Merge tag 'LA.VENDOR.1.0.r1-25300-WAIPIO.QSSI15.0' into staging/lineage-21.0_merge-LA.VENDOR.1.0.r1-25300-WAIPIO.QSSI15.0

"LA.VENDOR.1.0.r1-25300-WAIPIO.QSSI15.0"

* tag 'LA.VENDOR.1.0.r1-25300-WAIPIO.QSSI15.0':
  Camera: Anorak: Add Missing Permissions to run QVR and Camera HAL Concurrently
  sepolicy_vndr: Adding changes to support codec2.
  sepolicy: allow qvr to access camera hal service.
  anorak: add controller permission to access camera hal
  Camera: Anorak: Add Permissions to run QVR and Camera HAL Concurrently
  Camera: Anorak: Add QVR permissions to Camera HAL
  anorak: move qvrcamservice from common/ to anorak/
  SEPolicy change for Location Qesdk Service..
  Sepolicy_vndr: add permission for qvrcamservice

 Conflicts:
	qva/vendor/common/service.te

Change-Id: I49a386bcc21f24ad27c05cd024b190f7f681b961

generic/vendor/common/hal_gnss_qti.te

@@ -54,6 +54,12 @@ allow vendor_hal_gnss_qti vendor_sysfs_mhi:file r_file_perms;
 # Allow Gnss HAL to get updates from health hal
 hal_client_domain(vendor_hal_gnss_qti, hal_health)
 
+# Allow Gnss HAL to access QESDK
+qesdk_access(vendor_hal_gnss_qti)
+
+# allows Gnss HAL to access ssgtzd socket
+unix_socket_connect(vendor_hal_gnss_qti, vendor_ssgtzd, vendor_ssgtzd)
+
 # Most HALs are not allowed to use network sockets. QTI library
 # libqdi is used across multiple processes which are clients of
 # netmgrd including the GNSS HAL. libqdi first attempts to get the network

qva/vendor/anorak/file_contexts

@@ -39,3 +39,6 @@
 
 # calib partition
 /mnt/vendor/calib(/.*)?               u:object_r:vendor_calib_file:s0
+
+# qvrcamservice
+/(vendor|system/vendor)/bin/hw/qvrcamservice     u:object_r:vendor_qvrd_vndr_cam_exec:s0

qva/vendor/anorak/hal_camera_default.te

@@ -0,0 +1,67 @@
+#Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+#SPDX-License-Identifier: BSD-3-Clause-Clear
+
+typeattribute hal_camera_default mlstrustedsubject;
+
+hal_server_domain(hal_camera_default, vendor_hal_qvrservice_qti)
+
+hal_server_domain(hal_camera_default, vendor_hal_qvrcamservice_qti)
+
+
+allow hal_camera_default vendor_hal_qvrservice_qti_socket_client:unix_stream_socket { getopt read setopt shutdown write };
+
+allow vendor_hal_qvrservice_qti_socket_fd_use_client hal_camera_default: fd use;
+allow hal_camera_default vendor_hal_qvrservice_qti_socket_fd_use_client:process setsched;
+
+# Allow access to qvrd_vndr socket
+allow hal_camera_default vendor_qvrd_vndr_socket:sock_file rw_file_perms;
+
+# Allow access to qvrd_vndr directory
+allow hal_camera_default vendor_qvrd_vndr_data_file:dir create_dir_perms;
+allow hal_camera_default vendor_qvrd_vndr_data_file:file create_file_perms;
+
+# Allow hal_camera to call sensor native service
+binder_call(hal_camera_default, system_server);
+
+
+hal_client_domain(hal_camera_default, hal_sensors)
+
+
+#
+# Display
+#
+
+# Allow access to /dev/graphics/fb0 for configuring vsync interrupts
+allow hal_camera_default graphics_device:dir r_dir_perms;
+allow hal_camera_default graphics_device:chr_file rw_file_perms;
+
+#
+# Scheduler
+#
+
+userdebug_or_eng(`
+  allow hal_camera_default su:process setsched;
+')
+allow hal_camera_default appdomain:process setsched;
+
+# Allows hal_camera to read the qvr properties
+get_prop(hal_camera_default, vendor_qvr_prop)
+get_prop(hal_camera_default, vendor_qvr_persist_prop)
+get_prop(hal_camera_default, vendor_qvrd_persist_prop)
+
+allow hal_camera_default vendor_qvrd_vndr:unix_stream_socket { connectto };
+allow hal_camera_default vendor_qvrd_vndr:fd use;
+
+# Allow access to thermal
+binder_call(hal_camera_default, hal_thermal);
+hal_client_domain(hal_camera_default, hal_thermal);
+unix_socket_connect(hal_camera_default, vendor_thermal, vendor_thermal-engine)
+
+crash_dump_fallback(hal_camera_default);
+unix_socket_connect(hal_camera_default, logdr, logd)
+
+allow hal_camera_default mnt_vendor_file:dir r_dir_perms;
+allow hal_camera_default vendor_calib_file:dir r_dir_perms;
+allow hal_camera_default vendor_calib_file:file rw_file_perms;
+
+

