exynos9610: initial sepolicy

Change-Id: I8f45bf61337ace5c98931c9036b371c77af627cc

diff --git a/BoardConfigCommon.mk b/BoardConfigCommon.mk
index 6054221eba6e287310cba8696d92fca327a7be95..ab3f4849b2f50472ceeef37aef17fde01872669a 100644 (file)
--- a/BoardConfigCommon.mk
+++ b/BoardConfigCommon.mk
@@ -131,7 +131,8 @@ USE_XML_AUDIO_POLICY_CONF := 1
 BOARD_SEPOLICY_TEE_FLAVOR := mobicore
 include device/samsung_slsi/sepolicy/sepolicy.mk
 
-BOARD_PLAT_PRIVATE_SEPOLICY_DIR := $(COMMON_PATH)/sepolicy/private
+BOARD_PLAT_PRIVATE_SEPOLICY_DIR += $(COMMON_PATH)/sepolicy/private
+BOARD_VENDOR_SEPOLICY_DIRS += $(COMMON_PATH)/sepolicy/vendor
 
 # Properties
 TARGET_SYSTEM_PROP += $(COMMON_PATH)/system.prop

diff --git a/sepolicy/private/clean_scratch_files.te b/sepolicy/private/clean_scratch_files.te
new file mode 100644 (file)
index 0000000..fe6c8c4
--- /dev/null
+++ b/sepolicy/private/clean_scratch_files.te
@@ -0,0 +1,7 @@
+type clean_scratch_files, domain;
+type clean_scratch_files_exec, exec_type, file_type, system_file_type;
+typeattribute clean_scratch_files coredomain;
+
+init_daemon_domain(clean_scratch_files)
+
+allow clean_scratch_files metadata_file:dir search;

diff --git a/sepolicy/private/device.te b/sepolicy/private/device.te
new file mode 100644 (file)
index 0000000..c7ec66b
--- /dev/null
+++ b/sepolicy/private/device.te
@@ -0,0 +1,2 @@
+type fm_device, dev_type;
+type pktrouter_device, dev_type;

diff --git a/sepolicy/private/domain.te b/sepolicy/private/domain.te
new file mode 100644 (file)
index 0000000..0bdbc46
--- /dev/null
+++ b/sepolicy/private/domain.te
@@ -0,0 +1 @@
+get_prop(domain, vendor_exported_system_prop)

diff --git a/sepolicy/private/file_contexts b/sepolicy/private/file_contexts
new file mode 100644 (file)
index 0000000..220196d
--- /dev/null
+++ b/sepolicy/private/file_contexts
@@ -0,0 +1,14 @@
+####################################
+# Daemons
+#
+
+/system/bin/clean_scratch_files     u:object_r:clean_scratch_files_exec:s0
+/system/bin/wfc-pkt-router          u:object_r:netutils_wrapper_exec:s0
+
+##########################
+# Devices
+#
+
+/dev/radio0                         u:object_r:fm_device:s0
+/dev/umts_wfc0                      u:object_r:pktrouter_device:s0
+/dev/umts_wfc1                      u:object_r:pktrouter_device:s0

diff --git a/sepolicy/private/netutils_wrapper.te b/sepolicy/private/netutils_wrapper.te
new file mode 100644 (file)
index 0000000..825cf5d
--- /dev/null
+++ b/sepolicy/private/netutils_wrapper.te
@@ -0,0 +1,2 @@
+init_daemon_domain(netutils_wrapper)
+allow netutils_wrapper pktrouter_device:chr_file rw_file_perms;

diff --git a/sepolicy/private/otapreopt_chroot.te b/sepolicy/private/otapreopt_chroot.te
new file mode 100644 (file)
index 0000000..52a37ba
--- /dev/null
+++ b/sepolicy/private/otapreopt_chroot.te
@@ -0,0 +1 @@
+dontaudit otapreopt_chroot system_file:dir mounton;

diff --git a/sepolicy/private/property.te b/sepolicy/private/property.te
new file mode 100644 (file)
index 0000000..eb029e1
--- /dev/null
+++ b/sepolicy/private/property.te
@@ -0,0 +1 @@
+type vendor_exported_system_prop, property_type;

diff --git a/sepolicy/private/property_contexts b/sepolicy/private/property_contexts
new file mode 100644 (file)
index 0000000..3f61f69
--- /dev/null
+++ b/sepolicy/private/property_contexts
@@ -0,0 +1 @@
+ro.vendor.qti.va_aosp.support       u:object_r:vendor_exported_system_prop:s0 exact bool

diff --git a/sepolicy/private/system_app.te b/sepolicy/private/system_app.te
new file mode 100644 (file)
index 0000000..e86d053
--- /dev/null
+++ b/sepolicy/private/system_app.te
@@ -0,0 +1,3 @@
+allow system_app fm_device:chr_file rw_file_perms;
+
+binder_call(system_app, storaged)

diff --git a/sepolicy/vendor/abox.te b/sepolicy/vendor/abox.te
new file mode 100644 (file)
index 0000000..41f84e0
--- /dev/null
+++ b/sepolicy/vendor/abox.te
@@ -0,0 +1,7 @@
+type abox, domain, mlstrustedsubject;
+type abox_exec, exec_type, file_type, vendor_file_type;
+init_daemon_domain(abox)
+
+allow abox sysfs_abox_writable:file rw_file_perms;
+
+allow abox self:netlink_kobject_uevent_socket create_socket_perms_no_ioctl;

diff --git a/sepolicy/vendor/attributes b/sepolicy/vendor/attributes
new file mode 100644 (file)
index 0000000..7e6def7
--- /dev/null
+++ b/sepolicy/vendor/attributes
@@ -0,0 +1 @@
+attribute vendor_persist_type;

diff --git a/sepolicy/vendor/bluetooth.te b/sepolicy/vendor/bluetooth.te
new file mode 100644 (file)
index 0000000..c8b0aa4
--- /dev/null
+++ b/sepolicy/vendor/bluetooth.te
@@ -0,0 +1 @@
+get_prop(bluetooth, vendor_audio_prop)

diff --git a/sepolicy/vendor/cbd.te b/sepolicy/vendor/cbd.te
new file mode 100644 (file)
index 0000000..332f951
--- /dev/null
+++ b/sepolicy/vendor/cbd.te
@@ -0,0 +1,4 @@
+allow cbd modem_block_device:blk_file r_file_perms;
+
+get_prop(cbd, exported3_radio_prop)
+set_prop(cbd, vendor_radio_prop)

