diff --git a/a20/aosp_a20.mk b/a20/aosp_a20.mk new file mode 100644 index 0000000..05c2ff2 --- /dev/null +++ b/a20/aosp_a20.mk @@ -0,0 +1,8 @@ +# Auto-Generated by device/samsung/a20/setup.sh +$(call inherit-product, device/samsung/a20/full_a20.mk) +$(call inherit-product, vendor/aosp/config/common_full_phone.mk) +PRODUCT_NAME := aosp_a20 + +# Additional Props +TARGET_FACE_UNLOCK_SUPPORTED := true +TARGET_BOOT_ANIMATION_RES := 720 diff --git a/universal7885-common/BoardConfigCommon.mk b/universal7885-common/BoardConfigCommon.mk index 1a6203b..874495e 100644 --- a/universal7885-common/BoardConfigCommon.mk +++ b/universal7885-common/BoardConfigCommon.mk @@ -84,17 +84,13 @@ ENABLE_VENDOR_RIL_SERVICE := true # Sepolicy SYSTEM_EXT_PUBLIC_SEPOLICY_DIRS += \ - $(COMMON_PATH)/sepolicy/samsung_slsi/tee/public \ - $(COMMON_PATH)/sepolicy/samsung_slsi/public \ - $(COMMON_PATH)/sepolicy/samsungparts + $(COMMON_PATH)/sepolicy/public BOARD_VENDOR_SEPOLICY_DIRS += \ - $(COMMON_PATH)/sepolicy/samsung_slsi/tee/vendor \ - $(COMMON_PATH)/sepolicy/vendor \ - $(COMMON_PATH)/sepolicy/samsung_slsi/vendor + $(COMMON_PATH)/sepolicy/vendor SYSTEM_EXT_PRIVATE_SEPOLICY_DIRS += \ - $(COMMON_PATH)/sepolicy/samsung_slsi/private + $(COMMON_PATH)/sepolicy/private # Vendor TARGET_COPY_OUT_VENDOR := vendor diff --git a/universal7885-common/SamsungParts/init.samsungparts.rc b/universal7885-common/SamsungParts/init.samsungparts.rc new file mode 100644 index 0000000..c7da3fb --- /dev/null +++ b/universal7885-common/SamsungParts/init.samsungparts.rc @@ -0,0 +1,13 @@ +on property:sys.boot_completed=1 + chmod 664 /sys/devices/platform/11500000.mali/tmu + chown system system /sys/devices/platform/11500000.mali/tmu + chmod 664 /sys/class/camera/flash/torch_brightness_lvl + chown system system /sys/class/camera/flash/torch_brightness_lvl + chmod 664 /sys/class/camera/flash/torch_brightness_lvl_enable + chown system system /sys/class/camera/flash/torch_brightness_lvl_enable + chmod 664 /sys/devices/platform/battery/power_supply/battery/batt_slate_mode + chown system system /sys/devices/platform/battery/power_supply/battery/batt_slate_mode + chmod 644 /sys/class/sec/switch/afc_disable + chown system system /sys/class/sec/switch/afc_disable + chmod 644 /sys/fs/selinux/enforce + chown system system /sys/fs/selinux/enforce diff --git a/universal7885-common/sepolicy/samsung_slsi/private/file_contexts b/universal7885-common/sepolicy/private/file_contexts similarity index 100% rename from universal7885-common/sepolicy/samsung_slsi/private/file_contexts rename to universal7885-common/sepolicy/private/file_contexts diff --git a/universal7885-common/sepolicy/samsung_slsi/private/property_contexts b/universal7885-common/sepolicy/private/property_contexts similarity index 100% rename from universal7885-common/sepolicy/samsung_slsi/private/property_contexts rename to universal7885-common/sepolicy/private/property_contexts diff --git a/universal7885-common/sepolicy/samsung_slsi/public/attributes b/universal7885-common/sepolicy/public/attributes similarity index 100% rename from universal7885-common/sepolicy/samsung_slsi/public/attributes rename to universal7885-common/sepolicy/public/attributes diff --git a/universal7885-common/sepolicy/samsung_slsi/public/domain.te b/universal7885-common/sepolicy/public/domain.te similarity index 100% rename from universal7885-common/sepolicy/samsung_slsi/public/domain.te rename to universal7885-common/sepolicy/public/domain.te diff --git a/universal7885-common/sepolicy/samsungparts/file.te b/universal7885-common/sepolicy/public/file.te similarity index 77% rename from universal7885-common/sepolicy/samsungparts/file.te rename to universal7885-common/sepolicy/public/file.te index 14559c8..4fb3794 100644 --- a/universal7885-common/sepolicy/samsungparts/file.te +++ b/universal7885-common/sepolicy/public/file.te @@ -1,3 +1,9 @@ +# file.te + +### DATA +type zram_data_file, file_type, data_file_type, core_data_file_type; + +## SYSFS type sysfs_gpu_tmu, sysfs_type, rw_fs_type, fs_type; type sysfs_flashlight, sysfs_type, rw_fs_type, fs_type; type sysfs_sec_switch, sysfs_type, r_fs_type, fs_type; diff --git a/universal7885-common/sepolicy/samsungparts/genfs_contexts b/universal7885-common/sepolicy/public/genfs_contexts similarity index 100% rename from universal7885-common/sepolicy/samsungparts/genfs_contexts rename to universal7885-common/sepolicy/public/genfs_contexts diff --git a/universal7885-common/sepolicy/samsungparts/init.te b/universal7885-common/sepolicy/public/init.te similarity index 50% rename from universal7885-common/sepolicy/samsungparts/init.te rename to universal7885-common/sepolicy/public/init.te index 7839bb6..6461e8f 100644 --- a/universal7885-common/sepolicy/samsungparts/init.te +++ b/universal7885-common/sepolicy/public/init.te @@ -1,4 +1,5 @@ allow init sysfs_gpu_tmu:file { setattr }; allow init sysfs_flashlight:file { setattr }; +allow init selinuxfs:file { setattr }; allow init sysfs_sec_switch_writable:file { setattr }; -allow init sysfs_battery_writeable:file { setattr }; +allow init sysfs_battery_writable:file { setattr }; repo):universal7885-common/sepolicy/public/init.te diff --git a/universal7885-common/sepolicy/samsung_slsi/public/property.te b/universal7885-common/sepolicy/public/property.te similarity index 100% rename from universal7885-common/sepolicy/samsung_slsi/public/property.te rename to universal7885-common/sepolicy/public/property.te diff --git a/universal7885-common/sepolicy/samsungparts/system_app.te b/universal7885-common/sepolicy/public/system_app.te similarity index 100% rename from universal7885-common/sepolicy/samsungparts/system_app.te rename to universal7885-common/sepolicy/public/system_app.te diff --git a/universal7885-common/sepolicy/samsung_slsi/tee/public/te_macros b/universal7885-common/sepolicy/public/te_macros similarity index 100% rename from universal7885-common/sepolicy/samsung_slsi/tee/public/te_macros rename to universal7885-common/sepolicy/public/te_macros diff --git a/universal7885-common/sepolicy/samsung_slsi/public/file.te b/universal7885-common/sepolicy/samsung_slsi/public/file.te deleted file mode 100644 index 05d43ab..0000000 --- a/universal7885-common/sepolicy/samsung_slsi/public/file.te +++ /dev/null @@ -1,4 +0,0 @@ -# file.te - -### DATA -type zram_data_file, file_type, data_file_type, core_data_file_type; diff --git a/universal7885-common/sepolicy/samsung_slsi/tee/vendor/device.te b/universal7885-common/sepolicy/samsung_slsi/tee/vendor/device.te deleted file mode 100644 index b9c83a5..0000000 --- a/universal7885-common/sepolicy/samsung_slsi/tee/vendor/device.te +++ /dev/null @@ -1,4 +0,0 @@ -# device.te - -type tz_device, dev_type; -type tz_user_device, dev_type; diff --git a/universal7885-common/sepolicy/samsung_slsi/tee/vendor/file.te b/universal7885-common/sepolicy/samsung_slsi/tee/vendor/file.te deleted file mode 100644 index 8acdd68..0000000 --- a/universal7885-common/sepolicy/samsung_slsi/tee/vendor/file.te +++ /dev/null @@ -1,7 +0,0 @@ -# file.te - -# DATA -type tee_vendor_data_file, file_type, data_file_type; - -# DEV SOCKET -type tz_socket, file_type; diff --git a/universal7885-common/sepolicy/samsung_slsi/tee/vendor/file_contexts b/universal7885-common/sepolicy/samsung_slsi/tee/vendor/file_contexts deleted file mode 100644 index f66c3c6..0000000 --- a/universal7885-common/sepolicy/samsung_slsi/tee/vendor/file_contexts +++ /dev/null @@ -1,18 +0,0 @@ -# file_contexts - -# DATA -/data/vendor/tee(/.*)? u:object_r:tee_vendor_data_file:s0 - -# DEV -/dev/socket/tz u:object_r:tz_socket:s0 -/dev/tuihw u:object_r:tz_device:s0 -/dev/tzdev u:object_r:tz_user_device:s0 -/dev/tzic u:object_r:tz_device:s0 -/dev/tzirs u:object_r:tz_device:s0 -/dev/tziwsock u:object_r:tz_user_device:s0 - -# VENDOR -/(vendor|system/vendor)/bin/tzdaemon u:object_r:tzdaemon_exec:s0 -/(vendor|system/vendor)/bin/tzts_daemon u:object_r:tztsdaemon_exec:s0 - -/(vendor|system/vendor)/lib(64)?/libteecl\.so u:object_r:same_process_hal_file:s0 diff --git a/universal7885-common/sepolicy/samsung_slsi/tee/vendor/hal_fingerprint_default.te b/universal7885-common/sepolicy/samsung_slsi/tee/vendor/hal_fingerprint_default.te deleted file mode 100644 index fcec9f8..0000000 --- a/universal7885-common/sepolicy/samsung_slsi/tee/vendor/hal_fingerprint_default.te +++ /dev/null @@ -1,3 +0,0 @@ -# hal_fingerprint_default.te - -teegris_use(hal_fingerprint_default) diff --git a/universal7885-common/sepolicy/samsung_slsi/tee/vendor/hal_gatekeeper_default.te b/universal7885-common/sepolicy/samsung_slsi/tee/vendor/hal_gatekeeper_default.te deleted file mode 100644 index 386284f..0000000 --- a/universal7885-common/sepolicy/samsung_slsi/tee/vendor/hal_gatekeeper_default.te +++ /dev/null @@ -1 +0,0 @@ -teegris_use(hal_gatekeeper_default) diff --git a/universal7885-common/sepolicy/samsung_slsi/tee/vendor/hal_keymaster_default.te b/universal7885-common/sepolicy/samsung_slsi/tee/vendor/hal_keymaster_default.te deleted file mode 100644 index 7c3e33f..0000000 --- a/universal7885-common/sepolicy/samsung_slsi/tee/vendor/hal_keymaster_default.te +++ /dev/null @@ -1 +0,0 @@ -teegris_use(hal_keymaster_default) diff --git a/universal7885-common/sepolicy/samsung_slsi/tee/vendor/property.te b/universal7885-common/sepolicy/samsung_slsi/tee/vendor/property.te deleted file mode 100644 index 231d68e..0000000 --- a/universal7885-common/sepolicy/samsung_slsi/tee/vendor/property.te +++ /dev/null @@ -1,4 +0,0 @@ -# property.te -type vendor_secureos_prop, property_type; -type vendor_tzdaemon_prop, property_type; -type vendor_tztsdaemon_prop, property_type; diff --git a/universal7885-common/sepolicy/samsung_slsi/tee/vendor/property_contexts b/universal7885-common/sepolicy/samsung_slsi/tee/vendor/property_contexts deleted file mode 100644 index 7ce7710..0000000 --- a/universal7885-common/sepolicy/samsung_slsi/tee/vendor/property_contexts +++ /dev/null @@ -1,6 +0,0 @@ -# property_contexts - -# TEEGRIS -vendor.secureos. u:object_r:vendor_secureos_prop:s0 -vendor.tzdaemon u:object_r:vendor_tzdaemon_prop:s0 -vendor.tzts_daemon u:object_r:vendor_tztsdaemon_prop:s0 diff --git a/universal7885-common/sepolicy/samsung_slsi/tee/vendor/tzdaemon.te b/universal7885-common/sepolicy/samsung_slsi/tee/vendor/tzdaemon.te deleted file mode 100644 index a600038..0000000 --- a/universal7885-common/sepolicy/samsung_slsi/tee/vendor/tzdaemon.te +++ /dev/null @@ -1,33 +0,0 @@ -type tzdaemon, domain; -type tzdaemon_exec, exec_type, vendor_file_type, file_type; - -# tzdaemon is started by init, type transit from init domain to tzdaemon domain -init_daemon_domain(tzdaemon) - -set_prop(tzdaemon, vendor_tzdaemon_prop) -set_prop(tzdaemon, vendor_secureos_prop) - -allow tzdaemon tz_device:chr_file rw_file_perms; -allow tzdaemon tz_user_device:chr_file rw_file_perms; -allow tzdaemon tz_socket:sock_file { write }; - -# /dev/kmsg -allow tzdaemon kmsg_device:chr_file rw_file_perms; - -# /data/vendor/tee -allow tzdaemon tee_vendor_data_file:dir create_dir_perms; -allow tzdaemon tee_vendor_data_file:file create_file_perms; - -# /proc/stat -allow tzdaemon proc_stat:file r_file_perms; - -# /efs -allow tzdaemon efs_file:dir r_dir_perms; - -# /efs/tee/ -# /mnt/vendor/efs/tee/ -allow tzdaemon tee_efs_file:dir create_dir_perms; -allow tzdaemon tee_efs_file:file create_file_perms; - -# /mnt/vendor/ -allow tzdaemon mnt_vendor_file:dir r_dir_perms; diff --git a/universal7885-common/sepolicy/samsung_slsi/vendor/cbd.te b/universal7885-common/sepolicy/samsung_slsi/vendor/cbd.te deleted file mode 100644 index b3fb0e1..0000000 --- a/universal7885-common/sepolicy/samsung_slsi/vendor/cbd.te +++ /dev/null @@ -1,63 +0,0 @@ -# cbd.te - -type cbd, domain; -type cbd_exec, exec_type, vendor_file_type, file_type; - -allow cbd self:capability setuid; - -# cbd is started by init, type transit from init domain to cbd domain -init_daemon_domain(cbd) - -# /dev/block/ -allow cbd block_device:dir search; - -# /data/vendor/log -allow cbd log_vendor_data_file:dir search; - -# /data/vendor/log/cbd -allow cbd log_cbd_vendor_data_file:dir create_dir_perms; -allow cbd log_cbd_vendor_data_file:file create_file_perms; - -# /dev/block/platform/.