qva/vendor/anorak/hal_nordic_default.te

@@ -36,3 +36,8 @@ allow vendor_hal_nordic_default mnt_vendor_file:dir r_dir_perms;
 allow vendor_hal_nordic_default vendor_calib_file:dir r_dir_perms;
 allow vendor_hal_nordic_default vendor_calib_file:file rw_file_perms;
 allow vendor_hal_nordic_default vendor_ttyKXR2:chr_file rw_file_perms;
+allow vendor_hal_nordic_default vendor_qvrd_vndr_cam:unix_stream_socket connectto;
+allow vendor_hal_nordic_default vendor_qvrd_vndr_cam:fd use;
+allow vendor_hal_nordic_default vendor_qvrd_vndr_camera_socket:sock_file rw_file_perms;
+allow vendor_hal_nordic_default hal_camera_default:unix_stream_socket connectto;
+allow vendor_hal_nordic_default hal_camera_default:fd use;

qva/vendor/anorak/qvrd_vndr.te

@@ -12,6 +12,9 @@ allow vendor_qvrd_vndr self:qipcrtr_socket { create getattr write read setopt };
 allow vendor_qvrd_vndr vendor_camera_data_file:dir create_dir_perms;
 allow vendor_qvrd_vndr vendor_camera_data_file:file create_file_perms;
 
+allow vendor_qvrd_vndr hal_camera_default:unix_stream_socket { connectto };
+allow vendor_qvrd_vndr hal_camera_default:fd use;
+
 # Allow access thermal
 unix_socket_connect(vendor_qvrd_vndr, vendor_thermal, vendor_thermal-engine)
 
@@ -22,7 +25,15 @@ allow vendor_qvrd_vndr vendor_calib_file:file rw_file_perms;
 neverallow { coredomain -init -ueventd } vendor_calib_file:dir *;
 neverallow { coredomain -init -ueventd } vendor_calib_file:file *;
 
-get_prop(vendor_qvrd_vndr, vendor_camera_prop)
 dontaudit vendor_qvrd_vndr vendor_hal_camera_postproc_hwservice:hwservice_manager *;
 
 allow vendor_qvrd_vndr vendor_sysfs_ipd_distance:file rw_file_perms;
+
+
+# Allow to access qvr_vndr_cam
+allow vendor_qvrd_vndr vendor_qvrd_vndr_camera_socket:sock_file rw_file_perms;
+allow vendor_qvrd_vndr vendor_qvrd_vndr_cam:unix_stream_socket connectto;
+allow vendor_qvrd_vndr vendor_qvrd_vndr_cam:fd use;
+
+get_prop(vendor_qvrd_vndr, vendor_camera_prop)
+hal_server_domain_bypass(vendor_qvrd_vndr, vendor_hal_qvrcamservice_qti)

