bunnypad/android_device_samsung_a20
Watch
1
0
Fork
You've already forked android_device_samsung_a20
 0
mirror of https://github.com/chararomandroid/android_device_samsung_a20 synced 2026-08-22 12:05:32 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions
247 commits 3 branches 0 tags 43 MiB
Commit graph android_device_samsung_a20/sepolicy
Author SHA1 Message Date
SamarV-121
22cd3a8290 universal7885: sepolicy: Cleanup unused contexts 
* Also rearrange them

Change-Id: I27cbe8e6d4a4a26461e23485f7ae46afcd7f7d74
Signed-off-by: SamarV-121 <samarvispute121@pm.me>
 2021-10-21 22:12:08 +09:00
SamarV-121
ae24c2ca02 universal7885: Label more power supply nodes 
* seen on a40

Change-Id: If0ab64794d9805bb2310d085e15c72c1c9190078
Signed-off-by: SamarV-121 <samarvispute121@pm.me>
 2021-10-21 22:12:08 +09:00
SamarV-121
3cb8448da3 universal7885: Label another rtc node 
* seen on a40

Change-Id: Ibaa65145a2e3874e33677acb0b2fd7350c004f23
Signed-off-by: SamarV-121 <samarvispute121@pm.me>
 2021-10-21 22:12:08 +09:00
SamarV-121
0d34c0e460 universal7885: Allow wifi HAL to read vendor_wifi_prop 
Change-Id: I3af8cb34f0555bfe8b1d4eeb629c80fcfb865afc
Signed-off-by: SamarV-121 <samarvispute121@gmail.com>
 2021-10-21 22:12:08 +09:00
Arne Coucheron
d0e9e5ef6a universal7885: sepolicy: Allow radio to make binder calls to gpuservice 
I have no idea why it needs to.

avc: denied { call } for scontext=u:r:radio:s0 tcontext=u:r:gpuservice:s0 tclass=binder permissive=0

Change-Id: I2a1eac04bb90423c2c2f4fb7a524cd03f3d31df2
Signed-off-by: SamarV-121 <samarvispute121@gmail.com>
 2021-10-21 22:12:08 +09:00
SamarV-121
c73e82afaf universal7885: sepolicy: Allow hwc HAL to write ion_device 
`W composer@2.1-se: type=1400 audit(0.0:144): avc: denied { write } for name="ion" dev="tmpfs" ino=13333 scontext=u:r:hal_graphics_composer_default:s0 tcontext=u:object_r:ion_device:s0 tclass=chr_file permissive=0`
`E libacryl: Failed to open /dev/ion [Permission denied]`

Change-Id: I4f6475d00981a21adddd7a99d5cfb902ee0959da
Signed-off-by: SamarV-121 <samarvispute121@gmail.com>
 2021-10-21 22:12:08 +09:00
SamarV-121
959d155c73 universal7885: sepolicy: Cleanup unused rules 
Change-Id: Idcf765bab4f43f67ecc21cd572b6264d691f9185
Signed-off-by: SamarV-121 <samarvispute121@gmail.com>
 2021-10-21 22:12:08 +09:00
SamarV-121
cdae24b850 universal7885: sepolicy: Allow zygote to read cmdline 
Signed-off-by: SamarV-121 <samarvispute121@gmail.com>
Change-Id: Ieb498872e834939da48da56ac13554b78da21915
 2021-10-21 22:12:08 +09:00
SamarV-121
c01abf68d7 universal7885: sepolicy: Label /mnt/vendor/cpefs 
`W vold    : Failed to open /mnt/vendor/cpefs: Permission denied`
`I auditd  : type=1400 audit(0.0:78): avc: denied { read } for comm="Binder:3484_2" name="/" dev="mmcblk0p4" ino=2 scontext=u:r:vold:s0 tcontext=u:object_r:mnt_vendor_file:s0 tclass=dir permissive=0`

Change-Id: Id8a194322977d4a697dd525df27f1b1a691a2475
Signed-off-by: SamarV-121 <samarvispute121@pm.me>
 2021-10-21 22:12:08 +09:00
SamarV-121
bea423e4a5 universal7885: sepolicy: Silence tee denial 
- `I auditd  : type=1107 audit(0.0:15): uid=0 auid=4294967295 ses=4294967295 subj=u:r:init:s0 msg='avc: denied { set } for propertteey=sys.mobicoredaemon.enable pid=3585 uid=1000 gid=1000 scontext=u:r:tee:s0 tcontext=u:object_r:system_prop:s0 tclass=property_service permissive=0'`
- this prop is used nowhere

