Piteball
/
android_device_asus_flo
mirror of https://github.com/followmsi/android_device_asus_flo.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity
android_device_asus_flo/sepolicy/file_contexts

99 lines
4.9 KiB
Plaintext
Raw Permalink Normal View History

Label kgsl (graphics) nodes. Created a new label and addressed the following denials. * For system server denied { read write } for pid=800 comm="ndroid.systemui" name="kgsl-3d0" dev="tmpfs" ino=8426 scontext=u:r:platform_app:s0 tcontext=u:object_r:device:s0 tclass=chr_file denied { open } for pid=800 comm="ndroid.systemui" name="kgsl-3d0" dev="tmpfs" ino=8426 scontext=u:r:platform_app:s0 tcontext=u:object_r:device:s0 tclass=chr_file denied { ioctl } for pid=800 comm="ndroid.systemui" path="/dev/kgsl-3d0" dev="tmpfs" ino=8426 scontext=u:r:platform_app:s0 tcontext=u:object_r:device:s0 tclass=chr_file * For surfaceflinger denied { ioctl } for pid=286 comm="SurfaceFlinger" path="/dev/kgsl-3d0" dev="tmpfs" ino=8426 scontext=u:r:surfaceflinger:s0 tcontext=u:object_r:device:s0 tclass=chr_file denied { read write } for pid=286 comm="SurfaceFlinger" path="/dev/kgsl-3d0" dev="tmpfs" ino=8426 scontext=u:r:surfaceflinger:s0 tcontext=u:object_r:device:s0 tclass=chr_file * For app domains denied { read write } for pid=800 comm="ndroid.systemui" name="kgsl-3d0" dev="tmpfs" ino=8426 scontext=u:r:platform_app:s0 tcontext=u:object_r:device:s0 tclass=chr_file denied { open } for pid=800 comm="ndroid.systemui" name="kgsl-3d0" dev="tmpfs" ino=8426 scontext=u:r:platform_app:s0 tcontext=u:object_r:device:s0 tclass=chr_file denied { ioctl } for pid=800 comm="ndroid.systemui" path="/dev/kgsl-3d0" dev="tmpfs" ino=8426 scontext=u:r:platform_app:s0 tcontext=u:object_r:device:s0 tclass=chr_file Change-Id: I417bbd12fbdc17cd3d1110dcf3bff73dd5e385a4
2013-11-13 15:47:59 +00:00
###### GPU device (world r/w)
/dev/kgsl u:object_r:gpu_device:s0
Create new security labels for device nodes. Labeling nodes with appropriate types doesn't introduce any new denials to the mix. This list largely addresses the Qualcomm specific nodes. Various nodes are labeled with radio specific types. Since the deb build inherits from this flo policy, it is a good idea to include them. Change-Id: Ia55a80af027c8bde933d45c41f4ed287f01adb2e
2013-11-13 16:10:28 +00:00
/dev/bcm2079x-i2c u:object_r:nfc_device:s0
flo: Update sepolicies
2020-11-26 10:02:35 +00:00
/dev/stune(/.*)? u:object_r:cgroup:s0
Create new security labels for device nodes. Labeling nodes with appropriate types doesn't introduce any new denials to the mix. This list largely addresses the Qualcomm specific nodes. Various nodes are labeled with radio specific types. Since the deb build inherits from this flo policy, it is a good idea to include them. Change-Id: Ia55a80af027c8bde933d45c41f4ed287f01adb2e
2013-11-13 16:10:28 +00:00
