tequilaOS/platform_device_qcom_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Add domain and selinux policy for sxrservice

Browse source 
Change-Id: Id235ebd7f36f147d2ba485fd9f72326330db2dfe
This commit is contained in:
Aditya Raut 2021-02-03 19:02:54 +05:30 committed by Gerrit - the friendly Code Review server
parent 14def69239
commit c4f145a3bf
13 changed files with 199 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
generic/prebuilts/api/30.0/private/compat/30.0/30.0.cil
View file

@ -91,3 +91,6 @@
(typeattributeset vendor_seempdw_socket_30_0 (vendor_seempdw_socket))
(expandtypeattribute (vendor_seempdw_socket_30_0) true)
(typeattribute vendor_seempdw_socket_30_0)
(typeattributeset vendor_sys_sxrd_30_0 (vendor_sys_sxrd))
(expandtypeattribute (vendor_sys_sxrd_30_0) true)
(typeattribute vendor_sys_sxrd_30_0)

2
generic/prebuilts/api/30.0/private/file.te
View file

@ -33,5 +33,7 @@ type vendor_qvrd_data_file, file_type, data_file_type, core_data_file_type;
type vendor_qvrd_socket, file_type, mlstrustedobject, coredomain_socket;
type vendor_qvrd_controller_socket, file_type, coredomain_socket;
type vendor_qvrd_hvx_socket, file_type, coredomain_socket;
type vendor_sys_sxrd_data_file, file_type, data_file_type, core_data_file_type;
type vendor_sys_sxrd_socket, file_type, mlstrustedobject, coredomain_socket;
type vendor_qcc_data_file, file_type, data_file_type, core_data_file_type;
type vendor_qcc_app_socket, file_type, mlstrustedobject, coredomain_socket;

3
generic/prebuilts/api/30.0/private/file_contexts
View file

@ -42,12 +42,14 @@
/dev/socket/qvrservice_controller u:object_r:vendor_qvrd_controller_socket:s0
/dev/socket/qvrservice_camera u:object_r:vendor_qvrd_socket:s0
/dev/socket/qvrservice_hvx_camera u:object_r:vendor_qvrd_hvx_socket:s0
/dev/socket/sxrservice u:object_r:vendor_sys_sxrd_socket:s0
/dev/socket/qdma_app(/.*)? u:object_r:vendor_qcc_app_socket:s0
####### system file ###############
/system/bin/seempd u:object_r:vendor_seempd_exec:s0
/(system_ext|system/system_ext)/bin/dpmd u:object_r:vendor_dpmd_exec:s0
/(system_ext|system/system_ext)/bin/qvrservice u:object_r:vendor_qvrd_exec:s0
/(system_ext|system/system_ext)/bin/sxrservice u:object_r:vendor_sys_sxrd_exec:s0
/system/bin/vpsservice u:object_r:vendor_vpsservice_exec:s0
####### system_ext file ###############
@ -65,5 +67,6 @@
####### data files ################
/data/dpm(/.*)? u:object_r:vendor_dpmd_data_file:s0
/data/misc/qvr(/.*)? u:object_r:vendor_qvrd_data_file:s0
/data/misc/sxr(/.*)? u:object_r:vendor_sys_sxrd_data_file:s0
/data/nfc(/.*)? u:object_r:nfc_data_file:s0
/data/misc/qdma(/.*)? u:object_r:vendor_qcc_data_file:s0

61
generic/prebuilts/api/30.0/private/sxrd.te Normal file
View file

@ -0,0 +1,61 @@
# Copyright (c) 2020 The Linux Foundation. All rights reserved.
#
# Redistribution and use in source and binary forms, with or without
# modification, are permitted provided that the following conditions are
# met:
# * Redistributions of source code must retain the above copyright
# notice, this list of conditions and the following disclaimer.
# * Redistributions in binary form must reproduce the above
# copyright notice, this list of conditions and the following
# disclaimer in the documentation and/or other materials provided
# with the distribution.
# * Neither the name of The Linux Foundation nor the names of its
# contributors may be used to endorse or promote products derived
# from this software without specific prior written permission.
#
# THIS SOFTWARE IS PROVIDED "AS IS" AND ANY EXPRESS OR IMPLIED
# WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT
# ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS
# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
# BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
# OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
# IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
typeattribute vendor_sys_sxrd coredomain;
typeattribute vendor_sys_sxrd mlstrustedsubject;
type vendor_sys_sxrd_exec, system_file_type, exec_type, file_type;
init_daemon_domain(vendor_sys_sxrd)
# Allow access to our socket
allow vendor_sys_sxrd vendor_sys_sxrd_socket:sock_file rw_file_perms;
# Allow interracting with vendor_sxrd directory
allow vendor_sys_sxrd vendor_sys_sxrd_data_file:dir create_dir_perms;
allow vendor_sys_sxrd vendor_sys_sxrd_data_file:file create_file_perms;
#video device
allow vendor_sys_sxrd video_device:chr_file rw_file_perms;
#Allow hal graphics allocator permissions
hal_client_domain(vendor_sys_sxrd, hal_graphics_allocator);
#access to usb device
allow vendor_sys_sxrd usb_device:chr_file rw_file_perms;
allow vendor_sys_sxrd usb_device:dir search;
allow vendor_sys_sxrd device:dir search;
#Allow access to PCM sound card
allow vendor_sys_sxrd audio_device:chr_file rw_file_perms;
allow vendor_sys_sxrd audio_device:dir r_dir_perms;
#Allow access to Audio Flinger APIs
binder_call(vendor_sys_sxrd, audioserver);
allow vendor_sys_sxrd audioserver_service : service_manager find;
# Add rule to access /proc/asound/pcm file
r_dir_file(vendor_sys_sxrd, proc_asound);