Signed-off-by: SamarV-121 <samarvispute121@gmail.com>
Change-Id: I823e09cd6ee98fded5855d71ccec2d5f91454611
 2021-10-21 22:12:08 +09:00
SamarV-121
c4c7efdbac universal7885: sepolicy: Nuke neverallows 
Signed-off-by: SamarV-121 <samarvispute121@gmail.com>
Change-Id: Ie0339184617873ffe3b5dc25c277e740b34c8d86
 2021-10-21 22:12:08 +09:00
SamarV-121
aed3c1f464 universal7885: sepolicy: Allow kernel to read sysfs_virtual nodes 
`avc: denied { read } for name="hall_detect" dev="sysfs" ino=29566 scontext=u:r:kernel:s0 tcontext=u:object_r:sysfs_virtual:s0 tclass=file permissive=0`

Signed-off-by: SamarV-121 <samarvispute121@gmail.com>
Change-Id: I8fb01d8c4ce8b48fbf58a0688b04dc79664d2964
 2021-10-21 22:12:08 +09:00
SamarV-121
0b3a75c212 universal7885: sepolicy: Allow hwc HAL to read hwc.exynos.vsync_mode prop 
`W composer@2.1-se: type=1400 audit(0.0:23509): avc: denied { read } for name="u:object_r:default_prop:s0" dev="tmpfs" ino=2518 scontext=u:r:hal_graphics_composer_default:s0 tcontext=u:object_r:default_prop:s0 tclass=file permissive=0`
`E libc    : Access denied finding property "hwc.exynos.vsync_mode"`

Change-Id: Ib259886ae5560dc3b2e427890e46877c732ff7ba
Signed-off-by: SamarV-121 <samarvispute121@gmail.com>
 2021-10-21 22:12:08 +09:00
SamarV-121
6cfb2d5778 universal7885: sepolicy: Remove mobicore and trustonic HAL rules from here 
* Moved to common slsi sepolicy

Signed-off-by: SamarV-121 <samarvispute121@gmail.com>
Change-Id: I204b0eaad014f97166180b17678277c48a851491
 2021-10-21 22:12:08 +09:00
SamarV-121
ae0130bb13 universal7885: sepolicy: Resolve neverallows 
libsepol.report_failure: neverallow on line 9 of device/samsung/universal7885-common/sepolicy/vendor/mediacodec.te (or line 60921 of policy.conf) violated by allow hal_power_default hal_power_hwservice:hwservice_manager { add };
libsepol.report_failure: neverallow on line 5 of system/sepolicy/public/hal_power.te (or line 19140 of policy.conf) violated by allow mediacodec hal_power_hwservice:hwservice_manager { find };
libsepol.report_failure: neverallow on line 5 of system/sepolicy/public/hal_power.te (or line 19132 of policy.conf) violated by allow mediacodec hal_power_hwservice:hwservice_manager { add };
libsepol.report_failure: neverallow on line 990 of system/sepolicy/public/domain.te (or line 13095 of policy.conf) violated by allow zygote vendor_file:file { read };
libsepol.report_failure: neverallow on line 861 of system/sepolicy/public/domain.te (or line 12818 of policy.conf) violated by allow hal_fingerprint_default fingerprintd_data_file:dir { write };
libsepol.report_failure: neverallow on line 861 of system/sepolicy/public/domain.te (or line 12818 of policy.conf) violated by allow rild radio_data_file:dir { search };
libsepol.report_failure: neverallow on line 861 of system/sepolicy/public/domain.te (or line 12818 of policy.conf) violated by allow hal_camera_default camera_data_file:dir { search };
libsepol.report_failure: neverallow on line 861 of system/sepolicy/public/domain.te (or line 12818 of policy.conf) violated by allow hal_drm_widevine media_data_file:dir { search };
libsepol.report_failure: neverallow on line 831 of system/sepolicy/public/domain.te (or line 12761 of policy.conf) violated by allow rild radio_data_file:file { lock open watch watch_reads };