Add SELinux policy for kickstart denials. Access to m9kefs* block devices. avc: denied { getattr } for pid=215 comm="sh" path="/dev/block/mmcblk0p5" dev="tmpfs" ino=7618 scontext=u:r:kickstart:s0 tcontext=u:object_r:block_device:s0 tclass=blk_file avc: denied { setattr } for pid=216 comm="chown" name="mmcblk0p5" dev="tmpfs" ino=7618 scontext=u:r:kickstart:s0 tcontext=u:object_r:block_device:s0 tclass=blk_file Change owner and perms on /dev/block/platform/msm_sdcc.1/by-name/m9kefs* avc: denied { chown } for pid=216 comm="chown" capability=0 scontext=u:r:kickstart:s0 tcontext=u:r:kickstart:s0 tclass=capability avc: denied { fowner } for pid=220 comm="chmod" capability=3 scontext=u:r:kickstart:s0 tcontext=u:r:kickstart:s0 tclass=capability Label and give access to specific rmnet usb files. avc: denied { write } for pid=182 comm="sh" name="rmnet_data_init" dev="sysfs" ino=4275 scontext=u:r:kickstart:s0 tcontext=u:object_r:sysfs:s0 tclass=file Change-Id: I2a1edda0efdfc57615c56c61ee446c343d7d875b Signed-off-by: rpcraig <rpcraig@tycho.ncsc.mil>
2014-02-12 17:47:42 +00:00
# efs block labeling
Assign specific types to system and recovery block devices. This assigns the types defined by Ie9c1f6d632f6e9e8cbba106f07f6b1979d2a3c4a to the block device files for the system and recovery partitions as per the fstab.<board> file. Also rewrite the existing /dev/block entries for other partitions to use the by-name symlinks where possible. Change-Id: Ia1fbe871b567b5c4a7004b07c84d8d6348b81c47 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-10-02 14:32:56 +00:00
/dev/block/platform/msm_sdcc\.1/by-name/m9kefs[123c] u:object_r:efs_block_device:s0
/dev/block/platform/msm_sdcc\.1/by-name/modemst[12] u:object_r:modem_block_device:s0
Assign specific types to userdata and cache block devices. This assigns the types defined by I99d24f06506f51ebf1d186d9c393b3cad60e98d7 to the block device files for userdata and cache for this device. Change-Id: I731ba250d694a080857e19ab996f4229bf003e30 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-09-24 19:23:48 +00:00
/dev/block/platform/msm_sdcc\.1/by-name/userdata u:object_r:userdata_block_device:s0
Assign specific type to metadata block device. This assigns the type defined by Id3bea28f5958086716cd3db055bea309b3b5fa5a to the block device file for the metadata partition specified via the encryptable= option for the userdata entry in the fstab.<board> file. Change-Id: I0ef96fa716be89fa9f8b6c03014a76ac2556d06e Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-10-21 13:27:16 +00:00
# encryption metadata
/dev/block/platform/msm_sdcc\.1/by-name/metadata u:object_r:metadata_block_device:s0
Add SELinux policy for kickstart denials. Access to m9kefs* block devices. avc: denied { getattr } for pid=215 comm="sh" path="/dev/block/mmcblk0p5" dev="tmpfs" ino=7618 scontext=u:r:kickstart:s0 tcontext=u:object_r:block_device:s0 tclass=blk_file avc: denied { setattr } for pid=216 comm="chown" name="mmcblk0p5" dev="tmpfs" ino=7618 scontext=u:r:kickstart:s0 tcontext=u:object_r:block_device:s0 tclass=blk_file Change owner and perms on /dev/block/platform/msm_sdcc.1/by-name/m9kefs* avc: denied { chown } for pid=216 comm="chown" capability=0 scontext=u:r:kickstart:s0 tcontext=u:r:kickstart:s0 tclass=capability avc: denied { fowner } for pid=220 comm="chmod" capability=3 scontext=u:r:kickstart:s0 tcontext=u:r:kickstart:s0 tclass=capability Label and give access to specific rmnet usb files. avc: denied { write } for pid=182 comm="sh" name="rmnet_data_init" dev="sysfs" ino=4275 scontext=u:r:kickstart:s0 tcontext=u:object_r:sysfs:s0 tclass=file Change-Id: I2a1edda0efdfc57615c56c61ee446c343d7d875b Signed-off-by: rpcraig <rpcraig@tycho.ncsc.mil>
