diff options
author | Suresh Kumar Sugguna <sureshk@codeaurora.org> | 2017-11-19 16:50:57 +0530 |
---|---|---|
committer | Gerrit - the friendly Code Review server <code-review@localhost> | 2018-02-08 20:59:48 -0800 |
commit | d2b7a4a99372e0339f899592adaa0e04c086cb92 (patch) | |
tree | fb7b7d831dbb55c0970517053235548477774670 /qcs605 | |
parent | ca6b49c08ee9eefa6bd41fed993e5604153b2313 (diff) | |
download | android_device_qcom_sepolicy-d2b7a4a99372e0339f899592adaa0e04c086cb92.tar.gz android_device_qcom_sepolicy-d2b7a4a99372e0339f899592adaa0e04c086cb92.tar.bz2 android_device_qcom_sepolicy-d2b7a4a99372e0339f899592adaa0e04c086cb92.zip |
sepolicy: initial qmmf-server sepolicy drop
Add qmmf server and corresponding access permissions.
Change-Id: I324ae9cdfa45f298b392ab81bdd24c8b025175f5
Diffstat (limited to 'qcs605')
-rw-r--r-- | qcs605/file.te | 29 | ||||
-rw-r--r-- | qcs605/file_contexts | 8 | ||||
-rw-r--r-- | qcs605/genfs_contexts | 28 | ||||
-rw-r--r-- | qcs605/mm-qcamerad.te | 29 | ||||
-rw-r--r-- | qcs605/property.te | 28 | ||||
-rw-r--r-- | qcs605/property_contexts | 29 | ||||
-rw-r--r-- | qcs605/qmmf-servd.te | 74 | ||||
-rw-r--r-- | qcs605/system_server.te | 28 | ||||
-rw-r--r-- | qcs605/vndservice.te | 32 | ||||
-rw-r--r-- | qcs605/vndservice_contexts | 32 |
10 files changed, 316 insertions, 1 deletions
diff --git a/qcs605/file.te b/qcs605/file.te new file mode 100644 index 00000000..c403cfec --- /dev/null +++ b/qcs605/file.te @@ -0,0 +1,29 @@ +# Copyright (c) 2018, The Linux Foundation. All rights reserved. +# +# Redistribution and use in source and binary forms, with or without +# modification, are permitted provided that the following conditions are +# met: +# * Redistributions of source code must retain the above copyright +# notice, this list of conditions and the following disclaimer. +# * Redistributions in binary form must reproduce the above +# copyright notice, this list of conditions and the following +# disclaimer in the documentation and/or other materials provided +# with the distribution. +# * Neither the name of The Linux Foundation nor the names of its +# contributors may be used to endorse or promote products derived +# from this software without specific prior written permission. +# +# THIS SOFTWARE IS PROVIDED "AS IS" AND ANY EXPRESS OR IMPLIED +# WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF +# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT +# ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS +# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR +# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF +# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR +# BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, +# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE +# OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN +# IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + +# qmmf data file +type qmmf_data_file, file_type, data_file_type; diff --git a/qcs605/file_contexts b/qcs605/file_contexts index 323cec25..40b3d162 100644 --- a/qcs605/file_contexts +++ b/qcs605/file_contexts @@ -1,4 +1,4 @@ -# Copyright (c) 2016-2017, The Linux Foundation. All rights reserved. +# Copyright (c) 2016-2018, The Linux Foundation. All rights reserved. # # Redistribution and use in source and binary forms, with or without # modification, are permitted provided that the following conditions are @@ -148,3 +148,9 @@ # same process HAL libs /vendor/lib(64)?/hw/gralloc\.qcs605\.so u:object_r:same_process_hal_file:s0 /vendor/lib(64)?/hw/vulkan\.qcs605\.so u:object_r:same_process_hal_file:s0 + +# qmmf server +/(vendor|system/vendor)/bin/qmmf-server u:object_r:qmmf-servd_exec:s0 + +# qmmf data files +/data/misc/qmmf(/.*)? u:object_r:qmmf_data_file:s0 diff --git a/qcs605/genfs_contexts b/qcs605/genfs_contexts new file mode 100644 index 00000000..4c40db30 --- /dev/null +++ b/qcs605/genfs_contexts @@ -0,0 +1,28 @@ +# Copyright (c) 2018, The Linux Foundation. All rights reserved. +# +# Redistribution and use in source and binary forms, with or without +# modification, are permitted provided that the following conditions are +# met: +# * Redistributions of source code must retain the above copyright +# notice, this list of conditions and the following disclaimer. +# * Redistributions in binary form must reproduce the above +# copyright notice, this list of conditions and the following +# disclaimer in the documentation and/or other materials provided +# with the distribution. +# * Neither the name of The Linux Foundation nor the names of its +# contributors may be used to endorse or promote products derived +# from this software without specific prior written permission. +# +# THIS SOFTWARE IS PROVIDED "AS IS" AND ANY EXPRESS OR IMPLIED +# WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF +# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT +# ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS +# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR +# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF +# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR +# BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, +# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE +# OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN +# IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + +genfscon proc /asound/cards u:object_r:proc_audiod:s0 diff --git a/qcs605/mm-qcamerad.te b/qcs605/mm-qcamerad.te new file mode 100644 index 00000000..5e48baf2 --- /dev/null +++ b/qcs605/mm-qcamerad.te @@ -0,0 +1,29 @@ +# Copyright (c) 2018, The Linux Foundation. All rights reserved. +# +# Redistribution and use in source and binary forms, with or without +# modification, are permitted provided that the following conditions are +# met: +# * Redistributions of source code must retain the above copyright +# notice, this list of conditions and the following disclaimer. +# * Redistributions in binary form must reproduce the above +# copyright notice, this list of conditions and the following +# disclaimer in the documentation and/or other materials provided +# with the distribution. +# * Neither the name of The Linux Foundation nor the names of its +# contributors may be used to endorse