diff options
| -rw-r--r-- | BoardConfigCommon.mk | 4 | ||||
| -rw-r--r-- | rootdir/init.camera.rc | 17 | ||||
| -rw-r--r-- | rootdir/init.qcom.rc | 4 | ||||
| -rw-r--r-- | sepolicy/cameraserver_new.te | 18 | ||||
| -rw-r--r-- | sepolicy/cameraserver_old (renamed from sepolicy/cameraserver.te) | 5 | ||||
| -rw-r--r-- | sepolicy/credmgrd.te | 62 | ||||
| -rw-r--r-- | sepolicy/file_contexts | 20 | ||||
| -rw-r--r-- | sepolicy/idd.te | 43 | ||||
| -rw-r--r-- | sepolicy/workarounds.te | 149 | ||||
| -rw-r--r-- | sepolicy/workarounds_old | 232 |
10 files changed, 368 insertions, 186 deletions
diff --git a/BoardConfigCommon.mk b/BoardConfigCommon.mk index eb9b1f7..c98ee01 100644 --- a/BoardConfigCommon.mk +++ b/BoardConfigCommon.mk @@ -23,7 +23,9 @@ BOARD_VENDOR_PLATFORM := shinano # Kernel information BOARD_KERNEL_BASE := 0x00000000 BOARD_KERNEL_PAGESIZE := 2048 -BOARD_KERNEL_CMDLINE := androidboot.hardware=qcom user_debug=31 msm_rtb.filter=0x37 ehci-hcd.park=3 dwc3.maximum_speed=high dwc3_msm.prop_chg_detect=Y androidboot.selinux=permissive +BOARD_KERNEL_CMDLINE := androidboot.hardware=qcom user_debug=31 msm_rtb.filter=0x37 ehci-hcd.park=3 dwc3.maximum_speed=high dwc3_msm.prop_chg_detect=Y +BOARD_KERNEL_CMDLINE += androidboot.selinux=permissive +#BOARD_KERNEL_CMDLINE += androidboot.selinux=disabled BOARD_MKBOOTIMG_ARGS := --ramdisk_offset 0x02000000 --tags_offset 0x01E00000 BOARD_KERNEL_SEPARATED_DT := true TARGET_DTB_EXTRA_FLAGS := --force-v2 diff --git a/rootdir/init.camera.rc b/rootdir/init.camera.rc index a2cafe1..bf26bce 100644 --- a/rootdir/init.camera.rc +++ b/rootdir/init.camera.rc @@ -182,7 +182,8 @@ service scdnotifier_nitz /system/bin/scdnotifier nitz on property:sys.listeners.registered=true start wvkbd_installer -service wvkbd_installer /system/bin/logwrapper /system/bin/wvkbd +#service wvkbd_installer /system/bin/logwrapper /system/bin/wvkbd +service wvkbd_installer /system/bin/wvkbd user system group system oneshot @@ -193,12 +194,13 @@ service rmt_storage /system/bin/rmt_storage user root -service qcamerasvr /system/bin/logwrapper /system/bin/mm-qcamera-daemon +#service qcamerasvr /system/bin/logwrapper /system/bin/mm-qcamera-daemon +service qcamerasvr /system/bin/mm-qcamera-daemon class late_start user camera - group camera system inet input graphics -# group camera system inet input graphics credmgr_client cameraserver - seclabel u:r:mm-qcamerad:s0 +# group camera system inet input graphics + group camera system inet input graphics credmgr_client cameraserver +# seclabel u:r:mm-qcamerad:s0 # SONY: TrimArea Daemon # Last 2 args: start block(blk size 128k), number of blocks(partitionsize(kb)/128(kb)) @@ -211,13 +213,14 @@ service tad_static /sbin/tad_static /dev/block/bootdevice/by-name/TA 0,16 # tad_static is in rootfs, normal file_context does not work seclabel u:r:tad:s0 -service cameraserver /system/bin/logwrapper /system/bin/cameraserver +#service cameraserver /system/bin/logwrapper /system/bin/cameraserver +service cameraserver /system/bin/cameraserver class main user cameraserver group camera drmrpc inet media mediadrm net_bt net_bt_admin net_bw_acct credmgr_client trimarea system audio # group audio camera drmrpc inet media mediadrm net_bt net_bt_admin net_bw_acct credmgr_client ioprio rt 4 - seclabel u:r:cameraserver:s0 +# seclabel u:r:cameraserver:s0 writepid /dev/cpuset/foreground/tasks diff --git a/rootdir/init.qcom.rc b/rootdir/init.qcom.rc index f93ad53..8bad5f8 100644 --- a/rootdir/init.qcom.rc +++ b/rootdir/init.qcom.rc @@ -517,7 +517,7 @@ service irsc_util /system/bin/irsc_util "/etc/sec_config" service sensors /system/bin/sensors.qcom class main user root - group sensors radio system + group root service time_daemon /system/bin/time_daemon class late_start @@ -557,7 +557,7 @@ service drm /system/bin/drmserver service media /system/bin/mediaserver class main user media - group audio camera inet net_bt net_bt_admin net_bw_acct drmrpc mediadrm credmgr_client + group