+/by-name/radio -allow cbd radio_block_device:blk_file r_file_perms; - -# /dev/kmsg -allow cbd kmsg_device:chr_file rw_file_perms; - -# /dev/umts_* -allow cbd vendor_radio_device:chr_file rw_file_perms; - -# /mnt/vendor/ -allow cbd mnt_vendor_file:dir search; - -# /mnt/vendor/efs/ -allow cbd efs_file:dir r_dir_perms; - -# /mnt/vendor/efs/factory.prop -allow cbd efs_file:file r_file_perms; - -# /mnt/vendor/efs/nv_data.bin -allow cbd bin_nv_data_efs_file:file r_file_perms; - -# /proc/cmdline -allow cbd proc_cmdline:file r_file_perms; - -# /sys/power/wake_unlock -allow cbd sysfs_wake_lock:file rw_file_perms; - -# /sys/devices/platform/10000.mif_pdata/sim/ -allow cbd sysfs_sim:dir r_dir_perms; -allow cbd sysfs_sim:file r_file_perms; - -# /sys/devices/platform/10000.mif_pdata/sim/ds_detect -allow cbd sysfs_sim_writable:file rw_file_perms; - -# kernel log -allow cbd kernel:system syslog_read; - -# vendor.cbd. -set_prop(cbd, vendor_cbd_prop) - -# FIXME: Can we be more specific? -allow cbd vendor_shell_exec:file execute_no_trans; -# FIXME END diff --git a/universal7885-common/sepolicy/samsung_slsi/vendor/device.te b/universal7885-common/sepolicy/samsung_slsi/vendor/device.te deleted file mode 100644 index 47639b2..0000000 --- a/universal7885-common/sepolicy/samsung_slsi/vendor/device.te +++ /dev/null @@ -1,22 +0,0 @@ -# device.te -type efs_block_device, dev_type; -type dqmdbg_block_device, dev_type; -type dtbo_block_device, dev_type; -type keydata_block_device, dev_type; -type keyrefuge_block_device, dev_type; -type modem_block_device, dev_type; -type omr_block_device, dev_type; -type radio_block_device, dev_type; -type sec_efs_block_device, dev_type; - -type bbd_device, dev_type; -type bt_device, dev_type; -type cpu_dma_device, dev_type; -type drb_device, dev_type; -type epic_device, dev_type; -type fp_sensor_device, dev_type; -type io_device, dev_type; -type pm_qos_device, dev_type; -type radio_qos_device, dev_type; -type ssp_device, dev_type; -type vendor_radio_device, dev_type; diff --git a/universal7885-common/sepolicy/samsung_slsi/vendor/epicd.te b/universal7885-common/sepolicy/samsung_slsi/vendor/epicd.te deleted file mode 100644 index 40aa60c..0000000 --- a/universal7885-common/sepolicy/samsung_slsi/vendor/epicd.te +++ /dev/null @@ -1,27 +0,0 @@ -type epicd, domain; -type epicd_exec, exec_type, vendor_file_type, file_type; - -# epicd is started by init, type transit from init domain to epicd domain -init_daemon_domain(epicd) - -# WTF? -# execve("/vendor/bin/sh", ["sh", "-c", "getprop ro.hardware"] -allow epicd vendor_shell_exec:file execute_no_trans; - -# WTF? -# execve("/vendor/bin/getprop", ["getprop", "ro.hardware"] -allow epicd vendor_toolbox_exec:file execute_no_trans; - -# /dev/cluster[0-9]_freq_(max|min) -# /dev/*_throughput* -# /dev/gpu_freq_(max|min) -allow epicd pm_qos_device:chr_file rw_file_perms; - -# /dev/socket/ -allow epicd socket_device:dir w_dir_perms; - -# /dev/socket/epic -allow epicd epicd_socket:unix_dgram_socket { read write }; - -# /dev/mode -allow epicd epic_device:chr_file rw_file_perms; diff --git a/universal7885-common/sepolicy/samsung_slsi/vendor/file.te b/universal7885-common/sepolicy/samsung_slsi/vendor/file.te deleted file mode 100644 index 964d946..0000000 --- a/universal7885-common/sepolicy/samsung_slsi/vendor/file.te +++ /dev/null @@ -1,63 +0,0 @@ -# file.te - -### DATA -type biometrics_vendor_data_file, file_type, data_file_type; -type conn_vendor_data_file, file_type, data_file_type; -type gps_vendor_data_file, file_type, data_file_type; -type log_vendor_data_file, file_type, data_file_type; -type log_cbd_vendor_data_file, file_type, data_file_type; -type radio_vendor_data_file, file_type, data_file_type; -type wifi_vendor_data_file, file_type, data_file_type; - -# EFS -type app_efs_file, file_type; -type battery_efs_file, file_type; -type bin_nv_data_efs_file, file_type; -type cpk_efs_file, file_type; -type imei_efs_file, file_type; -type nfc_efs_file, file_type; -type pfw_efs_file, file_type; -type prov_efs_file, file_type; -type sec_efs_file, file_type; -type tee_efs_file, file_type; -type wifi_efs_file, file_type; - -# PROC -type proc_last_kmsg, fs_type, proc_type; - -# SOCKETS -type epicd_socket, file_type, data_file_type; - -### SYSFS -type sysfs_argos, sysfs_type, r_fs_type, fs_type; -#type sysfs_battery, sysfs_type, r_fs_type, fs_type; -type sysfs_bbd, sysfs_type, r_fs_type, fs_type; -type sysfs_fingerprint, sysfs_type, r_fs_type, fs_type; -type sysfs_iio, sysfs_type, r_fs_type, fs_type; -type sysfs_input, sysfs_type, r_fs_type, fs_type; -type sysfs_sec_gps, sysfs_type, r_fs_type, fs_type; -type sysfs_sec_key, sysfs_type, r_fs_type, fs_type; -type sysfs_sec_sensors, sysfs_type, r_fs_type, fs_type; -#type sysfs_sec_switch, sysfs_type, r_fs_type, fs_type; -type sysfs_sec_touchscreen, sysfs_type, r_fs_type, fs_type; -type sysfs_sim, sysfs_type, r_fs_type, fs_type; -type sysfs_sensors, sysfs_type, r_fs_type, fs_type; -type sysfs_wifi, sysfs_type, r_fs_type, fs_type; - -type sysfs_backlight_writable, sysfs_type, rw_fs_type, fs_type; -#type sysfs_battery_writable, sysfs_type, rw_fs_type, fs_type; -type sysfs_bt_writable, sysfs_type, rw_fs_type, fs_type; -type sysfs_gps_writable, sysfs_type, rw_fs_type, fs_type; -type sysfs_lcd_writable, sysfs_type, rw_fs_type, fs_type; -type sysfs_power_writable, sysfs_type, rw_fs_type, fs_type; -type sysfs_scsi_host_writable, sysfs_type, rw_fs_type, fs_type; -type sysfs_sensorhub_writable, sysfs_type, rw_fs_type, fs_type; -type sysfs_sensors_writable, sysfs_type, rw_fs_type, fs_type; -type sysfs_sim_writable, sysfs_type, rw_fs_type, fs_type; -type sysfs_spi_writeable, sysfs_type, rw_fs_type, fs_type; -#type sysfs_sec_switch_writable, sysfs_type, rw_fs_type, fs_type; -type sysfs_touchscreen_writable, sysfs_type, rw_fs_type, fs_type; -type sysfs_wifi_writable, sysfs_type, rw_fs_type, fs_type; - -### VENDOR -type vendor_firmware_file, file_type, vendor_file_type; diff --git a/universal7885-common/sepolicy/samsung_slsi/vendor/file_contexts b/universal7885-common/sepolicy/samsung_slsi/vendor/file_contexts deleted file mode 100644 index 577db4f..0000000 --- a/universal7885-common/sepolicy/samsung_slsi/vendor/file_contexts +++ /dev/null @@ -1,126 +0,0 @@ -# file_contexts - -### DATA -/data/vendor/biometrics(/.*)? u:object_r:biometrics_vendor_data_file:s0 -/data/vendor/conn(/.*)? u:object_r:conn_vendor_data_file:s0 -/data/vendor/gps(/.*)? u:object_r:gps_vendor_data_file:s0 -/data/vendor/wifi(/.*)? u:object_r:wifi_vendor_data_file:s0 -/data/vendor/log(/.*)? u:object_r:log_vendor_data_file:s0 -/data/vendor/log/cbd(/.*)? u:object_r:log_cbd_vendor_data_file:s0 -/data/vendor/secradio(/.*)? u:object_r:radio_vendor_data_file:s0 - -### DEV -/dev/block/platform/.+/by-name/boot u:object_r:boot_block_device:s0 -/dev/block/platform/.+/by-name/cache u:object_r:cache_block_device:s0 -/dev/block/platform/.+/by-name/efs u:object_r:efs_block_device:s0 -/dev/block/platform/.+/by-name/dqmdbg u:object_r:dqmdbg_block_device:s0 -/dev/block/platform/.+/by-name/dtbo u:object_r:dtbo_block_device:s0 -/dev/block/platform/.+/by-name/keydata u:object_r:keydata_block_device:s0 -/dev/block/platform/.+/by-name/keyrefuge u:object_r:keyrefuge_block_device:s0 -/dev/block/platform/.+/by-name/metadata u:object_r:metadata_block_device:s0 -/dev/block/platform/.+/by-name/misc u:object_r:misc_block_device:s0 -/dev/block/platform/.+/by-name/modem u:object_r:modem_block_device:s0 -/dev/block/platform/.+/by-name/omr u:object_r:omr_block_device:s0 -/dev/block/platform/.+/by-name/persistent u:object_r:frp_block_device:s0 -/dev/block/platform/.+/by-name/radio u:object_r:radio_block_device:s0 -/dev/block/platform/.+/by-name/recovery u:object_r:recovery_block_device:s0 -/dev/block/platform/.+/by-name/sec_efs u:object_r:sec_efs_block_device:s0 -/dev/block/platform/.+/by-name/super u:object_r:super_block_device:s0 -/dev/block/platform/.+/by-name/userdata u:object_r:userdata_block_device:s0 - -/dev/esfp[0-9] u:object_r:fp_sensor_device:s0 -/dev/batch_io u:object_r:io_device:s0 -/dev/ssp_sensorhub u:object_r:ssp_device:s0 - -# bluetooth -/dev/ttySAC[0-9] u:object_r:bt_device:s0 - -# cpu -/dev/cpu_dma_latency u:object_r:cpu_dma_device:s0 - -### epic -/dev/mode u:object_r:epic_device:s0 -/dev/socket/epic u:object_r:epicd_socket:s0 - -### gnss/gps -/dev/bbd_control u:object_r:bbd_device:s0 -/dev/bbd_packet u:object_r:bbd_device:s0 -/dev/bbd_patch u:object_r:bbd_device:s0 -/dev/bbd_reliable u:object_r:bbd_device:s0 -/dev/bbd_sensor u:object_r:bbd_device:s0 -/dev/bbd_sio u:object_r:bbd_device:s0 -/dev/bbd_urgent_patch u:object_r:bbd_device:s0 -/dev/ttyBCM[0-9]* u:object_r:bbd_device:s0 - -### qos -/dev/bus_throughput u:object_r:pm_qos_device:s0 -/dev/bus_throughput_max u:object_r:pm_qos_device:s0 -/dev/cluster0_freq_max u:object_r:pm_qos_device:s0 -/dev/cluster0_freq_min u:object_r:pm_qos_device:s0 -/dev/cluster1_freq_max u:object_r:pm_qos_device:s0 -/dev/cluster1_freq_min u:object_r:pm_qos_device:s0 -/dev/cluster2_freq_max u:object_r:pm_qos_device:s0 -/dev/cluster2_freq_min u:object_r:pm_qos_device:s0 -/dev/cpu_online_max u:object_r:pm_qos_device:s0 -/dev/cpu_online_min u:object_r:pm_qos_device:s0 -/dev/device_throughput u:object_r:pm_qos_device:s0 -/dev/device_throughput_max u:object_r:pm_qos_device:s0 -/dev/gpu_freq_max u:object_r:pm_qos_device:s0 -/dev/gpu_freq_min u:object_r:pm_qos_device:s0 -/dev/mfc_throughput u:object_r:pm_qos_device:s0 -/dev/mfc_throughput_max u:object_r:pm_qos_device:s0 -/dev/network_throughput u:object_r:radio_qos_device:s0 -/dev/npu_throughput u:object_r:pm_qos_device:s0 -/dev/npu_throughput_max u:object_r:pm_qos_device:s0 - -### radio -# DRB -/dev/drb u:object_r:drb_device:s0 - -# UMTS -/dev/umts_boot0 u:object_r:vendor_radio_device:s0 -/dev/umts_cass u:object_r:vendor_radio_device:s0 -/dev/umts_ipc[0-1] u:object_r:vendor_radio_device:s0 -/dev/umts_dm0 u:object_r:vendor_radio_device:s0 -/dev/umts_rfs0 u:object_r:vendor_radio_device:s0 -/dev/umts_router u:object_r:vendor_radio_device:s0 - -### EFS -/efs/Battery(/.*)? u:object_r:battery_efs_file:s0 -/efs/DAK(/.*)? u:object_r:prov_efs_file:s0 -/efs/afc(/.*)? u:object_r:sec_efs_file:s0 -/efs/bluetooth(/.*)? u:object_r:bluetooth_efs_file:s0 -/efs/cpk(/.*)? u:object_r:cpk_efs_file:s0 -/efs/imei(/.*)? u:object_r:imei_efs_file:s0 -/efs/nfc(/.*)? u:object_r:nfc_efs_file:s0 -/efs/nv_data\.bin(.*) u:object_r:bin_nv_data_efs_file:s0 -/efs/pfw_data(/.*)? u:object_r:pfw_efs_file:s0 -/efs/prov(/.*)? u:object_r:prov_efs_file:s0 -/efs/prov_data(/.*)? u:object_r:prov_efs_file:s0 -/efs/root(/.*)? u:object_r:app_efs_file:s0 -/efs/tee(/.*)? u:object_r:tee_efs_file:s0 -/efs/wifi(/.*)? u:object_r:wifi_efs_file:s0 - -/mnt/vendor/efs(/.*)? u:object_r:efs_file:s0 -/mnt/vendor/efs/DAK(/.*)? u:object_r:prov_efs_file:s0 -/mnt/vendor/efs/afc(/.*)? u:object_r:sec_efs_file:s0 -/mnt/vendor/efs/bluetooth(/.*)? u:object_r:bluetooth_efs_file:s0 -/mnt/vendor/efs/cpk(/.*)? u:object_r:cpk_efs_file:s0 -/mnt/vendor/efs/imei(/.*)? u:object_r:imei_efs_file:s0 -/mnt/vendor/efs/nv_data\.bin(.