tequilaOS/platform_device_qcom_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Selinux enabled for xrcb_app.

Browse source 
This change enables xrcb application to facilitate
communication between QXR Client apk and QXR hal service.

Change-Id: I8fc2759d5d4710d735de86aca0bd31d1069611f6
This commit is contained in:
Ashwani Jha 2021-07-22 10:49:46 -07:00
parent 154aac708d
commit 4de60122b0
13 changed files with 60 additions and 120 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
generic/private/bluetooth.te
View file

@ -1,4 +1,4 @@
# Copyright (c) 2020, The Linux Foundation. All rights reserved.
# Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
#
# Redistribution and use in source and binary forms, with or without
# modification, are permitted provided that the following conditions are
@ -24,5 +24,3 @@
# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
# OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
# IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
unix_socket_connect(bluetooth, vendor_qvrd_controller, vendor_qvrd)

6
generic/private/file.te
View file

@ -1,4 +1,4 @@
# Copyright (c) 2015, 2017-2018, 2020 The Linux Foundation. All rights reserved.
# Copyright (c) 2015, 2017-2018, 2020-2021 The Linux Foundation. All rights reserved.
#
# Redistribution and use in source and binary forms, with or without
# modification, are permitted provided that the following conditions are
@ -29,9 +29,5 @@ type vendor_seemp_data_file, core_data_file_type, data_file_type, file_type;
type vendor_dpmd_socket, file_type, coredomain_socket;
type vendor_dpmd_data_file, file_type, data_file_type, core_data_file_type;
type vendor_dpmwrapper_socket, file_type, coredomain_socket, mlstrustedobject;
type vendor_qvrd_data_file, file_type, data_file_type, core_data_file_type;
type vendor_qvrd_socket, file_type, mlstrustedobject, coredomain_socket;
type vendor_qvrd_controller_socket, file_type, coredomain_socket;
type vendor_qvrd_hvx_socket, file_type, coredomain_socket;
type vendor_qcc_data_file, file_type, data_file_type, core_data_file_type;
type vendor_qcc_app_socket, file_type, mlstrustedobject, coredomain_socket;

8
generic/private/file_contexts
View file

@ -1,4 +1,4 @@
# Copyright (c) 2018-2020, The Linux Foundation. All rights reserved.
# Copyright (c) 2018-2021, The Linux Foundation. All rights reserved.
#
# Redistribution and use in source and binary forms, with or without
# modification, are permitted provided that the following conditions are
@ -39,17 +39,12 @@
/dev/socket/dpmd u:object_r:vendor_dpmd_socket:s0
/dev/socket/tcm u:object_r:vendor_dpmtcm_socket:s0
/dev/socket/tcmd u:object_r:vendor_dpmtcm_socket:s0
/dev/socket/qvrservice u:object_r:vendor_qvrd_socket:s0
/dev/socket/qvrservice_controller u:object_r:vendor_qvrd_controller_socket:s0
/dev/socket/qvrservice_camera u:object_r:vendor_qvrd_socket:s0
/dev/socket/qvrservice_hvx_camera u:object_r:vendor_qvrd_hvx_socket:s0
/dev/socket/qdma_app(/.*)? u:object_r:vendor_qcc_app_socket:s0
####### system file ###############
/system/bin/seempd u:object_r:vendor_seempd_exec:s0
/(system_ext|system/system_ext)/bin/dpmd u:object_r:vendor_dpmd_exec:s0
/(system_ext|system/system_ext)/bin/tcmd u:object_r:vendor_tcmd_exec:s0
/(system_ext|system/system_ext)/bin/qvrservice u:object_r:vendor_qvrd_exec:s0
/system/bin/vpsservice u:object_r:vendor_vpsservice_exec:s0
####### system_ext file ###############
@ -68,6 +63,5 @@
####### data files ################
/data/dpm(/.*)? u:object_r:vendor_dpmd_data_file:s0
/data/misc/qvr(/.*)? u:object_r:vendor_qvrd_data_file:s0
/data/nfc(/.*)? u:object_r:nfc_data_file:s0
/data/misc/qdma(/.*)? u:object_r:vendor_qcc_data_file:s0

5
generic/private/property.te
View file

@ -1,4 +1,4 @@
# Copyright (c) 2019-2020, The Linux Foundation. All rights reserved.
# Copyright (c) 2019-2021, The Linux Foundation. All rights reserved.
#
# Redistribution and use in source and binary forms, with or without
# modification, are permitted provided that the following conditions are
@ -42,3 +42,6 @@ system_internal_prop(vendor_wigig_core_prop)
system_internal_prop(vendor_fst_prop)
system_internal_prop(ctl_dpmd_prop)
system_internal_prop(ctl_tcmd_prop)
#XRCB property
system_internal_prop(vendor_xrcb_prop)

