[0-9]\.[0-9]-service\.exynos7885 u:object_r:hal_camera_default_exec:s0 /(vendor|system/vendor)/bin/hw/android\.hardware\.usb@[0-9]\.[0-9]-service\.a10 u:object_r:hal_usb_default_exec:s0 -/(vendor|system/vendor)/bin/hw/vendor\.samsung\.hardware\.gnss@[0-9]\.[0-9]-service u:object_r:hal_gnss_default_exec:s0 -/(vendor|system/vendor)/bin/hw/android\.hardware\.sensors@[0-9]\.[0-9]-service\.a10 u:object_r:hal_sensors_default_exec:s0 -/(vendor|system/vendor)/bin/hw/android\.hardware\.power\.stats-service\.exynos7 u:object_r:hal_power_stats_default_exec:s0 -/(vendor|system/vendor)/firmware(/.*)? u:object_r:vendor_firmware_file:s0 - -/factory(/.*)? u:object_r:sec_efs_file:s0 - +/(vendor|system/vendor)/bin/hw/android\.hardware\.sensors@[0-9]\.[0-9]-service_a10 u:object_r:hal_sensors_default_exec:s0 +/(vendor|system/vendor)/bin/hw/android\.hardware\.power\.stats-service\.exynos7 u:object_r:hal_power_stats_default_exec:s0 diff --git a/universal7885-common/sepolicy/vendor/fsck.te b/universal7885-common/sepolicy/vendor/fsck.te index a1f7a4c..d0af831 100644 --- a/universal7885-common/sepolicy/vendor/fsck.te +++ b/universal7885-common/sepolicy/vendor/fsck.te @@ -1,4 +1,2 @@ -allow fsck cache_file:dir getattr; -allow fsck tmpfs:blk_file getattr; allow fsck efs_block_device:blk_file rw_file_perms; allow fsck omr_block_device:blk_file rw_file_perms; diff --git a/universal7885-common/sepolicy/vendor/genfs_contexts b/universal7885-common/sepolicy/vendor/genfs_contexts index 0a65e76..3adf936 100644 --- a/universal7885-common/sepolicy/vendor/genfs_contexts +++ b/universal7885-common/sepolicy/vendor/genfs_contexts @@ -1,90 +1,14 @@ -# genfs_contexts +# PROCFS +genfscon proc /sys/vm/swappiness u:object_r:proc_swappiness:s0 -### PROC -genfscon proc /last_kmsg u:object_r:proc_last_kmsg:s0 - -### SYSFS -genfscon sysfs /bbd u:object_r:sysfs_bbd:s0 - -genfscon sysfs /bus/iio/devices u:object_r:sysfs_iio:s0 - -genfscon sysfs /class/backlight/ u:object_r:sysfs_backlight_writable:s0 -genfscon sysfs /class/fingerprint/fingerprint u:object_r:sysfs_fingerprint:s0 -genfscon sysfs /class/input u:object_r:sysfs_input:s0 -genfscon sysfs /class/power_supply u:object_r:sysfs_battery:s0 -genfscon sysfs /class/rtc/rtc0 u:object_r:sysfs_rtc:s0 -genfscon sysfs /class/sec/gps u:object_r:sysfs_sec_gps:s0 -genfscon sysfs /class/sec/ccic u:object_r:sysfs_sec_ccic:s0 -genfscon sysfs /class/sec/sensors u:object_r:sysfs_sec_sensors:s0 -genfscon sysfs /class/sensor_event u:object_r:sysfs_sensors:s0 -genfscon sysfs /class/sensors u:object_r:sysfs_sensors:s0 -genfscon sysfs /class/thermal u:object_r:sysfs_thermal:s0 -genfscon sysfs /class/timed_output/vibrator/intensity u:object_r:sysfs_vibrator:s0 -genfscon sysfs /class/timed_output/vibrator/multi_freq u:object_r:sysfs_vibrator:s0 - -genfscon sysfs /devices/platform/argos u:object_r:sysfs_argos:s0 - -genfscon sysfs /devices/platform/13500000.dwmmc0/mmc_host/mmc0/ u:object_r:sysfs_mmc:s0 -genfscon sysfs /devices/platform/13500000.dwmmc0/mmc_host/mmc0/mmc0:0001/block/mmcblk0/queue/ u:object_r:sysfs_mmc_queue:s0 - -genfscon sysfs /devices/platform/13500000.dwmmc0/mmc_host/mmc0/mmc0:0001/block/mmcblk0/uevent u:object_r:sysfs_mmc_uevent:s0 - -genfscon sysfs /devices/virtual/fingerprint/fingerprint u:object_r:sysfs_fingerprint:s0 -genfscon sysfs /devices/virtual/input u:object_r:sysfs_input:s0 -genfscon sysfs /devices/virtual/lcd/panel u:object_r:sysfs_lcd_writable:s0 -genfscon sysfs /devices/virtual/sec/gps u:object_r:sysfs_sec_gps:s0 -genfscon sysfs /devices/virtual/sec/sec_key u:object_r:sysfs_sec_key:s0 -genfscon sysfs /devices/virtual/sec/ccic u:object_r:sysfs_sec_ccic:s0 -genfscon sysfs /devices/virtual/sensor_event u:object_r:sysfs_sensors:s0 -genfscon sysfs /devices/virtual/sensors u:object_r:sysfs_sensors:s0 -genfscon sysfs /devices/virtual/sensors/hidden_hole/hh_check_coef u:object_r:sysfs_sensors_writable:s0 -genfscon sysfs /devices/virtual/sensors/ssp_sensor/enable u:object_r:sysfs_sensors_writable:s0 -genfscon sysfs /devices/virtual/sensors/ssp_sensor/ssp_flush u:object_r:sysfs_sensors_writable:s0 -genfscon sysfs /devices/virtual/thermal u:object_r:sysfs_thermal:s0 -genfscon sysfs /devices/virtual/timed_output/vibrator/cp_trigger_index u:object_r:sysfs_vibrator:s0 -genfscon sysfs /devices/virtual/timed_output/vibrator/intensity u:object_r:sysfs_vibrator:s0 -genfscon sysfs /devices/virtual/timed_output/vibrator/multi_freq u:object_r:sysfs_vibrator:s0 - -genfscon sysfs /module/dhd/parameters u:object_r:sysfs_wifi_writable:s0 -genfscon sysfs /module/printk/parameters/enabled u:object_r:sysfs_printk:s0 -genfscon sysfs /power/cpufreq_max_limit u:object_r:sysfs_power_writable:s0 -genfscon sysfs /power/cpufreq_min_limit u:object_r:sysfs_power_writable:s0 -genfscon sysfs /power/cpuhotplug/max_online_cpu u:object_r:sysfs_power_writable:s0 -genfscon sysfs /power/rtc_status u:object_r:sysfs_power_writable:s0 - -genfscon sysfs /wifi u:object_r:sysfs_wifi:s0 -genfscon sysfs /wifi/cid u:object_r:sysfs_wifi_writable:s0 -genfscon sysfs /wifi/mac_addr u:object_r:sysfs_wifi_writable:s0 -genfscon sysfs /wifi/memdump u:object_r:sysfs_wifi_writable:s0 - -# DEBUGFS -genfscon debugfs /mali/ u:object_r:debugfs_mali:s0 -genfscon debugfs /mali/mem/ u:object_r:debugfs_mali_mem:s0 - -# ion debugfs -genfscon debugfs /ion/ u:object_r:debugfs_ion:s0 -genfscon debugfs /dma_buf u:object_r:debugfs_ion_dma:s0 - -# PROC -genfscon proc /extra u:object_r:proc_extra:s0 -genfscon proc /reset_reason u:object_r:proc_reset_reason:s0 -genfscon proc /sys/vm/swappiness u:object_r:proc_swapiness:s0 - -# SYSFS - -# class -genfscon sysfs /class/video4linux u:object_r:sysfs_v4l:s0 -genfscon sysfs /class/input/input1 u:object_r:sysfs_input:s0 -genfscon sysfs /class/backlight/panel/brightness u:object_r:sysfs_graphics:s0 -genfscon sysfs /class/backlight/panel/max_brightness u:object_r:sysfs_graphics:s0 - -# battery -genfscon sysfs /class/power_supply/battery/ u:object_r:sysfs_battery_info:s0 - -# devices +genfscon sysfs /devices/platform/battery/power_supply/battery/batt_slate_mode u:object_r:sysfs_battery_writable:s0 +# device genfscon sysfs /devices/virtual/misc/multipdp u:object_r:sysfs_multipdp:s0 -genfscon sysfs /devices/virtual/sensors/sensor_dev/flush u:object_r:sysfs_sensor_writable:s0 +genfscon sysfs /devices/virtual/camera u:object_r:sysfs_camera:s0 + +genfscon sysfs /devices/platform/gpio_keys/input/ u:object_r:sysfs_input:s0 +genfscon sysfs /devices/platform/flip_cover/input/ u:object_r:sysfs_input:s0 genfscon sysfs /devices/virtual/input/input1/enable u:object_r:sysfs_input_writable:s0 genfscon sysfs /devices/virtual/input/input2/enable u:object_r:sysfs_input_writable:s0 genfscon sysfs /devices/virtual/input/input3/enable u:object_r:sysfs_input_writable:s0 @@ -95,7 +19,7 @@ genfscon sysfs /devices/virtual/input/input7/enable genfscon sysfs /devices/virtual/input/input8/enable u:object_r:sysfs_input_writable:s0 genfscon sysfs /devices/virtual/input/input9/enable u:object_r:sysfs_input_writable:s0 genfscon sysfs /devices/virtual/input/input10/enable u:object_r:sysfs_input_writable:s0 -genfscon sysfs /devices/virtual/input/input11/enable u:object_r:sysfs_input_writable:s0 +genfscon sysfs /devices/virtual/input/input11/enable u:object_r:sysfs_input_writable:s0 genfscon sysfs /devices/virtual/input/input12/enable u:object_r:sysfs_input_writable:s0 genfscon sysfs /devices/virtual/input/input1/poll_delay u:object_r:sysfs_input_writable:s0 genfscon sysfs /devices/virtual/input/input2/poll_delay u:object_r:sysfs_input_writable:s0 @@ -106,33 +30,32 @@ genfscon sysfs /devices/virtual/input/input6/poll_delay genfscon sysfs /devices/virtual/input/input7/poll_delay u:object_r:sysfs_input_writable:s0 genfscon sysfs /devices/virtual/input/input8/poll_delay u:object_r:sysfs_input_writable:s0 genfscon sysfs /devices/virtual/input/input9/poll_delay u:object_r:sysfs_input_writable:s0 -genfscon sysfs /devices/virtual/input/input10/poll_delay u:object_r:sysfs_input_writable:s0 -genfscon sysfs /devices/virtual/input/input11/poll_delay u:object_r:sysfs_input_writable:s0 -genfscon sysfs /devices/virtual/input/input12/poll_delay u:object_r:sysfs_input_writable:s0 +genfscon sysfs /devices/virtual/input/input10/poll_delay u:object_r:sysfs_input_writable:s0 +genfscon sysfs /devices/virtual/input/input11/poll_delay u:object_r:sysfs_input_writable:s0 +genfscon sysfs /devices/virtual/input/input12/poll_delay u:object_r:sysfs_input_writable:s0 +genfscon sysfs /devices/virtual/sensors/sensor_dev/flush u:object_r:sysfs_input_writable:s0 -# A20e GPIO -genfscon sysfs /devices/platform/gpio_keys/input/input12 u:object_r:sysfs_input:s0 -# A20 GPIO -genfscon sysfs /devices/platform/gpio_keys/input/input13 u:object_r:sysfs_input:s0 -genfscon sysfs /devices/platform/flip_cover/input/input13 u:object_r:sysfs_input:s0 +genfscon sysfs /devices/virtual/sec/hall_ic/ u:object_r:sysfs_sec_key:s0 genfscon sysfs /devices/platform/10000.mif_pdata/sim/ds_detect u:object_r:sysfs_sim_writable:s0 + # A20e RTC -genfscon sysfs /devices/platform/11ce0000.speedy/i2c-5/5-0000/s2mpu08-rtc/rtc u:object_r:sysfs_rtc:s0 +genfscon sysfs /devices/platform/11ce0000.speedy/i2c-5/5-0000/s2mpu08-rtc/rtc u:object_r:sysfs_rtc:s0 # A20 RTC genfscon sysfs /devices/platform/11ce0000.speedy/i2c-6/6-0000/s2mpu08-rtc/rtc u:object_r:sysfs_rtc:s0 # A40 RTC genfscon sysfs /devices/platform/11ce0000.speedy/i2c-7/7-0000/s2mpu08-rtc/rtc u:object_r:sysfs_rtc:s0 # A20e Display -genfscon sysfs /devices/platform/13870000.i2c/i2c-11/11-0048/input/ u:object_r:sysfs_touchscreen_writable:s0 +genfscon sysfs /devices/platform/13870000.i2c/i2c-11/11-0048/input/ u:object_r:sysfs_touchscreen_writable:s0 genfscon sysfs /devices/platform/11ce0000.speedy/i2c-5/5-0003/input/input11 u:object_r:sysfs_touchscreen_writable:s0 # A20 Display -genfscon sysfs /devices/platform/13870000.i2c/i2c-11/11-0020/input/ u:object_r:sysfs_touchscreen_writable:s0 -genfscon sysfs /devices/platform/11ce0000.speedy/i2c-6/6-0003/input/input12 u:object_r:sysfs_touchscreen_writable:s0 +genfscon sysfs /devices/platform/13870000.i2c/i2c-11/11-0020/input/ u:object_r:sysfs_touchscreen_writable:s0 +genfscon sysfs /devices/platform/11ce0000.speedy/i2c-6/6-0003/input/input12 u:object_r:sysfs_touchscreen_writable:s0 # A40 Display genfscon sysfs /devices/platform/11ce0000.speedy/i2c-7/7-0003/input/input11 u:object_r:sysfs_touchscreen_writable:s0 genfscon sysfs /devices/platform/13930000.hsi2c/i2c-5/5-0048/input/ u:object_r:sysfs_touchscreen_writable:s0 +genfscon sysfs /devices/platform/13500000.dwmmc0/mmc_host/mmc0 u:object_r:sysfs_mmc:s0 genfscon sysfs /devices/platform/14870000.dsim/backlight/panel u:object_r:sysfs_graphics:s0 genfscon sysfs /devices/platform/14a50000.abox/service u:object_r:sysfs_abox_writable:s0 genfscon sysfs /devices/platform/14860000.decon_f u:object_r:sysfs_decon:s0 @@ -143,45 +66,42 @@ genfscon sysfs /devices/platform/14440000.fimc_is/video4linux genfscon sysfs /devices/platform/12c30000.mfc0/video4linux u:object_r:sysfs_v4l_mfc:s0 genfscon sysfs /devices/platform/12c00000.smfc/video4linux u:object_r:sysfs_v4l_smfc:s0 genfscon sysfs /devices/soc0/soc_id u:object_r:sysfs_socinfo:s0 -genfscon sysfs /devices/soc0/machine u:object_r:sysfs_sec_gps:s0 -genfscon sysfs /devices/soc0/revision u:object_r:sysfs_sec_gps:s0 -genfscon sysfs /devices/virtual/block/zram0/mm_stat u:object_r:sysfs_zram:s0 +genfscon sysfs /devices/soc0/machine u:object_r:sysfs_socinfo:s0 +genfscon sysfs /devices/soc0/revision u:object_r:sysfs_socinfo:s0 genfscon sysfs /devices/system/chip-id/revision u:object_r:sysfs_ss_writable:s0 # Devfreq -genfscon sysfs /devices/platform/17000010.devfreq_mif/devfreq/17000010.devfreq_mif u:object_r:sysfs_devfreq:s0 +genfscon sysfs /devices/platform/17000010.devfreq_mif/devfreq/17000010.devfreq_mif u:object_r:sysfs_devfreq:s0 genfscon sysfs /devices/platform/17000020.devfreq_int/devfreq/17000020.devfreq_int u:object_r:sysfs_devfreq:s0 -genfscon sysfs /devices/platform/17000040.devfreq_disp/devfreq/17000040.devfreq_disp u:object_r:sysfs_devfreq:s0 +genfscon sysfs /devices/platform/17000040.devfreq_disp/devfreq/17000040.devfreq_disp u:object_r:sysfs_devfreq:s0 genfscon sysfs /devices/platform/17000050.devfreq_cam/devfreq/17000050.devfreq_cam u:object_r:sysfs_devfreq:s0 genfscon sysfs /devices/platform/17000060.devfreq_aud/devfreq/17000060.devfreq_aud u:object_r:sysfs_devfreq:s0 -genfscon sysfs /devices/platform/17000070.devfreq_fsys/devfreq/17000070.devfreq_fsys u:object_r:sysfs_devfreq:s0 +genfscon sysfs /devices/platform/17000070.devfreq_fsys/devfreq/17000070.devfreq_fsys u:object_r:sysfs_devfreq:s0 # S2MU005 CHARGER (A10) genfscon sysfs /devices/platform/13840000.i2c/i2c-9/9-003d/s2mu004-charger/power_supply/s2mu004-charger u:object_r:sysfs_charger:s0 genfscon sysfs /devices/platform/13840000.i2c/i2c-9/9-003d/s2mu004-muic/power_supply/muic-manager u:object_r:sysfs_charger:s0 -genfscon sysfs /devices/platform/13840000.i2c/i2c-9/9-003d/s2mu004-charger/power_supply/otg u:object_r:sysfs_charger:s0 -genfscon sysfs /devices/platform/13840000.i2c/i2c-8/8-003d/s2mu005-charger/power_supply/otg/type u:object_r:sysfs_charger:s0 +genfscon sysfs /devices/platform/13840000.i2c/i2c-9/9-003d/s2mu004-charger/power_supply/otg u:object_r:sysfs_charger:s0 +genfscon sysfs /devices/platform/13840000.i2c/i2c-8/8-003d/s2mu005-charger/power_supply/otg/type u:object_r:sysfs_charger:s0 # S2MU106 CHARGER (A20e) genfscon sysfs /devices/platform/13840000.i2c/i2c-8/8-003d/s2mu106-powermeter/power_supply/s2mu106_pmeter u:object_r:sysfs_charger:s0 genfscon sysfs /devices/platform/13840000.i2c/i2c-8/8-003d/s2mu106-muic/power_supply/muic-manager u:object_r:sysfs_charger:s0 genfscon sysfs /devices/platform/13840000.i2c/i2c-8/8-003d/s2mu106-charger/power_supply/otg u:object_r:sysfs_charger:s0 genfscon sysfs /devices/platform/13840000.i2c/i2c-8/8-003d/s2mu106-charger/power_supply/s2mu106-charger u:object_r:sysfs_charger:s0 -genfscon sysfs /devices/platform/13830000.i2c/i2c-7/7-003c/power_supply/s2mu106-usbpd/type u:object_r:sysfs_charger:s0 -genfscon sysfs /devices/platform/13830000.i2c/i2c-7/7-003b/power_supply/s2mu106-fuelgauge/type u:object_r:sysfs_fuelgauge:s0 +genfscon sysfs /devices/platform/13830000.i2c/i2c-7/7-003c/power_supply/s2mu106-usbpd/type u:object_r:sysfs_charger:s0 +genfscon sysfs /devices/platform/13830000.i2c/i2c-7/7-003b/power_supply/s2mu106-fuelgauge/type u:object_r:sysfs_fuelgauge:s0 # S2MU106 CHARGER (A20) genfscon sysfs /devices/platform/13840000.i2c/i2c-9/9-003d/s2mu106-powermeter/power_supply/s2mu106_pmeter u:object_r:sysfs_charger:s0 genfscon sysfs /devices/platform/13840000.i2c/i2c-9/9-003d/s2mu106-muic/power_supply/muic-manager u:object_r:sysfs_charger:s0 genfscon sysfs /devices/platform/13840000.i2c/i2c-9/9-003d/s2mu106-charger/power_supply/otg u:object_r:sysfs_charger:s0 genfscon sysfs /devices/platform/13840000.i2c/i2c-9/9-003d/s2mu106-charger/power_supply/s2mu106-charger u:object_r:sysfs_charger:s0 -genfscon sysfs /devices/platform/13830000.i2c/i2c-8/8-003c/power_supply/s2mu106-usbpd/type u:object_r:sysfs_charger:s0 -genfscon sysfs /devices/platform/13830000.i2c/i2c-8/8-003b/power_supply/s2mu106-fuelgauge/type u:object_r:sysfs_fuelgauge:s0 +genfscon sysfs /devices/platform/13830000.i2c/i2c-8/8-003c/power_supply/s2mu106-usbpd/type u:object_r:sysfs_charger:s0 +genfscon sysfs /devices/platform/13830000.i2c/i2c-8/8-003b/power_supply/s2mu106-fuelgauge/type u:object_r:sysfs_fuelgauge:s0 -genfscon sysfs /class/input/input1/enabled u:object_r:sysfs_sec_touchscreen:s0 genfscon sysfs /module/modem_ctrl_ss310ap/parameters/ds_detect u:object_r:sysfs_modem:s0 genfscon sysfs /module/scsc_bt/parameters/bluetooth_address u:object_r:sysfs_bt_writable:s0 -genfscon sysfs /firmware/devicetree/base/model_info-system_rev u:object_r:sysfs_info:s0 genfscon sysfs /kernel/gpu/ u:object_r:sysfs_gpu:s0 genfscon sysfs /kernel/gpu/gpu_max_clock u:object_r:sysfs_gpu_writable:s0 genfscon sysfs /kernel/gpu/gpu_min_clock u:object_r:sysfs_gpu_writable:s0 diff --git a/universal7885-common/sepolicy/vendor/gpsd.te b/universal7885-common/sepolicy/vendor/gpsd.te index f61cc40..2c24116 100644 --- a/universal7885-common/sepolicy/vendor/gpsd.te +++ b/universal7885-common/sepolicy/vendor/gpsd.te @@ -1,47 +1,5 @@ -type gpsd, domain, netdomain; -type gpsd_exec, exec_type, vendor_file_type, file_type; - -# gpsd is started by init, type transit from init domain to gpsd domain -init_daemon_domain(gpsd) - -allow gpsd rild:unix_stream_socket connectto; - -get_prop(gpsd, vendor_radio_prop) -allow gpsd system_data_file:dir search; - -get_prop(gpsd, telephony_config_prop) -get_prop(gpsd, exported_config_prop) - -get_prop(gpsd, hwservicemanager_prop) -hwbinder_use(gpsd) -allow gpsd system_suspend_hwservice:hwservice_manager { find }; -allow gpsd fwk_sensor_hwservice:hwservice_manager { find }; - -binder_call(gpsd, system_suspend_server) -binder_call(gpsd, system_server) -binder_call(system_server, gpsd) - -allow gpsd self:netlink_kobject_uevent_socket create_socket_perms_no_ioctl; -allow gpsd self:{ tcp_socket udp_socket } create_stream_socket_perms; -allow gpsd