*) u:object_r:bin_nv_data_efs_file:s0 -/mnt/vendor/efs/pfw_data(/.*)? u:object_r:pfw_efs_file:s0 -/mnt/vendor/efs/prov(/.*)? u:object_r:prov_efs_file:s0 -/mnt/vendor/efs/prov_data(/.*)? u:object_r:prov_efs_file:s0 -/mnt/vendor/efs/root(/.*)? u:object_r:app_efs_file:s0 -/mnt/vendor/efs/tee(/.*)? u:object_r:tee_efs_file:s0 -/mnt/vendor/efs/wifi(/.*)? u:object_r:wifi_efs_file:s0 - -### VENDOR -/(vendor|system/vendor)/bin/cbd u:object_r:cbd_exec:s0 -/(vendor|system/vendor)/bin/secril_config_svc u:object_r:secril_config_svc_exec:s0 - -/(vendor|system/vendor)/bin/hw/android\.hardware\.biometrics\.fingerprint@[0-9].[0-9]-service\.samsung u:object_r:hal_fingerprint_default_exec:s0 -/(vendor|system/vendor)/bin/hw/android\.hardware\.light@[0-9].[0-9]-service\.samsung u:object_r:hal_light_default_exec:s0 -/(vendor|system/vendor)/bin/hw/android\.hardware\.thermal@[0-9].[0-9]-service\.samsung u:object_r:hal_thermal_default_exec:s0 - -/(vendor|system/vendor)/firmware(/.*)? u:object_r:vendor_firmware_file:s0 diff --git a/universal7885-common/sepolicy/samsung_slsi/vendor/genfs_contexts b/universal7885-common/sepolicy/samsung_slsi/vendor/genfs_contexts deleted file mode 100644 index b051a52..0000000 --- a/universal7885-common/sepolicy/samsung_slsi/vendor/genfs_contexts +++ /dev/null @@ -1,64 +0,0 @@ -# genfs_contexts - -### PROC -genfscon proc /last_kmsg u:object_r:proc_last_kmsg:s0 - -### SYSFS -genfscon sysfs /bbd u:object_r:sysfs_bbd:s0 - -genfscon sysfs /bus/iio/devices u:object_r:sysfs_iio:s0 - -genfscon sysfs /class/backlight/ u:object_r:sysfs_backlight_writable:s0 -genfscon sysfs /class/fingerprint/fingerprint u:object_r:sysfs_fingerprint:s0 -genfscon sysfs /class/input u:object_r:sysfs_input:s0 -genfscon sysfs /class/power_supply u:object_r:sysfs_battery:s0 -genfscon sysfs /class/rtc/rtc0 u:object_r:sysfs_rtc:s0 -genfscon sysfs /class/sec/gps u:object_r:sysfs_sec_gps:s0 -genfscon sysfs /class/sec/sensors u:object_r:sysfs_sec_sensors:s0 -genfscon sysfs /class/sec/tsp u:object_r:sysfs_sec_touchscreen:s0 -genfscon sysfs /class/sensor_event u:object_r:sysfs_sensors:s0 -genfscon sysfs /class/sensors u:object_r:sysfs_sensors:s0 -genfscon sysfs /class/thermal u:object_r:sysfs_thermal:s0 -genfscon sysfs /class/timed_output/vibrator/intensity u:object_r:sysfs_vibrator:s0 -genfscon sysfs /class/timed_output/vibrator/multi_freq u:object_r:sysfs_vibrator:s0 - -genfscon sysfs /devices/platform/argos u:object_r:sysfs_argos:s0 -genfscon sysfs /devices/platform/battery/power_supply u:object_r:sysfs_battery:s0 -genfscon sysfs /devices/platform/battery/power_supply/battery/lcd u:object_r:sysfs_battery_writable:s0 -genfscon sysfs /devices/platform/panel@0/backlight/panel/brightness u:object_r:sysfs_backlight_writable:s0 -genfscon sysfs /devices/platform/panel@0/backlight/panel/max_brightness u:object_r:sysfs_backlight_writable:s0 -genfscon sysfs /devices/platform/panel@0/lcd/panel u:object_r:sysfs_lcd_writable:s0 - -genfscon sysfs /devices/virtual/fingerprint/fingerprint u:object_r:sysfs_fingerprint:s0 -genfscon sysfs /devices/virtual/input u:object_r:sysfs_input:s0 -genfscon sysfs /devices/virtual/lcd/panel u:object_r:sysfs_lcd_writable:s0 -genfscon sysfs /devices/virtual/sec/gps u:object_r:sysfs_sec_gps:s0 -genfscon sysfs /devices/virtual/sec/sec_key u:object_r:sysfs_sec_key:s0 -genfscon sysfs /devices/virtual/sec/tsp u:object_r:sysfs_sec_touchscreen:s0 -genfscon sysfs /devices/virtual/sec/tsp/cmd u:object_r:sysfs_touchscreen_writable:s0 -genfscon sysfs /devices/virtual/sec/tsp/ear_detect_enable u:object_r:sysfs_touchscreen_writable:s0 -genfscon sysfs /devices/virtual/sec/tsp/prox_power_off u:object_r:sysfs_touchscreen_writable:s0 -genfscon sysfs /devices/virtual/sec/tsp/input/enabled u:object_r:sysfs_touchscreen_writable:s0 -genfscon sysfs /devices/virtual/sensor_event u:object_r:sysfs_sensors:s0 -genfscon sysfs /devices/virtual/sensors u:object_r:sysfs_sensors:s0 -genfscon sysfs /devices/virtual/sensors/hidden_hole/hh_check_coef u:object_r:sysfs_sensors_writable:s0 -genfscon sysfs /devices/virtual/sensors/ssp_sensor/enable u:object_r:sysfs_sensors_writable:s0 -genfscon sysfs /devices/virtual/sensors/ssp_sensor/ssp_flush u:object_r:sysfs_sensors_writable:s0 -genfscon sysfs /devices/virtual/sec/switch u:object_r:sysfs_sec_switch:s0 -genfscon sysfs /devices/virtual/sec/switch/afc_disable u:object_r:sysfs_sec_switch_writable:s0 -genfscon sysfs /devices/virtual/thermal u:object_r:sysfs_thermal:s0 -genfscon sysfs /devices/virtual/timed_output/vibrator/cp_trigger_index u:object_r:sysfs_vibrator:s0 -genfscon sysfs /devices/virtual/timed_output/vibrator/intensity u:object_r:sysfs_vibrator:s0 -genfscon sysfs /devices/virtual/timed_output/vibrator/multi_freq u:object_r:sysfs_vibrator:s0 - -genfscon sysfs /module/dhd/parameters u:object_r:sysfs_wifi_writable:s0 - -genfscon sysfs /power/cpufreq_max_limit u:object_r:sysfs_power_writable:s0 -genfscon sysfs /power/cpufreq_min_limit u:object_r:sysfs_power_writable:s0 -genfscon sysfs /power/cpuhotplug/max_online_cpu u:object_r:sysfs_power_writable:s0 -genfscon sysfs /power/rtc_status u:object_r:sysfs_power_writable:s0 - -genfscon sysfs /wifi u:object_r:sysfs_wifi:s0 -genfscon sysfs /wifi/cid u:object_r:sysfs_wifi_writable:s0 -genfscon sysfs /wifi/mac_addr u:object_r:sysfs_wifi_writable:s0 -genfscon sysfs /wifi/memdump u:object_r:sysfs_wifi_writable:s0 diff --git a/universal7885-common/sepolicy/samsung_slsi/vendor/gpsd.te b/universal7885-common/sepolicy/samsung_slsi/vendor/gpsd.te deleted file mode 100644 index 6e89239..0000000 --- a/universal7885-common/sepolicy/samsung_slsi/vendor/gpsd.te +++ /dev/null @@ -1,37 +0,0 @@ -type gpsd, domain, netdomain; -type gpsd_exec, exec_type, vendor_file_type, file_type; - -# gpsd is started by init, type transit from init domain to gpsd domain -init_daemon_domain(gpsd) - -allow gpsd rild:unix_stream_socket connectto; - -get_prop(gpsd, vendor_radio_prop) -get_prop(gpsd, telephony_config_prop) -get_prop(gpsd, exported_config_prop) - -get_prop(gpsd, hwservicemanager_prop) -hwbinder_use(gpsd) -allow gpsd system_suspend_hwservice:hwservice_manager { find }; -allow gpsd fwk_sensor_hwservice:hwservice_manager { find }; - -binder_call(gpsd, system_suspend_server) -binder_call(gpsd, system_server) -binder_call(system_server, gpsd) - -allow gpsd self:netlink_kobject_uevent_socket create_socket_perms_no_ioctl; -allow gpsd self:{ tcp_socket udp_socket } create_stream_socket_perms; -allow gpsd port:tcp_socket { name_bind name_connect }; -allow gpsd port:udp_socket name_bind; -allow gpsd node:{ tcp_socket udp_socket } node_bind; - -# /acct/tasks -allow gpsd cgroup:file getattr; - -# /dev/socket/fwmarkd -allow gpsd fwmarkd_socket:sock_file write; - -# /data/vendor/gps -allow gpsd gps_vendor_data_file:dir rw_dir_perms; -allow gpsd gps_vendor_data_file:file create_file_perms; -allow gpsd gps_vendor_data_file:fifo_file create_file_perms; diff --git a/universal7885-common/sepolicy/samsung_slsi/vendor/hal_bluetooth_default.te b/universal7885-common/sepolicy/samsung_slsi/vendor/hal_bluetooth_default.te deleted file mode 100644 index d04de81..0000000 --- a/universal7885-common/sepolicy/samsung_slsi/vendor/hal_bluetooth_default.te +++ /dev/null @@ -1,24 +0,0 @@ -# hal_bluetooth_default.te - -# ro.rfkilldisabled -get_prop(hal_bluetooth_default, rfkilldisabled_prop) -# vendor.bluetooth_fw_ver -set_prop(hal_bluetooth_default, wifi_log_prop) -# sys.bluetooth.tty -set_prop(hal_bluetooth_default, exported_bluetooth_prop) - -# /dev/ttySAC[0-9] -allow hal_bluetooth_default bt_device:chr_file rw_file_perms; - -# /mnt/vendor -allow hal_bluetooth_default mnt_vendor_file:dir search; - -# /mnt/vendor/efs/ -allow hal_bluetooth_default efs_file:dir r_dir_perms; - -# /mnt/vendor/conn -allow hal_bluetooth_default conn_vendor_data_file:dir r_dir_perms; -allow hal_bluetooth_default conn_vendor_data_file:file r_file_perms; - -# /sys/devices/platform/bluetooth/rfkill/rfkill0/state -allow hal_bluetooth_default sysfs_bt_writable:file rw_file_perms; diff --git a/universal7885-common/sepolicy/samsung_slsi/vendor/hal_fingerprint_default.te b/universal7885-common/sepolicy/samsung_slsi/vendor/hal_fingerprint_default.te deleted file mode 100644 index cce1395..0000000 --- a/universal7885-common/sepolicy/samsung_slsi/vendor/hal_fingerprint_default.te +++ /dev/null @@ -1,14 +0,0 @@ -# hal_fingerprint_default.te - -# /dev/esfp[0-9] -allow hal_fingerprint_default fp_sensor_device:chr_file rw_file_perms; - -# /data/vendor/ -> biometrics -file_type_auto_trans(hal_fingerprint_default, vendor_data_file, biometrics_vendor_data_file) - -# /data/vendor/biometrics/* -allow hal_fingerprint_default biometrics_vendor_data_file:file create_file_perms; - -# /sys/class/fingerprint/ -allow hal_fingerprint_default sysfs_fingerprint:dir r_dir_perms; -allow hal_fingerprint_default sysfs_fingerprint:file r_file_perms; diff --git a/universal7885-common/sepolicy/samsung_slsi/vendor/hal_gnss_default.te b/universal7885-common/sepolicy/samsung_slsi/vendor/hal_gnss_default.te deleted file mode 100644 index 5911960..0000000 --- a/universal7885-common/sepolicy/samsung_slsi/vendor/hal_gnss_default.te +++ /dev/null @@ -1,12 +0,0 @@ -# hal_gnss_default.te - -# cgroups tasks -allow hal_gnss_default cgroup:file getattr; - -# /data/vendor/gps -allow hal_gnss_default gps_vendor_data_file:dir rw_dir_perms; -allow hal_gnss_default gps_vendor_data_file:file create_file_perms; -allow hal_gnss_default gps_vendor_data_file:fifo_file create_file_perms; - -# /mnt/vendor -allow hal_gnss_default mnt_vendor_file:dir search; diff --git a/universal7885-common/sepolicy/samsung_slsi/vendor/hal_keymaster_default.te b/universal7885-common/sepolicy/samsung_slsi/vendor/hal_keymaster_default.te deleted file mode 100644 index 1d91a5d..0000000 --- a/universal7885-common/sepolicy/samsung_slsi/vendor/hal_keymaster_default.te +++ /dev/null @@ -1,7 +0,0 @@ -# hal_keymaster_default - -# /mnt/vendor -allow hal_keymaster_default mnt_vendor_file:dir search; - -# /mnt/vendor/efs -allow hal_keymaster_default efs_file:dir search; diff --git a/universal7885-common/sepolicy/samsung_slsi/vendor/hal_light_default.te b/universal7885-common/sepolicy/samsung_slsi/vendor/hal_light_default.te deleted file mode 100644 index dab24d3..0000000 --- a/universal7885-common/sepolicy/samsung_slsi/vendor/hal_light_default.te +++ /dev/null @@ -1,5 +0,0 @@ -# hal_light_default.te - -# /sys/devices/platform/panel@0/backlight/panel/brightness -# /sys/devices/platform/panel@0/backlight/panel/max_brightness -allow hal_light_default sysfs_backlight_writable:file rw_file_perms; diff --git a/universal7885-common/sepolicy/samsung_slsi/vendor/hal_power_default.te b/universal7885-common/sepolicy/samsung_slsi/vendor/hal_power_default.te deleted file mode 100644 index cd4df7d..0000000 --- a/universal7885-common/sepolicy/samsung_slsi/vendor/hal_power_default.te +++ /dev/null @@ -1,25 +0,0 @@ -# hal_power_default.te - -# /dev/cpu_dma_latency -allow hal_power_default cpu_dma_device:chr_file rw_file_perms; - -# /dev/stune/top-app/schedtune.boost -allow hal_power_default cgroup:file rw_file_perms; - -# /sys/class/input/ -allow hal_power_default sysfs_input:dir r_dir_perms; - -# /sys/class/power/ -allow hal_power_default sysfs_power:dir r_dir_perms; -allow hal_power_default sysfs_power:file r_file_perms; -allow hal_power_default sysfs_power_writable:file rw_file_perms; - -# /sys/class/sec/tsp/input/ -allow hal_power_default sysfs_sec_touchscreen:dir r_dir_perms; -allow hal_power_default sysfs_sec_touchscreen:lnk_file r_file_perms; - -# /sys/class/sec/tsp/input/{cmd,enabled} -allow