or promote products derived +# from this software without specific prior written permission. +# +# THIS SOFTWARE IS PROVIDED "AS IS" AND ANY EXPRESS OR IMPLIED +# WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF +# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT +# ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS +# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR +# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF +# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR +# BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, +# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE +# OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN +# IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + +#Allow fd use for qmmf-server +allow mm-qcamerad qmmf-servd:fd use; diff --git a/qcs605/property.te b/qcs605/property.te new file mode 100644 index 00000000..f7bf0ae3 --- /dev/null +++ b/qcs605/property.te @@ -0,0 +1,28 @@ +# Copyright (c) 2018, The Linux Foundation. All rights reserved. +# +# Redistribution and use in source and binary forms, with or without +# modification, are permitted provided that the following conditions are +# met: +# * Redistributions of source code must retain the above copyright +# notice, this list of conditions and the following disclaimer. +# * Redistributions in binary form must reproduce the above +# copyright notice, this list of conditions and the following +# disclaimer in the documentation and/or other materials provided +# with the distribution. +# * Neither the name of The Linux Foundation nor the names of its +# contributors may be used to endorse or promote products derived +# from this software without specific prior written permission. +# +# THIS SOFTWARE IS PROVIDED "AS IS" AND ANY EXPRESS OR IMPLIED +# WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF +# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT +# ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS +# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR +# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF +# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR +# BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, +# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE +# OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN +# IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + +type qmmf_prop, property_type; diff --git a/qcs605/property_contexts b/qcs605/property_contexts new file mode 100644 index 00000000..057446f0 --- /dev/null +++ b/qcs605/property_contexts @@ -0,0 +1,29 @@ +# Copyright (c) 2018, The Linux Foundation. All rights reserved. +# +# Redistribution and use in source and binary forms, with or without +# modification, are permitted provided that the following conditions are +# met: +# * Redistributions of source code must retain the above copyright +# notice, this list of conditions and the following disclaimer. +# * Redistributions in binary form must reproduce the above +# copyright notice, this list of conditions and the following +# disclaimer in the documentation and/or other materials provided +# with the distribution. +# * Neither the name of The Linux Foundation nor the names of its +# contributors may be used to endorse or promote products derived +# from this software without specific prior written permission. +# +# THIS SOFTWARE IS PROVIDED "AS IS" AND ANY EXPRESS OR IMPLIED +# WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF +# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT +# ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS +# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR +# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF +# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR +# BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, +# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE +# OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN +# IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + +qmmf. u:object_r:qmmf_prop:s0 +persist.qmmf. u:object_r:qmmf_prop:s0 diff --git a/qcs605/qmmf-servd.te b/qcs605/qmmf-servd.te new file mode 100644 index 00000000..7b6b795e --- /dev/null +++ b/qcs605/qmmf-servd.te @@ -0,0 +1,74 @@ +# Copyright (c) 2017-2018, The Linux Foundation. All rights reserved. +# +# Redistribution and use in source and binary forms, with or without +# modification, are permitted provided that the following conditions are +# met: +# * Redistributions of source code must retain the above copyright +# notice, this list of conditions and the following disclaimer. +# * Redistributions in binary form must reproduce the above +# copyright notice, this list of conditions and the following +# disclaimer in the documentation and/or other materials provided +# with the distribution. +# * Neither the name of The Linux Foundation nor the names of its +# contributors may be used to endorse or promote products derived +# from this software without specific prior written permission. +# +# THIS SOFTWARE IS PROVIDED "AS IS" AND ANY EXPRESS OR IMPLIED +# WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF +# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT +# ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS +# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR +# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF +# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR +# BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, +# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE +# OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN +# IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + +type qmmf-servd, domain; +type qmmf-servd_exec, exec_type, vendor_file_type, file_type; +init_daemon_domain(qmmf-servd) + +vndbinder_use(qmmf-servd); + +userdebug_or_eng(` + # Allow access to debugfs + allow qmmf-servd qti_debugfs:dir r_dir_perms; + allow qmmf-servd qti_debugfs:file rw_file_perms; +') + +# Allow access to video devices +allow qmmf-servd { gpu_device video_device }:chr_file rw_file_perms; + +# Allow access to camera socket file +allow qmmf-servd camera_data_file:dir w_dir_perms; +allow qmmf-servd camera_data_file:file