mirror of
https://github.com/chararomandroid/android_device_samsung_a20
synced 2026-08-21 11:55:31 -04:00
universal7885: sepolicy: Completely merge samsung_slsi repo
This commit is contained in:
roynatech2544
parent
00fb011c7c
commit
f6da6e72c2
82 changed files with 852 additions and 872 deletions
8
a20/aosp_a20.mk
Normal file
8
a20/aosp_a20.mk
Normal file
|
|
@ -0,0 +1,8 @@
|
|||
# Auto-Generated by device/samsung/a20/setup.sh
|
||||
$(call inherit-product, device/samsung/a20/full_a20.mk)
|
||||
$(call inherit-product, vendor/aosp/config/common_full_phone.mk)
|
||||
PRODUCT_NAME := aosp_a20
|
||||
|
||||
# Additional Props
|
||||
TARGET_FACE_UNLOCK_SUPPORTED := true
|
||||
TARGET_BOOT_ANIMATION_RES := 720
|
||||
|
|
@ -84,17 +84,13 @@ ENABLE_VENDOR_RIL_SERVICE := true
|
|||
|
||||
# Sepolicy
|
||||
SYSTEM_EXT_PUBLIC_SEPOLICY_DIRS += \
|
||||
$(COMMON_PATH)/sepolicy/samsung_slsi/tee/public \
|
||||
$(COMMON_PATH)/sepolicy/samsung_slsi/public \
|
||||
$(COMMON_PATH)/sepolicy/samsungparts
|
||||
$(COMMON_PATH)/sepolicy/public
|
||||
|
||||
BOARD_VENDOR_SEPOLICY_DIRS += \
|
||||
$(COMMON_PATH)/sepolicy/samsung_slsi/tee/vendor \
|
||||
$(COMMON_PATH)/sepolicy/vendor \
|
||||
$(COMMON_PATH)/sepolicy/samsung_slsi/vendor
|
||||
$(COMMON_PATH)/sepolicy/vendor
|
||||
|
||||
SYSTEM_EXT_PRIVATE_SEPOLICY_DIRS += \
|
||||
$(COMMON_PATH)/sepolicy/samsung_slsi/private
|
||||
$(COMMON_PATH)/sepolicy/private
|
||||
|
||||
# Vendor
|
||||
TARGET_COPY_OUT_VENDOR := vendor
|
||||
|
|
|
|||
13
universal7885-common/SamsungParts/init.samsungparts.rc
Normal file
13
universal7885-common/SamsungParts/init.samsungparts.rc
Normal file
|
|
@ -0,0 +1,13 @@
|
|||
on property:sys.boot_completed=1
|
||||
chmod 664 /sys/devices/platform/11500000.mali/tmu
|
||||
chown system system /sys/devices/platform/11500000.mali/tmu
|
||||
chmod 664 /sys/class/camera/flash/torch_brightness_lvl
|
||||
chown system system /sys/class/camera/flash/torch_brightness_lvl
|
||||
chmod 664 /sys/class/camera/flash/torch_brightness_lvl_enable
|
||||
chown system system /sys/class/camera/flash/torch_brightness_lvl_enable
|
||||
chmod 664 /sys/devices/platform/battery/power_supply/battery/batt_slate_mode
|
||||
chown system system /sys/devices/platform/battery/power_supply/battery/batt_slate_mode
|
||||
chmod 644 /sys/class/sec/switch/afc_disable
|
||||
chown system system /sys/class/sec/switch/afc_disable
|
||||
chmod 644 /sys/fs/selinux/enforce
|
||||
chown system system /sys/fs/selinux/enforce
|
||||
|
|
@ -1,3 +1,9 @@
|
|||
# file.te
|
||||
|
||||
### DATA
|
||||
type zram_data_file, file_type, data_file_type, core_data_file_type;
|
||||
|
||||
## SYSFS
|
||||
type sysfs_gpu_tmu, sysfs_type, rw_fs_type, fs_type;
|
||||
type sysfs_flashlight, sysfs_type, rw_fs_type, fs_type;
|
||||
type sysfs_sec_switch, sysfs_type, r_fs_type, fs_type;
|
||||
|
|
@ -1,4 +1,5 @@
|
|||
allow init sysfs_gpu_tmu:file { setattr };
|
||||
allow init sysfs_flashlight:file { setattr };
|
||||
allow init selinuxfs:file { setattr };
|
||||
allow init sysfs_sec_switch_writable:file { setattr };
|
||||
allow init sysfs_battery_writeable:file { setattr };
|
||||
allow init sysfs_battery_writable:file { setattr }; repo):universal7885-common/sepolicy/public/init.te
|
||||
|
|
@ -1,4 +0,0 @@
|
|||
# file.te
|
||||
|
||||
### DATA
|
||||
type zram_data_file, file_type, data_file_type, core_data_file_type;
|
||||
|
|
@ -1,4 +0,0 @@
|
|||
# device.te
|
||||
|
||||
type tz_device, dev_type;
|
||||
type tz_user_device, dev_type;
|
||||
|
|
@ -1,7 +0,0 @@
|
|||
# file.te
|
||||
|
||||
# DATA
|
||||
type tee_vendor_data_file, file_type, data_file_type;
|
||||
|
||||
# DEV SOCKET
|
||||
type tz_socket, file_type;
|
||||
|
|
@ -1,18 +0,0 @@
|
|||
# file_contexts
|
||||
|
||||
# DATA
|
||||
/data/vendor/tee(/.*)? u:object_r:tee_vendor_data_file:s0
|
||||
|
||||
# DEV
|
||||
/dev/socket/tz u:object_r:tz_socket:s0
|
||||
/dev/tuihw u:object_r:tz_device:s0
|
||||
/dev/tzdev u:object_r:tz_user_device:s0
|
||||
/dev/tzic u:object_r:tz_device:s0
|
||||
/dev/tzirs u:object_r:tz_device:s0
|
||||
/dev/tziwsock u:object_r:tz_user_device:s0
|
||||
|
||||
# VENDOR
|
||||
/(vendor|system/vendor)/bin/tzdaemon u:object_r:tzdaemon_exec:s0
|
||||
/(vendor|system/vendor)/bin/tzts_daemon u:object_r:tztsdaemon_exec:s0
|
||||
|
||||
/(vendor|system/vendor)/lib(64)?/libteecl\.so u:object_r:same_process_hal_file:s0
|
||||
|
|
@ -1,3 +0,0 @@
|
|||
# hal_fingerprint_default.te
|
||||
|
||||
teegris_use(hal_fingerprint_default)
|
||||
|
|
@ -1 +0,0 @@
|
|||
teegris_use(hal_gatekeeper_default)
|
||||
|
|
@ -1 +0,0 @@
|
|||
teegris_use(hal_keymaster_default)
|
||||
|
|
@ -1,4 +0,0 @@
|
|||
# property.te
|
||||
type vendor_secureos_prop, property_type;
|
||||
type vendor_tzdaemon_prop, property_type;
|
||||
type vendor_tztsdaemon_prop, property_type;
|
||||
|
|
@ -1,6 +0,0 @@
|
|||
# property_contexts
|
||||
|
||||
# TEEGRIS
|
||||
vendor.secureos. u:object_r:vendor_secureos_prop:s0
|
||||
vendor.tzdaemon u:object_r:vendor_tzdaemon_prop:s0
|
||||
vendor.tzts_daemon u:object_r:vendor_tztsdaemon_prop:s0
|
||||
|
|
@ -1,33 +0,0 @@
|
|||
type tzdaemon, domain;
|
||||
type tzdaemon_exec, exec_type, vendor_file_type, file_type;
|
||||
|
||||
# tzdaemon is started by init, type transit from init domain to tzdaemon domain
|
||||
init_daemon_domain(tzdaemon)
|
||||
|
||||
set_prop(tzdaemon, vendor_tzdaemon_prop)
|
||||
set_prop(tzdaemon, vendor_secureos_prop)
|
||||
|
||||
allow tzdaemon tz_device:chr_file rw_file_perms;
|
||||
allow tzdaemon tz_user_device:chr_file rw_file_perms;
|
||||
allow tzdaemon tz_socket:sock_file { write };
|
||||
|
||||
# /dev/kmsg
|
||||
allow tzdaemon kmsg_device:chr_file rw_file_perms;
|
||||
|
||||
# /data/vendor/tee
|
||||
allow tzdaemon tee_vendor_data_file:dir create_dir_perms;
|
||||
allow tzdaemon tee_vendor_data_file:file create_file_perms;
|
||||
|
||||
# /proc/stat
|
||||
allow tzdaemon proc_stat:file r_file_perms;
|
||||
|
||||
# /efs
|
||||
allow tzdaemon efs_file:dir r_dir_perms;
|
||||
|
||||
# /efs/tee/
|
||||
# /mnt/vendor/efs/tee/
|
||||
allow tzdaemon tee_efs_file:dir create_dir_perms;
|
||||
allow tzdaemon tee_efs_file:file create_file_perms;
|
||||
|
||||
# /mnt/vendor/
|
||||
allow tzdaemon mnt_vendor_file:dir r_dir_perms;
|
||||
|
|
@ -1,63 +0,0 @@
|
|||
# cbd.te
|
||||
|
||||
type cbd, domain;
|
||||
type cbd_exec, exec_type, vendor_file_type, file_type;
|
||||
|
||||
allow cbd self:capability setuid;
|
||||
|
||||
# cbd is started by init, type transit from init domain to cbd domain
|
||||
init_daemon_domain(cbd)
|
||||
|
||||
# /dev/block/
|
||||
allow cbd block_device:dir search;
|
||||
|
||||
# /data/vendor/log
|
||||
allow cbd log_vendor_data_file:dir search;
|
||||
|
||||
# /data/vendor/log/cbd
|
||||
allow cbd log_cbd_vendor_data_file:dir create_dir_perms;
|
||||
allow cbd log_cbd_vendor_data_file:file create_file_perms;
|
||||
|
||||
# /dev/block/platform/.+/by-name/radio
|
||||
allow cbd radio_block_device:blk_file r_file_perms;
|
||||
|
||||
# /dev/kmsg
|
||||
allow cbd kmsg_device:chr_file rw_file_perms;
|
||||
|
||||
# /dev/umts_*
|
||||
allow cbd vendor_radio_device:chr_file rw_file_perms;
|
||||
|
||||
# /mnt/vendor/
|
||||
allow cbd mnt_vendor_file:dir search;
|
||||
|
||||
# /mnt/vendor/efs/
|
||||
allow cbd efs_file:dir r_dir_perms;
|
||||
|
||||
# /mnt/vendor/efs/factory.prop
|
||||
allow cbd efs_file:file r_file_perms;
|
||||
|
||||
# /mnt/vendor/efs/nv_data.bin
|
||||
allow cbd bin_nv_data_efs_file:file r_file_perms;
|
||||
|
||||
# /proc/cmdline
|
||||
allow cbd proc_cmdline:file r_file_perms;
|
||||
|
||||
# /sys/power/wake_unlock
|
||||
allow cbd sysfs_wake_lock:file rw_file_perms;
|
||||
|
||||
# /sys/devices/platform/10000.mif_pdata/sim/
|
||||
allow cbd sysfs_sim:dir r_dir_perms;
|
||||
allow cbd sysfs_sim:file r_file_perms;
|
||||
|
||||
# /sys/devices/platform/10000.mif_pdata/sim/ds_detect
|
||||
allow cbd sysfs_sim_writable:file rw_file_perms;
|
||||
|
||||
# kernel log
|
||||
allow cbd kernel:system syslog_read;
|
||||
|
||||
# vendor.cbd.
|
||||
set_prop(cbd, vendor_cbd_prop)
|
||||
|
||||
# FIXME: Can we be more specific?
|
||||
allow cbd vendor_shell_exec:file execute_no_trans;
|
||||
# FIXME END
|
||||
|
|
@ -1,22 +0,0 @@
|
|||
# device.te
|
||||
type efs_block_device, dev_type;
|
||||
type dqmdbg_block_device, dev_type;
|
||||
type dtbo_block_device, dev_type;
|
||||
type keydata_block_device, dev_type;
|
||||
type keyrefuge_block_device, dev_type;
|
||||
type modem_block_device, dev_type;
|
||||
type omr_block_device, dev_type;
|
||||
type radio_block_device, dev_type;
|
||||
type sec_efs_block_device, dev_type;
|
||||
|
||||
type bbd_device, dev_type;
|
||||
type bt_device, dev_type;
|
||||
type cpu_dma_device, dev_type;
|
||||
type drb_device, dev_type;
|
||||
type epic_device, dev_type;
|
||||
type fp_sensor_device, dev_type;
|
||||
type io_device, dev_type;
|
||||
type pm_qos_device, dev_type;
|
||||
type radio_qos_device, dev_type;
|
||||
type ssp_device, dev_type;
|
||||
type vendor_radio_device, dev_type;
|
||||
|
|
@ -1,27 +0,0 @@
|
|||
type epicd, domain;
|
||||
type epicd_exec, exec_type, vendor_file_type, file_type;
|
||||
|
||||
# epicd is started by init, type transit from init domain to epicd domain
|
||||
init_daemon_domain(epicd)
|
||||
|
||||
# WTF?
|
||||
# execve("/vendor/bin/sh", ["sh", "-c", "getprop ro.hardware"]
|
||||
allow epicd vendor_shell_exec:file execute_no_trans;