hal_power_default sysfs_touchscreen_writable:file rw_file_perms; - -# /sys/devices/system/cpu/cpu[0-9]/cpufreq/scaling_max_freq -allow hal_power_default sysfs_devices_system_cpu:file rw_file_perms; diff --git a/universal7885-common/sepolicy/samsung_slsi/vendor/hal_sensors_default.te b/universal7885-common/sepolicy/samsung_slsi/vendor/hal_sensors_default.te deleted file mode 100644 index 0c2cbef..0000000 --- a/universal7885-common/sepolicy/samsung_slsi/vendor/hal_sensors_default.te +++ /dev/null @@ -1,62 +0,0 @@ -# hal_sensors_default.te - -# /dev/batch_io -allow hal_sensors_default io_device:chr_file r_file_perms; - -# /dev/iio:device1 -allow hal_sensors_default iio_device:chr_file r_file_perms; - -# /dev/ssp_sensorhub -allow hal_sensors_default ssp_device:chr_file rw_file_perms; - -# /efs -allow hal_sensors_default efs_file:dir r_dir_perms; - -# /efs/FactoryApp/ -allow hal_sensors_default app_efs_file:dir rw_dir_perms; -allow hal_sensors_default app_efs_file:file { setattr rw_file_perms }; - -# /sys/bus/iio/devices -allow hal_sensors_default sysfs_iio:dir r_dir_perms; -allow hal_sensors_default sysfs_iio:file r_file_perms; - -# /sys/class/sec/sensors -allow hal_sensors_default sysfs_sec_sensors:dir r_dir_perms; -allow hal_sensors_default sysfs_sec_sensors:file r_file_perms; - -# /sys/class/sensors/ssp_sensor/enable -allow hal_sensors_default sysfs_sensors_writable:dir r_dir_perms; -allow hal_sensors_default sysfs_sensors_writable:file rw_file_perms; - -# /sys/devices/platform/10970000.spi/ -allow hal_sensors_default sysfs_spi_writeable:dir r_dir_perms; -allow hal_sensors_default sysfs_spi_writeable:file rw_file_perms; - -# /sys/devices/platform/panel@0/lcd/panel/window_type -allow hal_sensors_default sysfs_lcd_writable:dir r_dir_perms; -allow hal_sensors_default sysfs_lcd_writable:file r_file_perms; - -# /sys/class/input -allow hal_sensors_default sysfs_input:dir r_dir_perms; - -# /sys/devices/virtual/input/input4 -# /sys/devices/virtual/input/input6 -allow hal_sensors_default sysfs_sensors:dir r_dir_perms; -allow hal_sensors_default sysfs_sensors:file r_file_perms; - -# /sys/devices/virtual/sensors/magnetic_sensor/vendor -allow hal_sensors_default sysfs_sensors:dir r_dir_perms; -allow hal_sensors_default sysfs_sensors:file r_file_perms; - -# /sys/devices/virtual/sec/sec_key/hall_detect -allow hal_sensors_default sysfs_sec_key:dir r_dir_perms; -allow hal_sensors_default sysfs_sec_key:file r_file_perms; - -# /sys/class/sec/tsp/ -allow hal_sensors_default sysfs_sec_touchscreen:dir r_dir_perms; -allow hal_sensors_default sysfs_sec_touchscreen:file r_file_perms; -allow hal_sensors_default sysfs_sec_touchscreen:lnk_file r_file_perms; - -# /sys/class/sec/tsp/ear_detect_enable -# /sys/class/sec/tsp/cmd -allow hal_sensors_default sysfs_touchscreen_writable:file rw_file_perms; diff --git a/universal7885-common/sepolicy/samsung_slsi/vendor/hal_thermal_default.te b/universal7885-common/sepolicy/samsung_slsi/vendor/hal_thermal_default.te deleted file mode 100644 index 7cd9ba0..0000000 --- a/universal7885-common/sepolicy/samsung_slsi/vendor/hal_thermal_default.te +++ /dev/null @@ -1,8 +0,0 @@ -# hal_thermal_default.te - -# /acct/tasks -allow hal_thermal_default cgroup:file getattr; - -# /sys/devices/virtual/thermal/ -allow hal_thermal_default sysfs_thermal:dir r_dir_perms; -allow hal_thermal_default sysfs_thermal:file r_file_perms; diff --git a/universal7885-common/sepolicy/samsung_slsi/vendor/hal_wifi_hostapd_default.te b/universal7885-common/sepolicy/samsung_slsi/vendor/hal_wifi_hostapd_default.te deleted file mode 100644 index fc048fd..0000000 --- a/universal7885-common/sepolicy/samsung_slsi/vendor/hal_wifi_hostapd_default.te +++ /dev/null @@ -1,4 +0,0 @@ -# hal_wifi_hostapd_default.te - -# /data/vendor/wifi/hostapd/hostapd_wlan0.conf -r_dir_file(hal_wifi_hostapd_default, wifi_vendor_data_file) diff --git a/universal7885-common/sepolicy/samsung_slsi/vendor/init.te b/universal7885-common/sepolicy/samsung_slsi/vendor/init.te deleted file mode 100644 index 490913e..0000000 --- a/universal7885-common/sepolicy/samsung_slsi/vendor/init.te +++ /dev/null @@ -1,3 +0,0 @@ -# init.te - -allow init proc_last_kmsg:file setattr; diff --git a/universal7885-common/sepolicy/samsung_slsi/vendor/kernel.te b/universal7885-common/sepolicy/samsung_slsi/vendor/kernel.te deleted file mode 100644 index b016aad..0000000 --- a/universal7885-common/sepolicy/samsung_slsi/vendor/kernel.te +++ /dev/null @@ -1,5 +0,0 @@ -# kernel.te - -# /vendor/firmware/ -allow kernel vendor_firmware_file:dir r_dir_perms; -allow kernel vendor_firmware_file:file r_file_perms; diff --git a/universal7885-common/sepolicy/samsung_slsi/vendor/macloader.te b/universal7885-common/sepolicy/samsung_slsi/vendor/macloader.te deleted file mode 100644 index d1f3d0c..0000000 --- a/universal7885-common/sepolicy/samsung_slsi/vendor/macloader.te +++ /dev/null @@ -1,40 +0,0 @@ -# macloader.te - -type macloader, domain; -type macloader_exec, exec_type, vendor_file_type, file_type; - -# macloader is started by init, type transit from init domain to macloader domain -init_daemon_domain(macloader) - -set_prop(macloader, vendor_wifi_prop); - -allow macloader self:capability { net_admin }; - -allow macloader self:udp_socket create_socket_perms; -allowxperm macloader self:udp_socket ioctl { 0x8913 0x8914 }; - -# /data/vendor/conn -allow macloader conn_vendor_data_file:dir rw_dir_perms; -allow macloader conn_vendor_data_file:file create_file_perms; - -# /mnt/vendor -allow macloader mnt_vendor_file:dir search; - -# /mnt/vendor/efs -allow macloader efs_file:dir rw_dir_perms; - -# /mnt/vendor/efs/wifi -allow macloader wifi_efs_file:dir rw_dir_perms; -allow macloader wifi_efs_file:file rw_file_perms; - -# /sys/class/net -allow macloader sysfs_net:dir r_dir_perms; -allow macloader sysfs_net:file r_file_perms; - -# /sys/module/dhd/parameters/firmware_path -allow macloader sysfs_wifi_writable:dir r_dir_perms; -allow macloader sysfs_wifi_writable:file rw_file_perms; - -# /sys/wifi -allow macloader sysfs_wifi:dir r_dir_perms; -allow macloader sysfs_wifi:file r_file_perms; diff --git a/universal7885-common/sepolicy/samsung_slsi/vendor/property.te b/universal7885-common/sepolicy/samsung_slsi/vendor/property.te deleted file mode 100644 index 98639bd..0000000 --- a/universal7885-common/sepolicy/samsung_slsi/vendor/property.te +++ /dev/null @@ -1,6 +0,0 @@ -# property.te - -type vendor_cbd_prop, property_type; -type vendor_radio_prop, property_type; -type vendor_fastcharge_prop, property_type; -type vendor_wifi_prop, property_type; diff --git a/universal7885-common/sepolicy/samsung_slsi/vendor/property_contexts b/universal7885-common/sepolicy/samsung_slsi/vendor/property_contexts deleted file mode 100644 index 039d872..0000000 --- a/universal7885-common/sepolicy/samsung_slsi/vendor/property_contexts +++ /dev/null @@ -1,13 +0,0 @@ -### cbd -vendor.cbd. u:object_r:vendor_cbd_prop:s0 -persist.vendor.cbd. u:object_r:vendor_radio_prop:s0 - -### radio -ro.multisim. u:object_r:vendor_radio_prop:s0 -ro.vendor.multisim. u:object_r:vendor_radio_prop:s0 -ro.vendor.radio. u:object_r:vendor_radio_prop:s0 - -### wifi -vendor.wifi. u:object_r:vendor_wifi_prop:s0 -ro.vendor.wifi. u:object_r:vendor_wifi_prop:s0 - diff --git a/universal7885-common/sepolicy/samsung_slsi/vendor/rild.te b/universal7885-common/sepolicy/samsung_slsi/vendor/rild.te deleted file mode 100644 index 6bfdc95..0000000 --- a/universal7885-common/sepolicy/samsung_slsi/vendor/rild.te +++ /dev/null @@ -1,68 +0,0 @@ -# rild.te - -get_prop(rild, vendor_radio_prop) - -allow rild block_device:dir search; -allow rild mnt_vendor_file:dir { getattr search }; - -# audio hal -allow rild hal_audio_default:dir search; -allow rild hal_audio_default:file r_file_perms; - -# gps -allow rild gpsd:dir search; -allow rild gpsd:file r_file_perms; - -# /data -allow rild system_data_file:dir getattr; - -# /data/vendor/log -allow rild log_vendor_data_file:dir rw_dir_perms; -allow rild log_vendor_data_file:file create_file_perms; - -# /dev/block/platform/.+/by-name/radio -allow rild radio_block_device:blk_file r_file_perms; - -# /dev/drb -allow rild drb_device:chr_file rw_file_perms; - -# /dev/umts_* -# /dev/umts_ipc* -allow rild vendor_radio_device:chr_file rw_file_perms; - -# /data/vendor/secradio -allow rild radio_vendor_data_file:dir rw_dir_perms; -allow rild radio_vendor_data_file:file create_file_perms; - -# /efs/FactoryApp/ -# /mnt/vendor/efs/root -allow rild app_efs_file:dir r_dir_perms; -allow rild app_efs_file:file { rw_file_perms setattr }; - -# /efs/imei -allow rild imei_efs_file:dir r_dir_perms; -allow rild imei_efs_file:file r_file_perms; - -# /mnt/vendor/efs/ -allow rild prov_efs_file:dir r_dir_perms; -allow rild prov_efs_file:file r_file_perms; - -# /mnt/vendor/efs/nv_data.bin -allow rild bin_nv_data_efs_file:file { rw_file_perms setattr unlink }; - -# /proc/net/xt_qtaguid/iface_stat_fmt -allow rild proc_qtaguid_stat:file r_file_perms; - -# /proc/sys/net/ipv6/conf/*/accept_ra_defrtr -allow rild proc_net:file rw_file_perms; - -# mdc. -# persist.sys.omc_support -# ro.csc. -get_prop(rild, exported_config_prop); - -# ro.boot.cpboot, ril.NwNmId[0-9] -get_prop(rild, telephony_config_prop) - -# vendor.cbd. -set_prop(rild, vendor_cbd_prop) diff --git a/universal7885-common/sepolicy/samsung_slsi/vendor/secril_config_svc.te b/universal7885-common/sepolicy/samsung_slsi/vendor/secril_config_svc.te deleted file mode 100644 index 3b83705..0000000 --- a/universal7885-common/sepolicy/samsung_slsi/vendor/secril_config_svc.te +++ /dev/null @@ -1,20 +0,0 @@ -# secril_config_svc.te - -type secril_config_svc, domain; -type secril_config_svc_exec, exec_type, vendor_file_type, file_type; - -# secril_config_svc is started by init, type transit from init domain to secril_config_svc domain -init_daemon_domain(secril_config_svc) - -# /mnt/vendor/ -allow secril_config_svc mnt_vendor_file:dir search; - -# /mnt/vendor/efs/factory.prop -# /mnt/vendor/efs/telephony.prop -allow secril_config_svc efs_file:dir search; -allow secril_config_svc efs_file:file r_file_perms; - -# ro.multisim. -# ro.vendor.multisim. -# ro.vendor.radio.default_network -set_prop(secril_config_svc, vendor_radio_prop) diff --git a/universal7885-common/sepolicy/samsung_slsi/vendor/system_server.te b/universal7885-common/sepolicy/samsung_slsi/vendor/system_server.te deleted file mode 100644 index 2bae9a7..0000000 --- a/universal7885-common/sepolicy/samsung_slsi/vendor/system_server.te +++ /dev/null @@ -1,3 +0,0 @@ -# system_server.te - -allow system_server proc_last_kmsg:file r_file_perms; diff --git a/universal7885-common/sepolicy/samsung_slsi/vendor/argosd.te b/universal7885-common/sepolicy/vendor/argosd.te similarity index 100% rename from universal7885-common/sepolicy/samsung_slsi/vendor/argosd.te rename to universal7885-common/sepolicy/vendor/argosd.te diff --git a/universal7885-common/sepolicy/vendor/cbd.te b/universal7885-common/sepolicy/vendor/cbd.te index f1e3d01..4b34374 100644 --- a/universal7885-common/sepolicy/vendor/cbd.te +++ b/universal7885-common/sepolicy/vendor/cbd.te @@ -1,2 +1,65 @@ +# cbd.te + +type cbd, domain; +type cbd_exec, exec_type, vendor_file_type, file_type; + +allow cbd self:capability setuid; + +# cbd is started by init, type transit from init domain to cbd domain +init_daemon_domain(cbd) + +# /dev/block/ +allow cbd block_device:dir search; + +# /data/vendor/log +allow cbd log_vendor_data_file:dir search; + +# /data/vendor/log/cbd +allow cbd log_cbd_vendor_data_file:dir create_dir_perms; +allow cbd log_cbd_vendor_data_file:file create_file_perms; + +# /dev/block/platform/.