universal7580: sepolicy: cleanup

Change-Id: I181e502745f1837de864d7f4369e867fef9b0176

diff --git a/sepolicy/audioserver.te b/sepolicy/audioserver.te
index 197a74e74e61515fb1f3dc81b32263240b82fc63..cbee9249bd3c9021763b50a24cf269c191b6d83f 100644 (file)
--- a/sepolicy/audioserver.te
+++ b/sepolicy/audioserver.te
@@ -2,8 +2,8 @@
 unix_socket_connect(audioserver, property, rild)
 
 # /efs/maxim
-allow audioserver { efs_file sec_efs_file }:dir r_dir_perms;
-allow audioserver { efs_file sec_efs_file }:file r_file_perms;
+r_dir_file(audioserver, efs_file);
+r_dir_file(audioserver, sec_efs_file);
 
 # TFA98xx amplifier
 allow audioserver amplifier_device:chr_file rw_file_perms;

diff --git a/sepolicy/bluetooth.te b/sepolicy/bluetooth.te
index 6aaa8ab24e3bc208baf20e0583456b82d6f9c56a..4a80b404309cbb18edd852f834df0b82c0bfb92a 100644 (file)
--- a/sepolicy/bluetooth.te
+++ b/sepolicy/bluetooth.te
@@ -1,10 +1,6 @@
 # /dev/ttySAC3
-allow bluetooth bluetooth_device:chr_file { rw_file_perms ioctl };
-allow hal_bluetooth_default bluetooth_device:chr_file { ioctl open read write };
+allow bluetooth bluetooth_device:chr_file rw_file_perms ;
+allow hal_bluetooth_default bluetooth_device:chr_file rw_file_perms;
 
 # /data/.cid.info
 allow bluetooth wifi_data_file:file r_file_perms;
-
-# /efs
-allow hal_bluetooth_default efs_file:dir { search };
-r_dir_file(hal_bluetooth_default, bluetooth_efs_file)
\ No newline at end of file

diff --git a/sepolicy/cameraserver.te b/sepolicy/cameraserver.te
index 0ac2ce0eb194305596c8b7013944010471526765..85e7a11047bcc5165b7657ee0a203850e9140f43 100644 (file)
--- a/sepolicy/cameraserver.te
+++ b/sepolicy/cameraserver.te
@@ -2,14 +2,11 @@
 allow cameraserver camera_device:chr_file rw_file_perms;
 
 # /sys/devices/virtual/camera/*/*_camfw
-allow cameraserver sysfs_camera:file { rw_file_perms open getattr };
-
-# searching for syses nodes
 allow cameraserver sysfs_camera:dir search;
+allow cameraserver sysfs_camera:file rw_file_perms;
 
 # /data/camera/ISP_CV
 allow cameraserver camera_data_file:file r_file_perms;
 
 # /data/media(/.*)?
-allow cameraserver media_rw_data_file:dir r_dir_perms;
-allow cameraserver media_rw_data_file:file r_file_perms;
+r_dir_file(cameraserver, media_rw_data_file);

diff --git a/sepolicy/charger.te b/sepolicy/charger.te
index 888f5024aa5d04f0e424216ed43fd58a54693340..52e3cd546d524cced5facb99af206330444a12d0 100644 (file)
--- a/sepolicy/charger.te
+++ b/sepolicy/charger.te
@@ -1,2 +1 @@
-# charger
 allow charger sysfs_usb_supply:file rw_file_perms;

diff --git a/sepolicy/domain.te b/sepolicy/domain.te
deleted file mode 100644 (file)
index c8d8d53..0000000
--- a/sepolicy/domain.te
+++ /dev/null
@@ -1 +0,0 @@
-dontaudit domain kernel:system module_request;

diff --git a/sepolicy/file.te b/sepolicy/file.te
index dedd5a6bbde49a0372425f0b0aff2fac72d0e36a..f4ac61c0f1239dfbd1dcdac00c637d4c97042f6a 100644 (file)
--- a/sepolicy/file.te
+++ b/sepolicy/file.te
@@ -25,6 +25,7 @@ type proc_vm, fs_type, proc_type;
 type proc_dt_firmware, fs_type, proc_type;
 type proc_reset_reason, fs_type, proc_type;
 type proc_simslot_count, fs_type, proc_type;
+type proc_input_devices, fs_type, proc_type;
 type proc_sec, fs_type, proc_type;
 