|
||||
|
||||
# WTF?
|
||||
# execve("/vendor/bin/getprop", ["getprop", "ro.hardware"]
|
||||
allow epicd vendor_toolbox_exec:file execute_no_trans;
|
||||
|
||||
# /dev/cluster[0-9]_freq_(max|min)
|
||||
# /dev/*_throughput*
|
||||
# /dev/gpu_freq_(max|min)
|
||||
allow epicd pm_qos_device:chr_file rw_file_perms;
|
||||
|
||||
# /dev/socket/
|
||||
allow epicd socket_device:dir w_dir_perms;
|
||||
|
||||
# /dev/socket/epic
|
||||
allow epicd epicd_socket:unix_dgram_socket { read write };
|
||||
|
||||
# /dev/mode
|
||||
allow epicd epic_device:chr_file rw_file_perms;
|
||||
|
|
@ -1,63 +0,0 @@
|
|||
# file.te
|
||||
|
||||
### DATA
|
||||
type biometrics_vendor_data_file, file_type, data_file_type;
|
||||
type conn_vendor_data_file, file_type, data_file_type;
|
||||
type gps_vendor_data_file, file_type, data_file_type;
|
||||
type log_vendor_data_file, file_type, data_file_type;
|
||||
type log_cbd_vendor_data_file, file_type, data_file_type;
|
||||
type radio_vendor_data_file, file_type, data_file_type;
|
||||
type wifi_vendor_data_file, file_type, data_file_type;
|
||||
|
||||
# EFS
|
||||
type app_efs_file, file_type;
|
||||
type battery_efs_file, file_type;
|
||||
type bin_nv_data_efs_file, file_type;
|
||||
type cpk_efs_file, file_type;
|
||||
type imei_efs_file, file_type;
|
||||
type nfc_efs_file, file_type;
|
||||
type pfw_efs_file, file_type;
|
||||
type prov_efs_file, file_type;
|
||||
type sec_efs_file, file_type;
|
||||
type tee_efs_file, file_type;
|
||||
type wifi_efs_file, file_type;
|
||||
|
||||
# PROC
|
||||
type proc_last_kmsg, fs_type, proc_type;
|
||||
|
||||
# SOCKETS
|
||||
type epicd_socket, file_type, data_file_type;
|
||||
|
||||
### SYSFS
|
||||
type sysfs_argos, sysfs_type, r_fs_type, fs_type;
|
||||
#type sysfs_battery, sysfs_type, r_fs_type, fs_type;
|
||||
type sysfs_bbd, sysfs_type, r_fs_type, fs_type;
|
||||
type sysfs_fingerprint, sysfs_type, r_fs_type, fs_type;
|
||||
type sysfs_iio, sysfs_type, r_fs_type, fs_type;
|
||||
type sysfs_input, sysfs_type, r_fs_type, fs_type;
|
||||
type sysfs_sec_gps, sysfs_type, r_fs_type, fs_type;
|
||||
type sysfs_sec_key, sysfs_type, r_fs_type, fs_type;
|
||||
type sysfs_sec_sensors, sysfs_type, r_fs_type, fs_type;
|
||||
#type sysfs_sec_switch, sysfs_type, r_fs_type, fs_type;
|
||||
type sysfs_sec_touchscreen, sysfs_type, r_fs_type, fs_type;
|
||||
type sysfs_sim, sysfs_type, r_fs_type, fs_type;
|
||||
type sysfs_sensors, sysfs_type, r_fs_type, fs_type;
|
||||
type sysfs_wifi, sysfs_type, r_fs_type, fs_type;
|
||||
|
||||
type sysfs_backlight_writable, sysfs_type, rw_fs_type, fs_type;
|
||||
#type sysfs_battery_writable, sysfs_type, rw_fs_type, fs_type;
|
||||
type sysfs_bt_writable, sysfs_type, rw_fs_type, fs_type;
|
||||
type sysfs_gps_writable, sysfs_type, rw_fs_type, fs_type;
|
||||
type sysfs_lcd_writable, sysfs_type, rw_fs_type, fs_type;
|
||||
type sysfs_power_writable, sysfs_type, rw_fs_type, fs_type;
|
||||
type sysfs_scsi_host_writable, sysfs_type, rw_fs_type, fs_type;
|
||||
type sysfs_sensorhub_writable, sysfs_type, rw_fs_type, fs_type;
|
||||
type sysfs_sensors_writable, sysfs_type, rw_fs_type, fs_type;
|
||||
type sysfs_sim_writable, sysfs_type, rw_fs_type, fs_type;
|
||||
type sysfs_spi_writeable, sysfs_type, rw_fs_type, fs_type;
|
||||
#type sysfs_sec_switch_writable, sysfs_type, rw_fs_type, fs_type;
|
||||
type sysfs_touchscreen_writable, sysfs_type, rw_fs_type, fs_type;
|
||||
type sysfs_wifi_writable, sysfs_type, rw_fs_type, fs_type;
|
||||
|
||||
### VENDOR
|
||||
type vendor_firmware_file, file_type, vendor_file_type;
|
||||
|
|
@ -1,126 +0,0 @@
|
|||
# file_contexts
|
||||
|
||||
### DATA
|
||||
/data/vendor/biometrics(/.*)? u:object_r:biometrics_vendor_data_file:s0
|
||||
/data/vendor/conn(/.*)? u:object_r:conn_vendor_data_file:s0
|
||||
/data/vendor/gps(/.*)? u:object_r:gps_vendor_data_file:s0
|
||||
/data/vendor/wifi(/.*)? u:object_r:wifi_vendor_data_file:s0
|
||||
/data/vendor/log(/.*)? u:object_r:log_vendor_data_file:s0
|
||||
/data/vendor/log/cbd(/.*)? u:object_r:log_cbd_vendor_data_file:s0
|
||||
/data/vendor/secradio(/.*)? u:object_r:radio_vendor_data_file:s0
|
||||
|
||||
### DEV
|
||||
/dev/block/platform/.+/by-name/boot u:object_r:boot_block_device:s0
|
||||
/dev/block/platform/.+/by-name/cache u:object_r:cache_block_device:s0
|
||||
/dev/block/platform/.+/by-name/efs u:object_r:efs_block_device:s0
|
||||
/dev/block/platform/.+/by-name/dqmdbg u:object_r:dqmdbg_block_device:s0
|
||||
/dev/block/platform/.+/by-name/dtbo u:object_r:dtbo_block_device:s0
|
||||
/dev/block/platform/.+/by-name/keydata u:object_r:keydata_block_device:s0
|
||||
/dev/block/platform/.+/by-name/keyrefuge u:object_r:keyrefuge_block_device:s0
|
||||
/dev/block/platform/.+/by-name/metadata u:object_r:metadata_block_device:s0
|
||||
/dev/block/platform/.+/by-name/misc u:object_r:misc_block_device:s0
|
||||
/dev/block/platform/.+/by-name/modem u:object_r:modem_block_device:s0
|
||||
/dev/block/platform/.+/by-name/omr u:object_r:omr_block_device:s0
|
||||
/dev/block/platform/.+/by-name/persistent u:object_r:frp_block_device:s0
|
||||
/dev/block/platform/.+/by-name/radio u:object_r:radio_block_device:s0
|
||||
/dev/block/platform/.+/by-name/recovery u:object_r:recovery_block_device:s0
|
||||
/dev/block/platform/.+/by-name/sec_efs u:object_r:sec_efs_block_device:s0
|
||||
/dev/block/platform/.+/by-name/super u:object_r:super_block_device:s0
|
||||
/dev/block/platform/.+/by-name/userdata u:object_r:userdata_block_device:s0
|
||||
|
||||
/dev/esfp[0-9] u:object_r:fp_sensor_device:s0
|
||||
/dev/batch_io u:object_r:io_device:s0
|
||||
/dev/ssp_sensorhub u:object_r:ssp_device:s0
|
||||
|
||||
# bluetooth
|
||||
/dev/ttySAC[0-9] u:object_r:bt_device:s0
|
||||
|
||||
# cpu
|
||||
/dev/cpu_dma_latency u:object_r:cpu_dma_device:s0
|
||||
|
||||
### epic
|
||||
/dev/mode u:object_r:epic_device:s0
|
||||
/dev/socket/epic u:object_r:epicd_socket:s0
|
||||
|
||||
### gnss/gps
|
||||
/dev/bbd_control u:object_r:bbd_device:s0
|
||||
/dev/bbd_packet u:object_r:bbd_device:s0
|
||||
/dev/bbd_patch u:object_r:bbd_device:s0
|
||||
/dev/bbd_reliable u:object_r:bbd_device:s0
|
||||
/dev/bbd_sensor u:object_r:bbd_device:s0
|
||||
/dev/bbd_sio u:object_r:bbd_device:s0
|
||||
/dev/bbd_urgent_patch u:object_r:bbd_device:s0
|
||||
/dev/ttyBCM[0-9]* u:object_r:bbd_device:s0
|
||||
|
||||
### qos
|
||||
/dev/bus_throughput u:object_r:pm_qos_device:s0
|
||||
/dev/bus_throughput_max u:object_r:pm_qos_device:s0
|
||||
/dev/cluster0_freq_max u:object_r:pm_qos_device:s0
|
||||
/dev/cluster0_freq_min u:object_r:pm_qos_device:s0
|
||||
/dev/cluster1_freq_max u:object_r:pm_qos_device:s0
|
||||
/dev/cluster1_freq_min u:object_r:pm_qos_device:s0
|
||||
/dev/cluster2_freq_max u:object_r:pm_qos_device:s0
|
||||
/dev/cluster2_freq_min u:object_r:pm_qos_device:s0
|
||||
/dev/cpu_online_max u:object_r:pm_qos_device:s0
|
||||
/dev/cpu_online_min u:object_r:pm_qos_device:s0
|
||||
/dev/device_throughput u:object_r:pm_qos_device:s0
|
||||
/dev/device_throughput_max u:object_r:pm_qos_device:s0
|
||||
/dev/gpu_freq_max u:object_r:pm_qos_device:s0
|
||||
/dev/gpu_freq_min u:object_r:pm_qos_device:s0
|
||||
/dev/mfc_throughput u:object_r:pm_qos_device:s0
|
||||
/dev/mfc_throughput_max u:object_r:pm_qos_device:s0
|
||||
/dev/network_throughput u:object_r:radio_qos_device:s0
|
||||
/dev/npu_throughput u:object_r:pm_qos_device:s0
|
||||
/dev/npu_throughput_max u:object_r:pm_qos_device:s0
|
||||
|
||||
### radio
|
||||
# DRB
|
||||
/dev/drb u:object_r:drb_device:s0
|
||||
|
||||
# UMTS
|
||||
/dev/umts_boot0 u:object_r:vendor_radio_device:s0
|
||||
/dev/umts_cass u:object_r:vendor_radio_device:s0
|
||||
/dev/umts_ipc[0-1] u:object_r:vendor_radio_device:s0
|
||||
/dev/umts_dm0 u:object_r:vendor_radio_device:s0
|
||||
/dev/umts_rfs0 u:object_r:vendor_radio_device:s0
|
||||
/dev/umts_router u:object_r:vendor_radio_device:s0
|
||||
|
||||
### EFS
|
||||
/efs/Battery(/.*)? u:object_r:battery_efs_file:s0
|
||||
/efs/DAK(/.*)? u:object_r:prov_efs_file:s0
|
||||
/efs/afc(/.*)? u:object_r:sec_efs_file:s0
|
||||
/efs/bluetooth(/.*)? u:object_r:bluetooth_efs_file:s0
|
||||
/efs/cpk(/.*)? u:object_r:cpk_efs_file:s0
|
||||
/efs/imei(/.*)? u:object_r:imei_efs_file:s0
|
||||
/efs/nfc(/.*)? u:object_r:nfc_efs_file:s0
|
||||
/efs/nv_data\.bin(.*) u:object_r:bin_nv_data_efs_file:s0
|
||||
/efs/pfw_data(/.*)? u:object_r:pfw_efs_file:s0
|
||||
/efs/prov(/.*)? u:object_r:prov_efs_file:s0
|
||||
/efs/prov_data(/.*)? u:object_r:prov_efs_file:s0
|
||||
/efs/root(/.*)? u:object_r:app_efs_file:s0
|
||||
/efs/tee(/.*)? u:object_r:tee_efs_file:s0
|
||||
/efs/wifi(/.*)? u:object_r:wifi_efs_file:s0
|
||||
|
||||
/mnt/vendor/efs(/.*)? u:object_r:efs_file:s0
|
||||
/mnt/vendor/efs/DAK(/.*)? u:object_r:prov_efs_file:s0
|
||||
/mnt/vendor/efs/afc(/.*)? u:object_r:sec_efs_file:s0
|
||||
/mnt/vendor/efs/bluetooth(/.*)? u:object_r:bluetooth_efs_file:s0
|
||||
/mnt/vendor/efs/cpk(/.*)? u:object_r:cpk_efs_file:s0
|
||||
/mnt/vendor/efs/imei(/.*)? u:object_r:imei_efs_file:s0
|
||||
/mnt/vendor/efs/nv_data\.bin(.*) u:object_r:bin_nv_data_efs_file:s0
|
||||
/mnt/vendor/efs/pfw_data(/.*)? u:object_r:pfw_efs_file:s0
|
||||
/mnt/vendor/efs/prov(/.*)? u:object_r:prov_efs_file:s0
|
||||
/mnt/vendor/efs/prov_data(/.*)? u:object_r:prov_efs_file:s0
|
||||
/mnt/vendor/efs/root(/.*)? u:object_r:app_efs_file:s0
|
||||
/mnt/vendor/efs/tee(/.*)? u:object_r:tee_efs_file:s0
|
||||
/mnt/vendor/efs/wifi(/.*)? u:object_r:wifi_efs_file:s0
|
||||
|
||||
### VENDOR
|
||||
/(vendor|system/vendor)/bin/cbd u:object_r:cbd_exec:s0
|
||||
/(vendor|system/vendor)/bin/secril_config_svc u:object_r:secril_config_svc_exec:s0
|
||||
|
||||
/(vendor|system/vendor)/bin/hw/android\.hardware\.biometrics\.fingerprint@[0-9].[0-9]-service\.samsung u:object_r:hal_fingerprint_default_exec:s0
|
||||
/(vendor|system/vendor)/bin/hw/android\.hardware\.light@[0-9].[0-9]-service\.samsung u:object_r:hal_light_default_exec:s0
|
||||
/(vendor|system/vendor)/bin/hw/android\.hardware\.thermal@[0-9].[0-9]-service\.samsung u:object_r:hal_thermal_default_exec:s0
|
||||
|
||||
/(vendor|system/vendor)/firmware(/.*)? u:object_r:vendor_firmware_file:s0
