LenovoZ5s/device_lenovo_sdm710-common
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

kunlun2: addressed some denials

Browse source
This commit is contained in:
Giammarco Senatore 2021-02-15 15:35:27 +01:00
parent 6ab15e1726
commit e0a7933eff
No known key found for this signature in database
GPG key ID: 029A0AB63D977A86
15 changed files with 78 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
sepolicy/private/app.te
View file

@ -1,2 +1,4 @@
# Allow appdomain to get vendor_camera_prop # Allow appdomain to get vendor_camera_prop
get_prop(appdomain, vendor_camera_prop) get_prop(appdomain, vendor_camera_prop)
get_prop(appdomain, vendor_default_prop)

1
sepolicy/private/dontaudit.te Normal file
View file

@ -0,0 +1 @@
dontaudit gmscore_app firmware_file:filesystem getattr;

1
sepolicy/private/file.te
View file

@ -2,6 +2,7 @@ type adsprpcd_file, file_type;
type bt_firmware_file, file_type; type bt_firmware_file, file_type;
type firmware_file, file_type; type firmware_file, file_type;
type persist_file, file_type; type persist_file, file_type;
type sensors_persist_file, file_type;
type proc_touchpanel, fs_type, proc_type; type proc_touchpanel, fs_type, proc_type;
type sysfs_graphics, sysfs_type, fs_type; type sysfs_graphics, sysfs_type, fs_type;
type sysfs_devfreq, sysfs_type, fs_type; type sysfs_devfreq, sysfs_type, fs_type;

9
sepolicy/private/file_contexts
View file

@ -1,6 +1,9 @@
# Data files # Data files
/data/display(/.*)? u:object_r:display_data_file:s0 /data/display(/.*)? u:object_r:display_data_file:s0
# Dev nodes
/dev/diag u:object_r:diag_device:s0
# Files in rootfs # Files in rootfs
/bt_firmware(/.*)? u:object_r:bt_firmware_file:s0 /bt_firmware(/.*)? u:object_r:bt_firmware_file:s0
/dsp(/.*)? u:object_r:adsprpcd_file:s0 /dsp(/.*)? u:object_r:adsprpcd_file:s0
@ -12,6 +15,12 @@
/system/bin/hw/lineage\.livedisplay@2\.0-service-sdm u:object_r:shal_livedisplay_default_exec:s0 /system/bin/hw/lineage\.livedisplay@2\.0-service-sdm u:object_r:shal_livedisplay_default_exec:s0
/(product|system/product)/vendor_overlay/[0-9]+/bin/hw/android\.hardware\.light@2\.0-service u:object_r:hal_light_default_exec:s0 /(product|system/product)/vendor_overlay/[0-9]+/bin/hw/android\.hardware\.light@2\.0-service u:object_r:hal_light_default_exec:s0
# IMS
/vendor/bin/imsdatadaemon u:object_r:ims_exec:s0
# Thermal config
/(system|system/vendor)/etc/thermal-engine.conf u:object_r:vendor_configs_file:s0
# Touch # Touch
/sys/class/touch/tp_dev/gesture_on u:object_r:sysfs_tp:s0 /sys/class/touch/tp_dev/gesture_on u:object_r:sysfs_tp:s0

7
sepolicy/private/hal_audio.te
View file

@ -1 +1,8 @@
allow hal_audio diag_device:chr_file rw_file_perms;
allow hal_audio sysfs:dir read;
allow hal_audio hal_power_pixel:binder call; allow hal_audio hal_power_pixel:binder call;
get_prop(hal_audio, default_prop)
get_prop(hal_audio, audio_prop)

1
sepolicy/private/hal_bluetooth.te
View file

@ -1 +1,2 @@
allow hal_bluetooth vendor_fm_app:binder call; allow hal_bluetooth vendor_fm_app:binder call;
allow hal_bluetooth diag_device:chr_file rw_file_perms;

2
sepolicy/private/hal_camera.te Normal file
View file

@ -0,0 +1,2 @@
get_prop(hal_camera, system_prop)
get_prop(hal_camera, default_prop)

