sm8250-common: Re:Start sepolicy
* Drop all old rules, but keep tri-state-key. * Also introduce dashd/wlchgd domain as they are needed for seclabels. Change-Id: I0a7121f51d106d927866aead746a49b3dea6a149
This commit is contained in:
LuK1337
4
sepolicy/vendor/dashd.te
vendored
Normal file
4
sepolicy/vendor/dashd.te
vendored
Normal file
@@ -0,0 +1,4 @@
|
||||
type dashd, domain;
|
||||
type dashd_exec, exec_type, vendor_file_type, file_type;
|
||||
|
||||
init_daemon_domain(dashd)
|
||||
14
sepolicy/vendor/device.te
vendored
14
sepolicy/vendor/device.te
vendored
@@ -1,14 +0,0 @@
|
||||
type ab_block_device, dev_type;
|
||||
type custom_ab_block_device, dev_type;
|
||||
type efs_boot_dev, dev_type;
|
||||
type gpt_block_device, dev_type;
|
||||
type limits_block_device, dev_type;
|
||||
type mdtp_device, dev_type;
|
||||
type modem_block_device, dev_type;
|
||||
type modem_efs_partition_device, dev_type;
|
||||
type persist_block_device, dev_type;
|
||||
type rpmb_device, dev_type;
|
||||
type sg_device, dev_type;
|
||||
type ssd_block_device, dev_type;
|
||||
type uefi_block_device, dev_type;
|
||||
type xbl_block_device, dev_type;
|
||||
12
sepolicy/vendor/fastbootd.te
vendored
12
sepolicy/vendor/fastbootd.te
vendored
@@ -1,12 +0,0 @@
|
||||
recovery_only(`
|
||||
allow fastbootd {
|
||||
custom_ab_block_device
|
||||
recovery_block_device
|
||||
xbl_block_device
|
||||
uefi_block_device
|
||||
modem_block_device
|
||||
mdtp_device
|
||||
}:blk_file { rw_file_perms };
|
||||
')
|
||||
|
||||
allow fastbootd tmpfs:lnk_file { getattr read };
|
||||
2
sepolicy/vendor/file.te
vendored
2
sepolicy/vendor/file.te
vendored
@@ -1,2 +0,0 @@
|
||||
# sysfs
|
||||
type sysfs_scsi_target, fs_type, sysfs_type;
|
||||
88
sepolicy/vendor/file_contexts
vendored
88
sepolicy/vendor/file_contexts
vendored
@@ -1,88 +0,0 @@
|
||||
# devices
|
||||
/dev/sg[0-9]+ u:object_r:sg_device:s0
|
||||
|
||||
# graphics device
|
||||
/dev/mdss_rotator u:object_r:graphics_device:s0
|
||||
/dev/dri/card0 u:object_r:graphics_device:s0
|
||||
/dev/dri/controlD64 u:object_r:graphics_device:s0
|
||||
/dev/dri/renderD128 u:object_r:graphics_device:s0
|
||||
|
||||
# sysfs files
|
||||
/sys/class/thermal(/.*)? u:object_r:sysfs_thermal:s0
|
||||
/sys/devices(/platform)?/soc/[a-f0-9]+.ufshc/host0/target0:0:0/0:0:0:[0-9]+/scsi_generic(/.*)? u:object_r:sysfs_scsi_target:s0
|
||||
/sys/devices/platform/soc/ae00000.qcom,mdss_mdp/backlight(/.*)? u:object_r:sysfs_graphics:s0
|
||||
/sys/devices/virtual/thermal(/.*)? u:object_r:sysfs_thermal:s0
|
||||
|
||||
# UFS Devices
|
||||
/dev/block/platform/soc/1d84000\.ufshc/by-name/system u:object_r:system_block_device:s0
|
||||
/dev/block/platform/soc/1d84000\.ufshc/by-name/vendor u:object_r:system_block_device:s0
|
||||
/dev/block/platform/soc/1d84000\.ufshc/by-name/product u:object_r:system_block_device:s0
|
||||
/dev/block/platform/soc/1d84000\.ufshc/by-name/odm u:object_r:system_block_device:s0
|
||||
/dev/block/platform/soc/1d84000\.ufshc/by-name/metadata u:object_r:metadata_block_device:s0
