tequilaOS/platform_device_qcom_sepolicy_vndr-sm8450
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Merge "sepolicy: rename hang_guard to qguard"

Browse source
This commit is contained in:
qctecmdr 2021-09-09 03:56:13 -07:00 committed by Gerrit - the friendly Code Review server
commit 975234aee7
2 changed files with 19 additions and 14 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
generic/vendor/test/file_contexts vendored
View file

@ -78,8 +78,8 @@
/(vendor|system/vendor)/bin/test-fake-ap u:object_r:vendor_location_exec:s0
/(vendor|system/vendor)/bin/test-fdal u:object_r:vendor_location_exec:s0
#### Context for hang_guard
/(vendor|system/vendor)/bin/hang_guard u:object_r:vendor_hang_guard_exec:s0
#### Context for qguard
/(vendor|system/vendor)/bin/qguard u:object_r:vendor_qguard_exec:s0
#For debug script
/(vendor|system/vendor)/bin/init\.qti\.kernel\.debug\.sh u:object_r:vendor_qti_init_shell_exec:s0

29
generic/vendor/test/hang_guard.te → generic/vendor/test/qguard.te vendored
View file

@ -25,27 +25,32 @@
# OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
# IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
type vendor_hang_guard, domain, mlstrustedsubject;
type vendor_hang_guard_exec, exec_type, vendor_file_type, file_type;
type vendor_qguard, domain, mlstrustedsubject;
type vendor_qguard_exec, exec_type, vendor_file_type, file_type;
init_daemon_domain(vendor_hang_guard)
init_daemon_domain(vendor_qguard)
userdebug_or_eng(`
allow vendor_hang_guard self:global_capability_class_set kill;
allow vendor_hang_guard kmsg_device:chr_file w_file_perms;
allow vendor_hang_guard domain:process { signal sigstop sigkill };
allow vendor_qguard self:global_capability_class_set kill;
allow vendor_qguard kmsg_device:chr_file w_file_perms;
allow vendor_qguard domain:process { signal sigstop sigkill };
# sh
allow vendor_hang_guard { vendor_shell_exec vendor_toolbox_exec }:file rx_file_perms;
allow vendor_qguard { vendor_shell_exec vendor_toolbox_exec }:file rx_file_perms;
# look through /proc
allow vendor_hang_guard domain:dir r_dir_perms;
allow vendor_hang_guard domain:file r_file_perms;
allow vendor_hang_guard domain:lnk_file read;
allow vendor_qguard domain:dir r_dir_perms;
allow vendor_qguard domain:file r_file_perms;
allow vendor_qguard domain:lnk_file read;
# write into hung_task_enh
allow vendor_qguard proc:file { write open };
# write into sysrq
allow vendor_hang_guard proc_sysrq:file w_file_perms;
allow vendor_qguard proc_sysrq:file w_file_perms;
# reboot
set_prop(vendor_hang_guard, powerctl_prop)
set_prop(vendor_qguard, powerctl_prop)
dontaudit vendor_qguard default_prop:file read;
')