 ### sysfs types
@@ -47,7 +48,5 @@ type sysfs_block, sysfs_type, fs_type, mlstrustedobject;
 type sysfs_jack, sysfs_type, fs_type, mlstrustedobject;
 type sysfs_v4l, sysfs_type, fs_type, mlstrustedobject;
 
-allow sysfs_type tmpfs:filesystem associate;
-
 ### data types
 type display_vendor_data_file, file_type, data_file_type;

diff --git a/sepolicy/file_contexts b/sepolicy/file_contexts
index a97cf2cdfeca65e26f5a8799b5de97943c7d170b..21af1c5849b679e8a898c440ab89e2c731d8391a 100644 (file)
--- a/sepolicy/file_contexts
+++ b/sepolicy/file_contexts
@@ -17,8 +17,6 @@
 /dev/media[0-3]*             u:object_r:camera_device:s0
 /dev/m2m1shot_jpeg           u:object_r:camera_device:s0
 
-/dev/mtp_usb*                u:object_r:mtp_device:s0
-
 /dev/__cbd_msg_              u:object_r:mif_device:s0
 /dev/umts.*                  u:object_r:mif_device:s0
 /dev/ehci_power              u:object_r:mif_device:s0

diff --git a/sepolicy/fingerprintd.te b/sepolicy/fingerprintd.te
index 12770f7d5e0bd017dd1e45c4837b7d281eda4bd1..81af2ba298ab1f0de043477de97553583d8040da 100644 (file)
--- a/sepolicy/fingerprintd.te
+++ b/sepolicy/fingerprintd.te
@@ -1,5 +1,5 @@
 # allow hal_fingerprint_default to communicate with various devices
-binder_call(system_app, hal_fingerprint_default);
+binder_call(system_app, hal_fingerprint_default)
 
 # kernel fp device
 allow hal_fingerprint_default fingerprint_device:chr_file rw_file_perms;

diff --git a/sepolicy/genfs_contexts b/sepolicy/genfs_contexts
index 00a80db193589a8ac95a740c2c2bcd780f938256..d9d72cdf4d1541965107218ddf6edfe907b57cea 100644 (file)
--- a/sepolicy/genfs_contexts
+++ b/sepolicy/genfs_contexts
@@ -11,9 +11,11 @@ genfscon proc /sys/vm/vfs_cache_pressure        u:object_r:proc_vm:s0
 genfscon proc /reset_reason     u:object_r:proc_reset_reason:s0
 genfscon proc /simslot_count    u:object_r:proc_simslot_count:s0
 
+genfscon proc /bus/input/devices    u:object_r:proc_input_devices:s0
+
 # SEC devices
 genfscon proc /sec_log          u:object_r:proc_sec:s0
-#genfscon sysfs /class/sec/     u:object_r:sysfs_sec:s0
+#genfscon sysfs /class/sec      u:object_r:sysfs_sec:s0
 
 # Power supply devices
 genfscon sysfs /devices/battery.20/power_supply                                     u:object_r:sysfs_usb_supply:s0
@@ -26,10 +28,11 @@ genfscon sysfs /devices/platform/htc_battery/power_supply/ps
 # Input devices
 genfscon sysfs /devices/i2c.23/i2c-5/5-0020/input/input2/enabled            u:object_r:sysfs_input:s0
 genfscon sysfs /devices/13850000.i2c/i2c-10/10-0050/input/input3/enabled    u:object_r:sysfs_input:s0
-genfscon sysfs /devices/virtual/sec/sec_touchkey/                           u:object_r:sysfs_input:s0
-genfscon sysfs /devices/virtual/sec/sec_key/                                u:object_r:sysfs_input:s0
-genfscon sysfs /devices/virtual/sec/tsp/                                    u:object_r:sysfs_input:s0
-genfscon sysfs /devices/virtual/secgpio_check/                              u:object_r:sysfs_input:s0
+genfscon sysfs /devices/virtual/sec/sec_touchkey                            u:object_r:sysfs_input:s0
+genfscon sysfs /devices/virtual/sec/sec_key                                 u:object_r:sysfs_input:s0
+genfscon sysfs /devices/virtual/sec/tsp                                     u:object_r:sysfs_input:s0
+genfscon sysfs /devices/virtual/secgpio_check                               u:object_r:sysfs_input:s0
+genfscon sysfs /devices/virtual/input                                       u:object_r:sysfs_input:s0
 