|
||||
|
|
@ -1,64 +0,0 @@
|
|||
# genfs_contexts
|
||||
|
||||
### PROC
|
||||
genfscon proc /last_kmsg u:object_r:proc_last_kmsg:s0
|
||||
|
||||
### SYSFS
|
||||
genfscon sysfs /bbd u:object_r:sysfs_bbd:s0
|
||||
|
||||
genfscon sysfs /bus/iio/devices u:object_r:sysfs_iio:s0
|
||||
|
||||
genfscon sysfs /class/backlight/ u:object_r:sysfs_backlight_writable:s0
|
||||
genfscon sysfs /class/fingerprint/fingerprint u:object_r:sysfs_fingerprint:s0
|
||||
genfscon sysfs /class/input u:object_r:sysfs_input:s0
|
||||
genfscon sysfs /class/power_supply u:object_r:sysfs_battery:s0
|
||||
genfscon sysfs /class/rtc/rtc0 u:object_r:sysfs_rtc:s0
|
||||
genfscon sysfs /class/sec/gps u:object_r:sysfs_sec_gps:s0
|
||||
genfscon sysfs /class/sec/sensors u:object_r:sysfs_sec_sensors:s0
|
||||
genfscon sysfs /class/sec/tsp u:object_r:sysfs_sec_touchscreen:s0
|
||||
genfscon sysfs /class/sensor_event u:object_r:sysfs_sensors:s0
|
||||
genfscon sysfs /class/sensors u:object_r:sysfs_sensors:s0
|
||||
genfscon sysfs /class/thermal u:object_r:sysfs_thermal:s0
|
||||
genfscon sysfs /class/timed_output/vibrator/intensity u:object_r:sysfs_vibrator:s0
|
||||
genfscon sysfs /class/timed_output/vibrator/multi_freq u:object_r:sysfs_vibrator:s0
|
||||
|
||||
genfscon sysfs /devices/platform/argos u:object_r:sysfs_argos:s0
|
||||
genfscon sysfs /devices/platform/battery/power_supply u:object_r:sysfs_battery:s0
|
||||
genfscon sysfs /devices/platform/battery/power_supply/battery/lcd u:object_r:sysfs_battery_writable:s0
|
||||
genfscon sysfs /devices/platform/panel@0/backlight/panel/brightness u:object_r:sysfs_backlight_writable:s0
|
||||
genfscon sysfs /devices/platform/panel@0/backlight/panel/max_brightness u:object_r:sysfs_backlight_writable:s0
|
||||
genfscon sysfs /devices/platform/panel@0/lcd/panel u:object_r:sysfs_lcd_writable:s0
|
||||
|
||||
genfscon sysfs /devices/virtual/fingerprint/fingerprint u:object_r:sysfs_fingerprint:s0
|
||||
genfscon sysfs /devices/virtual/input u:object_r:sysfs_input:s0
|
||||
genfscon sysfs /devices/virtual/lcd/panel u:object_r:sysfs_lcd_writable:s0
|
||||
genfscon sysfs /devices/virtual/sec/gps u:object_r:sysfs_sec_gps:s0
|
||||
genfscon sysfs /devices/virtual/sec/sec_key u:object_r:sysfs_sec_key:s0
|
||||
genfscon sysfs /devices/virtual/sec/tsp u:object_r:sysfs_sec_touchscreen:s0
|
||||
genfscon sysfs /devices/virtual/sec/tsp/cmd u:object_r:sysfs_touchscreen_writable:s0
|
||||
genfscon sysfs /devices/virtual/sec/tsp/ear_detect_enable u:object_r:sysfs_touchscreen_writable:s0
|
||||
genfscon sysfs /devices/virtual/sec/tsp/prox_power_off u:object_r:sysfs_touchscreen_writable:s0
|
||||
genfscon sysfs /devices/virtual/sec/tsp/input/enabled u:object_r:sysfs_touchscreen_writable:s0
|
||||
genfscon sysfs /devices/virtual/sensor_event u:object_r:sysfs_sensors:s0
|
||||
genfscon sysfs /devices/virtual/sensors u:object_r:sysfs_sensors:s0
|
||||
genfscon sysfs /devices/virtual/sensors/hidden_hole/hh_check_coef u:object_r:sysfs_sensors_writable:s0
|
||||
genfscon sysfs /devices/virtual/sensors/ssp_sensor/enable u:object_r:sysfs_sensors_writable:s0
|
||||
genfscon sysfs /devices/virtual/sensors/ssp_sensor/ssp_flush u:object_r:sysfs_sensors_writable:s0
|
||||
genfscon sysfs /devices/virtual/sec/switch u:object_r:sysfs_sec_switch:s0
|
||||
genfscon sysfs /devices/virtual/sec/switch/afc_disable u:object_r:sysfs_sec_switch_writable:s0
|
||||
genfscon sysfs /devices/virtual/thermal u:object_r:sysfs_thermal:s0
|
||||
genfscon sysfs /devices/virtual/timed_output/vibrator/cp_trigger_index u:object_r:sysfs_vibrator:s0
|
||||
genfscon sysfs /devices/virtual/timed_output/vibrator/intensity u:object_r:sysfs_vibrator:s0
|
||||
genfscon sysfs /devices/virtual/timed_output/vibrator/multi_freq u:object_r:sysfs_vibrator:s0
|
||||
|
||||
genfscon sysfs /module/dhd/parameters u:object_r:sysfs_wifi_writable:s0
|
||||
|
||||
genfscon sysfs /power/cpufreq_max_limit u:object_r:sysfs_power_writable:s0
|
||||
genfscon sysfs /power/cpufreq_min_limit u:object_r:sysfs_power_writable:s0
|
||||
genfscon sysfs /power/cpuhotplug/max_online_cpu u:object_r:sysfs_power_writable:s0
|
||||
genfscon sysfs /power/rtc_status u:object_r:sysfs_power_writable:s0
|
||||
|
||||
genfscon sysfs /wifi u:object_r:sysfs_wifi:s0
|
||||
genfscon sysfs /wifi/cid u:object_r:sysfs_wifi_writable:s0
|
||||
genfscon sysfs /wifi/mac_addr u:object_r:sysfs_wifi_writable:s0
|
||||
genfscon sysfs /wifi/memdump u:object_r:sysfs_wifi_writable:s0
|
||||
|
|
@ -1,37 +0,0 @@
|
|||
type gpsd, domain, netdomain;
|
||||
type gpsd_exec, exec_type, vendor_file_type, file_type;
|
||||
|
||||
# gpsd is started by init, type transit from init domain to gpsd domain
|
||||
init_daemon_domain(gpsd)
|
||||
|
||||
allow gpsd rild:unix_stream_socket connectto;
|
||||
|
||||
get_prop(gpsd, vendor_radio_prop)
|
||||
get_prop(gpsd, telephony_config_prop)
|
||||
get_prop(gpsd, exported_config_prop)
|
||||
|
||||
get_prop(gpsd, hwservicemanager_prop)
|
||||
hwbinder_use(gpsd)
|
||||
allow gpsd system_suspend_hwservice:hwservice_manager { find };
|
||||
allow gpsd fwk_sensor_hwservice:hwservice_manager { find };
|
||||
|
||||
binder_call(gpsd, system_suspend_server)
|
||||
binder_call(gpsd, system_server)
|
||||
binder_call(system_server, gpsd)
|
||||
|
||||
allow gpsd self:netlink_kobject_uevent_socket create_socket_perms_no_ioctl;
|
||||
allow gpsd self:{ tcp_socket udp_socket } create_stream_socket_perms;
|
||||
allow gpsd port:tcp_socket { name_bind name_connect };
|
||||
allow gpsd port:udp_socket name_bind;
|
||||
allow gpsd node:{ tcp_socket udp_socket } node_bind;
|
||||
|
||||
# /acct/tasks
|
||||
allow gpsd cgroup:file getattr;
|
||||
|
||||
# /dev/socket/fwmarkd
|
||||
allow gpsd fwmarkd_socket:sock_file write;
|
||||
|
||||
# /data/vendor/gps
|
||||
allow gpsd gps_vendor_data_file:dir rw_dir_perms;
|
||||
allow gpsd gps_vendor_data_file:file create_file_perms;
|
||||
allow gpsd gps_vendor_data_file:fifo_file create_file_perms;
|
||||
|
|
@ -1,24 +0,0 @@
|
|||
# hal_bluetooth_default.te
|
||||
|
||||
# ro.rfkilldisabled
|
||||
get_prop(hal_bluetooth_default, rfkilldisabled_prop)
|
||||
# vendor.bluetooth_fw_ver
|
||||
set_prop(hal_bluetooth_default, wifi_log_prop)
|
||||
# sys.bluetooth.tty
|
||||
set_prop(hal_bluetooth_default, exported_bluetooth_prop)
|
||||
|
||||
# /dev/ttySAC[0-9]
|
||||
allow hal_bluetooth_default bt_device:chr_file rw_file_perms;
|
||||
|
||||
# /mnt/vendor
|
||||
allow hal_bluetooth_default mnt_vendor_file:dir search;
|
||||
|
||||
# /mnt/vendor/efs/
|
||||
allow hal_bluetooth_default efs_file:dir r_dir_perms;
|
||||
|
||||
# /mnt/vendor/conn
|
||||
allow hal_bluetooth_default conn_vendor_data_file:dir r_dir_perms;
|
||||
allow hal_bluetooth_default conn_vendor_data_file:file r_file_perms;
|
||||
|
||||
# /sys/devices/platform/bluetooth/rfkill/rfkill0/state
|
||||
allow hal_bluetooth_default sysfs_bt_writable:file rw_file_perms;
|
||||
|
|
@ -1,14 +0,0 @@
|
|||
# hal_fingerprint_default.te
|
||||
|
||||
# /dev/esfp[0-9]
|
||||
allow hal_fingerprint_default fp_sensor_device:chr_file rw_file_perms;
|
||||
|
||||
# /data/vendor/ -> biometrics
|
||||
file_type_auto_trans(hal_fingerprint_default, vendor_data_file, biometrics_vendor_data_file)
|
||||
|
||||
# /data/vendor/biometrics/*
|
||||
allow hal_fingerprint_default biometrics_vendor_data_file:file create_file_perms;
|
||||
|
||||
# /sys/class/fingerprint/
|
||||
allow hal_fingerprint_default sysfs_fingerprint:dir r_dir_perms;
|
||||
allow hal_fingerprint_default sysfs_fingerprint:file r_file_perms;
|
||||
|
|
@ -1,12 +0,0 @@
|
|||
# hal_gnss_default.te
|
||||
|
||||
# cgroups tasks
|
||||
allow hal_gnss_default cgroup:file getattr;
|
||||
|
||||
# /data/vendor/gps
|
||||
allow hal_gnss_default gps_vendor_data_file:dir rw_dir_perms;
|
||||
allow hal_gnss_default gps_vendor_data_file:file create_file_perms;
|
||||
allow hal_gnss_default gps_vendor_data_file:fifo_file create_file_perms;
|
||||
|
||||
# /mnt/vendor
|
||||
allow hal_gnss_default mnt_vendor_file:dir search;
|
||||
|
|
@ -1,7 +0,0 @@
|
|||
# hal_keymaster_default
|
||||
|
||||
# /mnt/vendor
|
||||
allow hal_keymaster_default mnt_vendor_file:dir search;
|
||||
|
||||
# /mnt/vendor/efs
|
||||
allow hal_keymaster_default efs_file:dir search;
|
||||
|
|
@ -1,5 +0,0 @@
|
|||
# hal_light_default.te
|
||||
|
||||
# /sys/devices/platform/panel@0/backlight/panel/brightness
|
||||
# /sys/devices/platform/panel@0/backlight/panel/max_brightness
|
||||
allow hal_light_default sysfs_backlight_writable:file rw_file_perms;
|
||||
|
|
@ -1,25 +0,0 @@
|
|||
# hal_power_default.te
|
||||
|
||||
# /dev/cpu_dma_latency
|
||||
allow hal_power_default cpu_dma_device:chr_file rw_file_perms;
|
||||
|
||||
# /dev/stune/top-app/schedtune.boost
|
||||
allow hal_power_default cgroup:file rw_file_perms;
|
||||
|
||||
# /sys/class/input/
|
||||
allow hal_power_default sysfs_input:dir r_dir_perms;
|
||||
|
||||
# /sys/class/power/
|
||||
allow hal_power_default sysfs_power:dir r_dir_perms;
|
||||
allow hal_power_default sysfs_power:file r_file_perms;
|
||||
allow hal_power_default sysfs_power_writable:file rw_file_perms;
|
||||
|
||||
# /sys/class/sec/tsp/input/
|
||||
allow hal_power_default sysfs_sec_touchscreen:dir r_dir_perms;
|
||||
allow hal_power_default sysfs_sec_touchscreen:lnk_file r_file_perms;
|
||||
|
||||
# /sys/class/sec/tsp/input/{cmd,enabled}
|
||||
allow hal_power_default sysfs_touchscreen_writable:file rw_file_perms;
|
||||
|
||||
# /sys/devices/system/cpu/cpu[0-9]/cpufreq/scaling_max_freq
|
||||
allow hal_power_default sysfs_devices_system_cpu:file rw_file_perms;
|
||||
|
|
@ -1,62 +0,0 @@
|
|||
# hal_sensors_default.te
|
||||
|
||||
# /dev/batch_io
|
||||
allow hal_sensors_default io_device:chr_file r_file_perms;
|
||||
|
||||
# /dev/iio:device1
|
||||
allow hal_sensors_default iio_device:chr_file r_file_perms;
|
||||
|
||||
# /dev/ssp_sensorhub
|
||||
allow hal_sensors_default ssp_device:chr_file rw_file_perms;
|
||||
|
||||
# /efs
|
||||
allow hal_sensors_default efs_file:dir r_dir_perms;
|
||||
|
||||
# /efs/FactoryApp/
|
||||
allow hal_sensors_default app_efs_file:dir rw_dir_perms;
