msm8937-common: sepolicy: Address more denials

* Also arrange sepolicies
HyperTeam · Jul 8, 2018 · d5fe8be · d5fe8be
1 parent 28b0c31
commit d5fe8be
Show file tree

Hide file tree

Showing 14 changed files with 45 additions and 29 deletions.
diff --git a/sepolicy/vendor/bluetooth_loader-qcom.te b/sepolicy/vendor/bluetooth_loader-qcom.te
diff --git a/sepolicy/vendor/bluetooth_loader.te b/sepolicy/vendor/bluetooth_loader.te
@@ -1,2 +1,29 @@
+type bluetooth_loader, domain;
+type bluetooth_loader_exec, exec_type, vendor_file_type, file_type;
+
+# Started by init
+init_daemon_domain(bluetooth_loader)
+
+# Get persist.service.bdroid.*, bluetooth.* and wcnss property values
+get_prop(bluetooth_loader, bluetooth_prop)
+get_prop(bluetooth_loader, wcnss_prop)
+
+# Access the serial device
+allow bluetooth_loader serial_device:chr_file rw_file_perms;
+
+# And the smd device
+allow bluetooth_loader smd_device:chr_file rw_file_perms;
+
 allow bluetooth_loader persist_bluetooth_file:dir search;
 allow bluetooth_loader persist_bluetooth_file:file rw_file_perms;
+
+# And qmuxd
+allow bluetooth_loader qmuxd_socket:dir create_dir_perms;
+allow bluetooth_loader qmuxd_socket:sock_file create_file_perms;
+allow bluetooth_loader qmuxd:unix_stream_socket connectto;
+
+r_dir_file(bluetooth_loader, persist_file)
+
+userdebug_or_eng(`
+    diag_use(bluetooth_loader)
+')
diff --git a/sepolicy/vendor/dpmd.te b/sepolicy/vendor/dpmd.te
@@ -0,0 +1 @@
+allow dpmd self:capability dac_override;
diff --git a/sepolicy/vendor/file.te b/sepolicy/vendor/file.te
@@ -4,3 +4,4 @@ type fpce_socket, file_type;
 type fpc_sysfs, fs_type, sysfs_type;
 type gx_fpd_data_file, file_type, data_file_type;
 type debugfs_rmt, debugfs_type, fs_type;
+type rild_file, file_type, vendor_file_type;
diff --git a/sepolicy/vendor/file_contexts b/sepolicy/vendor/file_contexts
@@ -26,5 +26,8 @@
 # Ir
 /dev/lirc[0-9]*					u:object_r:lirc_device:s0
 
+# Rild
+/(vendor|system/vendor)/radio/qcril_database/qcril.db	u:object_r:rild_file:s0
+
 # Light
 /sys/devices/soc/78b6000\.i2c/i2c-2/2-[0-9a-f]+/leds(/.*)?    u:object_r:sysfs_leds:s0
diff --git a/sepolicy/vendor/hal_audio_default.te b/sepolicy/vendor/hal_audio_default.te
@@ -0,0 +1 @@
+allow hal_audio_default sysfs:dir r_dir_perms;
diff --git a/sepolicy/vendor/hal_ir_default.te b/sepolicy/vendor/hal_ir_default.te
@@ -0,0 +1,2 @@
+allow hal_ir_default sysfs_leds:dir search;
+allow hal_ir_default sysfs:file { open read write };
diff --git a/sepolicy/vendor/location.te b/sepolicy/vendor/location.te
diff --git a/sepolicy/vendor/camera.te → sepolicy/vendor/mm-qcamerad.te b/sepolicy/vendor/camera.te → sepolicy/vendor/mm-qcamerad.te
diff --git a/sepolicy/vendor/per_mgr.te b/sepolicy/vendor/per_mgr.te
diff --git a/sepolicy/vendor/platform_app.te b/sepolicy/vendor/platform_app.te
@@ -0,0 +1 @@
+allow platform_app qemu_hw_mainkeys_prop:file read;
diff --git a/sepolicy/vendor/qti_init_shell.te b/sepolicy/vendor/qti_init_shell.te
@@ -1,4 +1,6 @@
 allow qti_init_shell bluetooth_data_file:file r_file_perms;
 allow qti_init_shell bluetooth_loader_exec:file { read open };
+allow qti_init_shell hci_attach_dev:chr_file rw_file_perms;
 allow qti_init_shell proc:dir setattr;
 allow qti_init_shell sysfs:file write;
+allow qti_init_shell sysfs_devices_system_cpu:dir write;
diff --git a/sepolicy/vendor/rild.te b/sepolicy/vendor/rild.te
@@ -1,2 +1,3 @@
 allow rild vendor_file:file ioctl;
+allow rild rild_file:file r_file_perms;
 set_prop(rild, system_radio_prop)
diff --git a/sepolicy/vendor/thermal-engine.te b/sepolicy/vendor/thermal-engine.te
@@ -0,0 +1,6 @@
+allow thermal-engine file_contexts_file:file { getattr read open };
+allow thermal-engine self:process { setfscreate };
+allow thermal-engine socket_device:sock_file { create relabelfrom relabelto setattr };
+allow thermal-engine thermal_socket:sock_file { relabelfrom relabelto };
+allow thermal-engine vendor_shell_exec:file execute_no_trans;
+allow thermal-engine vendor_toolbox_exec:file execute_no_trans;