+/by-name/radio +allow cbd radio_block_device:blk_file r_file_perms; + +# /dev/kmsg +allow cbd kmsg_device:chr_file rw_file_perms; + +# /dev/umts_* +allow cbd vendor_radio_device:chr_file rw_file_perms; + +# /mnt/vendor/ +allow cbd mnt_vendor_file:dir search; + +# /mnt/vendor/efs/ +allow cbd efs_file:dir r_dir_perms; + +# /mnt/vendor/efs/factory.prop +allow cbd efs_file:file r_file_perms; + +# /mnt/vendor/efs/nv_data.bin +allow cbd bin_nv_data_efs_file:file r_file_perms; + +# /proc/cmdline +allow cbd proc_cmdline:file r_file_perms; + +# /sys/power/wake_unlock +allow cbd sysfs_wake_lock:file rw_file_perms; + +# /sys/devices/platform/10000.mif_pdata/sim/ +allow cbd sysfs_sim:dir r_dir_perms; +allow cbd sysfs_sim:file r_file_perms; + +# /sys/devices/platform/10000.mif_pdata/sim/ds_detect +allow cbd sysfs_sim_writable:file rw_file_perms; + +# kernel log +allow cbd kernel:system syslog_read; + +# vendor.cbd. +set_prop(cbd, vendor_cbd_prop) + +# FIXME: Can we be more specific? +allow cbd vendor_shell_exec:file execute_no_trans; +# FIXME END allow cbd factoryprop_efs_file:file r_file_perms; allow cbd sysfs_info:file r_file_perms; diff --git a/universal7885-common/sepolicy/vendor/device.te b/universal7885-common/sepolicy/vendor/device.te index fcea880..b891d94 100644 --- a/universal7885-common/sepolicy/vendor/device.te +++ b/universal7885-common/sepolicy/vendor/device.te @@ -1,3 +1,7 @@ +# device.te + +type tz_device, dev_type; +type tz_user_device, dev_type; # /dev/m2m1shot_scaler0 type m2m1shot_device, dev_type; @@ -6,3 +10,26 @@ type gps_device, dev_type; # /dev/goodix_fp type goodix_device, dev_type; + +# device.te +type efs_block_device, dev_type; +type dqmdbg_block_device, dev_type; +type dtbo_block_device, dev_type; +type keydata_block_device, dev_type; +type keyrefuge_block_device, dev_type; +type modem_block_device, dev_type; +type omr_block_device, dev_type; +type radio_block_device, dev_type; +type sec_efs_block_device, dev_type; + +type bbd_device, dev_type; +type bt_device, dev_type; +type cpu_dma_device, dev_type; +type drb_device, dev_type; +type epic_device, dev_type; +type fp_sensor_device, dev_type; +type io_device, dev_type; +type pm_qos_device, dev_type; +type radio_qos_device, dev_type; +type ssp_device, dev_type; +type vendor_radio_device, dev_type; diff --git a/universal7885-common/sepolicy/samsung_slsi/vendor/fastbootd.te b/universal7885-common/sepolicy/vendor/fastbootd.te similarity index 100% rename from universal7885-common/sepolicy/samsung_slsi/vendor/fastbootd.te rename to universal7885-common/sepolicy/vendor/fastbootd.te diff --git a/universal7885-common/sepolicy/vendor/file.te b/universal7885-common/sepolicy/vendor/file.te index 94c367f..27d593d 100644 --- a/universal7885-common/sepolicy/vendor/file.te +++ b/universal7885-common/sepolicy/vendor/file.te @@ -1,60 +1,123 @@ -### efs types -type radio_factoryapp_efs_file, file_type; -type factoryprop_efs_file, file_type; -type sensor_factoryapp_efs_file, file_type; -type factorymode_factoryapp_efs_file, file_type; -type baro_delta_factoryapp_efs_file, file_type; - -# gps -type gps_socket, file_type; - -# debugfs types -type debugfs_mali, fs_type, debugfs_type; -type debugfs_mali_mem, fs_type, debugfs_type; -type debugfs_ion, fs_type, debugfs_type; -type debugfs_ion_dma, fs_type, debugfs_type; - -# cache -type boot_logcat_file, file_type, data_file_type; - -# proc -type proc_extra, fs_type, proc_type; -type proc_reset_reason, fs_type, proc_type; -type proc_swapiness, fs_type, proc_type; - -# data types -type display_vendor_data_file, file_type, data_file_type; -type fingerprintd_vendor_data_file, data_file_type, file_type; -type mediadrm_data_file, file_type, data_file_type; -type nfc_vendor_data_file, file_type, data_file_type; - -# sysfs types -type sysfs_battery_info, sysfs_type, fs_type; -type sysfs_battery_supply, sysfs_type, rw_fs_type, fs_type; -type sysfs_abox_writable, sysfs_type, rw_fs_type, fs_type; -type sysfs_sensor_writable, sysfs_type, rw_fs_type, fs_type; -type sysfs_input_writable, sysfs_type, rw_fs_type, fs_type; -type sysfs_batteryinfo_charger_writable, sysfs_type, rw_fs_type, fs_type; -type sysfs_camera_writable, sysfs_type, rw_fs_type, fs_type; -type sysfs_decon, sysfs_type, r_fs_type, fs_type; -type sysfs_gpu, sysfs_type, r_fs_type, fs_type; -type sysfs_socinfo, sysfs_type, r_fs_type, fs_type; -type sysfs_v4l, sysfs_type, r_fs_type, fs_type; -type sysfs_v4l_mfc, sysfs_type, r_fs_type, fs_type; -type sysfs_v4l_smfc, sysfs_type, r_fs_type, fs_type; -type sysfs_v4l_fimc, sysfs_type, r_fs_type, fs_type; -type sysfs_graphics, fs_type, sysfs_type; -type sysfs_multipdp, fs_type, sysfs_type, mlstrustedobject; -type sysfs_sec, fs_type, sysfs_type, mlstrustedobject; -type sysfs_gps, fs_type, sysfs_type, mlstrustedobject; -type sysfs_brightness, fs_type, sysfs_type, mlstrustedobject; -type sysfs_virtual, fs_type, sysfs_type, mlstrustedobject; -type sysfs_fuelgauge, fs_type, sysfs_type, mlstrustedobject; -type sysfs_charger, fs_type, sysfs_type, mlstrustedobject; -type sysfs_modem, fs_type, sysfs_type, mlstrustedobject; -type sysfs_camera, fs_type, sysfs_type, mlstrustedobject; -type sysfs_mmc_host_writable, sysfs_type, rw_fs_type, fs_type; -type sysfs_ss_writable, sysfs_type, rw_fs_type, fs_type; -type sysfs_usb_writable, sysfs_type, rw_fs_type, fs_type; -type sysfs_gpu_writable, sysfs_type, rw_fs_type, fs_type; -type sysfs_info, sysfs_type, r_fs_type, fs_type; +### DATA +type biometrics_vendor_data_file, file_type, data_file_type; +type conn_vendor_data_file, file_type, data_file_type; +type gps_vendor_data_file, file_type, data_file_type; +type log_vendor_data_file, file_type, data_file_type; +type log_cbd_vendor_data_file, file_type, data_file_type; +type radio_vendor_data_file, file_type, data_file_type; +type wifi_vendor_data_file, file_type, data_file_type; + +# EFS +type app_efs_file, file_type; +type battery_efs_file, file_type; +type bin_nv_data_efs_file, file_type; +type cpk_efs_file, file_type; +type imei_efs_file, file_type; +type nfc_efs_file, file_type; +type pfw_efs_file, file_type; +type prov_efs_file, file_type; +type sec_efs_file, file_type; +type tee_efs_file, file_type; +type wifi_efs_file, file_type; + +# PROC +type proc_last_kmsg, fs_type, proc_type; + +# SOCKETS +type epicd_socket, file_type, data_file_type; + +### SYSFS +type sysfs_argos, sysfs_type, r_fs_type, fs_type; +#type sysfs_battery, sysfs_type, r_fs_type, fs_type; +type sysfs_bbd, sysfs_type, r_fs_type, fs_type; +type sysfs_fingerprint, sysfs_type, r_fs_type, fs_type; +type sysfs_iio, sysfs_type, r_fs_type, fs_type; +type sysfs_input, sysfs_type, r_fs_type, fs_type; +type sysfs_sec_gps, sysfs_type, r_fs_type, fs_type; +type sysfs_sec_key, sysfs_type, r_fs_type, fs_type; +type sysfs_sec_sensors, sysfs_type, r_fs_type, fs_type; +#type sysfs_sec_switch, sysfs_type, r_fs_type, fs_type; +type sysfs_sec_touchscreen, sysfs_type, r_fs_type, fs_type; +type sysfs_sim, sysfs_type, r_fs_type, fs_type; +type sysfs_sensors, sysfs_type, r_fs_type, fs_type; +type sysfs_wifi, sysfs_type, r_fs_type, fs_type; + +type sysfs_backlight_writable, sysfs_type, rw_fs_type, fs_type; +#type sysfs_battery_writable, sysfs_type, rw_fs_type, fs_type; +type sysfs_bt_writable, sysfs_type, rw_fs_type, fs_type; +type sysfs_gps_writable, sysfs_type, rw_fs_type, fs_type; +type sysfs_lcd_writable, sysfs_type, rw_fs_type, fs_type; +type sysfs_power_writable, sysfs_type, rw_fs_type, fs_type; +type sysfs_scsi_host_writable, sysfs_type, rw_fs_type, fs_type; +type sysfs_sensorhub_writable, sysfs_type, rw_fs_type, fs_type; +type sysfs_sensors_writable, sysfs_type, rw_fs_type, fs_type; +type sysfs_sim_writable, sysfs_type, rw_fs_type, fs_type; +type sysfs_spi_writeable, sysfs_type, rw_fs_type, fs_type; +#type sysfs_sec_switch_writable, sysfs_type, rw_fs_type, fs_type; +type sysfs_touchscreen_writable, sysfs_type, rw_fs_type, fs_type; +type sysfs_wifi_writable, sysfs_type, rw_fs_type, fs_type; + +### VENDOR +type vendor_firmware_file, file_type, vendor_file_type; + +# DATA +type tee_vendor_data_file, file_type, data_file_type; + +# DEV SOCKET +type tz_socket, file_type; +### efs types +type radio_factoryapp_efs_file, file_type; +type factoryprop_efs_file, file_type; +type sensor_factoryapp_efs_file, file_type; +type factorymode_factoryapp_efs_file, file_type; +type baro_delta_factoryapp_efs_file, file_type; +# gps +type gps_socket, file_type; +# debugfs types +type debugfs_mali, fs_type, debugfs_type; +type debugfs_mali_mem, fs_type, debugfs_type; +type debugfs_ion, fs_type, debugfs_type; +type debugfs_ion_dma, fs_type, debugfs_type; +# cache +type boot_logcat_file, file_type, data_file_type; +# proc +type proc_extra, fs_type, proc_type; +type proc_reset_reason, fs_type, proc_type; +type proc_swapiness, fs_type, proc_type; + +# data types +type display_vendor_data_file, file_type, data_file_type; +type fingerprintd_vendor_data_file, data_file_type, file_type; +type mediadrm_data_file, file_type, data_file_type; +type nfc_vendor_data_file, file_type, data_file_type; + +# sysfs types +type sysfs_battery_info, sysfs_type, fs_type; +type sysfs_battery_supply, sysfs_type, rw_fs_type, fs_type; +type sysfs_abox_writable, sysfs_type, rw_fs_type, fs_type; +type sysfs_sensor_writable, sysfs_type, rw_fs_type, fs_type; +type sysfs_input_writable, sysfs_type, rw_fs_type, fs_type; +type sysfs_batteryinfo_charger_writable, sysfs_type, rw_fs_type, fs_type; +type sysfs_camera_writable, sysfs_type, rw_fs_type, fs_type; +type sysfs_decon, sysfs_type, r_fs_type, fs_type; +type sysfs_gpu, sysfs_type, r_fs_type, fs_type; +type sysfs_socinfo, sysfs_type, r_fs_type, fs_type; +type sysfs_v4l, sysfs_type, r_fs_type, fs_type; +type sysfs_v4l_mfc, sysfs_type, r_fs_type, fs_type; +type sysfs_v4l_smfc, sysfs_type, r_fs_type, fs_type; +type sysfs_v4l_fimc, sysfs_type, r_fs_type, fs_type; +type sysfs_graphics, fs_type, sysfs_type; +type sysfs_multipdp, fs_type, sysfs_type, mlstrustedobject; +type sysfs_sec, fs_type, sysfs_type, mlstrustedobject; +type sysfs_gps, fs_type, sysfs_type, mlstrustedobject; +type sysfs_brightness, fs_type, sysfs_type, mlstrustedobject; +type sysfs_virtual, fs_type, sysfs_type, mlstrustedobject; +type sysfs_fuelgauge, fs_type, sysfs_type, mlstrustedobject; +type sysfs_charger, fs_type, sysfs_type, mlstrustedobject; +type sysfs_modem, fs_type, sysfs_type, mlstrustedobject; +type sysfs_camera, fs_type, sysfs_type, mlstrustedobject; +type sysfs_mmc_host_writable, sysfs_type, rw_fs_type, fs_type; +type sysfs_ss_writable, sysfs_type, rw_fs_type, fs_type; +type sysfs_usb_writable, sysfs_type, rw_fs_type, fs_type; +type sysfs_gpu_writable, sysfs_type, rw_fs_type, fs_type; +type sysfs_info, sysfs_type, r_fs_type, fs_type; \ No newline at end of file diff --git a/universal7885-common/sepolicy/vendor/file_contexts b/universal7885-common/sepolicy/vendor/file_contexts index 2a35f3f..0b066dd 100644 --- a/universal7885-common/sepolicy/vendor/file_contexts +++ b/universal7885-common/sepolicy/vendor/file_contexts @@ -1,3 +1,144 @@ +# file_contexts + +# DATA +/data/vendor/tee(/.*)? u:object_r:tee_vendor_data_file:s0 + +# DEV +/dev/socket/tz u:object_r:tz_socket:s0 +/dev/tuihw u:object_r:tz_device:s0 +/dev/tzdev u:object_r:tz_user_device:s0 +/dev/tzic u:object_r:tz_device:s0 +/dev/tzirs u:object_r:tz_device:s0 +/dev/tziwsock u:object_r:tz_user_device:s0 + +# VENDOR +/(vendor|system/vendor)/bin/tzdaemon u:object_r:tzdaemon_exec:s0 +/(vendor|system/vendor)/bin/tzts_daemon u:object_r:tztsdaemon_exec:s0 + +/(vendor|system/vendor)/lib(64)?