universal7885: Go back track slsi sepolicy

- Also cleanup rebundant rules, duplicate rules

universal7885-common/BoardConfigCommon.mk

@@ -116,18 +116,20 @@ ENABLE_VENDOR_RIL_SERVICE := true
 BOARD_ROOT_EXTRA_FOLDERS := factory
 BOARD_ROOT_EXTRA_SYMLINKS := /factory:/efs
 
-# Sepolicy
+BOARD_SEPOLICY_TEE_FLAVOR := teegris
-SYSTEM_EXT_PUBLIC_SEPOLICY_DIRS += \
+include device/samsung_slsi/sepolicy/sepolicy.mk
-    $(COMMON_PATH)/sepolicy/public
 
+# Sepolicy
 BOARD_VENDOR_SEPOLICY_DIRS += \
     $(COMMON_PATH)/sepolicy/vendor \
     hardware/samsung-ext/interfaces/sepolicy/vendor
-
+SYSTEM_EXT_PUBLIC_SEPOLICY_DIRS += \
+    $(COMMON_PATH)/sepolicy/public \
+    hardware/samsung-ext/interfaces/sepolicy/public
 SYSTEM_EXT_PRIVATE_SEPOLICY_DIRS += \
     $(COMMON_PATH)/sepolicy/private \
     hardware/samsung-ext/interfaces/sepolicy/private
-    
+
 # Vendor
 TARGET_COPY_OUT_VENDOR := vendor
 VENDOR_SECURITY_PATCH := 2023-02-05

universal7885-common/sepolicy/private/file_contexts

@@ -1,7 +1,3 @@
-# file_contexts
-
-### DATA
-/data/zram(/.*)?                             u:object_r:zram_data_file:s0
 
 # FMRadio
 /system/bin/vendor\.eureka\.hardware\.fmradio-service    		      u:object_r:hal_fmradio_default_exec:s0

universal7885-common/sepolicy/private/hal_fmradio_default.te

@@ -9,7 +9,6 @@ binder_use(hal_fmradio_default);
 allow hal_fmradio_default sysfs_fmradio_tune:file rw_file_perms;
 allow hal_fmradio_default sysfs_fmradio_tune:dir search;
 
-allow hal_fmradio_default sysfs_virtual:dir search;
 allow hal_fmradio_default fm_radio_device:chr_file { read write open ioctl };
 
 allow hal_fmradio_default hal_audio_route_service:service_manager find;

universal7885-common/sepolicy/private/hal_samsung_battery_default.te

@@ -1,3 +1,2 @@
-allow hal_samsung_battery_default { sysfs_battery sysfs_battery_writable }:dir search;
+r_file_recursive(hal_samsung_battery_default, sysfs_battery)
-allow hal_samsung_battery_default sysfs_battery_writable:file rw_file_perms;
+rw_file_recursive(hal_samsung_battery_default, sysfs_battery_writable)
-allow hal_samsung_battery_default sysfs_battery:file r_file_perms;

universal7885-common/sepolicy/private/hal_samsung_camera_flashlight_default.te

@@ -1,3 +1,2 @@
-allow hal_samsung_camera_flashlight_default sysfs_flashlight:file rw_file_perms;
+allow hal_samsung_camera_flashlight_default sysfs_camera:file rw_file_perms;
-allow hal_samsung_camera_flashlight_default sysfs_flashlight:dir search;
+allow hal_samsung_camera_flashlight_default sysfs_camera:dir search;
-allow hal_samsung_camera_flashlight_default sysfs_virtual:dir search;

universal7885-common/sepolicy/private/property_contexts

@@ -1,33 +0,0 @@
-### BLUETOOTH
-sys.bluetooth.tty                            u:object_r:exported_bluetooth_prop:s0
-
-### BUILD
-#ro.build.PDA                                 u:object_r:exported2_default_prop:s0
-
-### CAMERA
-system.camera.CC.                            u:object_r:exported_camera_prop:s0
-service.camera.                              u:object_r:exported_camera_prop:s0
-sys.cameramode.                              u:object_r:exported_camera_prop:s0
-ro.camera.req.fmq.size                       u:object_r:exported_camera_prop:s0
-ro.camera.res.fmq.size                       u:object_r:exported_camera_prop:s0
-
-### GFX
-#ro.gfx.driver.1                              u:object_r:exported3_default_prop:s0 exact string
-
-### MDC
-mdc.                                         u:object_r:exported_config_prop:s0
-
-### OMC
-persist.sys.omc_support                      u:object_r:exported_config_prop:s0
-persist.sys.omc_etcpath                      u:object_r:exported_config_prop:s0
-ro.omc.                                      u:object_r:exported_config_prop:s0
-ro.csc.					     u:object_r:exported_config_prop:s0
-
-### RADIO
-ril.NwNmId                                   u:object_r:telephony_config_prop:s0
-ril.NwNmId2                                  u:object_r:telephony_config_prop:s0
-ro.boot.cpboot                               u:object_r:telephony_config_prop:s0
-ro.simbased.changetype                       u:object_r:exported_config_prop:s0
-
-### RFKILL
-ro.rfkilldisabled                            u:object_r:rfkilldisabled_prop:s0

universal7885-common/sepolicy/public/attributes

@@ -1,8 +0,0 @@
-# Tag for read only filesystem type
-attribute r_fs_type;
-
-# Tag for read/write filesystem type
-attribute rw_fs_type;
-
-# Tag for read/execute filesystem type
-attribute rx_fs_type;

universal7885-common/sepolicy/public/domain.te

@@ -1,4 +0,0 @@
-# domain.te
-
-# Make sure that labels are used correctly
-neverallow { domain -vendor_init -ueventd } r_fs_type:file write;

universal7885-common/sepolicy/public/file.te

@@ -1,14 +1 @@
-# file.te
+type sysfs_camera, fs_type, sysfs_type, mlstrustedobject;
-
-### DATA
-type zram_data_file, file_type, data_file_type, core_data_file_type;
-
-## SYSFS
-type sysfs_virtual, fs_type, sysfs_type, mlstrustedobject;
-type sysfs_sec_switch, sysfs_type, r_fs_type, fs_type;
-type sysfs_battery, sysfs_type, r_fs_type, fs_type;
-type sysfs_sec_touchscreen, sysfs_type, r_fs_type, fs_type;
-type sysfs_sec_switch_writable, sysfs_type, rw_fs_type, fs_type;
-type sysfs_touchscreen_writable, sysfs_type, rw_fs_type, fs_type;
-type sysfs_battery_writable, sysfs_type, rw_fs_type, fs_type;
-type sysfs_flashlight, sysfs_type, rw_fs_type, fs_type;

universal7885-common/sepolicy/public/genfs_contexts

@@ -1,19 +0,0 @@
-genfscon sysfs /devices/virtual                                                   u:object_r:sysfs_virtual:s0
-genfscon sysfs /devices/virtual/camera/flash/torch_brightness_lvl                          u:object_r:sysfs_flashlight:s0
-genfscon sysfs /devices/virtual/camera/flash/torch_brightness_lvl_enable                   u:object_r:sysfs_flashlight:s0
-genfscon sysfs /class/sec/tsp                                             u:object_r:sysfs_sec_touchscreen:s0
-
-genfscon sysfs /devices/virtual/sec/tsp                                   u:object_r:sysfs_sec_touchscreen:s0
-genfscon sysfs /devices/virtual/sec/tsp/cmd                               u:object_r:sysfs_touchscreen_writable:s0
-genfscon sysfs /devices/virtual/sec/tsp/cmd_result                        u:object_r:sysfs_touchscreen_writable:s0
-genfscon sysfs /devices/virtual/sec/tsp/ear_detect_enable                 u:object_r:sysfs_touchscreen_writable:s0
-genfscon sysfs /devices/virtual/sec/tsp/prox_power_off                    u:object_r:sysfs_touchscreen_writable:s0
-genfscon sysfs /devices/virtual/sec/tsp/input/enabled                     u:object_r:sysfs_touchscreen_writable:s0
-genfscon sysfs /devices/virtual/sec/switch                                u:object_r:sysfs_sec_switch:s0
-genfscon sysfs /devices/virtual/sec/switch/afc_disable                    u:object_r:sysfs_sec_switch_writable:s0
-genfscon sysfs /devices/platform/battery/power_supply/battery                     u:object_r:sysfs_battery_writable:s0
-genfscon sysfs /devices/platform/battery/power_supply/ac/type                     u:object_r:sysfs_battery_writable:s0
-genfscon sysfs /devices/platform/battery/power_supply/wireless/type               u:object_r:sysfs_battery_writable:s0
-genfscon sysfs /devices/platform/battery/power_supply/ps/type                     u:object_r:sysfs_battery_writable:s0
-genfscon sysfs /devices/platform/battery/power_supply/ps/status                   u:object_r:sysfs_battery_writable:s0
-genfscon sysfs /devices/platform/battery/power_supply                     u:object_r:sysfs_battery:s0

universal7885-common/sepolicy/public/property.te

@@ -1,2 +0,0 @@
-### RFKILL
-type rfkilldisabled_prop, property_type;

universal7885-common/sepolicy/public/te_macros

@@ -1,8 +0,0 @@
-# teegris_use(domain)
-#
-# Allow domain to use teegris
-define(`teegris_use', `
-get_prop($1, vendor_tztsdaemon_prop)
-# /dev/tzdev
-allow $1 tz_user_device:chr_file rw_file_perms;
-')

universal7885-common/sepolicy/vendor/adbd.te

@@ -1 +0,0 @@
-allow adbd proc_last_kmsg:file r_file_perms;

universal7885-common/sepolicy/vendor/apexd.te

@@ -1 +0,0 @@
-allow apexd sysfs_virtual:file rw_file_perms;

universal7885-common/sepolicy/vendor/bootanim.te

@@ -1,2 +1 @@
 get_prop(bootanim, userspace_reboot_exported_prop) 
-allow bootanim system_data_file:dir read;

universal7885-common/sepolicy/vendor/cameraserver.te

@@ -0,0 +1 @@
+get_prop(cameraserver, vendor_camera_prop)

universal7885-common/sepolicy/vendor/cbd.te

@@ -1,65 +0,0 @@
-# cbd.te
-
-type cbd, domain;
-type cbd_exec, exec_type, vendor_file_type, file_type;
-
-allow cbd self:capability setuid;
-
-# cbd is started by init, type transit from init domain to cbd domain
-init_daemon_domain(cbd)
-
-# /dev/block/
-allow cbd block_device:dir search;
-
-# /data/vendor/log
-allow cbd log_vendor_data_file:dir search;
-
-# /data/vendor/log/cbd
-allow cbd log_cbd_vendor_data_file:dir create_dir_perms;
-allow cbd log_cbd_vendor_data_file:file create_file_perms;
-
-# /dev/block/platform/.+/by-name/radio
-allow cbd radio_block_device:blk_file r_file_perms;
-
-# /dev/kmsg
-allow cbd kmsg_device:chr_file rw_file_perms;
-
-# /dev/umts_*
-allow cbd vendor_radio_device:chr_file rw_file_perms;
-
-# /mnt/vendor/
-allow cbd mnt_vendor_file:dir search;
-
-# /mnt/vendor/efs/
-allow cbd efs_file:dir r_dir_perms;
-
-# /mnt/vendor/efs/factory.prop
-allow cbd efs_file:file r_file_perms;
-
-# /mnt/vendor/efs/nv_data.bin
-allow cbd bin_nv_data_efs_file:file r_file_perms;
-
-# /proc/cmdline
-allow cbd proc_cmdline:file r_file_perms;
-
-# /sys/power/wake_unlock
-allow cbd sysfs_wake_lock:file rw_file_perms;
-
-# /sys/devices/platform/10000.mif_pdata/sim/
-allow cbd sysfs_sim:dir r_dir_perms;
-allow cbd sysfs_sim:file r_file_perms;
-
-# /sys/devices/platform/10000.mif_pdata/sim/ds_detect
-allow cbd sysfs_sim_writable:file rw_file_perms;
-
-# kernel log
-allow cbd kernel:system syslog_read;
-
-# vendor.cbd.
-set_prop(cbd, vendor_cbd_prop)
-
-# FIXME: Can we be more specific?
-allow cbd vendor_shell_exec:file execute_no_trans;
-# FIXME END
-allow cbd factoryprop_efs_file:file r_file_perms;
-allow cbd sysfs_info:file r_file_perms;

universal7885-common/sepolicy/vendor/crash_dump.te

@@ -1,5 +0,0 @@
-get_prop(crash_dump, hwservicemanager_prop)
-get_prop(crash_dump, exported_camera_prop)
-#get_prop(crash_dump, vendor_default_prop)
-
-allow crash_dump app_data_file:file read;

universal7885-common/sepolicy/vendor/device.te

@@ -1,36 +1,7 @@
-# device.te
-
-type tz_device, dev_type;
-type tz_user_device, dev_type;
 # /dev/m2m1shot_scaler0
 type m2m1shot_device, dev_type;
-
 # gps
 type gps_device, dev_type;
 
