exynos9610: sepolicy: Update for RSB31.Q1-48-36-11

Change-Id: I6ca1ee2012e68d66e09c7aec8dd38eef1e8c0fb6

diff --git a/sepolicy/private/device.te b/sepolicy/private/device.te
index c7ec66b6c5e389291ad2c7b2891200092ef71efc..ac5597dd6774cbf24cbe976b1a42327850d01a51 100644 (file)
--- a/sepolicy/private/device.te
+++ b/sepolicy/private/device.te
@@ -1,2 +1 @@
 type fm_device, dev_type;
-type pktrouter_device, dev_type;

diff --git a/sepolicy/private/file_contexts b/sepolicy/private/file_contexts
index 220196d4c3446819133f4874a1212816e4917b51..ecbfdf082fedbcdb486ac75cdc4c81b081e8953a 100644 (file)
--- a/sepolicy/private/file_contexts
+++ b/sepolicy/private/file_contexts
@@ -3,12 +3,9 @@
 #
 
 /system/bin/clean_scratch_files     u:object_r:clean_scratch_files_exec:s0
-/system/bin/wfc-pkt-router          u:object_r:netutils_wrapper_exec:s0
 
 ##########################
 # Devices
 #
 
 /dev/radio0                         u:object_r:fm_device:s0
-/dev/umts_wfc0                      u:object_r:pktrouter_device:s0
-/dev/umts_wfc1                      u:object_r:pktrouter_device:s0

diff --git a/sepolicy/private/netutils_wrapper.te b/sepolicy/private/netutils_wrapper.te
deleted file mode 100644 (file)
index ca3a4e6..0000000
--- a/sepolicy/private/netutils_wrapper.te
+++ /dev/null
@@ -1,9 +0,0 @@
-init_daemon_domain(netutils_wrapper)
-allow netutils_wrapper pktrouter_device:chr_file rw_file_perms;
-
-allow netutils_wrapper self:packet_socket create_socket_perms_no_ioctl;
-allow netutils_wrapper node:rawip_socket node_bind;
-allow netutils_wrapper port:udp_socket name_bind;
-allow netutils_wrapper node:udp_socket node_bind;
-
-dontaudit netutils_wrapper self:capability dac_override;

diff --git a/sepolicy/vendor/device.te b/sepolicy/vendor/device.te
index e7834519b76a5b0b6d2fecde1448c0e52b51525a..f759c7d154553d6700092e51adec47d1e047c657 100644 (file)
--- a/sepolicy/vendor/device.te
+++ b/sepolicy/vendor/device.te
@@ -13,6 +13,7 @@ type logo_block_device, dev_type;
 type m2m1shot_device, dev_type;
 type oem_block_device, dev_type;
 type persist_block_device, dev_type;
+type pktrouter_device, dev_type;
 type proinfo_block_device, dev_type;
 type slotinfo_block_device, dev_type;
 type utags_block_device, dev_type;

diff --git a/sepolicy/vendor/file_contexts b/sepolicy/vendor/file_contexts
index 1f2d176646fd907678f4136c75966f6b0be33e59..41cf075bd919b1625775b0aa6f94cb730caf3fc9 100644 (file)
--- a/sepolicy/vendor/file_contexts
+++ b/sepolicy/vendor/file_contexts
@@ -7,6 +7,7 @@
 /(vendor|system/vendor)/bin/charon                                                      u:object_r:charonservice_exec:s0
 /(vendor|system/vendor)/bin/exynos-thermald                                             u:object_r:exynos-thermald_exec:s0
 /(vendor|system/vendor)/bin/mcDriverDaemon                                              u:object_r:tee_exec:s0
+/(vendor|system/vendor)/bin/wfc-pkt-router                                              u:object_r:pktrouter_exec:s0
 /(vendor|system/vendor)/bin/hw/rild_exynos                                              u:object_r:rild_exec:s0
 /(vendor|system/vendor)/bin/hw/gpsd                                                     u:object_r:gpsd_exec:s0
 
@@ -80,6 +81,9 @@
 
 /dev/ttyGS[0-3]*                                                                        u:object_r:serial_device:s0
 