diff --git a/sepolicy/vendor/charge_only.te b/sepolicy/vendor/charge_only.te
new file mode 100644 (file)
index 0000000..569747a
--- /dev/null
+++ b/sepolicy/vendor/charge_only.te
@@ -0,0 +1,37 @@
+type charge_only, domain;
+type charge_only_exec, exec_type, vendor_file_type, file_type;
+init_daemon_domain(charge_only)
+
+allow charge_only chargeonly_data_file:dir rw_dir_perms;
+allow charge_only chargeonly_data_file:file create_file_perms;
+
+allow charge_only {
+    graphics_device
+    input_device
+}:dir r_dir_perms;
+
+allow charge_only {
+    graphics_device
+    input_device
+    kmsg_device
+}:chr_file rw_file_perms;
+
+r_dir_file(charge_only, sysfs_battery)
+r_dir_file(charge_only, sysfs_battery_writable)
+r_dir_file(charge_only, sysfs_leds)
+
+allow charge_only {
+    sysfs_backlight_writable
+    sysfs_power
+}:file rw_file_perms;
+
+allow charge_only self:netlink_kobject_uevent_socket create_socket_perms_no_ioctl;
+
+unix_socket_connect(charge_only, property, init)
+
+binder_call(charge_only, hwservicemanager)
+
+get_prop(charge_only, hwservicemanager_prop)
+set_prop(charge_only, powerctl_prop)
+
+dontaudit charge_only self:capability { dac_override net_admin };

diff --git a/sepolicy/vendor/charonservice.te b/sepolicy/vendor/charonservice.te
new file mode 100644 (file)
index 0000000..88f00b7
--- /dev/null
+++ b/sepolicy/vendor/charonservice.te
@@ -0,0 +1,3 @@
+type charonservice, domain, mlstrustedsubject;
+type charonservice_exec, exec_type, file_type, vendor_file_type;
+init_daemon_domain(charonservice)

diff --git a/sepolicy/vendor/device.te b/sepolicy/vendor/device.te
new file mode 100644 (file)
index 0000000..99ce762
--- /dev/null
+++ b/sepolicy/vendor/device.te
@@ -0,0 +1,21 @@
+type bl_block_device, dev_type;
+type bllogs_block_device, dev_type;
+type bootloader_block_device, dev_type;
+type carrier_block_device, dev_type;
+type cid_block_device, dev_type;
+type fat_block_device, dev_type;
+type gnss_device, dev_type;
+type hw_block_device, dev_type;
+type keystorage_block_device, dev_type;
+type kpan_block_device, dev_type;
+type ldfw_block_device, dev_type;
+type logo_block_device, dev_type;
+type oem_block_device, dev_type;
+type persist_block_device, dev_type;
+type proinfo_block_device, dev_type;
+type slotinfo_block_device, dev_type;
+type utags_block_device, dev_type;
+type vbmeta_block_device, dev_type;
+type vendor_block_device, dev_type;
+type vendor_nanohub_device, dev_type;
+type vendor_secmem_device, dev_type;

diff --git a/sepolicy/vendor/domain.te b/sepolicy/vendor/domain.te
new file mode 100644 (file)
index 0000000..17a123e
--- /dev/null
+++ b/sepolicy/vendor/domain.te
@@ -0,0 +1,5 @@
+allow domain {
+    debugfs_ion_dma
+    debugfs_mali
+    debugfs_mali_mem
+}:dir search;

diff --git a/sepolicy/vendor/exynos-thermald.te b/sepolicy/vendor/exynos-thermald.te
new file mode 100644 (file)
index 0000000..de389fc
--- /dev/null
+++ b/sepolicy/vendor/exynos-thermald.te
@@ -0,0 +1,18 @@
+type exynos-thermald, domain, mlstrustedsubject;
+type exynos-thermald_exec, exec_type, file_type, vendor_file_type;
+init_daemon_domain(exynos-thermald)
+
+r_dir_file(exynos-thermald, sysfs_battery)
+r_dir_file(exynos-thermald, sysfs_thermal)
+
+allow exynos-thermald {
+    sysfs_backlight_writable
+    sysfs_battery_writable
+    sysfs_cpuhotplug_writable
+    sysfs_devices_system_cpu
+    sysfs_fimc_writable
+    sysfs_mali_writable
+}:file rw_file_perms;
+
+allow exynos-thermald log_vendor_data_file:dir ra_dir_perms;
+allow exynos-thermald log_vendor_data_file:file create_file_perms;

diff --git a/sepolicy/vendor/file.te b/sepolicy/vendor/file.te
new file mode 100644 (file)
index 0000000..0db8ba5
--- /dev/null
+++ b/sepolicy/vendor/file.te
@@ -0,0 +1,44 @@
+# data types
+type camera_vendor_data_file, file_type, data_file_type;
+type chargeonly_data_file, file_type, data_file_type;
+type mediadrm_vendor_data_file, file_type, data_file_type;
+type mobicore_data_registry_file, file_type, data_file_type;
+type rild_vendor_data_file, file_type, data_file_type;
+type sensor_vendor_data_file, file_type, data_file_type;
+type thermal_vendor_data_file, file_type, data_file_type;
+
+# debug types
+type debugfs_mali, fs_type, debugfs_type;
+type debugfs_mali_mem, fs_type, debugfs_type;
+type debugfs_ion, fs_type, debugfs_type;
+type debugfs_ion_dma, fs_type, debugfs_type;
+
+# persist types
+type persist_file, file_type, vendor_persist_type;
+type persist_audio_file, file_type, vendor_persist_type;
+type persist_camera_file, file_type, vendor_persist_type;
+type persist_gk_file, file_type, vendor_persist_type;
+type persist_keymaster_file, file_type, vendor_persist_type;
+type persist_mobicore_file, file_type, vendor_persist_type;
+type persist_security_file, file_type, vendor_persist_type;
+type persist_sensor_file, file_type, vendor_persist_type;
+
+# proc types
+type proc_last_kmsg, fs_type, proc_type;
+type proc_printk, fs_type, proc_type;
+type proc_reap_mem_on_sigkill, fs_type, proc_type;
+type proc_swappiness, fs_type, proc_type;
+
+# sysfs types
+type sysfs_abox_writable, sysfs_type, rw_fs_type, fs_type;
+type sysfs_chipid, sysfs_type, r_fs_type, fs_type;
+type sysfs_cpuhotplug_writable, sysfs_type, rw_fs_type, fs_type;
+type sysfs_decon, sysfs_type, r_fs_type, fs_type;
+type sysfs_decon_writable, sysfs_type, rw_fs_type, fs_type;
+type sysfs_fimc_writable, sysfs_type, rw_fs_type, fs_type;
+type sysfs_mali_writable, sysfs_type, rw_fs_type, fs_type;
+type sysfs_nanohub, sysfs_type, r_fs_type, fs_type;
+type sysfs_rbs, fs_type, sysfs_type;
+type sysfs_scheduler, fs_type, sysfs_type;
+type sysfs_socinfo, fs_type, sysfs_type;
+type sysfs_v4l, sysfs_type, r_fs_type, fs_type;

