diff options
Diffstat (limited to 'common')
| -rw-r--r-- | common/bluetooth.te | 5 | ||||
| -rw-r--r-- | common/dataservice_app.te | 1 | ||||
| -rw-r--r-- | common/device.te | 3 | ||||
| -rw-r--r-- | common/file.te | 7 | ||||
| -rw-r--r-- | common/file_contexts | 7 | ||||
| -rw-r--r-- | common/init.te | 3 | ||||
| -rw-r--r-- | common/init_shell.te | 7 | ||||
| -rwxr-xr-x | common/mmi.te | 2 | ||||
| -rw-r--r-- | common/nqnfcinfo.te | 39 | ||||
| -rwxr-xr-x | common/property.te | 10 | ||||
| -rwxr-xr-x | common/property_contexts | 7 | ||||
| -rwxr-xr-x[-rw-r--r--] | common/qcomsysd.te | 3 | ||||
| -rw-r--r-- | common/qseecomd.te | 3 | ||||
| -rw-r--r-- | common/recovery.te | 6 | ||||
| -rw-r--r-- | common/rfs_access.te | 1 | ||||
| -rw-r--r-- | common/rmt_storage.te | 2 | ||||
| -rw-r--r-- | common/system_server.te | 2 | ||||
| -rw-r--r-- | common/thermal-engine.te | 3 | ||||
| -rw-r--r-- | common/wcnss_filter.te | 4 | ||||
| -rw-r--r-- | common/wcnss_service.te | 4 | ||||
| -rw-r--r-- | common/wfdservice.te | 3 |
21 files changed, 111 insertions, 11 deletions
diff --git a/common/bluetooth.te b/common/bluetooth.te index ffe1ed90..eef36b8d 100644 --- a/common/bluetooth.te +++ b/common/bluetooth.te @@ -11,6 +11,10 @@ type btsnoop, bluetoothdomain, domain_deprecated; type btsnoop_exec, exec_type, file_type; domain_auto_trans(init, btsnoop_exec, bluetooth) +type bt_logger, bluetoothdomain; +type bt_logger_exec, exec_type, file_type; +domain_auto_trans(init, bt_logger_exec, bluetooth) + type btnvtool, bluetoothdomain, domain_deprecated; type btnvtool_exec, exec_type, file_type; domain_auto_trans(init, btnvtool_exec, bluetooth) @@ -37,6 +41,7 @@ allow bluetooth { serial_device #BT needes read and write on smd device node smd_device + bt_device }:chr_file rw_file_perms; #Access to persist_file diff --git a/common/dataservice_app.te b/common/dataservice_app.te index 36056c17..140f0363 100644 --- a/common/dataservice_app.te +++ b/common/dataservice_app.te @@ -33,6 +33,7 @@ net_domain(dataservice_app) allow dataservice_app { qtitetherservice_service dpmservice cne_service } :service_manager { add find } ; allow dataservice_app { app_api_service system_api_service audioserver_service radio_service } :service_manager find; +set_prop(dataservice_app, persist_dpm_prop) set_prop(dataservice_app, sys_usb_tethering_prop) diff --git a/common/device.te b/common/device.te index 362be377..22179749 100644 --- a/common/device.te +++ b/common/device.te @@ -138,3 +138,6 @@ type avtimer_device, dev_type; #define AT device type at_device, dev_type; + +#define Bluetooth device +type bt_device, dev_type; diff --git a/common/file.te b/common/file.te index 2d31a6d4..997d025d 100644 --- a/common/file.te +++ b/common/file.te @@ -190,13 +190,11 @@ type ssr_ramdump_data_file, file_type, data_file_type; # Regionalization files type regionalization_file, file_type; +type regionalization_data_file, file_type, data_file_type; # /data/system/swap/swapfile - swapfile type swap_data_file, file_type, data_file_type; -# dynamic nv files -type dynamic_nv_data_file, file_type, data_file_type; - # wififtmd socket file type wififtmd_socket, file_type; @@ -206,3 +204,6 @@ type persist_time_file, file_type; # kgsl file type for sysfs access type sysfs_kgsl, sysfs_type, fs_type; + +# secure touch files +type sysfs_securetouch, fs_type, sysfs_type; diff --git a/common/file_contexts b/common/file_contexts index b0bb68b6..cd93c2f7 100644 --- a/common/file_contexts +++ b/common/file_contexts @@ -10,6 +10,7 @@ /dev/bhi u:object_r:bhi_device:s0 /dev/msm_.