/libteecl\.so u:object_r:same_process_hal_file:s0 +### DATA +/data/vendor/biometrics(/.*)? u:object_r:biometrics_vendor_data_file:s0 +/data/vendor/conn(/.*)? u:object_r:conn_vendor_data_file:s0 +/data/vendor/gps(/.*)? u:object_r:gps_vendor_data_file:s0 +/data/vendor/wifi(/.*)? u:object_r:wifi_vendor_data_file:s0 +/data/vendor/log(/.*)? u:object_r:log_vendor_data_file:s0 +/data/vendor/log/cbd(/.*)? u:object_r:log_cbd_vendor_data_file:s0 +/data/vendor/secradio(/.*)? u:object_r:radio_vendor_data_file:s0 + +### DEV +/dev/block/platform/.+/by-name/boot u:object_r:boot_block_device:s0 +/dev/block/platform/.+/by-name/cache u:object_r:cache_block_device:s0 +/dev/block/platform/.+/by-name/efs u:object_r:efs_block_device:s0 +/dev/block/platform/.+/by-name/dqmdbg u:object_r:dqmdbg_block_device:s0 +/dev/block/platform/.+/by-name/dtbo u:object_r:dtbo_block_device:s0 +/dev/block/platform/.+/by-name/keydata u:object_r:keydata_block_device:s0 +/dev/block/platform/.+/by-name/keyrefuge u:object_r:keyrefuge_block_device:s0 +/dev/block/platform/.+/by-name/metadata u:object_r:metadata_block_device:s0 +/dev/block/platform/.+/by-name/misc u:object_r:misc_block_device:s0 +/dev/block/platform/.+/by-name/modem u:object_r:modem_block_device:s0 +/dev/block/platform/.+/by-name/omr u:object_r:omr_block_device:s0 +/dev/block/platform/.+/by-name/persistent u:object_r:frp_block_device:s0 +/dev/block/platform/.+/by-name/radio u:object_r:radio_block_device:s0 +/dev/block/platform/.+/by-name/recovery u:object_r:recovery_block_device:s0 +/dev/block/platform/.+/by-name/sec_efs u:object_r:sec_efs_block_device:s0 +/dev/block/platform/.+/by-name/super u:object_r:super_block_device:s0 +/dev/block/platform/.+/by-name/userdata u:object_r:userdata_block_device:s0 + +/dev/esfp[0-9] u:object_r:fp_sensor_device:s0 +/dev/batch_io u:object_r:io_device:s0 +/dev/ssp_sensorhub u:object_r:ssp_device:s0 + +# bluetooth +/dev/ttySAC[0-9] u:object_r:bt_device:s0 + +# cpu +/dev/cpu_dma_latency u:object_r:cpu_dma_device:s0 + +### epic +/dev/mode u:object_r:epic_device:s0 +/dev/socket/epic u:object_r:epicd_socket:s0 + +### gnss/gps +/dev/bbd_control u:object_r:bbd_device:s0 +/dev/bbd_packet u:object_r:bbd_device:s0 +/dev/bbd_patch u:object_r:bbd_device:s0 +/dev/bbd_reliable u:object_r:bbd_device:s0 +/dev/bbd_sensor u:object_r:bbd_device:s0 +/dev/bbd_sio u:object_r:bbd_device:s0 +/dev/bbd_urgent_patch u:object_r:bbd_device:s0 +/dev/ttyBCM[0-9]* u:object_r:bbd_device:s0 + +### qos +/dev/bus_throughput u:object_r:pm_qos_device:s0 +/dev/bus_throughput_max u:object_r:pm_qos_device:s0 +/dev/cluster0_freq_max u:object_r:pm_qos_device:s0 +/dev/cluster0_freq_min u:object_r:pm_qos_device:s0 +/dev/cluster1_freq_max u:object_r:pm_qos_device:s0 +/dev/cluster1_freq_min u:object_r:pm_qos_device:s0 +/dev/cluster2_freq_max u:object_r:pm_qos_device:s0 +/dev/cluster2_freq_min u:object_r:pm_qos_device:s0 +/dev/cpu_online_max u:object_r:pm_qos_device:s0 +/dev/cpu_online_min u:object_r:pm_qos_device:s0 +/dev/device_throughput u:object_r:pm_qos_device:s0 +/dev/device_throughput_max u:object_r:pm_qos_device:s0 +/dev/gpu_freq_max u:object_r:pm_qos_device:s0 +/dev/gpu_freq_min u:object_r:pm_qos_device:s0 +/dev/mfc_throughput u:object_r:pm_qos_device:s0 +/dev/mfc_throughput_max u:object_r:pm_qos_device:s0 +/dev/network_throughput u:object_r:radio_qos_device:s0 +/dev/npu_throughput u:object_r:pm_qos_device:s0 +/dev/npu_throughput_max u:object_r:pm_qos_device:s0 + +### radio +# DRB +/dev/drb u:object_r:drb_device:s0 + +# UMTS +/dev/umts_boot0 u:object_r:vendor_radio_device:s0 +/dev/umts_cass u:object_r:vendor_radio_device:s0 +/dev/umts_ipc[0-1] u:object_r:vendor_radio_device:s0 +/dev/umts_dm0 u:object_r:vendor_radio_device:s0 +/dev/umts_rfs0 u:object_r:vendor_radio_device:s0 +/dev/umts_router u:object_r:vendor_radio_device:s0 + +### EFS +/efs/Battery(/.*)? u:object_r:battery_efs_file:s0 +/efs/DAK(/.*)? u:object_r:prov_efs_file:s0 +/efs/afc(/.*)? u:object_r:sec_efs_file:s0 +/efs/bluetooth(/.*)? u:object_r:bluetooth_efs_file:s0 +/efs/cpk(/.*)? u:object_r:cpk_efs_file:s0 +/efs/imei(/.*)? u:object_r:imei_efs_file:s0 +/efs/nfc(/.*)? u:object_r:nfc_efs_file:s0 +/efs/nv_data\.bin(.*) u:object_r:bin_nv_data_efs_file:s0 +/efs/pfw_data(/.*)? u:object_r:pfw_efs_file:s0 +/efs/prov(/.*)? u:object_r:prov_efs_file:s0 +/efs/prov_data(/.*)? u:object_r:prov_efs_file:s0 +/efs/root(/.*)? u:object_r:app_efs_file:s0 +/efs/tee(/.*)? u:object_r:tee_efs_file:s0 +/efs/wifi(/.*)? u:object_r:wifi_efs_file:s0 + +/mnt/vendor/efs(/.*)? u:object_r:efs_file:s0 +/mnt/vendor/efs/DAK(/.*)? u:object_r:prov_efs_file:s0 +/mnt/vendor/efs/afc(/.*)? u:object_r:sec_efs_file:s0 +/mnt/vendor/efs/bluetooth(/.*)? u:object_r:bluetooth_efs_file:s0 +/mnt/vendor/efs/cpk(/.*)? u:object_r:cpk_efs_file:s0 +/mnt/vendor/efs/imei(/.*)? u:object_r:imei_efs_file:s0 +/mnt/vendor/efs/nv_data\.bin(.*) u:object_r:bin_nv_data_efs_file:s0 +/mnt/vendor/efs/pfw_data(/.*)? u:object_r:pfw_efs_file:s0 +/mnt/vendor/efs/prov(/.*)? u:object_r:prov_efs_file:s0 +/mnt/vendor/efs/prov_data(/.*)? u:object_r:prov_efs_file:s0 +/mnt/vendor/efs/root(/.*)? u:object_r:app_efs_file:s0 +/mnt/vendor/efs/tee(/.*)? u:object_r:tee_efs_file:s0 +/mnt/vendor/efs/wifi(/.*)? u:object_r:wifi_efs_file:s0 + +### VENDOR +/(vendor|system/vendor)/bin/cbd u:object_r:cbd_exec:s0 +/(vendor|system/vendor)/bin/secril_config_svc u:object_r:secril_config_svc_exec:s0 + +/(vendor|system/vendor)/bin/hw/android\.hardware\.biometrics\.fingerprint@[0-9].[0-9]-service\.samsung u:object_r:hal_fingerprint_default_exec:s0 +/(vendor|system/vendor)/bin/hw/android\.hardware\.light@[0-9].[0-9]-service\.samsung u:object_r:hal_light_default_exec:s0 +/(vendor|system/vendor)/bin/hw/android\.hardware\.thermal@[0-9].[0-9]-service\.samsung u:object_r:hal_thermal_default_exec:s0 + #################################### # Devices /dev/mali[0-9]* u:object_r:gpu_device:s0 @@ -70,3 +211,6 @@ /(vendor|system/vendor)/bin/hw/android\.hardware\.nfc@[0-9]\.[0-9]-service\.samsung u:object_r:hal_nfc_default_exec:s0 /(vendor|system/vendor)/bin/hw/android\.hardware\.usb@[0-9]\.[0-9]-service\.typec u:object_r:hal_usb_default_exec:s0 /(vendor|system/vendor)/bin/hw/vendor\.samsung\.hardware\.gnss@[0-9]\.[0-9]-service u:object_r:hal_gnss_default_exec:s0 +/(vendor|system/vendor)/bin/hw/android\.hardware\.sensors@2\.1-service\.samsung-multihal u:object_r:hal_sensors_default_exec:s0 +# SamsungParts +/(vendor/system/vendor)/bin/hw/vendor.eureka.hardware.battery@1.0-service u:object_r:hal_battery_default_exec:s0 diff --git a/universal7885-common/sepolicy/vendor/genfs_contexts b/universal7885-common/sepolicy/vendor/genfs_contexts index c983a13..6c19585 100644 --- a/universal7885-common/sepolicy/vendor/genfs_contexts +++ b/universal7885-common/sepolicy/vendor/genfs_contexts @@ -1,3 +1,68 @@ +# genfs_contexts + +### PROC +genfscon proc /last_kmsg u:object_r:proc_last_kmsg:s0 + +### SYSFS +genfscon sysfs /bbd u:object_r:sysfs_bbd:s0 + +genfscon sysfs /bus/iio/devices u:object_r:sysfs_iio:s0 + +genfscon sysfs /class/backlight/ u:object_r:sysfs_backlight_writable:s0 +genfscon sysfs /class/fingerprint/fingerprint u:object_r:sysfs_fingerprint:s0 +genfscon sysfs /class/input u:object_r:sysfs_input:s0 +genfscon sysfs /class/power_supply u:object_r:sysfs_battery:s0 +genfscon sysfs /class/rtc/rtc0 u:object_r:sysfs_rtc:s0 +genfscon sysfs /class/sec/gps u:object_r:sysfs_sec_gps:s0 +genfscon sysfs /class/sec/sensors u:object_r:sysfs_sec_sensors:s0 +genfscon sysfs /class/sec/tsp u:object_r:sysfs_sec_touchscreen:s0 +genfscon sysfs /class/sensor_event u:object_r:sysfs_sensors:s0 +genfscon sysfs /class/sensors u:object_r:sysfs_sensors:s0 +genfscon sysfs /class/thermal u:object_r:sysfs_thermal:s0 +genfscon sysfs /class/timed_output/vibrator/intensity u:object_r:sysfs_vibrator:s0 +genfscon sysfs /class/timed_output/vibrator/multi_freq u:object_r:sysfs_vibrator:s0 + +genfscon sysfs /devices/platform/argos u:object_r:sysfs_argos:s0 +genfscon sysfs /devices/platform/battery/power_supply u:object_r:sysfs_battery:s0 +genfscon sysfs /devices/platform/battery/power_supply/battery/lcd u:object_r:sysfs_battery_writable:s0 +genfscon sysfs /devices/platform/panel@0/backlight/panel/brightness u:object_r:sysfs_backlight_writable:s0 +genfscon sysfs /devices/platform/panel@0/backlight/panel/max_brightness u:object_r:sysfs_backlight_writable:s0 +genfscon sysfs /devices/platform/panel@0/lcd/panel u:object_r:sysfs_lcd_writable:s0 + +genfscon sysfs /devices/virtual/fingerprint/fingerprint u:object_r:sysfs_fingerprint:s0 +genfscon sysfs /devices/virtual/input u:object_r:sysfs_input:s0 +genfscon sysfs /devices/virtual/lcd/panel u:object_r:sysfs_lcd_writable:s0 +genfscon sysfs /devices/virtual/sec/gps u:object_r:sysfs_sec_gps:s0 +genfscon sysfs /devices/virtual/sec/sec_key u:object_r:sysfs_sec_key:s0 +genfscon sysfs /devices/virtual/sec/tsp u:object_r:sysfs_sec_touchscreen:s0 +genfscon sysfs /devices/virtual/sec/tsp/cmd u:object_r:sysfs_touchscreen_writable:s0 +genfscon sysfs /devices/virtual/sec/tsp/ear_detect_enable u:object_r:sysfs_touchscreen_writable:s0 +genfscon sysfs /devices/virtual/sec/tsp/prox_power_off u:object_r:sysfs_touchscreen_writable:s0 +genfscon sysfs /devices/virtual/sec/tsp/input/enabled u:object_r:sysfs_touchscreen_writable:s0 +genfscon sysfs /devices/virtual/sensor_event u:object_r:sysfs_sensors:s0 +genfscon sysfs /devices/virtual/sensors u:object_r:sysfs_sensors:s0 +genfscon sysfs /devices/virtual/sensors/hidden_hole/hh_check_coef u:object_r:sysfs_sensors_writable:s0 +genfscon sysfs /devices/virtual/sensors/ssp_sensor/enable u:object_r:sysfs_sensors_writable:s0 +genfscon sysfs /devices/virtual/sensors/ssp_sensor/ssp_flush u:object_r:sysfs_sensors_writable:s0 +genfscon sysfs /devices/virtual/sec/switch u:object_r:sysfs_sec_switch:s0 +genfscon sysfs /devices/virtual/sec/switch/afc_disable u:object_r:sysfs_sec_switch_writable:s0 +genfscon sysfs /devices/virtual/thermal u:object_r:sysfs_thermal:s0 +genfscon sysfs /devices/virtual/timed_output/vibrator/cp_trigger_index u:object_r:sysfs_vibrator:s0 +genfscon sysfs /devices/virtual/timed_output/vibrator/intensity u:object_r:sysfs_vibrator:s0 +genfscon sysfs /devices/virtual/timed_output/vibrator/multi_freq u:object_r:sysfs_vibrator:s0 + +genfscon sysfs /module/dhd/parameters u:object_r:sysfs_wifi_writable:s0 + +genfscon sysfs /power/cpufreq_max_limit u:object_r:sysfs_power_writable:s0 +genfscon sysfs /power/cpufreq_min_limit u:object_r:sysfs_power_writable:s0 +genfscon sysfs /power/cpuhotplug/max_online_cpu u:object_r:sysfs_power_writable:s0 +genfscon sysfs /power/rtc_status u:object_r:sysfs_power_writable:s0 + +genfscon sysfs /wifi u:object_r:sysfs_wifi:s0 +genfscon sysfs /wifi/cid u:object_r:sysfs_wifi_writable:s0 +genfscon sysfs /wifi/mac_addr u:object_r:sysfs_wifi_writable:s0 +genfscon sysfs /wifi/memdump u:object_r:sysfs_wifi_writable:s0 + # DEBUGFS genfscon debugfs /mali/ u:object_r:debugfs_mali:s0 genfscon debugfs /mali/mem/ u:object_r:debugfs_mali_mem:s0 diff --git a/universal7885-common/sepolicy/vendor/gpsd.te b/universal7885-common/sepolicy/vendor/gpsd.te index b2a5c45..a90616f 100644 --- a/universal7885-common/sepolicy/vendor/gpsd.te +++ b/universal7885-common/sepolicy/vendor/gpsd.te @@ -1,3 +1,41 @@ +type gpsd, domain, netdomain; +type gpsd_exec, exec_type, vendor_file_type, file_type; + +# gpsd is started by init, type transit from init domain to gpsd domain +init_daemon_domain(gpsd) + +allow gpsd rild:unix_stream_socket connectto; + +get_prop(gpsd, vendor_radio_prop) +get_prop(gpsd, telephony_config_prop) +get_prop(gpsd, exported_config_prop) + +get_prop(gpsd, hwservicemanager_prop) +hwbinder_use(gpsd) +allow gpsd