5
generic/private/property_contexts
View file

@ -1,4 +1,4 @@
# Copyright (c) 2017, 2019, The Linux Foundation. All rights reserved.
# Copyright (c) 2017, 2019, 2021 The Linux Foundation. All rights reserved.
#
# Redistribution and use in source and binary forms, with or without
# modification, are permitted provided that the following conditions are
@ -87,3 +87,6 @@ ro.vendor.beluga.p u:object_r:vendor_exported_system_pro
ro.vendor.beluga.c u:object_r:vendor_exported_system_prop:s0
ro.vendor.beluga.s u:object_r:vendor_exported_system_prop:s0
ro.vendor.beluga.t u:object_r:vendor_exported_system_prop:s0
#XRCB prop
vendor.xrcb. u:object_r:vendor_xrcb_prop:s0

94
generic/private/qvrd.te
View file

@ -1,94 +0,0 @@
# Copyright (c) 2017,2020, The Linux Foundation. All rights reserved.
#
# Redistribution and use in source and binary forms, with or without
# modification, are permitted provided that the following conditions are
# met:
# * Redistributions of source code must retain the above copyright
# notice, this list of conditions and the following disclaimer.
# * Redistributions in binary form must reproduce the above
# copyright notice, this list of conditions and the following
# disclaimer in the documentation and/or other materials provided
# with the distribution.
# * Neither the name of The Linux Foundation nor the names of its
# contributors may be used to endorse or promote products derived
# from this software without specific prior written permission.
#
# THIS SOFTWARE IS PROVIDED "AS IS" AND ANY EXPRESS OR IMPLIED
# WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT
# ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS
# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
# BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
# OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
# IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
typeattribute vendor_qvrd coredomain;
typeattribute vendor_qvrd mlstrustedsubject;
type vendor_qvrd_exec, system_file_type, exec_type, file_type;
init_daemon_domain(vendor_qvrd)
#
# General
#
binder_call(vendor_qvrd, system_server);
# Allow interracting with vendor_qvrd directory
allow vendor_qvrd vendor_qvrd_data_file:dir create_dir_perms;
allow vendor_qvrd vendor_qvrd_data_file:file create_file_perms;
#allow binder use for checking permissions
binder_use(vendor_qvrd)
allow vendor_qvrd permission_service:service_manager find;
#Allow hardware binder use
hwbinder_use(vendor_qvrd)
get_prop(vendor_qvrd, hwservicemanager_prop)
# Allow access to our socket
allow vendor_qvrd vendor_qvrd_socket:sock_file rw_file_perms;
allow vendor_qvrd vendor_qvrd_controller_socket:sock_file rw_file_perms;
#
# Sensors
#
# Allow access to sensor1 API
allow vendor_qvrd self:socket create_socket_perms_no_ioctl;
#
# Display
#
# Allow access to /dev/graphics/fb0 for configuring vsync interrupts
allow vendor_qvrd graphics_device:dir r_dir_perms;
allow vendor_qvrd graphics_device:chr_file rw_file_perms;
#
# Graphics
#
#Allow hal graphics mapper permissions
hal_client_domain(vendor_qvrd, hal_graphics_composer);
#Allow hal graphics allocator permissions
hal_client_domain(vendor_qvrd, hal_graphics_allocator);
#
# Scheduler
#
allow vendor_qvrd self:capability { sys_nice };
userdebug_or_eng(`
allow vendor_qvrd su:process setsched;
')
allow vendor_qvrd appdomain:process setsched;
# whitelisting ioctlcmd c302
allowxperm vendor_qvrd self:socket ioctl msm_sock_ipc_ioctls_system;
allow vendor_qvrd self:socket ioctl;

3
generic/private/seapp_contexts
View file

@ -75,3 +75,6 @@ user=system seinfo=platform name=vendor.qti.qesdk.sysservice isPrivApp=true doma
#Add new domain for workloadclassifier
user=_app seinfo=platform name=com.qualcomm.qti.workloadclassifier domain=vendor_wlc_app type=app_data_file levelFrom=all
#Add new domain for xrcb app
user=_app seinfo=platform name=com.qualcomm.qti.xrcb domain=vendor_xrcb_app type=app_data_file levelFrom=all

