android_device_xiaomi_sdm66.../sepolicy/vendor/vendor_init.te

#============= vendor_init ==============
typeattribute vendor_init data_between_core_and_vendor_violators;

allow vendor_init {
  media_rw_data_file
  system_data_file
  tombstone_data_file
  camera_data_file
}:dir { create search getattr open read setattr ioctl write add_name remove_name rmdir relabelfrom };

allow vendor_init unlabeled:{ dir file } { getattr relabelfrom };

allow vendor_init media_rw_data_file:file { getattr relabelfrom };

allow vendor_init rootfs:dir { add_name create setattr write };
allow vendor_init persist_debug_prop:property_service set;
allow vendor_init persist_debug_prop:file read;
allow vendor_init persist_dpm_prop:property_service set;
allow vendor_init qcom_ims_prop:property_service set;
allow vendor_init thermal_engine_prop:property_service set;
allow vendor_init vendor_ssr_prop:property_service set;
allow vendor_init audio_prop:property_service set;
allow vendor_init vendor_fp_prop:property_service set;
allow vendor_init reschedule_service_prop:property_service set;
allow vendor_init bservice_prop:property_service set;

allow vendor_init rootfs:dir { add_name write };
allow vendor_init rootfs:lnk_file setattr;
allow vendor_init fingerprint_data_file:dir {setattr create};

allow vendor_init blkio_dev:file write;
allow vendor_init proc_dirty:file write;

set_prop(vendor_init, camera_prop)
set_prop(vendor_init, vendor_camera_prop)
set_prop(vendor_init, freq_prop)
set_prop(vendor_init, fm_prop)
sdm660-common: sepolicy: Add restricted permissions to vendor_init The core SEPolicy for vendor_init is being restricted to the proper Treble restrictions. Since this is a legacy device, it is tagged as a data_between_core_and_vendor_violators and the needed permissions are added to its device specific vendor_init.te Bug: 62875318 Test: boot walleye without audits Change-Id: I13aaa2278e71092d740216d3978dc720afafe8ea Signed-off-by: Subhajeet Muhuri <kenny3fcb@gmail.com> 2018-01-23 17:15:24 -05:00			`#============= vendor_init ==============`
wayne-common: Address denials for P Signed-off-by: Isaac Chen <tingyi364@gmail.com> 2019-07-24 00:04:32 -04:00			`typeattribute vendor_init data_between_core_and_vendor_violators;`

			`allow vendor_init {`
sdm660-common: sepolicy: Add restricted permissions to vendor_init The core SEPolicy for vendor_init is being restricted to the proper Treble restrictions. Since this is a legacy device, it is tagged as a data_between_core_and_vendor_violators and the needed permissions are added to its device specific vendor_init.te Bug: 62875318 Test: boot walleye without audits Change-Id: I13aaa2278e71092d740216d3978dc720afafe8ea Signed-off-by: Subhajeet Muhuri <kenny3fcb@gmail.com> 2018-01-23 17:15:24 -05:00			`media_rw_data_file`
wayne-common: Address denials for P Signed-off-by: Isaac Chen <tingyi364@gmail.com> 2019-07-24 00:04:32 -04:00			`system_data_file`
			`tombstone_data_file`
sdm660-common: sepolicy: fix Camera denials for access camera data * needed for clover oreo blobs 2019-08-20 17:11:46 -04:00			`camera_data_file`
wayne-common: Address denials for P Signed-off-by: Isaac Chen <tingyi364@gmail.com> 2019-07-24 00:04:32 -04:00			`}:dir { create search getattr open read setattr ioctl write add_name remove_name rmdir relabelfrom };`

sdm660-common: Force restorecon for /mnt/vendor/persist The restorecon_recursive directive in init is only applied if the file_contexts file changed between builds, but not necessarily if any file or folder inside /mnt/vendor/persist/ has changed. The restorecon code checks whether an xattr named "security.sehash" contains a string that matches the current combined hashes of the SELinux context files and skips restoring labels if there is a match, see https://android.googlesource.com/platform/external/selinux/+/refs/tags/android-9.0.0_r35/libselinux/src/android/android_platform.c#1546 Force wiping that xattr so that restorecon always runs since it's not very expensive (there are currently only about 50 files on /persist). The restorecon is needed to fix issues such as wrong stock labels on /mnt/vendor/persist/sensors/: sensors_persist_file -> persist_sensors_file Change-Id: Ic0cd848836ee550499d9236f56ed6e939e35f01e 2019-04-26 12:02:06 -04:00			`allow vendor_init unlabeled:{ dir file } { getattr relabelfrom };`

sdm660-common: sepolicy: Address more vendor_init denials 2019-07-19 04:32:01 -04:00			`allow vendor_init media_rw_data_file:file { getattr relabelfrom };`

wayne-common: Address denials for P Signed-off-by: Isaac Chen <tingyi364@gmail.com> 2019-07-24 00:04:32 -04:00			`allow vendor_init rootfs:dir { add_name create setattr write };`
			`allow vendor_init persist_debug_prop:property_service set;`
sdm660-common: sepolicy: Adress few denials Change-Id: I45c7af8087a8495e4e7902d74f7811c2d40f5197 2020-04-15 11:51:04 -04:00			`allow vendor_init persist_debug_prop:file read;`
wayne-common: Address denials for P Signed-off-by: Isaac Chen <tingyi364@gmail.com> 2019-07-24 00:04:32 -04:00			`allow vendor_init persist_dpm_prop:property_service set;`
			`allow vendor_init qcom_ims_prop:property_service set;`
sdm660: sepolicy: Allow vendor_init to set props 2019-08-13 10:08:41 -04:00			`allow vendor_init thermal_engine_prop:property_service set;`
			`allow vendor_init vendor_ssr_prop:property_service set;`
			`allow vendor_init audio_prop:property_service set;`
			`allow vendor_init vendor_fp_prop:property_service set;`
sdm660: sepolicy: Allow vendor init to set few props Change-Id: I0b2574b0e2f5f9b84df1db9ea7386522361a2864 2020-04-13 15:14:37 -04:00			`allow vendor_init reschedule_service_prop:property_service set;`
			`allow vendor_init bservice_prop:property_service set;`
sdm660: sepolicy: Allow vendor_init to set props 2019-08-13 10:08:41 -04:00
			`allow vendor_init rootfs:dir { add_name write };`
wayne-common: Address denials for P Signed-off-by: Isaac Chen <tingyi364@gmail.com> 2019-07-24 00:04:32 -04:00			`allow vendor_init rootfs:lnk_file setattr;`
sdm660-common: sepolicy: Adress few denials Change-Id: I45c7af8087a8495e4e7902d74f7811c2d40f5197 2020-04-15 11:51:04 -04:00			`allow vendor_init fingerprint_data_file:dir {setattr create};`

			`allow vendor_init blkio_dev:file write;`
			`allow vendor_init proc_dirty:file write;`

sdm660-common: sepolicy: Address camera denials Change-Id: I052adadca396fb104af49daec1d83047d0809416 2019-04-09 22:40:06 -04:00			`set_prop(vendor_init, camera_prop)`
			`set_prop(vendor_init, vendor_camera_prop)`
sdm660-common: sepolicy: Address some denials Change-Id: Iaba642838e51a2c39c2961e30456148f9794f60e 2020-05-12 10:45:35 -04:00			`set_prop(vendor_init, freq_prop)`
			`set_prop(vendor_init, fm_prop)`