2
generic/prebuilts/api/30.0/private/untrusted_app_all.te
View file

@ -28,3 +28,5 @@
unix_socket_connect(untrusted_app_all, vendor_dpmtcm, vendor_dpmd)
unix_socket_connect(untrusted_app_all, vendor_qvrd, vendor_qvrd)
allow untrusted_app_all vendor_qvrd:fd use;
unix_socket_connect(untrusted_app_all, vendor_sys_sxrd, vendor_sys_sxrd)
allow untrusted_app_all vendor_sys_sxrd:fd use;

28
generic/prebuilts/api/30.0/public/sxrd.te Normal file
View file

@ -0,0 +1,28 @@
# Copyright (c) 2020, The Linux Foundation. All rights reserved.
#
# Redistribution and use in source and binary forms, with or without
# modification, are permitted provided that the following conditions are
# met:
# * Redistributions of source code must retain the above copyright
# notice, this list of conditions and the following disclaimer.
# * Redistributions in binary form must reproduce the above
# copyright notice, this list of conditions and the following
# disclaimer in the documentation and/or other materials provided
# with the distribution.
# * Neither the name of The Linux Foundation nor the names of its
# contributors may be used to endorse or promote products derived
# from this software without specific prior written permission.
#
# THIS SOFTWARE IS PROVIDED "AS IS" AND ANY EXPRESS OR IMPLIED
# WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT
# ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS
# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
# BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
# OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
# IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
type vendor_sys_sxrd, domain;

2
generic/prebuilts/api/30.0/system_ext_pub_versioned.cil
View file

@ -30,6 +30,7 @@
(type vendor_wfdservice)
(type vendor_sigmahal_qti)
(type vendor_dataservice_app)
(type vendor_sxrd)
(typeattribute vendor_smcinvoke_device_30_0)
(typeattribute vendor_qtelephony_30_0)
(typeattribute vendor_dpmd_30_0)
@ -62,3 +63,4 @@
(typeattribute vendor_wfdservice_30_0)
(typeattribute vendor_sigmahal_qti_30_0)
(typeattribute vendor_dataservice_app_30_0)
(typeattribute vendor_sys_sxrd_30_0)

2
generic/private/compat/30.0/30.0.cil
View file

@ -60,3 +60,5 @@
(expandtypeattribute (vendor_location_app_30_0) true)
(typeattributeset vendor_seempdw_socket_30_0 (vendor_seempdw_socket))
(expandtypeattribute (vendor_seempdw_socket_30_0) true)
(typeattributeset vendor_sys_sxrd_30_0 (vendor_sys_sxrd))
(expandtypeattribute (vendor_sys_sxrd_30_0) true)

2
generic/private/file.te
View file

@ -33,5 +33,7 @@ type vendor_qvrd_data_file, file_type, data_file_type, core_data_file_type;
type vendor_qvrd_socket, file_type, mlstrustedobject, coredomain_socket;
type vendor_qvrd_controller_socket, file_type, coredomain_socket;
type vendor_qvrd_hvx_socket, file_type, coredomain_socket;
type vendor_sys_sxrd_data_file, file_type, data_file_type, core_data_file_type;
type vendor_sys_sxrd_socket, file_type, mlstrustedobject, coredomain_socket;
type vendor_qcc_data_file, file_type, data_file_type, core_data_file_type;
type vendor_qcc_app_socket, file_type, mlstrustedobject, coredomain_socket;