Change-Id: I47cc5117dda055ca4041e666bb7ffa8a51f9a3d9
Signed-off-by: SamarV-121 <samarvispute121@gmail.com>
 2021-10-21 22:12:08 +09:00
Jan Altensen
4fed82613c universal8890: build nfc hal from source 
Change-Id: Ief7ef8f2a597b1a978ea4b0ec4e41391cec03a99
Signed-off-by: SamarV-121 <samarvispute121@gmail.com>
 2021-10-21 22:12:08 +09:00
SamarV-121
1875a501a1 universal7885: sepolicy: Adapt for universal7885 and address denials 
* Everything's working fine now
 * todo: Cleanup unnecessary rules and vendor init

Change-Id: I4faea56383b5851bbd486f45d103e0bb94ebdd24
Signed-off-by: SamarV-121 <samarvispute121@gmail.com>
 2021-10-21 22:12:08 +09:00
Henrik Grimler
1db34af1a0 universal7885: Initial sepolicy 
* Based on {exynos9820,universal7880}-common
 * Squashed from https://github.com/exynos8895/android_device_samsung_universal8895-common/commits/lineage-17.1/sepolicy

Co-authored-by: Jan Altensen <info@stricted.net>
Change-Id: I5ff59c00498bc546db70277571e3d5c7595bc2b8
Signed-off-by: SamarV-121 <samarvispute121@gmail.com>
 2021-10-21 22:12:08 +09:00
SamarV-121
42fff278ba universal7885: Drop all prebuilt vendor hax 
* also Compile all HALs to vendor
 * Remove stuffs actually from vendor which we were disabling in system

Change-Id: I15f5a12a2c36238adf99ca9bbbd0c97475b72fc6
Signed-off-by: SamarV-121 <samarvispute121@gmail.com>
 2021-10-21 22:12:08 +09:00
Kyle Harrison
b8c8ac9fa3 universal7885: sepolicy: Fix exported_camera_prop denials 
Change-Id: Ib3abf88a4c71fcd1510a9b1a3cd496b85379c8b2
Signed-off-by: SamarV-121 <samarvispute121@gmail.com>
 2021-10-21 22:12:08 +09:00
SamarV-121
38d4aa0bbc universal7885: sepolicy: Silence sec_system_init_shell denials spam 
Change-Id: Ic8d22b933e730672379624f268e5ecf9362b93f7
Signed-off-by: SamarV-121 <samarvispute121@gmail.com>
 2021-10-21 22:12:08 +09:00
Kyle Harrison
3251d8d3f6 universal7885: sepolicy: Fix userspace_reboot prop denials 
- userspace_reboot_exported_prop
- userspace_reboot_config_prop

Change-Id: Ibec834df41345d1268b1eea4ae88b2fd5d37dd55
Signed-off-by: SamarV-121 <samarvispute121@gmail.com>
 2021-10-21 22:12:08 +09:00
SamarV-121
8f61f55a41 universal7885: sepolicy: Allow init to write watchdog_device 
Signed-off-by: SamarV-121 <samarvispute121@gmail.com>
Change-Id: I0ef79c41e3afd59742d0fcaed456bbdcd4dbc797
 2021-10-21 22:12:08 +09:00
JJ Lee
d1c45bdd1a universal7885: sepolicy: Allow hal audio to use wakelock 
Allow audio hal service to take wakelock.
This is needed to ensure Hotword sessions

Following denied pattern:
avc:  denied  { find } for
interface=android.system.suspend::ISystemSuspend
sid=u:r:hal_audio_default:s0 pid=7678
scontext=u:r:hal_audio_default:s0
tcontext=u:object_r:system_suspend_hwservice:s0
tclass=hwservice_manager permissive=0

Bug: 149454068
Test: build pass, "avc denied" cleared

Change-Id: I11b9f72e48241dc5b7d942ad3b519c6e19910579
Signed-off-by: JJ Lee <leejj@google.com>
Signed-off-by: SamarV-121 <samarvispute121@gmail.com>
 2021-10-21 22:12:08 +09:00
SamarV-121
d3f562dea9 universal7885: sepolicy: Allow health HAL to read otg and muic-manager node 
* also remove write access