diff --git a/sepolicy/vendor/file_contexts b/sepolicy/vendor/file_contexts
new file mode 100644 (file)
index 0000000..fc88185
--- /dev/null
+++ b/sepolicy/vendor/file_contexts
@@ -0,0 +1,112 @@
+####################################
+# Daemons
+#
+
+/(vendor|system/vendor)/bin/main_abox                                                   u:object_r:abox_exec:s0
+/(vendor|system/vendor)/bin/charge_only_mode                                            u:object_r:charge_only_exec:s0
+/(vendor|system/vendor)/bin/charon                                                      u:object_r:charonservice_exec:s0
+/(vendor|system/vendor)/bin/exynos-thermald                                             u:object_r:exynos-thermald_exec:s0
+/(vendor|system/vendor)/bin/mcDriverDaemon                                              u:object_r:tee_exec:s0
+/(vendor|system/vendor)/bin/hw/rild_exynos                                              u:object_r:rild_exec:s0
+/(vendor|system/vendor)/bin/hw/gpsd                                                     u:object_r:gpsd_exec:s0
+
+####################################
+# Data Files
+
+/data/vendor/camera(/.*)?                                                               u:object_r:camera_vendor_data_file:s0
+/data/vendor/mediadrm(/.*)?                                                             u:object_r:mediadrm_vendor_data_file:s0
+/data/vendor/sensor(/.*)?                                                               u:object_r:sensor_vendor_data_file:s0
+/data/vendor/rild(/.*)?                                                                 u:object_r:rild_vendor_data_file:s0
+/data/vendor/mcRegistry(/.*)?                                                           u:object_r:mobicore_data_registry_file:s0
+/data/nfc(/.*)?                                                                         u:object_r:nfc_data_file:s0
+/data/chargeonlymode(/.*)?                                                              u:object_r:chargeonly_data_file:s0
+
+##########################
+# Devices
+#
+
+/dev/block/(.*/)?by-name/boot(_[ab])?                                                   u:object_r:boot_block_device:s0
+/dev/block/(.*/)?by-name/bootloader(_[ab])?                                             u:object_r:bootloader_block_device:s0
+/dev/block/(.*/)?by-name/carrier                                                        u:object_r:carrier_block_device:s0
+/dev/block/(.*/)?by-name/cid                                                            u:object_r:cid_block_device:s0
+/dev/block/(.*/)?by-name/dtbo(_[ab])?                                                   u:object_r:dtbo_block_device:s0
+/dev/block/(.*/)?by-name/efsbk                                                          u:object_r:efs_block_device:s0
+/dev/block/(.*/)?by-name/efs                                                            u:object_r:efs_block_device:s0
+/dev/block/(.*/)?by-name/fat                                                            u:object_r:fat_block_device:s0
+/dev/block/(.*/)?by-name/frp                                                            u:object_r:frp_block_device:s0
+/dev/block/(.*/)?by-name/hw                                                             u:object_r:hw_block_device:s0
+/dev/block/(.*/)?by-name/keystorage(_[ab])?                                             u:object_r:keystorage_block_device:s0
+/dev/block/(.*/)?by-name/kpan                                                           u:object_r:kpan_block_device:s0
+/dev/block/(.*/)?by-name/ldfw(_[ab])?                                                   u:object_r:ldfw_block_device:s0
+/dev/block/(.*/)?by-name/logo(_[ab])?                                                   u:object_r:logo_block_device:s0
+/dev/block/(.*/)?by-name/logs                                                           u:object_r:bllogs_block_device:s0
+/dev/block/(.*/)?by-name/metadata                                                       u:object_r:metadata_block_device:s0
+/dev/block/(.*/)?by-name/misc                                                           u:object_r:misc_block_device:s0
+/dev/block/(.*/)?by-name/modem(_[ab])?                                                  u:object_r:modem_block_device:s0
+/dev/block/(.*/)?by-name/oem(_[ab])?                                                    u:object_r:oem_block_device:s0
+/dev/block/(.*/)?by-name/persist([0-9])?                                                u:object_r:persist_block_device:s0
+/dev/block/(.*/)?by-name/persist                                                        u:object_r:persist_block_device:s0
+/dev/block/(.*/)?by-name/proinfo                                                        u:object_r:proinfo_block_device:s0
+/dev/block/(.*/)?by-name/proinfo_backup                                                 u:object_r:proinfo_block_device:s0
+/dev/block/(.*/)?by-name/slotinfo                                                       u:object_r:slotinfo_block_device:s0
+/dev/block/(.*/)?by-name/sp                                                             u:object_r:bl_block_device:s0
+/dev/block/(.*/)?by-name/system(_[ab])?                                                 u:object_r:system_block_device:s0
+/dev/block/(.*/)?by-name/userdata                                                       u:object_r:userdata_block_device:s0
+/dev/block/(.*/)?by-name/utagsBackup                                                    u:object_r:utags_block_device:s0
+/dev/block/(.*/)?by-name/utags                                                          u:object_r:utags_block_device:s0
+/dev/block/(.*/)?by-name/vbmeta(_[ab])?                                                 u:object_r:vbmeta_block_device:s0
+/dev/block/(.*/)?by-name/vendor(_[ab])?                                                 u:object_r:vendor_block_device:s0
+
+/dev/block/zram0                                                                        u:object_r:swap_block_device:s0
+
+/dev/chub_dev                                                                           u:object_r:vendor_nanohub_device:s0
+
+/dev/g2d                                                                                u:object_r:graphics_device:s0
+
+/dev/gnss_ipc                                                                           u:object_r:gnss_device:s0
+
+/dev/mali[0-9]                                                                          u:object_r:gpu_device:s0
+
+/dev/nanohub                                                                            u:object_r:vendor_nanohub_device:s0
+
+/dev/s5p-smem                                                                           u:object_r:vendor_secmem_device:s0
+
+/dev/scsc_h4_0                                                                          u:object_r:bt_device:s0
+
+/dev/sec-nfc                                                                            u:object_r:nfc_device:s0
+
+/dev/ttyGS[0-3]*                                                                        u:object_r:serial_device:s0
+
+####################################
+# HIDL
+#
+
+/(vendor|system/vendor)/bin/hw/android.hardware.biometrics.fingerprint@2.1-service-rbs  u:object_r:hal_fingerprint_default_exec:s0
+/(vendor|system/vendor)/bin/hw/android.hardware.drm@1.3-service.clearkey                u:object_r:hal_drm_clearkey_exec:s0
+/(vendor|system/vendor)/bin/hw/android.hardware.drm@1.2-service.widevine                u:object_r:hal_drm_widevine_exec:s0
+/(vendor|system/vendor)/bin/hw/android.hardware.nfc@1.2-service.samsung                 u:object_r:hal_nfc_default_exec:s0
+/(vendor|system/vendor)/bin/hw/android.hardware.secure_element@1.1-service-uicc         u:object_r:hal_secure_element_default_exec:s0
+/(vendor|system/vendor)/bin/hw/android.hardware.vibrator@1.0-service.exynos9610         u:object_r:hal_vibrator_default_exec:s0
+/(vendor|system/vendor)/bin/hw/vendor.samsung.hardware.gnss@1.0-service                 u:object_r:hal_gnss_default_exec:s0
+
+####################################
+# Persist Files
+
+/mnt/vendor/persist(/.*)?                                                               u:object_r:persist_file:s0
+/mnt/vendor/persist/camera(/.*)?                                                        u:object_r:persist_camera_file:s0
+/mnt/vendor/persist/factory/audio(/.*)?                                                 u:object_r:persist_audio_file:s0
+/mnt/vendor/persist/gk(/.*)?                                                            u:object_r:persist_gk_file:s0
+/mnt/vendor/persist/mobicore(/.*)?                                                      u:object_r:persist_mobicore_file:s0
+/mnt/vendor/persist/security(/.*)?                                                      u:object_r:persist_security_file:s0
+/mnt/vendor/persist/sensor(/.*)?                                                        u:object_r:persist_sensor_file:s0
+/mnt/vendor/persist/sensortype                                                          u:object_r:persist_sensor_file:s0
+/mnt/vendor/persist/sensorcal.json                                                      u:object_r:persist_sensor_file:s0
+/mnt/vendor/persist/security/attest_keybox.so                                           u:object_r:persist_keymaster_file:s0
+/mnt/vendor/persist/wv.keys                                                             u:object_r:persist_security_file:s0
+
+####################################
+# Same-process HAL files and their dependencies
+#
+
+/(vendor|system/vendor)/lib(64)?/hw/[a-zA-Z0-9_\-.]+\.exynos[0-9]*\.so                  u:object_r:same_process_hal_file:s0
+/(vendor|system/vendor)/lib(64)?/libion_exynos.so                                       u:object_r:same_process_hal_file:s0

