diff options
Diffstat (limited to 'sepolicy/vendor')
39 files changed, 226 insertions, 0 deletions
diff --git a/sepolicy/vendor/app.te b/sepolicy/vendor/app.te new file mode 100644 index 0000000..c61957b --- /dev/null +++ b/sepolicy/vendor/app.te @@ -0,0 +1,6 @@ +# Allow appdomain to get vendor_camera_prop +get_prop(appdomain, vendor_camera_prop) +allow { appdomain -isolated_app } hal_mlipay_hwservice:hwservice_manager find; +binder_call({ appdomain -isolated_app }, hal_mlipay_default) +get_prop({ appdomain -isolated_app }, mlipay_prop) +get_prop({ appdomain -isolated_app }, hal_fingerprint_prop) diff --git a/sepolicy/vendor/atfwd.te b/sepolicy/vendor/atfwd.te new file mode 100644 index 0000000..a60277a --- /dev/null +++ b/sepolicy/vendor/atfwd.te @@ -0,0 +1 @@ +allow atfwd sysfs:file read; diff --git a/sepolicy/vendor/device.te b/sepolicy/vendor/device.te new file mode 100644 index 0000000..b84e726 --- /dev/null +++ b/sepolicy/vendor/device.te @@ -0,0 +1,2 @@ +type fingerprint_device, dev_type; +type spidev_device, dev_type; diff --git a/sepolicy/vendor/file.te b/sepolicy/vendor/file.te new file mode 100644 index 0000000..2ca38b9 --- /dev/null +++ b/sepolicy/vendor/file.te @@ -0,0 +1,8 @@ +type debugfs_wlan, debugfs_type, fs_type; +type ir_dev_file, file_type; +type proc_dt2w, fs_type, proc_type; +type fingerprint_data_file, file_type, data_file_type, core_data_file_type; +type fingerprint_sysfs, fs_type, sysfs_type; +type vendor_keylayout_file, file_type, vendor_file_type; +type sysfs_light, fs_type, sysfs_type; +type thermal_data_file, file_type, data_file_type; diff --git a/sepolicy/vendor/file_contexts b/sepolicy/vendor/file_contexts new file mode 100644 index 0000000..6939ff5 --- /dev/null +++ b/sepolicy/vendor/file_contexts @@ -0,0 +1,45 @@ +# Biometric +/(vendor|system/vendor)/bin/hw/android\.hardware\.biometrics\.fingerprint@2\.1-service\.xiaomi_wayne u:object_r:hal_fingerprint_wayne_exec:s0 + +# Fpc Fingerprint +/sys/devices/soc/soc:fpc1020(/.*)? u:object_r:fingerprint_sysfs:s0 + +# For Goodix fingerprint +/dev/goodix_fp* u:object_r:fingerprint_device:s0 + +# Goodix Fingerprint data +/data/gf_data/frr_database.db u:object_r:fingerprint_data_file:s0 +/data/misc/gf_data(/.*)? u:object_r:fingerprint_data_file:s0 +/data/misc/goodix(/.*)? u:object_r:fingerprint_data_file:s0 +/persist/data/gf* u:object_r:fingerprint_data_file:s0 + +# Fpc Fingerprint data +/persist/fpc(/.*)? u:object_r:fingerprint_data_file:s0 + +# HVDCP +/sys/devices(/platform)?/soc/[a-z0-9]+\.i2c/i2c-[0-9]+/[0-9]+-[a-z0-9]+/[a-z0-9]+\.i2c:qcom,[a-z0-9]+@[a-z0-9]:qcom,smb[a-z0-9]+-parallel-slave@[0-9]+/power_supply/parallel(/.*)? u:object_r:sysfs_usb_supply:s0 + +# IR +/dev/spidev7.1 u:object_r:spidev_device:s0 + +# Keylayout +/vendor/usr/idc(/.*)? u:object_r:vendor_keylayout_file:s0 +/vendor/usr/keylayout(/.