Piteball/android_device_asus_flo
1
0
Fork 0
mirror of https://github.com/followmsi/android_device_asus_flo.git synced 2024-11-06 21:56:05 +00:00
Code Issues Projects Releases Wiki Activity
android_device_asus_flo/sepolicy/bluetooth_loader.te

27 lines
1,013 B
Text
Raw Normal View History

flo: updates for SELinux * Move binaries from /system/etc to /system/bin. That's the proper place for binaries, and avoids having to preface each service entry with /system/bin/sh * Drop seclabel statements and rely on automatic domain transitions. * remove call to init.qcom.class_main.sh , which doesn't exist. This gets rid of the following unnecessary errors: <3>[ 5.286834] init: Warning! Service qcom-c_main-sh needs a SELinux domain defined; please fix! <5>[ 5.288970] type=1400 audit(1425327865.651:5): avc: denied { execute_no_trans } for pid=191 comm="init" path="/system/bin/sh" dev="mmcblk0p22" ino=341 scontext=u:r:init:s0 tcontext=u:object_r:shell_exec:s0 tclass=file Fix some other minor policy issues. Change-Id: Ib47d49b6c239ab7a2ebe6159465deb98b4b8cecb
2015-04-01 22:04:11 +00:00
# Bluetooth executables and script (bdAddrLoader, init.flo.bt.sh)
flo: Update sepolicies
2020-11-26 10:02:35 +00:00
# type bluetooth_loader, domain, device_domain_deprecated;
# type bluetooth_loader_exec, exec_type, file_type;
Add to selinux policy. Bring policy over from the mako board which has a lot of similar domains and services. mako is also a Qualcomm board which allows a lot of that policy to be directly brought over and applied. Included in this are some radio specific pieces. Though not directly applicable to flo, the deb board inherits this policy. Change-Id: I6b294c7dc830189c08f1f981a239234a2c3f577f
2013-11-15 17:58:07 +00:00
flo: updates for SELinux * Move binaries from /system/etc to /system/bin. That's the proper place for binaries, and avoids having to preface each service entry with /system/bin/sh * Drop seclabel statements and rely on automatic domain transitions. * remove call to init.qcom.class_main.sh , which doesn't exist. This gets rid of the following unnecessary errors: <3>[ 5.286834] init: Warning! Service qcom-c_main-sh needs a SELinux domain defined; please fix! <5>[ 5.288970] type=1400 audit(1425327865.651:5): avc: denied { execute_no_trans } for pid=191 comm="init" path="/system/bin/sh" dev="mmcblk0p22" ino=341 scontext=u:r:init:s0 tcontext=u:object_r:shell_exec:s0 tclass=file Fix some other minor policy issues. Change-Id: Ib47d49b6c239ab7a2ebe6159465deb98b4b8cecb
2015-04-01 22:04:11 +00:00
# Run init.flo.bt.sh
allow bluetooth_loader shell_exec:file rx_file_perms;
Drop restorecons from init.flo.rc file. Recent changes have obsoleted the need to call restorecon on any of /data files and dirs. This patch drops those restorecons from the file. Also use a global macro where appropriate. Change-Id: Id3322180cfe431a4065cfd39046711d7ddfd9f31 Signed-off-by: rpcraig <rpcraig@tycho.ncsc.mil>
2014-02-06 21:26:14 +00:00
allow bluetooth_loader bluetooth_loader_exec:file rx_file_perms;
Add to selinux policy. Bring policy over from the mako board which has a lot of similar domains and services. mako is also a Qualcomm board which allows a lot of that policy to be directly brought over and applied. Included in this are some radio specific pieces. Though not directly applicable to flo, the deb board inherits this policy. Change-Id: I6b294c7dc830189c08f1f981a239234a2c3f577f
2013-11-15 17:58:07 +00:00
flo: updates for SELinux * Move binaries from /system/etc to /system/bin. That's the proper place for binaries, and avoids having to preface each service entry with /system/bin/sh * Drop seclabel statements and rely on automatic domain transitions. * remove call to init.qcom.class_main.sh , which doesn't exist. This gets rid of the following unnecessary errors: <3>[ 5.286834] init: Warning! Service qcom-c_main-sh needs a SELinux domain defined; please fix! <5>[ 5.288970] type=1400 audit(1425327865.651:5): avc: denied { execute_no_trans } for pid=191 comm="init" path="/system/bin/sh" dev="mmcblk0p22" ino=341 scontext=u:r:init:s0 tcontext=u:object_r:shell_exec:s0 tclass=file Fix some other minor policy issues. Change-Id: Ib47d49b6c239ab7a2ebe6159465deb98b4b8cecb
2015-04-01 22:04:11 +00:00
# init.flo.bt.sh needs /system/bin/log access
Add to selinux policy. Bring policy over from the mako board which has a lot of similar domains and services. mako is also a Qualcomm board which allows a lot of that policy to be directly brought over and applied. Included in this are some radio specific pieces. Though not directly applicable to flo, the deb board inherits this policy. Change-Id: I6b294c7dc830189c08f1f981a239234a2c3f577f