-# /dev/goodix_fp
+# /dev/goodix_fp, /dev/egis0
-type goodix_device, dev_type;
-
-# device.te
-type efs_block_device, dev_type;
-type dqmdbg_block_device, dev_type;
-type dtbo_block_device, dev_type;
-type keydata_block_device, dev_type;
-type keyrefuge_block_device, dev_type;
-type modem_block_device, dev_type;
-type omr_block_device, dev_type;
-type radio_block_device, dev_type;
-type sec_efs_block_device, dev_type;
-
-type bbd_device, dev_type;
-type cpu_dma_device, dev_type;
-type drb_device, dev_type;
-type epic_device, dev_type;
-type fp_sensor_device, dev_type;
-type io_device, dev_type;
-type pm_qos_device, dev_type;
-type radio_qos_device, dev_type;
-type ssp_device, dev_type;
-type vendor_radio_device, dev_type;
-
 type drm_device, dev_type;

universal7885-common/sepolicy/vendor/domain.te

@@ -1,16 +0,0 @@
-# domain.te
-
-# /sys/kernel/debug/mali
-allow domain debugfs_mali:dir search;
-
-# /sys/kernel/debug/mali/mem
-allow domain debugfs_mali_mem:dir search;
-
-# /sys/kernel/debug/dma_buf
-allow domain debugfs_ion_dma:dir search;
-
-# /sys/kernel/debug/ion
-allow domain debugfs_ion:dir search;
-
-# /sys/kernel/debug/tracing/trace_marker
-allow domain debugfs_trace_marker:file getattr;

universal7885-common/sepolicy/vendor/file.te

@@ -1,121 +1,26 @@
-### DATA
-type biometrics_vendor_data_file, file_type, data_file_type;
-type conn_vendor_data_file, file_type, data_file_type;
-type gps_vendor_data_file, file_type, data_file_type;
-type log_vendor_data_file, file_type, data_file_type;
-type log_cbd_vendor_data_file, file_type, data_file_type;
-type radio_vendor_data_file, file_type, data_file_type;
-type wifi_vendor_data_file, file_type, data_file_type;
-
-# EFS
-type app_efs_file, file_type;
-type battery_efs_file, file_type;
-type bin_nv_data_efs_file, file_type;
-type cpk_efs_file, file_type;
-type imei_efs_file, file_type;
-type nfc_efs_file, file_type;
-type pfw_efs_file, file_type;
-type prov_efs_file, file_type;
-type sec_efs_file, file_type;
-type tee_efs_file, file_type;
-type wifi_efs_file, file_type;
-
-# PROC
-type proc_last_kmsg, fs_type, proc_type;
-
-# SOCKETS
-type epicd_socket, file_type, data_file_type;
-
-### SYSFS
-type sysfs_sec_ccic, sysfs_type, rw_fs_type, fs_type;
-type sysfs_argos, sysfs_type, r_fs_type, fs_type;
-type sysfs_bbd, sysfs_type, r_fs_type, fs_type;
-type sysfs_fingerprint, sysfs_type, r_fs_type, fs_type;
-type sysfs_iio, sysfs_type, r_fs_type, fs_type;
-type sysfs_input, sysfs_type, r_fs_type, fs_type;
-type sysfs_sec_gps, sysfs_type, r_fs_type, fs_type;
-type sysfs_sec_key, sysfs_type, r_fs_type, fs_type;
-type sysfs_sec_sensors, sysfs_type, r_fs_type, fs_type;
-type sysfs_sim, sysfs_type, r_fs_type, fs_type;
-type sysfs_sensors, sysfs_type, r_fs_type, fs_type;
-type sysfs_wifi, sysfs_type, r_fs_type, fs_type;
-type sysfs_mmc, sysfs_type, r_fs_type, fs_type;
-type sysfs_backlight_writable, sysfs_type, rw_fs_type, fs_type;
-type sysfs_bt_writable, sysfs_type, rw_fs_type, fs_type;
-type sysfs_mmc_uevent, sysfs_type, rw_fs_type, fs_type;
-type sysfs_mmc_queue, sysfs_type, rw_fs_type, fs_type;
-type sysfs_gps_writable, sysfs_type, rw_fs_type, fs_type;
-type sysfs_lcd_writable, sysfs_type, rw_fs_type, fs_type;
-type sysfs_power_writable, sysfs_type, rw_fs_type, fs_type;
-type sysfs_scsi_host_writable, sysfs_type, rw_fs_type, fs_type;
-type sysfs_sensorhub_writable, sysfs_type, rw_fs_type, fs_type;
-type sysfs_sensors_writable, sysfs_type, rw_fs_type, fs_type;
-type sysfs_sim_writable, sysfs_type, rw_fs_type, fs_type;
-type sysfs_spi_writeable, sysfs_type, rw_fs_type, fs_type;
-type sysfs_wifi_writable, sysfs_type, rw_fs_type, fs_type;
-type sysfs_printk, sysfs_type, rw_fs_type, fs_type;
-type sysfs_devfreq, sysfs_type, r_fs_type, fs_type;
-
-### VENDOR
-type vendor_firmware_file, file_type, vendor_file_type;
-
-# DATA
-type tee_vendor_data_file, file_type, data_file_type;
-
-# DEV SOCKET
-type tz_socket, file_type;
-
-### efs types
-type radio_factoryapp_efs_file, file_type;
-type factoryprop_efs_file, file_type;
-type sensor_factoryapp_efs_file, file_type;
-type factorymode_factoryapp_efs_file, file_type;
-type baro_delta_factoryapp_efs_file, file_type;
-# gps
-type gps_socket, file_type;
-# debugfs types
-type debugfs_mali, fs_type, debugfs_type;
-type debugfs_mali_mem, fs_type, debugfs_type;
-type debugfs_ion, fs_type, debugfs_type;
-type debugfs_ion_dma, fs_type, debugfs_type;
-# cache
-type boot_logcat_file, file_type, data_file_type;
 # proc
-type proc_extra, fs_type, proc_type;
+type proc_swappiness, fs_type, proc_type;
-type proc_reset_reason, fs_type, proc_type;
-type proc_swapiness, fs_type, proc_type;
 
 # data types
-type display_vendor_data_file, file_type, data_file_type;
-type fingerprintd_vendor_data_file, data_file_type, file_type;
 type mediadrm_data_file, file_type, data_file_type;
 type nfc_vendor_data_file, file_type, data_file_type;
+type sensors_data_file, file_type, data_file_type;
 
 # sysfs types
-type sysfs_battery_info, sysfs_type, fs_type;
-type sysfs_battery_supply, sysfs_type, rw_fs_type, fs_type;
 type sysfs_abox_writable, sysfs_type, rw_fs_type, fs_type;
-type sysfs_sensor_writable, sysfs_type, rw_fs_type, fs_type;
 type sysfs_input_writable, sysfs_type, rw_fs_type, fs_type;
-type sysfs_batteryinfo_charger_writable, sysfs_type, rw_fs_type, fs_type;
 type sysfs_camera_writable, sysfs_type, rw_fs_type, fs_type;
 type sysfs_decon, sysfs_type, r_fs_type, fs_type;
 type sysfs_socinfo, sysfs_type, r_fs_type, fs_type;
-type sysfs_v4l, sysfs_type, r_fs_type, fs_type;
 type sysfs_v4l_mfc, sysfs_type, r_fs_type, fs_type;
 type sysfs_v4l_smfc, sysfs_type, r_fs_type, fs_type;
+type sysfs_devfreq, sysfs_type, r_fs_type, fs_type;
 type sysfs_v4l_fimc, sysfs_type, r_fs_type, fs_type;
 type sysfs_graphics, fs_type, sysfs_type;
 type sysfs_multipdp, fs_type, sysfs_type, mlstrustedobject;
-type sysfs_sec, fs_type, sysfs_type, mlstrustedobject;
-type sysfs_gps, fs_type, sysfs_type, mlstrustedobject;
-type sysfs_brightness, fs_type, sysfs_type, mlstrustedobject;
 type sysfs_fuelgauge, fs_type, sysfs_type, mlstrustedobject;
 type sysfs_charger, fs_type, sysfs_type, mlstrustedobject;
 type sysfs_modem, fs_type, sysfs_type, mlstrustedobject;
-type sysfs_camera, fs_type, sysfs_type, mlstrustedobject;
+type sysfs_mmc, sysfs_type, rw_fs_type, fs_type;
-type sysfs_mmc_host_writable, sysfs_type, rw_fs_type, fs_type;
 type sysfs_ss_writable, sysfs_type, rw_fs_type, fs_type;
-type sysfs_usb_writable, sysfs_type, rw_fs_type, fs_type;
 type sysfs_gpu_writable, sysfs_type, rw_fs_type, fs_type;
-type sysfs_info, sysfs_type, r_fs_type, fs_type;

universal7885-common/sepolicy/vendor/file_contexts

@@ -1,152 +1,11 @@
-# file_contexts
-
-# DATA
-/data/vendor/tee(/.*)?                       u:object_r:tee_vendor_data_file:s0
-
-# DEV
-/dev/socket/tz                               u:object_r:tz_socket:s0
-/dev/tuihw                                   u:object_r:tz_device:s0
-/dev/tzdev                                   u:object_r:tz_user_device:s0
-/dev/tzic                                    u:object_r:tz_device:s0
-/dev/tzirs                                   u:object_r:tz_device:s0
-/dev/tziwsock                                u:object_r:tz_user_device:s0
-
-# VENDOR
-/(vendor|system/vendor)/bin/tzdaemon         u:object_r:tzdaemon_exec:s0
-/(vendor|system/vendor)/bin/tzts_daemon      u:object_r:tztsdaemon_exec:s0
-
-/(vendor|system/vendor)/lib(64)?/libteecl\.so    u:object_r:same_process_hal_file:s0
-### DATA
-/data/vendor/biometrics(/.*)?                u:object_r:biometrics_vendor_data_file:s0
-/data/vendor/conn(/.*)?                      u:object_r:conn_vendor_data_file:s0
-/data/vendor/gps(/.*)?                       u:object_r:gps_vendor_data_file:s0
-/data/vendor/wifi(/.*)?                      u:object_r:wifi_vendor_data_file:s0
-/data/vendor/log(/.*)?                       u:object_r:log_vendor_data_file:s0
-/data/vendor/log/cbd(/.*)?                   u:object_r:log_cbd_vendor_data_file:s0
-/data/vendor/secradio(/.*)?                  u:object_r:radio_vendor_data_file:s0
-
-### DEV
-/dev/block/platform/.+/by-name/boot          u:object_r:boot_block_device:s0
-/dev/block/platform/.+/by-name/cache         u:object_r:cache_block_device:s0
-/dev/block/platform/.+/by-name/efs           u:object_r:efs_block_device:s0
-/dev/block/platform/.+/by-name/dqmdbg        u:object_r:dqmdbg_block_device:s0
-/dev/block/platform/.+/by-name/dtbo          u:object_r:dtbo_block_device:s0
-/dev/block/platform/.+/by-name/keydata       u:object_r:keydata_block_device:s0
-/dev/block/platform/.+/by-name/keyrefuge     u:object_r:keyrefuge_block_device:s0
-/dev/block/platform/.+/by-name/metadata      u:object_r:metadata_block_device:s0
-/dev/block/platform/.+/by-name/misc          u:object_r:misc_block_device:s0
-/dev/block/platform/.+/by-name/modem         u:object_r:modem_block_device:s0
-/dev/block/platform/.+/by-name/persistent    u:object_r:frp_block_device:s0
-/dev/block/platform/.+/by-name/radio         u:object_r:radio_block_device:s0
-/dev/block/platform/.+/by-name/recovery      u:object_r:recovery_block_device:s0
-/dev/block/platform/.+/by-name/sec_efs       u:object_r:sec_efs_block_device:s0
-/dev/block/platform/.+/by-name/super         u:object_r:super_block_device:s0
-/dev/block/platform/.+/by-name/userdata      u:object_r:userdata_block_device:s0
-/dev/block/platform/.+/by-name/omr      u:object_r:metadata_block_device:s0
-
-/dev/esfp[0-9]                               u:object_r:fp_sensor_device:s0
-/dev/batch_io                                u:object_r:io_device:s0
-/dev/ssp_sensorhub                           u:object_r:ssp_device:s0
-
-# bluetooth
-/dev/ttySAC[0-9]                             u:object_r:bt_device:s0
-
-# cpu
-/dev/cpu_dma_latency                         u:object_r:cpu_dma_device:s0
-
-### epic
-/dev/mode                                    u:object_r:epic_device:s0
-/dev/socket/epic                             u:object_r:epicd_socket:s0
-
-### gnss/gps
-/dev/bbd_control                             u:object_r:bbd_device:s0
-/dev/bbd_packet                              u:object_r:bbd_device:s0
-/dev/bbd_patch                               u:object_r:bbd_device:s0
-/dev/bbd_reliable                            u:object_r:bbd_device:s0
-/dev/bbd_sensor                              u:object_r:bbd_device:s0
-/dev/bbd_sio                                 u:object_r:bbd_device:s0
-/dev/bbd_urgent_patch                        u:object_r:bbd_device:s0
-/dev/ttyBCM[0-9]*                            u:object_r:bbd_device:s0
-
-### qos
-/dev/bus_throughput                          u:object_r:pm_qos_device:s0
-/dev/bus_throughput_max                      u:object_r:pm_qos_device:s0
-/dev/cluster0_freq_max                       u:object_r:pm_qos_device:s0
-/dev/cluster0_freq_min                       u:object_r:pm_qos_device:s0
-/dev/cluster1_freq_max                       u:object_r:pm_qos_device:s0
-/dev/cluster1_freq_min                       u:object_r:pm_qos_device:s0
-/dev/cluster2_freq_max                       u:object_r:pm_qos_device:s0
-/dev/cluster2_freq_min                       u:object_r:pm_qos_device:s0
-/dev/cpu_online_max                          u:object_r:pm_qos_device:s0
-/dev/cpu_online_min                          u:object_r:pm_qos_device:s0
-/dev/device_throughput                       u:object_r:pm_qos_device:s0
-/dev/device_throughput_max                   u:object_r:pm_qos_device:s0
-/dev/gpu_freq_max                            u:object_r:pm_qos_device:s0
-/dev/gpu_freq_min                            u:object_r:pm_qos_device:s0
-/dev/mfc_throughput                          u:object_r:pm_qos_device:s0
-/dev/mfc_throughput_max                      u:object_r:pm_qos_device:s0
-/dev/network_throughput                      u:object_r:radio_qos_device:s0
-/dev/npu_throughput                          u:object_r:pm_qos_device:s0
-/dev/npu_throughput_max                      u:object_r:pm_qos_device:s0
-
-### radio
-# DRB
-/dev/drb                                     u:object_r:drb_device:s0
-
-# UMTS
-/dev/umts_boot0                              u:object_r:vendor_radio_device:s0
-/dev/umts_cass                               u:object_r:vendor_radio_device:s0
-/dev/umts_ipc[0-1]                           u:object_r:vendor_radio_device:s0
-/dev/umts_dm0                                u:object_r:vendor_radio_device:s0
-/dev/umts_rfs0                               u:object_r:vendor_radio_device:s0
-/dev/umts_router                             u:object_r:vendor_radio_device:s0
-
-### EFS
-/efs/Battery(/.*)?                           u:object_r:battery_efs_file:s0
-/efs/DAK(/.*)?                               u:object_r:prov_efs_file:s0
-/efs/afc(/.*)?                               u:object_r:sec_efs_file:s0
-/efs/bluetooth(/.*)?                         u:object_r:bluetooth_efs_file:s0
-/efs/cpk(/.*)?                               u:object_r:cpk_efs_file:s0
-/efs/imei(/.*)?                              u:object_r:imei_efs_file:s0
-/efs/nfc(/.*)?                               u:object_r:nfc_efs_file:s0
-/efs/nv_data\.bin(.*)                        u:object_r:bin_nv_data_efs_file:s0
-/efs/pfw_data(/.*)?                          u:object_r:pfw_efs_file:s0
-/efs/prov(/.*)?                              u:object_r:prov_efs_file:s0
-/efs/prov_data(/.*)?                         u:object_r:prov_efs_file:s0
-/efs/root(/.*)?                              u:object_r:app_efs_file:s0
-/efs/tee(/.*)?                               u:object_r:tee_efs_file:s0
-/efs/wifi(/.*)?                              u:object_r:wifi_efs_file:s0
-
-/mnt/vendor/efs(/.*)?                        u:object_r:efs_file:s0
-/mnt/vendor/efs/DAK(/.*)?                    u:object_r:prov_efs_file:s0
-/mnt/vendor/efs/afc(/.*)?                    u:object_r:sec_efs_file:s0
-/mnt/vendor/efs/bluetooth(/.*)?              u:object_r:bluetooth_efs_file:s0
-/mnt/vendor/efs/cpk(/.*)?                    u:object_r:cpk_efs_file:s0
-/mnt/vendor/efs/imei(/.*)?                   u:object_r:imei_efs_file:s0
-/mnt/vendor/efs/nv_data\.bin(.*)             u:object_r:bin_nv_data_efs_file:s0
-/mnt/vendor/efs/pfw_data(/.*)?               u:object_r:pfw_efs_file:s0
-/mnt/vendor/efs/prov(/.*)?                   u:object_r:prov_efs_file:s0
-/mnt/vendor/efs/prov_data(/.*)?              u:object_r:prov_efs_file:s0
-/mnt/vendor/efs/root(/.*)?                   u:object_r:app_efs_file:s0
-/mnt/vendor/efs/tee(/.*)?                    u:object_r:tee_efs_file:s0
-/mnt/vendor/efs/wifi(/.*)?                   u:object_r:wifi_efs_file:s0
-
-### VENDOR
-/(vendor|system/vendor)/bin/cbd              u:object_r:cbd_exec:s0
-/(vendor|system/vendor)/bin/secril_config_svc    u:object_r:secril_config_svc_exec:s0
-
-/(vendor|system/vendor)/bin/hw/android\.hardware\.biometrics\.fingerprint@[0-9].[0-9]-service\.samsung    u:object_r:hal_fingerprint_default_exec:s0
-/(vendor|system/vendor)/bin/hw/android\.hardware\.light(@[0-9].[0-9])?-service\.samsung              u:object_r:hal_light_default_exec:s0
-/(vendor|system/vendor)/bin/hw/android\.hardware\.thermal@[0-9].[0-9]-service\.samsung            u:object_r:hal_thermal_default_exec:s0
-
 ####################################
 # Devices
 /dev/mali[0-9]*                                             u:object_r:gpu_device:s0
 /dev/umts_ipc0                                              u:object_r:radio_device:s0
 /dev/fimg2d                                                 u:object_r:video_device:s0
 /dev/sec-nfc                                                u:object_r:nfc_device:s0
-/dev/esfp0                                                  u:object_r:goodix_device:s0
+/dev/esfp0                                                  u:object_r:fp_sensor_device:s0
-/dev/goodix_fp                                              u:object_r:goodix_device:s0
+/dev/goodix_fp                                              u:object_r:fp_sensor_device:s0
 /dev/gnss_ipc                                               u:object_r:gps_device:s0
 /dev/scsc_h4_0                                              u:object_r:bt_device:s0
 /dev/cpuset(/.*)?                                           u:object_r:cgroup:s0
@@ -155,7 +14,7 @@
 /dev/m2m1shot_scaler0                                       u:object_r:m2m1shot_device:s0
  