*)? u:object_r:vendor_keylayout_file:s0 + +# Light HAL +/(vendor|system/vendor)/bin/hw/android\.hardware\.light@2\.0-service\.xiaomi_wayne u:object_r:hal_light_default_exec:s0 + +# Mlipay +/(vendor|system/vendor)/bin/mlipayd@1.1 u:object_r:hal_mlipay_default_exec:s0 + +# Persist +/persist/PRSensorData\.txt u:object_r:sensors_persist_file:s0 + +# RTC +/sys/devices/soc/800f000.qcom,spmi/spmi-0/spmi0-00/800f000.qcom,spmi:qcom,pm660@0:qcom,pm660_rtc/rtc/rtc0(/.*)? u:object_r:sysfs_rtc:s0 + +# Shell Script +/(vendor|system/vendor)/bin/init\.goodix\.sh u:object_r:init_fingerprint_exec:s0 + +# Thermal +/data/vendor/thermal(/.*)? u:object_r:thermal_data_file:s0 diff --git a/sepolicy/vendor/genfs_contexts b/sepolicy/vendor/genfs_contexts new file mode 100644 index 0000000..638c917 --- /dev/null +++ b/sepolicy/vendor/genfs_contexts @@ -0,0 +1,2 @@ +genfscon proc /nvt_wake_gesture u:object_r:proc_dt2w:s0 +genfscon debugfs /wlan0 u:object_r:debugfs_wlan:s0 diff --git a/sepolicy/vendor/hal_audio_default.te b/sepolicy/vendor/hal_audio_default.te new file mode 100644 index 0000000..128920f --- /dev/null +++ b/sepolicy/vendor/hal_audio_default.te @@ -0,0 +1,2 @@ +allow hal_audio_default vendor_data_file:dir { create write add_name }; +allow hal_audio_default vendor_data_file:file { append create getattr open read }; diff --git a/sepolicy/vendor/hal_camera_default.te b/sepolicy/vendor/hal_camera_default.te new file mode 100644 index 0000000..0f40bbd --- /dev/null +++ b/sepolicy/vendor/hal_camera_default.te @@ -0,0 +1,6 @@ +binder_call(hal_camera_default, hal_configstore_default) +binder_call(hal_camera_default, hal_graphics_allocator_default) + +allow hal_camera_default { hal_configstore_ISurfaceFlingerConfigs hal_graphics_allocator_hwservice }:hwservice_manager find; +allow hal_camera_default sysfs:file { getattr open read }; +allow hal_camera_default sysfs_kgsl:file { getattr open read }; diff --git a/sepolicy/vendor/hal_cas_default.te b/sepolicy/vendor/hal_cas_default.te new file mode 100644 index 0000000..18b00de --- /dev/null +++ b/sepolicy/vendor/hal_cas_default.te @@ -0,0 +1 @@ +vndbinder_use(hal_cas_default) diff --git a/sepolicy/vendor/hal_fingerprint_wayne.te b/sepolicy/vendor/hal_fingerprint_wayne.te new file mode 100644 index 0000000..11a99de --- /dev/null +++ b/sepolicy/vendor/hal_fingerprint_wayne.te @@ -0,0 +1,39 @@ +type hal_fingerprint_wayne, domain, binder_in_vendor_violators; +hal_server_domain(hal_fingerprint_wayne, hal_fingerprint) + +type hal_fingerprint_wayne_exec, exec_type, vendor_file_type, file_type; +typeattribute hal_fingerprint_wayne data_between_core_and_vendor_violators; +binder_use(hal_fingerprint_wayne) +init_daemon_domain(hal_fingerprint_wayne) + +allow hal_fingerprint_wayne fingerprint_device:chr_file { read write open ioctl }; +allow hal_fingerprint_wayne { tee_device uhid_device }:chr_file { read write open ioctl }; +allow hal_fingerprint_wayne fingerprint_data_file:file rw_file_perms; +allow hal_fingerprint_wayne fingerprintd_data_file:dir rw_dir_perms; +allow hal_fingerprint_wayne fingerprintd_data_file:file create_file_perms; +allow hal_fingerprint_wayne { fuse mnt_user_file storage_file }:dir search; +allow hal_fingerprint_wayne { mnt_user_file