diff options
author | Sathish Ambley <sathishambley@codeaurora.org> | 2016-11-03 15:15:39 -0700 |
---|---|---|
committer | Sathish Ambley <sathishambley@codeaurora.org> | 2016-11-03 15:15:39 -0700 |
commit | ddc833553694987293bb081c75f9ffab3e219293 (patch) | |
tree | e24caf372deaa64868cbaf6f80e2bbb6b888a6a6 | |
parent | df68f0e886ca8e6b47be840dd19fc6f89b095046 (diff) | |
download | android_device_qcom_sepolicy-ddc833553694987293bb081c75f9ffab3e219293.tar.gz android_device_qcom_sepolicy-ddc833553694987293bb081c75f9ffab3e219293.tar.bz2 android_device_qcom_sepolicy-ddc833553694987293bb081c75f9ffab3e219293.zip |
sepolicy: msmcobalt: Add policy for VR service
Add policy for VR service.
Change-Id: I760bcb2a721aab13c8370dcb74237794d0dc37f0
CRs-Fixed: 1075747
-rw-r--r-- | msmcobalt/app.te | 30 | ||||
-rw-r--r-- | msmcobalt/file.te | 6 | ||||
-rw-r--r-- | msmcobalt/file_contexts | 8 | ||||
-rw-r--r-- | msmcobalt/init_shell.te | 3 | ||||
-rw-r--r-- | msmcobalt/mm-qcamerad.te | 29 | ||||
-rw-r--r-- | msmcobalt/property.te | 29 | ||||
-rw-r--r-- | msmcobalt/property_contexts | 28 | ||||
-rw-r--r-- | msmcobalt/qvrd.te | 99 |
8 files changed, 231 insertions, 1 deletions
diff --git a/msmcobalt/app.te b/msmcobalt/app.te new file mode 100644 index 00000000..9893883f --- /dev/null +++ b/msmcobalt/app.te @@ -0,0 +1,30 @@ +# Copyright (c) 2016, The Linux Foundation. All rights reserved. +# +# Redistribution and use in source and binary forms, with or without +# modification, are permitted provided that the following conditions are +# met: +# * Redistributions of source code must retain the above copyright +# notice, this list of conditions and the following disclaimer. +# * Redistributions in binary form must reproduce the above +# copyright notice, this list of conditions and the following +# disclaimer in the documentation and/or other materials provided +# with the distribution. +# * Neither the name of The Linux Foundation nor the names of its +# contributors may be used to endorse or promote products derived +# from this software without specific prior written permission. +# +# THIS SOFTWARE IS PROVIDED "AS IS" AND ANY EXPRESS OR IMPLIED +# WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF +# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT +# ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS +# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR +# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF +# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR +# BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, +# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE +# OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN +# IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + +# Allow all apps to connect to VR service +allow appdomain qvrd:fd use; +unix_socket_connect(appdomain, qvrd, qvrd) diff --git a/msmcobalt/file.te b/msmcobalt/file.te index 7679b9d9..b6d287ab 100644 --- a/msmcobalt/file.te +++ b/msmcobalt/file.te @@ -29,4 +29,8 @@ type sysfs_emmc_dload, sysfs_type, fs_type; # Data type for QVOP -type qvop_data_file, file_type, data_file_type;
\ No newline at end of file +type qvop_data_file, file_type, data_file_type; + +# Data type for qvrd +type qvrd_data_file, file_type, data_file_type; +type qvrd_socket, file_type, mlstrustedobject; diff --git a/msmcobalt/file_contexts b/msmcobalt/file_contexts index a3dde719..1f5a1116 100644 --- a/msmcobalt/file_contexts +++ b/msmcobalt/file_contexts @@ -51,13 +51,20 @@ /sys/kernel/dload/emmc_dload u:object_r:sysfs_emmc_dload:s0 ################################### +# Dev socket nodes +# +/dev/socket/qvrservice u:object_r:qvrd_socket:s0 + +################################### # System files # /system/bin/qvop-daemon u:object_r:qvop_exec:s0 + ################################### # data files # /data/misc/qvop(/.*)? u:object_r:qvop_data_file:s0 +/data/misc/qvr(/.