qva/vendor/anorak/qvrd_vndr_cam.te

@@ -0,0 +1,71 @@
+#Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+#SPDX-License-Identifier: BSD-3-Clause
+
+type vendor_qvrd_vndr_cam, domain, mlstrustedsubject;
+type vendor_qvrd_vndr_cam_exec, vendor_file_type, exec_type, file_type;
+
+init_daemon_domain(vendor_qvrd_vndr_cam)
+
+binder_service(vendor_qvrd_vndr_cam)
+
+hal_server_domain(vendor_qvrd_vndr_cam, vendor_hal_qvrcamservice_qti)
+hal_attribute_service(vendor_hal_qvrcamservice_qti, vendor_hal_qvrd_camservice)
+
+binder_use(vendor_qvrd_vndr_cam);
+
+# Allow access to our socket
+allow vendor_qvrd_vndr_cam vendor_qvrd_vndr_camera_socket:sock_file rw_file_perms;
+allow vendor_qvrd_vndr_cam vendor_qvrd_vndr_socket:sock_file rw_file_perms;
+allow vendor_qvrd_vndr_cam vendor_qvrd_vndr:unix_stream_socket connectto;
+allow vendor_qvrd_vndr_cam vendor_qvrd_vndr:fd use;
+allow vendor_qvrd_vndr_cam self:capability sys_nice;
+
+# qvrcam properties
+get_prop(vendor_qvrd_vndr_cam, vendor_qvr_prop)
+get_prop(vendor_qvrd_vndr_cam, vendor_sxr_prop)
+get_prop(vendor_qvrd_vndr_cam, vendor_qvrd_prop)
+get_prop(vendor_qvrd_vndr_cam, vendor_qvr_persist_prop)
+get_prop(vendor_qvrd_vndr_cam, vendor_qvrd_persist_prop)
+
+# Allow access with qvrd_vndr directory
+allow vendor_qvrd_vndr_cam vendor_qvrd_vndr_data_file:dir rw_dir_perms;
+allow vendor_qvrd_vndr_cam vendor_qvrd_vndr_data_file:file { rw_file_perms create };
+
+#
+# Camera
+#
+get_prop(vendor_qvrd_vndr_cam, vendor_camera_prop)
+allow vendor_qvrd_vndr_cam vendor_camera_data_file:dir create_dir_perms;
+allow vendor_qvrd_vndr_cam vendor_camera_data_file:file create_file_perms;
+
+# Allow access to ADSP & SLPI
+allow vendor_qvrd_vndr_cam vendor_xdsp_device:chr_file r_file_perms;
+allow vendor_qvrd_vndr_cam dmabuf_system_heap_device:chr_file r_file_perms;
+
+#
+# Sensors
+#
+allow vendor_qvrd_vndr_cam self:qipcrtr_socket { create getattr write read setopt };
+
+#
+# Perfd
+#
+hal_client_domain(vendor_qvrd_vndr_cam, vendor_hal_perf)
+
+# Allow access thermal
+unix_socket_connect(vendor_qvrd_vndr_cam, vendor_thermal, vendor_thermal-engine)
+
+#Allow hal graphics mapper permissions
+hal_client_domain(vendor_qvrd_vndr_cam, hal_graphics_composer);
+
+#Allow hal graphics allocator permissions
+hal_client_domain(vendor_qvrd_vndr_cam, hal_graphics_allocator);
+
+get_prop(vendor_qvrd_vndr_cam, aac_drc_prop)
+get_prop(vendor_qvrd_vndr_cam, ab_update_gki_prop)
+
+allow vendor_qvrd_vndr_cam { gpu_device sensors_device }:chr_file r_file_perms;
+allow vendor_qvrd_vndr_cam video_device:chr_file rw_file_perms;
+
+allow vendor_qvrd_vndr_cam proc_uptime:file r_file_perms;
+crash_dump_fallback(vendor_qvrd_vndr_cam);

