Align SELinux policies to new release restrictions

Update multiple policies for new Android release.

Change-Id: I7f486c210a14efcebcb83b5d750c4abd07c178e3

15 files changed, 25 insertions, 26 deletions

diff --git a/common/app.te b/common/app.te
index 9f809aa5..0593280c 100644
--- a/common/app.te
+++ b/common/app.te
@@ -20,8 +20,8 @@ unix_socket_send(appdomain, mpctl, mpdecision)
 unix_socket_connect(appdomain, mpctl, mpdecision)
 
 # Allow access to qti_logkit
-allow appdomain qti_logkit_pub_data_file:dir create_dir_perms;
-allow appdomain qti_logkit_pub_data_file:file create_file_perms;
+allow { appdomain -untrusted_app } qti_logkit_pub_data_file:dir create_dir_perms;
+allow { appdomain -untrusted_app } qti_logkit_pub_data_file:file create_file_perms;
 allow appdomain qti_logkit_pub_socket:dir r_dir_perms;
 unix_socket_connect(appdomain, qti_logkit_pub, qti_logkit)
 allow appdomain qti_logkit_pub_socket:sock_file r_file_perms;
diff --git a/common/bluetooth.te b/common/bluetooth.te
index 5da23a0d..28fbd655 100644
--- a/common/bluetooth.te
+++ b/common/bluetooth.te
@@ -28,7 +28,7 @@ allow bluetooth media_rw_data_file:file create_file_perms;
 #allow proc_sysrq access for crash dump
 userdebug_or_eng(`
  allow bluetooth proc_sysrq:file w_file_perms;
- allow bluetooth debugfs:file r_file_perms;
+ #allow bluetooth debugfs:file r_file_perms;
 ')
 
 allow bluetooth {
diff --git a/common/diag.te b/common/diag.te
index 5ef5aafc..3a9e25f2 100644
--- a/common/diag.te
+++ b/common/diag.te
@@ -18,7 +18,7 @@ userdebug_or_eng(`
 
   allow diag {
       cgroup
-      sdcard_internal
+      fuse
       persist_drm_file
   }:dir create_dir_perms;
 
diff --git a/common/file_contexts b/common/file_contexts
index aed75975..4543e217 100644
--- a/common/file_contexts
+++ b/common/file_contexts
@@ -25,9 +25,9 @@
 /dev/ttyHS[0-9]*                                u:object_r:serial_device:s0
 /dev/ttyGS0                                     u:object_r:gadget_serial_device:s0
 /dev/usb_ext_chg                                u:object_r:hvdcp_device:s0
-/dev/media([0-9])+                              u:object_r:camera_device:s0
-/dev/jpeg[0-9]*                                 u:object_r:camera_device:s0
-/dev/v4l-subdev.*                               u:object_r:camera_device:s0
+/dev/media([0-9])+                              u:object_r:video_device:s0
+/dev/jpeg[0-9]*                                 u:object_r:video_device:s0
+/dev/v4l-subdev.*                               u:object_r:video_device:s0
 /dev/vm_bms                                     u:object_r:vm_bms_device:s0
 /dev/battery_data                               u:object_r:battery_data_device:s0
 /dev/block/mmcblk1                              u:object_r:sd_device:s0
diff --git a/common/mediaserver.te b/common/mediaserver.te
index 6d3508a0..1af2dec3 100644
--- a/common/mediaserver.te
+++ b/common/mediaserver.te
@@ -1,7 +1,6 @@
 # allow mediaserver to communicate with cnd
 unix_socket_connect(mediaserver, cnd, cnd)
 