*)? u:object_r:qvrd_data_file:s0 ################################## # non-hlos mount points @@ -72,3 +79,4 @@ # sysfs files # /sys/devices/soc/75ba000.i2c/i2c-12/12-0020/input/input[0-9]/secure_touch_enable u:object_r:sysfs_securetouch:s0 +/sys/devices/virtual/graphics/fb([0-3])+/lineptr_value u:object_r:sysfs_graphics:s0 diff --git a/msmcobalt/init_shell.te b/msmcobalt/init_shell.te index 5f2ea564..ef747698 100644 --- a/msmcobalt/init_shell.te +++ b/msmcobalt/init_shell.te @@ -28,3 +28,6 @@ # For regionalization allow qti_init_shell regionalization_file:dir r_dir_perms; allow qti_init_shell regionalization_file:file create_file_perms; + +# For VR +allow qti_init_shell ctl_qvrd_prop:property_service set; diff --git a/msmcobalt/mm-qcamerad.te b/msmcobalt/mm-qcamerad.te new file mode 100644 index 00000000..5e3ff470 --- /dev/null +++ b/msmcobalt/mm-qcamerad.te @@ -0,0 +1,29 @@ +# Copyright (c) 2016, The Linux Foundation. All rights reserved. +# +# Redistribution and use in source and binary forms, with or without +# modification, are permitted provided that the following conditions are +# met: +# * Redistributions of source code must retain the above copyright +# notice, this list of conditions and the following disclaimer. +# * Redistributions in binary form must reproduce the above +# copyright notice, this list of conditions and the following +# disclaimer in the documentation and/or other materials provided +# with the distribution. +# * Neither the name of The Linux Foundation nor the names of its +# contributors may be used to endorse or promote products derived +# from this software without specific prior written permission. +# +# THIS SOFTWARE IS PROVIDED "AS IS" AND ANY EXPRESS OR IMPLIED +# WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF +# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT +# ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS +# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR +# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF +# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR +# BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, +# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE +# OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN +# IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + +#Allow camera to work normally in VR mode +binder_call(mm-qcamerad, qvrd) diff --git a/msmcobalt/property.te b/msmcobalt/property.te new file mode 100644 index 00000000..e317966c --- /dev/null +++ b/msmcobalt/property.te @@ -0,0 +1,29 @@ +# Copyright (c) 2016, The Linux Foundation. All rights reserved. +# +# Redistribution and use in source and binary forms, with or without +# modification, are permitted provided that the following conditions are +# met: +# * Redistributions of source code must retain the above copyright +# notice, this list of conditions and the following disclaimer. +# * Redistributions in binary form must reproduce the above +# copyright notice, this list of conditions and the following +# disclaimer in the documentation and/or other materials provided +# with the distribution. +# * Neither the name of The Linux Foundation nor the names of its +# contributors may be used to endorse or promote products derived +# from this software without specific prior written permission. +# +# THIS SOFTWARE IS PROVIDED "AS IS" AND ANY EXPRESS OR IMPLIED +# WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF +# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT +# ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS +# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR +# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF +# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR +# BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, +# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE +# OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN +# IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + +#properties for qvrd +type ctl_qvrd_prop, property_type; diff --git a/msmcobalt/property_contexts b/msmcobalt/property_contexts new file mode 100644 index 00000000..9548ba89 --- /dev/null +++ b/msmcobalt/property_contexts @@ -0,0 +1,28 @@ +# Copyright (c) 2016, The Linux Foundation. All rights reserved. +# +# Redistribution and use in source and binary forms, with or without +# modification, are permitted provided that the following conditions are +# met: +# * Redistributions of source code must retain the above copyright +# notice, this list of conditions and the following disclaimer. +# * Redistributions in binary form must reproduce the above +# copyright notice, this list of conditions and the following +# disclaimer in the documentation and/or other materials provided +# with the distribution. +# * Neither the name of The Linux Foundation nor the names of its +# contributors may be used to endorse or promote products derived +# from this software without specific prior written permission. +# +# THIS SOFTWARE IS PROVIDED "AS IS" AND ANY EXPRESS OR IMPLIED +# WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF +# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT +# ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS +# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR +# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF +# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR +# BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, +# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE +# OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN +# IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + +ctl.qvrd u:object_r:ctl_qvrd_prop:s0 diff --git a/msmcobalt/qvrd.te b/msmcobalt/qvrd.te new file mode 100644 index 00000000..778ae61e --- /dev/null +++ b/msmcobalt/qvrd.te @@ -0,0 +1,99 @@ +# Copyright (c) 2016, The Linux Foundation. All rights reserved. +# +# Redistribution and use in source and binary forms, with or without +# modification, are permitted provided that the following conditions are +# met: +# * Redistributions of source code must retain the above copyright +# notice, this list of conditions and the following disclaimer. +# * Redistributions in binary form must reproduce the above +# copyright notice, this list of conditions and the following +# disclaimer in the documentation and/or other materials provided +# with the distribution. +# * Neither the name of The Linux Foundation nor the names of its +# contributors may be used to endorse or promote products derived +# from this software without specific prior written permission. +# +# THIS SOFTWARE IS PROVIDED "AS IS" AND ANY EXPRESS OR IMPLIED +# WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF +# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT +# ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS +# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR +# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF +# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR +# BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, +# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE +# OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN +# IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + +type qvrd, domain, mlstrustedsubject; +type qvrd_exec, exec_type, file_type; + +init_daemon_domain(qvrd) + +# +# General +# + +# Allow interracting with qvrd directory +allow qvrd qvrd_data_file:dir create_dir_perms; +allow qvrd qvrd_data_file:file create_file_perms; + +# Allow access to our socket +allow qvrd qvrd_socket:sock_file rw_file_perms; + +# +# Sensors +# + +# Allow access to ADSP & SLPI +allow qvrd { ion_device qdsp_device dsp_device }:chr_file r_file_perms; + +# Allow access to adsprpcd +r_dir_file(qvrd, adsprpcd_file); +allow qvrd system_file:dir read; + +# +# Display +# + +# Allow access to /sys/devices/virtual/graphics/fb* for lineptr interrupts +allow qvrd sysfs_graphics:file rw_file_perms; + +# Allow access to /dev/graphics/fb0 for configuring vsync interrupts +allow qvrd graphics_device:dir r_dir_perms; +allow qvrd graphics_device:chr_file rw_file_perms; + +# +# Scheduler +# + +allow qvrd self:capability { sys_nice }; +userdebug_or_eng(` + allow qvrd su:process setsched; +') +allow qvrd appdomain:process setsched; + +# +# Camera +# + +# Allow access to camera HAL +allow qvrd { gpu_device video_device camera_device sensors_device }:chr_file rw_file_perms; +allow qvrd camera_data_file:dir rw_dir_perms; +allow qvrd camera_data_file:sock_file w_file_perms; +allow qvrd mm-qcamerad:unix_dgram_socket sendto; +binder_use(qvrd) +binder_call(qvrd, surfaceflinger); +allow qvrd surfaceflinger_service:service_manager find; +allow qvrd sysfs:file r_file_perms; + +# Allow access to /dev/video/* devices +allow qvrd video_device:dir r_dir_perms; + +unix_socket_connect(qvrd, mpctl, perfd) + +# Allow access to sensor1 API +allow qvrd self:socket create_socket_perms; +allow qvrd persist_file:dir r_dir_perms; +allow qvrd sensors_persist_file:dir r_dir_perms; +allow qvrd sensors_persist_file:file r_file_perms; |