 # DRM
-/dev/s5p-smem 						    u:object_r:drm_device:s0
+/dev/s5p-smem                                               u:object_r:drm_device:s0
 
 # usb
 /dev/android_ssusbcon(/.*)?                                 u:object_r:usb_device:s0
@@ -176,7 +35,6 @@
 /dev/block/platform/.+/by-name/(cache|CACHE)?               u:object_r:cache_block_device:s0
 /dev/block/platform/.+/by-name/(system|SYSTEM)?             u:object_r:system_block_device:s0
 /dev/block/platform/.+/by-name/(userdata|USERDATA)?         u:object_r:userdata_block_device:s0
-/dev/block/platform/.+/by-name/(keyrefuge|KEYREFUGE)?       u:object_r:keyrefuge_block_device:s0
 /dev/block/platform/.+/by-name/(persistent|PERSISTENT)?     u:object_r:frp_block_device:s0
 /dev/block/platform/.+/by-name/(boot|BOOT)?                 u:object_r:boot_block_device:s0
 /dev/block/platform/.+/by-name/(recovery|RECOVERY)?         u:object_r:recovery_block_device:s0
@@ -184,40 +42,21 @@
 ####################################
 # efs
 /mnt/vendor/cpefs(/.*)?                                     u:object_r:efs_file:s0
+/factory(/.*)?                                              u:object_r:sec_efs_file:s0
 
 ####################################
 # data files
 /data/vendor/nfc(/.*)?                                      u:object_r:nfc_vendor_data_file:s0
-# drm
 /data/vendor/mediadrm(/.*)?                                 u:object_r:mediadrm_data_file:s0
-
+/data/vendor/yas_lib(/.*)?                                  u:object_r:sensors_data_file:s0
-# camera
-/data/camera(/.*)?                                          u:object_r:camera_data_file:s0
 
 ####################################
 ### VENDOR
-/(vendor|system/vendor)/lib(64)?/hw/gralloc\.exynos7884B\.so  u:object_r:same_process_hal_file:s0
+# Exynos7884'B'
-/(vendor|system/vendor)/lib(64)?/hw/gralloc\.exynos7904\.so  u:object_r:same_process_hal_file:s0
+/(vendor|system/vendor)/lib(64)?/hw/gralloc\.exynos[0-9]*B\.so    u:object_r:same_process_hal_file:s0
-/(vendor|system/vendor)/lib(64)?/libion_exynos\.so          u:object_r:same_process_hal_file:s0
+
-/(vendor|system/vendor)/bin/main_abox                       u:object_r:abox_exec:s0
+/(vendor|system/vendor)/bin/main_abox                            u:object_r:abox_exec:s0
-/(vendor|system/vendor)/bin/wlbtd                           u:object_r:wlbtd_exec:s0
+/(vendor|system/vendor)/bin/hw/android\.hardware\.camera\.provider@[0-9]\.[0-9]-service\.exynos7885	  u:object_r:hal_camera_default_exec:s0
-/system/bin/multiclientd		    u:object_r:multiclientd_exec:s0
-/(vendor|system/vendor)/bin/hw/gpsd                         u:object_r:gpsd_exec:s0
-/(vendor|system/vendor)/bin/hw/macloader                    u:object_r:macloader_exec:s0
-/(vendor|system/vendor)/bin/hw/android\.hardware\.power(@[0-9]\.[0-9])?-service\.samsung-libperfmgr   u:object_r:hal_power_default_exec:s0
-/(vendor|system/vendor)/bin/hw/android\.hardware\.vibrator(@[0-9].[0-9])?-service\.samsung    u:object_r:hal_vibrator_default_exec:s0
-/(vendor|system/vendor)/bin/hw/android\.hardware\.drm@[0-9]\.[0-9]-service\.clearkey          u:object_r:hal_drm_clearkey_exec:s0
-/(vendor|system/vendor)/bin/hw/android\.hardware\.drm@[0-9]\.[0-9]-service\.widevine          u:object_r:hal_drm_widevine_exec:s0
-/(vendor|system/vendor)/bin/hw/android\.hardware\.memtrack-service\.samsung-mali	       u:object_r:hal_memtrack_default_exec:s0
-/(vendor|system/vendor)/bin/hw/android\.hardware\.keymaster@[0-9]\.[0-9]-service\.samsung     u:object_r:hal_keymaster_default_exec:s0
-/(vendor|system/vendor)/bin/hw/android\.hardware\.nfc@[0-9]\.[0-9]-service\.samsung           u:object_r:hal_nfc_default_exec:s0
-/(vendor|system/vendor)/bin/hw/android\.hardware\.usb(@[0-9]\.[0-9])?-service\.samsung        u:object_r:hal_usb_default_exec:s0
-/(vendor|system/vendor)/bin/hw/android\.hardware\.camera\.provider@[0-9]\.[0-9]-service\.exynos7885        u:object_r:hal_camera_default_exec:s0
 /(vendor|system/vendor)/bin/hw/android\.hardware\.usb@[0-9]\.[0-9]-service\.a10	              u:object_r:hal_usb_default_exec:s0
-/(vendor|system/vendor)/bin/hw/vendor\.samsung\.hardware\.gnss@[0-9]\.[0-9]-service           u:object_r:hal_gnss_default_exec:s0
+/(vendor|system/vendor)/bin/hw/android\.hardware\.sensors@[0-9]\.[0-9]-service_a10            u:object_r:hal_sensors_default_exec:s0
-/(vendor|system/vendor)/bin/hw/android\.hardware\.sensors@[0-9]\.[0-9]-service\.a10	              u:object_r:hal_sensors_default_exec:s0
+/(vendor|system/vendor)/bin/hw/android\.hardware\.power\.stats-service\.exynos7	              u:object_r:hal_power_stats_default_exec:s0
-/(vendor|system/vendor)/bin/hw/android\.hardware\.power\.stats-service\.exynos7			u:object_r:hal_power_stats_default_exec:s0
-/(vendor|system/vendor)/firmware(/.*)?       u:object_r:vendor_firmware_file:s0
-
-/factory(/.*)?									u:object_r:sec_efs_file:s0
-

universal7885-common/sepolicy/vendor/fsck.te

@@ -1,4 +1,2 @@
-allow fsck cache_file:dir getattr;
-allow fsck tmpfs:blk_file getattr;
 allow fsck efs_block_device:blk_file rw_file_perms;
 allow fsck omr_block_device:blk_file rw_file_perms;

universal7885-common/sepolicy/vendor/genfs_contexts

@@ -1,90 +1,14 @@
-# genfs_contexts
+# PROCFS
+genfscon proc /sys/vm/swappiness                  u:object_r:proc_swappiness:s0
 