|
||||
allow hal_sensors_default app_efs_file:file { setattr rw_file_perms };
|
||||
|
||||
# /sys/bus/iio/devices
|
||||
allow hal_sensors_default sysfs_iio:dir r_dir_perms;
|
||||
allow hal_sensors_default sysfs_iio:file r_file_perms;
|
||||
|
||||
# /sys/class/sec/sensors
|
||||
allow hal_sensors_default sysfs_sec_sensors:dir r_dir_perms;
|
||||
allow hal_sensors_default sysfs_sec_sensors:file r_file_perms;
|
||||
|
||||
# /sys/class/sensors/ssp_sensor/enable
|
||||
allow hal_sensors_default sysfs_sensors_writable:dir r_dir_perms;
|
||||
allow hal_sensors_default sysfs_sensors_writable:file rw_file_perms;
|
||||
|
||||
# /sys/devices/platform/10970000.spi/
|
||||
allow hal_sensors_default sysfs_spi_writeable:dir r_dir_perms;
|
||||
allow hal_sensors_default sysfs_spi_writeable:file rw_file_perms;
|
||||
|
||||
# /sys/devices/platform/panel@0/lcd/panel/window_type
|
||||
allow hal_sensors_default sysfs_lcd_writable:dir r_dir_perms;
|
||||
allow hal_sensors_default sysfs_lcd_writable:file r_file_perms;
|
||||
|
||||
# /sys/class/input
|
||||
allow hal_sensors_default sysfs_input:dir r_dir_perms;
|
||||
|
||||
# /sys/devices/virtual/input/input4
|
||||
# /sys/devices/virtual/input/input6
|
||||
allow hal_sensors_default sysfs_sensors:dir r_dir_perms;
|
||||
allow hal_sensors_default sysfs_sensors:file r_file_perms;
|
||||
|
||||
# /sys/devices/virtual/sensors/magnetic_sensor/vendor
|
||||
allow hal_sensors_default sysfs_sensors:dir r_dir_perms;
|
||||
allow hal_sensors_default sysfs_sensors:file r_file_perms;
|
||||
|
||||
# /sys/devices/virtual/sec/sec_key/hall_detect
|
||||
allow hal_sensors_default sysfs_sec_key:dir r_dir_perms;
|
||||
allow hal_sensors_default sysfs_sec_key:file r_file_perms;
|
||||
|
||||
# /sys/class/sec/tsp/
|
||||
allow hal_sensors_default sysfs_sec_touchscreen:dir r_dir_perms;
|
||||
allow hal_sensors_default sysfs_sec_touchscreen:file r_file_perms;
|
||||
allow hal_sensors_default sysfs_sec_touchscreen:lnk_file r_file_perms;
|
||||
|
||||
# /sys/class/sec/tsp/ear_detect_enable
|
||||
# /sys/class/sec/tsp/cmd
|
||||
allow hal_sensors_default sysfs_touchscreen_writable:file rw_file_perms;
|
||||
|
|
@ -1,8 +0,0 @@
|
|||
# hal_thermal_default.te
|
||||
|
||||
# /acct/tasks
|
||||
allow hal_thermal_default cgroup:file getattr;
|
||||
|
||||
# /sys/devices/virtual/thermal/
|
||||
allow hal_thermal_default sysfs_thermal:dir r_dir_perms;
|
||||
allow hal_thermal_default sysfs_thermal:file r_file_perms;
|
||||
|
|
@ -1,4 +0,0 @@
|
|||
# hal_wifi_hostapd_default.te
|
||||
|
||||
# /data/vendor/wifi/hostapd/hostapd_wlan0.conf
|
||||
r_dir_file(hal_wifi_hostapd_default, wifi_vendor_data_file)
|
||||
|
|
@ -1,3 +0,0 @@
|
|||
# init.te
|
||||
|
||||
allow init proc_last_kmsg:file setattr;
|
||||
|
|
@ -1,5 +0,0 @@
|
|||
# kernel.te
|
||||
|
||||
# /vendor/firmware/
|
||||
allow kernel vendor_firmware_file:dir r_dir_perms;
|
||||
allow kernel vendor_firmware_file:file r_file_perms;
|
||||
|
|
@ -1,40 +0,0 @@
|
|||
# macloader.te
|
||||
|
||||
type macloader, domain;
|
||||
type macloader_exec, exec_type, vendor_file_type, file_type;
|
||||
|
||||
# macloader is started by init, type transit from init domain to macloader domain
|
||||
init_daemon_domain(macloader)
|
||||
|
||||
set_prop(macloader, vendor_wifi_prop);
|
||||
|
||||
allow macloader self:capability { net_admin };
|
||||
|
||||
allow macloader self:udp_socket create_socket_perms;
|
||||
allowxperm macloader self:udp_socket ioctl { 0x8913 0x8914 };
|
||||
|
||||
# /data/vendor/conn
|
||||
allow macloader conn_vendor_data_file:dir rw_dir_perms;
|
||||
allow macloader conn_vendor_data_file:file create_file_perms;
|
||||
|
||||
# /mnt/vendor
|
||||
allow macloader mnt_vendor_file:dir search;
|
||||
|
||||
# /mnt/vendor/efs
|
||||
allow macloader efs_file:dir rw_dir_perms;
|
||||
|
||||
# /mnt/vendor/efs/wifi
|
||||
allow macloader wifi_efs_file:dir rw_dir_perms;
|
||||
allow macloader wifi_efs_file:file rw_file_perms;
|
||||
|
||||
# /sys/class/net
|
||||
allow macloader sysfs_net:dir r_dir_perms;
|
||||
allow macloader sysfs_net:file r_file_perms;
|
||||
|
||||
# /sys/module/dhd/parameters/firmware_path
|
||||
allow macloader sysfs_wifi_writable:dir r_dir_perms;
|
||||
allow macloader sysfs_wifi_writable:file rw_file_perms;
|
||||
|
||||
# /sys/wifi
|
||||
allow macloader sysfs_wifi:dir r_dir_perms;
|
||||
allow macloader sysfs_wifi:file r_file_perms;
|
||||
|
|
@ -1,6 +0,0 @@
|
|||
# property.te
|
||||
|
||||
type vendor_cbd_prop, property_type;
|
||||
type vendor_radio_prop, property_type;
|
||||
type vendor_fastcharge_prop, property_type;
|
||||
type vendor_wifi_prop, property_type;
|
||||
|
|
@ -1,13 +0,0 @@
|
|||
### cbd
|
||||
vendor.cbd. u:object_r:vendor_cbd_prop:s0
|
||||
persist.vendor.cbd. u:object_r:vendor_radio_prop:s0
|
||||
|
||||
### radio
|
||||
ro.multisim. u:object_r:vendor_radio_prop:s0
|
||||
ro.vendor.multisim. u:object_r:vendor_radio_prop:s0
|
||||
ro.vendor.radio. u:object_r:vendor_radio_prop:s0
|
||||
|
||||
### wifi
|
||||
vendor.wifi. u:object_r:vendor_wifi_prop:s0
|
||||
ro.vendor.wifi. u:object_r:vendor_wifi_prop:s0
|
||||
|
||||
|
|
@ -1,68 +0,0 @@
|
|||
# rild.te
|
||||
|
||||
get_prop(rild, vendor_radio_prop)
|
||||
|
||||
allow rild block_device:dir search;
|
||||
allow rild mnt_vendor_file:dir { getattr search };
|
||||
|
||||
# audio hal
|
||||
allow rild hal_audio_default:dir search;
|
||||
allow rild hal_audio_default:file r_file_perms;
|
||||
|
||||
# gps
|
||||
allow rild gpsd:dir search;
|
||||
allow rild gpsd:file r_file_perms;
|
||||
|
||||
# /data
|
||||
allow rild system_data_file:dir getattr;
|
||||
|
||||
# /data/vendor/log
|
||||
allow rild log_vendor_data_file:dir rw_dir_perms;
|
||||
allow rild log_vendor_data_file:file create_file_perms;
|
||||
|
||||
# /dev/block/platform/.+/by-name/radio
|
||||
allow rild radio_block_device:blk_file r_file_perms;
|
||||
|
||||
# /dev/drb
|
||||
allow rild drb_device:chr_file rw_file_perms;
|
||||
|
||||
# /dev/umts_*
|
||||
# /dev/umts_ipc*
|
||||
allow rild vendor_radio_device:chr_file rw_file_perms;
|
||||
|
||||
# /data/vendor/secradio
|
||||
allow rild radio_vendor_data_file:dir rw_dir_perms;
|
||||
allow rild radio_vendor_data_file:file create_file_perms;
|
||||
|
||||
# /efs/FactoryApp/
|
||||
# /mnt/vendor/efs/root
|
||||
allow rild app_efs_file:dir r_dir_perms;
|
||||
allow rild app_efs_file:file { rw_file_perms setattr };
|
||||
|
||||
# /efs/imei
|
||||
allow rild imei_efs_file:dir r_dir_perms;
|
||||
allow rild imei_efs_file:file r_file_perms;
|
||||
|
||||
# /mnt/vendor/efs/
|
||||
allow rild prov_efs_file:dir r_dir_perms;
|
||||
allow rild prov_efs_file:file r_file_perms;
|
||||
|
||||
# /mnt/vendor/efs/nv_data.bin
|
||||
allow rild bin_nv_data_efs_file:file { rw_file_perms setattr unlink };
|
||||
|
||||
# /proc/net/xt_qtaguid/iface_stat_fmt
|
||||
allow rild proc_qtaguid_stat:file r_file_perms;
|
||||
|
||||
# /proc/sys/net/ipv6/conf/*/accept_ra_defrtr
|
||||
allow rild proc_net:file rw_file_perms;
|
||||
|
||||
# mdc.
|
||||
# persist.sys.omc_support
|
||||
# ro.csc.
|
||||
get_prop(rild, exported_config_prop);
|
||||
|
||||
# ro.boot.cpboot, ril.NwNmId[0-9]
|
||||
get_prop(rild, telephony_config_prop)
|
||||
|
||||
# vendor.cbd.
|
||||
set_prop(rild, vendor_cbd_prop)
|
||||
|
|
@ -1,20 +0,0 @@
|
|||
# secril_config_svc.te
|
||||
|
||||
type secril_config_svc, domain;
|
||||
type secril_config_svc_exec, exec_type, vendor_file_type, file_type;
|
||||
|
||||
# secril_config_svc is started by init, type transit from init domain to secril_config_svc domain
|
||||
init_daemon_domain(secril_config_svc)
|
||||
|
||||
# /mnt/vendor/
|
||||
allow secril_config_svc mnt_vendor_file:dir search;
|
||||
|
||||
# /mnt/vendor/efs/factory.prop
|
||||
# /mnt/vendor/efs/telephony.prop
|
||||
allow secril_config_svc efs_file:dir search;
|
||||
allow secril_config_svc efs_file:file r_file_perms;
|
||||
|
||||
# ro.multisim.
|
||||
# ro.vendor.multisim.
|
||||
# ro.vendor.radio.default_network
|
||||
set_prop(secril_config_svc, vendor_radio_prop)
|
||||
|
|
@ -1,3 +0,0 @@
|
|||
# system_server.te
|
||||
|
||||
allow system_server proc_last_kmsg:file r_file_perms;
|
||||
63
universal7885-common/sepolicy/vendor/cbd.te
vendored
63
universal7885-common/sepolicy/vendor/cbd.te
vendored
|
|
@ -1,2 +1,65 @@
|
|||
# cbd.te
|
||||
|
||||
type cbd, domain;
|
||||
type cbd_exec, exec_type, vendor_file_type, file_type;
|
||||
|
||||
allow cbd self:capability setuid;
|
||||
|
||||
# cbd is started by init, type transit from init domain to cbd domain
|
||||
init_daemon_domain(cbd)
|
||||
|
||||
# /dev/block/
|
||||
allow cbd block_device:dir search;
|
||||
|
||||
# /data/vendor/log
|
||||
allow cbd log_vendor_data_file:dir search;
|
||||
|
||||
# /data/vendor/log/cbd
|
||||
allow cbd log_cbd_vendor_data_file:dir create_dir_perms;
|
||||
allow cbd log_cbd_vendor_data_file:file create_file_perms;
|
||||
|
||||
# /dev/block/platform/.+/by-name/radio
|
||||
allow cbd radio_block_device:blk_file r_file_perms;
|
||||
|
||||
# /dev/kmsg
|
||||
allow cbd kmsg_device:chr_file rw_file_perms;
|
||||
|
||||
# /dev/umts_*
|
||||
allow cbd vendor_radio_device:chr_file rw_file_perms;
|
||||
|
||||
# /mnt/vendor/
|
||||
allow cbd mnt_vendor_file:dir search;
|
||||
|
||||
# /mnt/vendor/efs/
|
||||
allow cbd efs_file:dir r_dir_perms;
|
||||
|
||||
# /mnt/vendor/efs/factory.prop
|
||||
allow cbd efs_file:file r_file_perms;
|
||||
|
||||
# /mnt/vendor/efs/nv_data.bin
|
||||
allow cbd bin_nv_data_efs_file:file r_file_perms;
|
||||
|
||||
# /proc/cmdline
|
||||
allow cbd proc_cmdline:file r_file_perms;
|
||||
|
||||
# /sys/power/wake_unlock
|
||||
allow cbd sysfs_wake_lock:file rw_file_perms;
|
||||
|
||||
# /sys/devices/platform/10000.mif_pdata/sim/
|
||||
allow cbd sysfs_sim:dir r_dir_perms;
|
||||
allow cbd sysfs_sim:file r_file_perms;
|
||||
|
||||
# /sys/devices/platform/10000.mif_pdata/sim/ds_detect
|
||||
allow cbd sysfs_sim_writable:file rw_file_perms;
|
||||
|
||||
# kernel log
|
||||
allow cbd kernel:system syslog_read;
|
||||
|
||||
# vendor.cbd.
|
||||
set_prop(cbd, vendor_cbd_prop)