2013-11-15 17:58:07 +00:00
allow bluetooth_loader devpts:chr_file rw_file_perms;
flo: updates for SELinux * Move binaries from /system/etc to /system/bin. That's the proper place for binaries, and avoids having to preface each service entry with /system/bin/sh * Drop seclabel statements and rely on automatic domain transitions. * remove call to init.qcom.class_main.sh , which doesn't exist. This gets rid of the following unnecessary errors: <3>[ 5.286834] init: Warning! Service qcom-c_main-sh needs a SELinux domain defined; please fix! <5>[ 5.288970] type=1400 audit(1425327865.651:5): avc: denied { execute_no_trans } for pid=191 comm="init" path="/system/bin/sh" dev="mmcblk0p22" ino=341 scontext=u:r:init:s0 tcontext=u:object_r:shell_exec:s0 tclass=file Fix some other minor policy issues. Change-Id: Ib47d49b6c239ab7a2ebe6159465deb98b4b8cecb
2015-04-01 22:04:11 +00:00
# Run hci_qcomm_init from init.flo.bt.sh
Add to selinux policy. Bring policy over from the mako board which has a lot of similar domains and services. mako is also a Qualcomm board which allows a lot of that policy to be directly brought over and applied. Included in this are some radio specific pieces. Though not directly applicable to flo, the deb board inherits this policy. Change-Id: I6b294c7dc830189c08f1f981a239234a2c3f577f
2013-11-15 17:58:07 +00:00
domain_auto_trans(bluetooth_loader, hci_attach_exec, hci_attach)
allow hci_attach bluetooth_loader:fd use;
# Read mac address from persist partition
allow bluetooth_loader persist_file:dir search;
r_dir_file(bluetooth_loader, persist_bluetooth_file)
# Set persist.service.bdroid.* and bluetooth.* property values
Update device to use set_prop() macro Change-Id: I630ba0178439c935d08062892990d43a3cc1239e Signed-off-by: William Roberts <william.c.roberts@linux.intel.com>
2015-05-11 17:53:24 +00:00
set_prop(bluetooth, bluetooth_prop)
set_prop(bluetooth_loader, bluetooth_prop)
Add to selinux policy. Bring policy over from the mako board which has a lot of similar domains and services. mako is also a Qualcomm board which allows a lot of that policy to be directly brought over and applied. Included in this are some radio specific pieces. Though not directly applicable to flo, the deb board inherits this policy. Change-Id: I6b294c7dc830189c08f1f981a239234a2c3f577f
2013-11-15 17:58:07 +00:00
flo: updates for SELinux * Move binaries from /system/etc to /system/bin. That's the proper place for binaries, and avoids having to preface each service entry with /system/bin/sh * Drop seclabel statements and rely on automatic domain transitions. * remove call to init.qcom.class_main.sh , which doesn't exist. This gets rid of the following unnecessary errors: <3>[ 5.286834] init: Warning! Service qcom-c_main-sh needs a SELinux domain defined; please fix! <5>[ 5.288970] type=1400 audit(1425327865.651:5): avc: denied { execute_no_trans } for pid=191 comm="init" path="/system/bin/sh" dev="mmcblk0p22" ino=341 scontext=u:r:init:s0 tcontext=u:object_r:shell_exec:s0 tclass=file Fix some other minor policy issues. Change-Id: Ib47d49b6c239ab7a2ebe6159465deb98b4b8cecb
2015-04-01 22:04:11 +00:00
# Allow getprop/setprop for init.flo.bt.sh
Add to selinux policy. Bring policy over from the mako board which has a lot of similar domains and services. mako is also a Qualcomm board which allows a lot of that policy to be directly brought over and applied. Included in this are some radio specific pieces. Though not directly applicable to flo, the deb board inherits this policy. Change-Id: I6b294c7dc830189c08f1f981a239234a2c3f577f
2013-11-15 17:58:07 +00:00
allow bluetooth_loader system_file:file execute_no_trans;
Only allow toolbox exec where /system exec was already allowed. When the toolbox domain was introduced, we allowed all domains to exec it to avoid breakage. However, only domains that were previously allowed the ability to exec /system files would have been able to do this prior to the introduction of the toolbox domain. Remove the rule from domain.te and add rules to all domains that are already allowed execute_no_trans to system_file. Requires coordination with device-specific policy changes with the same Change-Id. Change-Id: Ie46209f0412f9914857dc3d7c6b0917b7031aae5 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2015-08-25 15:43:36 +00:00
allow bluetooth_loader toolbox_exec:file rx_file_perms;
Reference in a new issue Copy permalink