diff --git a/sepolicy/vendor/fsck.te b/sepolicy/vendor/fsck.te
new file mode 100644 (file)
index 0000000..195b164
--- /dev/null
+++ b/sepolicy/vendor/fsck.te
@@ -0,0 +1 @@
+allow fsck self:capability kill;

diff --git a/sepolicy/vendor/genfs_contexts b/sepolicy/vendor/genfs_contexts
new file mode 100644 (file)
index 0000000..31337d1
--- /dev/null
+++ b/sepolicy/vendor/genfs_contexts
@@ -0,0 +1,70 @@
+####################################
+# DebugFS
+#
+
+genfscon debugfs /mali/                                                                                                 u:object_r:debugfs_mali:s0
+genfscon debugfs /mali/mem/                                                                                             u:object_r:debugfs_mali_mem:s0
+genfscon debugfs /ion                                                                                                   u:object_r:debugfs_ion:s0
+genfscon debugfs /dma_buf                                                                                               u:object_r:debugfs_ion_dma:s0
+
+####################################
+# Proc
+#
+
+genfscon proc /last_kmsg                                                                                                u:object_r:proc_last_kmsg:s0
+genfscon proc /sys/kernel/printk                                                                                        u:object_r:proc_printk:s0
+genfscon proc /sys/vm/reap_mem_on_sigkill                                                                               u:object_r:proc_reap_mem_on_sigkill:s0
+genfscon proc /sys/vm/swappiness                                                                                        u:object_r:proc_swappiness:s0
+
+####################################
+# Sysfs
+#
+
+genfscon sysfs /class/power_supply/battery/charge_temp                                                                  u:object_r:sysfs_battery_writable:s0
+genfscon sysfs /devices/platform/11500000.mali/dvfs_max_lock                                                            u:object_r:sysfs_mali_writable:s0
+genfscon sysfs /devices/platform/11500000.mali/dvfs_min_lock                                                            u:object_r:sysfs_mali_writable:s0
+genfscon sysfs /devices/platform/11a10000.speedy/i2c-6/6-0000/s2mpu09-rtc/rtc/rtc0/hctosys                              u:object_r:sysfs_rtc:s0
+genfscon sysfs /devices/platform/11a10000.speedy/i2c-7/7-0000/s2mpu09-rtc/rtc/rtc0/hctosys                              u:object_r:sysfs_rtc:s0
+genfscon sysfs /devices/platform/11c30000.adc/iio:device1/11c30000.adc:battery_thermistor/hwmon/hwmon1/temp1_input      u:object_r:sysfs_thermal:s0
+genfscon sysfs /devices/platform/11c30000.adc/iio:device1/11c30000.adc:board_thermistor/hwmon/hwmon3/temp1_input        u:object_r:sysfs_thermal:s0
+genfscon sysfs /devices/platform/11c30000.adc/iio:device1/11c30000.adc:cpu_thermistor/hwmon/hwmon0/temp1_input          u:object_r:sysfs_thermal:s0
+genfscon sysfs /devices/platform/11c30000.adc/iio:device1/11c30000.adc:pa_thermistor/hwmon/hwmon2/temp1_input           u:object_r:sysfs_thermal:s0
+genfscon sysfs /devices/platform/11c30000.adc/iio:device1/11c30000.adc:usb_con_thermistor/hwmon/hwmon4/temp1_input      u:object_r:sysfs_thermal:s0
+genfscon sysfs /devices/platform/11d40000.hsi2c/i2c-1/1-005a/leds/vibrator                                              u:object_r:sysfs_vibrator:s0
+genfscon sysfs /devices/platform/12c30000.mfc0/video4linux/video6/name                                                  u:object_r:sysfs_v4l:s0
+genfscon sysfs /devices/platform/12c30000.mfc0/video4linux/video7/name                                                  u:object_r:sysfs_v4l:s0
+genfscon sysfs /devices/platform/13520000.ufs/host0/target0:0:0/0:0:0:0/block/sda/queue/scheduler                       u:object_r:sysfs_scheduler:s0
+genfscon sysfs /devices/platform/13830000.i2c/i2c-7/7-003b/power_supply                                                 u:object_r:sysfs_battery:s0
+genfscon sysfs /devices/platform/13830000.i2c/i2c-7/7-003c/power_supply                                                 u:object_r:sysfs_battery:s0
+genfscon sysfs /devices/platform/13830000.i2c/i2c-8/8-003b/power_supply                                                 u:object_r:sysfs_battery:s0
+genfscon sysfs /devices/platform/13830000.i2c/i2c-8/8-003c/power_supply                                                 u:object_r:sysfs_battery:s0
+genfscon sysfs /devices/platform/13840000.i2c/i2c-8/8-003d/leds-s2mu106/leds                                            u:object_r:sysfs_leds:s0
+genfscon sysfs /devices/platform/13840000.i2c/i2c-8/8-003d/s2mu00x-battery/power_supply                                 u:object_r:sysfs_battery:s0
+genfscon sysfs /devices/platform/13840000.i2c/i2c-8/8-003d/s2mu00x-battery/power_supply/battery/charge_control_limit    u:object_r:sysfs_battery_writable:s0
+genfscon sysfs /devices/platform/13840000.i2c/i2c-8/8-003d/s2mu00x-battery/power_supply/battery/technology              u:object_r:sysfs_battery_writable:s0
+genfscon sysfs /devices/platform/13840000.i2c/i2c-8/8-003d/s2mu00x-battery/power_supply/battery/temp                    u:object_r:sysfs_battery_writable:s0
+genfscon sysfs /devices/platform/13840000.i2c/i2c-8/8-003d/s2mu106-charger/power_supply                                 u:object_r:sysfs_battery:s0
+genfscon sysfs /devices/platform/13840000.i2c/i2c-8/8-003d/s2mu106-powermeter/power_supply/s2mu106_pmeter/type          u:object_r:sysfs_battery:s0
+genfscon sysfs /devices/platform/13840000.i2c/i2c-8/8-0041/power_supply/s2mcs02-charger/type                            u:object_r:sysfs_battery:s0
+genfscon sysfs /devices/platform/13840000.i2c/i2c-9/9-003d/leds-s2mu106/leds                                            u:object_r:sysfs_leds:s0
+genfscon sysfs /devices/platform/13840000.i2c/i2c-9/9-003d/s2mu00x-battery/factory_charge_upper                         u:object_r:sysfs_battery:s0
+genfscon sysfs /devices/platform/13840000.i2c/i2c-9/9-003d/s2mu00x-battery/power_supply                                 u:object_r:sysfs_battery:s0
+genfscon sysfs /devices/platform/13840000.i2c/i2c-9/9-003d/s2mu00x-battery/power_supply/battery/charge_control_limit    u:object_r:sysfs_battery_writable:s0
+genfscon sysfs /devices/platform/13840000.i2c/i2c-9/9-003d/s2mu00x-battery/power_supply/battery/technology              u:object_r:sysfs_battery_writable:s0
+genfscon sysfs /devices/platform/13840000.i2c/i2c-9/9-003d/s2mu00x-battery/power_supply/battery/temp                    u:object_r:sysfs_battery_writable:s0
+genfscon sysfs /devices/platform/13840000.i2c/i2c-9/9-003d/s2mu106-charger/power_supply                                 u:object_r:sysfs_battery:s0
+genfscon sysfs /devices/platform/13840000.i2c/i2c-9/9-003d/s2mu106-powermeter/power_supply/s2mu106_pmeter/type          u:object_r:sysfs_battery:s0
+genfscon sysfs /devices/platform/14490000.fimc_is/debug/fixed_sensor_fps                                                u:object_r:sysfs_fimc_writable:s0
+genfscon sysfs /devices/platform/148b0000.decon_f/psr_info                                                              u:object_r:sysfs_decon:s0
+genfscon sysfs /devices/platform/148b0000.decon_f/vsync                                                                 u:object_r:sysfs_decon_writable:s0
+genfscon sysfs /devices/platform/148e0000.dsim/panel/panel/max_brightness                                               u:object_r:sysfs_backlight_writable:s0
+genfscon sysfs /devices/platform/14a50000.abox/service                                                                  u:object_r:sysfs_abox_writable:s0
+genfscon sysfs /devices/platform/egis_input/navigation_event                                                            u:object_r:sysfs_rbs:s0
+genfscon sysfs /devices/soc0/machine                                                                                    u:object_r:sysfs_socinfo:s0
+genfscon sysfs /devices/soc0/revision                                                                                   u:object_r:sysfs_socinfo:s0
+genfscon sysfs /devices/system/chip-id/revision                                                                         u:object_r:sysfs_chipid:s0
+genfscon sysfs /devices/virtual/backlight/backlight_0/brightness                                                        u:object_r:sysfs_backlight_writable:s0
+genfscon sysfs /devices/virtual/backlight/backlight_0/max_brightness                                                    u:object_r:sysfs_backlight_writable:s0
+genfscon sysfs /devices/virtual/nanohub/nanohub/sensortype                                                              u:object_r:sysfs_nanohub:s0
+genfscon sysfs /module/scsc_bt/parameters/bluetooth_address                                                             u:object_r:sysfs_bt_writable:s0
+genfscon sysfs /power/cpuhp/set_online_cpu                                                                              u:object_r:sysfs_cpuhotplug_writable:s0