2014-02-12 17:47:42 +00:00
flo/deb: sepolicy: label misc block device to resolve uncrypt denial Fixes Settings->Erase options->Erase all data and LineageOS updater installation. Change-Id: I193583783fa5d344ed44b98a00c3281742a67ee0
2018-04-22 06:32:43 +00:00
/dev/block/platform/msm_sdcc\.1/by-name/misc u:object_r:misc_block_device:s0
Create new security labels for device nodes. Labeling nodes with appropriate types doesn't introduce any new denials to the mix. This list largely addresses the Qualcomm specific nodes. Various nodes are labeled with radio specific types. Since the deb build inherits from this flo policy, it is a good idea to include them. Change-Id: Ia55a80af027c8bde933d45c41f4ed287f01adb2e
2013-11-13 16:10:28 +00:00
# CPU governor controls
/dev/socket/mpdecision(/.*)? u:object_r:mpdecision_socket:s0
## Radio related
# high speed inter-chip controls
/dev/hsicctl[0-3] u:object_r:radio_device:s0
# mux controller
/dev/rmnet_mux_ctrl u:object_r:radio_device:s0
# qmi protocol driver
/dev/qmi[0-2] u:object_r:radio_device:s0
# shared memory drivers
/dev/smdcntl[0-7] u:object_r:radio_device:s0
# Bluetooth shared memory interfaces
/dev/smd2 u:object_r:hci_attach_dev:s0
/dev/smd3 u:object_r:hci_attach_dev:s0
# Default label for shared memory drivers
/dev/smd([0-9])+ u:object_r:smd_device:s0
# Serial console
/dev/ttyHS0 u:object_r:hci_attach_dev:s0
# Serial-to-Usb support
/dev/ttyUSB0 u:object_r:radio_device:s0
# Jpeg Engine support
camera_device: remove type camera_device didn't really offer much in terms of control considering that most domains that need camera_device, also need video_device and vice versa. Thus, drop camera_device from the policy. Change-Id: Ib7773985ba3b93537702b113a2deb5d2f6f3c7ef
2016-01-08 21:31:39 +00:00
/dev/gemini.* u:object_r:video_device:s0
Create new security labels for device nodes. Labeling nodes with appropriate types doesn't introduce any new denials to the mix. This list largely addresses the Qualcomm specific nodes. Various nodes are labeled with radio specific types. Since the deb build inherits from this flo policy, it is a good idea to include them. Change-Id: Ia55a80af027c8bde933d45c41f4ed287f01adb2e
2013-11-13 16:10:28 +00:00
# Qualcomm MSM Audio devices
/dev/msm_acdb u:object_r:audio_device:s0
/dev/msm_mp3 u:object_r:audio_device:s0
/dev/msm_rtac u:object_r:audio_device:s0
/dev/msm_vidc.* u:object_r:audio_device:s0
/dev/msm_amrnb.* u:object_r:audio_device:s0
/dev/msm_amrwb.* u:object_r:audio_device:s0
/dev/msm_aac.* u:object_r:audio_device:s0
# MSM Dedicated Sensors Processor Subsystem
# Sensors shared Memory Packet Interface
/dev/smd_sns_dsps u:object_r:sensors_device:s0