-allow mediaserver camera_device:chr_file rw_file_perms;
 unix_socket_send(mediaserver, camera, mm-qcamerad)
 
 allow mediaserver tee_device:chr_file rw_file_perms;
@@ -18,7 +17,7 @@ userdebug_or_eng(`
   allow mediaserver camera_data_file:dir rw_dir_perms;
   allow mediaserver camera_data_file:file create_file_perms;
   # Access to audio
-  allow mediaserver debugfs:file rw_file_perms;
+  #allow mediaserver debugfs:file rw_file_perms;
 ')
 
 r_dir_file(mediaserver, sysfs_esoc)
diff --git a/common/mm-qcamerad.te b/common/mm-qcamerad.te
index 4be1fa47..65b3d99e 100644
--- a/common/mm-qcamerad.te
+++ b/common/mm-qcamerad.te
@@ -4,8 +4,8 @@ init_daemon_domain(mm-qcamerad)
 
 #added to support EZTune for camera
 userdebug_or_eng(`
-  allow mm-qcamerad debugfs:dir r_dir_perms;
-  allow mm-qcamerad debugfs:file read;
+  #allow mm-qcamerad debugfs:dir r_dir_perms;
+  #allow mm-qcamerad debugfs:file read;
   allow mm-qcamerad camera_data_file:file create_file_perms;
   allow mm-qcamerad self:tcp_socket create_stream_socket_perms;
   allow mm-qcamerad node:tcp_socket node_bind;
@@ -33,8 +33,8 @@ binder_use(mm-qcamerad);
 allow mm-qcamerad self:process execmem;
 
 # Interact with other media devices
-allow mm-qcamerad camera_device:dir r_dir_perms;
-allow mm-qcamerad { gpu_device video_device camera_device sensors_device }:chr_file rw_file_perms;
+allow mm-qcamerad video_device:dir r_dir_perms;
+allow mm-qcamerad { gpu_device video_device sensors_device }:chr_file rw_file_perms;
 
 allow mm-qcamerad { surfaceflinger mediaserver }:fd use;
 
@@ -58,4 +58,4 @@ allow mm-qcamerad graphics_device:chr_file rw_file_perms;
 unix_socket_connect(mm-qcamerad, property, init)
 
 #Allow camera work normally in FFBM
-binder_call(mm-qcamerad, mmi)；
+binder_call(mm-qcamerad, mmi);
diff --git a/common/mmi.te b/common/mmi.te
index c4436327..78069b31 100755
--- a/common/mmi.te
+++ b/common/mmi.te
@@ -78,7 +78,6 @@ allow mmi block_device:blk_file getattr;
 allow mmi block_device:dir r_dir_perms;
 
 #camera
-allow mmi camera_device:chr_file rw_file_perms;
 allow mmi video_device:chr_file rw_file_perms;
 allow mmi camera_data_file:sock_file write;
 allow mmi camera_data_file:dir r_dir_perms;
diff --git a/common/netd.te b/common/netd.te
index 9e067dd7..77886373 100644
--- a/common/netd.te
+++ b/common/netd.te
@@ -10,7 +10,7 @@ allow netd wfdservice:fd use;
 allow netd wfdservice:tcp_socket rw_socket_perms;
 
 binder_use(netd);
-binder_call(netd, qtitetherservice_app);
+#binder_call(netd, qtitetherservice_app);
 
 # allow to read /data/misc/ipa/tether_stats file
 allow netd ipacm_data_file:dir r_dir_perms;
diff --git a/common/nfc.te b/common/nfc.te
index 872a63a0..f1393962 100644
--- a/common/nfc.te
+++ b/common/nfc.te
@@ -1,3 +1,3 @@
 qmux_socket(nfc);
-allow nfc nfc_data_file:file x_file_perms;
+#allow nfc nfc_data_file:file x_file_perms;
 allow nfc self:socket create_socket_perms;
diff --git a/common/qlogd.te b/common/qlogd.te
index e7402e4b..4bb939ca 100644
--- a/common/qlogd.te
+++ b/common/qlogd.te
@@ -45,7 +45,8 @@ allow qlogd kernel:system syslog_mod;
 