-### PROC
+genfscon sysfs /devices/platform/battery/power_supply/battery/batt_slate_mode     u:object_r:sysfs_battery_writable:s0
-genfscon proc /last_kmsg                                                  u:object_r:proc_last_kmsg:s0
-
-### SYSFS
-genfscon sysfs /bbd                                                       u:object_r:sysfs_bbd:s0
-
-genfscon sysfs /bus/iio/devices                                           u:object_r:sysfs_iio:s0
-
-genfscon sysfs /class/backlight/                                          u:object_r:sysfs_backlight_writable:s0
-genfscon sysfs /class/fingerprint/fingerprint                             u:object_r:sysfs_fingerprint:s0
-genfscon sysfs /class/input                                               u:object_r:sysfs_input:s0
-genfscon sysfs /class/power_supply                                        u:object_r:sysfs_battery:s0
-genfscon sysfs /class/rtc/rtc0                                            u:object_r:sysfs_rtc:s0
-genfscon sysfs /class/sec/gps                                             u:object_r:sysfs_sec_gps:s0
-genfscon sysfs /class/sec/ccic                                         u:object_r:sysfs_sec_ccic:s0
-genfscon sysfs /class/sec/sensors                                         u:object_r:sysfs_sec_sensors:s0
-genfscon sysfs /class/sensor_event                                        u:object_r:sysfs_sensors:s0
-genfscon sysfs /class/sensors                                             u:object_r:sysfs_sensors:s0
-genfscon sysfs /class/thermal                                             u:object_r:sysfs_thermal:s0
-genfscon sysfs /class/timed_output/vibrator/intensity                     u:object_r:sysfs_vibrator:s0
-genfscon sysfs /class/timed_output/vibrator/multi_freq                    u:object_r:sysfs_vibrator:s0
-
-genfscon sysfs /devices/platform/argos                                    u:object_r:sysfs_argos:s0
-
-genfscon sysfs /devices/platform/13500000.dwmmc0/mmc_host/mmc0/ u:object_r:sysfs_mmc:s0
-genfscon sysfs /devices/platform/13500000.dwmmc0/mmc_host/mmc0/mmc0:0001/block/mmcblk0/queue/ u:object_r:sysfs_mmc_queue:s0
-
-genfscon sysfs /devices/platform/13500000.dwmmc0/mmc_host/mmc0/mmc0:0001/block/mmcblk0/uevent u:object_r:sysfs_mmc_uevent:s0
-
-genfscon sysfs /devices/virtual/fingerprint/fingerprint                   u:object_r:sysfs_fingerprint:s0
-genfscon sysfs /devices/virtual/input                                     u:object_r:sysfs_input:s0
-genfscon sysfs /devices/virtual/lcd/panel                                 u:object_r:sysfs_lcd_writable:s0
-genfscon sysfs /devices/virtual/sec/gps                                   u:object_r:sysfs_sec_gps:s0
-genfscon sysfs /devices/virtual/sec/sec_key                               u:object_r:sysfs_sec_key:s0
-genfscon sysfs /devices/virtual/sec/ccic                                         u:object_r:sysfs_sec_ccic:s0
-genfscon sysfs /devices/virtual/sensor_event                              u:object_r:sysfs_sensors:s0
-genfscon sysfs /devices/virtual/sensors                                   u:object_r:sysfs_sensors:s0
-genfscon sysfs /devices/virtual/sensors/hidden_hole/hh_check_coef         u:object_r:sysfs_sensors_writable:s0
-genfscon sysfs /devices/virtual/sensors/ssp_sensor/enable                 u:object_r:sysfs_sensors_writable:s0
-genfscon sysfs /devices/virtual/sensors/ssp_sensor/ssp_flush              u:object_r:sysfs_sensors_writable:s0
-genfscon sysfs /devices/virtual/thermal                                   u:object_r:sysfs_thermal:s0
-genfscon sysfs /devices/virtual/timed_output/vibrator/cp_trigger_index    u:object_r:sysfs_vibrator:s0
-genfscon sysfs /devices/virtual/timed_output/vibrator/intensity           u:object_r:sysfs_vibrator:s0
-genfscon sysfs /devices/virtual/timed_output/vibrator/multi_freq          u:object_r:sysfs_vibrator:s0
-
-genfscon sysfs /module/dhd/parameters                                     u:object_r:sysfs_wifi_writable:s0
-genfscon sysfs /module/printk/parameters/enabled			u:object_r:sysfs_printk:s0
-genfscon sysfs /power/cpufreq_max_limit                                   u:object_r:sysfs_power_writable:s0
-genfscon sysfs /power/cpufreq_min_limit                                   u:object_r:sysfs_power_writable:s0
-genfscon sysfs /power/cpuhotplug/max_online_cpu                           u:object_r:sysfs_power_writable:s0
-genfscon sysfs /power/rtc_status                                          u:object_r:sysfs_power_writable:s0
-
-genfscon sysfs /wifi                                                      u:object_r:sysfs_wifi:s0
-genfscon sysfs /wifi/cid                                                  u:object_r:sysfs_wifi_writable:s0
-genfscon sysfs /wifi/mac_addr                                             u:object_r:sysfs_wifi_writable:s0
-genfscon sysfs /wifi/memdump                                              u:object_r:sysfs_wifi_writable:s0
-
-# DEBUGFS
-genfscon debugfs /mali/                           u:object_r:debugfs_mali:s0
-genfscon debugfs /mali/mem/                       u:object_r:debugfs_mali_mem:s0
-
-# ion debugfs
-genfscon debugfs /ion/                            u:object_r:debugfs_ion:s0
-genfscon debugfs /dma_buf                         u:object_r:debugfs_ion_dma:s0
-
-# PROC
-genfscon proc /extra                              u:object_r:proc_extra:s0
-genfscon proc /reset_reason                       u:object_r:proc_reset_reason:s0
-genfscon proc /sys/vm/swappiness                  u:object_r:proc_swapiness:s0
-
-# SYSFS
-
-# class
-genfscon sysfs /class/video4linux                                                 u:object_r:sysfs_v4l:s0
-genfscon sysfs /class/input/input1                                                u:object_r:sysfs_input:s0
-genfscon sysfs /class/backlight/panel/brightness                                  u:object_r:sysfs_graphics:s0
-genfscon sysfs /class/backlight/panel/max_brightness                              u:object_r:sysfs_graphics:s0
-
-# battery
-genfscon sysfs /class/power_supply/battery/                                       u:object_r:sysfs_battery_info:s0
-
-# devices
 
+# device
 genfscon sysfs /devices/virtual/misc/multipdp                                     u:object_r:sysfs_multipdp:s0
-genfscon sysfs /devices/virtual/sensors/sensor_dev/flush                          u:object_r:sysfs_sensor_writable:s0
+genfscon sysfs /devices/virtual/camera                                            u:object_r:sysfs_camera:s0
+
+genfscon sysfs /devices/platform/gpio_keys/input/                                 u:object_r:sysfs_input:s0
+genfscon sysfs /devices/platform/flip_cover/input/                                u:object_r:sysfs_input:s0
 genfscon sysfs /devices/virtual/input/input1/enable                               u:object_r:sysfs_input_writable:s0
 genfscon sysfs /devices/virtual/input/input2/enable                               u:object_r:sysfs_input_writable:s0
 genfscon sysfs /devices/virtual/input/input3/enable                               u:object_r:sysfs_input_writable:s0
@@ -95,7 +19,7 @@ genfscon sysfs /devices/virtual/input/input7/enable
 genfscon sysfs /devices/virtual/input/input8/enable                               u:object_r:sysfs_input_writable:s0
 genfscon sysfs /devices/virtual/input/input9/enable                               u:object_r:sysfs_input_writable:s0
 genfscon sysfs /devices/virtual/input/input10/enable                              u:object_r:sysfs_input_writable:s0
-genfscon sysfs /devices/virtual/input/input11/enable                               u:object_r:sysfs_input_writable:s0
+genfscon sysfs /devices/virtual/input/input11/enable                              u:object_r:sysfs_input_writable:s0
 genfscon sysfs /devices/virtual/input/input12/enable                              u:object_r:sysfs_input_writable:s0
 genfscon sysfs /devices/virtual/input/input1/poll_delay                           u:object_r:sysfs_input_writable:s0
 genfscon sysfs /devices/virtual/input/input2/poll_delay                           u:object_r:sysfs_input_writable:s0
@@ -106,33 +30,32 @@ genfscon sysfs /devices/virtual/input/input6/poll_delay
 genfscon sysfs /devices/virtual/input/input7/poll_delay                           u:object_r:sysfs_input_writable:s0
 genfscon sysfs /devices/virtual/input/input8/poll_delay                           u:object_r:sysfs_input_writable:s0
 genfscon sysfs /devices/virtual/input/input9/poll_delay                           u:object_r:sysfs_input_writable:s0
-genfscon sysfs /devices/virtual/input/input10/poll_delay                           u:object_r:sysfs_input_writable:s0
+genfscon sysfs /devices/virtual/input/input10/poll_delay                          u:object_r:sysfs_input_writable:s0
-genfscon sysfs /devices/virtual/input/input11/poll_delay                           u:object_r:sysfs_input_writable:s0
+genfscon sysfs /devices/virtual/input/input11/poll_delay                          u:object_r:sysfs_input_writable:s0
-genfscon sysfs /devices/virtual/input/input12/poll_delay                           u:object_r:sysfs_input_writable:s0
+genfscon sysfs /devices/virtual/input/input12/poll_delay                          u:object_r:sysfs_input_writable:s0
+genfscon sysfs /devices/virtual/sensors/sensor_dev/flush                          u:object_r:sysfs_input_writable:s0
 
-# A20e GPIO
+genfscon sysfs /devices/virtual/sec/hall_ic/                                      u:object_r:sysfs_sec_key:s0
-genfscon sysfs /devices/platform/gpio_keys/input/input12                          u:object_r:sysfs_input:s0
-# A20 GPIO
-genfscon sysfs /devices/platform/gpio_keys/input/input13                          u:object_r:sysfs_input:s0
-genfscon sysfs /devices/platform/flip_cover/input/input13                         u:object_r:sysfs_input:s0
 genfscon sysfs /devices/platform/10000.mif_pdata/sim/ds_detect                    u:object_r:sysfs_sim_writable:s0
+
 # A20e RTC
-genfscon sysfs /devices/platform/11ce0000.speedy/i2c-5/5-0000/s2mpu08-rtc/rtc    u:object_r:sysfs_rtc:s0
+genfscon sysfs /devices/platform/11ce0000.speedy/i2c-5/5-0000/s2mpu08-rtc/rtc     u:object_r:sysfs_rtc:s0
 # A20 RTC
 genfscon sysfs /devices/platform/11ce0000.speedy/i2c-6/6-0000/s2mpu08-rtc/rtc     u:object_r:sysfs_rtc:s0
 # A40 RTC
 genfscon sysfs /devices/platform/11ce0000.speedy/i2c-7/7-0000/s2mpu08-rtc/rtc     u:object_r:sysfs_rtc:s0
 
 # A20e Display
-genfscon sysfs /devices/platform/13870000.i2c/i2c-11/11-0048/input/            u:object_r:sysfs_touchscreen_writable:s0
+genfscon sysfs /devices/platform/13870000.i2c/i2c-11/11-0048/input/               u:object_r:sysfs_touchscreen_writable:s0
 genfscon sysfs /devices/platform/11ce0000.speedy/i2c-5/5-0003/input/input11		  u:object_r:sysfs_touchscreen_writable:s0
 # A20 Display
-genfscon sysfs /devices/platform/13870000.i2c/i2c-11/11-0020/input/            u:object_r:sysfs_touchscreen_writable:s0
+genfscon sysfs /devices/platform/13870000.i2c/i2c-11/11-0020/input/               u:object_r:sysfs_touchscreen_writable:s0
-genfscon sysfs /devices/platform/11ce0000.speedy/i2c-6/6-0003/input/input12     u:object_r:sysfs_touchscreen_writable:s0
+genfscon sysfs /devices/platform/11ce0000.speedy/i2c-6/6-0003/input/input12       u:object_r:sysfs_touchscreen_writable:s0
 # A40 Display
 genfscon sysfs /devices/platform/11ce0000.speedy/i2c-7/7-0003/input/input11       u:object_r:sysfs_touchscreen_writable:s0
 genfscon sysfs /devices/platform/13930000.hsi2c/i2c-5/5-0048/input/               u:object_r:sysfs_touchscreen_writable:s0
 
+genfscon sysfs /devices/platform/13500000.dwmmc0/mmc_host/mmc0                    u:object_r:sysfs_mmc:s0
 genfscon sysfs /devices/platform/14870000.dsim/backlight/panel                    u:object_r:sysfs_graphics:s0
 genfscon sysfs /devices/platform/14a50000.abox/service                            u:object_r:sysfs_abox_writable:s0
 genfscon sysfs /devices/platform/14860000.decon_f                                 u:object_r:sysfs_decon:s0
@@ -143,45 +66,42 @@ genfscon sysfs /devices/platform/14440000.fimc_is/video4linux
 genfscon sysfs /devices/platform/12c30000.mfc0/video4linux                        u:object_r:sysfs_v4l_mfc:s0
 genfscon sysfs /devices/platform/12c00000.smfc/video4linux                        u:object_r:sysfs_v4l_smfc:s0
 genfscon sysfs /devices/soc0/soc_id                                               u:object_r:sysfs_socinfo:s0
-genfscon sysfs /devices/soc0/machine                                              u:object_r:sysfs_sec_gps:s0
+genfscon sysfs /devices/soc0/machine                                              u:object_r:sysfs_socinfo:s0
-genfscon sysfs /devices/soc0/revision                                             u:object_r:sysfs_sec_gps:s0
+genfscon sysfs /devices/soc0/revision                                             u:object_r:sysfs_socinfo:s0
-genfscon sysfs /devices/virtual/block/zram0/mm_stat                               u:object_r:sysfs_zram:s0
 genfscon sysfs /devices/system/chip-id/revision                                   u:object_r:sysfs_ss_writable:s0
 
 # Devfreq
-genfscon sysfs /devices/platform/17000010.devfreq_mif/devfreq/17000010.devfreq_mif 			u:object_r:sysfs_devfreq:s0
+genfscon sysfs /devices/platform/17000010.devfreq_mif/devfreq/17000010.devfreq_mif                  u:object_r:sysfs_devfreq:s0
 genfscon sysfs /devices/platform/17000020.devfreq_int/devfreq/17000020.devfreq_int                  u:object_r:sysfs_devfreq:s0
-genfscon sysfs /devices/platform/17000040.devfreq_disp/devfreq/17000040.devfreq_disp                  u:object_r:sysfs_devfreq:s0
+genfscon sysfs /devices/platform/17000040.devfreq_disp/devfreq/17000040.devfreq_disp                u:object_r:sysfs_devfreq:s0
 genfscon sysfs /devices/platform/17000050.devfreq_cam/devfreq/17000050.devfreq_cam                  u:object_r:sysfs_devfreq:s0
 genfscon sysfs /devices/platform/17000060.devfreq_aud/devfreq/17000060.devfreq_aud                  u:object_r:sysfs_devfreq:s0
-genfscon sysfs /devices/platform/17000070.devfreq_fsys/devfreq/17000070.devfreq_fsys                  u:object_r:sysfs_devfreq:s0
+genfscon sysfs /devices/platform/17000070.devfreq_fsys/devfreq/17000070.devfreq_fsys                u:object_r:sysfs_devfreq:s0
 
 # S2MU005 CHARGER (A10)
 genfscon sysfs /devices/platform/13840000.i2c/i2c-9/9-003d/s2mu004-charger/power_supply/s2mu004-charger u:object_r:sysfs_charger:s0
 genfscon sysfs /devices/platform/13840000.i2c/i2c-9/9-003d/s2mu004-muic/power_supply/muic-manager       u:object_r:sysfs_charger:s0
-genfscon sysfs /devices/platform/13840000.i2c/i2c-9/9-003d/s2mu004-charger/power_supply/otg		 u:object_r:sysfs_charger:s0
+genfscon sysfs /devices/platform/13840000.i2c/i2c-9/9-003d/s2mu004-charger/power_supply/otg		        u:object_r:sysfs_charger:s0
-genfscon sysfs /devices/platform/13840000.i2c/i2c-8/8-003d/s2mu005-charger/power_supply/otg/type	 u:object_r:sysfs_charger:s0
+genfscon sysfs /devices/platform/13840000.i2c/i2c-8/8-003d/s2mu005-charger/power_supply/otg/type	    u:object_r:sysfs_charger:s0
 