flo: move proprietary modules to vendor Change-Id: Ie51036d03f391d4581e555980fed2e7afe885b41
2017-12-02 13:51:27 +00:00
/system/vendor/bin/qcks u:object_r:kickstart_exec:s0
/system/vendor/bin/efsks u:object_r:kickstart_exec:s0
/system/vendor/bin/ks u:object_r:kickstart_exec:s0
/system/vendor/bin/kickstart_checker\.sh u:object_r:kickstart_exec:s0
SELinux policy updates. * Make gpu_device a trusted object since all apps can write to the device. denied { write } for pid=3460 comm="ense_free.menus" name="kgsl-3d0" dev="tmpfs" ino=7606 scontext=u:r:untrusted_app:s0:c92,c256 tcontext=u:object_r:gpu_device:s0 tclass=chr_file * Drop dead type mpdecision_device. * Create policy for mm-pp-daemon and keep it permissive. Address the following initial denials. denied { write } for pid=220 comm="mm-pp-daemon" name="property_service" dev="tmpfs" ino=7289 scontext=u:r:ppd:s0 tcontext=u:object_r:property_socket:s0 tclass=sock_file denied { connectto } for pid=220 comm="mm-pp-daemon" path="/dev/socket/property_service" scontext=u:r:ppd:s0 tcontext=u:r:init:s0 tclass=unix_stream_socket denied { read write } for pid=220 comm="mm-pp-daemon" name="fb0" dev="tmpfs" ino=8523 scontext=u:r:ppd:s0 tcontext=u:object_r:graphics_device:s0 tclass=chr_file denied { open } for pid=220 comm="mm-pp-daemon" name="fb0" dev="tmpfs" ino=8523 scontext=u:r:ppd:s0 tcontext=u:object_r:graphics_device:s0 tclass=chr_file denied { ioctl } for pid=220 comm="mm-pp-daemon" path="/dev/graphics/fb0" dev="tmpfs" ino=8523 scontext=u:r:ppd:s0 tcontext=u:object_r:graphics_device:s0 tclass=chr_file * Add kickstart_exec labels for kickstart binaries that are used by deb devices. * Add tee policy. Label /data/misc/playready and allow tee access. denied { write } for pid=259 comm="qseecomd" name="misc" dev="mmcblk0p30" ino=635233 scontext=u:r:tee:s0 tcontext=u:object_r:system_data_file:s0 tclass=dir denied { read } for pid=232 comm="qseecomd" name="/" dev="mmcblk0p30" ino=2 scontext=u:r:tee:s0 tcontext=u:object_r:system_data_file:s0 tclass=dir denied { create } for pid=306 comm="qseecomd" name="playready" scontext=u:r:tee:s0 tcontext=u:object_r:drm_data_file:s0 tclass=dir denied { search } for pid=282 comm="qseecomd" name="playready" dev="mmcblk0p30" ino=635262 scontext=u:r:tee:s0 tcontext=u:object_r:drm_data_file:s0 tclass=dir denied { read } for pid=282 comm="qseecomd" name="playready" dev="mmcblk0p30" ino=635262 scontext=u:r:tee:s0 tcontext=u:object_r:drm_data_file:s0 tclass=dir denied { write } for pid=265 comm="qseecomd" name="playready" dev="mmcblk0p30" ino=635262 scontext=u:r:tee:s0 tcontext=u:object_r:drm_data_file:s0 tclass=dir denied { create } for pid=252 comm="qseecomd" name="tzdrm.log" scontext=u:r:tee:s0 tcontext=u:object_r:drm_data_file:s0 tclass=file denied { read write open } for pid=271 comm="qseecomd" name="tzdrm.log" dev="mmcblk0p30" ino=635264 scontext=u:r:tee:s0 tcontext=u:object_r:drm_data_file:s0 tclass=file * Give surfaceflinger access to /dev/socket/pps and allow access to certain sysfs nodes. denied { write } for pid=181 comm="surfaceflinger" name="pps" dev="tmpfs" ino=7958 scontext=u:r:surfaceflinger:s0 tcontext=u:object_r:ppd_socket:s0 tclass=sock_file denied { write } for pid=182 comm="surfaceflinger" name="hpd" dev="sysfs" ino=9639 scontext=u:r:surfaceflinger:s0 tcontext=u:object_r:sysfs:s0 tclass=file Change-Id: Ia7a5c63365593af7ac5adc207b27fad113b01dd3
