Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Vendor updates for Pie: Bluetooth, own domain for SODP apps #421

merged 6 commits into from Dec 15, 2018
Show file tree
Hide file tree
Changes from all commits
File filter

Filter by extension

Filter by extension

Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
@@ -7,10 +7,9 @@ allow hal_bluetooth_default bluetooth_vendor_data_file:file create_file_perms;
allow hal_bluetooth_default kernel:system module_request;
allow hal_bluetooth_default self:socket create;

allow hal_bluetooth_default vendor_default_prop:property_service set;

set_prop(hal_bluetooth_default, wc_prop)
set_prop(hal_bluetooth_default, bluetooth_prop)
set_prop(hal_bluetooth_default, vendor_bluetooth_prop)

r_dir_file(hal_bluetooth_default, persist_file)
r_dir_file(hal_bluetooth_default, vendor_firmware_file)
@@ -18,3 +18,4 @@ persist.vendor.usb. u:object_r:vendor_usb_prop:s0
vendor.usb.config u:object_r:vendor_usb_config_prop:s0
persist.vendor.usb.config u:object_r:vendor_usb_config_prop:s0
vendor.qcom.devup u:object_r:vendor_device_prop:s0 u:object_r:vendor_bluetooth_prop:s0
@@ -0,0 +1,19 @@
type qcrilam_app, domain;


# Needed to get access to /data/data/
# Only getattr and search are requested since qcrilam does not write to its own directory
# /data/data/ only has two empty subdirs
dontaudit qcrilam_app app_data_file:dir { getattr search };

# Acccess to its own service and broadcasts
allow qcrilam_app activity_service:service_manager find;
# Find media.audio_flinger
allow qcrilam_app audioserver_service:service_manager find;

# Find the HIDL service
allow qcrilam_app vnd_qcrilhook_hwservice:hwservice_manager find;

# Interact with rild
binder_call(qcrilam_app, rild)
@@ -1,5 +1,7 @@

binder_call(rild, per_mgr)
binder_call(rild, qcrilam_app);

allow rild per_mgr_service:service_manager find;

@@ -1 +1,11 @@
user=system seinfo=platform domain=system_app type=system_app_data_file
# To assign a custom domain to system-level app, it needs to be a priv-app.
# Otherwise it will stay a platform_app regardless of the domain specified here.
user=system seinfo=platform domain=timekeep_app type=app_data_file
user=system seinfo=platform domain=qcrilam_app type=app_data_file
# Why app_data_file and not system_app_data_file?
# Because some daemon needs access to /data/data/{timekeep,qcrilam}
# This happens with system_app_data_file:
# ContextImpl: Failed to ensure /data/user/0/ mkdir failed: EACCES (Permission denied)
# ContextImpl: Failed to update user.inode_cache: stat failed: EACCES (Permission denied)
# ContextImpl: Failed to ensure /data/user_de/0/ mkdir failed: EACCES (Permission denied)
# ContextImpl: Failed to update user.inode_code_cache: stat failed: EACCES (Permission denied)
@@ -7,10 +7,18 @@ r_dir_rw_file(system_app, sysfs_pcc_profile)
set_prop(system_app, adbtcpes_prop)
set_prop(system_app, dispcal_prop)

# TimeKeep Java service
allow system_app timekeep_vendor_data_file:dir create_dir_perms;
allow system_app timekeep_vendor_data_file:file create_file_perms;
# Different system_apps read this value, independent from timekeep.c or
#, so keep it in here
set_prop(system_app, timekeep_prop)

# For android setttings
binder_call(system_app, per_mgr)
binder_call(system_app, wificond)

# This is a neverallow anyways, so ignore it
dontaudit system_app perfprofd:binder call;

allow system_app fs_bpf:dir search;
allow system_app proc_pagetypeinfo:file r_file_perms;
allow system_app sysfs_zram:dir search;
allow system_app sysfs_zram:file r_file_perms;
@@ -1,14 +1,22 @@
# Policy for the timekeep.c oneshot system service
# Gets called once during init by vendor timekeep.rc and restores
# clock from persist.sys.timeadjust property, reads
# /sys/class/rtc/rtc0/since_epoch
type timekeep, domain;
type timekeep_exec, exec_type, vendor_file_type, file_type;


# Grant permission to set system time and to set the real-time lock
# Grant permission to set system time and to set the real-time clock
allow timekeep self:capability { fowner sys_time };

# Write to /data/vendor/time/ats_2
allow timekeep timekeep_vendor_data_file:dir rw_dir_perms;
allow timekeep timekeep_vendor_data_file:file create_file_perms;

# Set persist.sys.timeadjust
set_prop(timekeep, timekeep_prop)

r_dir_file(timekeep, sysfs_msm_subsys)
# Read /sys/class/rtc/rtc0/since_epoch
allow timekeep sysfs_rtc:dir search;
allow timekeep sysfs_rtc:{ file lnk_file } r_file_perms;
@@ -0,0 +1,25 @@
# Policy for the TimeKeep Java app. It listens to a BootReceiver
# or TIME_SET event and calculates the offset between the rtc clock
# in /sys/class/rtc0/since_epoch and the current device time and stores that
# value in /data/vendor/time/ats_2 and as persist.sys.timeadjust.
type timekeep_app, domain;


# Needed to get access to /data/data/
# Only getattr and search are requested since TimeKeep does not write to its own directory
# /data/data/ only has two empty subdirs
dontaudit timekeep_app app_data_file:dir { getattr search };

allow timekeep_app activity_service:service_manager find;

# Read from /data/vendor/time/ats_2
allow timekeep_app timekeep_vendor_data_file:dir create_dir_perms;
allow timekeep_app timekeep_vendor_data_file:file create_file_perms;

# Read /sys/class/rtc/rtc0/since_epoch
allow timekeep_app sysfs_rtc:dir { search };
allow timekeep_app sysfs_rtc:{ file lnk_file } r_file_perms;

# Set the persist.sys.timeadjust property
set_prop(timekeep_app, timekeep_prop)
@@ -1,2 +1,3 @@
type qdisplay_service, vndservice_manager_type;
type per_mgr_service, vndservice_manager_type;
type qcrilam_service, vndservice_manager_type;
@@ -1,2 +1,3 @@
display.qservice u:object_r:qdisplay_service:s0
vendor.qcom.PeripheralManager u:object_r:per_mgr_service:s0 u:object_r:qcrilam_service:s0