 # S2MU106 CHARGER (A20e)
 genfscon sysfs /devices/platform/13840000.i2c/i2c-8/8-003d/s2mu106-powermeter/power_supply/s2mu106_pmeter u:object_r:sysfs_charger:s0
 genfscon sysfs /devices/platform/13840000.i2c/i2c-8/8-003d/s2mu106-muic/power_supply/muic-manager         u:object_r:sysfs_charger:s0
 genfscon sysfs /devices/platform/13840000.i2c/i2c-8/8-003d/s2mu106-charger/power_supply/otg               u:object_r:sysfs_charger:s0
 genfscon sysfs /devices/platform/13840000.i2c/i2c-8/8-003d/s2mu106-charger/power_supply/s2mu106-charger   u:object_r:sysfs_charger:s0
-genfscon sysfs /devices/platform/13830000.i2c/i2c-7/7-003c/power_supply/s2mu106-usbpd/type		  u:object_r:sysfs_charger:s0
+genfscon sysfs /devices/platform/13830000.i2c/i2c-7/7-003c/power_supply/s2mu106-usbpd/type		          u:object_r:sysfs_charger:s0
-genfscon sysfs /devices/platform/13830000.i2c/i2c-7/7-003b/power_supply/s2mu106-fuelgauge/type	      u:object_r:sysfs_fuelgauge:s0
+genfscon sysfs /devices/platform/13830000.i2c/i2c-7/7-003b/power_supply/s2mu106-fuelgauge/type	          u:object_r:sysfs_fuelgauge:s0
 
 # S2MU106 CHARGER (A20)
 genfscon sysfs /devices/platform/13840000.i2c/i2c-9/9-003d/s2mu106-powermeter/power_supply/s2mu106_pmeter u:object_r:sysfs_charger:s0
 genfscon sysfs /devices/platform/13840000.i2c/i2c-9/9-003d/s2mu106-muic/power_supply/muic-manager         u:object_r:sysfs_charger:s0
 genfscon sysfs /devices/platform/13840000.i2c/i2c-9/9-003d/s2mu106-charger/power_supply/otg               u:object_r:sysfs_charger:s0
 genfscon sysfs /devices/platform/13840000.i2c/i2c-9/9-003d/s2mu106-charger/power_supply/s2mu106-charger   u:object_r:sysfs_charger:s0
-genfscon sysfs /devices/platform/13830000.i2c/i2c-8/8-003c/power_supply/s2mu106-usbpd/type		  u:object_r:sysfs_charger:s0
+genfscon sysfs /devices/platform/13830000.i2c/i2c-8/8-003c/power_supply/s2mu106-usbpd/type                u:object_r:sysfs_charger:s0
-genfscon sysfs /devices/platform/13830000.i2c/i2c-8/8-003b/power_supply/s2mu106-fuelgauge/type               u:object_r:sysfs_fuelgauge:s0
+genfscon sysfs /devices/platform/13830000.i2c/i2c-8/8-003b/power_supply/s2mu106-fuelgauge/type            u:object_r:sysfs_fuelgauge:s0
 
-genfscon sysfs /class/input/input1/enabled					     u:object_r:sysfs_sec_touchscreen:s0
 genfscon sysfs /module/modem_ctrl_ss310ap/parameters/ds_detect                    u:object_r:sysfs_modem:s0
 genfscon sysfs /module/scsc_bt/parameters/bluetooth_address                       u:object_r:sysfs_bt_writable:s0
-genfscon sysfs /firmware/devicetree/base/model_info-system_rev                    u:object_r:sysfs_info:s0
 genfscon sysfs /kernel/gpu/                                                       u:object_r:sysfs_gpu:s0
 genfscon sysfs /kernel/gpu/gpu_max_clock                                          u:object_r:sysfs_gpu_writable:s0
 genfscon sysfs /kernel/gpu/gpu_min_clock                                          u:object_r:sysfs_gpu_writable:s0

universal7885-common/sepolicy/vendor/gpsd.te

@@ -1,47 +1,5 @@
-type gpsd, domain, netdomain;
-type gpsd_exec, exec_type, vendor_file_type, file_type;
-
-# gpsd is started by init, type transit from init domain to gpsd domain
-init_daemon_domain(gpsd)
-
-allow gpsd rild:unix_stream_socket connectto;
-
-get_prop(gpsd, vendor_radio_prop)
-allow gpsd system_data_file:dir search;
-
-get_prop(gpsd, telephony_config_prop)
-get_prop(gpsd, exported_config_prop)
-
-get_prop(gpsd, hwservicemanager_prop)
-hwbinder_use(gpsd)
-allow gpsd system_suspend_hwservice:hwservice_manager { find };
-allow gpsd fwk_sensor_hwservice:hwservice_manager { find };
-
-binder_call(gpsd, system_suspend_server)
-binder_call(gpsd, system_server)
-binder_call(system_server, gpsd)
-
-allow gpsd self:netlink_kobject_uevent_socket create_socket_perms_no_ioctl;
-allow gpsd self:{ tcp_socket udp_socket } create_stream_socket_perms;
-allow gpsd port:tcp_socket { name_bind name_connect };
-allow gpsd port:udp_socket name_bind;
-allow gpsd node:{ tcp_socket udp_socket } node_bind;
-
-# /acct/tasks
-allow gpsd cgroup:file getattr;
-
-# /dev/socket/fwmarkd
-allow gpsd fwmarkd_socket:sock_file write;
-
-# /data/vendor/gps
-allow gpsd gps_vendor_data_file:dir rw_dir_perms;
-allow gpsd gps_vendor_data_file:file create_file_perms;
-allow gpsd gps_vendor_data_file:fifo_file create_file_perms;
-
-r_dir_file(gpsd, sysfs_sec_gps)
-
-allow gpsd sysfs_gps_writable:file rw_file_perms;
 allow gpsd sysfs_wake_lock:file rw_file_perms;
+allow gpsd sysfs_socinfo:file r_file_perms;
 
 allow gpsd self:capability net_raw;
 allow gpsd self:capability2 block_suspend;
@@ -50,7 +8,8 @@ allow gpsd bt_device:chr_file rw_file_perms;
 allow gpsd gps_device:chr_file rw_file_perms;
 allow gpsd gpsd_exec:file execute_no_trans;
 
-get_prop(gpsd, exported_config_prop)
-get_prop(gpsd, bootanim_system_prop)
 allow gpsd servicemanager:binder call;
 allow gpsd hal_system_suspend_service:service_manager find;
+
+get_prop(gpsd, exported_config_prop)
+get_prop(gpsd, bootanim_system_prop)

universal7885-common/sepolicy/vendor/gpuservice.te

@@ -1 +0,0 @@
-get_prop(gpuservice, graphics_config_prop)

universal7885-common/sepolicy/vendor/hal_bluetooth_default.te

@@ -1,24 +0,0 @@
-
-# ro.rfkilldisabled
-get_prop(hal_bluetooth_default, rfkilldisabled_prop)
-# vendor.bluetooth_fw_ver
-set_prop(hal_bluetooth_default, wifi_log_prop)
-# sys.bluetooth.tty
-set_prop(hal_bluetooth_default, exported_bluetooth_prop)
-
-# /dev/ttySAC[0-9]
-allow hal_bluetooth_default bt_device:chr_file rw_file_perms;
-
-# /mnt/vendor
-allow hal_bluetooth_default mnt_vendor_file:dir search;
-
-# /mnt/vendor/efs/
-allow hal_bluetooth_default efs_file:dir r_dir_perms;
-
-# /mnt/vendor/conn
-allow hal_bluetooth_default conn_vendor_data_file:dir r_dir_perms;
-allow hal_bluetooth_default conn_vendor_data_file:file r_file_perms;
-
-# /sys/devices/platform/bluetooth/rfkill/rfkill0/state
-allow hal_bluetooth_default sysfs_bt_writable:file rw_file_perms;
-allow hal_bluetooth_default vendor_firmware_file:dir r_dir_perms;

universal7885-common/sepolicy/vendor/hal_camera_default.te

@@ -1,25 +1,11 @@
-vndbinder_use(hal_camera_default)
-
-allow hal_camera_default vndbinder_device:chr_file r_file_perms;
 allow hal_camera_default hal_graphics_mapper_hwservice:hwservice_manager find;
 allow hal_camera_default hal_graphics_composer_default:fd use;
-allow hal_camera_default sysfs_virtual:dir search;
+
-allow hal_camera_default sysfs_virtual:file rw_file_perms;
+rw_file_recursive(hal_camera_default, sysfs_camera)
-allow hal_camera_default sysfs_camera:dir search;
+r_file_recursive(hal_camera_default, sysfs_battery)
-allow hal_camera_default sysfs_camera:file rw_file_perms;
-allow hal_camera_default sysfs_battery:dir search;
-allow hal_camera_default sysfs_battery_writable:dir search;
-allow hal_camera_default sysfs_battery_writable:file r_file_perms;
 
 get_prop(hal_camera_default, exported_camera_prop)
 set_prop(hal_camera_default, vendor_camera_prop)
-get_prop(hal_camera_default, exported_default_prop)
 get_prop(hal_camera_default, vendor_factory_prop)
-get_prop(hal_camera_default, exported_config_prop)
-get_prop(hal_camera_default, exported_system_prop)
 
 binder_call(hal_camera_default, system_server)
-binder_call(system_server, hal_camera_default)
-
-r_dir_file(hal_camera_default, sysfs_decon)
-set_prop(hal_camera_default, camera_prop)

universal7885-common/sepolicy/vendor/hal_drm_clearkey.te

@@ -1,14 +0,0 @@
-# policy for /vendor/bin/hw/android.hardware.drm clearkey service
-type hal_drm_clearkey, domain;
-type hal_drm_clearkey_exec, exec_type, vendor_file_type, file_type;
-
-init_daemon_domain(hal_drm_clearkey)
-
-hal_server_domain(hal_drm_clearkey, hal_drm)
-
-vndbinder_use(hal_drm_clearkey)
-
-allow hal_drm_clearkey { appdomain -isolated_app }:fd use;
-
-allow hal_drm_clearkey mediadrm_data_file:dir create_dir_perms;
-allow hal_drm_clearkey mediadrm_data_file:file create_file_perms;

universal7885-common/sepolicy/vendor/hal_drm_widevine.te

@@ -1,28 +1,12 @@
-type hal_drm_widevine, domain;
-type hal_drm_widevine_exec, exec_type, vendor_file_type, file_type;
-
-init_daemon_domain(hal_drm_widevine)
-
-hal_server_domain(hal_drm_widevine, hal_drm)
-
-vndbinder_use(hal_drm_widevine)
-
-allow hal_drm_widevine mediacodec:fd use;
-allow hal_drm_widevine { appdomain -isolated_app }:fd use;
-
-allow hal_drm_widevine hal_allocator_server:fd use;
-
-allow hal_drm_widevine mediadrm_data_file:dir create_dir_perms;
-allow hal_drm_widevine mediadrm_data_file:file create_file_perms;
-allow hal_drm_widevine vendor_data_file:dir create_dir_perms;
-allow hal_drm_widevine vendor_data_file:file create_file_perms;
-
 allow hal_drm_widevine cpk_efs_file:file r_file_perms;
 allow hal_drm_widevine efs_file:dir search;
 allow hal_drm_widevine efs_file:lnk_file r_file_perms;
 
-allow hal_drm_widevine drm_device:chr_file { read write open ioctl };
+allow hal_drm_widevine drm_device:chr_file rw_file_perms;
-
+allow hal_drm_widevine tz_user_device:chr_file rw_file_perms;
-allow hal_drm_widevine tz_user_device:chr_file { read write open ioctl };
 
 allow hal_drm_widevine sec_efs_file:file r_file_perms;
+allow hal_drm_widevine mediadrm_data_file:file create_file_perms;
+allow hal_drm_widevine mediadrm_data_file:dir create_dir_perms;
+
+allow hal_drm_widevine mediacodec:fd use;

universal7885-common/sepolicy/vendor/hal_fingerprint_default.te

@@ -1,26 +1,5 @@
-# hal_fingerprint_default.te
-
-teegris_use(hal_fingerprint_default)
-# /dev/esfp[0-9]
-allow hal_fingerprint_default fp_sensor_device:chr_file rw_file_perms;
-
-# /data/vendor/ -> biometrics
-file_type_auto_trans(hal_fingerprint_default, vendor_data_file, biometrics_vendor_data_file)
-
-# /data/vendor/biometrics/*
-allow hal_fingerprint_default biometrics_vendor_data_file:file create_file_perms;
-
-# /sys/class/fingerprint/
-allow hal_fingerprint_default sysfs_fingerprint:dir r_dir_perms;
-allow hal_fingerprint_default sysfs_fingerprint:file r_file_perms;
 typeattribute hal_fingerprint_default data_between_core_and_vendor_violators;
 
-allow hal_fingerprint_default fingerprintd_data_file:dir write;
-allow hal_fingerprint_default sysfs_virtual:dir search;
-allow hal_fingerprint_default sysfs_virtual:file r_file_perms;
-
-allow hal_fingerprint_default goodix_device:chr_file rw_file_perms;
-
 allow hal_fingerprint_default self:netlink_socket { bind create write read };
 allow hal_fingerprint_default uhid_device:chr_file rw_file_perms;
 

universal7885-common/sepolicy/vendor/hal_gatekeeper_default.te

@@ -1,4 +1,3 @@
 allow hal_gatekeeper_default efs_file:dir search;
 allow hal_gatekeeper_default efs_file:file rw_file_perms;
 allow hal_gatekeeper_default mnt_vendor_file:dir search;
-teegris_use(hal_gatekeeper_default)

universal7885-common/sepolicy/vendor/hal_gnss_default.te

@@ -1,18 +1,3 @@
-# hal_gnss_default.te
-
-# cgroups tasks
-allow hal_gnss_default cgroup:file getattr;
-
-# /data/vendor/gps
-allow hal_gnss_default gps_vendor_data_file:dir rw_dir_perms;
-allow hal_gnss_default gps_vendor_data_file:file create_file_perms;
-allow hal_gnss_default gps_vendor_data_file:fifo_file create_file_perms;
-
-# /mnt/vendor
-allow hal_gnss_default mnt_vendor_file:dir search;
-# vndbinder
-allow hal_gnss_default vndbinder_device:chr_file rw_file_perms;
-
 # Connect to socket
 allow hal_gnss_default gpsd:unix_stream_socket connectto;
 

universal7885-common/sepolicy/vendor/hal_graphics_allocator_default.te

@@ -1,7 +0,0 @@
-allow hal_graphics_allocator_default cgroup:file rw_file_perms;
-
-vndbinder_use(hal_graphics_allocator_default)
-
-# /sys/kernel/debug/dma_buf/footprint/[0-9]+
-allow hal_graphics_allocator_default debugfs_ion_dma:dir r_dir_perms;
-allow hal_graphics_allocator_default debugfs_ion_dma:file r_file_perms;

universal7885-common/sepolicy/vendor/hal_graphics_composer_default.te

@@ -17,27 +17,18 @@ allow hal_graphics_composer_default graphics_device:chr_file rw_file_perms;
 # /dev/video50
 allow hal_graphics_composer_default video_device:chr_file rw_file_perms;
 