|
||||
/dev/block/platform/soc/1d84000\.ufshc/by-name/userdata u:object_r:userdata_block_device:s0
|
||||
/dev/block/platform/soc/1d84000\.ufshc/by-name/boot u:object_r:boot_block_device:s0
|
||||
/dev/block/platform/soc/1d84000\.ufshc/by-name/fsc u:object_r:modem_efs_partition_device:s0
|
||||
/dev/block/platform/soc/1d84000\.ufshc/by-name/fsg u:object_r:modem_efs_partition_device:s0
|
||||
/dev/block/platform/soc/1d84000\.ufshc/by-name/modemst1 u:object_r:modem_efs_partition_device:s0
|
||||
/dev/block/platform/soc/1d84000\.ufshc/by-name/modemst2 u:object_r:modem_efs_partition_device:s0
|
||||
/dev/block/platform/soc/1d84000\.ufshc/by-name/ssd u:object_r:ssd_block_device:s0
|
||||
/dev/block/platform/soc/1d84000\.ufshc/by-name/misc u:object_r:misc_block_device:s0
|
||||
/dev/block/platform/soc/1d84000\.ufshc/by-name/rpm u:object_r:rpmb_device:s0
|
||||
/dev/block/platform/soc/1d84000\.ufshc/by-name/recovery u:object_r:recovery_block_device:s0
|
||||
/dev/block/platform/soc/1d84000\.ufshc/by-name/cache u:object_r:cache_block_device:s0
|
||||
/dev/block/platform/soc/1d84000\.ufshc/by-name/frp u:object_r:frp_block_device:s0
|
||||
/dev/block/platform/soc/1d84000\.ufshc/by-name/mdtp u:object_r:mdtp_device:s0
|
||||
/dev/block/platform/soc/1d84000\.ufshc/by-name/mdm1m9kefs1 u:object_r:efs_boot_dev:s0
|
||||
/dev/block/platform/soc/1d84000\.ufshc/by-name/mdm1m9kefs2 u:object_r:efs_boot_dev:s0
|
||||
/dev/block/platform/soc/1d84000\.ufshc/by-name/mdm1m9kefs3 u:object_r:efs_boot_dev:s0
|
||||
/dev/block/platform/soc/1d84000\.ufshc/by-name/mdmddr u:object_r:efs_boot_dev:s0
|
||||
|
||||
# A/B partitions.
|
||||
/dev/block/platform/soc/1d84000\.ufshc/by-name/abl_[ab] u:object_r:custom_ab_block_device:s0
|
||||
/dev/block/platform/soc/1d84000\.ufshc/by-name/aop_[ab] u:object_r:custom_ab_block_device:s0
|
||||
/dev/block/platform/soc/1d84000\.ufshc/by-name/apdp_[ab] u:object_r:custom_ab_block_device:s0
|
||||
/dev/block/platform/soc/1d84000\.ufshc/by-name/bluetooth_[ab] u:object_r:modem_block_device:s0
|
||||
/dev/block/platform/soc/1d84000\.ufshc/by-name/boot_[ab] u:object_r:boot_block_device:s0
|
||||
/dev/block/platform/soc/1d84000\.ufshc/by-name/cmnlib_[ab] u:object_r:custom_ab_block_device:s0
|
||||
/dev/block/platform/soc/1d84000\.ufshc/by-name/cmnlib64_[ab] u:object_r:custom_ab_block_device:s0
|
||||
/dev/block/platform/soc/1d84000\.ufshc/by-name/core_nhlos_[ab] u:object_r:custom_ab_block_device:s0
|
||||
/dev/block/platform/soc/1d84000\.ufshc/by-name/devcfg_[ab] u:object_r:custom_ab_block_device:s0
|
||||
/dev/block/platform/soc/1d84000\.ufshc/by-name/dsp_[ab] u:object_r:custom_ab_block_device:s0
|
||||
/dev/block/platform/soc/1d84000\.ufshc/by-name/dtbo_[ab] u:object_r:custom_ab_block_device:s0
|
||||
/dev/block/platform/soc/1d84000\.ufshc/by-name/featenabler_[ab] u:object_r:custom_ab_block_device:s0
|
||||
/dev/block/platform/soc/1d84000\.ufshc/by-name/hyp_[ab] u:object_r:custom_ab_block_device:s0
|
||||
/dev/block/platform/soc/1d84000\.ufshc/by-name/keymaster_[ab] u:object_r:custom_ab_block_device:s0