|
||||
|
||||
# FIXME: Can we be more specific?
|
||||
allow cbd vendor_shell_exec:file execute_no_trans;
|
||||
# FIXME END
|
||||
allow cbd factoryprop_efs_file:file r_file_perms;
|
||||
allow cbd sysfs_info:file r_file_perms;
|
||||
|
|
|
|||
27
universal7885-common/sepolicy/vendor/device.te
vendored
27
universal7885-common/sepolicy/vendor/device.te
vendored
|
|
@ -1,3 +1,7 @@
|
|||
# device.te
|
||||
|
||||
type tz_device, dev_type;
|
||||
type tz_user_device, dev_type;
|
||||
# /dev/m2m1shot_scaler0
|
||||
type m2m1shot_device, dev_type;
|
||||
|
||||
|
|
@ -6,3 +10,26 @@ type gps_device, dev_type;
|
|||
|
||||
# /dev/goodix_fp
|
||||
type goodix_device, dev_type;
|
||||
|
||||
# device.te
|
||||
type efs_block_device, dev_type;
|
||||
type dqmdbg_block_device, dev_type;
|
||||
type dtbo_block_device, dev_type;
|
||||
type keydata_block_device, dev_type;
|
||||
type keyrefuge_block_device, dev_type;
|
||||
type modem_block_device, dev_type;
|
||||
type omr_block_device, dev_type;
|
||||
type radio_block_device, dev_type;
|
||||
type sec_efs_block_device, dev_type;
|
||||
|
||||
type bbd_device, dev_type;
|
||||
type bt_device, dev_type;
|
||||
type cpu_dma_device, dev_type;
|
||||
type drb_device, dev_type;
|
||||
type epic_device, dev_type;
|
||||
type fp_sensor_device, dev_type;
|
||||
type io_device, dev_type;
|
||||
type pm_qos_device, dev_type;
|
||||
type radio_qos_device, dev_type;
|
||||
type ssp_device, dev_type;
|
||||
type vendor_radio_device, dev_type;
|
||||
|
|
|
|||
183
universal7885-common/sepolicy/vendor/file.te
vendored
183
universal7885-common/sepolicy/vendor/file.te
vendored
|
|
@ -1,60 +1,123 @@
|
|||
### efs types
|
||||
type radio_factoryapp_efs_file, file_type;
|
||||
type factoryprop_efs_file, file_type;
|
||||
type sensor_factoryapp_efs_file, file_type;
|
||||
type factorymode_factoryapp_efs_file, file_type;
|
||||
type baro_delta_factoryapp_efs_file, file_type;
|
||||
|
||||
# gps
|
||||
type gps_socket, file_type;
|
||||
|
||||
# debugfs types
|
||||
type debugfs_mali, fs_type, debugfs_type;
|
||||
type debugfs_mali_mem, fs_type, debugfs_type;
|
||||
type debugfs_ion, fs_type, debugfs_type;
|
||||
type debugfs_ion_dma, fs_type, debugfs_type;
|
||||
|
||||
# cache
|
||||
type boot_logcat_file, file_type, data_file_type;
|
||||
|
||||
# proc
|
||||
type proc_extra, fs_type, proc_type;
|
||||
type proc_reset_reason, fs_type, proc_type;
|
||||
type proc_swapiness, fs_type, proc_type;
|
||||
|
||||
# data types
|
||||
type display_vendor_data_file, file_type, data_file_type;
|
||||
type fingerprintd_vendor_data_file, data_file_type, file_type;
|
||||
type mediadrm_data_file, file_type, data_file_type;
|
||||
type nfc_vendor_data_file, file_type, data_file_type;
|
||||
|
||||
# sysfs types
|
||||
type sysfs_battery_info, sysfs_type, fs_type;
|
||||
type sysfs_battery_supply, sysfs_type, rw_fs_type, fs_type;
|
||||
type sysfs_abox_writable, sysfs_type, rw_fs_type, fs_type;
|
||||
type sysfs_sensor_writable, sysfs_type, rw_fs_type, fs_type;
|
||||
type sysfs_input_writable, sysfs_type, rw_fs_type, fs_type;
|
||||
type sysfs_batteryinfo_charger_writable, sysfs_type, rw_fs_type, fs_type;
|
||||
type sysfs_camera_writable, sysfs_type, rw_fs_type, fs_type;
|
||||
type sysfs_decon, sysfs_type, r_fs_type, fs_type;
|
||||
type sysfs_gpu, sysfs_type, r_fs_type, fs_type;
|
||||
type sysfs_socinfo, sysfs_type, r_fs_type, fs_type;
|
||||
type sysfs_v4l, sysfs_type, r_fs_type, fs_type;
|
||||
type sysfs_v4l_mfc, sysfs_type, r_fs_type, fs_type;
|
||||
type sysfs_v4l_smfc, sysfs_type, r_fs_type, fs_type;
|
||||
type sysfs_v4l_fimc, sysfs_type, r_fs_type, fs_type;
|
||||
type sysfs_graphics, fs_type, sysfs_type;
|
||||
type sysfs_multipdp, fs_type, sysfs_type, mlstrustedobject;
|
||||
type sysfs_sec, fs_type, sysfs_type, mlstrustedobject;
|
||||
type sysfs_gps, fs_type, sysfs_type, mlstrustedobject;
|
||||
type sysfs_brightness, fs_type, sysfs_type, mlstrustedobject;
|
||||
type sysfs_virtual, fs_type, sysfs_type, mlstrustedobject;
|
||||
type sysfs_fuelgauge, fs_type, sysfs_type, mlstrustedobject;
|
||||
type sysfs_charger, fs_type, sysfs_type, mlstrustedobject;
|
||||
type sysfs_modem, fs_type, sysfs_type, mlstrustedobject;
|
||||
type sysfs_camera, fs_type, sysfs_type, mlstrustedobject;
|
||||
type sysfs_mmc_host_writable, sysfs_type, rw_fs_type, fs_type;
|
||||
type sysfs_ss_writable, sysfs_type, rw_fs_type, fs_type;
|
||||
type sysfs_usb_writable, sysfs_type, rw_fs_type, fs_type;
|
||||
type sysfs_gpu_writable, sysfs_type, rw_fs_type, fs_type;
|
||||
type sysfs_info, sysfs_type, r_fs_type, fs_type;
|
||||
### DATA
|
||||
type biometrics_vendor_data_file, file_type, data_file_type;
|
||||
type conn_vendor_data_file, file_type, data_file_type;
|
||||
type gps_vendor_data_file, file_type, data_file_type;
|
||||
type log_vendor_data_file, file_type, data_file_type;
|
||||
type log_cbd_vendor_data_file, file_type, data_file_type;
|
||||
type radio_vendor_data_file, file_type, data_file_type;
|
||||
type wifi_vendor_data_file, file_type, data_file_type;
|
||||
|
||||
# EFS
|
||||
type app_efs_file, file_type;
|
||||
type battery_efs_file, file_type;
|
||||
type bin_nv_data_efs_file, file_type;
|
||||
type cpk_efs_file, file_type;
|
||||
type imei_efs_file, file_type;
|
||||
type nfc_efs_file, file_type;
|
||||
type pfw_efs_file, file_type;
|
||||
type prov_efs_file, file_type;
|
||||
type sec_efs_file, file_type;
|
||||
type tee_efs_file, file_type;
|
||||
type wifi_efs_file, file_type;
|
||||
|
||||
# PROC
|
||||
type proc_last_kmsg, fs_type, proc_type;
|
||||
|
||||
# SOCKETS
|
||||
type epicd_socket, file_type, data_file_type;
|
||||
|
||||
### SYSFS
|
||||
type sysfs_argos, sysfs_type, r_fs_type, fs_type;
|
||||
#type sysfs_battery, sysfs_type, r_fs_type, fs_type;
|
||||
type sysfs_bbd, sysfs_type, r_fs_type, fs_type;
|
||||
type sysfs_fingerprint, sysfs_type, r_fs_type, fs_type;
|
||||
type sysfs_iio, sysfs_type, r_fs_type, fs_type;
|
||||
type sysfs_input, sysfs_type, r_fs_type, fs_type;
|
||||
type sysfs_sec_gps, sysfs_type, r_fs_type, fs_type;
|
||||
type sysfs_sec_key, sysfs_type, r_fs_type, fs_type;
|
||||
type sysfs_sec_sensors, sysfs_type, r_fs_type, fs_type;
|
||||
#type sysfs_sec_switch, sysfs_type, r_fs_type, fs_type;
|
||||
type sysfs_sec_touchscreen, sysfs_type, r_fs_type, fs_type;
|
||||
type sysfs_sim, sysfs_type, r_fs_type, fs_type;
|
||||
type sysfs_sensors, sysfs_type, r_fs_type, fs_type;
|
||||
type sysfs_wifi, sysfs_type, r_fs_type, fs_type;
|
||||
|
||||
type sysfs_backlight_writable, sysfs_type, rw_fs_type, fs_type;
|
||||
#type sysfs_battery_writable, sysfs_type, rw_fs_type, fs_type;
|
||||
type sysfs_bt_writable, sysfs_type, rw_fs_type, fs_type;
|
||||
type sysfs_gps_writable, sysfs_type, rw_fs_type, fs_type;
|
||||
type sysfs_lcd_writable, sysfs_type, rw_fs_type, fs_type;
|
||||
type sysfs_power_writable, sysfs_type, rw_fs_type, fs_type;
|
||||
type sysfs_scsi_host_writable, sysfs_type, rw_fs_type, fs_type;
|
||||
type sysfs_sensorhub_writable, sysfs_type, rw_fs_type, fs_type;
|
||||
type sysfs_sensors_writable, sysfs_type, rw_fs_type, fs_type;
|
||||
type sysfs_sim_writable, sysfs_type, rw_fs_type, fs_type;
|
||||
type sysfs_spi_writeable, sysfs_type, rw_fs_type, fs_type;
|
||||
#type sysfs_sec_switch_writable, sysfs_type, rw_fs_type, fs_type;
|
||||
type sysfs_touchscreen_writable, sysfs_type, rw_fs_type, fs_type;
|
||||
type sysfs_wifi_writable, sysfs_type, rw_fs_type, fs_type;
|
||||
|
||||
### VENDOR
|
||||
type vendor_firmware_file, file_type, vendor_file_type;
|
||||
|
||||
# DATA
|
||||
type tee_vendor_data_file, file_type, data_file_type;
|
||||
|
||||
# DEV SOCKET
|
||||
type tz_socket, file_type;
|
||||
### efs types
|
||||
type radio_factoryapp_efs_file, file_type;
|
||||
type factoryprop_efs_file, file_type;
|
||||
type sensor_factoryapp_efs_file, file_type;
|
||||
type factorymode_factoryapp_efs_file, file_type;
|
||||
type baro_delta_factoryapp_efs_file, file_type;
|
||||
# gps
|
||||
type gps_socket, file_type;
|
||||
# debugfs types
|
||||
type debugfs_mali, fs_type, debugfs_type;
|
||||
type debugfs_mali_mem, fs_type, debugfs_type;
|
||||
type debugfs_ion, fs_type, debugfs_type;
|
||||
type debugfs_ion_dma, fs_type, debugfs_type;
|
||||
# cache
|
||||
type boot_logcat_file, file_type, data_file_type;
|
||||
# proc
|
||||
type proc_extra, fs_type, proc_type;
|
||||
type proc_reset_reason, fs_type, proc_type;
|
||||
type proc_swapiness, fs_type, proc_type;
|
||||
|
||||
# data types
|
||||
type display_vendor_data_file, file_type, data_file_type;
|
||||
type fingerprintd_vendor_data_file, data_file_type, file_type;
|
||||
type mediadrm_data_file, file_type, data_file_type;
|
||||
type nfc_vendor_data_file, file_type, data_file_type;
|
||||
|
||||
# sysfs types
|
||||
type sysfs_battery_info, sysfs_type, fs_type;
|
||||
type sysfs_battery_supply, sysfs_type, rw_fs_type, fs_type;
|
||||
type sysfs_abox_writable, sysfs_type, rw_fs_type, fs_type;
|
||||
type sysfs_sensor_writable, sysfs_type, rw_fs_type, fs_type;
|
||||
type sysfs_input_writable, sysfs_type, rw_fs_type, fs_type;
|
||||
type sysfs_batteryinfo_charger_writable, sysfs_type, rw_fs_type, fs_type;
|
||||
type sysfs_camera_writable, sysfs_type, rw_fs_type, fs_type;
|
||||
type sysfs_decon, sysfs_type, r_fs_type, fs_type;
|
||||
type sysfs_gpu, sysfs_type, r_fs_type, fs_type;
|
||||
type sysfs_socinfo, sysfs_type, r_fs_type, fs_type;
|
||||
type sysfs_v4l, sysfs_type, r_fs_type, fs_type;
|
||||
type sysfs_v4l_mfc, sysfs_type, r_fs_type, fs_type;
|
||||
type sysfs_v4l_smfc, sysfs_type, r_fs_type, fs_type;
|
||||
type sysfs_v4l_fimc, sysfs_type, r_fs_type, fs_type;
|
||||
type sysfs_graphics, fs_type, sysfs_type;
|
||||
type sysfs_multipdp, fs_type, sysfs_type, mlstrustedobject;
|
||||
type sysfs_sec, fs_type, sysfs_type, mlstrustedobject;
|
||||
type sysfs_gps, fs_type, sysfs_type, mlstrustedobject;
|
||||
type sysfs_brightness, fs_type, sysfs_type, mlstrustedobject;
|
||||
type sysfs_virtual, fs_type, sysfs_type, mlstrustedobject;
|
||||
type sysfs_fuelgauge, fs_type, sysfs_type, mlstrustedobject;
|
||||
type sysfs_charger, fs_type, sysfs_type, mlstrustedobject;
|
||||
type sysfs_modem, fs_type, sysfs_type, mlstrustedobject;
|
||||
type sysfs_camera, fs_type, sysfs_type, mlstrustedobject;
|
||||
type sysfs_mmc_host_writable, sysfs_type, rw_fs_type, fs_type;
|
||||
type sysfs_ss_writable, sysfs_type, rw_fs_type, fs_type;
|
||||
type sysfs_usb_writable, sysfs_type, rw_fs_type, fs_type;
|
||||
type sysfs_gpu_writable, sysfs_type, rw_fs_type, fs_type;
|
||||
type sysfs_info, sysfs_type, r_fs_type, fs_type;
|
||||
144
universal7885-common/sepolicy/vendor/file_contexts
vendored
144
universal7885-common/sepolicy/vendor/file_contexts
vendored
|
|
@ -1,3 +1,144 @@
|
|||
# file_contexts
|
||||
|
||||
# DATA
|