* u:object_r:audio_device:s0 /dev/i2c-6 u:object_r:audio_device:s0 +/dev/wcd_dsp0_control u:object_r:audio_device:s0 /dev/wcd-dsp-glink u:object_r:audio_device:s0 /dev/usf1 u:object_r:usf_device:s0 /dev/msm_dsps u:object_r:sensors_device:s0 @@ -25,6 +26,7 @@ /dev/qsee_ipc_irq_spss u:object_r:qsee_ipc_irq_spss_device:s0 /dev/seemplog u:object_r:seemplog_device:s0 /dev/radio0 u:object_r:fm_radio_device:s0 +/dev/btpower u:object_r:bt_device:s0 /dev/rtc0 u:object_r:rtc_device:s0 /dev/sdsprpc-smd u:object_r:dsp_device:s0 /dev/sensors u:object_r:sensors_device:s0 @@ -135,6 +137,7 @@ /system/bin/ATFWD-daemon u:object_r:atfwd_exec:s0 /system/bin/PktRspTest u:object_r:diag_exec:s0 /system/bin/audiod u:object_r:audiod_exec:s0 +/system/vendor/bin/nqnfcinfo u:object_r:nqnfcinfo_exec:s0 /system/bin/charger_monitor u:object_r:charger_monitor_exec:s0 /system/bin/hvdcp_opti u:object_r:hvdcp_exec:s0 /system/bin/cnd u:object_r:cnd_exec:s0 @@ -231,6 +234,7 @@ /system/bin/sapd u:object_r:sapd_exec:s0 /system/bin/btnvtool u:object_r:btnvtool_exec:s0 /system/bin/btsnoop u:object_r:btsnoop_exec:s0 +/system/bin/bt_logger u:object_r:bt_logger_exec:s0 /system/bin/dun-server u:object_r:dun-server_exec:s0 /system/bin/wfdservice u:object_r:wfdservice_exec:s0 /system/bin/wcnss_filter u:object_r:wcnss_filter_exec:s0 @@ -344,10 +348,9 @@ /data/misc/qti-logkit/socket-privileged(/.*)? u:object_r:qti_logkit_priv_socket:s0 /data/misc/qti-logkit/socket-public(/.*)? u:object_r:qti_logkit_pub_socket:s0 /data/system/swap(/.*)? u:object_r:swap_data_file:s0 -/data/misc/wifi/nvbin(/.*)? u:object_r:dynamic_nv_data_file:s0 /data/misc/wifi/wigig_sockets(/.*)? u:object_r:wpa_socket:s0 /data/misc/wifi/wigig_sockets/wpa_ctrl.* u:object_r:system_wpa_socket:s0 - +/data/app-regional(/.*)? u:object_r:regionalization_data_file:s0 ################################### # persist files # diff --git a/common/init.te b/common/init.te index 6cde24b0..772e5fe4 100644 --- a/common/init.te +++ b/common/init.te @@ -31,3 +31,6 @@ allow init configfs:lnk_file create_file_perms; #Allow init to mount non-hlos partitions in A/B builds allow init firmware_file:dir { mounton }; allow init bt_firmware_file:dir { mounton }; + +#dontaudit non configfs usb denials +dontaudit init sysfs:dir write; diff --git a/common/init_shell.te b/common/init_shell.te index 487caf05..3962d296 100644 --- a/common/init_shell.te +++ b/common/init_shell.te @@ -96,6 +96,10 @@ allow qti_init_shell { sys_usb_configfs_prop #Needed for setting hwui properties in post_boot hwui_prop + #Needed for setting bservice in post_boot + bservice_prop + #Needed for setting Delayed Service Reschedule in post_boot + reschedule_service_prop graphics_vulkan_prop }:property_service set; @@ -160,6 +164,9 @@ allow qti_init_shell kernel:key search; # To change owner of /sys/devices/virtual/hsicctl/hsicctl0/modem_wait to radio allow qti_init_shell sysfs_hsic_modem_wait:file { r_file_perms setattr }; +# To change owner/permissions of secure touch sysfs files +r_dir_file(qti_init_shell, sysfs_securetouch) + # core-ctl allow qti_init_shell cgroup:dir add_name; diff --git a/common/mmi.te b/common/mmi.te index 3fedc290..417f6009 100755 --- a/common/mmi.te +++ b/common/mmi.te @@ -61,6 +61,8 @@ allow mmi bluetooth_data_file:dir rw_dir_perms; allow mmi bluetooth_data_file:file create_file_perms; allow mmi bluetooth_prop:property_service set; allow mmi smd_device:chr_file rw_file_perms; +allow mmi persist_bluetooth_file:file r_file_perms; +allow mmi wcnss_filter:unix_stream_socket connectto; #GPS case allow mmi location_data_file:fifo_file create_file_perms; diff --git a/common/nqnfcinfo.te b/common/nqnfcinfo.te new file mode 100644 index 00000000..3efc94c3 --- /dev/null +++ b/common/nqnfcinfo.te @@ -0,0 +1,39 @@ +#Copyright (c) 2016, The Linux Foundation. All rights reserved. +# +#Redistribution and use in source and binary forms, with or without +#modification, are permitted provided that the following conditions are +#met: +# * Redistributions of source code must retain the above copyright +# notice, this list of conditions and the following disclaimer. +# * Redistributions in binary form must reproduce the above +# copyright notice, this list of conditions and the following +# disclaimer in the documentation and/or other materials provided +# with the distribution. +# * Neither