 # A5 power supply devices
 genfscon sysfs /devices/battery.43/power_supply                                     u:object_r:sysfs_usb_supply:s0
@@ -66,29 +69,29 @@ genfscon sysfs /module/cpuidle_exynos64_smp/parameters/enable_mask  u:object_r:s
 genfscon sysfs /module/workqueue/parameters/power_efficient         u:object_r:sysfs_devices_system_cpu:s0
 
 # Camera
-genfscon sysfs /devices/virtual/camera/             u:object_r:sysfs_camera:s0
+genfscon sysfs /devices/virtual/camera              u:object_r:sysfs_camera:s0
 
 # GPS
-genfscon sysfs /devices/virtual/sec/gps/            u:object_r:sysfs_gps:s0
+genfscon sysfs /devices/virtual/sec/gps             u:object_r:sysfs_gps:s0
 
 # Audio sysfs
-genfscon sysfs /devices/virtual/audio/earjack/      u:object_r:sysfs_jack:s0
+genfscon sysfs /devices/virtual/audio/earjack       u:object_r:sysfs_jack:s0
 
 # USB lun device
-genfscon sysfs /devices/13580000.usb/gadget/lun0/   u:object_r:sysfs_android_usb:s0
+genfscon sysfs /devices/13580000.usb/gadget/lun0    u:object_r:sysfs_android_usb:s0
 
 # MMC block device cache files
 genfscon sysfs /devices/virtual/bdi/179:0/read_ahead_kb     u:object_r:sysfs_block:s0
 genfscon sysfs /devices/virtual/bdi/179:32/read_ahead_kb    u:object_r:sysfs_block:s0
 
 # ION
-genfscon sysfs /devices/virtual/ion_cma/    u:object_r:sysfs_ion:s0
+genfscon sysfs /devices/virtual/ion_cma     u:object_r:sysfs_ion:s0
 
 # Sensors
-genfscon sysfs /devices/virtual/sensors/                            u:object_r:sysfs_sensors:s0
-genfscon sysfs /devices/13870000.hsi2c/i2c-0/0-0028/iio:device0/    u:object_r:sysfs_sensors:s0
-genfscon sysfs /devices/13870000.hsi2c/i2c-0/0-0068/iio:device1/    u:object_r:sysfs_sensors:s0
-genfscon sysfs /devices/13870000.hsi2c/i2c-0/0-002e/iio:device2/    u:object_r:sysfs_sensors:s0
+genfscon sysfs /devices/virtual/sensors                             u:object_r:sysfs_sensors:s0
+genfscon sysfs /devices/13870000.hsi2c/i2c-0/0-0028/iio:device0     u:object_r:sysfs_sensors:s0
+genfscon sysfs /devices/13870000.hsi2c/i2c-0/0-0068/iio:device1     u:object_r:sysfs_sensors:s0
+genfscon sysfs /devices/13870000.hsi2c/i2c-0/0-002e/iio:device2     u:object_r:sysfs_sensors:s0
 
 
 genfscon sysfs /devices/13540000.dwmmc0/mmc_host/mmc0/mmc0:0001/block/mmcblk0 u:object_r:sysfs_mmc:s0
@@ -99,7 +102,7 @@ genfscon sysfs /devices/virtual/net/rmnet2 u:object_r:sysfs_net:s0
 genfscon sysfs /devices/virtual/net/rmnet3 u:object_r:sysfs_net:s0
 
 genfscon sysfs /devices/14830000.decon_fb  u:object_r:sysfs_graphics:s0
-genfscon sysfs /devices/14800000.dsim  u:object_r:sysfs_graphics:s0
+genfscon sysfs /devices/14800000.dsim      u:object_r:sysfs_graphics:s0
 