||||
/data/vendor/tee(/.*)? u:object_r:tee_vendor_data_file:s0
|
||||
|
||||
# DEV
|
||||
/dev/socket/tz u:object_r:tz_socket:s0
|
||||
/dev/tuihw u:object_r:tz_device:s0
|
||||
/dev/tzdev u:object_r:tz_user_device:s0
|
||||
/dev/tzic u:object_r:tz_device:s0
|
||||
/dev/tzirs u:object_r:tz_device:s0
|
||||
/dev/tziwsock u:object_r:tz_user_device:s0
|
||||
|
||||
# VENDOR
|
||||
/(vendor|system/vendor)/bin/tzdaemon u:object_r:tzdaemon_exec:s0
|
||||
/(vendor|system/vendor)/bin/tzts_daemon u:object_r:tztsdaemon_exec:s0
|
||||
|
||||
/(vendor|system/vendor)/lib(64)?/libteecl\.so u:object_r:same_process_hal_file:s0
|
||||
### DATA
|
||||
/data/vendor/biometrics(/.*)? u:object_r:biometrics_vendor_data_file:s0
|
||||
/data/vendor/conn(/.*)? u:object_r:conn_vendor_data_file:s0
|
||||
/data/vendor/gps(/.*)? u:object_r:gps_vendor_data_file:s0
|
||||
/data/vendor/wifi(/.*)? u:object_r:wifi_vendor_data_file:s0
|
||||
/data/vendor/log(/.*)? u:object_r:log_vendor_data_file:s0
|
||||
/data/vendor/log/cbd(/.*)? u:object_r:log_cbd_vendor_data_file:s0
|
||||
/data/vendor/secradio(/.*)? u:object_r:radio_vendor_data_file:s0
|
||||
|
||||
### DEV
|
||||
/dev/block/platform/.+/by-name/boot u:object_r:boot_block_device:s0
|
||||
/dev/block/platform/.+/by-name/cache u:object_r:cache_block_device:s0
|
||||
/dev/block/platform/.+/by-name/efs u:object_r:efs_block_device:s0
|
||||
/dev/block/platform/.+/by-name/dqmdbg u:object_r:dqmdbg_block_device:s0
|
||||
/dev/block/platform/.+/by-name/dtbo u:object_r:dtbo_block_device:s0
|
||||
/dev/block/platform/.+/by-name/keydata u:object_r:keydata_block_device:s0
|
||||
/dev/block/platform/.+/by-name/keyrefuge u:object_r:keyrefuge_block_device:s0
|
||||
/dev/block/platform/.+/by-name/metadata u:object_r:metadata_block_device:s0
|
||||
/dev/block/platform/.+/by-name/misc u:object_r:misc_block_device:s0
|
||||
/dev/block/platform/.+/by-name/modem u:object_r:modem_block_device:s0
|
||||
/dev/block/platform/.+/by-name/omr u:object_r:omr_block_device:s0
|
||||
/dev/block/platform/.+/by-name/persistent u:object_r:frp_block_device:s0
|
||||
/dev/block/platform/.+/by-name/radio u:object_r:radio_block_device:s0
|
||||
/dev/block/platform/.+/by-name/recovery u:object_r:recovery_block_device:s0
|
||||
/dev/block/platform/.+/by-name/sec_efs u:object_r:sec_efs_block_device:s0
|
||||
/dev/block/platform/.+/by-name/super u:object_r:super_block_device:s0
|
||||
/dev/block/platform/.+/by-name/userdata u:object_r:userdata_block_device:s0
|
||||
|
||||
/dev/esfp[0-9] u:object_r:fp_sensor_device:s0
|
||||
/dev/batch_io u:object_r:io_device:s0
|
||||
/dev/ssp_sensorhub u:object_r:ssp_device:s0
|
||||
|
||||
# bluetooth
|
||||
/dev/ttySAC[0-9] u:object_r:bt_device:s0
|
||||
|
||||
# cpu
|
||||
/dev/cpu_dma_latency u:object_r:cpu_dma_device:s0
|
||||
|
||||
### epic
|
||||
/dev/mode u:object_r:epic_device:s0
|
||||
/dev/socket/epic u:object_r:epicd_socket:s0
|
||||
|
||||
### gnss/gps
|
||||
/dev/bbd_control u:object_r:bbd_device:s0
|
||||
/dev/bbd_packet u:object_r:bbd_device:s0
|
||||
/dev/bbd_patch u:object_r:bbd_device:s0
|
||||
/dev/bbd_reliable u:object_r:bbd_device:s0
|
||||
/dev/bbd_sensor u:object_r:bbd_device:s0
|
||||
/dev/bbd_sio u:object_r:bbd_device:s0
|
||||
/dev/bbd_urgent_patch u:object_r:bbd_device:s0
|
||||
/dev/ttyBCM[0-9]* u:object_r:bbd_device:s0
|
||||
|
||||
### qos
|
||||
/dev/bus_throughput u:object_r:pm_qos_device:s0
|
||||
/dev/bus_throughput_max u:object_r:pm_qos_device:s0
|
||||
/dev/cluster0_freq_max u:object_r:pm_qos_device:s0
|
||||
/dev/cluster0_freq_min u:object_r:pm_qos_device:s0
|
||||
/dev/cluster1_freq_max u:object_r:pm_qos_device:s0
|
||||
/dev/cluster1_freq_min u:object_r:pm_qos_device:s0
|
||||
/dev/cluster2_freq_max u:object_r:pm_qos_device:s0
|
||||
/dev/cluster2_freq_min u:object_r:pm_qos_device:s0
|
||||
/dev/cpu_online_max u:object_r:pm_qos_device:s0
|
||||
/dev/cpu_online_min u:object_r:pm_qos_device:s0
|
||||
/dev/device_throughput u:object_r:pm_qos_device:s0
|
||||
/dev/device_throughput_max u:object_r:pm_qos_device:s0
|
||||
/dev/gpu_freq_max u:object_r:pm_qos_device:s0
|
||||
/dev/gpu_freq_min u:object_r:pm_qos_device:s0
|
||||
/dev/mfc_throughput u:object_r:pm_qos_device:s0
|
||||
/dev/mfc_throughput_max u:object_r:pm_qos_device:s0
|
||||
/dev/network_throughput u:object_r:radio_qos_device:s0
|
||||
/dev/npu_throughput u:object_r:pm_qos_device:s0
|
||||
/dev/npu_throughput_max u:object_r:pm_qos_device:s0
|
||||
|
||||
### radio
|
||||
# DRB
|
||||
/dev/drb u:object_r:drb_device:s0
|
||||
|
||||
# UMTS
|
||||
/dev/umts_boot0 u:object_r:vendor_radio_device:s0
|
||||
/dev/umts_cass u:object_r:vendor_radio_device:s0
|
||||
/dev/umts_ipc[0-1] u:object_r:vendor_radio_device:s0
|
||||
/dev/umts_dm0 u:object_r:vendor_radio_device:s0
|
||||
/dev/umts_rfs0 u:object_r:vendor_radio_device:s0
|
||||
/dev/umts_router u:object_r:vendor_radio_device:s0
|
||||
|
||||
### EFS
|
||||
/efs/Battery(/.*)? u:object_r:battery_efs_file:s0
|
||||
/efs/DAK(/.*)? u:object_r:prov_efs_file:s0
|
||||
/efs/afc(/.*)? u:object_r:sec_efs_file:s0
|
||||
/efs/bluetooth(/.*)? u:object_r:bluetooth_efs_file:s0
|
||||
/efs/cpk(/.*)? u:object_r:cpk_efs_file:s0
|
||||
/efs/imei(/.*)? u:object_r:imei_efs_file:s0
|
||||
/efs/nfc(/.*)? u:object_r:nfc_efs_file:s0
|
||||
/efs/nv_data\.bin(.*) u:object_r:bin_nv_data_efs_file:s0
|
||||
/efs/pfw_data(/.*)? u:object_r:pfw_efs_file:s0
|
||||
/efs/prov(/.*)? u:object_r:prov_efs_file:s0
|
||||
/efs/prov_data(/.*)? u:object_r:prov_efs_file:s0
|
||||
/efs/root(/.*)? u:object_r:app_efs_file:s0
|
||||
/efs/tee(/.*)? u:object_r:tee_efs_file:s0
|
||||
/efs/wifi(/.*)? u:object_r:wifi_efs_file:s0
|
||||
|
||||
/mnt/vendor/efs(/.*)? u:object_r:efs_file:s0
|
||||
/mnt/vendor/efs/DAK(/.*)? u:object_r:prov_efs_file:s0
|
||||
/mnt/vendor/efs/afc(/.*)? u:object_r:sec_efs_file:s0
|
||||
/mnt/vendor/efs/bluetooth(/.*)? u:object_r:bluetooth_efs_file:s0
|
||||
/mnt/vendor/efs/cpk(/.*)? u:object_r:cpk_efs_file:s0
|
||||
/mnt/vendor/efs/imei(/.*)? u:object_r:imei_efs_file:s0
|
||||
/mnt/vendor/efs/nv_data\.bin(.*) u:object_r:bin_nv_data_efs_file:s0
|
||||
/mnt/vendor/efs/pfw_data(/.*)? u:object_r:pfw_efs_file:s0
|
||||
/mnt/vendor/efs/prov(/.*)? u:object_r:prov_efs_file:s0
|
||||
/mnt/vendor/efs/prov_data(/.*)? u:object_r:prov_efs_file:s0
|
||||
/mnt/vendor/efs/root(/.*)? u:object_r:app_efs_file:s0
|
||||
/mnt/vendor/efs/tee(/.*)? u:object_r:tee_efs_file:s0
|
||||
/mnt/vendor/efs/wifi(/.*)? u:object_r:wifi_efs_file:s0
|
||||
|
||||
### VENDOR
|
||||
/(vendor|system/vendor)/bin/cbd u:object_r:cbd_exec:s0
|
||||
/(vendor|system/vendor)/bin/secril_config_svc u:object_r:secril_config_svc_exec:s0
|
||||
|
||||
/(vendor|system/vendor)/bin/hw/android\.hardware\.biometrics\.fingerprint@[0-9].[0-9]-service\.samsung u:object_r:hal_fingerprint_default_exec:s0
|
||||
/(vendor|system/vendor)/bin/hw/android\.hardware\.light@[0-9].[0-9]-service\.samsung u:object_r:hal_light_default_exec:s0
|
||||
/(vendor|system/vendor)/bin/hw/android\.hardware\.thermal@[0-9].[0-9]-service\.samsung u:object_r:hal_thermal_default_exec:s0
|
||||
|
||||
####################################
|
||||
# Devices
|
||||
/dev/mali[0-9]* u:object_r:gpu_device:s0
|
||||
|
|
@ -70,3 +211,6 @@
|
|||
/(vendor|system/vendor)/bin/hw/android\.hardware\.nfc@[0-9]\.[0-9]-service\.samsung u:object_r:hal_nfc_default_exec:s0
|
||||
/(vendor|system/vendor)/bin/hw/android\.hardware\.usb@[0-9]\.[0-9]-service\.typec u:object_r:hal_usb_default_exec:s0
|
||||
/(vendor|system/vendor)/bin/hw/vendor\.samsung\.hardware\.gnss@[0-9]\.[0-9]-service u:object_r:hal_gnss_default_exec:s0
|
||||
/(vendor|system/vendor)/bin/hw/android\.hardware\.sensors@2\.1-service\.samsung-multihal u:object_r:hal_sensors_default_exec:s0
|
||||
# SamsungParts
|
||||
/(vendor/system/vendor)/bin/hw/vendor.eureka.hardware.battery@1.0-service u:object_r:hal_battery_default_exec:s0
|
||||
|
|
|
|||
|
|
@ -1,3 +1,68 @@
|
|||
# genfs_contexts
|
||||
|
||||
### PROC
|
||||
genfscon proc /last_kmsg u:object_r:proc_last_kmsg:s0
|
||||
|
||||
### SYSFS
|
||||
genfscon sysfs /bbd u:object_r:sysfs_bbd:s0
|
||||
|
||||
genfscon sysfs /bus/iio/devices u:object_r:sysfs_iio:s0
|
||||
|
||||
genfscon sysfs /class/backlight/ u:object_r:sysfs_backlight_writable:s0
|
||||
genfscon sysfs /class/fingerprint/fingerprint u:object_r:sysfs_fingerprint:s0
|
||||
genfscon sysfs /class/input u:object_r:sysfs_input:s0
|
||||
genfscon sysfs /class/power_supply u:object_r:sysfs_battery:s0
|
||||
genfscon sysfs /class/rtc/rtc0 u:object_r:sysfs_rtc:s0
|
||||
genfscon sysfs /class/sec/gps u:object_r:sysfs_sec_gps:s0
|
||||
genfscon sysfs /class/sec/sensors u:object_r:sysfs_sec_sensors:s0
|
||||
genfscon sysfs /class/sec/tsp u:object_r:sysfs_sec_touchscreen:s0
|
||||
genfscon sysfs /class/sensor_event u:object_r:sysfs_sensors:s0
|
||||
genfscon sysfs /class/sensors u:object_r:sysfs_sensors:s0
|
||||
genfscon sysfs /class/thermal u:object_r:sysfs_thermal:s0
|
||||
genfscon sysfs /class/timed_output/vibrator/intensity u:object_r:sysfs_vibrator:s0
|
||||
genfscon sysfs /class/timed_output/vibrator/multi_freq u:object_r:sysfs_vibrator:s0
|
||||
|
||||
genfscon sysfs /devices/platform/argos u:object_r:sysfs_argos:s0
|
||||
genfscon sysfs /devices/platform/battery/power_supply u:object_r:sysfs_battery:s0
|
||||
genfscon sysfs /devices/platform/battery/power_supply/battery/lcd u:object_r:sysfs_battery_writable:s0
|
||||
genfscon sysfs /devices/platform/panel@0/backlight/panel/brightness u:object_r:sysfs_backlight_writable:s0
|
||||
genfscon sysfs /devices/platform/panel@0/backlight/panel/max_brightness u:object_r:sysfs_backlight_writable:s0
|
||||
genfscon sysfs /devices/platform/panel@0/lcd/panel u:object_r:sysfs_lcd_writable:s0
|
||||
|
||||
genfscon sysfs /devices/virtual/fingerprint/fingerprint u:object_r:sysfs_fingerprint:s0
|
||||
genfscon sysfs /devices/virtual/input u:object_r:sysfs_input:s0
|
||||
genfscon sysfs /devices/virtual/lcd/panel u:object_r:sysfs_lcd_writable:s0
|
||||
genfscon sysfs /devices/virtual/sec/gps u:object_r:sysfs_sec_gps:s0
|
||||
genfscon sysfs /devices/virtual/sec/sec_key u:object_r:sysfs_sec_key:s0
|
||||
genfscon sysfs /devices/virtual/sec/tsp u:object_r:sysfs_sec_touchscreen:s0
|
||||
genfscon sysfs /devices/virtual/sec/tsp/cmd u:object_r:sysfs_touchscreen_writable:s0
|
||||
genfscon sysfs /devices/virtual/sec/tsp/ear_detect_enable u:object_r:sysfs_touchscreen_writable:s0
|
||||
genfscon sysfs /devices/virtual/sec/tsp/prox_power_off u:object_r:sysfs_touchscreen_writable:s0
|
||||
genfscon sysfs /devices/virtual/sec/tsp/input/enabled u:object_r:sysfs_touchscreen_writable:s0
|
||||
genfscon sysfs /devices/virtual/sensor_event u:object_r:sysfs_sensors:s0
|
||||
genfscon sysfs /devices/virtual/sensors u:object_r:sysfs_sensors:s0
|
||||