storage_file }:lnk_file read; +allow hal_fingerprint_wayne fingerprint_sysfs:dir r_dir_perms; +allow hal_fingerprint_wayne fingerprint_sysfs:file rw_file_perms; + +allow hal_fingerprint_wayne hal_fingerprint_wayne:netlink_socket { create bind write read }; + +binder_call(hal_fingerprint_wayne, vndservicemanager) +binder_call(hal_fingerprint_wayne, hal_perf_default) + +binder_use(hal_fingerprint_wayne) + +r_dir_file(hal_fingerprint_wayne, firmware_file) + +add_service(hal_fingerprint_wayne, goodixvnd_service) +add_hwservice(hal_fingerprint_wayne, goodixhw_service) + +allow hal_fingerprint_wayne vndbinder_device:chr_file ioctl; + +get_prop(hal_fingerprint_wayne, hal_fingerprint_prop) +set_prop(hal_fingerprint_wayne, hal_fingerprint_prop) + +vndbinder_use(hal_fingerprint_wayne) + +dontaudit hal_fingerprint_wayne { media_rw_data_file sdcardfs}:dir search; +dontaudit hal_fingerprint_wayne media_rw_data_file:dir { read open }; diff --git a/sepolicy/vendor/hal_gnss_qti.te b/sepolicy/vendor/hal_gnss_qti.te new file mode 100644 index 0000000..711c8bb --- /dev/null +++ b/sepolicy/vendor/hal_gnss_qti.te @@ -0,0 +1 @@ +allow hal_gnss_qti sysfs:file { read open }; diff --git a/sepolicy/vendor/hal_graphics_composer_default.te b/sepolicy/vendor/hal_graphics_composer_default.te new file mode 100644 index 0000000..39e8fb4 --- /dev/null +++ b/sepolicy/vendor/hal_graphics_composer_default.te @@ -0,0 +1,2 @@ +allow hal_graphics_composer_default sysfs_graphics:file r_file_perms; +allow hal_graphics_composer_default sysfs_graphics:lnk_file read; diff --git a/sepolicy/vendor/hal_ir_default.te b/sepolicy/vendor/hal_ir_default.te new file mode 100644 index 0000000..2f9f2b6 --- /dev/null +++ b/sepolicy/vendor/hal_ir_default.te @@ -0,0 +1 @@ +allow hal_ir_default spidev_device:chr_file rw_file_perms; diff --git a/sepolicy/vendor/hal_light_default.te b/sepolicy/vendor/hal_light_default.te new file mode 100644 index 0000000..e0592d7 --- /dev/null +++ b/sepolicy/vendor/hal_light_default.te @@ -0,0 +1 @@ +allow hal_light_default sysfs_light:file rw_file_perms; diff --git a/sepolicy/vendor/hal_mlipay_default.te b/sepolicy/vendor/hal_mlipay_default.te new file mode 100644 index 0000000..c6f721c --- /dev/null +++ b/sepolicy/vendor/hal_mlipay_default.te @@ -0,0 +1,16 @@ +type hal_mlipay_default, domain; + +type hal_mlipay_default_exec, exec_type, vendor_file_type, file_type; +init_daemon_domain(hal_mlipay_default) + +hwbinder_use(hal_mlipay_default) +get_prop(hal_mlipay_default, hwservicemanager_prop) +add_hwservice(hal_mlipay_default, hal_mlipay_hwservice) + +allow hal_mlipay_default tee_device:chr_file rw_file_perms; +allow hal_mlipay_default ion_device:chr_file r_file_perms; + +r_dir_file(hal_mlipay_default, firmware_file) +set_prop(hal_mlipay_default, mlipay_prop); + +get_prop(hal_mlipay_default, hal_fingerprint_prop); diff --git a/sepolicy/vendor/hal_power_default.te b/sepolicy/vendor/hal_power_default.te new file mode 100644 index 0000000..2df04b0 --- /dev/null +++ b/sepolicy/vendor/hal_power_default.te @@ -0,0 +1,2 @@ +allow hal_power_default proc_dt2w:file rw_file_perms; +r_dir_file(hal_power_default, debugfs_wlan) diff --git a/sepolicy/vendor/hal_sensors_default.te b/sepolicy/vendor/hal_sensors_default.te new file mode 100644 index 0000000..28414f9 --- /dev/null +++ b/sepolicy/vendor/hal_sensors_default.te @@ -0,0 +1 @@ +allow hal_sensors_default sysfs:file { read open }; diff --git a/sepolicy/vendor/hvdcp.te b/sepolicy/vendor/hvdcp.te new file mode 100644 index 0000000..49a6b78 --- /dev/null +++ b/sepolicy/vendor/hvdcp.te @@ -0,0 +1 @@ +allow hvdcp sysfs:file { open read }; diff --git a/sepolicy/vendor/hwservice.te b/sepolicy/vendor/hwservice.te new file mode 100644 index 0000000..32adecb --- /dev/null +++ b/sepolicy/vendor/hwservice.te @@ -0,0 +1,2 @@ +type goodixhw_service, hwservice_manager_type; +type hal_mlipay_hwservice, hwservice_manager_type, untrusted_app_visible_hwservice; diff --git a/sepolicy/vendor/hwservice_contexts b/sepolicy/vendor/hwservice_contexts new file mode 100644 index 0000000..8ff7ae7 --- /dev/null +++ b/sepolicy/vendor/hwservice_contexts @@ -0,0 +1,2 @@ +vendor.goodix.hardware.fingerprint::IGoodixBiometricsFingerprint u:object_r:goodixhw_service:s0 +vendor.xiaomi.hardware.mlipay::IMlipayService u:object_r:hal_mlipay_hwservice:s0 diff --git a/sepolicy/vendor/hwservicemanager.te b/sepolicy/vendor/hwservicemanager.te new file mode 100644 index 0000000..3262afb --- /dev/null +++ b/sepolicy/vendor/hwservicemanager.te @@ -0,0 +1,4 @@ +#============= hwservicemanager ============== +allow hwservicemanager init:dir search; +allow hwservicemanager init:file { open read }; +allow hwservicemanager init:process getattr; diff --git a/sepolicy/vendor/init.te b/sepolicy/vendor/init.te new file mode 100644 index 0000000..734baea --- /dev/null +++ b/sepolicy/vendor/init.te @@ -0,0 +1,6 @@ +allow init hwservicemanager:binder { call transfer }; +allow init ipa_dev:chr_file open; +allow init ion_device:chr_file ioctl; +allow init property_socket:sock_file write; +allow init sysfs_dm:file { open write }; +allow init tee_device:chr_file { write ioctl }; diff --git a/sepolicy/vendor/init_fingerprint.te b/sepolicy/vendor/init_fingerprint.te new file mode 100644 index 0000000..b45cdd6 --- /dev/null +++ b/sepolicy/vendor/init_fingerprint.te @@ -0,0 +1,14 @@ +type init_fingerprint, domain; +type init_fingerprint_exec, exec_type, vendor_file_type, file_type; + +# Allow for transition from init domain to init_fingerprint +init_daemon_domain(init_fingerprint) + +# Shell script needs to execute /vendor/bin/sh +allow init_fingerprint vendor_shell_exec:file rx_file_perms; +allow init_fingerprint vendor_toolbox_exec:file rx_file_perms; + +# Allow to delete file +allow init_fingerprint persist_file:dir search; +allow init_fingerprint persist_drm_file:dir { read search open write remove_name }; +allow init_fingerprint persist_drm_file:file { getattr unlink };