 # video4linux
-genfscon sysfs /devices/12800000.mfc0/video4linux/  u:object_r:sysfs_v4l:s0
+genfscon sysfs /devices/12800000.mfc0/video4linux   u:object_r:sysfs_v4l:s0

diff --git a/sepolicy/gpsd.te b/sepolicy/gpsd.te
index 9613368d993e53e2817203c7e0474219166ec192..d44ce3a912c3a3ac8d8c521145a06e4962f509c8 100644 (file)
--- a/sepolicy/gpsd.te
+++ b/sepolicy/gpsd.te
@@ -1,7 +1,7 @@
 type gpsd, domain;
 type gpsd_exec, exec_type, file_type;
 
-init_daemon_domain(gpsd);
+init_daemon_domain(gpsd)
 
 # Automatically label files created in /data/system/gps as gps_data_file
 file_type_auto_trans(gpsd, system_data_file, gps_data_file)
@@ -10,7 +10,7 @@ file_type_auto_trans(gpsd, system_data_file, gps_data_file)
 unix_socket_connect(gpsd, property, rild)
 unix_socket_connect(gpsd, property, netd)
 
-allow gpsd system_server:unix_stream_socket { read write setopt };
+allow gpsd system_server:unix_stream_socket rw_socket_perms;
 
 binder_call(gpsd, system_server)
 binder_use(gpsd)
@@ -21,27 +21,27 @@ type_transition gpsd gps_data_file:sock_file gps_socket;
 allow gpsd dnsproxyd_socket:sock_file write;
 allow gpsd fwmarkd_socket:sock_file write;
 allow gpsd gps_socket:sock_file create_file_perms;
-allow gpsd self:udp_socket { create bind connect read setopt write }; 
+allow gpsd self:udp_socket create_socket_perms;
 
 # sysfs_gps
 allow gpsd sysfs_gps:lnk_file read;
-allow gpsd sysfs_gps:file { open rw_file_perms getattr };
+allow gpsd sysfs_gps:file rw_file_perms;
 
 # /dev/ttySAC3
-allow gpsd gps_device:chr_file { getattr setattr rw_file_perms };
-allow gpsd gps_data_file:dir { search write add_name remove_name rw_dir_perms };
-allow gpsd gps_data_file:fifo_file { unlink create setattr getattr rw_file_perms };
+allow gpsd gps_device:chr_file { setattr rw_file_perms };
+allow gpsd gps_data_file:dir rw_dir_perms;
+allow gpsd gps_data_file:fifo_file create_file_perms;
 
 allow gpsd sysfs_wake_lock:file rw_file_perms;
 
-allow gpsd sensorservice_service:service_manager { find };
+allow gpsd sensorservice_service:service_manager find;
 
 # /dev/umts_boot0
 allow gpsd mif_device:chr_file r_file_perms;
 
 # TCP sockets
 allow gpsd port:tcp_socket { name_connect name_bind };
-allow gpsd self:tcp_socket { bind read write connect create getopt };
+allow gpsd self:tcp_socket create_socket_perms;
 allow gpsd node:tcp_socket node_bind;
 
 # sec sysfs files

diff --git a/sepolicy/hal_bluetooth_default.te b/sepolicy/hal_bluetooth_default.te
new file mode 100644 (file)
index 0000000..418dcf8
--- /dev/null
+++ b/sepolicy/hal_bluetooth_default.te
@@ -0,0 +1,6 @@
+# /dev/ttySAC3
+allow hal_bluetooth_default bluetooth_device:chr_file rw_file_perms;
+
+# /efs
+allow hal_bluetooth_default efs_file:dir search;
+r_dir_file(hal_bluetooth_default, bluetooth_efs_file)

diff --git a/sepolicy/hal_camera_default.te b/sepolicy/hal_camera_default.te
index ec46d7e2810a899f707c8c0c489c31f15812f5ed..38fa4e410dfe3bcfdceb03a9483235cb89f80b37 100644 (file)
--- a/sepolicy/hal_camera_default.te
+++ b/sepolicy/hal_camera_default.te
@@ -1,4 +1,3 @@
-# hal_camera_default
 allow hal_camera_default sysfs_camera:dir search;
 allow hal_camera_default sysfs_camera:file rw_file_perms;
 

diff --git a/sepolicy/hal_drm_default.te b/sepolicy/hal_drm_default.te
index 81e33c6398add6cf7fcb11b7c6f3cefcf43b9f38..92eb9999b833d612d49c620618fe1efc804d6659 100644 (file)
--- a/sepolicy/hal_drm_default.te
+++ b/sepolicy/hal_drm_default.te
@@ -1,11 +1,10 @@
-# hal_drm_default
 vndbinder_use(hal_drm_default)
 