qva/vendor/anorak/sxrd_vndr.te

@@ -0,0 +1,39 @@
+# Copyright (c) 2021, The Linux Foundation. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+#     * Redistributions of source code must retain the above copyright
+#       notice, this list of conditions and the following disclaimer.
+#     * Redistributions in binary form must reproduce the above
+#       copyright notice, this list of conditions and the following
+#       disclaimer in the documentation and/or other materials provided
+#       with the distribution.
+#     * Neither the name of The Linux Foundation nor the names of its
+#       contributors may be used to endorse or promote products derived
+#       from this software without specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED "AS IS" AND ANY EXPRESS OR IMPLIED
+# WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT
+# ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS
+# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
+# BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
+# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
+# OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
+# IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+#
+# Changes from Qualcomm Innovation Center, Inc. are provided under the following license:
+# Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+# SPDX-License-Identifier: BSD-3-Clause-Clear
+
+#Allow /dev/dma_heap file access
+allow vendor_sxrd_vndr dmabuf_system_heap_device:chr_file { getattr read open ioctl };
+
+#Allow access to video files
+set_prop(vendor_sxrd_vndr, vendor_video_prop)
+
+#Allow access to codec2 config
+get_prop(vendor_sxrd_vndr, codec2_config_prop)

qva/vendor/common/file.te

@@ -128,6 +128,9 @@ type vendor_sysfs_qvr_external_sensor, sysfs_type, fs_type;
 type vendor_qvrd_vndr_data_file, file_type, data_file_type;
 type vendor_qvrd_vndr_socket, file_type;
 
+#qvrcamservice sysfs files
+type vendor_qvrd_vndr_camera_socket, file_type;
+
 #sxrservice sysfs files
 type vendor_sxrd_vndr_data_file, file_type, data_file_type;
 type vendor_sxrd_vndr_socket, file_type;

qva/vendor/common/file_contexts

@@ -73,7 +73,7 @@
 /dev/socket/qcc_trd(/.*)?                       u:object_r:vendor_qcc_trd_socket:s0
 /dev/socket/qesd                                u:object_r:vendor_qesd_socket:s0
 /dev/socket/qvrservice_vndr                     u:object_r:vendor_qvrd_vndr_socket:s0
-/dev/socket/qvrservice_vndr_camera              u:object_r:vendor_qvrd_vndr_socket:s0
+/dev/socket/qvrservice_vndr_camera              u:object_r:vendor_qvrd_vndr_camera_socket:s0
 /dev/socket/sxrservice_vndr                     u:object_r:vendor_sxrd_vndr_socket:s0
 
 /dev/smcinvoke                                  u:object_r:tee_device:s0

qva/vendor/common/service.te

@@ -28,5 +28,6 @@
 type vendor_dun_service,                 service_manager_type;
 type vendor_imsrcs_service,              service_manager_type;
 type vendor_hal_qvrd_service,            hal_service_type, protected_service, service_manager_type;
+type vendor_hal_qvrd_camservice,         hal_service_type, protected_service, service_manager_type;
 type vendor_hal_sxrd_service,            hal_service_type, protected_service, service_manager_type;
 type vendor_hal_dataconnection_service,  hal_service_type, protected_service, service_manager_type;

qva/vendor/common/service_contexts

@@ -26,7 +26,7 @@
 # IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 vendor.qti.hardware.qxr.IQXRCoreService/default        u:object_r:vendor_hal_qvrd_service:s0
-vendor.qti.hardware.qxr.IQXRCamService/default         u:object_r:vendor_hal_qvrd_service:s0
+vendor.qti.hardware.qxr.IQXRCamService/default         u:object_r:vendor_hal_qvrd_camservice:s0
 vendor.qti.hardware.qxr.IQXRModService/default         u:object_r:vendor_hal_qvrd_service:s0
 vendor.qti.hardware.qxr.IQXRSplitService/default        u:object_r:vendor_hal_sxrd_service:s0
 vendor.qti.hardware.qxr.IQXRAudioService/default        u:object_r:vendor_hal_sxrd_service:s0