Commit graph

8 commits

Author SHA1 Message Date
OdSazib
478a2b33b6
sdm660-common: sepolicy: Rework sepolicy (No more neverallow)
- Thanks to LineageOS and our sdm660 community

Change-Id: I54c7d76260041b7c383428449e149aa35d51de9b3c
2021-05-18 05:03:51 +06:00
OdSazib
9a192b7de0
sdm660-common: sepolicy: Update sepolicy and cleanup
* Address some denials from android 11
* Fix video recording
* Sort in alphabetic order

Signed-off-by: OdSazib <odsazib@gmail.com>
2020-12-21 09:16:25 +06:00
Max Weffers
b7b7fae1ef
sdm660-common: sepolicy: unbreak sepolicy for carbon
Change-Id: Ie324b974ceb741c524abe7ba53cadb4c2b01219e
2020-08-12 02:02:38 +06:00
Max Weffers
b0fa4e9f51
sdm660-common: sepolicy: Adress few denials
Change-Id: I45c7af8087a8495e4e7902d74f7811c2d40f5197
2020-08-12 02:02:38 +06:00
Max Weffers
599a611dd8
sdm660: sepolicy: Grant Vendor Toolbox fingerprint file acces in persist
Change-Id: I16afcc9bf2f822d741470ca5b741a4b283196575
2020-08-12 02:02:37 +06:00
LuK1337
2eb56727c3
sdm660-common: sepolicy: Add more /persist related contexts to toolbox rules
Change-Id: If9b28d1196eb352422e5acb0a570f2e005c2dcdf
2020-03-10 09:39:56 +01:00
LuK1337
1e7b6a0417
sdm660-common: sepolicy: Drop unnecessary rule
* This is already granted through init_daemon_domain(domain).

Change-Id: I6c2f1b3e267256da958b40af5014972785617cbe
2020-03-10 09:39:56 +01:00
Felix
ac571ee966
sdm660-common: Force restorecon for /mnt/vendor/persist
The restorecon_recursive directive in init is only applied if the
file_contexts file changed between builds, but not necessarily if any
file or folder inside /mnt/vendor/persist/ has changed.

The restorecon code checks whether an xattr named
"security.sehash" contains a string that matches the current
combined hashes of the SELinux context files and skips restoring labels
if there is a match, see
https://android.googlesource.com/platform/external/selinux/+/refs/tags/android-9.0.0_r35/libselinux/src/android/android_platform.c#1546

Force wiping that xattr so that restorecon always runs since it's not
very expensive (there are currently only about 50 files on /persist).

The restorecon is needed to fix issues such as wrong stock labels on
/mnt/vendor/persist/sensors/:
sensors_persist_file -> persist_sensors_file

Change-Id: Ic0cd848836ee550499d9236f56ed6e939e35f01e
2020-03-10 09:39:45 +01:00