 # /dev/s5p-smem
-allow hal_drm_default secmem_device:chr_file { ioctl rw_file_perms };
+allow hal_drm_default secmem_device:chr_file rw_file_perms;
 allow hal_drm_default tee:unix_stream_socket connectto;
 allow hal_drm_default efs_file:dir search;
-allow hal_drm_default cpk_efs_file:file { getattr open read };
+allow hal_drm_default cpk_efs_file:file r_file_perms;
 
 allow hal_drm_default media_data_file:file create_file_perms;
 allow hal_drm_default media_data_file:dir create_dir_perms;

diff --git a/sepolicy/hal_fingerprint_default.te b/sepolicy/hal_fingerprint_default.te
index 03a4040f4d6a39456ccce6c37c7afa4775a91c26..7f187f9753cfcbd737dd423c6a5c88117e8af069 100644 (file)
--- a/sepolicy/hal_fingerprint_default.te
+++ b/sepolicy/hal_fingerprint_default.te
@@ -1,4 +1,2 @@
-# hal_fingerprint_default
 allow hal_fingerprint_default sysfs_input:dir search;
 allow hal_fingerprint_default sysfs_input:file rw_file_perms;
-

diff --git a/sepolicy/hal_gnss_default.te b/sepolicy/hal_gnss_default.te
index 13fb59542f611cdd288ed63082af526024fc32dd..3e4fac7e36162c3e366ec3efc04d92ea52dcb6ae 100644 (file)
--- a/sepolicy/hal_gnss_default.te
+++ b/sepolicy/hal_gnss_default.te
@@ -1,6 +1,5 @@
-# hal_drm_default
 vndbinder_use(hal_gnss_default)
 
 # Allow gnss to access the gpsd data files
-allow hal_gnss_default gps_data_file:dir { add_name write };
-allow hal_gnss_default gps_data_file:fifo_file { create open read setattr write };
+allow hal_gnss_default gps_data_file:dir w_dir_perms;
+allow hal_gnss_default gps_data_file:fifo_file create_file_perms;

diff --git a/sepolicy/hal_health_default.te b/sepolicy/hal_health_default.te
index 04894e550ae63632cc9b29186dedc1a2dfd45b46..89b18e79da488c3631c6c3106be4c07af7766ab1 100644 (file)
--- a/sepolicy/hal_health_default.te
+++ b/sepolicy/hal_health_default.te
@@ -1,3 +1,2 @@
-# hal_health_default
 r_dir_file(hal_health_default, sysfs_usb_supply)
 allow hal_health_default sysfs_usb_supply:file rw_file_perms;

diff --git a/sepolicy/hal_light_default.te b/sepolicy/hal_light_default.te
index 54a072faedab0132f1cc1afc8a1a430afa81a4d7..854a807da7b53e905f5a2591d28cda79d4464825 100644 (file)
--- a/sepolicy/hal_light_default.te
+++ b/sepolicy/hal_light_default.te
@@ -1,8 +1,13 @@
-# hal_light_default
 allow hal_light_default sysfs_light:dir search;
-allow hal_light_default sysfs_light:file { getattr write open read };
+allow hal_light_default sysfs_light:file rw_file_perms;
+
 allow hal_light_default sysfs_graphics:dir search;
-allow hal_light_default sysfs_graphics:file { getattr write open read };
+allow hal_light_default sysfs_graphics:file rw_file_perms;
+
+allow hal_light_default sysfs_input:dir search;
+allow hal_light_default sysfs_input:lnk_file read;
+allow hal_light_default sysfs_input:file rw_file_perms;
+
 allow hal_light_default sysfs_sec:dir search;
 allow hal_light_default sysfs_sec:lnk_file read;
-allow hal_light_default sysfs_sec:file { getattr write open read };
+allow hal_light_default sysfs_sec:file rw_file_perms;