system_suspend_hwservice:hwservice_manager { find }; +allow gpsd fwk_sensor_hwservice:hwservice_manager { find }; + +binder_call(gpsd, system_suspend_server) +binder_call(gpsd, system_server) +binder_call(system_server, gpsd) + +allow gpsd self:netlink_kobject_uevent_socket create_socket_perms_no_ioctl; +allow gpsd self:{ tcp_socket udp_socket } create_stream_socket_perms; +allow gpsd port:tcp_socket { name_bind name_connect }; +allow gpsd port:udp_socket name_bind; +allow gpsd node:{ tcp_socket udp_socket } node_bind; + +# /acct/tasks +allow gpsd cgroup:file getattr; + +# /dev/socket/fwmarkd +allow gpsd fwmarkd_socket:sock_file write; + +# /data/vendor/gps +allow gpsd gps_vendor_data_file:dir rw_dir_perms; +allow gpsd gps_vendor_data_file:file create_file_perms; +allow gpsd gps_vendor_data_file:fifo_file create_file_perms; + r_dir_file(gpsd, sysfs_sec_gps) allow gpsd sysfs_gps_writable:file rw_file_perms; diff --git a/universal7885-common/sepolicy/vendor/hal_battery_default.te b/universal7885-common/sepolicy/vendor/hal_battery_default.te new file mode 100644 index 0000000..b435692 --- /dev/null +++ b/universal7885-common/sepolicy/vendor/hal_battery_default.te @@ -0,0 +1,3 @@ +type hal_battery_default, domain; +type hal_battery_default_exec, exec_type, file_type, vendor_file_type; +init_daemon_domain(hal_battery_default); diff --git a/universal7885-common/sepolicy/vendor/hal_bluetooth_default.te b/universal7885-common/sepolicy/vendor/hal_bluetooth_default.te index 30c2bb7..52f06cb 100644 --- a/universal7885-common/sepolicy/vendor/hal_bluetooth_default.te +++ b/universal7885-common/sepolicy/vendor/hal_bluetooth_default.te @@ -1 +1,24 @@ + +# ro.rfkilldisabled +get_prop(hal_bluetooth_default, rfkilldisabled_prop) +# vendor.bluetooth_fw_ver +set_prop(hal_bluetooth_default, wifi_log_prop) +# sys.bluetooth.tty +set_prop(hal_bluetooth_default, exported_bluetooth_prop) + +# /dev/ttySAC[0-9] +allow hal_bluetooth_default bt_device:chr_file rw_file_perms; + +# /mnt/vendor +allow hal_bluetooth_default mnt_vendor_file:dir search; + +# /mnt/vendor/efs/ +allow hal_bluetooth_default efs_file:dir r_dir_perms; + +# /mnt/vendor/conn +allow hal_bluetooth_default conn_vendor_data_file:dir r_dir_perms; +allow hal_bluetooth_default conn_vendor_data_file:file r_file_perms; + +# /sys/devices/platform/bluetooth/rfkill/rfkill0/state +allow hal_bluetooth_default sysfs_bt_writable:file rw_file_perms; allow hal_bluetooth_default vendor_firmware_file:dir r_dir_perms; diff --git a/universal7885-common/sepolicy/vendor/hal_fingerprint_default.te b/universal7885-common/sepolicy/vendor/hal_fingerprint_default.te index 761e09b..92fda15 100644 --- a/universal7885-common/sepolicy/vendor/hal_fingerprint_default.te +++ b/universal7885-common/sepolicy/vendor/hal_fingerprint_default.te @@ -1,3 +1,18 @@ +# hal_fingerprint_default.te + +teegris_use(hal_fingerprint_default) +# /dev/esfp[0-9] +allow hal_fingerprint_default fp_sensor_device:chr_file rw_file_perms; + +# /data/vendor/ -> biometrics +file_type_auto_trans(hal_fingerprint_default, vendor_data_file, biometrics_vendor_data_file) + +# /data/vendor/biometrics/* +allow hal_fingerprint_default biometrics_vendor_data_file:file create_file_perms; + +# /sys/class/fingerprint/ +allow hal_fingerprint_default sysfs_fingerprint:dir r_dir_perms; +allow hal_fingerprint_default sysfs_fingerprint:file r_file_perms; typeattribute hal_fingerprint_default data_between_core_and_vendor_violators; allow hal_fingerprint_default fingerprintd_data_file:dir write; diff --git a/universal7885-common/sepolicy/vendor/hal_gatekeeper_default.te b/universal7885-common/sepolicy/vendor/hal_gatekeeper_default.te index 904170b..c8114f4 100644 --- a/universal7885-common/sepolicy/vendor/hal_gatekeeper_default.te +++ b/universal7885-common/sepolicy/vendor/hal_gatekeeper_default.te @@ -1,3 +1,4 @@ allow hal_gatekeeper_default efs_file:dir search; allow hal_gatekeeper_default efs_file:file rw_file_perms; allow hal_gatekeeper_default mnt_vendor_file:dir search; +teegris_use(hal_gatekeeper_default) diff --git a/universal7885-common/sepolicy/vendor/hal_gnss_default.te b/universal7885-common/sepolicy/vendor/hal_gnss_default.te index 573b370..b37fe71 100644 --- a/universal7885-common/sepolicy/vendor/hal_gnss_default.te +++ b/universal7885-common/sepolicy/vendor/hal_gnss_default.te @@ -1,3 +1,5 @@ +# hal_gnss_default.te + # cgroups tasks allow hal_gnss_default cgroup:file getattr; @@ -8,7 +10,6 @@ allow hal_gnss_default gps_vendor_data_file:fifo_file create_file_perms; # /mnt/vendor allow hal_gnss_default mnt_vendor_file:dir search; - # vndbinder allow hal_gnss_default vndbinder_device:chr_file rw_file_perms; diff --git a/universal7885-common/sepolicy/vendor/hal_keymaster_default.te b/universal7885-common/sepolicy/vendor/hal_keymaster_default.te index 8db9d0e..16eb14f 100644 --- a/universal7885-common/sepolicy/vendor/hal_keymaster_default.te +++ b/universal7885-common/sepolicy/vendor/hal_keymaster_default.te @@ -1 +1,9 @@ +# hal_keymaster_default + +# /mnt/vendor +allow hal_keymaster_default mnt_vendor_file:dir search; + +# /mnt/vendor/efs +allow hal_keymaster_default efs_file:dir search; +teegris_use(hal_keymaster_default) allow hal_keymaster_default prov_efs_file:file r_file_perms; diff --git a/universal7885-common/sepolicy/vendor/hal_light_default.te b/universal7885-common/sepolicy/vendor/hal_light_default.te index d9dfb63..6cd32fd 100644 --- a/universal7885-common/sepolicy/vendor/hal_light_default.te +++ b/universal7885-common/sepolicy/vendor/hal_light_default.te @@ -1,3 +1,8 @@ +# hal_light_default.te + +# /sys/devices/platform/panel@0/backlight/panel/brightness +# /sys/devices/platform/panel@0/backlight/panel/max_brightness +allow hal_light_default sysfs_backlight_writable:file rw_file_perms; allow hal_light_default sysfs_graphics:dir search; allow hal_light_default sysfs_graphics:file rw_file_perms; allow hal_light_default sysfs_virtual:dir search; diff --git a/universal7885-common/sepolicy/vendor/hal_power_default.te b/universal7885-common/sepolicy/vendor/hal_power_default.te index d84b692..b1d0050 100644 --- a/universal7885-common/sepolicy/vendor/hal_power_default.te +++ b/universal7885-common/sepolicy/vendor/hal_power_default.te @@ -1,3 +1,28 @@ +# hal_power_default.te + +# /dev/cpu_dma_latency +allow hal_power_default cpu_dma_device:chr_file rw_file_perms; + +# /dev/stune/top-app/schedtune.boost +allow hal_power_default cgroup:file rw_file_perms; + +# /sys/class/input/ +allow hal_power_default sysfs_input:dir r_dir_perms; + +# /sys/class/power/ +allow hal_power_default sysfs_power:dir r_dir_perms; +allow hal_power_default sysfs_power:file r_file_perms; +allow hal_power_default sysfs_power_writable:file rw_file_perms; + +# /sys/class/sec/tsp/input/ +allow hal_power_default sysfs_sec_touchscreen:dir r_dir_perms; +allow hal_power_default sysfs_sec_touchscreen:lnk_file r_file_perms; + +# /sys/class/sec/tsp/input/{cmd,enabled} +allow hal_power_default sysfs_touchscreen_writable:file rw_file_perms; + +# /sys/devices/system/cpu/cpu[0-9]/cpufreq/scaling_max_freq +allow hal_power_default sysfs_devices_system_cpu:file rw_file_perms; allow hal_power_default sysfs_graphics:dir search; allow hal_power_default sysfs_graphics:file r_file_perms; allow hal_power_default sysfs_input:file r_file_perms; diff --git a/universal7885-common/sepolicy/vendor/hal_sensors_default.te b/universal7885-common/sepolicy/vendor/hal_sensors_default.te index 01d5b5a..2aedc5f 100644 --- a/universal7885-common/sepolicy/vendor/hal_sensors_default.te +++ b/universal7885-common/sepolicy/vendor/hal_sensors_default.te @@ -1,3 +1,62 @@ +# hal_sensors_default.te + +# /dev/batch_io +allow hal_sensors_default io_device:chr_file r_file_perms; + +# /dev/iio:device1 +allow hal_sensors_default iio_device:chr_file r_file_perms; + +# /dev/ssp_sensorhub +allow hal_sensors_default ssp_device:chr_file rw_file_perms; + +# /efs +allow hal_sensors_default efs_file:dir r_dir_perms; + +# /efs/FactoryApp/ +allow hal_sensors_default app_efs_file:dir rw_dir_perms; +allow hal_sensors_default app_efs_file:file { setattr rw_file_perms }; + +# /sys/bus/iio/devices +allow hal_sensors_default sysfs_iio:dir r_dir_perms; +allow hal_sensors_default sysfs_iio:file r_file_perms; + +# /sys/class/sec/sensors +allow hal_sensors_default sysfs_sec_sensors:dir r_dir_perms; +allow hal_sensors_default sysfs_sec_sensors:file r_file_perms; + +# /sys/class/sensors/ssp_sensor/enable +allow hal_sensors_default sysfs_sensors_writable:dir r_dir_perms; +allow hal_sensors_default sysfs_sensors_writable:file rw_file_perms; + +# /sys/devices/platform/10970000.spi/ +allow hal_sensors_default sysfs_spi_writeable:dir r_dir_perms; +allow hal_sensors_default sysfs_spi_writeable:file rw_file_perms; + +# /sys/devices/platform/panel@0/lcd/panel/window_type +allow hal_sensors_default sysfs_lcd_writable:dir r_dir_perms; +allow hal_sensors_default sysfs_lcd_writable:file r_file_perms; + +# /sys/class/input +allow hal_sensors_default sysfs_input:dir r_dir_perms; + +# /sys/devices/virtual/input/input4 +# /sys/devices/virtual/input/input6 +allow hal_sensors_default sysfs_sensors:dir r_dir_perms; +allow hal_sensors_default sysfs_sensors:file r_file_perms; + +# /sys/devices/virtual/sensors/magnetic_sensor/vendor +allow hal_sensors_default sysfs_sensors:dir r_dir_perms; +allow hal_sensors_default sysfs_sensors:file r_file_perms; + +# /sys/devices/virtual/sec/sec_key/hall_detect +allow hal_sensors_default sysfs_sec_key:dir r_dir_perms; +allow hal_sensors_default sysfs_sec_key:file r_file_perms; + +# /sys/class/sec/tsp/ +allow hal_sensors_default sysfs_sec_touchscreen:dir r_dir_perms; +allow hal_sensors_default sysfs_sec_touchscreen:file r_file_perms; +allow hal_sensors_default sysfs_sec_touchscreen:lnk_file r_file_perms; + allow hal_sensors_default sysfs_iio:file r_file_perms; allow hal_sensors_default sysfs_iio:lnk_file read; allow hal_sensors_default sysfs_virtual:dir r_dir_perms; diff --git a/universal7885-common/sepolicy/vendor/hal_thermal_default.te b/universal7885-common/sepolicy/vendor/hal_thermal_default.te index 14f013d..759bdb0 100644 --- a/universal7885-common/sepolicy/vendor/hal_thermal_default.te +++ b/universal7885-common/sepolicy/vendor/hal_thermal_default.te @@ -1 +1,8 @@ + +# /acct/tasks +allow hal_thermal_default cgroup:file getattr; + +# /sys/devices/virtual/thermal/ +allow hal_thermal_default sysfs_thermal:dir r_dir_perms; +allow hal_thermal_default sysfs_thermal:file r_file_perms; r_dir_file(hal_thermal_default, sysfs_virtual) diff --git a/universal7885-common/sepolicy/vendor/hal_wifi_hostapd_default.te b/universal7885-common/sepolicy/vendor/hal_wifi_hostapd_default.te index c13b158..abaab7b 100644 --- a/universal7885-common/sepolicy/vendor/hal_wifi_hostapd_default.te +++ b/universal7885-common/sepolicy/vendor/hal_wifi_hostapd_default.te @@ -1,2 +1,6 @@ +# hal_wifi_hostapd_default.te + +# /data/vendor/wifi/hostapd/hostapd_wlan0.conf +r_dir_file(hal_wifi_hostapd_default, wifi_vendor_data_file) allow hal_wifi_hostapd_default sysfs_virtual:dir search; allow hal_wifi_hostapd_default sysfs_virtual:lnk_file r_file_perms; diff --git a/universal7885-common/sepolicy/samsung_slsi/vendor/hal_wifi_supplicant_default.te b/universal7885-common/sepolicy/vendor/hal_wifi_supplicant_default.te similarity index 100% rename from universal7885-common/sepolicy/samsung_slsi/vendor/hal_wifi_supplicant_default.te rename to universal7885-common/sepolicy/vendor/hal_wifi_supplicant_default.te diff --git a/universal7885-common/sepolicy/vendor/hwservice.te b/universal7885-common/sepolicy/vendor/hwservice.te index 53ac5a0..a7b1329 