audio camera inet net_bt net_bt_admin net_bw_acct drmrpc mediadrm credmgr_client system ioprio rt 4 diff --git a/sepolicy/cameraserver_new.te b/sepolicy/cameraserver_new.te new file mode 100644 index 0000000..82196f2 --- /dev/null +++ b/sepolicy/cameraserver_new.te @@ -0,0 +1,18 @@ + + +allow mm-qcamerad camera_data_file:sock_file rw_file_perms; +allow mm-qcamerad camera_data_file:unix_dgram_socket sendto; +allow mm-qcamerad camera_data_file:unix_stream_socket connectto; +allow mm-qcamerad system_prop:property_service set; + +allow cameraserver camera_data_file:unix_dgram_socket sendto; +allow cameraserver camera_data_file:unix_stream_socket connectto; + +allow cameraserver ion_device:chr_file { ioctl open read }; + +#============= cameraserver ============== +allow cameraserver camera_device:chr_file { ioctl open read write }; +allow cameraserver mm-qcamerad:unix_stream_socket connectto; +allow cameraserver credmgrd:unix_stream_socket connectto; +allow cameraserver credmgrd_socket:sock_file write; + diff --git a/sepolicy/cameraserver.te b/sepolicy/cameraserver_old index 7db63bf..2a27807 100644 --- a/sepolicy/cameraserver.te +++ b/sepolicy/cameraserver_old @@ -21,3 +21,8 @@ allow mm-qcamerad camera_data_file:unix_stream_socket connectto; allow mm-qcamerad ion_device:chr_file { ioctl open read }; allow cameraserver ion_device:chr_file { ioctl open read }; + +allow cameraserver secd_socket:unix_dgram_socket sendto; +allow cameraserver secd_socket:unix_stream_socket connectto; +allow mm-qcamerad secd_socket:unix_dgram_socket sendto; +allow mm-qcamerad secd_socket:unix_stream_socket connectto; diff --git a/sepolicy/credmgrd.te b/sepolicy/credmgrd.te new file mode 100644 index 0000000..82c4929 --- /dev/null +++ b/sepolicy/credmgrd.te @@ -0,0 +1,62 @@ +#credmgrd define +type credmgrd, domain; +type credmgrd_exec, exec_type, file_type; +type credmgrd_data_file, file_type; +type credmgrd_socket, file_type; +init_daemon_domain(credmgrd); + +#credmgrd self +allow credmgrd self:socket create_socket_perms; +allow credmgrd self:file rw_file_perms; +allow credmgrd self:dir rw_file_perms; +allow credmgrd self:fifo_file rw_file_perms; +allow credmgrd credmgrd_data_file:file { getattr lock open read setattr write }; +allow credmgrd cache_file:dir { remove_name write }; +allow credmgrd credmgrd_data_file:dir { add_name open read remove_name write }; +allow credmgrd credmgrd_data_file:file { create unlink }; + + +#credmgdr tad +allow credmgrd tad_block_device:blk_file { read write ioctl open }; +allow credmgrd tad_socket:unix_dgram_socket sendto; +allow credmgrd tad_socket:unix_stream_socket connectto; +allow credmgrd tad:unix_stream_socket connectto; +allow credmgrd tad_socket:sock_file write; + +#credmgrd camera server +allow credmgrd camera_socket:file { read write getattr open }; +allow credmgrd camera_socket:unix_stream_socket sendto; +allow credmgrd camera_socket:unix_stream_socket connectto; + +#credmgrd mediaserver +allow mediaserver credmgrd:unix_stream_socket connectto; + +#credmgrd mm-qcamera +allow credmgrd mm-qcamerad:file { read write getattr open }; +allow credmgrd mm-qcamerad:unix_stream_socket sendto; +allow credmgrd mm-qcamerad:unix_stream_socket connectto; + +#credmgrd qseecomd tee +allow credmgrd tee_device:chr_file rw_file_perms; + +#credmgrd suntrold +allow credmgrd suntrold_sock_socket:unix_dgram_socket sendto; +allow credmgrd suntrold_sock_socket:unix_stream_socket connectto; +allow credmgrd suntrold_sock_socket:sock_file write; +allow credmgrd suntrold:unix_stream_socket connectto; + +#credmgrd iddd +allow credmgrd iddd:unix_dgram_socket sendto; +allow credmgrd iddd_file:dir search; +allow credmgrd iddd_file:sock_file write; +allow credmgrd iddd_file:unix_stream_socket connectto; +allow credmgrd iddd_file:unix_dgram_socket sendto; + + +#/mnt/idd is tmpfs +allow credmgrd tmpfs:lnk_file read; + +#credmgrd ion +allow credmgrd ion_device:chr_file { ioctl open read }; + + diff --git a/sepolicy/file_contexts b/sepolicy/file_contexts index 07853c1..22d0c1a 100644 --- a/sepolicy/file_contexts +++ b/sepolicy/file_contexts @@ -14,8 +14,8 @@ #iddd /system/bin/iddd u:object_r:iddd_exec:s0 /idd(/.