3
generic/private/file_contexts
View file

@ -42,12 +42,14 @@
/dev/socket/qvrservice_controller u:object_r:vendor_qvrd_controller_socket:s0
/dev/socket/qvrservice_camera u:object_r:vendor_qvrd_socket:s0
/dev/socket/qvrservice_hvx_camera u:object_r:vendor_qvrd_hvx_socket:s0
/dev/socket/sxrservice u:object_r:vendor_sys_sxrd_socket:s0
/dev/socket/qdma_app(/.*)? u:object_r:vendor_qcc_app_socket:s0
####### system file ###############
/system/bin/seempd u:object_r:vendor_seempd_exec:s0
/(system_ext|system/system_ext)/bin/dpmd u:object_r:vendor_dpmd_exec:s0
/(system_ext|system/system_ext)/bin/qvrservice u:object_r:vendor_qvrd_exec:s0
/(system_ext|system/system_ext)/bin/sxrservice u:object_r:vendor_sys_sxrd_exec:s0
/system/bin/vpsservice u:object_r:vendor_vpsservice_exec:s0
####### system_ext file ###############
@ -65,5 +67,6 @@
####### data files ################
/data/dpm(/.*)? u:object_r:vendor_dpmd_data_file:s0
/data/misc/qvr(/.*)? u:object_r:vendor_qvrd_data_file:s0
/data/misc/sxr(/.*)? u:object_r:vendor_sys_sxrd_data_file:s0
/data/nfc(/.*)? u:object_r:nfc_data_file:s0
/data/misc/qdma(/.*)? u:object_r:vendor_qcc_data_file:s0

61
generic/private/sxrd.te Normal file
View file

@ -0,0 +1,61 @@
# Copyright (c) 2020 The Linux Foundation. All rights reserved.
#
# Redistribution and use in source and binary forms, with or without
# modification, are permitted provided that the following conditions are
# met:
# * Redistributions of source code must retain the above copyright
# notice, this list of conditions and the following disclaimer.
# * Redistributions in binary form must reproduce the above
# copyright notice, this list of conditions and the following
# disclaimer in the documentation and/or other materials provided
# with the distribution.
# * Neither the name of The Linux Foundation nor the names of its
# contributors may be used to endorse or promote products derived
# from this software without specific prior written permission.
#
# THIS SOFTWARE IS PROVIDED "AS IS" AND ANY EXPRESS OR IMPLIED
# WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT
# ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS
# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
# BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
# OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
# IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
typeattribute vendor_sys_sxrd coredomain;
typeattribute vendor_sys_sxrd mlstrustedsubject;
type vendor_sys_sxrd_exec, system_file_type, exec_type, file_type;
init_daemon_domain(vendor_sys_sxrd)
# Allow access to our socket
allow vendor_sys_sxrd vendor_sys_sxrd_socket:sock_file rw_file_perms;
# Allow interracting with vendor_sxrd directory
allow vendor_sys_sxrd vendor_sys_sxrd_data_file:dir create_dir_perms;
allow vendor_sys_sxrd vendor_sys_sxrd_data_file:file create_file_perms;
#video device
allow vendor_sys_sxrd video_device:chr_file rw_file_perms;
#Allow hal graphics allocator permissions
hal_client_domain(vendor_sys_sxrd, hal_graphics_allocator);
#access to usb device
allow vendor_sys_sxrd usb_device:chr_file rw_file_perms;
allow vendor_sys_sxrd usb_device:dir search;
allow vendor_sys_sxrd device:dir search;
#Allow access to PCM sound card
allow vendor_sys_sxrd audio_device:chr_file rw_file_perms;
allow vendor_sys_sxrd audio_device:dir r_dir_perms;
#Allow access to Audio Flinger APIs
binder_call(vendor_sys_sxrd, audioserver);
allow vendor_sys_sxrd audioserver_service : service_manager find;
# Add rule to access /proc/asound/pcm file
r_dir_file(vendor_sys_sxrd, proc_asound);

2
generic/private/untrusted_app_all.te
View file

@ -28,3 +28,5 @@
unix_socket_connect(untrusted_app_all, vendor_dpmtcm, vendor_dpmd)
unix_socket_connect(untrusted_app_all, vendor_qvrd, vendor_qvrd)
allow untrusted_app_all vendor_qvrd:fd use;
unix_socket_connect(untrusted_app_all, vendor_sys_sxrd, vendor_sys_sxrd)
allow untrusted_app_all vendor_sys_sxrd:fd use;

28
generic/public/sxrd.te Normal file
View file

@ -0,0 +1,28 @@
# Copyright (c) 2020, The Linux Foundation. All rights reserved.
#
# Redistribution and use in source and binary forms, with or without
# modification, are permitted provided that the following conditions are
# met:
# * Redistributions of source code must retain the above copyright
# notice, this list of conditions and the following disclaimer.
# * Redistributions in binary form must reproduce the above
# copyright notice, this list of conditions and the following
# disclaimer in the documentation and/or other materials provided
# with the distribution.
# * Neither the name of The Linux Foundation nor the names of its
# contributors may be used to endorse or promote products derived
# from this software without specific prior written permission.
#
# THIS SOFTWARE IS PROVIDED "AS IS" AND ANY EXPRESS OR IMPLIED
# WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT
# ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS
# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
# BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
# OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
# IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
type vendor_sys_sxrd, domain;