Change-Id: Ib89b2a0c4b8e31a12c1f5262d8fd172c1a947b47
Signed-off-by: SamarV-121 <samarvispute121@gmail.com>
 2021-10-21 22:12:08 +09:00
SamarV-121
69841f6659 universal7885: sepolicy: Allow power HAL to write /sys/devices/system/cpu 
Change-Id: I7e263adfd51eb2e2680b4ae5214734c0d5c4805c
Signed-off-by: SamarV-121 <samarvispute121@gmail.com>
 2021-10-21 22:12:08 +09:00
ѕαмαя νιѕρυтє
5117c1c32d universal7885: sepolicy: Use system_internal_prop macro for system props 
* 19b99f18c8
 * Fixes -
neverallow check failed at out/target/product/m20lte/obj/ETC/plat_sepolicy.cil_intermediates/plat_sepolicy.cil:13204 from system/sepolicy/public/property.te:564
(neverallow base_typeattr_507 base_typeattr_508 (property_service (set)))
allow at out/target/product/m20lte/obj/ETC/system_ext_sepolicy.cil_intermediates/system_ext_sepolicy.cil:150
(allow hal_fastcharge_samsung sec_fastcharge_prop (property_service (set)))

Change-Id: Icc2bb1a51daad9c0b4ba9cda87a945effe780fdc
Signed-off-by: SamarV-121 <samarvispute121@gmail.com>
 2021-10-21 22:12:08 +09:00
SamarV-121
891ca20fab universal7885: power: Convert to blueprint 
* also rebrand to universal7885

Change-Id: Id2cddbef53eaecb2ee5df08ec635af55c104f97f
Signed-off-by: SamarV-121 <samarvispute121@gmail.com>
 2021-10-21 22:12:08 +09:00
Willi Ye
048849fcdf universal7885: Use custom Samsung sensors implementation 
* Get rid of com.samsung.permission.SSENSOR
* Map vendor proximity sensor type to generic

Signed-off-by: Jesse Chan <jc@lineageos.org>
Signed-off-by: SamarV-121 <samarvispute121@gmail.com>
Change-Id: I022d9061b144925b1291ba6294fe018faba07fed
 2021-10-21 22:12:08 +09:00
Francescodario Cuzzocrea
c5a166f294 universal7885: Build fastcharge hidl 
* https://review.lineageos.org/c/LineageOS/android_hardware_samsung/+/305684

Change-Id: Iec1a7faec24f0d5b4b1d2f1ef52b781368c5bd51
Signed-off-by: SamarV-121 <samarvispute121@gmail.com>
 2021-10-21 22:12:08 +09:00
SamarV-121
9dfefb7cfa universal7885: sepolicy: Allow power HAL to access touchpanel node 
Signed-off-by: SamarV-121 <samarvispute121@gmail.com>
 2021-10-21 22:12:08 +09:00
SamarV-121
25cadfd8aa universal7885: Compile OSS exynos power hal 
* https://github.com/LineageOS/android_hardware_samsung/tree/lineage-18.0/hidl/power

Signed-off-by: SamarV-121 <samarvispute121@gmail.com>
 2021-10-21 22:12:08 +09:00
SamarV-121
d687ffe488 universal7885: sepolicy: Address health HAL denials 
Change-Id: I7a5215175cdba42a8e9c422e138478733d172d26
Signed-off-by: SamarV-121 <samarvispute121@gmail.com>
 2021-10-21 22:12:08 +09:00
SamarV-121
62d8b28aa1 universal7885: Add Glove Mode support 
* Ref: e8b16f2cc2

Signed-off-by: SamarV-121 <samarvispute121@gmail.com>
 2021-10-21 22:12:08 +09:00
luk1337
c29c6e5616 universal7885: Use vendor_overlay for audio_policy_configuration.xml 
Signed-off-by: SamarV-121 <samarvispute121@gmail.com>
Change-Id: Ifaa42cb1547529085cb73e3a493e8064dae07215
 2021-10-21 22:12:07 +09:00
Jesse Chan
54be77083c universal7885: Address rro disabling sepolicy 
Change-Id: I528946f9cc6dbd6cb4558c3cdacbbc2343c8d376
Signed-off-by: SamarV-121 <samarvispute121@gmail.com>
 2021-10-21 22:12:07 +09:00
Alessandro Astone
2e4278499e universal7885: Make fastbootd permissive in non-user recovery builds 
Signed-off-by: SamarV-121 <samarvispute121@gmail.com>
 2021-10-21 22:12:07 +09:00
SamarV-121
cb0a5bcccb universal7885: Enable ZRAM 
Change-Id: Icd48749ad781ba48592fbcc2dc7c3ad88c659a57
Signed-off-by: SamarV-121 <samarvispute121@gmail.com>
 2021-10-21 22:12:07 +09:00