\ No newline at end of file diff --git a/sepolicy/vendor/kernel.te b/sepolicy/vendor/kernel.te new file mode 100644 index 0000000..9ba3537 --- /dev/null +++ b/sepolicy/vendor/kernel.te @@ -0,0 +1 @@ +allow kernel debugfs_wlan:dir search; diff --git a/sepolicy/vendor/location.te b/sepolicy/vendor/location.te new file mode 100644 index 0000000..4333581 --- /dev/null +++ b/sepolicy/vendor/location.te @@ -0,0 +1 @@ +allow location sysfs:file { read open }; diff --git a/sepolicy/vendor/netmgrd.te b/sepolicy/vendor/netmgrd.te new file mode 100644 index 0000000..47ce266 --- /dev/null +++ b/sepolicy/vendor/netmgrd.te @@ -0,0 +1 @@ +allow netmgrd property_socket:sock_file write; diff --git a/sepolicy/vendor/priv_app.te b/sepolicy/vendor/priv_app.te new file mode 100644 index 0000000..7ae851d --- /dev/null +++ b/sepolicy/vendor/priv_app.te @@ -0,0 +1 @@ +allow priv_app sysfs_graphics:file { getattr open read };
\ No newline at end of file diff --git a/sepolicy/vendor/property.te b/sepolicy/vendor/property.te new file mode 100644 index 0000000..313445c --- /dev/null +++ b/sepolicy/vendor/property.te @@ -0,0 +1,3 @@ +type hal_fingerprint_prop, property_type; +type mlipay_prop, property_type; +type thermal_engine_prop, property_type; diff --git a/sepolicy/vendor/property_contexts b/sepolicy/vendor/property_contexts new file mode 100644 index 0000000..037565e --- /dev/null +++ b/sepolicy/vendor/property_contexts @@ -0,0 +1,12 @@ +persist.camera. u:object_r:camera_prop:s0 +persist.vendor.camera. u:object_r:camera_prop:s0 +sys.fp.goodix u:object_r:hal_fingerprint_prop:s0 +sys.fp.vendor u:object_r:hal_fingerprint_prop:s0 +persist.sys.fp.info u:object_r:hal_fingerprint_prop:s0 +persist.vendor.sys.fp.vendor u:object_r:hal_fingerprint_prop:s0 +persist.vendor.sys.pay.fido u:object_r:mlipay_prop:s0 +persist.vendor.sys.pay.ifaa u:object_r:mlipay_prop:s0 +persist.vendor.sys.pay.soter u:object_r:mlipay_prop:s0 +persist.vendor.sys.provision.status u:object_r:mlipay_prop:s0 +persist.sys.thermal. u:object_r:thermal_engine_prop:s0 +sys.thermal. u:object_r:thermal_engine_prop:s0 diff --git a/sepolicy/vendor/qti_init_shell.te b/sepolicy/vendor/qti_init_shell.te new file mode 100644 index 0000000..aa81398 --- /dev/null +++ b/sepolicy/vendor/qti_init_shell.te @@ -0,0 +1,4 @@ +allow qti_init_shell sysfs_cpu_boost:file write; +allow qti_init_shell sysfs:file write; +allow qti_init_shell vendor_radio_data_file:dir { getattr read search }; +allow qti_init_shell vendor_radio_data_file:file { getattr read setattr write }; diff --git a/sepolicy/vendor/rild.te b/sepolicy/vendor/rild.te new file mode 100644 index 0000000..06625de --- /dev/null +++ b/sepolicy/vendor/rild.te @@ -0,0 +1 @@ +allow rild vendor_file:file ioctl; diff --git a/sepolicy/vendor/system_app.te b/sepolicy/vendor/system_app.te new file mode 100644 index 0000000..c7d0026 --- /dev/null +++ b/sepolicy/vendor/system_app.te @@ -0,0 +1,3 @@ +allow system_app vendor_default_prop:file { getattr open read }; +allow system_app wificond:binder call; +add_service(system_app, goodixhw_service) diff --git a/sepolicy/vendor/system_server.te b/sepolicy/vendor/system_server.te