wayne-common: Add BOARD_PLAT_[PUBLIC|PRIVATE]_SEPOLICY_DIR

Move vendor policy to vendor and add a place for system extensions.
Also add such an extension: a labeling of the qti.ims.ext service.

Bug: 38151691
Bug: 62041272
Test: Policy binary identical before and after, except plat_service_contexts
has new service added.

Change-Id: I1493c4c8876c4446a1de46b39942098bf49c79f8

39 files changed, 226 insertions, 0 deletions

diff --git a/sepolicy/vendor/app.te b/sepolicy/vendor/app.te
new file mode 100644
index 0000000..c61957b
--- /dev/null
+++ b/sepolicy/vendor/app.te
@@ -0,0 +1,6 @@
+# Allow appdomain to get vendor_camera_prop
+get_prop(appdomain, vendor_camera_prop)
+allow { appdomain -isolated_app } hal_mlipay_hwservice:hwservice_manager find;
+binder_call({ appdomain -isolated_app }, hal_mlipay_default)
+get_prop({ appdomain -isolated_app }, mlipay_prop)
+get_prop({ appdomain -isolated_app }, hal_fingerprint_prop)
diff --git a/sepolicy/vendor/atfwd.te b/sepolicy/vendor/atfwd.te
new file mode 100644
index 0000000..a60277a
--- /dev/null
+++ b/sepolicy/vendor/atfwd.te
@@ -0,0 +1 @@
+allow atfwd sysfs:file read;
diff --git a/sepolicy/vendor/device.te b/sepolicy/vendor/device.te
new file mode 100644
index 0000000..b84e726
--- /dev/null
+++ b/sepolicy/vendor/device.te
@@ -0,0 +1,2 @@
+type fingerprint_device, dev_type;
+type spidev_device, dev_type;
diff --git a/sepolicy/vendor/file.te b/sepolicy/vendor/file.te
new file mode 100644
index 0000000..2ca38b9
--- /dev/null
+++ b/sepolicy/vendor/file.te
@@ -0,0 +1,8 @@
+type debugfs_wlan, debugfs_type, fs_type;
+type ir_dev_file, file_type;
+type proc_dt2w, fs_type, proc_type;
+type fingerprint_data_file, file_type, data_file_type, core_data_file_type;
+type fingerprint_sysfs, fs_type, sysfs_type;
+type vendor_keylayout_file, file_type, vendor_file_type;
+type sysfs_light, fs_type, sysfs_type;
+type thermal_data_file, file_type, data_file_type;
diff --git a/sepolicy/vendor/file_contexts b/sepolicy/vendor/file_contexts
new file mode 100644
index 0000000..6939ff5
--- /dev/null
+++ b/sepolicy/vendor/file_contexts
@@ -0,0 +1,45 @@
+# Biometric
+/(vendor|system/vendor)/bin/hw/android\.hardware\.biometrics\.fingerprint@2\.1-service\.xiaomi_wayne u:object_r:hal_fingerprint_wayne_exec:s0
+
+# Fpc Fingerprint
+/sys/devices/soc/soc:fpc1020(/.*)?		u:object_r:fingerprint_sysfs:s0
+
+# For Goodix fingerprint
+/dev/goodix_fp*                                 u:object_r:fingerprint_device:s0
+
+# Goodix Fingerprint data
+/data/gf_data/frr_database.db                   u:object_r:fingerprint_data_file:s0
+/data/misc/gf_data(/.*)?                        u:object_r:fingerprint_data_file:s0
+/data/misc/goodix(/.*)?                         u:object_r:fingerprint_data_file:s0
+/persist/data/gf*                               u:object_r:fingerprint_data_file:s0
+
+# Fpc Fingerprint data
+/persist/fpc(/.*)?                              u:object_r:fingerprint_data_file:s0
+
+# HVDCP
+/sys/devices(/platform)?/soc/[a-z0-9]+\.i2c/i2c-[0-9]+/[0-9]+-[a-z0-9]+/[a-z0-9]+\.i2c:qcom,[a-z0-9]+@[a-z0-9]:qcom,smb[a-z0-9]+-parallel-slave@[0-9]+/power_supply/parallel(/.*)? u:object_r:sysfs_usb_supply:s0
+
+# IR
+/dev/spidev7.1                                  u:object_r:spidev_device:s0
+
+# Keylayout