+/dev/umts_wfc0                                                                          u:object_r:pktrouter_device:s0
+/dev/umts_wfc1                                                                          u:object_r:pktrouter_device:s0
+
 ####################################
 # HIDL
 #
@@ -87,9 +91,11 @@
 /(vendor|system/vendor)/bin/hw/android.hardware.biometrics.fingerprint@2.1-service-rbs  u:object_r:hal_fingerprint_default_exec:s0
 /(vendor|system/vendor)/bin/hw/android.hardware.drm@1.3-service.clearkey                u:object_r:hal_drm_clearkey_exec:s0
 /(vendor|system/vendor)/bin/hw/android.hardware.drm@1.2-service.widevine                u:object_r:hal_drm_widevine_exec:s0
+/(vendor|system/vendor)/bin/hw/android.hardware.drm@1.3-service.widevine                u:object_r:hal_drm_widevine_exec:s0
 /(vendor|system/vendor)/bin/hw/android.hardware.nfc@1.2-service.samsung                 u:object_r:hal_nfc_default_exec:s0
-/(vendor|system/vendor)/bin/hw/android.hardware.secure_element@1.1-service-uicc         u:object_r:hal_secure_element_default_exec:s0
+/(vendor|system/vendor)/bin/hw/android.hardware.secure_element@1.2-uicc-service         u:object_r:hal_secure_element_default_exec:s0
 /(vendor|system/vendor)/bin/hw/android.hardware.vibrator@1.0-service.exynos9610         u:object_r:hal_vibrator_default_exec:s0
+/(vendor|system/vendor)/bin/hw/samsung.hardware.media.c2@1.1-default-service            u:object_r:mediacodec_exec:s0
 /(vendor|system/vendor)/bin/hw/vendor.lineage.livedisplay@2.0-service.exynos9610        u:object_r:hal_lineage_livedisplay_exynos_exec:s0
 /(vendor|system/vendor)/bin/hw/vendor.samsung.hardware.gnss@1.0-service                 u:object_r:hal_gnss_default_exec:s0
 

diff --git a/sepolicy/vendor/pktrouter.te b/sepolicy/vendor/pktrouter.te
new file mode 100644 (file)
index 0000000..92353d9
--- /dev/null
+++ b/sepolicy/vendor/pktrouter.te
@@ -0,0 +1,15 @@
+type pktrouter, domain, mlstrustedsubject;
+type pktrouter_exec, exec_type, file_type, vendor_file_type;
+init_daemon_domain(pktrouter)
+
+allow pktrouter pktrouter_device:chr_file rw_file_perms;
+
+allow pktrouter self:packet_socket create_socket_perms_no_ioctl;
+allow pktrouter node:rawip_socket node_bind;
+allow pktrouter port:udp_socket name_bind;
+allow pktrouter node:udp_socket node_bind;
+allow pktrouter self:netlink_route_socket { create bind write nlmsg_write read };
+
+allowxperm pktrouter self:udp_socket ioctl SIOCGIFNAME;
+allow pktrouter self:capability net_raw;
+allow pktrouter self:udp_socket create_socket_perms;

diff --git a/sepolicy/vendor/property_contexts b/sepolicy/vendor/property_contexts
index 27b0f1146e462759c9dc2f7b3c9bdc8dc85b1002..23e5d8edba2da555e6d3006af19afd4c39dd73d3 100644 (file)
--- a/sepolicy/vendor/property_contexts
+++ b/sepolicy/vendor/property_contexts
@@ -11,6 +11,7 @@ persist.vendor.sys.camera.          u:object_r:vendor_camera_prop:s0
 vendor.charon                       u:object_r:vendor_ims_prop:s0
 vendor.charon.route                 u:object_r:vendor_ims_prop:s0
 custom.charon.status                u:object_r:vendor_ims_prop:s0
+vendor.pktrouter                    u:object_r:vendor_ims_prop:s0
 
 # HWC
 ro.vendor.ddk.set.afbc              u:object_r:vendor_hwc_prop:s0

diff --git a/sepolicy/vendor/radio.te b/sepolicy/vendor/radio.te
index 8984885b76c84f5779830e63fb5d6ce3a8acf82d..8ea8f4014fb994f47f3de0d0df849d56120aed6a 100644 (file)
--- a/sepolicy/vendor/radio.te
+++ b/sepolicy/vendor/radio.te
@@ -1 +1,3 @@
 binder_call(radio, gpuservice)
+
+allow radio hal_exynos_rild_hwservice:hwservice_manager find;