new file mode 100644 index 0000000..c9135cf --- /dev/null +++ b/sepolicy/vendor/system_server.te @@ -0,0 +1,4 @@ +allow system_server vendor_keylayout_file:dir search; +allow system_server vendor_keylayout_file:file r_file_perms; +allow system_server sysfs_vibrator:file rw_file_perms; +allow system_server sysfs_rtc:file r_file_perms; diff --git a/sepolicy/vendor/tee.te b/sepolicy/vendor/tee.te new file mode 100644 index 0000000..0a124bc --- /dev/null +++ b/sepolicy/vendor/tee.te @@ -0,0 +1,6 @@ +# TODO(b/36644492): Remove data_between_core_and_vendor_violators once +# tee no longer directly accesses /data owned by the frameworks. +typeattribute tee data_between_core_and_vendor_violators; +allow tee system_data_file:dir r_dir_perms; +allow tee fingerprintd_data_file:dir rw_dir_perms; +allow tee fingerprintd_data_file:file create_file_perms; diff --git a/sepolicy/vendor/thermal-engine.te b/sepolicy/vendor/thermal-engine.te new file mode 100644 index 0000000..0e03308 --- /dev/null +++ b/sepolicy/vendor/thermal-engine.te @@ -0,0 +1,6 @@ +allow thermal-engine thermal_data_file:dir rw_dir_perms; +allow thermal-engine thermal_data_file:file create_file_perms; +allow thermal-engine self:capability { chown fowner }; +dontaudit thermal-engine self:capability dac_override; + +set_prop(thermal-engine, thermal_engine_prop); diff --git a/sepolicy/vendor/vendor_init.te b/sepolicy/vendor/vendor_init.te new file mode 100644 index 0000000..9f602b1 --- /dev/null +++ b/sepolicy/vendor/vendor_init.te @@ -0,0 +1,13 @@ +typeattribute vendor_init data_between_core_and_vendor_violators; + +allow vendor_init { + system_data_file + tombstone_data_file +}:dir { create search getattr open read setattr ioctl write add_name remove_name rmdir relabelfrom }; + +set_prop(vendor_init, camera_prop) +allow vendor_init rootfs:dir { add_name create setattr write }; +allow vendor_init persist_debug_prop:property_service set; +allow vendor_init persist_dpm_prop:property_service set; +allow vendor_init qcom_ims_prop:property_service set; +allow vendor_init rootfs:lnk_file setattr; diff --git a/sepolicy/vendor/vndservice.te b/sepolicy/vendor/vndservice.te new file mode 100644 index 0000000..ebc594c --- /dev/null +++ b/sepolicy/vendor/vndservice.te @@ -0,0 +1 @@ +type goodixvnd_service, vndservice_manager_type; diff --git a/sepolicy/vendor/vndservice_contexts b/sepolicy/vendor/vndservice_contexts new file mode 100644 index 0000000..92d3f21 --- /dev/null +++ b/sepolicy/vendor/vndservice_contexts @@ -0,0 +1 @@ +android.hardware.fingerprint.IGoodixFingerprintDaemon u:object_r:goodixvnd_service:s0 diff --git a/sepolicy/vendor/vndservicemanager.te b/sepolicy/vendor/vndservicemanager.te new file mode 100644 index 0000000..8d04dea --- /dev/null +++ b/sepolicy/vendor/vndservicemanager.te @@ -0,0 +1,3 @@ +allow vndservicemanager hal_fingerprint_default:dir { search read open }; +allow vndservicemanager hal_fingerprint_default:file { read open }; +allow vndservicemanager hal_fingerprint_default:process getattr; |