diff --git a/sepolicy/hal_lineage_livedisplay_sysfs.te b/sepolicy/hal_lineage_livedisplay_sysfs.te
index a45c9e1dab61961ef3f4cc746ffbe2317a6d6c52..82c371dd613a9f2141717576d0aab295bf2e9696 100644 (file)
--- a/sepolicy/hal_lineage_livedisplay_sysfs.te
+++ b/sepolicy/hal_lineage_livedisplay_sysfs.te
@@ -1,11 +1,13 @@
 # Allow LiveDisplay to store files under /data/vendor/display and access them
 allow hal_lineage_livedisplay_sysfs display_vendor_data_file:dir rw_dir_perms;
 allow hal_lineage_livedisplay_sysfs display_vendor_data_file:file create_file_perms;
+
 # Allow LiveDisplay to read and write to files in sysfs_graphics, sysfs_mdnie
 allow hal_lineage_livedisplay_sysfs {
     sysfs_graphics
     sysfs_mdnie
 }:dir search;
+
 allow hal_lineage_livedisplay_sysfs {
     sysfs_graphics
     sysfs_mdnie

diff --git a/sepolicy/hal_power_default.te b/sepolicy/hal_power_default.te
index 432cb3c0acc23b95720d0f1088ced3b038c4e61d..1770e3b2ad9474fe6cdf429c57102a24452d421c 100644 (file)
--- a/sepolicy/hal_power_default.te
+++ b/sepolicy/hal_power_default.te
@@ -1,8 +1,6 @@
-# hal_power_default
-
 # Input devices
-allow hal_power_default sysfs_input:dir { open read search };
-allow hal_power_default sysfs_input:file { rw_file_perms };
+allow hal_power_default sysfs_input:dir r_dir_perms;
+allow hal_power_default sysfs_input:file rw_file_perms;
 
 # CPU devices
 allow hal_power_default sysfs_devices_system_cpu:dir search;

diff --git a/sepolicy/hal_wifi_default.te b/sepolicy/hal_wifi_default.te
index 2050e4f701470973e207d6f26a97556e1a988119..7cf9e4d1cc850105d4f6f07ada073683d40377ff 100644 (file)
--- a/sepolicy/hal_wifi_default.te
+++ b/sepolicy/hal_wifi_default.te
@@ -1,6 +1,8 @@
-# hal_wifi_default
 allow hal_wifi_default efs_file:dir search;
+
 allow hal_wifi_default wifi_efs_file:dir search;
-allow hal_wifi_default wifi_efs_file:file { open read };
+allow hal_wifi_default wifi_efs_file:file r_file_perms;
+
 allow hal_wifi_default wifi_data_file:file r_file_perms;
+
 allow hal_wifi_default sysfs_wifi:file write;

diff --git a/sepolicy/hal_wifi_supplicant_default.te b/sepolicy/hal_wifi_supplicant_default.te
deleted file mode 100644 (file)
index 8ba881a..0000000
--- a/sepolicy/hal_wifi_supplicant_default.te
+++ /dev/null
@@ -1,2 +0,0 @@
-# hal_wifi_supplicant_default
-allow hal_wifi_supplicant_default proc_net:file write;

diff --git a/sepolicy/healthd.te b/sepolicy/healthd.te
index 69edb8f395af50d7da6989c294d96e23a8505193..5aa5870a76397859fe13fe1560357706b6adec48 100644 (file)
--- a/sepolicy/healthd.te
+++ b/sepolicy/healthd.te
@@ -1,5 +1,3 @@
-# healthd
-allow healthd device:dir rw_dir_perms;
 allow healthd rtc_device:chr_file rw_file_perms;
 
 allow healthd sysfs_usb_supply:file rw_file_perms;

diff --git a/sepolicy/init.te b/sepolicy/init.te
index 0673892303f95861d9aa492eb1aebd841e174500..4c0d72007768138b89bc61553a6e1276847cfd3f 100644 (file)
--- a/sepolicy/init.te
+++ b/sepolicy/init.te
@@ -7,16 +7,12 @@ allow init efs_file:dir  mounton;
 # /dev/block/mmcblk0p[0-9]
 allow init emmcblk_device:blk_file rw_file_perms;
 