+/vendor/usr/idc(/.*)?                           u:object_r:vendor_keylayout_file:s0
+/vendor/usr/keylayout(/.*)?                     u:object_r:vendor_keylayout_file:s0
+
+# Light HAL
+/(vendor|system/vendor)/bin/hw/android\.hardware\.light@2\.0-service\.xiaomi_wayne u:object_r:hal_light_default_exec:s0
+
+# Mlipay
+/(vendor|system/vendor)/bin/mlipayd@1.1         u:object_r:hal_mlipay_default_exec:s0
+
+# Persist
+/persist/PRSensorData\.txt                      u:object_r:sensors_persist_file:s0
+
+# RTC
+/sys/devices/soc/800f000.qcom,spmi/spmi-0/spmi0-00/800f000.qcom,spmi:qcom,pm660@0:qcom,pm660_rtc/rtc/rtc0(/.*)? u:object_r:sysfs_rtc:s0
+
+# Shell Script
+/(vendor|system/vendor)/bin/init\.goodix\.sh    u:object_r:init_fingerprint_exec:s0
+
+# Thermal
+/data/vendor/thermal(/.*)?                      u:object_r:thermal_data_file:s0
diff --git a/sepolicy/vendor/genfs_contexts b/sepolicy/vendor/genfs_contexts
new file mode 100644
index 0000000..638c917
--- /dev/null
+++ b/sepolicy/vendor/genfs_contexts
@@ -0,0 +1,2 @@
+genfscon proc /nvt_wake_gesture u:object_r:proc_dt2w:s0
+genfscon debugfs /wlan0   u:object_r:debugfs_wlan:s0
diff --git a/sepolicy/vendor/hal_audio_default.te b/sepolicy/vendor/hal_audio_default.te
new file mode 100644
index 0000000..128920f
--- /dev/null
+++ b/sepolicy/vendor/hal_audio_default.te
@@ -0,0 +1,2 @@
+allow hal_audio_default vendor_data_file:dir { create write add_name };
+allow hal_audio_default vendor_data_file:file { append create getattr open read };
diff --git a/sepolicy/vendor/hal_camera_default.te b/sepolicy/vendor/hal_camera_default.te
new file mode 100644
index 0000000..0f40bbd
--- /dev/null
+++ b/sepolicy/vendor/hal_camera_default.te
@@ -0,0 +1,6 @@
+binder_call(hal_camera_default, hal_configstore_default)
+binder_call(hal_camera_default, hal_graphics_allocator_default)
+
+allow hal_camera_default { hal_configstore_ISurfaceFlingerConfigs hal_graphics_allocator_hwservice }:hwservice_manager find;
+allow hal_camera_default sysfs:file { getattr open read };
+allow hal_camera_default sysfs_kgsl:file { getattr open read };
diff --git a/sepolicy/vendor/hal_cas_default.te b/sepolicy/vendor/hal_cas_default.te
new file mode 100644
index 0000000..18b00de
--- /dev/null
+++ b/sepolicy/vendor/hal_cas_default.te
@@ -0,0 +1 @@
+vndbinder_use(hal_cas_default)
diff --git a/sepolicy/vendor/hal_fingerprint_wayne.te b/sepolicy/vendor/hal_fingerprint_wayne.te
new file mode 100644
index 0000000..11a99de
--- /dev/null
+++ b/sepolicy/vendor/hal_fingerprint_wayne.te
@@ -0,0 +1,39 @@
+type hal_fingerprint_wayne, domain, binder_in_vendor_violators;
+hal_server_domain(hal_fingerprint_wayne, hal_fingerprint)
+ 
+type hal_fingerprint_wayne_exec, exec_type, vendor_file_type, file_type;
+typeattribute hal_fingerprint_wayne data_between_core_and_vendor_violators;
+binder_use(hal_fingerprint_wayne)
+init_daemon_domain(hal_fingerprint_wayne)
+
+allow hal_fingerprint_wayne fingerprint_device:chr_file { read write open ioctl };
+allow hal_fingerprint_wayne { tee_device uhid_device }:chr_file { read write open ioctl };
+allow hal_fingerprint_wayne fingerprint_data_file:file rw_file_perms;
+allow hal_fingerprint_wayne fingerprintd_data_file:dir rw_dir_perms;
+allow hal_fingerprint_wayne fingerprintd_data_file:file create_file_perms;
+allow hal_fingerprint_wayne { fuse mnt_user_file storage_file }:dir search;