port:tcp_socket { name_bind name_connect }; -allow gpsd port:udp_socket name_bind; -allow gpsd node:{ tcp_socket udp_socket } node_bind; - -# /acct/tasks -allow gpsd cgroup:file getattr; - -# /dev/socket/fwmarkd -allow gpsd fwmarkd_socket:sock_file write; - -# /data/vendor/gps -allow gpsd gps_vendor_data_file:dir rw_dir_perms; -allow gpsd gps_vendor_data_file:file create_file_perms; -allow gpsd gps_vendor_data_file:fifo_file create_file_perms; - -r_dir_file(gpsd, sysfs_sec_gps) - -allow gpsd sysfs_gps_writable:file rw_file_perms; allow gpsd sysfs_wake_lock:file rw_file_perms; +allow gpsd sysfs_socinfo:file r_file_perms; allow gpsd self:capability net_raw; allow gpsd self:capability2 block_suspend; @@ -50,7 +8,8 @@ allow gpsd bt_device:chr_file rw_file_perms; allow gpsd gps_device:chr_file rw_file_perms; allow gpsd gpsd_exec:file execute_no_trans; -get_prop(gpsd, exported_config_prop) -get_prop(gpsd, bootanim_system_prop) allow gpsd servicemanager:binder call; allow gpsd hal_system_suspend_service:service_manager find; + +get_prop(gpsd, exported_config_prop) +get_prop(gpsd, bootanim_system_prop) diff --git a/universal7885-common/sepolicy/vendor/gpuservice.te b/universal7885-common/sepolicy/vendor/gpuservice.te deleted file mode 100644 index be795e9..0000000 --- a/universal7885-common/sepolicy/vendor/gpuservice.te +++ /dev/null @@ -1 +0,0 @@ -get_prop(gpuservice, graphics_config_prop) diff --git a/universal7885-common/sepolicy/vendor/hal_bluetooth_default.te b/universal7885-common/sepolicy/vendor/hal_bluetooth_default.te deleted file mode 100644 index 52f06cb..0000000 --- a/universal7885-common/sepolicy/vendor/hal_bluetooth_default.te +++ /dev/null @@ -1,24 +0,0 @@ - -# ro.rfkilldisabled -get_prop(hal_bluetooth_default, rfkilldisabled_prop) -# vendor.bluetooth_fw_ver -set_prop(hal_bluetooth_default, wifi_log_prop) -# sys.bluetooth.tty -set_prop(hal_bluetooth_default, exported_bluetooth_prop) - -# /dev/ttySAC[0-9] -allow hal_bluetooth_default bt_device:chr_file rw_file_perms; - -# /mnt/vendor -allow hal_bluetooth_default mnt_vendor_file:dir search; - -# /mnt/vendor/efs/ -allow hal_bluetooth_default efs_file:dir r_dir_perms; - -# /mnt/vendor/conn -allow hal_bluetooth_default conn_vendor_data_file:dir r_dir_perms; -allow hal_bluetooth_default conn_vendor_data_file:file r_file_perms; - -# /sys/devices/platform/bluetooth/rfkill/rfkill0/state -allow hal_bluetooth_default sysfs_bt_writable:file rw_file_perms; -allow hal_bluetooth_default vendor_firmware_file:dir r_dir_perms; diff --git a/universal7885-common/sepolicy/vendor/hal_camera_default.te b/universal7885-common/sepolicy/vendor/hal_camera_default.te index 029f56e..f4f6d08 100644 --- a/universal7885-common/sepolicy/vendor/hal_camera_default.te +++ b/universal7885-common/sepolicy/vendor/hal_camera_default.te @@ -1,25 +1,11 @@ -vndbinder_use(hal_camera_default) - -allow hal_camera_default vndbinder_device:chr_file r_file_perms; allow hal_camera_default hal_graphics_mapper_hwservice:hwservice_manager find; allow hal_camera_default hal_graphics_composer_default:fd use; -allow hal_camera_default sysfs_virtual:dir search; -allow hal_camera_default sysfs_virtual:file rw_file_perms; -allow hal_camera_default sysfs_camera:dir search; -allow hal_camera_default sysfs_camera:file rw_file_perms; -allow hal_camera_default sysfs_battery:dir search; -allow hal_camera_default sysfs_battery_writable:dir search; -allow hal_camera_default sysfs_battery_writable:file r_file_perms; + +rw_file_recursive(hal_camera_default, sysfs_camera) +r_file_recursive(hal_camera_default, sysfs_battery) get_prop(hal_camera_default, exported_camera_prop) set_prop(hal_camera_default, vendor_camera_prop) -get_prop(hal_camera_default, exported_default_prop) get_prop(hal_camera_default, vendor_factory_prop) -get_prop(hal_camera_default, exported_config_prop) -get_prop(hal_camera_default, exported_system_prop) binder_call(hal_camera_default, system_server) -binder_call(system_server, hal_camera_default) - -r_dir_file(hal_camera_default, sysfs_decon) -set_prop(hal_camera_default, camera_prop) diff --git a/universal7885-common/sepolicy/vendor/hal_drm_clearkey.te b/universal7885-common/sepolicy/vendor/hal_drm_clearkey.te deleted file mode 100644 index ad30d13..0000000 --- a/universal7885-common/sepolicy/vendor/hal_drm_clearkey.te +++ /dev/null @@ -1,14 +0,0 @@ -# policy for /vendor/bin/hw/android.hardware.drm clearkey service -type hal_drm_clearkey, domain; -type hal_drm_clearkey_exec, exec_type, vendor_file_type, file_type; - -init_daemon_domain(hal_drm_clearkey) - -hal_server_domain(hal_drm_clearkey, hal_drm) - -vndbinder_use(hal_drm_clearkey) - -allow hal_drm_clearkey { appdomain -isolated_app }:fd use; - -allow hal_drm_clearkey mediadrm_data_file:dir create_dir_perms; -allow hal_drm_clearkey mediadrm_data_file:file create_file_perms; diff --git a/universal7885-common/sepolicy/vendor/hal_drm_widevine.te b/universal7885-common/sepolicy/vendor/hal_drm_widevine.te index a887af1..52e8774 100644 --- a/universal7885-common/sepolicy/vendor/hal_drm_widevine.te +++ b/universal7885-common/sepolicy/vendor/hal_drm_widevine.te @@ -1,28 +1,12 @@ -type hal_drm_widevine, domain; -type hal_drm_widevine_exec, exec_type, vendor_file_type, file_type; - -init_daemon_domain(hal_drm_widevine) - -hal_server_domain(hal_drm_widevine, hal_drm) - -vndbinder_use(hal_drm_widevine) - -allow hal_drm_widevine mediacodec:fd use; -allow hal_drm_widevine { appdomain -isolated_app }:fd use; - -allow hal_drm_widevine hal_allocator_server:fd use; - -allow hal_drm_widevine mediadrm_data_file:dir create_dir_perms; -allow hal_drm_widevine mediadrm_data_file:file create_file_perms; -allow hal_drm_widevine vendor_data_file:dir create_dir_perms; -allow hal_drm_widevine vendor_data_file:file create_file_perms; - allow hal_drm_widevine cpk_efs_file:file r_file_perms; allow hal_drm_widevine efs_file:dir search; allow hal_drm_widevine efs_file:lnk_file r_file_perms; -allow hal_drm_widevine drm_device:chr_file { read write open ioctl }; - -allow hal_drm_widevine tz_user_device:chr_file { read write open ioctl }; +allow hal_drm_widevine drm_device:chr_file rw_file_perms; +allow hal_drm_widevine tz_user_device:chr_file rw_file_perms; allow hal_drm_widevine sec_efs_file:file r_file_perms; +allow hal_drm_widevine mediadrm_data_file:file create_file_perms; +allow hal_drm_widevine mediadrm_data_file:dir create_dir_perms; + +allow hal_drm_widevine mediacodec:fd use; diff --git a/universal7885-common/sepolicy/vendor/hal_fingerprint_default.te b/universal7885-common/sepolicy/vendor/hal_fingerprint_default.te index 1482ba5..7859223 100644 --- a/universal7885-common/sepolicy/vendor/hal_fingerprint_default.te +++ b/universal7885-common/sepolicy/vendor/hal_fingerprint_default.te @@ -1,26 +1,5 @@ -# hal_fingerprint_default.te - -teegris_use(hal_fingerprint_default) -# /dev/esfp[0-9] -allow hal_fingerprint_default fp_sensor_device:chr_file rw_file_perms; - -# /data/vendor/ -> biometrics -file_type_auto_trans(hal_fingerprint_default, vendor_data_file, biometrics_vendor_data_file) - -# /data/vendor/biometrics/* -allow hal_fingerprint_default biometrics_vendor_data_file:file create_file_perms; - -# /sys/class/fingerprint/ -allow hal_fingerprint_default sysfs_fingerprint:dir r_dir_perms; -allow hal_fingerprint_default sysfs_fingerprint:file r_file_perms; typeattribute hal_fingerprint_default data_between_core_and_vendor_violators; -allow hal_fingerprint_default fingerprintd_data_file:dir write; -allow hal_fingerprint_default sysfs_virtual:dir search; -allow hal_fingerprint_default sysfs_virtual:file r_file_perms; - -allow hal_fingerprint_default goodix_device:chr_file rw_file_perms; - allow hal_fingerprint_default self:netlink_socket { bind create write read }; allow hal_fingerprint_default uhid_device:chr_file rw_file_perms; diff --git a/universal7885-common/sepolicy/vendor/hal_gatekeeper_default.te b/universal7885-common/sepolicy/vendor/hal_gatekeeper_default.te index c8114f4..904170b 100644 --- a/universal7885-common/sepolicy/vendor/hal_gatekeeper_default.te +++ b/universal7885-common/sepolicy/vendor/hal_gatekeeper_default.te @@ -1,4 +1,3 @@ allow hal_gatekeeper_default efs_file:dir search; allow hal_gatekeeper_default efs_file:file rw_file_perms; allow hal_gatekeeper_default mnt_vendor_file:dir search; -teegris_use(hal_gatekeeper_default) diff --git a/universal7885-common/sepolicy/vendor/hal_gnss_default.te b/universal7885-common/sepolicy/vendor/hal_gnss_default.te index b37fe71..b9242cb 100644 --- a/universal7885-common/sepolicy/vendor/hal_gnss_default.te +++ b/universal7885-common/sepolicy/vendor/hal_gnss_default.te @@ -1,18 +1,3 @@ -# hal_gnss_default.te - -# cgroups tasks -allow hal_gnss_default cgroup:file getattr; - -# /data/vendor/gps -allow hal_gnss_default gps_vendor_data_file:dir rw_dir_perms; -allow hal_gnss_default gps_vendor_data_file:file create_file_perms; -allow hal_gnss_default gps_vendor_data_file:fifo_file create_file_perms; - -# /mnt/vendor -allow hal_gnss_default mnt_vendor_file:dir search; -# vndbinder -allow hal_gnss_default vndbinder_device:chr_file rw_file_perms; - # Connect to socket allow hal_gnss_default gpsd:unix_stream_socket connectto; diff --git a/universal7885-common/sepolicy/vendor/hal_graphics_allocator_default.te b/universal7885-common/sepolicy/vendor/hal_graphics_allocator_default.te deleted file mode 100644 index 8baf757..0000000 --- a/universal7885-common/sepolicy/vendor/hal_graphics_allocator_default.te +++ /dev/null @@ -1,7 +0,0 @@ -allow hal_graphics_allocator_default cgroup:file rw_file_perms; - -vndbinder_use(hal_graphics_allocator_default) - -# /sys/kernel/debug/dma_buf/footprint/[0-9]+ -allow hal_graphics_allocator_default debugfs_ion_dma:dir r_dir_perms; -allow hal_graphics_allocator_default debugfs_ion_dma:file r_file_perms; diff --git a/universal7885-common/sepolicy/vendor/hal_graphics_composer_default.te b/universal7885-common/sepolicy/vendor/hal_graphics_composer_default.te index 6385570..afc8628 100644 --- a/universal7885-common/sepolicy/vendor/hal_graphics_composer_default.te +++ b/universal7885-common/sepolicy/vendor/hal_graphics_composer_default.te @@ -17,27 +17,18 @@ allow hal_graphics_composer_default graphics_device:chr_file rw_file_perms; # /dev/video50 allow hal_graphics_composer_default video_device:chr_file rw_file_perms; -# /sys/devices/soc0/revision -allow hal_graphics_composer_default sysfs_socinfo:dir r_dir_perms; -allow hal_graphics_composer_default sysfs_socinfo:file r_file_perms; - - -# /sys/kernel/debug/dma_buf/footprint/[0-9]+ -allow hal_graphics_composer_default debugfs_ion_dma:dir r_dir_perms; -allow hal_graphics_composer_default debugfs_ion_dma:file r_file_perms; - allow hal_graphics_composer_default sysfs_decon:dir r_dir_perms; allow hal_graphics_composer_default sysfs_decon:file r_file_perms; allow hal_graphics_composer_default sysfs_ss_writable:dir r_dir_perms; allow hal_graphics_composer_default sysfs_ss_writable:file r_file_perms; +allow hal_graphics_composer_default sysfs_graphics:dir r_dir_perms; +allow hal_graphics_composer_default sysfs_graphics:file rw_file_perms; + # /dev/ion/ allow hal_graphics_composer_default ion_device:chr_file rw_file_perms; -allow hal_graphics_composer_default vendor_surfaceflinger_vndservice:service_manager { add find }; - -allow hal_graphics_composer_default sysfs_brightness:file rw_file_perms; -allow hal_graphics_composer_default sysfs_brightness:dir search; - get_prop(hal_graphics_composer_default, vendor_camera_prop) +set_prop(hal_graphics_composer_default, vendor_hwc_prop) +get_prop(hal_graphics_composer_default, boot_status_prop) diff --git a/universal7885-common/sepolicy/vendor/hal_health_default.te b/universal7885-common/sepolicy/vendor/hal_health_default.te index 21a93fd..5056059 100644 --- a/universal7885-common/sepolicy/vendor/hal_health_default.te +++ b/universal7885-common/sepolicy/vendor/hal_health_default.te @@ -1,13 +1,5 @@ -r_dir_file(hal_health_default, sysfs_charger) +rw_file_recursive(hal_health_default, sysfs_charger) -allow hal_health_default sysfs_charger:file rw_file_perms; +allow hal_health_default sysfs_fuelgauge:file r_file_perms; allow hal_health_default sysfs_battery:dir r_dir_perms; allow hal_health_default sysfs_battery:file r_file_perms; -allow hal_health_default sysfs_battery_writable:dir search; -allow hal_health_default sysfs_battery_writable:file r_file_perms; -allow hal_health_default sysfs_fuelgauge:file r_file_perms; -allow hal_health_default app_efs_file:file r_file_perms; -allow hal_health_default app_efs_file:dir search; -allow hal_health_default efs_file:lnk_file read; -allow hal_health_default efs_file:dir search; - diff --git a/universal7885-common/sepolicy/vendor/hal_keymaster_default.te b/universal7885-common/sepolicy/vendor/hal_keymaster_default.te index 506bb1c..d2d6555 100644 --- a/universal7885-common/sepolicy/vendor/hal_keymaster_default.te +++ b/universal7885-common/sepolicy/vendor/hal_keymaster_default.te @@ -1,10 +1 @@ -# hal_keymaster_default - -# /mnt/vendor -allow hal_keymaster_default mnt_vendor_file:dir search; - -# /mnt/vendor/efs -allow hal_keymaster_default efs_file:dir search; -teegris_use(hal_keymaster_default) -allow hal_keymaster_default prov_efs_file:file r_file_perms; -allow hal_keymaster_default prov_efs_file:dir search; +r_file_recursive(hal_keymaster_default, prov_efs_file) diff --git a/universal7885-common/sepolicy/vendor/hal_light_default.te b/universal7885-common/sepolicy/vendor/hal_light_default.te index 6cd32fd..ae4b15a 100644 --- a/universal7885-common/sepolicy/vendor/hal_light_default.te +++ b/universal7885-common/sepolicy/vendor/hal_light_default.te @@ -1,9 +1 @@ -# hal_light_default.te - -# /sys/devices/platform/panel@0/backlight/panel/brightness -# /sys/devices/platform/panel@0/backlight/panel/max_brightness -allow hal_light_default sysfs_backlight_writable:file rw_file_perms; -allow hal_light_default sysfs_graphics:dir search; -allow hal_light_default sysfs_graphics:file rw_file_perms; -allow hal_light_default sysfs_virtual:dir search; -allow hal_light_default sysfs_virtual:file rw_file_perms; +r_file_recursive(hal_light_default, sysfs_graphics) diff --git a/universal7885-common/sepolicy/vendor/hal_memtrack_default.te b/universal7885-common/sepolicy/vendor/hal_memtrack_default.te index c7f51e9..7554c6f 100644 --- a/universal7885-common/sepolicy/vendor/hal_memtrack_default.te +++ b/universal7885-common/sepolicy/vendor/hal_memtrack_default.te @@ -1,5 +1 @@ -r_dir_file(hal_memtrack_default, debugfs_mali) -r_dir_file(hal_memtrack_default, debugfs_mali_mem) -r_dir_file(hal_memtrack_default, debugfs_ion) -r_dir_file(hal_memtrack_default, debugfs_ion_dma) r_dir_file(hal_memtrack_default, sysfs_gpu) diff --git a/universal7885-common/sepolicy/vendor/hal_power_default.te b/universal7885-common/sepolicy/vendor/hal_power_default.te index 190fb5d..ffe2540 100644 --- a/universal7885-common/sepolicy/vendor/hal_power_default.te +++ b/universal7885-common/sepolicy/vendor/hal_power_default.te @@ -1,38 +1,10 @@ -# hal_power_default.te - -# /dev/cpu_dma_latency -allow hal_power_default cpu_dma_device:chr_file rw_file_perms; - -# /dev/stune/top-app/schedtune.boost -allow hal_power_default cgroup:file rw_file_perms; - -# /sys/class/input/ -allow hal_power_default sysfs_input:dir r_dir_perms; - -# /sys/class/power/ -allow hal_power_default sysfs_power:dir r_dir_perms; -allow hal_power_default sysfs_power:file r_file_perms; -allow hal_power_default sysfs_power_writable:file rw_file_perms; - -# /sys/class/sec/tsp/input/ -allow hal_power_default sysfs_sec_touchscreen:dir r_dir_perms; -allow hal_power_default sysfs_sec_touchscreen:lnk_file r_file_perms; - -# /sys/class/sec/tsp/input/{cmd,enabled} -allow hal_power_default sysfs_touchscreen_writable:file rw_file_perms; - -# /sys/devices/system/cpu/cpu[0-9]/cpufreq/scaling_max_freq -allow hal_power_default sysfs_devices_system_cpu:file rw_file_perms; allow hal_power_default sysfs_graphics:dir search; allow hal_power_default sysfs_graphics:file r_file_perms; allow hal_power_default sysfs_input:file r_file_perms; -allow hal_power_default sysfs_virtual:dir r_dir_perms; -allow hal_power_default sysfs_virtual:file r_file_perms; allow hal_power_default sysfs_touchscreen_writable:dir r_dir_perms; -allow hal_power_default sysfs_sec_touchscreen:dir { read open }; +allow hal_power_default sysfs_sec_touchscreen:dir r_dir_perms; allow hal_power_default sysfs_sec_touchscreen:file r_file_perms; -type hal_lineage_power_hwservice, hwservice_manager_type; -add_hwservice(hal_power_default, hal_power_hwservice) allow hal_power_default sysfs_decon:dir search; + set_prop(hal_power_default, vendor_powerhal_prop) diff --git a/universal7885-common/sepolicy/vendor/hal_sensors_default.te b/universal7885-common/sepolicy/vendor/hal_sensors_default.te index e1a1752..a540256 100644 --- a/universal7885-common/sepolicy/vendor/hal_sensors_default.te +++ b/universal7885-common/sepolicy/vendor/hal_sensors_default.te @@ -1,75 +1,11 @@ -# hal_sensors_default.te - -# /dev/batch_io -allow hal_sensors_default io_device:chr_file r_file_perms; - -# /dev/iio:device1 -allow hal_sensors_default iio_device:chr_file r_file_perms; - -# /dev/ssp_sensorhub -allow hal_sensors_default ssp_device:chr_file rw_file_perms; - -# /efs -allow hal_sensors_default efs_file:dir r_dir_perms; - -# /efs/FactoryApp/ -allow hal_sensors_default app_efs_file:dir rw_dir_perms; -allow hal_sensors_default app_efs_file:file { setattr rw_file_perms }; - -# /sys/bus/iio/devices -allow hal_sensors_default sysfs_iio:dir r_dir_perms; -allow hal_sensors_default sysfs_iio:file r_file_perms; - -# /sys/class/sec/sensors -allow hal_sensors_default sysfs_sec_sensors:dir r_dir_perms; -allow hal_sensors_default sysfs_sec_sensors:file r_file_perms; - -# /sys/class/sensors/ssp_sensor/enable -allow hal_sensors_default sysfs_sensors_writable:dir r_dir_perms; -allow hal_sensors_default sysfs_sensors_writable:file rw_file_perms; - -# /sys/devices/platform/10970000.spi/ -allow hal_sensors_default sysfs_spi_writeable:dir r_dir_perms; -allow hal_sensors_default sysfs_spi_writeable:file rw_file_perms; - -# /sys/devices/platform/panel@0/lcd/panel/window_type -allow hal_sensors_default sysfs_lcd_writable:dir r_dir_perms; -allow hal_sensors_default sysfs_lcd_writable:file r_file_perms; - -# /sys/class/input -allow hal_sensors_default sysfs_input:dir r_dir_perms; - -# /sys/devices/virtual/input/input4 -# /sys/devices/virtual/input/input6 -allow hal_sensors_default sysfs_sensors:dir r_dir_perms; -allow hal_sensors_default sysfs_sensors:file r_file_perms; - -# /sys/devices/virtual/sensors/magnetic_sensor/vendor -allow hal_sensors_default sysfs_sensors:dir r_dir_perms; -allow hal_sensors_default sysfs_sensors:file r_file_perms; - -# /sys/devices/virtual/sec/sec_key/hall_detect -allow hal_sensors_default sysfs_sec_key:dir r_dir_perms; -allow hal_sensors_default sysfs_sec_key:file r_file_perms; - -# /sys/class/sec/tsp/ -allow hal_sensors_default sysfs_sec_touchscreen:dir r_dir_perms; -allow hal_sensors_default sysfs_sec_touchscreen:file r_file_perms; -allow hal_sensors_default sysfs_sec_touchscreen:lnk_file r_file_perms; - allow hal_sensors_default sysfs_iio:file r_file_perms; allow hal_sensors_default sysfs_iio:lnk_file read; -allow hal_sensors_default sysfs_virtual:dir r_dir_perms; -allow hal_sensors_default sysfs_virtual:file rw_file_perms; -allow hal_sensors_default sysfs_virtual:lnk_file read; -allow hal_sensors_default baro_delta_factoryapp_efs_file:file r_file_perms; allow hal_sensors_default sysfs_input:file r_file_perms; allow hal_sensors_default sysfs_input_writable:file rw_file_perms; allow hal_sensors_default sysfs_input:dir r_dir_perms; -allow hal_sensors_default sysfs_sensor_writable:file rw_file_perms; allow hal_sensors_default sysfs_spi_writeable:file rw_file_perms; allow hal_sensors_default efs_file:lnk_file read; -# yas_lib -allow hal_sensors_default vendor_data_file:file create_file_perms; -allow hal_sensors_default vendor_data_file:dir create_dir_perms; +## /data/vendor/yas_lib +allow hal_sensors_default sensors_data_file:file create_file_perms; +allow hal_sensors_default sensors_data_file:dir create_dir_perms; diff --git a/universal7885-common/sepolicy/vendor/hal_thermal_default.te b/universal7885-common/sepolicy/vendor/hal_thermal_default.te deleted file mode 100644 index 759bdb0..0000000 --- a/universal7885-common/sepolicy/vendor/hal_thermal_default.te +++ /dev/null @@ -1,8 +0,0 @@ - -# /acct/tasks -allow hal_thermal_default cgroup:file getattr; - -# /sys/devices/virtual/thermal/ -allow hal_thermal_default sysfs_thermal:dir r_dir_perms; -allow hal_thermal_default sysfs_thermal:file r_file_perms; -r_dir_file(hal_thermal_default, sysfs_virtual) diff --git a/universal7885-common/sepolicy/vendor/hal_usb_default.te b/universal7885-common/sepolicy/vendor/hal_usb_default.te deleted file mode 100644 index 4de8e54..0000000 --- a/universal7885-common/sepolicy/vendor/hal_usb_default.te +++ /dev/null @@ -1,3 +0,0 @@ -allow hal_usb_default sysfs_virtual:dir search; -allow hal_usb_default sysfs_sec_ccic:dir search; -allow hal_usb_default sysfs_sec_ccic:file r_file_perms; diff --git a/universal7885-common/sepolicy/vendor/hal_vibrator_default.te b/universal7885-common/sepolicy/vendor/hal_vibrator_default.te deleted file mode 100644 index a81495f..0000000 --- a/universal7885-common/sepolicy/vendor/hal_vibrator_default.te +++ /dev/null @@ -1,2 +0,0 @@ -allow hal_vibrator_default sysfs_virtual:dir search; -allow hal_vibrator_default sysfs_virtual:file rw_file_perms; diff --git a/universal7885-common/sepolicy/vendor/hal_wifi_default.te b/universal7885-common/sepolicy/vendor/hal_wifi_default.te index dfc17b7..ee63286 100644 --- a/universal7885-common/sepolicy/vendor/hal_wifi_default.te +++ b/universal7885-common/sepolicy/vendor/hal_wifi_default.te @@ -1,8 +1,5 @@ -set_prop(hal_wifi_default, vendor_wlan_prop) -get_prop(hal_wifi_default, vendor_wifi_prop) - -allow hal_wifi_default conn_vendor_data_file:dir search; -allow hal_wifi_default conn_vendor_data_file:file rw_file_perms; +allow hal_wifi_default conn_vendor_data_file:dir rw_dir_perms; +allow hal_wifi_default conn_vendor_data_file:file create_file_perms; allow hal_wifi_default wifi_vendor_data_file:dir search; get_prop(hal_wifi_default, persist_vendor_debug_wifi_prop) @@ -11,5 +8,7 @@ allow hal_wifi_default efs_file:dir search; allow hal_wifi_default wifi_efs_file:dir search; allow hal_wifi_default wifi_efs_file:file r_file_perms; -allow hal_wifi_default conn_vendor_data_file:dir write; allow hal_wifi_default mnt_vendor_file:dir search; + +# vendor.wlan.firmware. +set_prop(hal_wifi_default, vendor_wifi_prop) diff --git a/universal7885-common/sepolicy/vendor/hal_wifi_hostapd_default.te b/universal7885-common/sepolicy/vendor/hal_wifi_hostapd_default.te deleted file mode 100644 index abaab7b..0000000 --- a/universal7885-common/sepolicy/vendor/hal_wifi_hostapd_default.te +++ /dev/null @@ -1,6 +0,0 @@ -# hal_wifi_hostapd_default.te - -# /data/vendor/wifi/hostapd/hostapd_wlan0.conf -r_dir_file(hal_wifi_hostapd_default, wifi_vendor_data_file) -allow hal_wifi_hostapd_default sysfs_virtual:dir search; -allow hal_wifi_hostapd_default sysfs_virtual:lnk_file r_file_perms; diff --git a/universal7885-common/sepolicy/vendor/hal_wifi_supplicant_default.te b/universal7885-common/sepolicy/vendor/hal_wifi_supplicant_default.te deleted file mode 100644 index 17ec008..0000000 --- a/universal7885-common/sepolicy/vendor/hal_wifi_supplicant_default.te +++ /dev/null @@ -1,8 +0,0 @@ -# hal_wifi_supplicant_default.te - -# /data/vendor/log -allow hal_wifi_supplicant_default log_vendor_data_file:dir r_dir_perms; - -# /data/vendor/wifi -allow hal_wifi_supplicant_default wifi_vendor_data_file:dir rw_dir_perms; -allow hal_wifi_supplicant_default wifi_vendor_data_file:file rw_file_perms; diff --git a/universal7885-common/sepolicy/vendor/hwservice.te b/universal7885-common/sepolicy/vendor/hwservice.te deleted file mode 100644 index b94a1b6..0000000 --- a/universal7885-common/sepolicy/vendor/hwservice.te +++ /dev/null @@ -1,3 +0,0 @@ -type rild_hwservice, hwservice_manager_type; -type hal_vendor_configstore_hwservice, hwservice_manager_type; -type hal_vendor_surfaceflinger_hwservice, hwservice_manager_type; diff --git a/universal7885-common/sepolicy/vendor/hwservice_contexts b/universal7885-common/sepolicy/vendor/hwservice_contexts index 2209fbb..d49aa7b 100644 --- a/universal7885-common/sepolicy/vendor/hwservice_contexts +++ b/universal7885-common/sepolicy/vendor/hwservice_contexts @@ -1,8 +1,4 @@ vendor.samsung.hardware.gnss::ISehGnss u:object_r:hal_gnss_hwservice:s0 -vendor.samsung.hardware.radio::ISehRadio u:object_r:rild_hwservice:s0 -vendor.samsung.hardware.radio.bridge::ISehBridge u:object_r:rild_hwservice:s0 -vendor.samsung.hardware.radio.channel::ISehChannel u:object_r:rild_hwservice:s0 -vendor.lineage.power::ILineagePower u:object_r:hal_power_hwservice:s0 - -vendor.samsung_slsi.hardware.ExynosHWCServiceTW::IExynosHWCServiceTW u:object_r:hal_vendor_surfaceflinger_hwservice:s0 -vendor.samsung_slsi.hardware.configstore::IExynosHWCConfigs u:object_r:hal_vendor_configstore_hwservice:s0 +vendor.samsung.hardware.radio::ISehRadio u:object_r:hal_telephony_hwservice:s0 +vendor.samsung.hardware.radio.bridge::ISehBridge u:object_r:hal_telephony_hwservice:s0 +vendor.samsung.hardware.radio.channel::ISehChannel u:object_r:hal_telephony_hwservice:s0 diff --git a/universal7885-common/sepolicy/vendor/init.te b/universal7885-common/sepolicy/vendor/init.te index 08dff44..6fd25eb 100644 --- a/universal7885-common/sepolicy/vendor/init.te +++ b/universal7885-common/sepolicy/vendor/init.te @@ -1,62 +1,5 @@ -allow init rild:unix_stream_socket connectto; -allow init self:netlink_kobject_uevent_socket create_socket_perms_no_ioctl; -allow init socket_device:sock_file create_file_perms; -allow init sysfs_devices_system_cpu:file write; -allow init vendor_data_file:fifo_file write; -allow init vendor_data_file:file append; -allow init dnsproxyd_socket:sock_file write; -allow init fwk_sensor_hwservice:hwservice_manager find; -allow init hwservicemanager:binder call; -allow init netd:unix_stream_socket connectto; -allow init fwmarkd_socket:sock_file write; -allow init nfc:binder call; -allow init nfc_device:chr_file ioctl; -allow init efs_file:dir mounton; -allow init efs_block_device:lnk_file relabelto; -allow init tmpfs:lnk_file create; - -allow init sysfs_virtual:file create_file_perms; -allow init sysfs_virtual:lnk_file { read }; -allow init sysfs:file setattr; -allow init sysfs_multipdp:file setattr; -allow init sysfs_camera:file setattr; -allow init sysfs_charger:file setattr; -allow init sysfs_input:file setattr; -allow init sysfs_modem:file w_file_perms; +allow init proc_swappiness:file w_file_perms; allow init sysfs_battery_writable:file setattr; -allow init sysfs_power_writable:file setattr; -allow init sysfs_graphics:file create_file_perms; - -allow init system_server:binder { transfer call }; -allow init device:chr_file ioctl; -allow init self:tcp_socket create_socket_perms; -allow init node:tcp_socket node_bind; -allow init port:tcp_socket { name_bind name_connect }; -allow init gps_vendor_data_file:fifo_file write; -allow init gps_vendor_data_file:file lock; +allow init { sec_efs_file efs_file }:dir mounton; +allow init sysfs_mmc:file w_file_perms; allow init socket_device:sock_file create_file_perms; -allow init kernel:system module_request; - -allow init logd:unix_stream_socket connectto; -allow init logdr_socket:sock_file write; -allow init self:capability sys_nice; -allow init sysfs_printk:file write; -allow init proc:file setattr; -allow init proc_swapiness:file write; -allow init proc_extra:file setattr; -allow init proc_reset_reason:file setattr; -allow init proc_swapiness:file open; -allow init self:netlink_generic_socket { bind create getattr read setopt write }; -allow init efs_file:lnk_file read; - -allow init proc_last_kmsg:file setattr; -allow init mnt_vendor_file:dir mounton; - -unix_socket_connect(init, property, rild) - -allow init sec_efs_file:dir mounton; -allow init sysfs_mmc_queue:file { open write }; -get_prop(init, vendor_radio_prop) -get_prop(init, radio_prop) -allow init sysfs_printk:file open; - diff --git a/universal7885-common/sepolicy/vendor/kernel.te b/universal7885-common/sepolicy/vendor/kernel.te index a8de462..3cfc4f1 100644 --- a/universal7885-common/sepolicy/vendor/kernel.te +++ b/universal7885-common/sepolicy/vendor/kernel.te @@ -1,20 +1,8 @@ -# kernel.te - -# /vendor/firmware/ -allow kernel vendor_firmware_file:dir r_dir_perms; -allow kernel vendor_firmware_file:file r_file_perms; -allow kernel app_efs_file:dir search; -allow kernel app_efs_file:file open; -allow kernel sensor_factoryapp_efs_file:file open; -allow kernel efs_file:dir search; - allow kernel device:chr_file { getattr setattr unlink create }; allow kernel device:dir create_dir_perms; allow kernel self:capability { sys_rawio mknod }; - allow kernel block_device:dir search; +# Hall IC allow kernel sysfs_sec_key:dir search; -r_dir_file(kernel, sysfs_virtual) - -allow kernel loop_device:blk_file { create setattr }; +allow kernel sysfs_sec_key:file { open read }; diff --git a/universal7885-common/sepolicy/vendor/macloader.te b/universal7885-common/sepolicy/vendor/macloader.te deleted file mode 100644 index b080898..0000000 --- a/universal7885-common/sepolicy/vendor/macloader.te +++ /dev/null @@ -1,41 +0,0 @@ -# macloader.te - -type macloader, domain; -type macloader_exec, exec_type, vendor_file_type, file_type; - -# macloader is started by init, type transit from init domain to macloader domain -init_daemon_domain(macloader) - -set_prop(macloader, vendor_wifi_prop); - -allow macloader self:capability { net_admin }; - -allow macloader self:udp_socket create_socket_perms; -allowxperm macloader self:udp_socket ioctl { 0x8913 0x8914 }; - -# /data/vendor/conn -allow macloader conn_vendor_data_file:dir rw_dir_perms; -allow macloader conn_vendor_data_file:file create_file_perms; - -# /mnt/vendor -allow macloader mnt_vendor_file:dir search; - -# /mnt/vendor/efs -allow macloader efs_file:dir rw_dir_perms; - -# /mnt/vendor/efs/wifi -allow macloader wifi_efs_file:dir rw_dir_perms; -allow macloader wifi_efs_file:file rw_file_perms; - -# /sys/class/net -allow macloader sysfs_net:dir r_dir_perms; -allow macloader sysfs_net:file r_file_perms; - -# /sys/module/dhd/parameters/firmware_path -allow macloader sysfs_wifi_writable:dir r_dir_perms; -allow macloader sysfs_wifi_writable:file rw_file_perms; - -# /sys/wifi -allow macloader sysfs_wifi:dir r_dir_perms; -allow macloader sysfs_wifi:file r_file_perms; -allow macloader sysfs_virtual:dir search; diff --git a/universal7885-common/sepolicy/vendor/mediacodec.te b/universal7885-common/sepolicy/vendor/mediacodec.te index c6702fd..6eb16fa 100644 --- a/universal7885-common/sepolicy/vendor/mediacodec.te +++ b/universal7885-common/sepolicy/vendor/mediacodec.te @@ -1,7 +1,7 @@ # /sys/class/video4linux/video6/name -allow mediacodec sysfs_v4l:dir r_dir_perms; allow mediacodec sysfs_v4l_mfc:dir search; allow mediacodec sysfs_v4l_mfc:file r_file_perms; +allow mediacodec m2m1shot_device:chr_file rw_file_perms; hal_client_domain(mediacodec, hal_power) hal_client_domain(mediacodec, hal_omx) diff --git a/universal7885-common/sepolicy/vendor/multiclientd.te b/universal7885-common/sepolicy/vendor/multiclientd.te deleted file mode 100644 index bd3b3d0..0000000 --- a/universal7885-common/sepolicy/vendor/multiclientd.te +++ /dev/null @@ -1,11 +0,0 @@ -type multiclientd, domain, coredomain; -type multiclientd_exec, file_type, exec_type, system_file_type; - -init_daemon_domain(multiclientd) - -allow multiclientd rild:binder { call transfer }; -allow multiclientd rild_hwservice:hwservice_manager find; -binder_call(multiclientd, hwservicemanager) -binder_call(hwservicemanager, multiclientd) -get_prop(multiclientd, hwservicemanager_prop); -allow multiclientd same_process_hal_file:file execute; diff --git a/universal7885-common/sepolicy/vendor/netd.te b/universal7885-common/sepolicy/vendor/netd.te index 1e3fdb6..d2da5da 100644 --- a/universal7885-common/sepolicy/vendor/netd.te +++ b/universal7885-common/sepolicy/vendor/netd.te @@ -1,5 +1,3 @@ allow netd self:capability sys_module; allow netd init:tcp_socket rw_socket_perms_no_ioctl; -allow netd sysfs_virtual:dir search; -allow netd sysfs_virtual:file w_file_perms; diff --git a/universal7885-common/sepolicy/vendor/platform_app.te b/universal7885-common/sepolicy/vendor/platform_app.te deleted file mode 100644 index 69e0abd..0000000 --- a/universal7885-common/sepolicy/vendor/platform_app.te +++ /dev/null @@ -1,2 +0,0 @@ -# /dev/mali0 -allow platform_app gpu_device:chr_file rw_file_perms; diff --git a/universal7885-common/sepolicy/vendor/priv_app.te b/universal7885-common/sepolicy/vendor/priv_app.te deleted file mode 100644 index d37cf17..0000000 --- a/universal7885-common/sepolicy/vendor/priv_app.te +++ /dev/null @@ -1,10 +0,0 @@ -# /dev/mali0 -allow priv_app gpu_device:chr_file rw_file_perms; - -allow priv_app debugfs_ion:dir search; -allow priv_app debugfs_mali:dir search; -allow priv_app debugfs_mali_mem:dir search; - -allow priv_app sysfs_zram:file r_file_perms; - -#get_prop(priv_app, vendor_default_prop) diff --git a/universal7885-common/sepolicy/vendor/property.te b/universal7885-common/sepolicy/vendor/property.te index 4b7a5ee..bfc6d33 100644 --- a/universal7885-common/sepolicy/vendor/property.te +++ b/universal7885-common/sepolicy/vendor/property.te @@ -1,20 +1,5 @@ -vendor_internal_prop(modemloader_prop) -vendor_internal_prop(camera_prop) vendor_internal_prop(persist_rmnet_prop) -vendor_internal_prop(persist_data_df_prop) -vendor_internal_prop(persist_data_wda_prop) vendor_public_prop(vendor_camera_prop) vendor_internal_prop(vendor_factory_prop) -vendor_internal_prop(vendor_gps_prop) vendor_internal_prop(vendor_nfc_prop) -vendor_internal_prop(vendor_wlbtd_prop) -vendor_internal_prop(vendor_wlan_prop) -vendor_internal_prop(vendor_cbd_prop) -vendor_internal_prop(vendor_radio_prop) -vendor_internal_prop(vendor_fastcharge_prop) -vendor_internal_prop(vendor_wifi_prop) -vendor_internal_prop(rild_prop) -vendor_internal_prop(vendor_secureos_prop) -vendor_internal_prop(vendor_tzdaemon_prop) vendor_internal_prop(vendor_powerhal_prop) -vendor_internal_prop(vendor_tztsdaemon_prop) diff --git a/universal7885-common/sepolicy/vendor/property_contexts b/universal7885-common/sepolicy/vendor/property_contexts index 6d94479..eb335ee 100644 --- a/universal7885-common/sepolicy/vendor/property_contexts +++ b/universal7885-common/sepolicy/vendor/property_contexts @@ -1,36 +1,15 @@ -### cbd -vendor.cbd. u:object_r:vendor_cbd_prop:s0 -persist.vendor.cbd. u:object_r:vendor_radio_prop:s0 - -### radio -ro.multisim. u:object_r:radio_prop:s0 -ro.vendor.multisim. u:object_r:vendor_radio_prop:s0 -ro.vendor.radio. u:object_r:vendor_radio_prop:s0 - -### wifi -vendor.wifi. u:object_r:vendor_wifi_prop:s0 -ro.vendor.wifi. u:object_r:vendor_wifi_prop:s0 - # fastbootd ro.fastbootd.available u:object_r:exported_default_prop:s0 # bluetooth persist.bluetooth_fw_ver u:object_r:bluetooth_prop:s0 ro.bluetooth.tty u:object_r:bluetooth_prop:s0 -wc_transport. u:object_r:bluetooth_prop:s0 - -# modemloader -hw.revision u:object_r:modemloader_prop:s0 -ro.cbd.dt_revision u:object_r:modemloader_prop:s0 -ril.cbd.dt_revision u:object_r:modemloader_prop:s0 -ro.modemloader.done u:object_r:modemloader_prop:s0 +# Data persist.rmnet. u:object_r:persist_rmnet_prop:s0 -persist.data.df. u:object_r:persist_data_df_prop:s0 -persist.data.wda. u:object_r:persist_data_wda_prop:s0 +persist.data. u:object_r:persist_rmnet_prop:s0 # CAMERA -persist.sys.camera. u:object_r:camera_prop:s0 persist.vendor.sys.camera. u:object_r:vendor_camera_prop:s0 persist.vendor.camera. u:object_r:vendor_camera_prop:s0 @@ -43,28 +22,21 @@ ro.debug_level u:object_r:exported_default_prop:s0 ro.hardware.chipname u:object_r:exported_default_prop:s0 ro.build.PDA u:object_r:exported_default_prop:s0 -# GPS -ro.spid.gps. u:object_r:vendor_gps_prop:s0 - # NFC vendor.nfc.fw. u:object_r:vendor_nfc_prop:s0 # RADIO persist.ril. u:object_r:radio_prop:s0 vendor.gsm. u:object_r:vendor_radio_prop:s0 -persist.radio. u:object_r:radio_prop:s0 -ril.clatd. u:object_r:vendor_radio_prop:s0 -vendor.powerhal. u:object_r:vendor_powerhal_prop:s0 -# FACTORY -ro.factory.factory_binary u:object_r:vendor_factory_prop:s0 +persist.radio. u:object_r:radio_prop:s0 +ril.clatd. u:object_r:vendor_radio_prop:s0 +ro.multisim. u:object_r:vendor_radio_prop:s0 -# wlbtd -vendor.wlbtd. u:object_r:vendor_wlbtd_prop:s0 +# Power +vendor.powerhal. u:object_r:vendor_powerhal_prop:s0 + +# FACTORY +ro.factory.factory_binary u:object_r:vendor_factory_prop:s0 # Wlan -vendor.wlan. u:object_r:vendor_wlan_prop:s0 - -# TEEGRIS -vendor.secureos. u:object_r:vendor_secureos_prop:s0 -vendor.tzdaemon u:object_r:vendor_tzdaemon_prop:s0 -vendor.tzts_daemon u:object_r:vendor_tztsdaemon_prop:s0 +vendor.wlan. u:object_r:vendor_wifi_prop:s0 diff --git a/universal7885-common/sepolicy/vendor/radio.te b/universal7885-common/sepolicy/vendor/radio.te deleted file mode 100644 index 5a6d645..0000000 --- a/universal7885-common/sepolicy/vendor/radio.te +++ /dev/null @@ -1,3 +0,0 @@ -binder_call(radio, gpuservice) -get_prop(radio, radio_prop) - diff --git a/universal7885-common/sepolicy/vendor/rild.te b/universal7885-common/sepolicy/vendor/rild.te index 6d17468..80dc4ad 100644 --- a/universal7885-common/sepolicy/vendor/rild.te +++ b/universal7885-common/sepolicy/vendor/rild.te @@ -1,102 +1,15 @@ -# rild.te - -get_prop(rild, vendor_radio_prop) - -allow rild block_device:dir search; -allow rild mnt_vendor_file:dir { getattr search }; - -# audio hal -allow rild hal_audio_default:dir search; -allow rild hal_audio_default:file r_file_perms; - -# gps -allow rild gpsd:dir search; -allow rild gpsd:file r_file_perms; - -# /data -allow rild system_data_file:dir getattr; - -# /data/vendor/log -allow rild log_vendor_data_file:dir rw_dir_perms; -allow rild log_vendor_data_file:file create_file_perms; - -# /dev/block/platform/.+/by-name/radio -allow rild radio_block_device:blk_file r_file_perms; - -# /dev/drb -allow rild drb_device:chr_file rw_file_perms; - -# /dev/umts_* -# /dev/umts_ipc* -allow rild vendor_radio_device:chr_file rw_file_perms; - -# /data/vendor/secradio -allow rild radio_vendor_data_file:dir rw_dir_perms; -allow rild radio_vendor_data_file:file create_file_perms; - -# /efs/FactoryApp/ -# /mnt/vendor/efs/root -allow rild app_efs_file:dir r_dir_perms; -allow rild app_efs_file:file { rw_file_perms setattr }; - -# /efs/imei -allow rild imei_efs_file:dir r_dir_perms; -allow rild imei_efs_file:file r_file_perms; - -# /mnt/vendor/efs/ -allow rild prov_efs_file:dir r_dir_perms; -allow rild prov_efs_file:file r_file_perms; - -# /mnt/vendor/efs/nv_data.bin -allow rild bin_nv_data_efs_file:file { rw_file_perms setattr unlink }; - -# /proc/net/xt_qtaguid/iface_stat_fmt -allow rild proc_qtaguid_stat:file r_file_perms; - -# /proc/sys/net/ipv6/conf/*/accept_ra_defrtr -allow rild proc_net:file rw_file_perms; - -# mdc. -# persist.sys.omc_support -# ro.csc. -get_prop(rild, exported_config_prop); - -# ro.boot.cpboot, ril.NwNmId[0-9] -get_prop(rild, telephony_config_prop) - -get_prop(rild, vendor_radio_prop) -# vendor.cbd. -set_prop(rild, vendor_cbd_prop) -allow rild proc_net:file write; +allow rild proc_net:file w_file_perms; allow rild vendor_data_file:file create_file_perms; - -# /dev/umts_ipc0 -allow rild radio_device:chr_file ioctl; - allow rild bin_nv_data_efs_file:file create_file_perms; -dontaudit rild bin_nv_data_efs_file:file ioctl; - +allow rild imei_efs_file:file w_file_perms; allow rild radio_vendor_data_file:file create_file_perms; allow rild radio_vendor_data_file:dir rw_dir_perms; - -allow rild proc_qtaguid_stat:file read; - -allow rild factoryprop_efs_file:file rw_file_perms; - -allow rild init:file getattr; - -# binder -allow rild hal_radio_default:binder call; - -# audio allow rild hal_audio_default:dir search; allow rild hal_audio_default:file r_file_perms; allow rild efs_file:lnk_file read; +dontaudit rild bin_nv_data_efs_file:file ioctl; # hwservice -add_hwservice(rild, rild_hwservice) set_prop(rild, radio_prop) -binder_call(rild, multiclientd) -binder_call(multiclientd, rild) -allow rild imei_efs_file:file w_file_perms; +binder_call(rild, hal_radio_default) diff --git a/universal7885-common/sepolicy/vendor/secril_config_svc.te b/universal7885-common/sepolicy/vendor/secril_config_svc.te deleted file mode 100644 index 5ba45bc..0000000 --- a/universal7885-common/sepolicy/vendor/secril_config_svc.te +++ /dev/null @@ -1,24 +0,0 @@ -# secril_config_svc.te - -type secril_config_svc, domain; -type secril_config_svc_exec, exec_type, vendor_file_type, file_type; - -# secril_config_svc is started by init, type transit from init domain to secril_config_svc domain -init_daemon_domain(secril_config_svc) - -# /mnt/vendor/ -allow secril_config_svc mnt_vendor_file:dir search; - -# /mnt/vendor/efs/factory.prop -# /mnt/vendor/efs/telephony.prop -allow secril_config_svc efs_file:dir search; -allow secril_config_svc efs_file:file r_file_perms; - -# ro.multisim. -# ro.vendor.multisim. -# ro.vendor.radio.default_network -set_prop(secril_config_svc, vendor_radio_prop) -dontaudit secril_config_svc radio_control_prop:property_service set; -get_prop(secril_config_svc, exported_config_prop) -get_prop(secril_config_svc, vendor_radio_prop) - diff --git a/universal7885-common/sepolicy/vendor/surfaceflinger.te b/universal7885-common/sepolicy/vendor/surfaceflinger.te index 50667e8..5b6789e 100644 --- a/universal7885-common/sepolicy/vendor/surfaceflinger.te +++ b/universal7885-common/sepolicy/vendor/surfaceflinger.te @@ -1,8 +1,4 @@ -# /dev/mali0 -allow surfaceflinger gpu_device:chr_file rw_file_perms; - -# libion_exynos -allow surfaceflinger same_process_hal_file:file rx_file_perms; - # Android 13+ r_dir_file(surfaceflinger, hal_graphics_composer_default) + +get_prop(surfaceflinger, vendor_hwc_prop) diff --git a/universal7885-common/sepolicy/vendor/system_app.te b/universal7885-common/sepolicy/vendor/system_app.te deleted file mode 100644 index c433d6a..0000000 --- a/universal7885-common/sepolicy/vendor/system_app.te +++ /dev/null @@ -1,13 +0,0 @@ -# /dev/mali0 -allow system_app gpu_device:chr_file rw_file_perms; - -allow system_app proc_pagetypeinfo:file r_file_perms; -allow system_app sysfs_virtual:dir search; - -# battery sysfs - -allow system_app sysfs_battery_info:dir { search }; -allow system_app sysfs_battery_info:file { read open getattr }; - -r_dir_file(system_app, sysfs_battery_info) -r_dir_file(system_app, sysfs_zram) diff --git a/universal7885-common/sepolicy/vendor/system_server.te