|
||||
/dev/block/platform/soc/1d84000\.ufshc/by-name/mdtp_[ab] u:object_r:mdtp_device:s0
|
||||
/dev/block/platform/soc/1d84000\.ufshc/by-name/mdtpsecapp_[ab] u:object_r:mdtp_device:s0
|
||||
/dev/block/platform/soc/1d84000\.ufshc/by-name/modem_[ab] u:object_r:modem_block_device:s0
|
||||
/dev/block/platform/soc/1d84000\.ufshc/by-name/msadp_[ab] u:object_r:custom_ab_block_device:s0
|
||||
/dev/block/platform/soc/1d84000\.ufshc/by-name/multiimgqti_[ab] u:object_r:custom_ab_block_device:s0
|
||||
/dev/block/platform/soc/1d84000\.ufshc/by-name/persist u:object_r:persist_block_device:s0
|
||||
/dev/block/platform/soc/1d84000\.ufshc/by-name/pmic_[ab] u:object_r:custom_ab_block_device:s0
|
||||
/dev/block/platform/soc/1d84000\.ufshc/by-name/qupfw_[ab] u:object_r:custom_ab_block_device:s0
|
||||
/dev/block/platform/soc/1d84000\.ufshc/by-name/rpm_[ab] u:object_r:custom_ab_block_device:s0
|
||||
/dev/block/platform/soc/1d84000\.ufshc/by-name/system_[ab] u:object_r:system_block_device:s0
|
||||
/dev/block/platform/soc/1d84000\.ufshc/by-name/tz_[ab] u:object_r:custom_ab_block_device:s0
|
||||
/dev/block/platform/soc/1d84000\.ufshc/by-name/vbmeta_[ab] u:object_r:custom_ab_block_device:s0
|
||||
/dev/block/platform/soc/1d84000\.ufshc/by-name/vendor_[ab] u:object_r:system_block_device:s0
|
||||
/dev/block/platform/soc/1d84000\.ufshc/by-name/product_[ab] u:object_r:system_block_device:s0
|
||||
/dev/block/platform/soc/1d84000\.ufshc/by-name/odm_[ab] u:object_r:system_block_device:s0
|
||||
/dev/block/platform/soc/1d84000\.ufshc/by-name/xbl_[ab] u:object_r:xbl_block_device:s0
|
||||
/dev/block/platform/soc/1d84000\.ufshc/by-name/xbl_config_[ab] u:object_r:custom_ab_block_device:s0
|
||||
/dev/block/platform/soc/1d84000\.ufshc/by-name/imagefv_[ab] u:object_r:custom_ab_block_device:s0
|
||||
/dev/block/platform/soc/1d84000\.ufshc/by-name/multiimgoem_[ab] u:object_r:custom_ab_block_device:s0
|
||||
/dev/block/platform/soc/1d84000\.ufshc/by-name/uefisecapp_[ab] u:object_r:uefi_block_device:s0
|
||||
/dev/block/platform/soc/1d84000\.ufshc/by-name/recovery_[ab] u:object_r:recovery_block_device:s0
|
||||
/dev/block/platform/soc/1d84000\.ufshc/by-name/vbmeta_system_[ab] u:object_r:custom_ab_block_device:s0
|
||||
/dev/block/platform/soc/1d84000\.ufshc/by-name/vbmeta_product_[ab] u:object_r:custom_ab_block_device:s0
|
||||
/dev/block/platform/soc/1d84000\.ufshc/by-name/super u:object_r:super_block_device:s0
|
||||
|
||||
# Block device holding the GPT, where the A/B attributes are stored.
|
||||
/dev/block/platform/soc/1d84000\.ufshc/sd[ade] u:object_r:gpt_block_device:s0
|
||||
|
||||
# Block devices for the drive that holds the xbl_a and xbl_b partitions.
|
||||
/dev/block/platform/soc/1d84000\.ufshc/sd[bc] u:object_r:xbl_block_device:s0
|
||||
|
||||
# limits Partitions
|
||||
/dev/block/platform/soc/1d84000\.ufshc/by-name/limits u:object_r:limits_block_device:s0
|
||||
/dev/block/platform/soc/1d84000\.ufshc/by-name/limits-cdsp u:object_r:limits_block_device:s0