+allow hal_fingerprint_wayne { mnt_user_file storage_file }:lnk_file read;
+allow hal_fingerprint_wayne fingerprint_sysfs:dir r_dir_perms;
+allow hal_fingerprint_wayne fingerprint_sysfs:file rw_file_perms;
+
+allow hal_fingerprint_wayne hal_fingerprint_wayne:netlink_socket { create bind write read };
+
+binder_call(hal_fingerprint_wayne, vndservicemanager)
+binder_call(hal_fingerprint_wayne, hal_perf_default)
+
+binder_use(hal_fingerprint_wayne)
+
+r_dir_file(hal_fingerprint_wayne, firmware_file)
+
+add_service(hal_fingerprint_wayne, goodixvnd_service)
+add_hwservice(hal_fingerprint_wayne, goodixhw_service)
+
+allow hal_fingerprint_wayne vndbinder_device:chr_file ioctl;
+
+get_prop(hal_fingerprint_wayne, hal_fingerprint_prop)
+set_prop(hal_fingerprint_wayne, hal_fingerprint_prop)
+
+vndbinder_use(hal_fingerprint_wayne)
+
+dontaudit hal_fingerprint_wayne { media_rw_data_file sdcardfs}:dir search;
+dontaudit hal_fingerprint_wayne media_rw_data_file:dir { read open };
diff --git a/sepolicy/vendor/hal_gnss_qti.te b/sepolicy/vendor/hal_gnss_qti.te
new file mode 100644
index 0000000..711c8bb
--- /dev/null
+++ b/sepolicy/vendor/hal_gnss_qti.te
@@ -0,0 +1 @@
+allow hal_gnss_qti sysfs:file { read open };
diff --git a/sepolicy/vendor/hal_graphics_composer_default.te b/sepolicy/vendor/hal_graphics_composer_default.te
new file mode 100644
index 0000000..39e8fb4
--- /dev/null
+++ b/sepolicy/vendor/hal_graphics_composer_default.te
@@ -0,0 +1,2 @@
+allow hal_graphics_composer_default sysfs_graphics:file r_file_perms;
+allow hal_graphics_composer_default sysfs_graphics:lnk_file read;
diff --git a/sepolicy/vendor/hal_ir_default.te b/sepolicy/vendor/hal_ir_default.te
new file mode 100644
index 0000000..2f9f2b6
--- /dev/null
+++ b/sepolicy/vendor/hal_ir_default.te
@@ -0,0 +1 @@
+allow hal_ir_default spidev_device:chr_file rw_file_perms;
diff --git a/sepolicy/vendor/hal_light_default.te b/sepolicy/vendor/hal_light_default.te
new file mode 100644
index 0000000..e0592d7
--- /dev/null
+++ b/sepolicy/vendor/hal_light_default.te
@@ -0,0 +1 @@
+allow hal_light_default sysfs_light:file rw_file_perms;
diff --git a/sepolicy/vendor/hal_mlipay_default.te b/sepolicy/vendor/hal_mlipay_default.te
new file mode 100644
index 0000000..c6f721c
--- /dev/null
+++ b/sepolicy/vendor/hal_mlipay_default.te
@@ -0,0 +1,16 @@
+type hal_mlipay_default, domain;
+
+type hal_mlipay_default_exec, exec_type, vendor_file_type, file_type;
+init_daemon_domain(hal_mlipay_default)
+
+hwbinder_use(hal_mlipay_default)
+get_prop(hal_mlipay_default, hwservicemanager_prop)
+add_hwservice(hal_mlipay_default, hal_mlipay_hwservice)
+
+allow hal_mlipay_default tee_device:chr_file rw_file_perms;
+allow hal_mlipay_default ion_device:chr_file r_file_perms;
+
+r_dir_file(hal_mlipay_default, firmware_file)
+set_prop(hal_mlipay_default, mlipay_prop);
+
+get_prop(hal_mlipay_default, hal_fingerprint_prop);
diff --git a/sepolicy/vendor/hal_power_default.te b/sepolicy/vendor/hal_power_default.te
new file mode 100644
index 0000000..2df04b0
--- /dev/null
+++ b/sepolicy/vendor/hal_power_default.te
@@ -0,0 +1,2 @@
+allow hal_power_default proc_dt2w:file rw_file_perms;
+r_dir_file(hal_power_default, debugfs_wlan)
diff --git a/sepolicy/vendor/hal_sensors_default.te b/sepolicy/vendor/hal_sensors_default.te
