MiPad4/android_device_xiaomi_sdm660-common
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
android_device_xiaomi_sdm66.../sepolicy/vendor/vendor_toolbox.te

51 lines
1.3 KiB
Text
Raw Normal View History

sdm660-common: Force restorecon for /mnt/vendor/persist The restorecon_recursive directive in init is only applied if the file_contexts file changed between builds, but not necessarily if any file or folder inside /mnt/vendor/persist/ has changed. The restorecon code checks whether an xattr named "security.sehash" contains a string that matches the current combined hashes of the SELinux context files and skips restoring labels if there is a match, see https://android.googlesource.com/platform/external/selinux/+/refs/tags/android-9.0.0_r35/libselinux/src/android/android_platform.c#1546 Force wiping that xattr so that restorecon always runs since it's not very expensive (there are currently only about 50 files on /persist). The restorecon is needed to fix issues such as wrong stock labels on /mnt/vendor/persist/sensors/: sensors_persist_file -> persist_sensors_file Change-Id: Ic0cd848836ee550499d9236f56ed6e939e35f01e
2019-04-26 12:02:06 -04:00
type vendor_toolbox, domain;
init_daemon_domain(vendor_toolbox)
# Allow vendor_toolbox to use sys_admin capability
allow vendor_toolbox self:capability sys_admin;
# Allow vendor_toolbox to execute /vendor/bin/toybox_vendor
allow vendor_toolbox vendor_toolbox_exec:file execute_no_trans;
# Allow vendor_toolbox to read directories in rootfs
allow vendor_toolbox rootfs:dir r_dir_perms;
# Allow vendor_toolbox to remove "security.*" xattrs from /mnt/vendor/persist
allow vendor_toolbox {
mnt_vendor_file
persist_alarm_file
sdm660-common: sepolicy: Add more /persist related contexts to toolbox rules Change-Id: If9b28d1196eb352422e5acb0a570f2e005c2dcdf
2020-03-01 18:28:54 -05:00
persist_block_device
sdm660-common: Force restorecon for /mnt/vendor/persist The restorecon_recursive directive in init is only applied if the file_contexts file changed between builds, but not necessarily if any file or folder inside /mnt/vendor/persist/ has changed. The restorecon code checks whether an xattr named "security.sehash" contains a string that matches the current combined hashes of the SELinux context files and skips restoring labels if there is a match, see https://android.googlesource.com/platform/external/selinux/+/refs/tags/android-9.0.0_r35/libselinux/src/android/android_platform.c#1546 Force wiping that xattr so that restorecon always runs since it's not very expensive (there are currently only about 50 files on /persist). The restorecon is needed to fix issues such as wrong stock labels on /mnt/vendor/persist/sensors/: sensors_persist_file -> persist_sensors_file Change-Id: Ic0cd848836ee550499d9236f56ed6e939e35f01e
2019-04-26 12:02:06 -04:00
persist_bluetooth_file
persist_bms_file
persist_display_file
persist_drm_file
sdm660-common: sepolicy: Add more /persist related contexts to toolbox rules Change-Id: If9b28d1196eb352422e5acb0a570f2e005c2dcdf
2020-03-01 18:28:54 -05:00
persist_file
sdm660: sepolicy: Grant Vendor Toolbox fingerprint file acces in persist Change-Id: I16afcc9bf2f822d741470ca5b741a4b283196575
2020-03-26 14:57:03 -04:00
persist_fingerprint_file
sdm660-common: sepolicy: Add more /persist related contexts to toolbox rules Change-Id: If9b28d1196eb352422e5acb0a570f2e005c2dcdf
2020-03-01 18:28:54 -05:00
persist_hvdcp_file
sdm660-common: Force restorecon for /mnt/vendor/persist The restorecon_recursive directive in init is only applied if the file_contexts file changed between builds, but not necessarily if any file or folder inside /mnt/vendor/persist/ has changed. The restorecon code checks whether an xattr named "security.sehash" contains a string that matches the current combined hashes of the SELinux context files and skips restoring labels if there is a match, see https://android.googlesource.com/platform/external/selinux/+/refs/tags/android-9.0.0_r35/libselinux/src/android/android_platform.c#1546 Force wiping that xattr so that restorecon always runs since it's not very expensive (there are currently only about 50 files on /persist). The restorecon is needed to fix issues such as wrong stock labels on /mnt/vendor/persist/sensors/: sensors_persist_file -> persist_sensors_file Change-Id: Ic0cd848836ee550499d9236f56ed6e939e35f01e
2019-04-26 12:02:06 -04:00
persist_misc_file
persist_qti_fp_file
persist_rfs_file
persist_rfs_shared_hlos_file
persist_secnvm_file
persist_time_file
persist_vpp_file
regionalization_file
sdm660-common: sepolicy: Add more /persist related contexts to toolbox rules Change-Id: If9b28d1196eb352422e5acb0a570f2e005c2dcdf
2020-03-01 18:28:54 -05:00
rfs_file
rfs_shared_hlos_file
sdm660-common: Force restorecon for /mnt/vendor/persist The restorecon_recursive directive in init is only applied if the file_contexts file changed between builds, but not necessarily if any file or folder inside /mnt/vendor/persist/ has changed. The restorecon code checks whether an xattr named "security.sehash" contains a string that matches the current combined hashes of the SELinux context files and skips restoring labels if there is a match, see https://android.googlesource.com/platform/external/selinux/+/refs/tags/android-9.0.0_r35/libselinux/src/android/android_platform.c#1546 Force wiping that xattr so that restorecon always runs since it's not very expensive (there are currently only about 50 files on /persist). The restorecon is needed to fix issues such as wrong stock labels on /mnt/vendor/persist/sensors/: sensors_persist_file -> persist_sensors_file Change-Id: Ic0cd848836ee550499d9236f56ed6e939e35f01e
2019-04-26 12:02:06 -04:00
sensors_persist_file
unlabeled
sdm660-common: sepolicy: Add more /persist related contexts to toolbox rules Change-Id: If9b28d1196eb352422e5acb0a570f2e005c2dcdf
2020-03-01 18:28:54 -05:00
vendor_persist_mmi_file
sdm660: sepolicy: Grant Vendor Toolbox fingerprint file acces in persist Change-Id: I16afcc9bf2f822d741470ca5b741a4b283196575
2020-03-26 14:57:03 -04:00
}:dir { r_dir_perms setattr getattr};
sdm660-common: sepolicy: Adress few denials Change-Id: I45c7af8087a8495e4e7902d74f7811c2d40f5197
2020-04-15 11:51:04 -04:00
allow vendor_toolbox {
mnt_vendor_file
persist_alarm_file
persist_block_device
persist_bluetooth_file
persist_bms_file
persist_hvdcp_file
persist_time_file
regionalization_file
sensors_persist_file
}:file { getattr};
Reference in a new issue Copy permalink