diff --git a/sepolicy/vendor/gmscore_app.te b/sepolicy/vendor/gmscore_app.te
new file mode 100644 (file)
index 0000000..d89057b
--- /dev/null
+++ b/sepolicy/vendor/gmscore_app.te
@@ -0,0 +1,2 @@
+dontaudit gmscore_app mnt_product_file:dir search;
+dontaudit gmscore_app hal_memtrack_hwservice:hwservice_manager find;

diff --git a/sepolicy/vendor/gpsd.te b/sepolicy/vendor/gpsd.te
new file mode 100644 (file)
index 0000000..150bcb7
--- /dev/null
+++ b/sepolicy/vendor/gpsd.te
@@ -0,0 +1,17 @@
+allow gpsd gnss_device:chr_file rw_file_perms;
+
+allow gpsd gps_vendor_data_file:dir create_dir_perms;
+allow gpsd gps_vendor_data_file:file create_file_perms;
+allow gpsd gps_vendor_data_file:fifo_file create_file_perms;
+
+allow gpsd self:capability net_raw;
+
+allow gpsd sysfs_socinfo:file r_file_perms;
+
+allow gpsd hal_exynos_rild_hwservice:hwservice_manager find;
+
+binder_call(gpsd, rild)
+
+get_prop(gpsd, exported3_radio_prop)
+
+wakelock_use(gpsd)

diff --git a/sepolicy/vendor/hal_audio_default.te b/sepolicy/vendor/hal_audio_default.te
new file mode 100644 (file)
index 0000000..c0ab776
--- /dev/null
+++ b/sepolicy/vendor/hal_audio_default.te
@@ -0,0 +1,12 @@
+r_dir_file(hal_audio_default, persist_audio_file)
+
+allow hal_audio_default hal_exynos_rild_hwservice:hwservice_manager find;
+
+allow hal_audio_default {
+    mnt_vendor_file
+    persist_file
+}:dir search;
+
+binder_call(hal_audio_default, rild)
+
+vndbinder_use(hal_audio_default);

diff --git a/sepolicy/vendor/hal_bootctl_default.te b/sepolicy/vendor/hal_bootctl_default.te
new file mode 100644 (file)
index 0000000..3445052
--- /dev/null
+++ b/sepolicy/vendor/hal_bootctl_default.te
@@ -0,0 +1 @@
+allow hal_bootctl_default slotinfo_block_device:blk_file rw_file_perms;

diff --git a/sepolicy/vendor/hal_camera_default.te b/sepolicy/vendor/hal_camera_default.te
new file mode 100644 (file)
index 0000000..6514673
--- /dev/null
+++ b/sepolicy/vendor/hal_camera_default.te
@@ -0,0 +1,29 @@
+allow hal_camera_default camera_vendor_data_file:dir ra_dir_perms;
+allow hal_camera_default camera_vendor_data_file:file create_file_perms;
+
+r_dir_file(hal_camera_default, persist_camera_file)
+
+allow hal_camera_default sysfs_battery:dir search;
+r_dir_file(hal_camera_default, sysfs_battery)
+allow hal_camera_default sysfs_battery_writable:file r_file_perms;
+
+allow hal_camera_default sysfs_leds:dir search;
+allow hal_camera_default sysfs_leds:file rw_file_perms;
+
+allow hal_camera_default hal_graphics_mapper_hwservice:hwservice_manager find;
+
+allow hal_camera_default {
+    mnt_vendor_file
+    persist_file
+}:dir search;
+
+binder_call(hal_camera_default, hal_graphics_composer_default)
+binder_call(hal_camera_default, system_server)
+binder_call(system_server, hal_camera_default)
+
+get_prop(hal_camera_default, exported_camera_prop)
+set_prop(hal_camera_default, vendor_camera_prop);
+
+unix_socket_connect(hal_camera_default, property, init)
+
+vndbinder_use(hal_camera_default);