new file mode 100644
index 0000000..28414f9
--- /dev/null
+++ b/sepolicy/vendor/hal_sensors_default.te
@@ -0,0 +1 @@
+allow hal_sensors_default sysfs:file { read open };
diff --git a/sepolicy/vendor/hvdcp.te b/sepolicy/vendor/hvdcp.te
new file mode 100644
index 0000000..49a6b78
--- /dev/null
+++ b/sepolicy/vendor/hvdcp.te
@@ -0,0 +1 @@
+allow hvdcp sysfs:file { open read };
diff --git a/sepolicy/vendor/hwservice.te b/sepolicy/vendor/hwservice.te
new file mode 100644
index 0000000..32adecb
--- /dev/null
+++ b/sepolicy/vendor/hwservice.te
@@ -0,0 +1,2 @@
+type goodixhw_service, hwservice_manager_type;
+type hal_mlipay_hwservice, hwservice_manager_type, untrusted_app_visible_hwservice;
diff --git a/sepolicy/vendor/hwservice_contexts b/sepolicy/vendor/hwservice_contexts
new file mode 100644
index 0000000..8ff7ae7
--- /dev/null
+++ b/sepolicy/vendor/hwservice_contexts
@@ -0,0 +1,2 @@
+vendor.goodix.hardware.fingerprint::IGoodixBiometricsFingerprint u:object_r:goodixhw_service:s0
+vendor.xiaomi.hardware.mlipay::IMlipayService                    u:object_r:hal_mlipay_hwservice:s0
diff --git a/sepolicy/vendor/hwservicemanager.te b/sepolicy/vendor/hwservicemanager.te
new file mode 100644
index 0000000..3262afb
--- /dev/null
+++ b/sepolicy/vendor/hwservicemanager.te
@@ -0,0 +1,4 @@
+#============= hwservicemanager ==============
+allow hwservicemanager init:dir search;
+allow hwservicemanager init:file { open read };
+allow hwservicemanager init:process getattr;
diff --git a/sepolicy/vendor/init.te b/sepolicy/vendor/init.te
new file mode 100644
index 0000000..734baea
--- /dev/null
+++ b/sepolicy/vendor/init.te
@@ -0,0 +1,6 @@
+allow init hwservicemanager:binder { call transfer };
+allow init ipa_dev:chr_file open;
+allow init ion_device:chr_file ioctl;
+allow init property_socket:sock_file write;
+allow init sysfs_dm:file { open write };
+allow init tee_device:chr_file { write ioctl };
diff --git a/sepolicy/vendor/init_fingerprint.te b/sepolicy/vendor/init_fingerprint.te
new file mode 100644
index 0000000..b45cdd6
--- /dev/null
+++ b/sepolicy/vendor/init_fingerprint.te
@@ -0,0 +1,14 @@
+type init_fingerprint, domain;
+type init_fingerprint_exec, exec_type, vendor_file_type, file_type;
+
+# Allow for transition from init domain to init_fingerprint
+init_daemon_domain(init_fingerprint)
+
+# Shell script needs to execute /vendor/bin/sh
+allow init_fingerprint vendor_shell_exec:file rx_file_perms;
+allow init_fingerprint vendor_toolbox_exec:file rx_file_perms;
+
+# Allow to delete file
+allow init_fingerprint persist_file:dir search;
+allow init_fingerprint persist_drm_file:dir { read search open write remove_name };
+allow init_fingerprint persist_drm_file:file { getattr unlink };
\ No newline at end of file
diff --git a/sepolicy/vendor/kernel.te b/sepolicy/vendor/kernel.te
new file mode 100644
index 0000000..9ba3537
--- /dev/null
+++ b/sepolicy/vendor/kernel.te
@@ -0,0 +1 @@
+allow kernel debugfs_wlan:dir search;
diff --git a/sepolicy/vendor/location.te b/sepolicy/vendor/location.te
new file mode 100644
index 0000000..4333581
--- /dev/null
+++ b/sepolicy/vendor/location.te
@@ -0,0 +1 @@
+allow location sysfs:file { read open };
diff --git a/sepolicy/vendor/netmgrd.te b/sepolicy/vendor/netmgrd.te
new file mode 100644