|
||||
64
sepolicy/vendor/hal_bootctl.te
vendored
64
sepolicy/vendor/hal_bootctl.te
vendored
@@ -1,64 +0,0 @@
|
||||
# Copyright (c) 2018, The Linux Foundation. All rights reserved.
|
||||
#
|
||||
# Redistribution and use in source and binary forms, with or without
|
||||
# modification, are permitted provided that the following conditions are
|
||||
# met:
|
||||
# * Redistributions of source code must retain the above copyright
|
||||
# notice, this list of conditions and the following disclaimer.
|
||||
# * Redistributions in binary form must reproduce the above
|
||||
# copyright notice, this list of conditions and the following
|
||||
# disclaimer in the documentation and/or other materials provided
|
||||
# with the distribution.
|
||||
# * Neither the name of The Linux Foundation nor the names of its
|
||||
# contributors may be used to endorse or promote products derived
|
||||
# from this software without specific prior written permission.
|
||||
#
|
||||
# THIS SOFTWARE IS PROVIDED "AS IS" AND ANY EXPRESS OR IMPLIED
|
||||
# WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
|
||||
# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT
|
||||
# ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS
|
||||
# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
|
||||
# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
|
||||
# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
|
||||
# BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
|
||||
# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
|
||||
# OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
|
||||
# IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
# These are the permissions required to use the boot_control HAL implemented
|
||||
# here: hardware/qcom/bootctrl/boot_control.c
|
||||
|
||||
# Getting and setting GPT attributes for the bootloader iterates over all the
|
||||
# partition names in the block_device directory /dev/block/.../by-name
|
||||
allow hal_bootctl block_device:dir r_dir_perms;
|
||||
|
||||
# Edit the attributes stored in the GPT.
|
||||
allow hal_bootctl gpt_block_device:blk_file rw_file_perms;
|
||||
allow hal_bootctl root_block_device:blk_file rw_file_perms;
|
||||
|
||||
# Allow boot_control_hal to get attributes on all the A/B partitions.
|
||||
allow hal_bootctl boot_block_device:blk_file rw_file_perms;
|
||||
allow hal_bootctl ab_block_device:blk_file getattr;
|
||||
allow hal_bootctl xbl_block_device:blk_file getattr;
|
||||
allow hal_bootctl modem_block_device:blk_file getattr;
|
||||
allow hal_bootctl system_block_device:blk_file getattr;
|
||||
allow hal_bootctl custom_ab_block_device:blk_file getattr;
|
||||
allow hal_bootctl recovery_block_device:blk_file getattr;
|
||||
allow hal_bootctl mdtp_device:blk_file getattr;
|
||||
allow hal_bootctl_server misc_block_device:blk_file rw_file_perms;
|
||||
|
||||
# Access /dev/sgN devices (generic SCSI) to write the
|
||||
# A/B slot selection for the XBL partition. Allow also to issue a
|
||||
# UFS_IOCTL_QUERY ioctl.
|
||||
allow hal_bootctl sg_device:chr_file rw_file_perms;
|
||||
|
||||
# The sys_rawio denial message is benign, and shows up due to a capability()
|
||||
# call made by the scsi driver to check for CAP_SYS_RAWIO. Not having this
|
||||
# does not result in a error
|
||||
dontaudit hal_bootctl self:capability sys_rawio;
|
||||
|
||||
# Read the sysfs to lookup what /dev/sgN device
|
||||
# corresponds to the XBL partitions.
|
||||
allow hal_bootctl sysfs_scsi_target:dir r_dir_perms;
|
||||
|
||||
# Write to the XBL devices.
|
||||
allow hal_bootctl xbl_block_device:blk_file rw_file_perms;
|
||||
39
sepolicy/vendor/update_engine_common.te
vendored
39
sepolicy/vendor/update_engine_common.te
vendored
@@ -1,39 +0,0 @@
|
||||
# Copyright (c) 2019, The Linux Foundation. All rights reserved.
|
||||
#
|
||||
# Redistribution and use in source and binary forms, with or without
|
||||
# modification, are permitted provided that the following conditions are
|
||||
# met:
|
||||
# * Redistributions of source code must retain the above copyright
|
||||
# notice, this list of conditions and the following disclaimer.
|
||||
# * Redistributions in binary form must reproduce the above
|
||||
# copyright notice, this list of conditions and the following
|
||||
# disclaimer in the documentation and/or other materials provided
|
||||
# with the distribution.
|
||||
# * Neither the name of The Linux Foundation nor the names of its
|
||||
# contributors may be used to endorse or promote products derived
|
||||
# from this software without specific prior written permission.
|
||||
#
|
||||
# THIS SOFTWARE IS PROVIDED "AS IS" AND ANY EXPRESS OR IMPLIED
|
||||
# WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
|
||||
# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT
|
||||
# ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS
|
||||
# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
|
||||
# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
|
||||
# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
|
||||
# BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
|
||||
# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
|
||||
# OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
|
||||
# IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
|
||||
# Allow update_engine and update_engine_sideload (recovery) read/write on the
|
||||
# device-specific partitions it should update.
|
||||
allow update_engine_common {
|
||||
custom_ab_block_device
|
||||
xbl_block_device
|
||||
ssd_block_device
|
||||
modem_block_device
|
||||
uefi_block_device
|
||||
recovery_block_device
|
||||
}:blk_file rw_file_perms;
|
||||
|
||||
allow update_engine_common tmpfs:lnk_file r_file_perms;
|
||||
4
sepolicy/vendor/wlchgd.te
vendored
Normal file
4
sepolicy/vendor/wlchgd.te
vendored
Normal file
@@ -0,0 +1,4 @@
|
||||
type wlchgd, domain;
|
||||
type wlchgd_exec, exec_type, vendor_file_type, file_type;
|
||||
|
||||
init_daemon_domain(wlchgd)
|
||||
Reference in New Issue
Block a user