2013-11-25 13:24:21 +00:00
Add file_contexts entries for socket files. So that we do not relabel them on a restorecon -R /data. Change-Id: Ibf51efcbe8fed395b214ee81c097c4b04d4ce335 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-02-04 19:41:54 +00:00
/data/cam_socket[0-9] u:object_r:camera_socket:s0
/data/app/sensor_ctl_socket u:object_r:sensors_socket:s0
flo: Update sepolicies
2020-11-26 10:02:35 +00:00
/dev/socket/qcamera(/.*)? u:object_r:camera_socket:s0
/dev/socket/sensors(/.*)? u:object_r:sensors_socket:s0
Add file_contexts entries for socket files. So that we do not relabel them on a restorecon -R /data. Change-Id: Ibf51efcbe8fed395b214ee81c097c4b04d4ce335 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-02-04 19:41:54 +00:00
flo: Update sepolicies
2020-11-26 10:02:35 +00:00
/data/vendor/sensors(/.*)? u:object_r:sensors_vendor_data_file:s0
SELinux policy updates. * Make gpu_device a trusted object since all apps can write to the device. denied { write } for pid=3460 comm="ense_free.menus" name="kgsl-3d0" dev="tmpfs" ino=7606 scontext=u:r:untrusted_app:s0:c92,c256 tcontext=u:object_r:gpu_device:s0 tclass=chr_file * Drop dead type mpdecision_device. * Create policy for mm-pp-daemon and keep it permissive. Address the following initial denials. denied { write } for pid=220 comm="mm-pp-daemon" name="property_service" dev="tmpfs" ino=7289 scontext=u:r:ppd:s0 tcontext=u:object_r:property_socket:s0 tclass=sock_file denied { connectto } for pid=220 comm="mm-pp-daemon" path="/dev/socket/property_service" scontext=u:r:ppd:s0 tcontext=u:r:init:s0 tclass=unix_stream_socket denied { read write } for pid=220 comm="mm-pp-daemon" name="fb0" dev="tmpfs" ino=8523 scontext=u:r:ppd:s0 tcontext=u:object_r:graphics_device:s0 tclass=chr_file denied { open } for pid=220 comm="mm-pp-daemon" name="fb0" dev="tmpfs" ino=8523 scontext=u:r:ppd:s0 tcontext=u:object_r:graphics_device:s0 tclass=chr_file denied { ioctl } for pid=220 comm="mm-pp-daemon" path="/dev/graphics/fb0" dev="tmpfs" ino=8523 scontext=u:r:ppd:s0 tcontext=u:object_r:graphics_device:s0 tclass=chr_file * Add kickstart_exec labels for kickstart binaries that are used by deb devices. * Add tee policy. Label /data/misc/playready and allow tee access. denied { write } for pid=259 comm="qseecomd" name="misc" dev="mmcblk0p30" ino=635233 scontext=u:r:tee:s0 tcontext=u:object_r:system_data_file:s0 tclass=dir denied { read } for pid=232 comm="qseecomd" name="/" dev="mmcblk0p30" ino=2 scontext=u:r:tee:s0 tcontext=u:object_r:system_data_file:s0 tclass=dir denied { create } for pid=306 comm="qseecomd" name="playready" scontext=u:r:tee:s0 tcontext=u:object_r:drm_data_file:s0 