genfscon sysfs /devices/virtual/sensors/hidden_hole/hh_check_coef u:object_r:sysfs_sensors_writable:s0
|
||||
genfscon sysfs /devices/virtual/sensors/ssp_sensor/enable u:object_r:sysfs_sensors_writable:s0
|
||||
genfscon sysfs /devices/virtual/sensors/ssp_sensor/ssp_flush u:object_r:sysfs_sensors_writable:s0
|
||||
genfscon sysfs /devices/virtual/sec/switch u:object_r:sysfs_sec_switch:s0
|
||||
genfscon sysfs /devices/virtual/sec/switch/afc_disable u:object_r:sysfs_sec_switch_writable:s0
|
||||
genfscon sysfs /devices/virtual/thermal u:object_r:sysfs_thermal:s0
|
||||
genfscon sysfs /devices/virtual/timed_output/vibrator/cp_trigger_index u:object_r:sysfs_vibrator:s0
|
||||
genfscon sysfs /devices/virtual/timed_output/vibrator/intensity u:object_r:sysfs_vibrator:s0
|
||||
genfscon sysfs /devices/virtual/timed_output/vibrator/multi_freq u:object_r:sysfs_vibrator:s0
|
||||
|
||||
genfscon sysfs /module/dhd/parameters u:object_r:sysfs_wifi_writable:s0
|
||||
|
||||
genfscon sysfs /power/cpufreq_max_limit u:object_r:sysfs_power_writable:s0
|
||||
genfscon sysfs /power/cpufreq_min_limit u:object_r:sysfs_power_writable:s0
|
||||
genfscon sysfs /power/cpuhotplug/max_online_cpu u:object_r:sysfs_power_writable:s0
|
||||
genfscon sysfs /power/rtc_status u:object_r:sysfs_power_writable:s0
|
||||
|
||||
genfscon sysfs /wifi u:object_r:sysfs_wifi:s0
|
||||
genfscon sysfs /wifi/cid u:object_r:sysfs_wifi_writable:s0
|
||||
genfscon sysfs /wifi/mac_addr u:object_r:sysfs_wifi_writable:s0
|
||||
genfscon sysfs /wifi/memdump u:object_r:sysfs_wifi_writable:s0
|
||||
|
||||
# DEBUGFS
|
||||
genfscon debugfs /mali/ u:object_r:debugfs_mali:s0
|
||||
genfscon debugfs /mali/mem/ u:object_r:debugfs_mali_mem:s0
|
||||
|
|
|
|||
38
universal7885-common/sepolicy/vendor/gpsd.te
vendored
38
universal7885-common/sepolicy/vendor/gpsd.te
vendored
|
|
@ -1,3 +1,41 @@
|
|||
type gpsd, domain, netdomain;
|
||||
type gpsd_exec, exec_type, vendor_file_type, file_type;
|
||||
|
||||
# gpsd is started by init, type transit from init domain to gpsd domain
|
||||
init_daemon_domain(gpsd)
|
||||
|
||||
allow gpsd rild:unix_stream_socket connectto;
|
||||
|
||||
get_prop(gpsd, vendor_radio_prop)
|
||||
get_prop(gpsd, telephony_config_prop)
|
||||
get_prop(gpsd, exported_config_prop)
|
||||
|
||||
get_prop(gpsd, hwservicemanager_prop)
|
||||
hwbinder_use(gpsd)
|
||||
allow gpsd system_suspend_hwservice:hwservice_manager { find };
|
||||
allow gpsd fwk_sensor_hwservice:hwservice_manager { find };
|
||||
|
||||
binder_call(gpsd, system_suspend_server)
|
||||
binder_call(gpsd, system_server)
|
||||
binder_call(system_server, gpsd)
|
||||
|
||||
allow gpsd self:netlink_kobject_uevent_socket create_socket_perms_no_ioctl;
|
||||
allow gpsd self:{ tcp_socket udp_socket } create_stream_socket_perms;
|
||||
allow gpsd port:tcp_socket { name_bind name_connect };
|
||||
allow gpsd port:udp_socket name_bind;
|
||||
allow gpsd node:{ tcp_socket udp_socket } node_bind;
|
||||
|
||||
# /acct/tasks
|
||||
allow gpsd cgroup:file getattr;
|
||||
|
||||
# /dev/socket/fwmarkd
|
||||
allow gpsd fwmarkd_socket:sock_file write;
|
||||
|
||||
# /data/vendor/gps
|
||||
allow gpsd gps_vendor_data_file:dir rw_dir_perms;
|
||||
allow gpsd gps_vendor_data_file:file create_file_perms;
|
||||
allow gpsd gps_vendor_data_file:fifo_file create_file_perms;
|
||||
|
||||
r_dir_file(gpsd, sysfs_sec_gps)
|
||||
|
||||
allow gpsd sysfs_gps_writable:file rw_file_perms;
|
||||
|
|
|
|||
3
universal7885-common/sepolicy/vendor/hal_battery_default.te
vendored
Normal file
3
universal7885-common/sepolicy/vendor/hal_battery_default.te
vendored
Normal file
|
|
@ -0,0 +1,3 @@
|
|||
type hal_battery_default, domain;
|
||||
type hal_battery_default_exec, exec_type, file_type, vendor_file_type;
|
||||
init_daemon_domain(hal_battery_default);
|
||||
|
|
@ -1 +1,24 @@
|
|||
|
||||
# ro.rfkilldisabled
|
||||
get_prop(hal_bluetooth_default, rfkilldisabled_prop)
|
||||
# vendor.bluetooth_fw_ver
|
||||
set_prop(hal_bluetooth_default, wifi_log_prop)
|
||||
# sys.bluetooth.tty
|
||||
set_prop(hal_bluetooth_default, exported_bluetooth_prop)
|
||||
|
||||
# /dev/ttySAC[0-9]
|
||||
allow hal_bluetooth_default bt_device:chr_file rw_file_perms;
|
||||
|
||||
# /mnt/vendor
|
||||
allow hal_bluetooth_default mnt_vendor_file:dir search;
|
||||
|
||||
# /mnt/vendor/efs/
|
||||
allow hal_bluetooth_default efs_file:dir r_dir_perms;
|
||||
|
||||
# /mnt/vendor/conn
|
||||
allow hal_bluetooth_default conn_vendor_data_file:dir r_dir_perms;
|
||||
allow hal_bluetooth_default conn_vendor_data_file:file r_file_perms;
|
||||
|
||||
# /sys/devices/platform/bluetooth/rfkill/rfkill0/state
|
||||
allow hal_bluetooth_default sysfs_bt_writable:file rw_file_perms;
|
||||
allow hal_bluetooth_default vendor_firmware_file:dir r_dir_perms;
|
||||
|
|
|
|||
|
|
@ -1,3 +1,18 @@
|
|||
# hal_fingerprint_default.te
|
||||
|
||||
teegris_use(hal_fingerprint_default)
|
||||
# /dev/esfp[0-9]
|
||||
allow hal_fingerprint_default fp_sensor_device:chr_file rw_file_perms;
|
||||
|
||||
# /data/vendor/ -> biometrics
|
||||
file_type_auto_trans(hal_fingerprint_default, vendor_data_file, biometrics_vendor_data_file)
|
||||
|
||||
# /data/vendor/biometrics/*
|
||||
allow hal_fingerprint_default biometrics_vendor_data_file:file create_file_perms;
|
||||
|
||||
# /sys/class/fingerprint/
|
||||
allow hal_fingerprint_default sysfs_fingerprint:dir r_dir_perms;
|
||||
allow hal_fingerprint_default sysfs_fingerprint:file r_file_perms;
|
||||
typeattribute hal_fingerprint_default data_between_core_and_vendor_violators;
|
||||
|
||||
allow hal_fingerprint_default fingerprintd_data_file:dir write;
|
||||
|
|
|
|||
|
|
@ -1,3 +1,4 @@
|
|||
allow hal_gatekeeper_default efs_file:dir search;
|
||||
allow hal_gatekeeper_default efs_file:file rw_file_perms;
|
||||
allow hal_gatekeeper_default mnt_vendor_file:dir search;
|
||||
teegris_use(hal_gatekeeper_default)
|
||||
|
|
|
|||
|
|
@ -1,3 +1,5 @@
|
|||
# hal_gnss_default.te
|
||||
|
||||
# cgroups tasks
|
||||
allow hal_gnss_default cgroup:file getattr;
|
||||
|
||||
|
|
@ -8,7 +10,6 @@ allow hal_gnss_default gps_vendor_data_file:fifo_file create_file_perms;
|
|||
|
||||
# /mnt/vendor
|
||||
allow hal_gnss_default mnt_vendor_file:dir search;
|
||||
|
||||
# vndbinder
|
||||
allow hal_gnss_default vndbinder_device:chr_file rw_file_perms;
|
||||
|
||||
|
|
|
|||
|
|
@ -1 +1,9 @@
|
|||
# hal_keymaster_default
|
||||
|
||||
# /mnt/vendor
|
||||
allow hal_keymaster_default mnt_vendor_file:dir search;
|
||||
|
||||
# /mnt/vendor/efs
|
||||
allow hal_keymaster_default efs_file:dir search;
|
||||
teegris_use(hal_keymaster_default)
|
||||
allow hal_keymaster_default prov_efs_file:file r_file_perms;
|
||||
|
|
|
|||
|
|
@ -1,3 +1,8 @@
|
|||
# hal_light_default.te
|
||||
|
||||
# /sys/devices/platform/panel@0/backlight/panel/brightness
|
||||
# /sys/devices/platform/panel@0/backlight/panel/max_brightness
|
||||
allow hal_light_default sysfs_backlight_writable:file rw_file_perms;
|
||||
allow hal_light_default sysfs_graphics:dir search;
|
||||
allow hal_light_default sysfs_graphics:file rw_file_perms;
|
||||
allow hal_light_default sysfs_virtual:dir search;
|
||||
|
|
|
|||
|
|
@ -1,3 +1,28 @@
|
|||
# hal_power_default.te
|
||||
|
||||
# /dev/cpu_dma_latency
|
||||
allow hal_power_default cpu_dma_device:chr_file rw_file_perms;
|
||||
|
||||
# /dev/stune/top-app/schedtune.boost
|
||||
allow hal_power_default cgroup:file rw_file_perms;
|
||||
|
||||
# /sys/class/input/
|
||||
allow hal_power_default sysfs_input:dir r_dir_perms;
|
||||
|
||||
# /sys/class/power/
|
||||
allow hal_power_default sysfs_power:dir r_dir_perms;
|
||||
allow hal_power_default sysfs_power:file r_file_perms;
|
||||
allow hal_power_default sysfs_power_writable:file rw_file_perms;
|
||||
|
||||
# /sys/class/sec/tsp/input/
|
||||
allow hal_power_default sysfs_sec_touchscreen:dir r_dir_perms;
|
||||
allow hal_power_default sysfs_sec_touchscreen:lnk_file r_file_perms;
|
||||
|
||||
# /sys/class/sec/tsp/input/{cmd,enabled}
|
||||
allow hal_power_default sysfs_touchscreen_writable:file rw_file_perms;
|
||||
|
||||
# /sys/devices/system/cpu/cpu[0-9]/cpufreq/scaling_max_freq
|
||||
allow hal_power_default sysfs_devices_system_cpu:file rw_file_perms;
|
||||
allow hal_power_default sysfs_graphics:dir search;
|
||||
allow hal_power_default sysfs_graphics:file r_file_perms;
|
||||
allow hal_power_default sysfs_input:file r_file_perms;
|
||||
|
|
|
|||
|
|
@ -1,3 +1,62 @@
|
|||
# hal_sensors_default.te
|
||||
|
||||
# /dev/batch_io
|
||||
allow hal_sensors_default io_device:chr_file r_file_perms;
|
||||
|
||||
# /dev/iio:device1
|
||||
allow hal_sensors_default iio_device:chr_file r_file_perms;
|
||||
|
||||
# /dev/ssp_sensorhub
|
||||
allow hal_sensors_default ssp_device:chr_file rw_file_perms;
|
||||
|
||||
# /efs
|
||||
allow hal_sensors_default efs_file:dir r_dir_perms;
|
||||
|
||||
# /efs/FactoryApp/
|
||||
allow hal_sensors_default app_efs_file:dir rw_dir_perms;
|
||||
allow hal_sensors_default app_efs_file:file { setattr rw_file_perms };
|
||||
|
||||
# /sys/bus/iio/devices
|
||||
allow hal_sensors_default sysfs_iio:dir r_dir_perms;
|
||||
allow hal_sensors_default sysfs_iio:file r_file_perms;
|
||||
|
||||
# /sys/class/sec/sensors
|
||||
allow hal_sensors_default sysfs_sec_sensors:dir r_dir_perms;
|
||||
allow hal_sensors_default sysfs_sec_sensors:file r_file_perms;
|
||||
|
||||
# /sys/class/sensors/ssp_sensor/enable
|
||||
allow hal_sensors_default sysfs_sensors_writable:dir r_dir_perms;
|
||||
allow hal_sensors_default sysfs_sensors_writable:file rw_file_perms;
|
||||
|
||||
# /sys/devices/platform/10970000.spi/
|
||||
allow hal_sensors_default sysfs_spi_writeable:dir r_dir_perms;
|
||||
allow hal_sensors_default sysfs_spi_writeable:file rw_file_perms;
|
||||
|
||||
# /sys/devices/platform/panel@0/lcd/panel/window_type
|
||||
allow hal_sensors_default sysfs_lcd_writable:dir r_dir_perms;
|
||||
allow hal_sensors_default sysfs_lcd_writable:file r_file_perms;
|
||||
|
||||
# /sys/class/input
|
||||
allow hal_sensors_default sysfs_input:dir r_dir_perms;
|
||||
|
||||
# /sys/devices/virtual/input/input4
|
||||
# /sys/devices/virtual/input/input6
|
||||
allow hal_sensors_default sysfs_sensors:dir r_dir_perms;
|
||||
allow hal_sensors_default sysfs_sensors:file r_file_perms;
|
||||
|
||||
# /sys/devices/virtual/sensors/magnetic_sensor/vendor
|
||||
allow hal_sensors_default sysfs_sensors:dir r_dir_perms;
|
||||
allow hal_sensors_default sysfs_sensors:file r_file_perms;
|
||||
|
||||
# /sys/devices/virtual/sec/sec_key/hall_detect
|
||||
allow hal_sensors_default sysfs_sec_key:dir r_dir_perms;
|
||||
allow hal_sensors_default sysfs_sec_key:file r_file_perms;
|
||||
|
||||
# /sys/class/sec/tsp/
|
||||
allow hal_sensors_default sysfs_sec_touchscreen:dir r_dir_perms;
|
||||
allow hal_sensors_default sysfs_sec_touchscreen:file r_file_perms;