-# /sys/devices/soc0/revision
-allow hal_graphics_composer_default sysfs_socinfo:dir r_dir_perms;
-allow hal_graphics_composer_default sysfs_socinfo:file r_file_perms;
-
-
-# /sys/kernel/debug/dma_buf/footprint/[0-9]+
-allow hal_graphics_composer_default debugfs_ion_dma:dir r_dir_perms;
-allow hal_graphics_composer_default debugfs_ion_dma:file r_file_perms;
-
 allow hal_graphics_composer_default sysfs_decon:dir r_dir_perms;
 allow hal_graphics_composer_default sysfs_decon:file r_file_perms;
 
 allow hal_graphics_composer_default sysfs_ss_writable:dir r_dir_perms;
 allow hal_graphics_composer_default sysfs_ss_writable:file r_file_perms;
 
+allow hal_graphics_composer_default sysfs_graphics:dir r_dir_perms;
+allow hal_graphics_composer_default sysfs_graphics:file rw_file_perms;
+
 # /dev/ion/
 allow hal_graphics_composer_default ion_device:chr_file rw_file_perms;
 
-allow hal_graphics_composer_default vendor_surfaceflinger_vndservice:service_manager { add find };
-
-allow hal_graphics_composer_default sysfs_brightness:file rw_file_perms;
-allow hal_graphics_composer_default sysfs_brightness:dir search;
-
 get_prop(hal_graphics_composer_default, vendor_camera_prop)
+set_prop(hal_graphics_composer_default, vendor_hwc_prop)
+get_prop(hal_graphics_composer_default, boot_status_prop)

universal7885-common/sepolicy/vendor/hal_health_default.te

@@ -1,13 +1,5 @@
-r_dir_file(hal_health_default, sysfs_charger)
+rw_file_recursive(hal_health_default, sysfs_charger)
 
-allow hal_health_default sysfs_charger:file rw_file_perms;
+allow hal_health_default sysfs_fuelgauge:file r_file_perms;
 allow hal_health_default sysfs_battery:dir r_dir_perms;
 allow hal_health_default sysfs_battery:file r_file_perms;
-allow hal_health_default sysfs_battery_writable:dir search;
-allow hal_health_default sysfs_battery_writable:file r_file_perms;
-allow hal_health_default sysfs_fuelgauge:file r_file_perms;
-allow hal_health_default app_efs_file:file r_file_perms;
-allow hal_health_default app_efs_file:dir search;
-allow hal_health_default efs_file:lnk_file read;
-allow hal_health_default efs_file:dir search;
-

universal7885-common/sepolicy/vendor/hal_keymaster_default.te

@@ -1,10 +1 @@
-# hal_keymaster_default
+r_file_recursive(hal_keymaster_default, prov_efs_file)
-
-# /mnt/vendor
-allow hal_keymaster_default mnt_vendor_file:dir search;
-
-# /mnt/vendor/efs
-allow hal_keymaster_default efs_file:dir search;
-teegris_use(hal_keymaster_default)
-allow hal_keymaster_default prov_efs_file:file r_file_perms;
-allow hal_keymaster_default prov_efs_file:dir search;

universal7885-common/sepolicy/vendor/hal_light_default.te

@@ -1,9 +1 @@
-# hal_light_default.te
+r_file_recursive(hal_light_default, sysfs_graphics)
-
-# /sys/devices/platform/panel@0/backlight/panel/brightness
-# /sys/devices/platform/panel@0/backlight/panel/max_brightness
-allow hal_light_default sysfs_backlight_writable:file rw_file_perms;
-allow hal_light_default sysfs_graphics:dir search;
-allow hal_light_default sysfs_graphics:file rw_file_perms;
-allow hal_light_default sysfs_virtual:dir search;
-allow hal_light_default sysfs_virtual:file rw_file_perms;

universal7885-common/sepolicy/vendor/hal_memtrack_default.te

@@ -1,5 +1 @@
-r_dir_file(hal_memtrack_default, debugfs_mali)
-r_dir_file(hal_memtrack_default, debugfs_mali_mem)
-r_dir_file(hal_memtrack_default, debugfs_ion)
-r_dir_file(hal_memtrack_default, debugfs_ion_dma)
 r_dir_file(hal_memtrack_default, sysfs_gpu)

universal7885-common/sepolicy/vendor/hal_power_default.te

@@ -1,38 +1,10 @@
-# hal_power_default.te
-
-# /dev/cpu_dma_latency
-allow hal_power_default cpu_dma_device:chr_file rw_file_perms;
-
-# /dev/stune/top-app/schedtune.boost
-allow hal_power_default cgroup:file rw_file_perms;
-
-# /sys/class/input/
-allow hal_power_default sysfs_input:dir r_dir_perms;
-
-# /sys/class/power/
-allow hal_power_default sysfs_power:dir r_dir_perms;
-allow hal_power_default sysfs_power:file r_file_perms;
-allow hal_power_default sysfs_power_writable:file rw_file_perms;
-
-# /sys/class/sec/tsp/input/
-allow hal_power_default sysfs_sec_touchscreen:dir r_dir_perms;
-allow hal_power_default sysfs_sec_touchscreen:lnk_file r_file_perms;
-
-# /sys/class/sec/tsp/input/{cmd,enabled}
-allow hal_power_default sysfs_touchscreen_writable:file rw_file_perms;
-
-# /sys/devices/system/cpu/cpu[0-9]/cpufreq/scaling_max_freq
-allow hal_power_default sysfs_devices_system_cpu:file rw_file_perms;
 allow hal_power_default sysfs_graphics:dir search;
 allow hal_power_default sysfs_graphics:file r_file_perms;
 allow hal_power_default sysfs_input:file r_file_perms;
-allow hal_power_default sysfs_virtual:dir r_dir_perms;
-allow hal_power_default sysfs_virtual:file r_file_perms;
 allow hal_power_default sysfs_touchscreen_writable:dir r_dir_perms;
-allow hal_power_default sysfs_sec_touchscreen:dir { read open };
+allow hal_power_default sysfs_sec_touchscreen:dir r_dir_perms;
 allow hal_power_default sysfs_sec_touchscreen:file r_file_perms;
-type hal_lineage_power_hwservice, hwservice_manager_type; 
-add_hwservice(hal_power_default, hal_power_hwservice)
 allow hal_power_default sysfs_decon:dir search;
+
 set_prop(hal_power_default, vendor_powerhal_prop)
 

universal7885-common/sepolicy/vendor/hal_sensors_default.te

@@ -1,75 +1,11 @@
-# hal_sensors_default.te
-
-# /dev/batch_io
-allow hal_sensors_default io_device:chr_file r_file_perms;
-
-# /dev/iio:device1
-allow hal_sensors_default iio_device:chr_file r_file_perms;
-
-# /dev/ssp_sensorhub
-allow hal_sensors_default ssp_device:chr_file rw_file_perms;
-
-# /efs
-allow hal_sensors_default efs_file:dir r_dir_perms;
-
-# /efs/FactoryApp/
-allow hal_sensors_default app_efs_file:dir rw_dir_perms;
-allow hal_sensors_default app_efs_file:file { setattr rw_file_perms };
-
-# /sys/bus/iio/devices
-allow hal_sensors_default sysfs_iio:dir r_dir_perms;
-allow hal_sensors_default sysfs_iio:file r_file_perms;
-
-# /sys/class/sec/sensors
-allow hal_sensors_default sysfs_sec_sensors:dir r_dir_perms;
-allow hal_sensors_default sysfs_sec_sensors:file r_file_perms;
-
-# /sys/class/sensors/ssp_sensor/enable
-allow hal_sensors_default sysfs_sensors_writable:dir r_dir_perms;
-allow hal_sensors_default sysfs_sensors_writable:file rw_file_perms;
-
-# /sys/devices/platform/10970000.spi/
-allow hal_sensors_default sysfs_spi_writeable:dir r_dir_perms;
-allow hal_sensors_default sysfs_spi_writeable:file rw_file_perms;
-
-# /sys/devices/platform/panel@0/lcd/panel/window_type
-allow hal_sensors_default sysfs_lcd_writable:dir r_dir_perms;
-allow hal_sensors_default sysfs_lcd_writable:file r_file_perms;
-
-# /sys/class/input
-allow hal_sensors_default sysfs_input:dir r_dir_perms;
-
-# /sys/devices/virtual/input/input4
-# /sys/devices/virtual/input/input6
-allow hal_sensors_default sysfs_sensors:dir r_dir_perms;
-allow hal_sensors_default sysfs_sensors:file r_file_perms;
-
-# /sys/devices/virtual/sensors/magnetic_sensor/vendor
-allow hal_sensors_default sysfs_sensors:dir r_dir_perms;
-allow hal_sensors_default sysfs_sensors:file r_file_perms;
-
-# /sys/devices/virtual/sec/sec_key/hall_detect
-allow hal_sensors_default sysfs_sec_key:dir r_dir_perms;
-allow hal_sensors_default sysfs_sec_key:file r_file_perms;
-
-# /sys/class/sec/tsp/
-allow hal_sensors_default sysfs_sec_touchscreen:dir r_dir_perms;
-allow hal_sensors_default sysfs_sec_touchscreen:file r_file_perms;
-allow hal_sensors_default sysfs_sec_touchscreen:lnk_file r_file_perms;
-
 allow hal_sensors_default sysfs_iio:file r_file_perms;
 allow hal_sensors_default sysfs_iio:lnk_file read;
-allow hal_sensors_default sysfs_virtual:dir r_dir_perms;
-allow hal_sensors_default sysfs_virtual:file rw_file_perms;
-allow hal_sensors_default sysfs_virtual:lnk_file read;
-allow hal_sensors_default baro_delta_factoryapp_efs_file:file r_file_perms;
 allow hal_sensors_default sysfs_input:file r_file_perms;
 allow hal_sensors_default sysfs_input_writable:file rw_file_perms;
 allow hal_sensors_default sysfs_input:dir r_dir_perms;
-allow hal_sensors_default sysfs_sensor_writable:file rw_file_perms;
 allow hal_sensors_default sysfs_spi_writeable:file rw_file_perms;
 allow hal_sensors_default efs_file:lnk_file read;
 
-# yas_lib
+## /data/vendor/yas_lib
-allow hal_sensors_default vendor_data_file:file create_file_perms;
+allow hal_sensors_default sensors_data_file:file create_file_perms;
-allow hal_sensors_default vendor_data_file:dir create_dir_perms;
+allow hal_sensors_default sensors_data_file:dir create_dir_perms;

universal7885-common/sepolicy/vendor/hal_thermal_default.te

@@ -1,8 +0,0 @@
-
-# /acct/tasks
-allow hal_thermal_default cgroup:file getattr;
-
-# /sys/devices/virtual/thermal/
-allow hal_thermal_default sysfs_thermal:dir r_dir_perms;
-allow hal_thermal_default sysfs_thermal:file r_file_perms;
-r_dir_file(hal_thermal_default, sysfs_virtual)

universal7885-common/sepolicy/vendor/hal_usb_default.te

@@ -1,3 +0,0 @@
-allow hal_usb_default sysfs_virtual:dir search;
-allow hal_usb_default sysfs_sec_ccic:dir search;
-allow hal_usb_default sysfs_sec_ccic:file r_file_perms;

universal7885-common/sepolicy/vendor/hal_vibrator_default.te

@@ -1,2 +0,0 @@
-allow hal_vibrator_default sysfs_virtual:dir search;
-allow hal_vibrator_default sysfs_virtual:file rw_file_perms;

universal7885-common/sepolicy/vendor/hal_wifi_default.te

@@ -1,8 +1,5 @@
-set_prop(hal_wifi_default, vendor_wlan_prop)
+allow hal_wifi_default conn_vendor_data_file:dir rw_dir_perms;
-get_prop(hal_wifi_default, vendor_wifi_prop)
+allow hal_wifi_default conn_vendor_data_file:file create_file_perms;
-
-allow hal_wifi_default conn_vendor_data_file:dir search;
-allow hal_wifi_default conn_vendor_data_file:file rw_file_perms;
 allow hal_wifi_default wifi_vendor_data_file:dir search;
 
 get_prop(hal_wifi_default, persist_vendor_debug_wifi_prop)
@@ -11,5 +8,7 @@ allow hal_wifi_default efs_file:dir search;
 allow hal_wifi_default wifi_efs_file:dir search;
 allow hal_wifi_default wifi_efs_file:file r_file_perms;
 