4
generic/private/system_server.te
View file

@ -1,4 +1,4 @@
# Copyright (c) 2015,2017,2019 The Linux Foundation. All rights reserved.
# Copyright (c) 2015,2017,2019,2021 The Linux Foundation. All rights reserved.
#
# Redistribution and use in source and binary forms, with or without
# modification, are permitted provided that the following conditions are
@ -48,8 +48,6 @@ allow system_server vendor_perf_service:service_manager find;
#Allow system_server to add and find vps service
allow system_server vendor_vps_service:service_manager find;
binder_call(system_server,vendor_qvrd);
#Allow for access to WFD specific debug properties
binder_call(system_server, vendor_wfdservice);
userdebug_or_eng(`

5
generic/private/untrusted_app.te
View file

@ -1,4 +1,4 @@
# Copyright (c) 2015, 2017, The Linux Foundation. All rights reserved.
# Copyright (c) 2015, 2017, 2021, The Linux Foundation. All rights reserved.
#
# Redistribution and use in source and binary forms, with or without
# modification, are permitted provided that the following conditions are
@ -32,6 +32,5 @@ userdebug_or_eng(`
r_dir_file(untrusted_app, vendor_seemp_data_file)
allow untrusted_app vendor_seemp_data_file: file w_file_perms;
')
unix_socket_connect(untrusted_app, vendor_qvrd, vendor_qvrd);
allow untrusted_app vendor_qvrd:fd use;
qesdk_app_access(untrusted_app);
typeattribute untrusted_app vendor_hal_qvrservice_qti_socket_fd_use_client;

1
generic/private/untrusted_app_29.te
View file

@ -26,3 +26,4 @@
# IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
qesdk_app_access(untrusted_app_29);
typeattribute untrusted_app_29 vendor_hal_qvrservice_qti_socket_fd_use_client;

4
generic/private/untrusted_app_all.te
View file

@ -1,4 +1,4 @@
# Copyright (c) 2019, The Linux Foundation. All rights reserved.
# Copyright (c) 2019,2021, The Linux Foundation. All rights reserved.
#
# Redistribution and use in source and binary forms, with or without
# modification, are permitted provided that the following conditions are
@ -26,6 +26,4 @@
# IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
unix_socket_connect(untrusted_app_all, vendor_dpmtcm, vendor_dpmd)
unix_socket_connect(untrusted_app_all, vendor_qvrd, vendor_qvrd)
allow untrusted_app_all vendor_qvrd:fd use;
unix_socket_connect(untrusted_app_all, vendor_dpmtcm, vendor_tcmd)

36
generic/private/xrcb_app.te Normal file
View file

@ -0,0 +1,36 @@
# Copyright (c) 2021 The Linux Foundation. All rights reserved.
#
# Redistribution and use in source and binary forms, with or without
# modification, are permitted provided that the following conditions are
# met:
# * Redistributions of source code must retain the above copyright
# notice, this list of conditions and the following disclaimer.
# * Redistributions in binary form must reproduce the above
# copyright notice, this list of conditions and the following
# disclaimer in the documentation and/or other materials provided
# with the distribution.
# * Neither the name of The Linux Foundation nor the names of its
# contributors may be used to endorse or promote products derived
# from this software without specific prior written permission.
#
# THIS SOFTWARE IS PROVIDED "AS IS" AND ANY EXPRESS OR IMPLIED
# WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT
# ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS
# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
# BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
# OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
# IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
type vendor_xrcb_app,domain;
typeattribute vendor_xrcb_app coredomain;
typeattribute vendor_xrcb_app vendor_hal_qvrservice_qti_socket_client;
app_domain(vendor_xrcb_app);
hal_client_domain(vendor_xrcb_app, vendor_hal_qvrservice_qti);
hal_client_domain(vendor_xrcb_app, vendor_hal_perf);
allow vendor_xrcb_app app_api_service:service_manager find;
get_prop(vendor_xrcb_app, vendor_xrcb_prop);

5
generic/public/attributes
View file

@ -263,3 +263,8 @@ attribute vendor_hal_iwlanservice_qti;
attribute vendor_hal_iwlanservice_qti_client;
attribute vendor_hal_iwlanservice_qti_server;
attribute vendor_hal_qvrservice_qti;
attribute vendor_hal_qvrservice_qti_client;
attribute vendor_hal_qvrservice_qti_server;
attribute vendor_hal_qvrservice_qti_socket_client;
attribute vendor_hal_qvrservice_qti_socket_fd_use_client;