100644 --- a/universal7885-common/sepolicy/vendor/hwservice.te +++ b/universal7885-common/sepolicy/vendor/hwservice.te @@ -1 +1,2 @@ type rild_hwservice, hwservice_manager_type; +type hal_battery_hwservice, hwservice_manager_type; diff --git a/universal7885-common/sepolicy/vendor/hwservice_contexts b/universal7885-common/sepolicy/vendor/hwservice_contexts index f575dbe..09099bc 100644 --- a/universal7885-common/sepolicy/vendor/hwservice_contexts +++ b/universal7885-common/sepolicy/vendor/hwservice_contexts @@ -4,3 +4,6 @@ vendor.samsung.hardware.radio.bridge::ISehBridge u:object_r:rild_hwse vendor.samsung.hardware.radio.channel::ISehChannel u:object_r:rild_hwservice:s0 vendor.lineage.power::ILineagePower u:object_r:hal_power_hwservice:s0 +# SamsungParts +vendor.eureka.hardware.battery::IBattery u:object_r:hal_battery_hwservice:s0 + diff --git a/universal7885-common/sepolicy/vendor/init.te b/universal7885-common/sepolicy/vendor/init.te index c737257..3161c7f 100644 --- a/universal7885-common/sepolicy/vendor/init.te +++ b/universal7885-common/sepolicy/vendor/init.te @@ -49,6 +49,9 @@ allow init proc_extra:file setattr; allow init proc_reset_reason:file setattr; allow init proc_swapiness:file open; allow init self:netlink_generic_socket { bind create getattr read setopt write }; +# init.te + +allow init proc_last_kmsg:file setattr; allow init mnt_vendor_file:dir mounton; unix_socket_connect(init, property, rild) diff --git a/universal7885-common/sepolicy/vendor/kernel.te b/universal7885-common/sepolicy/vendor/kernel.te index 90c0d90..b6ef8ec 100644 --- a/universal7885-common/sepolicy/vendor/kernel.te +++ b/universal7885-common/sepolicy/vendor/kernel.te @@ -1,3 +1,8 @@ +# kernel.te + +# /vendor/firmware/ +allow kernel vendor_firmware_file:dir r_dir_perms; +allow kernel vendor_firmware_file:file r_file_perms; allow kernel app_efs_file:dir search; allow kernel app_efs_file:file open; allow kernel sensor_factoryapp_efs_file:file open; diff --git a/universal7885-common/sepolicy/samsung_slsi/vendor/lhd.te b/universal7885-common/sepolicy/vendor/lhd.te similarity index 100% rename from universal7885-common/sepolicy/samsung_slsi/vendor/lhd.te rename to universal7885-common/sepolicy/vendor/lhd.te diff --git a/universal7885-common/sepolicy/vendor/macloader.te b/universal7885-common/sepolicy/vendor/macloader.te index 9b5f5af..b080898 100644 --- a/universal7885-common/sepolicy/vendor/macloader.te +++ b/universal7885-common/sepolicy/vendor/macloader.te @@ -1 +1,41 @@ +# macloader.te + +type macloader, domain; +type macloader_exec, exec_type, vendor_file_type, file_type; + +# macloader is started by init, type transit from init domain to macloader domain +init_daemon_domain(macloader) + +set_prop(macloader, vendor_wifi_prop); + +allow macloader self:capability { net_admin }; + +allow macloader self:udp_socket create_socket_perms; +allowxperm macloader self:udp_socket ioctl { 0x8913 0x8914 }; + +# /data/vendor/conn +allow macloader conn_vendor_data_file:dir rw_dir_perms; +allow macloader conn_vendor_data_file:file create_file_perms; + +# /mnt/vendor +allow macloader mnt_vendor_file:dir search; + +# /mnt/vendor/efs +allow macloader efs_file:dir rw_dir_perms; + +# /mnt/vendor/efs/wifi +allow macloader wifi_efs_file:dir rw_dir_perms; +allow macloader wifi_efs_file:file rw_file_perms; + +# /sys/class/net +allow macloader sysfs_net:dir r_dir_perms; +allow macloader sysfs_net:file r_file_perms; + +# /sys/module/dhd/parameters/firmware_path +allow macloader sysfs_wifi_writable:dir r_dir_perms; +allow macloader sysfs_wifi_writable:file rw_file_perms; + +# /sys/wifi +allow macloader sysfs_wifi:dir r_dir_perms; +allow macloader sysfs_wifi:file r_file_perms; allow macloader sysfs_virtual:dir search; diff --git a/universal7885-common/sepolicy/vendor/property.te b/universal7885-common/sepolicy/vendor/property.te index 4ed6c15..2a4fc8e 100644 --- a/universal7885-common/sepolicy/vendor/property.te +++ b/universal7885-common/sepolicy/vendor/property.te @@ -13,3 +13,14 @@ type vendor_nfc_prop, property_type; type vendor_wlbtd_prop, property_type; type vendor_wlan_prop, property_type; type vendor_hwc_prop, property_type; +# property.te + +type vendor_cbd_prop, property_type; +type vendor_radio_prop, property_type; +type vendor_fastcharge_prop, property_type; +type vendor_wifi_prop, property_type; + +# property.te +type vendor_secureos_prop, property_type; +type vendor_tzdaemon_prop, property_type; +type vendor_tztsdaemon_prop, property_type; diff --git a/universal7885-common/sepolicy/vendor/property_contexts b/universal7885-common/sepolicy/vendor/property_contexts index 83c1393..dec4d3e 100644 --- a/universal7885-common/sepolicy/vendor/property_contexts +++ b/universal7885-common/sepolicy/vendor/property_contexts @@ -1,3 +1,16 @@ +### cbd +vendor.cbd. u:object_r:vendor_cbd_prop:s0 +persist.vendor.cbd. u:object_r:vendor_radio_prop:s0 + +### radio +ro.multisim. u:object_r:vendor_radio_prop:s0 +ro.vendor.multisim. u:object_r:vendor_radio_prop:s0 +ro.vendor.radio. u:object_r:vendor_radio_prop:s0 + +### wifi +vendor.wifi. u:object_r:vendor_wifi_prop:s0 +ro.vendor.wifi. u:object_r:vendor_wifi_prop:s0 + # bluetooth persist.bluetooth_fw_ver u:object_r:bluetooth_prop:s0 ro.bluetooth.tty u:object_r:bluetooth_prop:s0 @@ -38,3 +51,9 @@ vendor.wlan. u:object_r:vendor_wlan_prop:s0 # Hwc hwc.exynos.vsync_mode u:object_r:vendor_hwc_prop:s0 + + +# TEEGRIS +vendor.secureos. u:object_r:vendor_secureos_prop:s0 +vendor.tzdaemon u:object_r:vendor_tzdaemon_prop:s0 +vendor.tzts_daemon u:object_r:vendor_tztsdaemon_prop:s0 diff --git a/universal7885-common/sepolicy/vendor/rild.te b/universal7885-common/sepolicy/vendor/rild.te index 0c258e0..5675eaf 100644 --- a/universal7885-common/sepolicy/vendor/rild.te +++ b/universal7885-common/sepolicy/vendor/rild.te @@ -1,3 +1,71 @@ +# rild.te + +get_prop(rild, vendor_radio_prop) + +allow rild block_device:dir search; +allow rild mnt_vendor_file:dir { getattr search }; + +# audio hal +allow rild hal_audio_default:dir search; +allow rild hal_audio_default:file r_file_perms; + +# gps +allow rild gpsd:dir search; +allow rild gpsd:file r_file_perms; + +# /data +allow rild system_data_file:dir getattr; + +# /data/vendor/log +allow rild log_vendor_data_file:dir rw_dir_perms; +allow rild log_vendor_data_file:file create_file_perms; + +# /dev/block/platform/.+/by-name/radio +allow rild radio_block_device:blk_file r_file_perms; + +# /dev/drb +allow rild drb_device:chr_file rw_file_perms; + +# /dev/umts_* +# /dev/umts_ipc* +allow rild vendor_radio_device:chr_file rw_file_perms; + +# /data/vendor/secradio +allow rild radio_vendor_data_file:dir rw_dir_perms; +allow rild radio_vendor_data_file:file create_file_perms; + +# /efs/FactoryApp/ +# /mnt/vendor/efs/root +allow rild app_efs_file:dir r_dir_perms; +allow rild app_efs_file:file { rw_file_perms setattr }; + +# /efs/imei +allow rild imei_efs_file:dir r_dir_perms; +allow rild imei_efs_file:file r_file_perms; + +# /mnt/vendor/efs/ +allow rild prov_efs_file:dir r_dir_perms; +allow rild prov_efs_file:file r_file_perms; + +# /mnt/vendor/efs/nv_data.bin +allow rild bin_nv_data_efs_file:file { rw_file_perms setattr unlink }; + +# /proc/net/xt_qtaguid/iface_stat_fmt +allow rild proc_qtaguid_stat:file r_file_perms; + +# /proc/sys/net/ipv6/conf/*/accept_ra_defrtr +allow rild proc_net:file rw_file_perms; + +# mdc. +# persist.sys.omc_support +# ro.csc. +get_prop(rild, exported_config_prop); + +# ro.boot.cpboot, ril.NwNmId[0-9] +get_prop(rild, telephony_config_prop) + +# vendor.cbd. +set_prop(rild, vendor_cbd_prop) allow rild proc_net:file write; allow rild vendor_data_file:file create_file_perms; diff --git a/universal7885-common/sepolicy/vendor/secril_config_svc.te b/universal7885-common/sepolicy/vendor/secril_config_svc.te index 99da270..78f8a79 100644 --- a/universal7885-common/sepolicy/vendor/secril_config_svc.te +++ b/universal7885-common/sepolicy/vendor/secril_config_svc.te @@ -1 +1,21 @@ +# secril_config_svc.te + +type secril_config_svc, domain; +type secril_config_svc_exec, exec_type, vendor_file_type, file_type; + +# secril_config_svc is started by init, type transit from init domain to secril_config_svc domain +init_daemon_domain(secril_config_svc) + +# /mnt/vendor/ +allow secril_config_svc mnt_vendor_file:dir search; + +# /mnt/vendor/efs/factory.prop +# /mnt/vendor/efs/telephony.prop +allow secril_config_svc efs_file:dir search; +allow secril_config_svc efs_file:file r_file_perms; + +# ro.multisim. +# ro.vendor.multisim. +# ro.vendor.radio.default_network +set_prop(secril_config_svc, vendor_radio_prop) dontaudit secril_config_svc radio_control_prop:property_service set; diff --git a/universal7885-common/sepolicy/vendor/system_server.te b/universal7885-common/sepolicy/vendor/system_server.te index 754fd4c..0caaf12 100644 --- a/universal7885-common/sepolicy/vendor/system_server.te +++ b/universal7885-common/sepolicy/vendor/system_server.te @@ -1,3 +1,6 @@ +# system_server.te + +allow system_server proc_last_kmsg:file r_file_perms; # /dev/mali0 allow system_server gpu_device:chr_file rw_file_perms; diff --git a/universal7885-common/sepolicy/vendor/tzdaemon.te b/universal7885-common/sepolicy/vendor/tzdaemon.te index 548349c..676463a 100644 --- a/universal7885-common/sepolicy/vendor/tzdaemon.te +++ b/universal7885-common/sepolicy/vendor/tzdaemon.te @@ -1,4 +1,38 @@ +type tzdaemon, domain; +type tzdaemon_exec, exec_type, vendor_file_type, file_type; + +# tzdaemon is started by init, type transit from init domain to tzdaemon domain +init_daemon_domain(tzdaemon) + +set_prop(tzdaemon, vendor_tzdaemon_prop) +set_prop(tzdaemon, vendor_secureos_prop) + +allow tzdaemon tz_device:chr_file rw_file_perms; +allow tzdaemon tz_user_device:chr_file rw_file_perms; +allow tzdaemon tz_socket:sock_file { write }; + +# /dev/kmsg +allow tzdaemon kmsg_device:chr_file rw_file_perms; + +# /data/vendor/tee +allow tzdaemon tee_vendor_data_file:dir create_dir_perms; +allow tzdaemon tee_vendor_data_file:file create_file_perms; + +# /proc/stat +allow tzdaemon proc_stat:file r_file_perms; + +# /efs +allow tzdaemon efs_file:dir r_dir_perms; + +# /efs/tee/ +# /mnt/vendor/efs/tee/ +allow tzdaemon tee_efs_file:dir create_dir_perms; +allow tzdaemon tee_efs_file:file create_file_perms; + +# /mnt/vendor/ +allow tzdaemon mnt_vendor_file:dir r_dir_perms; + allow tzdaemon mnt_vendor_file:dir rw_dir_perms; allow tzdaemon efs_file:dir search; allow tzdaemon tee_efs_file:dir { add_name remove_name open create read search write }; -allow tzdaemon tee_efs_file:file { getattr open create read rename unlink write }; +allow tzdaemon tee_efs_file:file { getattr open create read rename unlink write }; \ No newline at end of file diff --git a/universal7885-common/sepolicy/samsung_slsi/tee/vendor/tztsdaemon.te b/universal7885-common/sepolicy/vendor/tztsdaemon.te similarity index 100% rename from universal7885-common/sepolicy/samsung_slsi/tee/vendor/tztsdaemon.te rename to universal7885-common/sepolicy/vendor/tztsdaemon.te diff --git a/universal7885-common/sepolicy/samsung_slsi/vendor/vndservice.te b/universal7885-common/sepolicy/vendor/vndservice.te similarity index 100% rename from universal7885-common/sepolicy/samsung_slsi/vendor/vndservice.te rename to universal7885-common/sepolicy/vendor/vndservice.te diff --git a/universal7885-common/sepolicy/samsung_slsi/vendor/vndservice_contexts b/universal7885-common/sepolicy/vendor/vndservice_contexts similarity index 100% rename from universal7885-common/sepolicy/samsung_slsi/vendor/vndservice_contexts rename to universal7885-common/sepolicy/vendor/vndservice_contexts