-allow hal_wifi_default conn_vendor_data_file:dir write;
 allow hal_wifi_default mnt_vendor_file:dir search;
+
+# vendor.wlan.firmware.
+set_prop(hal_wifi_default, vendor_wifi_prop)

universal7885-common/sepolicy/vendor/hal_wifi_hostapd_default.te

@@ -1,6 +0,0 @@
-# hal_wifi_hostapd_default.te
-
-# /data/vendor/wifi/hostapd/hostapd_wlan0.conf
-r_dir_file(hal_wifi_hostapd_default, wifi_vendor_data_file)
-allow hal_wifi_hostapd_default sysfs_virtual:dir search;
-allow hal_wifi_hostapd_default sysfs_virtual:lnk_file r_file_perms;

universal7885-common/sepolicy/vendor/hal_wifi_supplicant_default.te

@@ -1,8 +0,0 @@
-# hal_wifi_supplicant_default.te
-
-# /data/vendor/log
-allow hal_wifi_supplicant_default log_vendor_data_file:dir r_dir_perms;
-
-# /data/vendor/wifi
-allow hal_wifi_supplicant_default wifi_vendor_data_file:dir rw_dir_perms;
-allow hal_wifi_supplicant_default wifi_vendor_data_file:file rw_file_perms;

universal7885-common/sepolicy/vendor/hwservice.te

@@ -1,3 +0,0 @@
-type rild_hwservice, hwservice_manager_type;
-type hal_vendor_configstore_hwservice, hwservice_manager_type;
-type hal_vendor_surfaceflinger_hwservice, hwservice_manager_type;

universal7885-common/sepolicy/vendor/hwservice_contexts

@@ -1,8 +1,4 @@
 vendor.samsung.hardware.gnss::ISehGnss                      u:object_r:hal_gnss_hwservice:s0
-vendor.samsung.hardware.radio::ISehRadio                    u:object_r:rild_hwservice:s0
+vendor.samsung.hardware.radio::ISehRadio                    u:object_r:hal_telephony_hwservice:s0
-vendor.samsung.hardware.radio.bridge::ISehBridge            u:object_r:rild_hwservice:s0
+vendor.samsung.hardware.radio.bridge::ISehBridge            u:object_r:hal_telephony_hwservice:s0
-vendor.samsung.hardware.radio.channel::ISehChannel          u:object_r:rild_hwservice:s0
+vendor.samsung.hardware.radio.channel::ISehChannel          u:object_r:hal_telephony_hwservice:s0
-vendor.lineage.power::ILineagePower			      u:object_r:hal_power_hwservice:s0
-
-vendor.samsung_slsi.hardware.ExynosHWCServiceTW::IExynosHWCServiceTW u:object_r:hal_vendor_surfaceflinger_hwservice:s0
-vendor.samsung_slsi.hardware.configstore::IExynosHWCConfigs          u:object_r:hal_vendor_configstore_hwservice:s0

universal7885-common/sepolicy/vendor/init.te

@@ -1,62 +1,5 @@
-allow init rild:unix_stream_socket connectto;
+allow init proc_swappiness:file w_file_perms;
-allow init self:netlink_kobject_uevent_socket create_socket_perms_no_ioctl;
-allow init socket_device:sock_file create_file_perms;
-allow init sysfs_devices_system_cpu:file write;
-allow init vendor_data_file:fifo_file write;
-allow init vendor_data_file:file append;
-allow init dnsproxyd_socket:sock_file write;
-allow init fwk_sensor_hwservice:hwservice_manager find;
-allow init hwservicemanager:binder call;
-allow init netd:unix_stream_socket connectto;
-allow init fwmarkd_socket:sock_file write;
-allow init nfc:binder call;
-allow init nfc_device:chr_file ioctl;
-allow init efs_file:dir mounton;
-allow init efs_block_device:lnk_file relabelto;
-allow init tmpfs:lnk_file create;
-
-allow init sysfs_virtual:file create_file_perms;
-allow init sysfs_virtual:lnk_file { read };
-allow init sysfs:file setattr;
-allow init sysfs_multipdp:file setattr;
-allow init sysfs_camera:file setattr;
-allow init sysfs_charger:file setattr;
-allow init sysfs_input:file setattr;
-allow init sysfs_modem:file w_file_perms;
 allow init sysfs_battery_writable:file setattr;
-allow init sysfs_power_writable:file setattr;
+allow init { sec_efs_file efs_file }:dir mounton;
-allow init sysfs_graphics:file create_file_perms;
+allow init sysfs_mmc:file w_file_perms;
-
-allow init system_server:binder { transfer call };
-allow init device:chr_file ioctl;
-allow init self:tcp_socket create_socket_perms;
-allow init node:tcp_socket node_bind;
-allow init port:tcp_socket { name_bind name_connect };
-allow init gps_vendor_data_file:fifo_file write;
-allow init gps_vendor_data_file:file lock;
 allow init socket_device:sock_file create_file_perms;
-allow init kernel:system module_request;
-
-allow init logd:unix_stream_socket connectto;
-allow init logdr_socket:sock_file write;
-allow init self:capability sys_nice;
-allow init sysfs_printk:file write;
-allow init proc:file setattr;
-allow init proc_swapiness:file write;
-allow init proc_extra:file setattr;
-allow init proc_reset_reason:file setattr;
-allow init proc_swapiness:file open;
-allow init self:netlink_generic_socket { bind create getattr read setopt write };
-allow init efs_file:lnk_file read;
-
-allow init proc_last_kmsg:file setattr;
-allow init mnt_vendor_file:dir mounton;
-
-unix_socket_connect(init, property, rild)
-
-allow init sec_efs_file:dir mounton;
-allow init sysfs_mmc_queue:file { open write };
-get_prop(init, vendor_radio_prop)
-get_prop(init, radio_prop)
-allow init sysfs_printk:file open;
-

universal7885-common/sepolicy/vendor/kernel.te

@@ -1,20 +1,8 @@
-# kernel.te
-
-# /vendor/firmware/
-allow kernel vendor_firmware_file:dir r_dir_perms;
-allow kernel vendor_firmware_file:file r_file_perms;
-allow kernel app_efs_file:dir search;
-allow kernel app_efs_file:file open;
-allow kernel sensor_factoryapp_efs_file:file open;
-allow kernel efs_file:dir search;
-
 allow kernel device:chr_file { getattr setattr unlink create };
 allow kernel device:dir create_dir_perms;
 allow kernel self:capability { sys_rawio mknod };
-
 allow kernel block_device:dir search;
 
+# Hall IC
 allow kernel sysfs_sec_key:dir search;
-r_dir_file(kernel, sysfs_virtual)
+allow kernel sysfs_sec_key:file { open read };
-
-allow kernel loop_device:blk_file { create setattr };

universal7885-common/sepolicy/vendor/macloader.te

@@ -1,41 +0,0 @@
-# macloader.te
-
-type macloader, domain;
-type macloader_exec, exec_type, vendor_file_type, file_type;
-
-# macloader is started by init, type transit from init domain to macloader domain
-init_daemon_domain(macloader)
-
-set_prop(macloader, vendor_wifi_prop);
-
-allow macloader self:capability { net_admin };
-
-allow macloader self:udp_socket create_socket_perms;
-allowxperm macloader self:udp_socket ioctl { 0x8913 0x8914 };
-
-# /data/vendor/conn
-allow macloader conn_vendor_data_file:dir rw_dir_perms;
-allow macloader conn_vendor_data_file:file create_file_perms;
-
-# /mnt/vendor
-allow macloader mnt_vendor_file:dir search;
-
-# /mnt/vendor/efs
-allow macloader efs_file:dir rw_dir_perms;
-
-# /mnt/vendor/efs/wifi
-allow macloader wifi_efs_file:dir rw_dir_perms;
-allow macloader wifi_efs_file:file rw_file_perms;
-
-# /sys/class/net
-allow macloader sysfs_net:dir r_dir_perms;
-allow macloader sysfs_net:file r_file_perms;
-
-# /sys/module/dhd/parameters/firmware_path
-allow macloader sysfs_wifi_writable:dir r_dir_perms;
-allow macloader sysfs_wifi_writable:file rw_file_perms;
-
-# /sys/wifi
-allow macloader sysfs_wifi:dir r_dir_perms;
-allow macloader sysfs_wifi:file r_file_perms;
-allow macloader sysfs_virtual:dir search;

universal7885-common/sepolicy/vendor/mediacodec.te

@@ -1,7 +1,7 @@
 # /sys/class/video4linux/video6/name
-allow mediacodec sysfs_v4l:dir r_dir_perms;
 allow mediacodec sysfs_v4l_mfc:dir search;
 allow mediacodec sysfs_v4l_mfc:file r_file_perms;
+allow mediacodec m2m1shot_device:chr_file rw_file_perms;
 
 hal_client_domain(mediacodec, hal_power)
 hal_client_domain(mediacodec, hal_omx)

universal7885-common/sepolicy/vendor/multiclientd.te

@@ -1,11 +0,0 @@
-type multiclientd, domain, coredomain;
-type multiclientd_exec, file_type, exec_type, system_file_type;
-
-init_daemon_domain(multiclientd)
-
-allow multiclientd rild:binder { call transfer };
-allow multiclientd rild_hwservice:hwservice_manager find;
-binder_call(multiclientd, hwservicemanager)
-binder_call(hwservicemanager, multiclientd)
-get_prop(multiclientd, hwservicemanager_prop);
-allow multiclientd same_process_hal_file:file execute;

universal7885-common/sepolicy/vendor/netd.te

@@ -1,5 +1,3 @@
 allow netd self:capability sys_module;
 allow netd init:tcp_socket rw_socket_perms_no_ioctl;
 
-allow netd sysfs_virtual:dir search;
-allow netd sysfs_virtual:file w_file_perms;

universal7885-common/sepolicy/vendor/platform_app.te

@@ -1,2 +0,0 @@
-# /dev/mali0
-allow platform_app gpu_device:chr_file rw_file_perms;

universal7885-common/sepolicy/vendor/priv_app.te

@@ -1,10 +0,0 @@
-# /dev/mali0
-allow priv_app gpu_device:chr_file rw_file_perms;
-
-allow priv_app debugfs_ion:dir search;
-allow priv_app debugfs_mali:dir search;
-allow priv_app debugfs_mali_mem:dir search;
-
-allow priv_app sysfs_zram:file r_file_perms;
-
-#get_prop(priv_app, vendor_default_prop)

universal7885-common/sepolicy/vendor/property.te

@@ -1,20 +1,5 @@
-vendor_internal_prop(modemloader_prop)
-vendor_internal_prop(camera_prop)
 vendor_internal_prop(persist_rmnet_prop)
-vendor_internal_prop(persist_data_df_prop)
-vendor_internal_prop(persist_data_wda_prop)
 vendor_public_prop(vendor_camera_prop)
 vendor_internal_prop(vendor_factory_prop)
-vendor_internal_prop(vendor_gps_prop)
 vendor_internal_prop(vendor_nfc_prop)
-vendor_internal_prop(vendor_wlbtd_prop)
-vendor_internal_prop(vendor_wlan_prop)
-vendor_internal_prop(vendor_cbd_prop)
-vendor_internal_prop(vendor_radio_prop)
-vendor_internal_prop(vendor_fastcharge_prop)
-vendor_internal_prop(vendor_wifi_prop)
-vendor_internal_prop(rild_prop)
-vendor_internal_prop(vendor_secureos_prop)
-vendor_internal_prop(vendor_tzdaemon_prop)
 vendor_internal_prop(vendor_powerhal_prop)
-vendor_internal_prop(vendor_tztsdaemon_prop)

universal7885-common/sepolicy/vendor/property_contexts

@@ -1,36 +1,15 @@
-### cbd
-vendor.cbd.                    u:object_r:vendor_cbd_prop:s0
-persist.vendor.cbd.            u:object_r:vendor_radio_prop:s0
-
-### radio
-ro.multisim.                   u:object_r:radio_prop:s0
-ro.vendor.multisim.            u:object_r:vendor_radio_prop:s0
-ro.vendor.radio.               u:object_r:vendor_radio_prop:s0
-
-### wifi
-vendor.wifi.                   u:object_r:vendor_wifi_prop:s0
-ro.vendor.wifi.                u:object_r:vendor_wifi_prop:s0
-
 # fastbootd
 ro.fastbootd.available         u:object_r:exported_default_prop:s0
 
 # bluetooth
 persist.bluetooth_fw_ver    u:object_r:bluetooth_prop:s0
 ro.bluetooth.tty            u:object_r:bluetooth_prop:s0
-wc_transport.               u:object_r:bluetooth_prop:s0
-
-# modemloader
-hw.revision                 u:object_r:modemloader_prop:s0
-ro.cbd.dt_revision          u:object_r:modemloader_prop:s0
-ril.cbd.dt_revision         u:object_r:modemloader_prop:s0
-ro.modemloader.done         u:object_r:modemloader_prop:s0
 
+# Data
 persist.rmnet.              u:object_r:persist_rmnet_prop:s0
-persist.data.df.            u:object_r:persist_data_df_prop:s0
+persist.data.               u:object_r:persist_rmnet_prop:s0
-persist.data.wda.           u:object_r:persist_data_wda_prop:s0
 
 # CAMERA
-persist.sys.camera.         u:object_r:camera_prop:s0
 persist.vendor.sys.camera.  u:object_r:vendor_camera_prop:s0
 persist.vendor.camera.      u:object_r:vendor_camera_prop:s0
 
@@ -43,28 +22,21 @@ ro.debug_level                 u:object_r:exported_default_prop:s0
 ro.hardware.chipname           u:object_r:exported_default_prop:s0
 ro.build.PDA                   u:object_r:exported_default_prop:s0
 
-# GPS
-ro.spid.gps.                u:object_r:vendor_gps_prop:s0
-
 # NFC
 vendor.nfc.fw.              u:object_r:vendor_nfc_prop:s0
 
 # RADIO
 persist.ril.                u:object_r:radio_prop:s0
 vendor.gsm.                 u:object_r:vendor_radio_prop:s0
-persist.radio.         	 u:object_r:radio_prop:s0
+persist.radio.         	    u:object_r:radio_prop:s0
-ril.clatd.               u:object_r:vendor_radio_prop:s0
+ril.clatd.                  u:object_r:vendor_radio_prop:s0
-vendor.powerhal.             u:object_r:vendor_powerhal_prop:s0
+ro.multisim.                u:object_r:vendor_radio_prop:s0
-# FACTORY
-ro.factory.factory_binary   u:object_r:vendor_factory_prop:s0
 
-# wlbtd
+# Power
-vendor.wlbtd.              u:object_r:vendor_wlbtd_prop:s0
+vendor.powerhal.             u:object_r:vendor_powerhal_prop:s0
+
+# FACTORY
+ro.factory.factory_binary    u:object_r:vendor_factory_prop:s0
 