b/universal7885-common/sepolicy/vendor/system_server.te index d8c30ab..891807e 100644 --- a/universal7885-common/sepolicy/vendor/system_server.te +++ b/universal7885-common/sepolicy/vendor/system_server.te @@ -1,24 +1,18 @@ # system_server.te - allow system_server proc_last_kmsg:file r_file_perms; # /dev/mali0 allow system_server gpu_device:chr_file rw_file_perms; -# memtrack HAL -allow system_server debugfs_mali:dir r_dir_perms; -allow system_server debugfs_mali:file r_file_perms; -allow system_server debugfs_ion:file r_file_perms; -allow system_server debugfs_mali_mem:file r_file_perms; - allow system_server frp_block_device:blk_file rw_file_perms; -allow system_server sysfs_rtc:file r_file_perms; - -allow system_server sysfs_battery_writable:dir r_dir_perms; -allow system_server sysfs_battery_writable:file rw_file_perms; - get_prop(system_server, exported_camera_prop) get_prop(system_server, userspace_reboot_config_prop) get_prop(system_server, userspace_reboot_exported_prop) + +r_file_recursive(system_server, sysfs_sec_switch) +r_file_recursive(system_server, sysfs_sec_switch_writable) + allow system_server self:capability sys_module; allow system_server shell:unix_stream_socket getopt; +allow system_server cgroup:dir { create setattr }; +allow system_server cgroup:file setattr; diff --git a/universal7885-common/sepolicy/vendor/tee.te b/universal7885-common/sepolicy/vendor/tee.te deleted file mode 100644 index e769681..0000000 --- a/universal7885-common/sepolicy/vendor/tee.te +++ /dev/null @@ -1,5 +0,0 @@ -allow tee efs_file:dir r_dir_perms; -allow tee efs_file:file rw_file_perms; -allow tee mnt_vendor_file:dir search; - -dontaudit tee system_prop:property_service set; diff --git a/universal7885-common/sepolicy/vendor/toolbox.te b/universal7885-common/sepolicy/vendor/toolbox.te deleted file mode 100644 index 9da247e..0000000 --- a/universal7885-common/sepolicy/vendor/toolbox.te +++ /dev/null @@ -1 +0,0 @@ -allow toolbox ram_device:blk_file rw_file_perms; diff --git a/universal7885-common/sepolicy/vendor/tzdaemon.te b/universal7885-common/sepolicy/vendor/tzdaemon.te deleted file mode 100644 index 8bdee9d..0000000 --- a/universal7885-common/sepolicy/vendor/tzdaemon.te +++ /dev/null @@ -1,38 +0,0 @@ -type tzdaemon, domain; -type tzdaemon_exec, exec_type, vendor_file_type, file_type; - -# tzdaemon is started by init, type transit from init domain to tzdaemon domain -init_daemon_domain(tzdaemon) - -set_prop(tzdaemon, vendor_tzdaemon_prop) -set_prop(tzdaemon, vendor_secureos_prop) - -allow tzdaemon tz_device:chr_file rw_file_perms; -allow tzdaemon tz_user_device:chr_file rw_file_perms; -allow tzdaemon tz_socket:sock_file { write }; - -# /dev/kmsg -allow tzdaemon kmsg_device:chr_file rw_file_perms; - -# /data/vendor/tee -allow tzdaemon tee_vendor_data_file:dir create_dir_perms; -allow tzdaemon tee_vendor_data_file:file create_file_perms; - -# /proc/stat -allow tzdaemon proc_stat:file r_file_perms; - -# /efs -allow tzdaemon efs_file:dir r_dir_perms; - -# /efs/tee/ -# /mnt/vendor/efs/tee/ -allow tzdaemon tee_efs_file:dir create_dir_perms; -allow tzdaemon tee_efs_file:file create_file_perms; - -# /mnt/vendor/ -allow tzdaemon mnt_vendor_file:dir r_dir_perms; - -allow tzdaemon mnt_vendor_file:dir rw_dir_perms; -allow tzdaemon efs_file:dir search; -allow tzdaemon tee_efs_file:dir { add_name remove_name open create read search write }; -allow tzdaemon tee_efs_file:file { getattr open create read rename unlink write }; diff --git a/universal7885-common/sepolicy/vendor/tztsdaemon.te b/universal7885-common/sepolicy/vendor/tztsdaemon.te deleted file mode 100644 index 0a442c4..0000000 --- a/universal7885-common/sepolicy/vendor/tztsdaemon.te +++ /dev/null @@ -1,10 +0,0 @@ -type tztsdaemon, domain; -type tztsdaemon_exec, exec_type, vendor_file_type, file_type; - -# tztsdaemon is started by init, type transit from init domain to tztsdaemon domain -init_daemon_domain(tztsdaemon) - -set_prop(tztsdaemon, vendor_tztsdaemon_prop) - -# /dev/tziwsock -allow tztsdaemon tz_user_device:chr_file rw_file_perms; diff --git a/universal7885-common/sepolicy/vendor/ueventd.te b/universal7885-common/sepolicy/vendor/ueventd.te index fe6d046..985c8ec 100644 --- a/universal7885-common/sepolicy/vendor/ueventd.te +++ b/universal7885-common/sepolicy/vendor/ueventd.te @@ -1,2 +1 @@ -allow ueventd self:capability sys_nice; allow ueventd metadata_file:dir search; diff --git a/universal7885-common/sepolicy/vendor/vendor_init.te b/universal7885-common/sepolicy/vendor/vendor_init.te index 57af5c2..717f911 100644 --- a/universal7885-common/sepolicy/vendor/vendor_init.te +++ b/universal7885-common/sepolicy/vendor/vendor_init.te @@ -1,19 +1,18 @@ typeattribute vendor_init data_between_core_and_vendor_violators; -allow vendor_init proc_swapiness:file rw_file_perms; +allow vendor_init proc_swappiness:file w_file_perms; allow vendor_init cgroup:file getattr; allow vendor_init tmpfs:dir { add_name write }; -allow vendor_init wifi_data_file:dir { getattr setattr }; + +allow vendor_init wifi_data_file:dir rw_dir_perms; +allow vendor_init wifi_data_file:dir setattr; allow vendor_init wpa_socket:dir getattr; -allow vendor_init wifi_data_file:dir search; + # mkdir /data/hostapd allow vendor_init system_data_file:dir create_dir_perms; # mkdir /data/camera/* allow vendor_init camera_data_file:dir create_dir_perms; -set_prop(vendor_init, persist_data_df_prop) -set_prop(vendor_init, persist_data_wda_prop) set_prop(vendor_init, persist_rmnet_prop) -get_prop(vendor_init, system_prop) get_prop(vendor_init, vendor_radio_prop) -allow vendor_init efs_file:lnk_file read; set_prop(vendor_init, vendor_powerhal_prop) +allow vendor_init efs_file:lnk_file read; diff --git a/universal7885-common/sepolicy/vendor/vndservice.te b/universal7885-common/sepolicy/vendor/vndservice.te deleted file mode 100644 index 12a4819..0000000 --- a/universal7885-common/sepolicy/vendor/vndservice.te +++ /dev/null @@ -1 +0,0 @@ -type vendor_surfaceflinger_vndservice, vndservice_manager_type; diff --git a/universal7885-common/sepolicy/vendor/vndservice_contexts b/universal7885-common/sepolicy/vendor/vndservice_contexts deleted file mode 100644 index f088001..0000000 --- a/universal7885-common/sepolicy/vendor/vndservice_contexts +++ /dev/null @@ -1,3 +0,0 @@ -# vndservice_contexts - -Exynos.HWCService u:object_r:vendor_surfaceflinger_vndservice:s0 diff --git a/universal7885-common/sepolicy/vendor/vold.te b/universal7885-common/sepolicy/vendor/vold.te index 23238e9..7cc01ee 100644 --- a/universal7885-common/sepolicy/vendor/vold.te +++ b/universal7885-common/sepolicy/vendor/vold.te @@ -1,6 +1 @@ -# /efs -allow vold efs_file:dir r_dir_perms; - -allow vold sysfs_virtual:file write; - -allow vold sysfs_mmc_uevent:file write; +allow vold sysfs_mmc:file w_file_perms; diff --git a/universal7885-common/sepolicy/vendor/wlbtd.te b/universal7885-common/sepolicy/vendor/wlbtd.te deleted file mode 100644 index 8d202fb..0000000 --- a/universal7885-common/sepolicy/vendor/wlbtd.te +++ /dev/null @@ -1,15 +0,0 @@ -type wlbtd, domain; - -type wlbtd_exec, exec_type, vendor_file_type, file_type; -init_daemon_domain(wlbtd) - -allow wlbtd conn_vendor_data_file:dir search; -allow wlbtd conn_vendor_data_file:file rw_file_perms; -allow wlbtd self:netlink_generic_socket { create setopt bind getattr read write }; - -allow wlbtd init:unix_stream_socket connectto; - -r_dir_file(wlbtd, sysfs_wifi) -allow wlbtd sysfs_wifi_writable:file rw_file_perms; - -set_prop(wlbtd, vendor_wlbtd_prop) diff --git a/universal7885-common/sepolicy/vendor/zygote.te b/universal7885-common/sepolicy/vendor/zygote.te deleted file mode 100644 index d1de6f3..0000000 --- a/universal7885-common/sepolicy/vendor/zygote.te +++ /dev/null @@ -1,5 +0,0 @@ -get_prop(zygote, exported_camera_prop) - -allow zygote proc_cmdline:file r_file_perms; -dontaudit zygote unlabeled:file write; - diff --git a/universal7885-common/vendor.prop b/universal7885-common/vendor.prop index 3f1fd28..a4d857e 100644 --- a/universal7885-common/vendor.prop +++ b/universal7885-common/vendor.prop @@ -17,9 +17,6 @@ ro.opengles.version=196610 debug.egl.hw=1 debug.sf.hw=1 -## Low ram device -ro.config.avoid_gfx_accel=true - ### Vulkan ro.hwui.use_vulkan=true graphics.gpu.profiler.support=true @@ -41,8 +38,6 @@ debug.sf.disable_client_composition_cache=1 ro.surface_flinger.max_frame_buffer_acquired_buffers=3 # Display -vendor.display.disable_rotator_downscale=1 -vendor.display.disable_scaler=0 persist.sys.sf.color_mode=0 persist.sys.sf.color_saturation=1.20