-allow init block_device:lnk_file { setattr };
+allow init block_device:lnk_file setattr;
 allow init tmpfs:lnk_file create_file_perms;
 
 # /sys/class/power_supply/battery and /sys/class/android_usb/android0
 allow init sysfs_usb_supply:file { rw_file_perms setattr };
 
-# Shim libs
-allow init cameraserver:process noatsecure;
-allow init hal_fingerprint_default:process noatsecure;
-
 # /data
 allow init sdcardd_exec:file r_file_perms;
 
@@ -30,8 +26,8 @@ allow init sysfs_ion:file setattr;
 allow init sysfs_android_usb:file setattr;
 
 # read/chown mDNIE symlinks
-allow init sysfs_mdnie:lnk_file { read setattr };
-allow init sysfs_mdnie:file { open write };
+allow init sysfs_mdnie:lnk_file { r_file_perms setattr };
+allow init sysfs_mdnie:file rw_file_perms;
 
 # read/chown camera firmware
 allow init sysfs_camera:file { relabelto setattr };
@@ -71,7 +67,7 @@ allow init sysfs_net:file rw_file_perms;
 allow init sysfs_graphics:file { rw_file_perms setattr };
 allow init sysfs_light:file { rw_file_perms setattr };
 allow init sysfs_light:lnk_file { rw_file_perms setattr };
-allow init sysfs_mdnie:file { setattr };
+allow init sysfs_mdnie:file setattr;
 allow init sysfs_sec:file { rw_file_perms setattr };
 allow init sysfs_sec:lnk_file read;
 allow init sysfs_sensors:file { rw_file_perms setattr };

diff --git a/sepolicy/installd.te b/sepolicy/installd.te
deleted file mode 100644 (file)
index 792d600..0000000
--- a/sepolicy/installd.te
+++ /dev/null
@@ -1 +0,0 @@
-#

diff --git a/sepolicy/kernel.te b/sepolicy/kernel.te
index 73dbd2acbb83e4fbb8e2fa6226cd3a9af5b09eaf..fda228213e6ea852b921a80771c162b2dfc01daf 100644 (file)
--- a/sepolicy/kernel.te
+++ b/sepolicy/kernel.te
@@ -2,24 +2,21 @@ allow kernel self:capability { chown mknod };
 
 # /dev/mbin0
 allow kernel emmcblk_device:blk_file r_file_perms;
-allow kernel device:blk_file { create setattr getattr unlink };
-# /bus/usb/001/001
-allow kernel device:dir { create write remove_name rmdir add_name };
-allow kernel device:chr_file { create setattr getattr unlink };
 
 # /sys/devices/system/cpu/cpu[0-9]/cpufreq/*
-allow kernel sysfs_devices_system_cpu:file { setattr };
+allow kernel sysfs_devices_system_cpu:file setattr;
 
 # /efs contents
 allow kernel { app_efs_file battery_efs_file efs_file sensor_efs_file }:dir r_dir_perms;
 allow kernel { app_efs_file battery_efs_file efs_file sensor_efs_file }:file rw_file_perms;
 
 # /efs/wifi/.mac.info
-allow kernel wifi_efs_file:dir r_dir_perms;
-allow kernel wifi_efs_file:file r_file_perms;
+r_dir_file(kernel, wifi_efs_file);
 
 # /data/misc/conn/.wifiver.info
 allow kernel wifi_data_file:file rw_file_perms;
 
 # Allow kernel to search tmpfs
 allow kernel tmpfs:dir search;
+
+allow kernel self:capability sys_module;

diff --git a/sepolicy/mediacodec.te b/sepolicy/mediacodec.te
index 524c8e7e30c0631db57d2dec5e779a88dd2973b7..14cdbdcec3323163db2eb1312b5cf1fd5a1306a9 100644 (file)
--- a/sepolicy/mediacodec.te
+++ b/sepolicy/mediacodec.te
@@ -2,5 +2,4 @@
 allow mediacodec system_file:dir r_dir_perms;
 