 # Wlan
-vendor.wlan.               u:object_r:vendor_wlan_prop:s0
+vendor.wlan.                 u:object_r:vendor_wifi_prop:s0
-
-# TEEGRIS
-vendor.secureos.               u:object_r:vendor_secureos_prop:s0
-vendor.tzdaemon                u:object_r:vendor_tzdaemon_prop:s0
-vendor.tzts_daemon             u:object_r:vendor_tztsdaemon_prop:s0

universal7885-common/sepolicy/vendor/radio.te

@@ -1,3 +0,0 @@
-binder_call(radio, gpuservice)
-get_prop(radio, radio_prop)
-

universal7885-common/sepolicy/vendor/rild.te

@@ -1,102 +1,15 @@
-# rild.te
+allow rild proc_net:file w_file_perms;
-
-get_prop(rild, vendor_radio_prop)
-
-allow rild block_device:dir search;
-allow rild mnt_vendor_file:dir { getattr search };
-
-# audio hal
-allow rild hal_audio_default:dir search;
-allow rild hal_audio_default:file r_file_perms;
-
-# gps
-allow rild gpsd:dir search;
-allow rild gpsd:file r_file_perms;
-
-# /data
-allow rild system_data_file:dir getattr;
-
-# /data/vendor/log
-allow rild log_vendor_data_file:dir rw_dir_perms;
-allow rild log_vendor_data_file:file create_file_perms;
-
-# /dev/block/platform/.+/by-name/radio
-allow rild radio_block_device:blk_file r_file_perms;
-
-# /dev/drb
-allow rild drb_device:chr_file rw_file_perms;
-
-# /dev/umts_*
-# /dev/umts_ipc*
-allow rild vendor_radio_device:chr_file rw_file_perms;
-
-# /data/vendor/secradio
-allow rild radio_vendor_data_file:dir rw_dir_perms;
-allow rild radio_vendor_data_file:file create_file_perms;
-
-# /efs/FactoryApp/
-# /mnt/vendor/efs/root
-allow rild app_efs_file:dir r_dir_perms;
-allow rild app_efs_file:file { rw_file_perms setattr };
-
-# /efs/imei
-allow rild imei_efs_file:dir r_dir_perms;
-allow rild imei_efs_file:file r_file_perms;
-
-# /mnt/vendor/efs/
-allow rild prov_efs_file:dir r_dir_perms;
-allow rild prov_efs_file:file r_file_perms;
-
-# /mnt/vendor/efs/nv_data.bin
-allow rild bin_nv_data_efs_file:file { rw_file_perms setattr unlink };
-
-# /proc/net/xt_qtaguid/iface_stat_fmt
-allow rild proc_qtaguid_stat:file r_file_perms;
-
-# /proc/sys/net/ipv6/conf/*/accept_ra_defrtr
-allow rild proc_net:file rw_file_perms;
-
-# mdc.
-# persist.sys.omc_support
-# ro.csc.
-get_prop(rild, exported_config_prop);
-
-# ro.boot.cpboot, ril.NwNmId[0-9]
-get_prop(rild, telephony_config_prop)
-
-get_prop(rild, vendor_radio_prop)
-# vendor.cbd.
-set_prop(rild, vendor_cbd_prop)
-allow rild proc_net:file write;
 allow rild vendor_data_file:file create_file_perms;
-
-# /dev/umts_ipc0
-allow rild radio_device:chr_file ioctl;
-
 allow rild bin_nv_data_efs_file:file create_file_perms;
-dontaudit rild bin_nv_data_efs_file:file ioctl;
+allow rild imei_efs_file:file w_file_perms;
-
 allow rild radio_vendor_data_file:file create_file_perms;
 allow rild radio_vendor_data_file:dir rw_dir_perms;
-
-allow rild proc_qtaguid_stat:file read;
-
-allow rild factoryprop_efs_file:file rw_file_perms;
-
-allow rild init:file getattr;
-
-# binder
-allow rild hal_radio_default:binder call;
-
-# audio
 allow rild hal_audio_default:dir search;
 allow rild hal_audio_default:file r_file_perms;
 allow rild efs_file:lnk_file read;
+dontaudit rild bin_nv_data_efs_file:file ioctl;
 
 # hwservice
-add_hwservice(rild, rild_hwservice)
 set_prop(rild, radio_prop)
 
-binder_call(rild, multiclientd)
+binder_call(rild, hal_radio_default)
-binder_call(multiclientd, rild)
-allow rild imei_efs_file:file w_file_perms;

universal7885-common/sepolicy/vendor/secril_config_svc.te

@@ -1,24 +0,0 @@
-# secril_config_svc.te
-
-type secril_config_svc, domain;
-type secril_config_svc_exec, exec_type, vendor_file_type, file_type;
-
-# secril_config_svc is started by init, type transit from init domain to secril_config_svc domain
-init_daemon_domain(secril_config_svc)
-
-# /mnt/vendor/
-allow secril_config_svc mnt_vendor_file:dir search;
-
-# /mnt/vendor/efs/factory.prop
-# /mnt/vendor/efs/telephony.prop
-allow secril_config_svc efs_file:dir search;
-allow secril_config_svc efs_file:file r_file_perms;
-
-# ro.multisim.
-# ro.vendor.multisim.
-# ro.vendor.radio.default_network
-set_prop(secril_config_svc, vendor_radio_prop)
-dontaudit secril_config_svc radio_control_prop:property_service set;
-get_prop(secril_config_svc, exported_config_prop)
-get_prop(secril_config_svc, vendor_radio_prop)
-

universal7885-common/sepolicy/vendor/surfaceflinger.te

@@ -1,8 +1,4 @@
-# /dev/mali0
-allow surfaceflinger gpu_device:chr_file rw_file_perms;
-
-# libion_exynos
-allow surfaceflinger same_process_hal_file:file rx_file_perms;
-
 # Android 13+
 r_dir_file(surfaceflinger, hal_graphics_composer_default)
+
+get_prop(surfaceflinger, vendor_hwc_prop)

universal7885-common/sepolicy/vendor/system_app.te

@@ -1,13 +0,0 @@
-# /dev/mali0
-allow system_app gpu_device:chr_file rw_file_perms;
-
-allow system_app proc_pagetypeinfo:file r_file_perms;
-allow system_app sysfs_virtual:dir search;
-
-# battery sysfs
-
-allow system_app sysfs_battery_info:dir { search };
-allow system_app sysfs_battery_info:file { read open getattr };
-
-r_dir_file(system_app, sysfs_battery_info)
-r_dir_file(system_app, sysfs_zram)

universal7885-common/sepolicy/vendor/system_server.te

@@ -1,24 +1,18 @@
 # system_server.te
-
 allow system_server proc_last_kmsg:file r_file_perms;
 # /dev/mali0
 allow system_server gpu_device:chr_file rw_file_perms;
 
-# memtrack HAL
-allow system_server debugfs_mali:dir r_dir_perms;
-allow system_server debugfs_mali:file r_file_perms;
-allow system_server debugfs_ion:file r_file_perms;
-allow system_server debugfs_mali_mem:file r_file_perms;
-
 allow system_server frp_block_device:blk_file rw_file_perms;
 
-allow system_server sysfs_rtc:file r_file_perms;
-
-allow system_server sysfs_battery_writable:dir r_dir_perms;
-allow system_server sysfs_battery_writable:file rw_file_perms;
-
 get_prop(system_server, exported_camera_prop)
 get_prop(system_server, userspace_reboot_config_prop)
 get_prop(system_server, userspace_reboot_exported_prop)
+
+r_file_recursive(system_server, sysfs_sec_switch)
+r_file_recursive(system_server, sysfs_sec_switch_writable)
+
 allow system_server self:capability sys_module;
 allow system_server shell:unix_stream_socket getopt;
+allow system_server cgroup:dir { create setattr };
+allow system_server cgroup:file setattr;

universal7885-common/sepolicy/vendor/tee.te

@@ -1,5 +0,0 @@
-allow tee efs_file:dir r_dir_perms;
-allow tee efs_file:file rw_file_perms;
-allow tee mnt_vendor_file:dir search;
-
-dontaudit tee system_prop:property_service set;

universal7885-common/sepolicy/vendor/toolbox.te

@@ -1 +0,0 @@
-allow toolbox ram_device:blk_file rw_file_perms;

universal7885-common/sepolicy/vendor/tzdaemon.te

@@ -1,38 +0,0 @@
-type tzdaemon, domain;
-type tzdaemon_exec, exec_type, vendor_file_type, file_type;
-
-# tzdaemon is started by init, type transit from init domain to tzdaemon domain
-init_daemon_domain(tzdaemon)
-
-set_prop(tzdaemon, vendor_tzdaemon_prop)
-set_prop(tzdaemon, vendor_secureos_prop)
-
-allow tzdaemon tz_device:chr_file rw_file_perms;
-allow tzdaemon tz_user_device:chr_file rw_file_perms;
-allow tzdaemon tz_socket:sock_file { write };
-
-# /dev/kmsg
-allow tzdaemon kmsg_device:chr_file rw_file_perms;
-
-# /data/vendor/tee
-allow tzdaemon tee_vendor_data_file:dir create_dir_perms;
-allow tzdaemon tee_vendor_data_file:file create_file_perms;
-
-# /proc/stat
-allow tzdaemon proc_stat:file r_file_perms;
-
-# /efs
-allow tzdaemon efs_file:dir r_dir_perms;
-
-# /efs/tee/
-# /mnt/vendor/efs/tee/
-allow tzdaemon tee_efs_file:dir create_dir_perms;
-allow tzdaemon tee_efs_file:file create_file_perms;
-
-# /mnt/vendor/
-allow tzdaemon mnt_vendor_file:dir r_dir_perms;
-
-allow tzdaemon mnt_vendor_file:dir rw_dir_perms;
-allow tzdaemon efs_file:dir search;
-allow tzdaemon tee_efs_file:dir { add_name remove_name open create read search write };
-allow tzdaemon tee_efs_file:file { getattr open create read rename unlink write };

universal7885-common/sepolicy/vendor/tztsdaemon.te

@@ -1,10 +0,0 @@
-type tztsdaemon, domain;
-type tztsdaemon_exec, exec_type, vendor_file_type, file_type;
-
-# tztsdaemon is started by init, type transit from init domain to tztsdaemon domain
-init_daemon_domain(tztsdaemon)
-
-set_prop(tztsdaemon, vendor_tztsdaemon_prop)
-
-# /dev/tziwsock
-allow tztsdaemon tz_user_device:chr_file rw_file_perms;

universal7885-common/sepolicy/vendor/ueventd.te

@@ -1,2 +1 @@
-allow ueventd self:capability sys_nice;
 allow ueventd metadata_file:dir search;

universal7885-common/sepolicy/vendor/vendor_init.te

@@ -1,19 +1,18 @@
 typeattribute vendor_init data_between_core_and_vendor_violators;
 
-allow vendor_init proc_swapiness:file rw_file_perms; 
+allow vendor_init proc_swappiness:file w_file_perms;
 allow vendor_init cgroup:file getattr;
 allow vendor_init tmpfs:dir { add_name write };
-allow vendor_init wifi_data_file:dir { getattr setattr };
+
+allow vendor_init wifi_data_file:dir rw_dir_perms;
+allow vendor_init wifi_data_file:dir setattr;
 allow vendor_init wpa_socket:dir getattr;
-allow vendor_init wifi_data_file:dir search;
+
 # mkdir /data/hostapd
 allow vendor_init system_data_file:dir create_dir_perms;
 # mkdir /data/camera/*
 allow vendor_init camera_data_file:dir create_dir_perms;
-set_prop(vendor_init, persist_data_df_prop)
-set_prop(vendor_init, persist_data_wda_prop)
 set_prop(vendor_init, persist_rmnet_prop)
-get_prop(vendor_init, system_prop)
 get_prop(vendor_init, vendor_radio_prop)
-allow vendor_init efs_file:lnk_file read;
 set_prop(vendor_init, vendor_powerhal_prop)
+allow vendor_init efs_file:lnk_file read;

universal7885-common/sepolicy/vendor/vndservice.te

@@ -1 +0,0 @@
-type vendor_surfaceflinger_vndservice, vndservice_manager_type;

universal7885-common/sepolicy/vendor/vndservice_contexts

@@ -1,3 +0,0 @@
-# vndservice_contexts
-
-Exynos.HWCService                      u:object_r:vendor_surfaceflinger_vndservice:s0

universal7885-common/sepolicy/vendor/vold.te

@@ -1,6 +1 @@
-# /efs
+allow vold sysfs_mmc:file w_file_perms;
-allow vold efs_file:dir r_dir_perms;
-
-allow vold sysfs_virtual:file write;
-
-allow vold sysfs_mmc_uevent:file write;

universal7885-common/sepolicy/vendor/wlbtd.te

@@ -1,15 +0,0 @@
-type wlbtd, domain;
-
-type wlbtd_exec, exec_type, vendor_file_type, file_type;
-init_daemon_domain(wlbtd)
-
-allow wlbtd conn_vendor_data_file:dir search;
-allow wlbtd conn_vendor_data_file:file rw_file_perms;
-allow wlbtd self:netlink_generic_socket { create setopt bind getattr read write };
-
-allow wlbtd init:unix_stream_socket connectto;
-
-r_dir_file(wlbtd, sysfs_wifi)
-allow wlbtd sysfs_wifi_writable:file rw_file_perms;
-
-set_prop(wlbtd, vendor_wlbtd_prop)

universal7885-common/sepolicy/vendor/zygote.te

@@ -1,5 +0,0 @@
-get_prop(zygote, exported_camera_prop)
-
-allow zygote proc_cmdline:file r_file_perms;
-dontaudit zygote unlabeled:file write;
-

universal7885-common/vendor.prop

@@ -17,9 +17,6 @@ ro.opengles.version=196610
 debug.egl.hw=1
 debug.sf.hw=1
 
-## Low ram device
-ro.config.avoid_gfx_accel=true
-
 ### Vulkan
 ro.hwui.use_vulkan=true
 graphics.gpu.profiler.support=true
@@ -41,8 +38,6 @@ debug.sf.disable_client_composition_cache=1
 ro.surface_flinger.max_frame_buffer_acquired_buffers=3
 
 # Display
-vendor.display.disable_rotator_downscale=1
-vendor.display.disable_scaler=0
 persist.sys.sf.color_mode=0
 persist.sys.sf.color_saturation=1.20