index 0000000..47ce266
--- /dev/null
+++ b/sepolicy/vendor/netmgrd.te
@@ -0,0 +1 @@
+allow netmgrd property_socket:sock_file write;
diff --git a/sepolicy/vendor/priv_app.te b/sepolicy/vendor/priv_app.te
new file mode 100644
index 0000000..7ae851d
--- /dev/null
+++ b/sepolicy/vendor/priv_app.te
@@ -0,0 +1 @@
+allow priv_app sysfs_graphics:file { getattr open read };
\ No newline at end of file
diff --git a/sepolicy/vendor/property.te b/sepolicy/vendor/property.te
new file mode 100644
index 0000000..313445c
--- /dev/null
+++ b/sepolicy/vendor/property.te
@@ -0,0 +1,3 @@
+type hal_fingerprint_prop, property_type;
+type mlipay_prop, property_type;
+type thermal_engine_prop, property_type;
diff --git a/sepolicy/vendor/property_contexts b/sepolicy/vendor/property_contexts
new file mode 100644
index 0000000..037565e
--- /dev/null
+++ b/sepolicy/vendor/property_contexts
@@ -0,0 +1,12 @@
+persist.camera.                     u:object_r:camera_prop:s0
+persist.vendor.camera.              u:object_r:camera_prop:s0
+sys.fp.goodix	u:object_r:hal_fingerprint_prop:s0
+sys.fp.vendor   u:object_r:hal_fingerprint_prop:s0
+persist.sys.fp.info u:object_r:hal_fingerprint_prop:s0
+persist.vendor.sys.fp.vendor u:object_r:hal_fingerprint_prop:s0
+persist.vendor.sys.pay.fido         u:object_r:mlipay_prop:s0
+persist.vendor.sys.pay.ifaa         u:object_r:mlipay_prop:s0
+persist.vendor.sys.pay.soter        u:object_r:mlipay_prop:s0
+persist.vendor.sys.provision.status u:object_r:mlipay_prop:s0
+persist.sys.thermal.  u:object_r:thermal_engine_prop:s0
+sys.thermal.          u:object_r:thermal_engine_prop:s0
diff --git a/sepolicy/vendor/qti_init_shell.te b/sepolicy/vendor/qti_init_shell.te
new file mode 100644
index 0000000..aa81398
--- /dev/null
+++ b/sepolicy/vendor/qti_init_shell.te
@@ -0,0 +1,4 @@
+allow qti_init_shell sysfs_cpu_boost:file write;
+allow qti_init_shell sysfs:file write;
+allow qti_init_shell vendor_radio_data_file:dir { getattr read search };
+allow qti_init_shell vendor_radio_data_file:file { getattr read setattr write };
diff --git a/sepolicy/vendor/rild.te b/sepolicy/vendor/rild.te
new file mode 100644
index 0000000..06625de
--- /dev/null
+++ b/sepolicy/vendor/rild.te
@@ -0,0 +1 @@
+allow rild vendor_file:file ioctl;
diff --git a/sepolicy/vendor/system_app.te b/sepolicy/vendor/system_app.te
new file mode 100644
index 0000000..c7d0026
--- /dev/null
+++ b/sepolicy/vendor/system_app.te
@@ -0,0 +1,3 @@
+allow system_app vendor_default_prop:file { getattr open read };
+allow system_app wificond:binder call;
+add_service(system_app, goodixhw_service)
diff --git a/sepolicy/vendor/system_server.te b/sepolicy/vendor/system_server.te
new file mode 100644
index 0000000..c9135cf
--- /dev/null
+++ b/sepolicy/vendor/system_server.te
@@ -0,0 +1,4 @@
+allow system_server vendor_keylayout_file:dir search;
+allow system_server vendor_keylayout_file:file r_file_perms;
+allow system_server sysfs_vibrator:file rw_file_perms;
+allow system_server sysfs_rtc:file r_file_perms;
diff --git a/sepolicy/vendor/tee.te b/sepolicy/vendor/tee.te
new file mode 100644
index 0000000..0a124bc
--- /dev/null
+++ b/sepolicy/vendor/tee.te
@@ -0,0 +1,6 @@
+# TODO(b/36644492): Remove data_between_core_and_vendor_violators once
+# tee no longer directly accesses /data owned by the frameworks.