*)? u:object_r:iddd_file:s0 - -/system/bin/credmgrd u:object_r:credmgr_exec:s0 +/mnt/idd u:object_r:iddd_file:s0 +/system/bin/idd-logreader u:object_r:iddd_exec:s0 # Taimport /data/etc(/.*) u:object_r:ta_data_file:s0 @@ -24,8 +24,6 @@ /dev/socket/secd_credmgr_sock u:object_r:secd_socket:s0 /dev/socket/secd_devsec_sock u:object_r:secd_socket:s0 /dev/socket/secd_ebl_sock u:object_r:secd_socket:s0 -/data/credmgr u:object_r:secd_data_file:s0 -/data/credmgr(/.*) u:object_r:secd_data_file:s0 /system/bin/scd u:object_r:scd_exec:s0 /data/scd u:object_r:scd_data:s0 @@ -34,6 +32,16 @@ /system/bin/wvkbd u:object_r:wv_exec:s0 + + +########### +#credmgrd +/system/bin/credmgrd u:object_r:credmgrd_exec:s0 +/dev/socket/credmgr u:object_r:credmgrd_socket:s0 +/data/credmgr(/.*)? u:object_r:credmgrd_data_file:s0 +/cache/CredentialManagerData u:object_r:credmgrd_data_file:s0 + + #cam_socket -/data/misc/camera/cam_socket1 u:object_r:camera_socket:s0 -/data/misc/camera/cam_socket2 u:object_r:camera_socket:s0 +/data/misc/camera(/.*) u:object_r:camera_data_file:s0 +/dev/block/mmcblk0p1 u:object_r:tad_block_device:s0 diff --git a/sepolicy/idd.te b/sepolicy/idd.te index 7c8cf69..bb3ef03 100644 --- a/sepolicy/idd.te +++ b/sepolicy/idd.te @@ -7,6 +7,10 @@ allow iddd self:socket create_socket_perms; allow iddd iddd_file:fifo_file rw_file_perms; allow iddd iddd_file:file rw_file_perms; allow iddd iddd_file:dir rw_file_perms; +allow iddd iddd_file:dir { add_name remove_name search }; +allow iddd iddd_file:file { create rename unlink }; +allow iddd iddd_file:sock_file { create setattr unlink write }; + type_transition iddd system_data_file:file iddd_file; @@ -24,43 +28,16 @@ type wv,domain; type wv_exec, exec_type, file_type; init_daemon_domain(wv) +#iddd logd +allow iddd logd:unix_stream_socket connectto; +allow iddd logdr_socket:sock_file write; #============= system_server ============== allow system_server credmgr_exec:dir search; allow system_server credmgr_exec:file { getattr open read }; allow system_server iddd_exec:dir search; allow system_server iddd_exec:file { getattr open read }; - -#============= iddd_exec ============== -allow iddd_exec default_prop:file { getattr open read }; -allow iddd_exec device:dir search; -allow iddd_exec devpts:chr_file { open read write }; -allow iddd_exec iddd_file:dir search; -allow iddd_exec iddd_file:file { lock open read write }; -allow iddd_exec init:fd use; -allow iddd_exec init:process sigchld; -allow iddd_exec kernel:system module_request; -allow iddd_exec log_tag_prop:file { getattr open read }; -allow iddd_exec logd:unix_dgram_socket sendto; -allow iddd_exec logd_prop:file { getattr open read }; -allow iddd_exec logdw_socket:sock_file write; -allow iddd_exec null_device:chr_file { read write }; -allow iddd_exec proc:lnk_file read; -allow iddd_exec properties_device:dir getattr; -allow iddd_exec properties_serial:file { getattr open read }; -allow iddd_exec property_contexts:file { getattr open read }; -allow iddd_exec ptmx_device:chr_file { ioctl open read write }; -allow iddd_exec rootfs:lnk_file { getattr read }; -allow iddd_exec self:dir { read search }; -allow iddd_exec self:file { execute execute_no_trans getattr open read }; -allow iddd_exec self:lnk_file read; -allow iddd_exec self:process { fork sigchld }; -allow iddd_exec self:unix_dgram_socket { connect create write }; -allow iddd_exec self:unix_stream_socket read; -allow iddd_exec sysfs:dir search; -allow iddd_exec sysfs_devices_system_cpu:dir search; -allow iddd_exec sysfs_devices_system_cpu:file { getattr open read }; -allow iddd_exec system_file:dir getattr; -#allow iddd_exec system_file:file { entrypoint execute getattr open read }; -allow iddd_exec urandom_device:chr_file { getattr ioctl open read }; +allow iddd