This is a set of vendor changes necessary for interworking
with kernel verison 4.19 properly.
With kernel 4.19, additional filesystem getattr operations
are performed by init for the firmware mount points.
In addition on bootup after adb remount with Android's
Dynamic Partition feature, init needs access to underlying
block devices for overlayfs mounting. At that stage of
init, while SELinux is initialized (thus the need to add
these rules), the underlying block device nodes in tmpfs
have not yet be labeled.
Change-Id: Iaf15fda401da7b4a34e281e010e16303966bb2c0
Add file contexts for multiimgqti, featenabler
and core_nhlos partitions to enable A/B OTA update
on these partitions.
Change-Id: I532be0343de4068fd40b00b675d2765c5e5ab4f0
Following are added
1.ueventd and vold need search/read access to /mnt/vendor/persist
2. system_server need access to /sys/class/rtc/rtc0 path.
Change-Id: I4d5f322019f1e75aab1be2168eb3805f4f3998c6
These rules are missed while porting the policies from Android P
to Android Q.
Adressing the following denial:
type=1400 audit(14866.629:43): avc: denied { search } for comm="HwBinder:753_1"
name="gpu" dev="sda9" ino=376 scontext=u:r:hal_graphics_allocator_default:s0
tcontext=u:object_r:vendor_gles_data_file:s0 tclass=dir permissive=0
Change-Id: I24434be8d895d5dab8e5c24643c8be48f20d8673
- Add rule for write access to dpmtcm_socket sock file
- Add few domains to dont audit rule list for vendor_gles_data_file
dir search.
Change-Id: Iabc0250d2ac0bf28e4f4dd3d8c67b4bf20fbeb1e
CRs-Fixed: 2469209
Do not audit zygote service access to vendor_gles_data_file.
Addressing the following denial:
type=1400 audit(0.0:123): avc: denied { search } for name="gpu" dev="dm-0"
ino=1654839 scontext=u:r:zygote:s0 tcontext=u:object_r:
vendor_gles_data_file:s0 tclass=dir permissive=0
CRs-Fixed: 2465123
Change-Id: I6cc6e3e6e393a7181bd9fea6992e6f86f987f0d5
Add sysfs path for mhi timesync feature files to be read from
userspace applications/services.
CRs-Fixed: 2426302
Change-Id: Ib28800e000774d8ce27dd9a78db9efd6ebdbdb00
Add permission for feature enabler client app to have read and write
access to qseecom node, ion node,and mink socket
Change-Id: I08d5c5a27846fc5c22d505a66544645cb0543223
The error is encountered when usta_app (test app) is trying to open
system_data_file(/data/misc/gpu/adreno_config.txt). Providing only open
permission to the test app.
Addressing the issue:
avc: denied { open } for comm="RenderThread" path="/data/misc/gpu/adreno_config.txt"
dev="dm-0" ino=1180432 scontext=u:r:usta_app:s0 tcontext=u:object_r:system_data_file:s0
tclass=file permissive=1
JIRAs-Fixed: APTSEC-22
CRs-Fixed: 2460155
Change-Id: I73828c62fac6022197ff58f04494331a609a4175
wlan driver/fw version are set at property at enforcing mode.
Add rules to allow to set wlan driver/fw version info
CRs-Fixed: 2460816
Change-Id: Ic0bb570cd53fe450512496c5864f432ce3219bbe
Add hta runtime libraries to file_contexts for allowing applications from
data partition to link to them.
Change-Id: Ib6318f59fd1b0f7d462f587721d90bd3c1f909b0