tclass=dir denied { search } for pid=282 comm="qseecomd" name="playready" dev="mmcblk0p30" ino=635262 scontext=u:r:tee:s0 tcontext=u:object_r:drm_data_file:s0 tclass=dir denied { read } for pid=282 comm="qseecomd" name="playready" dev="mmcblk0p30" ino=635262 scontext=u:r:tee:s0 tcontext=u:object_r:drm_data_file:s0 tclass=dir denied { write } for pid=265 comm="qseecomd" name="playready" dev="mmcblk0p30" ino=635262 scontext=u:r:tee:s0 tcontext=u:object_r:drm_data_file:s0 tclass=dir denied { create } for pid=252 comm="qseecomd" name="tzdrm.log" scontext=u:r:tee:s0 tcontext=u:object_r:drm_data_file:s0 tclass=file denied { read write open } for pid=271 comm="qseecomd" name="tzdrm.log" dev="mmcblk0p30" ino=635264 scontext=u:r:tee:s0 tcontext=u:object_r:drm_data_file:s0 tclass=file * Give surfaceflinger access to /dev/socket/pps and allow access to certain sysfs nodes. denied { write } for pid=181 comm="surfaceflinger" name="pps" dev="tmpfs" ino=7958 scontext=u:r:surfaceflinger:s0 tcontext=u:object_r:ppd_socket:s0 tclass=sock_file denied { write } for pid=182 comm="surfaceflinger" name="hpd" dev="sysfs" ino=9639 scontext=u:r:surfaceflinger:s0 tcontext=u:object_r:sysfs:s0 tclass=file Change-Id: Ia7a5c63365593af7ac5adc207b27fad113b01dd3
2013-11-25 13:24:21 +00:00
/data/misc/playready(/.*)? u:object_r:drm_data_file:s0
Create new security labels for device nodes. Labeling nodes with appropriate types doesn't introduce any new denials to the mix. This list largely addresses the Qualcomm specific nodes. Various nodes are labeled with radio specific types. Since the deb build inherits from this flo policy, it is a good idea to include them. Change-Id: Ia55a80af027c8bde933d45c41f4ed287f01adb2e
2013-11-13 16:10:28 +00:00
flo: move proprietary modules to vendor Change-Id: Ie51036d03f391d4581e555980fed2e7afe885b41
2017-12-02 13:51:27 +00:00
/system/vendor/bin/hci_qcomm_init u:object_r:hci_attach_exec:s0
flo: move device-specific modules to vendor Change-Id: I79e26fe58dd393b9da04f3c99b3eadd263c40afa
2017-12-02 12:46:24 +00:00
/system/vendor/bin/bdAddrLoader u:object_r:bluetooth_loader_exec:s0
Move rmt into its own domain. Don't run rmt in init's domain. /system/bin/rmt_storage is a qualcomm specific daemon responsible for servicing modem filesystem requests. It doesn't make sense to run rmt_storage in init's domain, as doing so prevents us from fine tuning its policy. Keep the domain in permissive mode right now until we address the following denials: <5>[ 7.497467] type=1400 audit(1383939680.983:5): avc: denied { read write } for pid=193 comm="rmt_storage" name="mem" dev="tmpfs" ino=4010 scontext=u:r:rmt:s0 tcontext=u:object_r:kmem_device:s0 tclass=chr_file <5>[ 7.497741] type=1400 audit(1383939680.983:6): avc: denied { open } for pid=193 comm="rmt_storage" name="mem" dev="tmpfs" ino=4010 scontext=u:r:rmt:s0 tcontext=u:object_r:kmem_device:s0 tclass=chr_file We still need to get a better understanding of what rmt_storage does and what rules should be applied to it. Change-Id: I45d03fb93870f1b4bb64215f5dcd9a2a443f5566