tmpfs:lnk_file read; +#============= iddd ============== +allow iddd iddd_exec:file execute_no_trans; diff --git a/sepolicy/workarounds.te b/sepolicy/workarounds.te index 52203d8..ded4c69 100644 --- a/sepolicy/workarounds.te +++ b/sepolicy/workarounds.te @@ -1,164 +1,39 @@ -allow cameraserver camera_socket:dir { search write add_name }; -allow cameraserver camera_socket:file { read write getattr open }; -allow mm-qcamerad camera_socket:dir { search write add_name }; -allow mm-qcamerad camera_socket:file { read write getattr open }; - -#============= credmgr ============== -allow credmgr iddd:unix_dgram_socket sendto; -allow credmgr iddd_file:sock_file write; -allow credmgr secd_data_file:file { write getattr setattr read lock open }; -allow credmgr self:capability dac_override; -allow credmgr socket_device:sock_file write; -allow credmgr suntrold:unix_stream_socket connectto; -allow credmgr tad:unix_stream_socket connectto; -allow credmgr tad_socket:sock_file write; -allow credmgr tee_device:chr_file { read write open ioctl }; - #============= iddd ============== -allow iddd default_prop:property_service set; -allow iddd iddd_file:dir { remove_name search add_name }; -allow iddd iddd_file:file { rename create }; -allow iddd init:unix_stream_socket connectto; -allow iddd property_socket:sock_file write; -allow iddd iddd_file:file unlink; -allow iddd iddd_file:sock_file { write create unlink setattr }; -allow iddd logd:unix_stream_socket connectto; -allow iddd logdr_socket:sock_file write; -allow iddd self:netlink_socket { write bind create }; allow iddd system_file:file execute_no_trans; -#============= mediaserver ============== -allow mediaserver credmgr:unix_stream_socket connectto; -allow mediaserver socket_device:sock_file write; - -#============= suntrold ============== -allow suntrold self:capability dac_override; -allow suntrold socket_device:dir add_name; -allow suntrold socket_device:sock_file { create setattr }; -allow suntrold tad:unix_stream_socket connectto; -allow suntrold tad_socket:sock_file write; -allow suntrold tee_device:chr_file { read write ioctl open }; - -#============= system_server ============== -allow system_server ta_data_file:file { read open }; - -#============= ta_qmi ============== -allow ta_qmi self:capability { setuid setgid }; - -#============= tad ============== -allow tad block_device:blk_file { read write ioctl open }; -allow tad iddd:unix_dgram_socket sendto; -allow tad iddd_file:sock_file write; - -#============= thermanager ============== -allow thermanager sysfs_battery_supply:dir search; -allow thermanager sysfs_battery_supply:file { read write open }; - - - - -#============= init ============== -allow init block_device:blk_file setattr; -allow init debugfs:dir mounton; -allow init self:socket { read bind create write ioctl }; -allow init smem_log_device:chr_file { write ioctl }; -allow init socket_device:sock_file { create unlink setattr }; - -#============= taimport ============== -allow taimport ta_data_file:file unlink; - - -#============= credmgr ============== -allow credmgr ion_device:chr_file { ioctl open read }; - #============= init ============== allow init debugfs:file write; +allow init tad_block_device:blk_file setattr; #============= qti_init_shell ============== +allow qti_init_shell iddd_file:dir { getattr open read remove_name rmdir write }; allow qti_init_shell tad:unix_stream_socket connectto; allow qti_init_shell tad_socket:sock_file write; +allow qti_init_shell toolbox_exec:file entrypoint; -#============= scd ============== -allow scd socket_device:dir { add_name write }; -allow scd socket_device:sock_file { create setattr }; -allow scd sysfs:file { getattr open read }; - -#============= suntrold ============== -allow suntrold ion_device:chr_file { ioctl open read }; -#============= tad ============== -allow tad proc:file { open read }; -allow tad rootfs:file { entrypoint read }; - -#============= taimport ============== -allow