the name of The Linux Foundation nor the names of its +# contributors may be used to endorse or promote products derived +# from this software without specific prior written permission. +# +#THIS SOFTWARE IS PROVIDED "AS IS" AND ANY EXPRESS OR IMPLIED +#WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF +#MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT +#ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS +#BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR +#CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF +#SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR +#BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, +#WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE +#OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN +#IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + +type nqnfcinfo, domain; +type nqnfcinfo_exec, exec_type, file_type; + +# Started by init +init_daemon_domain(nqnfcinfo) + +r_dir_file(nqnfcinfo, sysfs_socinfo); + +set_prop(nqnfcinfo, nfc_nq_prop); + +# Access device nodes inside /dev/nq-nci +allow nqnfcinfo nfc_device:chr_file rw_file_perms; diff --git a/common/property.te b/common/property.te index c3032b10..726d54b5 100755 --- a/common/property.te +++ b/common/property.te @@ -72,6 +72,8 @@ type sys_usb_configfs_prop, property_type; type sys_usb_tethering_prop, property_type; type coresight_prop, property_type, core_property_type; +type persist_dpm_prop, property_type, core_property_type; + type ctl_hbtp_prop, property_type; type alarm_boot_prop, property_type, core_property_type; @@ -92,6 +94,14 @@ type alarm_instance_prop, property_type, core_property_type; #HWUI property type hwui_prop, property_type, core_property_type; +#Bservice property +type bservice_prop, property_type, core_property_type; + +#Delayed Service Reschedule property +type reschedule_service_prop, property_type, core_property_type; + type graphics_vulkan_prop, property_type, core_property_type; #boot mode property type boot_mode_prop, property_type; +#properties for nfc +type nfc_nq_prop, property_type, core_property_type; diff --git a/common/property_contexts b/common/property_contexts index bbaf87b4..8520a256 100755 --- a/common/property_contexts +++ b/common/property_contexts @@ -68,6 +68,7 @@ qemu.hw.mainkeys u:object_r:qemu_hw_mainkeys_prop:s0 ro.dbg.coresight.cfg_file u:object_r:coresight_prop:s0 ctl.hbtp u:object_r:ctl_hbtp_prop:s0 sys.audio.init u:object_r:audio_prop:s0 +persist.dpm.feature u:object_r:persist_dpm_prop:s0 ro.alarm_boot u:object_r:alarm_boot_prop:s0 debug.sf.nobootanimation u:object_r:boot_animation_prop:s0 debug.gralloc. u:object_r:debug_gralloc_prop:s0 @@ -83,8 +84,14 @@ ro.alarm_handled u:object_r:alarm_handled_prop:s0 ro.alarm_instance u:object_r:alarm_instance_prop:s0 #HWUI Property ro.hwui.texture_cache_size u:object_r:hwui_prop:s0 +#Bservice Property +ro.sys.fw.bservice_ u:object_r:bservice_prop:s0 +#Delayed Service Restart Property +ro.am.reschedule_service u:object_r:reschedule_service_prop:s0 persist.graphics.vulkan.disable u:object_r:graphics_vulkan_prop:s0 #boot mode property sys.boot_mode u:object_r:boot_mode_prop:s0 # GPU ro.gpu.available_frequencies u:object_r:freq_prop:s0 +# NFC +sys.nfc.nq. u:object_r:nfc_nq_prop:s0 diff --git a/common/qcomsysd.te b/common/qcomsysd.te index c1257cb8..d9edea1f 100644..100755 --- a/common/qcomsysd.te +++ b/common/qcomsysd.te @@ -21,9 +21,10 @@ allow qcomsysd sysfs_socinfo:file w_file_perms; allow qcomsysd self:capability { dac_override sys_boot }; use_per_mgr(qcomsysd); #allow qcomsysd access boot mode switch -allow qcomsysd boot_mode_prop:property_service set; +set_prop(qcomsysd, boot_mode_prop); #diag userdebug_or_eng(` diag_use(qcomsysd) + allow qcomsysd sysfs:file w_file_perms; ') diff --git a/common/qseecomd.te b/common/qseecomd.te index a2118202..8e2f8955 100644 --- a/common/qseecomd.te +++ b/common/qseecomd.te @@ -47,6 +47,9 @@ allow tee time_daemon:unix_stream_socket