Address more denials from when running as enforcing

Mostly working now.
These denials are left to fix:
```
kworker/u16:1: type=1400 audit(0.0:85): avc: denied { dac_override } for capability=1 scontext=u:r:kernel:s0 tcontext=u:r:kernel:s0 tclass=capability permissive=0
kworker/u16:1: type=1400 audit(0.0:86): avc: denied { dac_read_search } for capability=2 scontext=u:r:kernel:s0 tcontext=u:r:kernel:s0 tclass=capability permissive=0
type=1400 audit(1598966762.983:15): avc: denied { dac_override } for comm="e2fsck" capability=1 scontext=u:r:fsck:s0 tcontext=u:r:fsck:s0 tclass=capability permissive=0
type=1400 audit(1598966762.983:15): avc: denied { dac_read_search } for comm="e2fsck" capability=2 scontext=u:r:fsck:s0 tcontext=u:r:fsck:s0 tclass=capability permissive=0
```

diff --git a/sepolicy/hal_audio_default.te b/sepolicy/hal_audio_default.te
index ae8115a54c7511347588af49ac4f2901e404a535..5e488231023ec8f52411ed609883566d6b3fa733 100644 (file)
--- a/sepolicy/hal_audio_default.te
+++ b/sepolicy/hal_audio_default.te
@@ -4,7 +4,10 @@ allow hal_audio_default system_suspend_hwservice:hwservice_manager find;
 
 # /efs/maxim/rdc_cal
 allow hal_audio_default efs_file:file { read open };
+allow hal_audio_default efs_file:dir search;
 
 allow hal_audio_default imei_efs_file:dir search;
 allow hal_audio_default imei_efs_file:file { getattr open read };
 allow hal_audio_default vendor_radio_prop:file { getattr open read };
+
+allow hal_audio_default init:unix_stream_socket connectto;

diff --git a/sepolicy/hal_camera_default.te b/sepolicy/hal_camera_default.te
index 1dc628ba14f9973962addbf6634aafe2cc6d4964..d88db486e317300e4620af436f1b7be1401985b1 100644 (file)
--- a/sepolicy/hal_camera_default.te
+++ b/sepolicy/hal_camera_default.te
@@ -8,6 +8,7 @@ allow hal_camera_default sysfs_virtual:file { getattr open read write };
 allow hal_camera_default sysfs_camera:dir search;
 allow hal_camera_default sysfs_camera:file { getattr open read write };
 allow hal_camera_default exported_camera_prop:file { getattr open read };
+allow hal_camera_default camera_data_file:dir search;
 
 # add_hwservice(hal_camera_default, hal_vendor_multiframeprocessing_hwservice)
 # add_hwservice(hal_camera_default, hal_vendor_iva_hwservice)

diff --git a/sepolicy/hal_nfc_default.te b/sepolicy/hal_nfc_default.te
index eae98c1ab2c87cb6ac9aca266d350374a2ffc137..a0fd6abd87f285840dfbf63e79f516f4a2811747 100644 (file)
--- a/sepolicy/hal_nfc_default.te
+++ b/sepolicy/hal_nfc_default.te
@@ -4,5 +4,7 @@ init_daemon_domain(hal_nfc_default)
 # /system/etc/event-log-tags
 allow nfc runtime_event_log_tags_file:file getattr;
 
+allow hal_nfc_default hal_nfc_hwservice:hwservice_manager add;
+
 # vendor.nfc.fw.
 set_prop(hal_nfc_default, vendor_nfc_prop)

diff --git a/sepolicy/hwservice_contexts b/sepolicy/hwservice_contexts
index 3002bc361a36a5908667d4bcf094ee345d9988ee..9f2c841e07f0fe24a7dc25948403f051589ca4b9 100644 (file)
--- a/sepolicy/hwservice_contexts
+++ b/sepolicy/hwservice_contexts
@@ -4,6 +4,7 @@ vendor.samsung.hardware.radio.channel::ISehChannel          u:object_r:hal_sec_r
 