taimport adbsecure_prop:property_service set; -allow taimport init:unix_stream_socket connectto; -allow taimport property_socket:sock_file write; +#============= mm-qcamerad ============== +allow mm-qcamerad camera_device:chr_file { ioctl open read write }; #============= thermanager ============== allow thermanager sysfs:file { open read }; - -#============= wv ============== -allow wv ion_device:chr_file { ioctl open read }; -allow wv socket_device:sock_file write; -allow wv suntrold:unix_stream_socket connectto; -allow wv tad:unix_stream_socket connectto; -allow wv tad_socket:sock_file write; -allow wv tee_device:chr_file { ioctl open read write }; - - - - - -#============= cameraserver ============== -allow cameraserver ta_data_file:dir { getattr open read }; -allow cameraserver sudaemon:unix_dgram_socket sendto; -allow cameraserver sudaemon:unix_stream_socket connectto; -allow cameraserver mm-qcamerad:unix_stream_socket sendto; -allow cameraserver mm-qcamerad:unix_stream_socket connectto; - - - -#============r credmgr ============== -allow credmgr ion_device:chr_file { ioctl open read }; - -#============= init ============== -allow init debugfs:file write; - -#============= mm-qcamerad ============== -allow mm-qcamerad system_file:file execmod; -allow mm-qcamerad system_prop:property_service set; -allow mm-qcamerad ta_data_file:dir { getattr open read }; - -#============= qti_init_shell ============== -allow qti_init_shell tad:unix_stream_socket connectto; -allow qti_init_shell tad_socket:sock_file write; +allow thermanager sysfs_battery_supply:dir search; +allow thermanager sysfs_battery_supply:file { open read write }; #============= scd ============== +allow scd scd_data:dir getattr; +allow scd scd_data:file { getattr open read write }; allow scd socket_device:dir { add_name write }; allow scd socket_device:sock_file { create setattr }; allow scd sysfs:file { getattr open read }; -#============= suntrold ============== -allow suntrold ion_device:chr_file { ioctl open read }; - -#============= tad ============== -allow tad proc:file { open read }; -allow tad rootfs:file { entrypoint read }; - -#============= taimport ============== -allow taimport adbsecure_prop:property_service set; -allow taimport init:unix_stream_socket connectto; -allow taimport property_socket:sock_file write; - -#============= thermanager ============== -allow thermanager sysfs:file { open read }; - #============= wv ============== allow wv ion_device:chr_file { ioctl open read }; -allow wv socket_device:sock_file write; allow wv suntrold:unix_stream_socket connectto; +allow wv suntrold_sock_socket:sock_file write; allow wv tad:unix_stream_socket connectto; allow wv tad_socket:sock_file write; allow wv tee_device:chr_file { ioctl open read write }; +#============= mediaserver ============== +allow mediaserver sensorservice_service:service_manager find; diff --git a/sepolicy/workarounds_old b/sepolicy/workarounds_old new file mode 100644 index 0000000..310c2f1 --- /dev/null +++ b/sepolicy/workarounds_old @@ -0,0 +1,232 @@ + +allow cameraserver camera_socket:dir { search write add_name }; +allow cameraserver camera_socket:file { read write getattr open }; +allow mm-qcamerad camera_socket:dir { search write add_name }; +allow mm-qcamerad camera_socket:file { read write getattr open }; + + +#============= credmgr ============== +allow credmgr iddd_file:dir search; +allow credmgr tmpfs:lnk_file read; + +#============= iddd ============== +allow iddd tmpfs:lnk_file read; + +#============= mm-qcamerad ============== +allow mm-qcamerad devpts:chr_file { open read write }; +allow mm-qcamerad mm-qcamerad_exec:file execute_no_trans; + +#============= qti_init_shell ============== +allow qti_init_shell iddd_file:dir { getattr open read remove_name rmdir write }; +allow qti_init_shell toolbox_exec:file entrypoint; + +#============= scd ============== +allow scd scd_data:dir getattr; +allow scd scd_data:file { getattr open