+typeattribute tee data_between_core_and_vendor_violators;
+allow tee system_data_file:dir r_dir_perms;
+allow tee fingerprintd_data_file:dir rw_dir_perms;
+allow tee fingerprintd_data_file:file create_file_perms;
diff --git a/sepolicy/vendor/thermal-engine.te b/sepolicy/vendor/thermal-engine.te
new file mode 100644
index 0000000..0e03308
--- /dev/null
+++ b/sepolicy/vendor/thermal-engine.te
@@ -0,0 +1,6 @@
+allow thermal-engine thermal_data_file:dir rw_dir_perms;
+allow thermal-engine thermal_data_file:file create_file_perms;
+allow thermal-engine self:capability { chown fowner };
+dontaudit thermal-engine self:capability dac_override;
+
+set_prop(thermal-engine, thermal_engine_prop);
diff --git a/sepolicy/vendor/vendor_init.te b/sepolicy/vendor/vendor_init.te
new file mode 100644
index 0000000..9f602b1
--- /dev/null
+++ b/sepolicy/vendor/vendor_init.te
@@ -0,0 +1,13 @@
+typeattribute vendor_init data_between_core_and_vendor_violators;
+
+allow vendor_init {
+  system_data_file
+  tombstone_data_file
+}:dir { create search getattr open read setattr ioctl write add_name remove_name rmdir relabelfrom };
+
+set_prop(vendor_init, camera_prop)
+allow vendor_init rootfs:dir { add_name create setattr write };
+allow vendor_init persist_debug_prop:property_service set;
+allow vendor_init persist_dpm_prop:property_service set;
+allow vendor_init qcom_ims_prop:property_service set;
+allow vendor_init rootfs:lnk_file setattr;
diff --git a/sepolicy/vendor/vndservice.te b/sepolicy/vendor/vndservice.te
new file mode 100644
index 0000000..ebc594c
--- /dev/null
+++ b/sepolicy/vendor/vndservice.te
@@ -0,0 +1 @@
+type goodixvnd_service, vndservice_manager_type;
diff --git a/sepolicy/vendor/vndservice_contexts b/sepolicy/vendor/vndservice_contexts
new file mode 100644
index 0000000..92d3f21
--- /dev/null
+++ b/sepolicy/vendor/vndservice_contexts
@@ -0,0 +1 @@
+android.hardware.fingerprint.IGoodixFingerprintDaemon  u:object_r:goodixvnd_service:s0
diff --git a/sepolicy/vendor/vndservicemanager.te b/sepolicy/vendor/vndservicemanager.te
new file mode 100644
index 0000000..8d04dea
--- /dev/null
+++ b/sepolicy/vendor/vndservicemanager.te
@@ -0,0 +1,3 @@
+allow vndservicemanager hal_fingerprint_default:dir { search read open };
+allow vndservicemanager hal_fingerprint_default:file { read open };
+allow vndservicemanager hal_fingerprint_default:process getattr;