7
sepolicy/private/ims.te Normal file
View file

@ -0,0 +1,7 @@
type ims, domain;
type ims_exec, exec_type, vendor_file_type, file_type;
init_daemon_domain(ims)
net_domain(ims)
allow ims diag_device:chr_file rw_file_perms;

7
sepolicy/private/init.te
View file

@ -7,3 +7,10 @@ allow init vendor_configs_file:file mounton;
# Allow init to mount vendor overlay # Allow init to mount vendor overlay
allow init vendor_overlay_file:dir mounton; allow init vendor_overlay_file:dir mounton;
allow init self:netlink_generic_socket read;
allow init sysfs:file rw_file_perms;
allow init sysfs_tp:file setattr;
allow init vendor_file:file execute;

2
sepolicy/private/property.te
View file

@ -1,3 +1,5 @@
type vendor_camera_prop, property_type; type vendor_camera_prop, property_type;
type vendor_display_prop, property_type; type vendor_display_prop, property_type;
type vendor_power_prop, property_type; type vendor_power_prop, property_type;
type vendor_ssr_prop, property_type;
type vendor_cap_configstore_dbg_prop, property_type;

1
sepolicy/private/property_contexts
View file

@ -2,3 +2,4 @@ vendor.powerhal.state u:object_r:vendor_power_prop:s0
vendor.powerhal.audio u:object_r:vendor_power_prop:s0 vendor.powerhal.audio u:object_r:vendor_power_prop:s0
vendor.powerhal.init u:object_r:vendor_power_prop:s0 vendor.powerhal.init u:object_r:vendor_power_prop:s0
vendor.powerhal.rendering u:object_r:vendor_power_prop:s0 vendor.powerhal.rendering u:object_r:vendor_power_prop:s0
ro.vendor.fm.use_audio_session u:object_r:vendor_default_prop:s0

18
sepolicy/private/qti_init_shell.te
View file

@ -2,3 +2,21 @@ type qti_init_shell, domain;
allow qti_init_shell sysfs_io_sched_tuneable:file w_file_perms; allow qti_init_shell sysfs_io_sched_tuneable:file w_file_perms;
dontaudit qti_init_shell self:capability { dac_override dac_read_search }; dontaudit qti_init_shell self:capability { dac_override dac_read_search };
allow qti_init_shell configfs:dir create_dir_perms;
allow qti_init_shell configfs:file create_file_perms;
allow qti_init_shell configfs:lnk_file create_file_perms;
allow qti_init_shell persist_file:lnk_file read;
allow qti_init_shell sensors_persist_file:fifo_file create_file_perms;
allow qti_init_shell shell_exec:file rx_file_perms;
allow qti_init_shell sysfs:file setattr;
allow qti_init_shell sysfs_leds:file setattr;
allow qti_init_shell toolbox_exec:file rx_file_perms;
allow qti_init_shell vendor_file:file entrypoint;
get_prop(qti_init_shell, default_prop)

7
sepolicy/private/ssr_setup.te Normal file
View file

@ -0,0 +1,7 @@
type vendor_ssr_setup, domain;
type vendor_ssr_setup_exec, exec_type, vendor_file_type, file_type;
init_daemon_domain(vendor_ssr_setup);
allow vendor_ssr_setup sysfs:file rw_file_perms;
get_prop(vendor_ssr_setup, vendor_ssr_prop)

5
sepolicy/private/system_server.te
View file

@ -1,2 +1,5 @@
get_prop(system_server, vendor_camera_prop)
allow system_server hal_power_pixel:binder call; allow system_server hal_power_pixel:binder call;
allow system_server sysfs:file read;
get_prop(system_server, vendor_camera_prop)

9
sepolicy/private/vendor_init.te
View file

@ -2,3 +2,12 @@ typeattribute vendor_init data_between_core_and_vendor_violators;
# Allow vendor_init to check encryption status of system_data_file # Allow vendor_init to check encryption status of system_data_file
allow vendor_init system_data_file:dir { ioctl open read setattr }; allow vendor_init system_data_file:dir { ioctl open read setattr };
allow vendor_init block_device:lnk_file setattr;
allow vendor_init persist_file:lnk_file read;
get_prop(vendor_init, default_prop)
get_prop(vendor_init, persist_debug_prop)
set_prop(vendor_init, default_prop)