|
||||
allow hal_sensors_default sysfs_sec_touchscreen:lnk_file r_file_perms;
|
||||
|
||||
allow hal_sensors_default sysfs_iio:file r_file_perms;
|
||||
allow hal_sensors_default sysfs_iio:lnk_file read;
|
||||
allow hal_sensors_default sysfs_virtual:dir r_dir_perms;
|
||||
|
|
|
|||
|
|
@ -1 +1,8 @@
|
|||
|
||||
# /acct/tasks
|
||||
allow hal_thermal_default cgroup:file getattr;
|
||||
|
||||
# /sys/devices/virtual/thermal/
|
||||
allow hal_thermal_default sysfs_thermal:dir r_dir_perms;
|
||||
allow hal_thermal_default sysfs_thermal:file r_file_perms;
|
||||
r_dir_file(hal_thermal_default, sysfs_virtual)
|
||||
|
|
|
|||
|
|
@ -1,2 +1,6 @@
|
|||
# hal_wifi_hostapd_default.te
|
||||
|
||||
# /data/vendor/wifi/hostapd/hostapd_wlan0.conf
|
||||
r_dir_file(hal_wifi_hostapd_default, wifi_vendor_data_file)
|
||||
allow hal_wifi_hostapd_default sysfs_virtual:dir search;
|
||||
allow hal_wifi_hostapd_default sysfs_virtual:lnk_file r_file_perms;
|
||||
|
|
|
|||
|
|
@ -1 +1,2 @@
|
|||
type rild_hwservice, hwservice_manager_type;
|
||||
type hal_battery_hwservice, hwservice_manager_type;
|
||||
|
|
|
|||
|
|
@ -4,3 +4,6 @@ vendor.samsung.hardware.radio.bridge::ISehBridge u:object_r:rild_hwse
|
|||
vendor.samsung.hardware.radio.channel::ISehChannel u:object_r:rild_hwservice:s0
|
||||
vendor.lineage.power::ILineagePower u:object_r:hal_power_hwservice:s0
|
||||
|
||||
# SamsungParts
|
||||
vendor.eureka.hardware.battery::IBattery u:object_r:hal_battery_hwservice:s0
|
||||
|
||||
|
|
|
|||
3
universal7885-common/sepolicy/vendor/init.te
vendored
3
universal7885-common/sepolicy/vendor/init.te
vendored
|
|
@ -49,6 +49,9 @@ allow init proc_extra:file setattr;
|
|||
allow init proc_reset_reason:file setattr;
|
||||
allow init proc_swapiness:file open;
|
||||
allow init self:netlink_generic_socket { bind create getattr read setopt write };
|
||||
# init.te
|
||||
|
||||
allow init proc_last_kmsg:file setattr;
|
||||
allow init mnt_vendor_file:dir mounton;
|
||||
|
||||
unix_socket_connect(init, property, rild)
|
||||
|
|
|
|||
|
|
@ -1,3 +1,8 @@
|
|||
# kernel.te
|
||||
|
||||
# /vendor/firmware/
|
||||
allow kernel vendor_firmware_file:dir r_dir_perms;
|
||||
allow kernel vendor_firmware_file:file r_file_perms;
|
||||
allow kernel app_efs_file:dir search;
|
||||
allow kernel app_efs_file:file open;
|
||||
allow kernel sensor_factoryapp_efs_file:file open;
|
||||
|
|
|
|||
|
|
@ -1 +1,41 @@
|
|||
# macloader.te
|
||||
|
||||
type macloader, domain;
|
||||
type macloader_exec, exec_type, vendor_file_type, file_type;
|
||||
|
||||
# macloader is started by init, type transit from init domain to macloader domain
|
||||
init_daemon_domain(macloader)
|
||||
|
||||
set_prop(macloader, vendor_wifi_prop);
|
||||
|
||||
allow macloader self:capability { net_admin };
|
||||
|
||||
allow macloader self:udp_socket create_socket_perms;
|
||||
allowxperm macloader self:udp_socket ioctl { 0x8913 0x8914 };
|
||||
|
||||
# /data/vendor/conn
|
||||
allow macloader conn_vendor_data_file:dir rw_dir_perms;
|
||||
allow macloader conn_vendor_data_file:file create_file_perms;
|
||||
|
||||
# /mnt/vendor
|
||||
allow macloader mnt_vendor_file:dir search;
|
||||
|
||||
# /mnt/vendor/efs
|
||||
allow macloader efs_file:dir rw_dir_perms;
|
||||
|
||||
# /mnt/vendor/efs/wifi
|
||||
allow macloader wifi_efs_file:dir rw_dir_perms;
|
||||
allow macloader wifi_efs_file:file rw_file_perms;
|
||||
|
||||
# /sys/class/net
|
||||
allow macloader sysfs_net:dir r_dir_perms;
|
||||
allow macloader sysfs_net:file r_file_perms;
|
||||
|
||||
# /sys/module/dhd/parameters/firmware_path
|
||||
allow macloader sysfs_wifi_writable:dir r_dir_perms;
|
||||
allow macloader sysfs_wifi_writable:file rw_file_perms;
|
||||
|
||||
# /sys/wifi
|
||||
allow macloader sysfs_wifi:dir r_dir_perms;
|
||||
allow macloader sysfs_wifi:file r_file_perms;
|
||||
allow macloader sysfs_virtual:dir search;
|
||||
|
|
|
|||
11
universal7885-common/sepolicy/vendor/property.te
vendored
11
universal7885-common/sepolicy/vendor/property.te
vendored
|
|
@ -13,3 +13,14 @@ type vendor_nfc_prop, property_type;
|
|||
type vendor_wlbtd_prop, property_type;
|
||||
type vendor_wlan_prop, property_type;
|
||||
type vendor_hwc_prop, property_type;
|
||||
# property.te
|
||||
|
||||
type vendor_cbd_prop, property_type;
|
||||
type vendor_radio_prop, property_type;
|
||||
type vendor_fastcharge_prop, property_type;
|
||||
type vendor_wifi_prop, property_type;
|
||||
|
||||
# property.te
|
||||
type vendor_secureos_prop, property_type;
|
||||
type vendor_tzdaemon_prop, property_type;
|
||||
type vendor_tztsdaemon_prop, property_type;
|
||||
|
|
|
|||
|
|
@ -1,3 +1,16 @@
|
|||
### cbd
|
||||
vendor.cbd. u:object_r:vendor_cbd_prop:s0
|
||||
persist.vendor.cbd. u:object_r:vendor_radio_prop:s0
|
||||
|
||||
### radio
|
||||
ro.multisim. u:object_r:vendor_radio_prop:s0
|
||||
ro.vendor.multisim. u:object_r:vendor_radio_prop:s0
|
||||
ro.vendor.radio. u:object_r:vendor_radio_prop:s0
|
||||
|
||||
### wifi
|
||||
vendor.wifi. u:object_r:vendor_wifi_prop:s0
|
||||
ro.vendor.wifi. u:object_r:vendor_wifi_prop:s0
|
||||
|
||||
# bluetooth
|
||||
persist.bluetooth_fw_ver u:object_r:bluetooth_prop:s0
|
||||
ro.bluetooth.tty u:object_r:bluetooth_prop:s0
|
||||
|
|
@ -38,3 +51,9 @@ vendor.wlan. u:object_r:vendor_wlan_prop:s0
|
|||
|
||||
# Hwc
|
||||
hwc.exynos.vsync_mode u:object_r:vendor_hwc_prop:s0
|
||||
|
||||
|
||||
# TEEGRIS
|
||||
vendor.secureos. u:object_r:vendor_secureos_prop:s0
|
||||
vendor.tzdaemon u:object_r:vendor_tzdaemon_prop:s0
|
||||
vendor.tzts_daemon u:object_r:vendor_tztsdaemon_prop:s0
|
||||
|
|
|
|||
68
universal7885-common/sepolicy/vendor/rild.te
vendored
68
universal7885-common/sepolicy/vendor/rild.te
vendored
|
|
@ -1,3 +1,71 @@
|
|||
# rild.te
|
||||
|
||||
get_prop(rild, vendor_radio_prop)
|
||||
|
||||
allow rild block_device:dir search;
|
||||
allow rild mnt_vendor_file:dir { getattr search };
|
||||
|
||||
# audio hal
|
||||
allow rild hal_audio_default:dir search;
|
||||
allow rild hal_audio_default:file r_file_perms;
|
||||
|
||||
# gps
|
||||
allow rild gpsd:dir search;
|
||||
allow rild gpsd:file r_file_perms;
|
||||
|
||||
# /data
|
||||
allow rild system_data_file:dir getattr;
|
||||
|
||||
# /data/vendor/log
|
||||
allow rild log_vendor_data_file:dir rw_dir_perms;
|
||||
allow rild log_vendor_data_file:file create_file_perms;
|
||||
|
||||
# /dev/block/platform/.+/by-name/radio
|
||||
allow rild radio_block_device:blk_file r_file_perms;
|
||||
|
||||
# /dev/drb
|
||||
allow rild drb_device:chr_file rw_file_perms;
|
||||
|
||||
# /dev/umts_*
|
||||
# /dev/umts_ipc*
|
||||
allow rild vendor_radio_device:chr_file rw_file_perms;
|
||||
|
||||
# /data/vendor/secradio
|
||||
allow rild radio_vendor_data_file:dir rw_dir_perms;
|
||||
allow rild radio_vendor_data_file:file create_file_perms;
|
||||
|
||||
# /efs/FactoryApp/
|
||||
# /mnt/vendor/efs/root
|
||||
allow rild app_efs_file:dir r_dir_perms;
|
||||
allow rild app_efs_file:file { rw_file_perms setattr };
|
||||
|
||||
# /efs/imei
|
||||
allow rild imei_efs_file:dir r_dir_perms;
|
||||
allow rild imei_efs_file:file r_file_perms;
|
||||
|
||||
# /mnt/vendor/efs/
|
||||
allow rild prov_efs_file:dir r_dir_perms;
|
||||
allow rild prov_efs_file:file r_file_perms;
|
||||
|
||||
# /mnt/vendor/efs/nv_data.bin
|
||||
allow rild bin_nv_data_efs_file:file { rw_file_perms setattr unlink };
|
||||
|
||||
# /proc/net/xt_qtaguid/iface_stat_fmt
|
||||
allow rild proc_qtaguid_stat:file r_file_perms;
|
||||
|
||||
# /proc/sys/net/ipv6/conf/*/accept_ra_defrtr
|
||||
allow rild proc_net:file rw_file_perms;
|
||||
|
||||
# mdc.
|
||||
# persist.sys.omc_support
|
||||
# ro.csc.
|
||||
get_prop(rild, exported_config_prop);
|
||||
|
||||
# ro.boot.cpboot, ril.NwNmId[0-9]
|
||||
get_prop(rild, telephony_config_prop)
|
||||
|
||||
# vendor.cbd.
|
||||
set_prop(rild, vendor_cbd_prop)
|
||||
allow rild proc_net:file write;
|
||||
allow rild vendor_data_file:file create_file_perms;
|
||||
|
||||
|
|
|
|||
|
|
@ -1 +1,21 @@
|
|||
# secril_config_svc.te
|
||||
|
||||
type secril_config_svc, domain;
|
||||
type secril_config_svc_exec, exec_type, vendor_file_type, file_type;
|
||||
|
||||
# secril_config_svc is started by init, type transit from init domain to secril_config_svc domain
|
||||
init_daemon_domain(secril_config_svc)
|
||||
|
||||
# /mnt/vendor/
|
||||
allow secril_config_svc mnt_vendor_file:dir search;
|
||||
|
||||
# /mnt/vendor/efs/factory.prop
|
||||
# /mnt/vendor/efs/telephony.prop
|
||||
allow secril_config_svc efs_file:dir search;
|
||||
allow secril_config_svc efs_file:file r_file_perms;
|
||||
|
||||
# ro.multisim.
|
||||
# ro.vendor.multisim.
|
||||
# ro.vendor.radio.default_network
|
||||
set_prop(secril_config_svc, vendor_radio_prop)
|
||||
dontaudit secril_config_svc radio_control_prop:property_service set;
|
||||
|
|
|
|||
|
|
@ -1,3 +1,6 @@
|
|||
# system_server.te
|
||||
|
||||
allow system_server proc_last_kmsg:file r_file_perms;
|
||||
# /dev/mali0
|
||||
allow system_server gpu_device:chr_file rw_file_perms;
|
||||
|
||||
|
|
|
|||
36
universal7885-common/sepolicy/vendor/tzdaemon.te
vendored
36
universal7885-common/sepolicy/vendor/tzdaemon.te
vendored
|
|
@ -1,4 +1,38 @@
|
|||
type tzdaemon, domain;
|
||||
type tzdaemon_exec, exec_type, vendor_file_type, file_type;
|
||||
|
||||
# tzdaemon is started by init, type transit from init domain to tzdaemon domain
|
||||
init_daemon_domain(tzdaemon)
|
||||
|
||||
set_prop(tzdaemon, vendor_tzdaemon_prop)
|
||||
set_prop(tzdaemon, vendor_secureos_prop)
|
||||
|
||||
allow tzdaemon tz_device:chr_file rw_file_perms;
|
||||
allow tzdaemon tz_user_device:chr_file rw_file_perms;
|
||||
allow tzdaemon tz_socket:sock_file { write };
|
||||
|
||||
# /dev/kmsg
|
||||
allow tzdaemon kmsg_device:chr_file rw_file_perms;
|
||||
|
||||
# /data/vendor/tee
|
||||
allow tzdaemon tee_vendor_data_file:dir create_dir_perms;
|
||||
allow tzdaemon tee_vendor_data_file:file create_file_perms;
|
||||
|
||||
# /proc/stat
|
||||
allow tzdaemon proc_stat:file r_file_perms;
|
||||
|
||||
# /efs
|
||||
allow tzdaemon efs_file:dir r_dir_perms;
|
||||
|
||||
# /efs/tee/
|
||||
# /mnt/vendor/efs/tee/
|
||||
allow tzdaemon tee_efs_file:dir create_dir_perms;
|
||||
allow tzdaemon tee_efs_file:file create_file_perms;
|
||||
|
||||
# /mnt/vendor/
|
||||
allow tzdaemon mnt_vendor_file:dir r_dir_perms;
|
||||
|
||||
allow tzdaemon mnt_vendor_file:dir rw_dir_perms;
|
||||
allow tzdaemon efs_file:dir search;
|
||||
allow tzdaemon tee_efs_file:dir { add_name remove_name open create read search write };
|
||||
allow tzdaemon tee_efs_file:file { getattr open create read rename unlink write };
|
||||
allow tzdaemon tee_efs_file:file { getattr open create read rename unlink write };
|
||||
Loading…
Reference in a new issue