diff --git a/sepolicy/vendor/hal_drm_clearkey.te b/sepolicy/vendor/hal_drm_clearkey.te
new file mode 100644 (file)
index 0000000..da9ce6c
--- /dev/null
+++ b/sepolicy/vendor/hal_drm_clearkey.te
@@ -0,0 +1,5 @@
+type hal_drm_clearkey, domain;
+hal_server_domain(hal_drm_clearkey, hal_drm);
+
+type hal_drm_clearkey_exec, exec_type, vendor_file_type, file_type;
+init_daemon_domain(hal_drm_clearkey);

diff --git a/sepolicy/vendor/hal_drm_widevine.te b/sepolicy/vendor/hal_drm_widevine.te
new file mode 100644 (file)
index 0000000..5b18bab
--- /dev/null
+++ b/sepolicy/vendor/hal_drm_widevine.te
@@ -0,0 +1,23 @@
+type hal_drm_widevine, domain;
+hal_server_domain(hal_drm_widevine, hal_drm);
+
+type hal_drm_widevine_exec, exec_type, vendor_file_type, file_type;
+init_daemon_domain(hal_drm_widevine);
+
+allow hal_drm_widevine {
+    mnt_vendor_file
+    persist_file
+    persist_security_file
+}:dir search;
+
+allow hal_drm_widevine vendor_secmem_device:chr_file rw_file_perms;
+
+allow hal_drm_widevine persist_security_file:file r_file_perms;
+
+allow hal_drm_widevine {
+    mnt_vendor_file
+    persist_security_file
+}:lnk_file r_file_perms;
+
+allow hal_drm_widevine mediadrm_vendor_data_file:dir create_dir_perms;
+allow hal_drm_widevine mediadrm_vendor_data_file:file create_file_perms;

diff --git a/sepolicy/vendor/hal_fingerprint_default.te b/sepolicy/vendor/hal_fingerprint_default.te
new file mode 100644 (file)
index 0000000..b23ba4c
--- /dev/null
+++ b/sepolicy/vendor/hal_fingerprint_default.te
@@ -0,0 +1,4 @@
+allow hal_fingerprint_default fingerprint_vendor_data_file:dir create_dir_perms;
+allow hal_fingerprint_default fingerprint_vendor_data_file:file create_file_perms;
+
+allow hal_fingerprint_default sysfs_rbs:file rw_file_perms;

diff --git a/sepolicy/vendor/hal_gatekeeper_default.te b/sepolicy/vendor/hal_gatekeeper_default.te
new file mode 100644 (file)
index 0000000..9aea4b1
--- /dev/null
+++ b/sepolicy/vendor/hal_gatekeeper_default.te
@@ -0,0 +1,10 @@
+allow hal_gatekeeper_default {
+    mnt_vendor_file
+    persist_file
+    persist_gk_file
+}:dir search;
+
+allow hal_gatekeeper_default {
+    mnt_vendor_file
+    persist_gk_file
+}:file rw_file_perms;

diff --git a/sepolicy/vendor/hal_gnss_default.te b/sepolicy/vendor/hal_gnss_default.te
new file mode 100644 (file)
index 0000000..6106c89
--- /dev/null
+++ b/sepolicy/vendor/hal_gnss_default.te
@@ -0,0 +1 @@
+allow hal_gnss_default gpsd:unix_stream_socket connectto;

diff --git a/sepolicy/vendor/hal_graphics_allocator_default.te b/sepolicy/vendor/hal_graphics_allocator_default.te
new file mode 100644 (file)
index 0000000..bbf80e3
--- /dev/null
+++ b/sepolicy/vendor/hal_graphics_allocator_default.te
@@ -0,0 +1 @@
+get_prop(hal_graphics_allocator_default, vendor_hwc_prop)

diff --git a/sepolicy/vendor/hal_graphics_composer_default.te b/sepolicy/vendor/hal_graphics_composer_default.te
new file mode 100644 (file)
index 0000000..4a37693
--- /dev/null
+++ b/sepolicy/vendor/hal_graphics_composer_default.te
@@ -0,0 +1,17 @@
+hal_client_domain(hal_graphics_composer_default, hal_graphics_allocator);
+
+allow hal_graphics_composer_default log_vendor_data_file:dir { rw_file_perms add_name search };
+allow hal_graphics_composer_default log_vendor_data_file:file create_file_perms;
+
+allow hal_graphics_composer_default sysfs_chipid:file r_file_perms;
+allow hal_graphics_composer_default sysfs_decon:file r_file_perms;
+allow hal_graphics_composer_default sysfs_decon_writable:file rw_file_perms;
+
+allow hal_graphics_composer_default self:netlink_kobject_uevent_socket { bind create read setopt };
+
+allow hal_graphics_composer_default vendor_surfaceflinger_vndservice:service_manager { add find };
+
+get_prop(hal_graphics_composer_default, vendor_camera_prop)
+get_prop(hal_graphics_composer_default, vendor_hwc_prop)
+
+vndbinder_use(hal_graphics_composer_default);

diff --git a/sepolicy/vendor/hal_health_default.te b/sepolicy/vendor/hal_health_default.te
new file mode 100644 (file)
index 0000000..bede485
--- /dev/null
+++ b/sepolicy/vendor/hal_health_default.te
@@ -0,0 +1,2 @@
+r_dir_file(hal_health_default, sysfs_battery);
+r_dir_file(hal_health_default, sysfs_battery_writable);

diff --git a/sepolicy/vendor/hal_keymaster_default.te b/sepolicy/vendor/hal_keymaster_default.te
new file mode 100644 (file)
index 0000000..640c0a0
--- /dev/null
+++ b/sepolicy/vendor/hal_keymaster_default.te
@@ -0,0 +1,10 @@
+allow hal_keymaster_default {
+    mnt_vendor_file
+    persist_file
+    persist_security_file
+}:dir search;
+
+allow hal_keymaster_default {
+    persist_keymaster_file
+    persist_security_file
+}:file r_file_perms;

diff --git a/sepolicy/vendor/hal_memtrack_default.te b/sepolicy/vendor/hal_memtrack_default.te
new file mode 100644 (file)
index 0000000..a355a6e
--- /dev/null
+++ b/sepolicy/vendor/hal_memtrack_default.te
@@ -0,0 +1,4 @@
+r_dir_file(hal_memtrack_default, debugfs_mali);
+r_dir_file(hal_memtrack_default, debugfs_mali_mem);
+r_dir_file(hal_memtrack_default, debugfs_ion);
+r_dir_file(hal_memtrack_default, debugfs_ion_dma);

