universal8895: address charger denials

 * also make the charger domain permissive

Change-Id: If0c7860c84d925965417d841298ebc2a84eead7f

diff --git a/sepolicy/vendor/charger.te b/sepolicy/vendor/charger.te
new file mode 100644 (file)
index 0000000..890f355
--- /dev/null
+++ b/sepolicy/vendor/charger.te
@@ -0,0 +1,21 @@
+
+# lpm does not like being in enforcing, possibly due to the dac_override
+permissive charger;
+
+allow charger { sysfs_power sysfs_battery }:file r_file_perms;
+allow charger { sysfs_graphics sysfs_virtual sysfs_charger sysfs_battery_writable sysfs_power_writable }:file rw_file_perms;
+allow charger sysfs_charger:dir r_dir_perms;
+
+allow charger { app_efs_file efs_file imei_efs_file battery_efs_file }:file rw_file_perms;
+allow charger { app_efs_file efs_file imei_efs_file battery_efs_file }:dir search;
+
+allow charger input_device:{ chr_file file } rw_file_perms;
+allow charger input_device:dir rw_dir_perms;
+
+
+allow charger self:netlink_kobject_uevent_socket { create setopt bind read };
+allow charger self:capability { net_admin sys_tty_config sys_boot };
+
+dontaudit charger self:capability { dac_override dac_read_search };
+
+set_prop(charger,powerctl_prop)

diff --git a/sepolicy/vendor/file_contexts b/sepolicy/vendor/file_contexts
index 56b6de4a38bdaef57b0e306843de14822e3edc1a..b5a4225a0753f1794f4433c8137a261acc87597b 100644 (file)
--- a/sepolicy/vendor/file_contexts
+++ b/sepolicy/vendor/file_contexts
@@ -87,6 +87,8 @@
 /sys/devices/platform/10970000\.hsi2c/i2c-13/13-0066/max77865-charger/power_supply/max77865-charger(/.*)?     u:object_r:sysfs_charger:s0
 /sys/devices/platform/10970000\.hsi2c/i2c-13/13-0066/max77865-fuelgauge/power_supply/max77865-fuelgauge(/.*)? u:object_r:sysfs_charger:s0
 
+/system/bin/lpm                                        u:object_r:charger_exec:s0
+
 # sec
 /sys/class/sec(/.*)?                          -- u:object_r:sysfs_sec:s0