read write }; + +#============= tad ============== +allow tad proc:file getattr; + +#============= vold ============== +allow vold iddd_file:dir { ioctl open read }; + + + +#============= credmgr ============== +allow credmgr iddd:unix_dgram_socket sendto; +allow credmgr iddd_file:sock_file write; +allow credmgr secd_data_file:file { write getattr setattr read lock open }; +allow credmgr self:capability dac_override; +allow credmgr socket_device:sock_file write; +allow credmgr suntrold:unix_stream_socket connectto; +allow credmgr tad:unix_stream_socket connectto; +allow credmgr tad_socket:sock_file write; +allow credmgr tee_device:chr_file { read write open ioctl }; + +#============= iddd ============== +allow iddd default_prop:property_service set; +allow iddd iddd_file:dir { remove_name search add_name }; +allow iddd iddd_file:file { rename create }; +allow iddd init:unix_stream_socket connectto; +allow iddd property_socket:sock_file write; +allow iddd iddd_file:file unlink; +allow iddd iddd_file:sock_file { write create unlink setattr }; +allow iddd logd:unix_stream_socket connectto; +allow iddd logdr_socket:sock_file write; +allow iddd self:netlink_socket { write bind create }; +allow iddd system_file:file execute_no_trans; + +#============= mediaserver ============== +allow mediaserver credmgr:unix_stream_socket connectto; +allow mediaserver socket_device:sock_file write; + +#============= suntrold ============== +allow suntrold self:capability dac_override; +allow suntrold socket_device:dir add_name; +allow suntrold socket_device:sock_file { create setattr }; +allow suntrold tad:unix_stream_socket connectto; +allow suntrold tad_socket:sock_file write; +allow suntrold tee_device:chr_file { read write ioctl open }; + +#============= system_server ============== +allow system_server ta_data_file:file { read open }; + +#============= ta_qmi ============== +allow ta_qmi self:capability { setuid setgid }; + +#============= tad ============== +allow tad block_device:blk_file { read write ioctl open }; +allow tad iddd:unix_dgram_socket sendto; +allow tad iddd_file:sock_file write; + +#============= thermanager ============== +allow thermanager sysfs_battery_supply:dir search; +allow thermanager sysfs_battery_supply:file { read write open }; + + + + +#============= init ============== +allow init block_device:blk_file setattr; +allow init debugfs:dir mounton; +allow init self:socket { read bind create write ioctl }; +allow init smem_log_device:chr_file { write ioctl }; +allow init socket_device:sock_file { create unlink setattr }; + +#============= taimport ============== +allow taimport ta_data_file:file unlink; + + +#============= credmgr ============== +allow credmgr ion_device:chr_file { ioctl open read }; + +#============= init ============== +allow init debugfs:file write; + +#============= qti_init_shell ============== +allow qti_init_shell tad:unix_stream_socket connectto; +allow qti_init_shell tad_socket:sock_file write; + +#============= scd ============== +allow scd socket_device:dir { add_name write }; +allow scd socket_device:sock_file { create setattr }; +allow scd sysfs:file { getattr open read }; + +#============= suntrold ============== +allow suntrold ion_device:chr_file { ioctl open read }; + +#============= tad ============== +allow tad proc:file { open read }; +allow tad rootfs:file { entrypoint read }; + +#============= taimport ============== +allow taimport adbsecure_prop:property_service set; +allow taimport init:unix_stream_socket connectto; +allow taimport property_socket:sock_file write; + +#============= thermanager ============== +allow thermanager sysfs:file { open read }; + +#============= wv ============== +allow wv ion_device:chr_file { ioctl open read }; +allow wv socket_device:sock_file write; +allow wv suntrold:unix_stream_socket connectto; +allow wv tad:unix_stream_socket connectto; +allow wv tad_socket:sock_file write; +allow wv tee_device:chr_file { ioctl