2013-11-08 20:35:41 +00:00
# rmt_storage is a qualcomm specific daemon responsible
# for servicing modem filesystem requests.
flo: move proprietary modules to vendor Change-Id: Ie51036d03f391d4581e555980fed2e7afe885b41
2017-12-02 13:51:27 +00:00
/system/vendor/bin/rmt_storage u:object_r:rmt_exec:s0
/system/vendor/bin/bridgemgrd u:object_r:bridge_exec:s0
/system/vendor/bin/qmuxd u:object_r:qmux_exec:s0
/system/vendor/bin/netmgrd u:object_r:netmgrd_exec:s0
/system/vendor/bin/thermald u:object_r:thermald_exec:s0
/system/vendor/bin/mpdecision u:object_r:mpdecision_exec:s0
/system/vendor/bin/sensors\.qcom u:object_r:sensors_exec:s0
/system/vendor/bin/mm-qcamera-daemon u:object_r:camera_exec:s0
/system/vendor/bin/qseecomd u:object_r:tee_exec:s0
flo: move device-specific modules to vendor Change-Id: I79e26fe58dd393b9da04f3c99b3eadd263c40afa
2017-12-02 12:46:24 +00:00
/system/vendor/bin/conn_init u:object_r:conn_init_exec:s0
/system/vendor/bin/init\.flo\.wifi\.sh u:object_r:conn_init_exec:s0
flo: move proprietary modules to vendor Change-Id: Ie51036d03f391d4581e555980fed2e7afe885b41
2017-12-02 13:51:27 +00:00
/system/vendor/bin/irsc_util u:object_r:irsc_util_exec:s0
flo: move device-specific modules to vendor Change-Id: I79e26fe58dd393b9da04f3c99b3eadd263c40afa
2017-12-02 12:46:24 +00:00
/system/vendor/bin/init\.flo\.bt\.sh u:object_r:bluetooth_loader_exec:s0
flo: Accelerate boot by paralleling device enable Some QCOM devices require sysfs to trigger boot/init which are blocking the init process. [ 7.453205] init: Command 'write /sys/kernel/boot_adsp/boot 1' action=post-fs-data (/init.angler.rc:166) returned 0 took 271.936ms. This CL is to put those slow to start devices in a separate service and wait for the service to be done later on. Bug: 32712851 Test: On device Change-Id: Idd4e965f122cbc8421b443a41573d363112dfa50
2016-11-22 01:58:09 +00:00
/system/vendor/bin/init\.qcom\.devstart\.sh u:object_r:init-qcom-devstart-sh_exec:s0
/system/vendor/bin/init\.qcom\.devwait\.sh u:object_r:init-qcom-devwait-sh_exec:s0
Add to selinux policy. Bring policy over from the mako board which has a lot of similar domains and services. mako is also a Qualcomm board which allows a lot of that policy to be directly brought over and applied. Included in this are some radio specific pieces. Though not directly applicable to flo, the deb board inherits this policy. Change-Id: I6b294c7dc830189c08f1f981a239234a2c3f577f
2013-11-15 17:58:07 +00:00
flo/deb: Add gatekeeper@1.0-service.software
2020-11-26 10:34:09 +00:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.gatekeeper@1\.0-service\.software u:object_r:hal_gatekeeper_default_exec:s0
flo/deb: sepolicy: Actually define clearkey DRM HIDL service
2021-11-30 15:28:36 +00:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.drm@1\.4-service\.clearkey u:object_r:hal_drm_clearkey_exec:s0
flo/deb: Build power.stats@1.0-service.mock
2021-11-30 15:33:19 +00:00
/(vendor|system/vendor)/bin/hw/android\.hardware\.power\.stats@1\.0-service\.mock u:object_r:hal_power_stats_default_exec:s0
flo: Update sepolicies
2020-11-26 10:02:35 +00:00
Add to selinux policy. Bring policy over from the mako board which has a lot of similar domains and services. mako is also a Qualcomm board which allows a lot of that policy to be directly brought over and applied. Included in this are some radio specific pieces. Though not directly applicable to flo, the deb board inherits this policy. Change-Id: I6b294c7dc830189c08f1f981a239234a2c3f577f
2013-11-15 17:58:07 +00:00
# Persist firmware filesystem
/persist/camera_calibration(/.*)? u:object_r:persist_camera_file:s0
/persist/playready(/.*)? u:object_r:persist_drm_file:s0
/persist/widevine(/.*)? u:object_r:persist_drm_file:s0
/persist/wifi(/.*)? u:object_r:persist_wifi_file:s0