connectto; allow tee graphics_device:dir r_dir_perms; allow tee graphics_device:chr_file r_file_perms; +#allow tee access for secure touch to work +allow tee sysfs_securetouch:file rw_file_perms; + allow tee surfaceflinger_service : service_manager find; binder_call(tee, surfaceflinger) diff --git a/common/recovery.te b/common/recovery.te index 210c4050..c5b2c0ec 100644 --- a/common/recovery.te +++ b/common/recovery.te @@ -17,4 +17,10 @@ recovery_only(` allow recovery sg_device:chr_file rw_file_perms; allow recovery self:capability sys_rawio; allow recovery sg_device:chr_file ioctl; + # Enable adb on configfs devices + allow recovery configfs:file rw_file_perms; + allow recovery configfs:dir rw_dir_perms; + set_prop(recovery, ffs_prop); + get_prop(recovery, sys_usb_controller_prop); + get_prop(recovery, boot_mode_prop); ') diff --git a/common/rfs_access.te b/common/rfs_access.te index 318fffc1..629f9e46 100644 --- a/common/rfs_access.te +++ b/common/rfs_access.te @@ -54,7 +54,6 @@ allow rfs_access self:capability { setgid setpcap net_bind_service - net_raw }; # RFS UID and GIDs were changed and moved from old values to new ones OEM range. diff --git a/common/rmt_storage.te b/common/rmt_storage.te index f043becc..56f6f928 100644 --- a/common/rmt_storage.te +++ b/common/rmt_storage.te @@ -17,9 +17,7 @@ allow rmt_storage self:capability { setuid setgid sys_admin - dac_override net_bind_service - net_raw setpcap }; diff --git a/common/system_server.te b/common/system_server.te index f77d8a71..d95864c3 100644 --- a/common/system_server.te +++ b/common/system_server.te @@ -87,6 +87,8 @@ allow system_server { graphics_device audio_device tee_device + #allow access to power control ANT chip + bt_device }:chr_file rw_file_perms; #For firmware diff --git a/common/thermal-engine.te b/common/thermal-engine.te index 33a0efed..734ef4a1 100644 --- a/common/thermal-engine.te +++ b/common/thermal-engine.te @@ -55,3 +55,6 @@ type_transition thermal-engine socket_device:sock_file thermal_socket; userdebug_or_eng(` diag_use(thermal-engine) ') + +# To get GPU frequencies +allow thermal-engine sysfs_kgsl:file r_file_perms; diff --git a/common/wcnss_filter.te b/common/wcnss_filter.te index 7d84a76e..41045f60 100644 --- a/common/wcnss_filter.te +++ b/common/wcnss_filter.te @@ -50,6 +50,10 @@ r_dir_file(wcnss_filter, bt_firmware_file) allow wcnss_filter bluetooth_data_file:dir create_dir_perms; allow wcnss_filter bluetooth_data_file:notdevfile_class_set create_file_perms; +allow wcnss_filter persist_bluetooth_file:dir r_dir_perms; +allow wcnss_filter persist_bluetooth_file:file r_file_perms; +allow wcnss_filter persist_file:dir r_dir_perms; + #diag userdebug_or_eng(` diag_use(wcnss_filter) diff --git a/common/wcnss_service.te b/common/wcnss_service.te index 3d9b44c1..2fc7b46c 100644 --- a/common/wcnss_service.te +++ b/common/wcnss_service.te @@ -41,9 +41,9 @@ allow wcnss_service fuse:dir create_dir_perms; allow wcnss_service fuse:file create_file_perms; allow wcnss_service vfat:dir create_dir_perms; allow wcnss_service vfat:file create_file_perms; + +# needed for wlan dynamic nv feature allow wcnss_service persist_file:file { rw_file_perms setattr }; -allow wcnss_service dynamic_nv_data_file:file r_file_perms; -allow wcnss_service dynamic_nv_data_file:dir r_dir_perms; # This is needed for ptt_socket app to write logs file collected to sdcard r_dir_file(wcnss_service, storage_file) diff --git a/common/wfdservice.te b/common/wfdservice.te index 276e2e15..1514e055 100644 --- a/common/wfdservice.te +++ b/common/wfdservice.te @@ -39,6 +39,9 @@ allow wfdservice audio_device:dir r_dir_perms; #Allow access to /dev/graphics/fb* for screen capture allow wfdservice graphics_device:chr_file rw_file_perms; +#Allow access to encoder for YUV statistics +allow wfdservice gpu_device:chr_file rw_file_perms; + #Allow communication with init over property server unix_socket_connect(wfdservice, property, init); |