create_file_perms; + +hal_client_domain(qmmf-servd, hal_perf) +unix_socket_connect(qmmf-servd, property, init) + +# Allow qmmf to get properties +get_prop(qmmf-servd, bluetooth_prop) +get_prop(qmmf-servd, camera_prop) +set_prop(qmmf-servd, qmmf_prop) + +# Allow qmmf to talk with mm-qcamera daemon +allow qmmf-servd mm-qcamerad:unix_dgram_socket sendto; + +# Allow qmmf to register it's services +allow qmmf-servd { qmmf_system_service + qmmf_recorder_service + qmmf_audio_service + qmmf_player_service + qmmf_display_service + }:service_manager { add find }; + +allow qmmf-servd qmmf_data_file:dir rw_dir_perms; + +allow qmmf-servd audio_device:dir search; +allow qmmf-servd audio_device:chr_file rw_file_perms; +allow qmmf-servd audio_data_file:dir rw_dir_perms; +allow qmmf-servd audio_data_file:file create_file_perms; +allow qmmf-servd proc_audiod:file r_file_perms; + +allow qmmf-servd ion_device:chr_file r_file_perms; diff --git a/qcs605/system_server.te b/qcs605/system_server.te new file mode 100644 index 00000000..65d315e7 --- /dev/null +++ b/qcs605/system_server.te @@ -0,0 +1,28 @@ +# Copyright (c) 2018, The Linux Foundation. All rights reserved. +# +# Redistribution and use in source and binary forms, with or without +# modification, are permitted provided that the following conditions are +# met: +# * Redistributions of source code must retain the above copyright +# notice, this list of conditions and the following disclaimer. +# * Redistributions in binary form must reproduce the above +# copyright notice, this list of conditions and the following +# disclaimer in the documentation and/or other materials provided +# with the distribution. +# * Neither the name of The Linux Foundation nor the names of its +# contributors may be used to endorse or promote products derived +# from this software without specific prior written permission. +# +# THIS SOFTWARE IS PROVIDED "AS IS" AND ANY EXPRESS OR IMPLIED +# WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF +# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT +# ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS +# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR +# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF +# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR +# BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, +# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE +# OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN +# IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + +allow system_server proc_audiod:file r_file_perms; diff --git a/qcs605/vndservice.te b/qcs605/vndservice.te new file mode 100644 index 00000000..6cb544cb --- /dev/null +++ b/qcs605/vndservice.te @@ -0,0 +1,32 @@ +# Copyright (c) 2018, The Linux Foundation. All rights reserved. + +# Redistribution and use in source and binary forms, with or without +# modification, are permitted provided that the following conditions are +# met: +# * Redistributions of source code must retain the above copyright +# notice, this list of conditions and the following disclaimer. +# * Redistributions in binary form must reproduce the above +# copyright notice, this list of conditions and the following +# disclaimer in the documentation and/or other materials provided +# with the distribution. +# * Neither the name of The Linux Foundation nor the names of its +# contributors may be used to endorse or promote products derived +# from this software without specific prior written permission. +# +# THIS SOFTWARE IS PROVIDED "AS IS" AND ANY EXPRESS OR IMPLIED +# WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF +# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT +# ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS +# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR +# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF +# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR +# BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, +# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE +# OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN +# IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + +type qmmf_audio_service, vndservice_manager_type; +type qmmf_recorder_service, vndservice_manager_type; +type qmmf_player_service, vndservice_manager_type; +type qmmf_display_service, vndservice_manager_type; +type qmmf_system_service, vndservice_manager_type; diff --git a/qcs605/vndservice_contexts b/qcs605/vndservice_contexts new file mode 100644 index 00000000..fad8886f --- /dev/null +++ b/qcs605/vndservice_contexts @@ -0,0 +1,32 @@ +# Copyright (c) 2018, The Linux Foundation. All rights reserved. + +# Redistribution and use in source and binary forms, with or without +# modification, are permitted provided that the following conditions are +# met: +# * Redistributions of source code must retain the above copyright +# notice, this list of conditions and the following disclaimer. +# * Redistributions in binary form must reproduce the above +# copyright notice, this list of conditions and the following +# disclaimer in the documentation and/or other materials provided +# with the distribution. +# * Neither the name of The Linux Foundation nor the names of its +# contributors may be used to endorse or promote products derived +# from this software without specific prior written permission. +# +# THIS SOFTWARE IS PROVIDED "AS IS" AND ANY EXPRESS OR IMPLIED +# WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF +# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT +# ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS +# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR +# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF +# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR +# BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, +# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE +# OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN +# IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + +qmmf_system.service u:object_r:qmmf_system_service:s0 +qmmf_audio.service u:object_r:qmmf_audio_service:s0 +qmmf_recorder.service u:object_r:qmmf_recorder_service:s0 +qmmf_player.service u:object_r:qmmf_player_service:s0 +qmmf_display.service u:object_r:qmmf_display_service:s0 |