 vendor.samsung.hardware.camera.provider::ISehCameraProvider u:object_r:hal_camera_hwservice:s0
 vendor.samsung.hardware.gnss::ISecGnss                      u:object_r:hal_gnss_hwservice:s0
+vendor.samsung.hardware.nfc::ISecNfc                        u:object_r:hal_nfc_hwservice:s0
 vendor.samsung_slsi.hardware.MultiFrameProcessing20::IMultiFrameProcessing20 u:object_r:hal_vendor_multiframeprocessing_hwservice:s0
 vendor.samsung_slsi.hardware.eden_runtime::IEdenruntime     u:object_r:hal_vendor_eden_runtime_hwservice:s0
 vendor.samsung_slsi.hardware.iva::IIvaService               u:object_r:hal_vendor_iva_hwservice:s0

diff --git a/sepolicy/kernel.te b/sepolicy/kernel.te
index 2a282903a80f2f671dd229c6e72ae72e5d2739a6..61182edcb9c754714dafa30c372186fb913cc3e6 100644 (file)
--- a/sepolicy/kernel.te
+++ b/sepolicy/kernel.te
@@ -1,7 +1,8 @@
 allow kernel app_efs_file:dir search;
 allow kernel app_efs_file:file open;
 allow kernel sensor_factoryapp_efs_file:file open;
+allow kernel efs_file:dir search;
 
 allow kernel device:chr_file { getattr setattr unlink create };
 allow kernel device:dir { add_name remove_name rmdir write };
-allow kernel self:capability mknod;
+allow kernel self:capability { mknod };

diff --git a/sepolicy/lhd.te b/sepolicy/lhd.te
index 6d25f4b409a3b5b2d753f87c84a5eb1b193ce011..d6594b058757a5224a4a4c015b7c81e95c848a6f 100644 (file)
--- a/sepolicy/lhd.te
+++ b/sepolicy/lhd.te
@@ -1,3 +1,4 @@
 allow lhd sysfs_virtual:dir search;
 allow lhd sysfs_virtual:file { open read write };
 allow lhd sysfs_virtual:lnk_file read;
+allow lhd efs_file:dir search;

diff --git a/sepolicy/rild.te b/sepolicy/rild.te
index 7fac42b29bafed0457e41a8df8e97e8467402036..e5fde141344cb1d326d732e3af336b5ecf0438d8 100644 (file)
--- a/sepolicy/rild.te
+++ b/sepolicy/rild.te
@@ -9,6 +9,7 @@ allow rild bin_nv_data_efs_file:file { setattr getattr read open write };
 allow rild radio_vendor_data_file:file { create ioctl lock getattr read write open unlink };
 allow rild radio_vendor_data_file:dir { add_name write open read remove_name };
 allow rild radio_data_file:file { open read getattr write };
+allow rild radio_data_file:dir search;
 
 allow rild proc_qtaguid_stat:file read;
 

diff --git a/sepolicy/tee.te b/sepolicy/tee.te
index b355c77ce4ab5956836d346e830b1cffddf8751a..d56f72c34e5bea9faa2edc891c90578641032d7b 100644 (file)
--- a/sepolicy/tee.te
+++ b/sepolicy/tee.te
@@ -1,6 +1,6 @@
-allow tee efs_file:dir getattr;
+allow tee efs_file:dir { search getattr };
 allow tee efs_file:file { getattr open read };
-allow tee gatekeeper_efs_file:dir { open read };
+allow tee gatekeeper_efs_file:dir { search open read };
 allow tee gatekeeper_efs_file:file { getattr open read };
 allow tee init:unix_stream_socket connectto;
 allow tee property_socket:sock_file write;
@@ -11,5 +11,5 @@ allow tee tee_prop:property_service set;
 # /dev/t-base-tui
 allow tee tee_device:chr_file { ioctl open read };
 
-allow tee mobicore_vendor_data_file:dir { open read };
-allow tee mobicore_vendor_data_file:file { getattr open read };
+allow tee mobicore_vendor_data_file:dir { search open read };
+allow tee mobicore_vendor_data_file:file rw_file_perms;

diff --git a/sepolicy/untrusted_app.te b/sepolicy/untrusted_app.te
index 71b786b28e566dc0a2c575862f961fbecfa4a040..c9f2fb784e3404109bd43c38332814413a551438 100644 (file)
--- a/sepolicy/untrusted_app.te
+++ b/sepolicy/untrusted_app.te
@@ -1,2 +1,4 @@
 # /dev/mali0
 allow untrusted_app gpu_device:chr_file { ioctl open read write };
+
+allow untrusted_app debugfs_mali:dir read;