open read write }; + + + + + +#============= cameraserver ============== +allow cameraserver ta_data_file:dir { getattr open read }; +allow cameraserver sudaemon:unix_dgram_socket sendto; +allow cameraserver sudaemon:unix_stream_socket connectto; +allow cameraserver mm-qcamerad:unix_stream_socket sendto; +allow cameraserver mm-qcamerad:unix_stream_socket connectto; + + + +#============r credmgr ============== +allow credmgr ion_device:chr_file { ioctl open read }; + +#============= init ============== +allow init debugfs:file write; + +#============= mm-qcamerad ============== +allow mm-qcamerad system_file:file execmod; +allow mm-qcamerad system_prop:property_service set; +allow mm-qcamerad ta_data_file:dir { getattr open read }; + +#============= qti_init_shell ============== +allow qti_init_shell tad:unix_stream_socket connectto; +allow qti_init_shell tad_socket:sock_file write; + +#============= scd ============== +allow scd socket_device:dir { add_name write }; +allow scd socket_device:sock_file { create setattr }; +allow scd sysfs:file { getattr open read }; + +#============= suntrold ============== +allow suntrold ion_device:chr_file { ioctl open read }; + +#============= tad ============== +allow tad proc:file { open read }; +allow tad rootfs:file { entrypoint read }; + +#============= taimport ============== +allow taimport adbsecure_prop:property_service set; +allow taimport init:unix_stream_socket connectto; +allow taimport property_socket:sock_file write; + +#============= thermanager ============== +allow thermanager sysfs:file { open read }; + +#============= wv ============== +allow wv ion_device:chr_file { ioctl open read }; +allow wv socket_device:sock_file write; +allow wv suntrold:unix_stream_socket connectto; +allow wv tad:unix_stream_socket connectto; +allow wv tad_socket:sock_file write; +allow wv tee_device:chr_file { ioctl open read write }; + + +#============= mm-qcamerad_exec ============== +allow mm-qcamerad_exec camera_data_file:dir { add_name remove_name search write }; +allow mm-qcamerad_exec camera_data_file:sock_file { create unlink }; +allow mm-qcamerad_exec debug_prop:file { getattr open read }; +allow mm-qcamerad_exec debugfs:dir search; +allow mm-qcamerad_exec debugfs_trace_marker:file { open write }; +allow mm-qcamerad_exec debugfs_tracing:dir search; +allow mm-qcamerad_exec default_prop:file { getattr open read }; +allow mm-qcamerad_exec device:dir search; +allow mm-qcamerad_exec init:fd use; +allow mm-qcamerad_exec init:process sigchld; +allow mm-qcamerad_exec ion_device:chr_file { open read }; +allow mm-qcamerad_exec kernel:system module_request; +allow mm-qcamerad_exec null_device:chr_file { read write }; +allow mm-qcamerad_exec proc:lnk_file read; +allow mm-qcamerad_exec properties_device:dir { getattr search }; +allow mm-qcamerad_exec properties_serial:file { getattr open read }; +allow mm-qcamerad_exec property_contexts:file { getattr open read }; +allow mm-qcamerad_exec rootfs:lnk_file { getattr read }; +allow mm-qcamerad_exec self:dir { read search }; +allow mm-qcamerad_exec self:file { getattr open read }; +allow mm-qcamerad_exec self:lnk_file read; +allow mm-qcamerad_exec self:process { fork setsched }; +allow mm-qcamerad_exec self:unix_dgram_socket { bind create read }; +allow mm-qcamerad_exec self:unix_stream_socket { bind connect create listen write }; +allow mm-qcamerad_exec sysfs:dir search; +allow mm-qcamerad_exec sysfs_devices_system_cpu:dir search; +allow mm-qcamerad_exec sysfs_devices_system_cpu:file { getattr open read }; +allow mm-qcamerad_exec system_data_file:dir search; +allow mm-qcamerad_exec urandom_device:chr_file { getattr ioctl open read }; +allow mm-qcamerad_exec video_device:chr_file { ioctl open read write }; + + +#============= cameraserver ============== +allow cameraserver mm-qcamerad_exec:unix_dgram_socket sendto; +allow cameraserver credmgr:unix_stream_socket connectto; +allow cameraserver secd_socket:sock_file write; + |