diff --git a/sepolicy/vendor/hal_power_default.te b/sepolicy/vendor/hal_power_default.te
new file mode 100644 (file)
index 0000000..797e092
--- /dev/null
+++ b/sepolicy/vendor/hal_power_default.te
@@ -0,0 +1 @@
+allow hal_power_default sysfs_mali_writable:file rw_file_perms;

diff --git a/sepolicy/vendor/hal_secure_element_default.te b/sepolicy/vendor/hal_secure_element_default.te
new file mode 100644 (file)
index 0000000..9eadb10
--- /dev/null
+++ b/sepolicy/vendor/hal_secure_element_default.te
@@ -0,0 +1,5 @@
+allow hal_secure_element_default hal_exynos_rild_hwservice:hwservice_manager find;
+
+binder_call(hal_secure_element_default, rild)
+
+get_prop(hal_secure_element_default, exported3_radio_prop)

diff --git a/sepolicy/vendor/hal_sensors_default.te b/sepolicy/vendor/hal_sensors_default.te
new file mode 100644 (file)
index 0000000..ee7766b
--- /dev/null
+++ b/sepolicy/vendor/hal_sensors_default.te
@@ -0,0 +1,24 @@
+allow hal_sensors_default vendor_nanohub_device:chr_file rw_file_perms;
+
+allow hal_sensors_default persist_sensor_file:file r_file_perms;
+
+allow hal_sensors_default sensor_vendor_data_file:dir create_dir_perms;
+allow hal_sensors_default sensor_vendor_data_file:file create_file_perms;
+
+allow hal_sensors_default {
+    mnt_vendor_file
+    persist_file
+    persist_sensor_file
+}:dir search;
+
+allow hal_sensors_default {
+    sysfs_input
+    sysfs_nanohub
+}:file r_file_perms;
+
+allow hal_sensors_default mnt_vendor_file:file rw_file_perms;
+
+hal_client_domain(hal_sensors_default, hal_power)
+
+allow hal_sensors_default hal_power_hwservice:hwservice_manager find;
+binder_call(hal_sensors_default, hal_power_default)

diff --git a/sepolicy/vendor/hal_vibrator_default.te b/sepolicy/vendor/hal_vibrator_default.te
new file mode 100644 (file)
index 0000000..5352e19
--- /dev/null
+++ b/sepolicy/vendor/hal_vibrator_default.te
@@ -0,0 +1 @@
+r_dir_file(hal_vibrator_default, sysfs_leds)

diff --git a/sepolicy/vendor/hal_wifi_default.te b/sepolicy/vendor/hal_wifi_default.te
new file mode 100644 (file)
index 0000000..de58eb6
--- /dev/null
+++ b/sepolicy/vendor/hal_wifi_default.te
@@ -0,0 +1,4 @@
+allow hal_wifi_default wifi_vendor_data_file:dir r_dir_perms;
+allow hal_wifi_default wifi_vendor_data_file:file create_file_perms;
+
+set_prop(hal_wifi_default, vendor_wifi_prop)

diff --git a/sepolicy/vendor/hwservice.te b/sepolicy/vendor/hwservice.te
new file mode 100644 (file)
index 0000000..a9b21f5
--- /dev/null
+++ b/sepolicy/vendor/hwservice.te
@@ -0,0 +1 @@
+type hal_exynos_rild_hwservice, hwservice_manager_type;

diff --git a/sepolicy/vendor/hwservice_contexts b/sepolicy/vendor/hwservice_contexts
new file mode 100644 (file)
index 0000000..db80bae
--- /dev/null
+++ b/sepolicy/vendor/hwservice_contexts
@@ -0,0 +1,5 @@
+vendor.egistec.hardware.fingerprint::IBiometricsFingerprintRbs                  u:object_r:hal_fingerprint_hwservice:s0
+vendor.samsung.hardware.gnss::ISlsiGnss                                         u:object_r:hal_gnss_hwservice:s0
+vendor.samsung_slsi.hardware.radio::IOemSamsungslsi                             u:object_r:hal_telephony_hwservice:s0
+vendor.samsung_slsi.telephony.hardware.radio::IOemSamsungslsi                   u:object_r:hal_exynos_rild_hwservice:s0
+vendor.samsung_slsi.telephony.hardware.radioExternal::IOemSlsiRadioExternal     u:object_r:hal_exynos_rild_hwservice:s0

diff --git a/sepolicy/vendor/init.te b/sepolicy/vendor/init.te
new file mode 100644 (file)
index 0000000..1cf66b4
--- /dev/null
+++ b/sepolicy/vendor/init.te
@@ -0,0 +1,18 @@
+allow init {
+    boot_block_device
+    dtbo_block_device
+    vbmeta_block_device
+    vendor_block_device
+}:lnk_file relabelto;
+
+allow init {
+    efs_file
+    persist_file
+    mnt_product_file
+    mnt_vendor_file
+}:dir mounton;
+
+allow init proc_last_kmsg:file create_file_perms;
+allow init proc_printk:file w_file_perms;
+
+allow init sysfs_scheduler:file create_file_perms;

diff --git a/sepolicy/vendor/kernel.te b/sepolicy/vendor/kernel.te
new file mode 100644 (file)
index 0000000..badcddb
--- /dev/null
+++ b/sepolicy/vendor/kernel.te
@@ -0,0 +1,5 @@
+allow kernel self:capability mknod;
+
+# macros would grant too many perms which run into neverallows
+allow kernel device:chr_file { create getattr setattr unlink };
+allow kernel device:dir { add_name remove_name rmdir write };

diff --git a/sepolicy/vendor/mediacodec.te b/sepolicy/vendor/mediacodec.te
new file mode 100644 (file)
index 0000000..edd7c98
--- /dev/null
+++ b/sepolicy/vendor/mediacodec.te
@@ -0,0 +1,2 @@
+hal_client_domain(mediacodec, hal_power);
+r_dir_file(mediacodec, sysfs_v4l);

diff --git a/sepolicy/vendor/proc_net.te b/sepolicy/vendor/proc_net.te
new file mode 100644 (file)
index 0000000..0f22770
--- /dev/null
+++ b/sepolicy/vendor/proc_net.te
@@ -0,0 +1 @@
+allow proc_net proc:filesystem associate;

diff --git a/sepolicy/vendor/property.te b/sepolicy/vendor/property.te
new file mode 100644 (file)
index 0000000..2bbecb5
--- /dev/null
+++ b/sepolicy/vendor/property.te
@@ -0,0 +1,6 @@
+type vendor_audio_prop, property_type;
+type vendor_camera_prop, property_type;
+type vendor_hwc_prop, property_type;
+type moto_boot_prop, property_type;
+type rmnet_mux_prop, property_type;
+type vendor_wifi_prop, property_type;