 # need for qdss log and odl from UI
 userdebug_or_eng(`
-  allow qlogd { debugfs qdss_device }:file r_file_perms;
+  #allow qlogd { debugfs qdss_device }:file r_file_perms;
+  allow qlogd { qdss_device }:file r_file_perms;
   allow qlogd sysfs:file w_file_perms;
   r_dir_file(qlogd, storage_file)
   r_dir_file(qlogd, mnt_user_file)
diff --git a/common/qseecomd.te b/common/qseecomd.te
index 2140c583..6f21134b 100644
--- a/common/qseecomd.te
+++ b/common/qseecomd.te
@@ -60,8 +60,8 @@ allow tee system_prop:property_service set;
 
 userdebug_or_eng(`
   allow tee su:unix_dgram_socket sendto;
-  allow tee shell_data_file:file rw_file_perms;
-  allow tee shell_data_file:dir search;
+  #allow tee shell_data_file:file rw_file_perms;
+  #allow tee shell_data_file:dir search;
 ')
 
 # allow qseecom access to set system property
diff --git a/common/ridl.te b/common/ridl.te
index ea425351..d30f4235 100644
--- a/common/ridl.te
+++ b/common/ridl.te
@@ -41,7 +41,7 @@ net_domain(RIDL)
 allow RIDL RIDL_data_file:dir create_dir_perms;
 allow RIDL RIDL_data_file:file create_file_perms;
 allow RIDL RIDL_data_file:lnk_file { create read unlink };
-allow RIDL debugfs:file read;
+#allow RIDL debugfs:file read;
 
 # ver_info.txt
 r_dir_file(RIDL, firmware_file)
diff --git a/common/system_app.te b/common/system_app.te
index 6f0624c7..af07e9d9 100644
--- a/common/system_app.te
+++ b/common/system_app.te
@@ -28,7 +28,7 @@ unix_socket_connect(system_app, mpctl, perfd)
 unix_socket_connect(system_app, pps, mm-pp-daemon)
 
 userdebug_or_eng(`
-  allow system_app debugfs:file r_file_perms;
+  #allow system_app debugfs:file r_file_perms;
   allow system_app su:unix_dgram_socket sendto;
   allow system_app persist_file:dir r_dir_perms;
   allow system_app sensors_persist_file:dir r_dir_perms;
diff --git a/msm8960/file_contexts b/msm8960/file_contexts
index 877f6bbc..d5a3727e 100755
--- a/msm8960/file_contexts
+++ b/msm8960/file_contexts
@@ -1,7 +1,7 @@
 ###################################
 # Dev nodes
 #
-/dev/msm_camera(/.*)?                           u:object_r:camera_device:s0
+/dev/msm_camera(/.*)?                           u:object_r:video_device:s0
 /dev/msm_rotator                                u:object_r:graphics_device:s0
 /dev/mdp_arb                                    u:object_r:graphics_device:s0
 /dev/mdm                                        u:object_r:mdm_device:s0
diff --git a/test/qti-testscripts.te b/test/qti-testscripts.te
index d271f512..0ce770d5 100644
--- a/test/qti-testscripts.te
+++ b/test/qti-testscripts.te
@@ -72,10 +72,10 @@ userdebug_or_eng(`
   r_dir_file(qti-testscripts, domain)
 
   allow adbd qti-testscripts:process dyntransition;
-  allow domain qti-testscripts:unix_stream_socket connectto;
+  allow { domain -mediaextractor -mediacodec } qti-testscripts:unix_stream_socket connectto;
   allow domain qti-testscripts:fd use;
-  allow domain qti-testscripts:unix_stream_socket { getattr getopt read write shutdown };
-  binder_call({ domain -init }, qti-testscripts)
+  allow { domain -mediaextractor -mediacodec } qti-testscripts:unix_stream_socket { getattr getopt read write shutdown };
+  binder_call({ domain -init -netd }, qti-testscripts)
   allow domain qti-testscripts:fifo_file { write getattr };
   allow domain qti-testscripts:process sigchld;