diff --git a/sepolicy/vendor/property_contexts b/sepolicy/vendor/property_contexts
new file mode 100644 (file)
index 0000000..29876b8
--- /dev/null
+++ b/sepolicy/vendor/property_contexts
@@ -0,0 +1,30 @@
+# Audio
+vendor.audio_hal.                   u:object_r:vendor_audio_prop:s0
+
+# Boot
+ro.boot.carrier                     u:object_r:moto_boot_prop:s0
+
+# Camera
+persist.vendor.sys.camera.          u:object_r:vendor_camera_prop:s0
+
+# HWC
+ro.vendor.ddk.set.afbc              u:object_r:vendor_hwc_prop:s0
+
+# Radio
+persist.vendor.radio.cp.            u:object_r:vendor_radio_prop:s0
+persist.vendor.ril.                 u:object_r:vendor_radio_prop:s0
+ro.product.model.dm                 u:object_r:vendor_radio_prop:s0
+ro.radio.imei.sv                    u:object_r:vendor_radio_prop:s0
+vendor.radio.ril.                   u:object_r:vendor_radio_prop:s0
+vendor.radio.cp.                    u:object_r:vendor_radio_prop:s0
+vendor.ril.                         u:object_r:vendor_radio_prop:s0
+
+# Rmnet
+persist.rmnet.mux                   u:object_r:rmnet_mux_prop:s0
+persist.rmnet.data.enable           u:object_r:vendor_default_prop:s0
+
+# Wlan
+vendor.wlan.                        u:object_r:vendor_wifi_prop:s0
+
+persist.data.wda.enable             u:object_r:vendor_default_prop:s0
+persist.data.df.                    u:object_r:vendor_default_prop:s0

diff --git a/sepolicy/vendor/radio.te b/sepolicy/vendor/radio.te
new file mode 100644 (file)
index 0000000..8984885
--- /dev/null
+++ b/sepolicy/vendor/radio.te
@@ -0,0 +1 @@
+binder_call(radio, gpuservice)

diff --git a/sepolicy/vendor/rild.te b/sepolicy/vendor/rild.te
new file mode 100644 (file)
index 0000000..913ee30
--- /dev/null
+++ b/sepolicy/vendor/rild.te
@@ -0,0 +1,11 @@
+allow rild rild_vendor_data_file:dir create_dir_perms;
+allow rild rild_vendor_data_file:file create_file_perms;
+
+add_hwservice(rild, hal_exynos_rild_hwservice)
+
+binder_call(rild, gpsd)
+binder_call(rild, hal_audio_default)
+binder_call(rild, hal_secure_element_default)
+
+get_prop(rild, system_boot_reason_prop)
+set_prop(rild, vendor_radio_prop)

diff --git a/sepolicy/vendor/system_app.te.te b/sepolicy/vendor/system_app.te.te
new file mode 100644 (file)
index 0000000..cb91c96
--- /dev/null
+++ b/sepolicy/vendor/system_app.te.te
@@ -0,0 +1,11 @@
+r_dir_file(system_app, proc_pagetypeinfo)
+r_dir_file(system_app, proc_vmallocinfo)
+
+allow system_app sysfs_zram:dir search;
+
+allow system_app sysfs_zram:file rw_file_perms;
+
+dontaudit system_app system_suspend_control_service:service_manager find;
+
+binder_call(system_app, update_engine)
+binder_call(system_app, wificond)

diff --git a/sepolicy/vendor/system_server.te b/sepolicy/vendor/system_server.te
new file mode 100644 (file)
index 0000000..35a67c0
--- /dev/null
+++ b/sepolicy/vendor/system_server.te
@@ -0,0 +1,3 @@
+allow system_server proc_last_kmsg:file r_file_perms;
+
+get_prop(system_server, vendor_security_patch_level_prop)

diff --git a/sepolicy/vendor/tee.te b/sepolicy/vendor/tee.te
new file mode 100644 (file)
index 0000000..ef9c708
--- /dev/null
+++ b/sepolicy/vendor/tee.te
@@ -0,0 +1,14 @@
+allow tee log_vendor_data_file:dir search;
+
+allow tee {
+    mnt_vendor_file
+    persist_file
+}:dir search;
+
+r_dir_file(tee, persist_mobicore_file)
+
+allow tee mobicore_data_registry_file:dir create_dir_perms;
+allow tee mobicore_data_registry_file:file create_file_perms;
+
+allow tee log_vendor_data_file:file create_file_perms;
+allow tee log_vendor_data_file:dir rw_dir_perms;

diff --git a/sepolicy/vendor/toolbox.te b/sepolicy/vendor/toolbox.te
new file mode 100644 (file)
index 0000000..64f5780
--- /dev/null
+++ b/sepolicy/vendor/toolbox.te
@@ -0,0 +1 @@
+allow toolbox self:capability kill;

diff --git a/sepolicy/vendor/ueventd.te b/sepolicy/vendor/ueventd.te
new file mode 100644 (file)
index 0000000..985c8ec
--- /dev/null
+++ b/sepolicy/vendor/ueventd.te
@@ -0,0 +1 @@
+allow ueventd metadata_file:dir search;

diff --git a/sepolicy/vendor/update_engine.te b/sepolicy/vendor/update_engine.te
new file mode 100644 (file)
index 0000000..a05c9d7
--- /dev/null
+++ b/sepolicy/vendor/update_engine.te
@@ -0,0 +1,10 @@
+# /dev/blkio/background/tasks
+dontaudit update_engine device:file rw_file_perms;
+
+allow update_engine {
+    dtbo_block_device
+    vbmeta_block_device
+    vendor_block_device
+}:blk_file rw_file_perms;
+
+allow update_engine proc_filesystems:file r_file_perms;

diff --git a/sepolicy/vendor/vdc.te b/sepolicy/vendor/vdc.te
new file mode 100644 (file)
index 0000000..5919006
--- /dev/null
+++ b/sepolicy/vendor/vdc.te
@@ -0,0 +1 @@
+allow vdc vdc:capability kill;

diff --git a/sepolicy/vendor/vendor_init.te b/sepolicy/vendor/vendor_init.te
new file mode 100644 (file)
index 0000000..c149e82
--- /dev/null
+++ b/sepolicy/vendor/vendor_init.te
@@ -0,0 +1,24 @@
+allow vendor_init {
+    debugfs_trace_marker
+    functionfs
+}:file r_file_perms;
+
+allow vendor_init {
+    proc_printk
+    proc_reap_mem_on_sigkill
+    proc_swappiness
+}:file rw_file_perms;
+
+allow vendor_init block_device:lnk_file relabelfrom;
+allow vendor_init proinfo_block_device:lnk_file relabelto;
+
+# symlink /storage/sdcard /mnt/ext_sd
+allow vendor_init tmpfs:dir ra_dir_perms;
+allow vendor_init tmpfs:lnk_file create_file_perms;
+
+allow vendor_init system_data_root_file:dir { relabelto setattr };
+
+allow vendor_init unlabeled:{ dir file } { read getattr relabelfrom };
+
+set_prop(vendor_init, moto_boot_prop)
+set_prop(vendor_init, rmnet_mux_prop)

diff --git a/sepolicy/vendor/vold.te b/sepolicy/vendor/vold.te
new file mode 100644 (file)
index 0000000..5333275
--- /dev/null
+++ b/sepolicy/vendor/vold.te
@@ -0,0 +1,5 @@
+allow vold {
+    efs_file
+    mnt_product_file
+    mnt_vendor_file
+}:dir r_dir_perms;