 # /sys/class/video4linux/*
-allow mediacodec sysfs_v4l:dir { open read search };
-allow mediacodec sysfs_v4l:file r_file_perms;
+r_dir_file(mediacodec, sysfs_v4l);

diff --git a/sepolicy/mediaextractor.te b/sepolicy/mediaextractor.te
deleted file mode 100644 (file)
index 3d8072d..0000000
--- a/sepolicy/mediaextractor.te
+++ /dev/null
@@ -1 +0,0 @@
-allow mediaextractor fuse:file { read getattr };

diff --git a/sepolicy/mediaserver.te b/sepolicy/mediaserver.te
index 52e86b0e9576eb0ce8cad9506b3c7ca3a179d958..02b8f37c0d0c593ff6b474b51209ae26ce4fcfe9 100644 (file)
--- a/sepolicy/mediaserver.te
+++ b/sepolicy/mediaserver.te
@@ -5,8 +5,8 @@ allow mediaserver efs_file:dir r_dir_perms;
 allow mediaserver efs_file:file r_file_perms;
 
 # /dev/m2m1shot_jpeg
-allow mediaserver camera_device:chr_file { read write open getattr ioctl };
+allow mediaserver camera_device:chr_file rw_file_perms;
 
 # Snap permissions
-allow mediaserver sensorservice_service:service_manager { find };
-allow mediaserver system_server:unix_stream_socket { read write };
+allow mediaserver sensorservice_service:service_manager find;
+allow mediaserver system_server:unix_stream_socket rw_stream_socket_perms;

diff --git a/sepolicy/netd.te b/sepolicy/netd.te
index f819a9762d60cb69c39d290f04168f7bd3cb274b..8cfd7b74c1c698e7cf05d1f59df50c197fc2656d 100644 (file)
--- a/sepolicy/netd.te
+++ b/sepolicy/netd.te
@@ -1,4 +1,4 @@
 allow netd self:capability sys_module;
 allow netd gpsd:fd use;
-allow netd gpsd:udp_socket { read write getopt setopt };
-allow netd gpsd:tcp_socket { read write getopt setopt };
+allow netd gpsd:udp_socket rw_socket_perms;
+allow netd gpsd:tcp_socket rw_socket_perms;

diff --git a/sepolicy/nfc.te b/sepolicy/nfc.te
deleted file mode 100644 (file)
index 70f7fd2..0000000
--- a/sepolicy/nfc.te
+++ /dev/null
@@ -1,2 +0,0 @@
-allow nfc sec_efs_file:dir search;
-allow nfc efs_file:dir search;

diff --git a/sepolicy/rild.te b/sepolicy/rild.te
index a1201ddafe563724530334d48e371dbae7a0fb4b..1299f837ab5ecfcca7db669add0e73fb1bf1d350 100644 (file)
--- a/sepolicy/rild.te
+++ b/sepolicy/rild.te
@@ -1,17 +1,13 @@
 # Allow rild to change perms
-allow rild self:capability { chown };
+allow rild self:capability chown;
 
 # Allow additiional efs access
 allow rild bin_nv_data_efs_file:file create_file_perms;
-allow rild imei_efs_file:dir r_dir_perms;
-allow rild imei_efs_file:file r_file_perms;
-allow rild app_efs_file:dir r_dir_perms;
-allow rild app_efs_file:file r_file_perms;
+r_dir_file(rild, imei_efs_file);
+r_dir_file(rild, app_efs_file);
 
-# /dev
-allow rild audioserver:dir r_dir_perms;
-# /proc/<pid>/cmdline
-allow rild audioserver:file r_file_perms;
+# audioserver
+r_dir_file(rild, audioserver);
 
 # /dev/mbin0
 allow rild block_device:dir r_dir_perms;
@@ -28,14 +24,12 @@ allow rild sysfs_input:file rw_file_perms;
 # /proc/sys/net/ipv6/conf/*/accept_ra_defrtr
 allow rild proc_net:file rw_file_perms;
 
-allow rild gpsd:dir r_dir_perms;
-allow rild gpsd:file r_file_perms;
+r_dir_file(rild, gpsd);
 
 allow rild proc_qtaguid_stat:file r_file_perms;
 
 # rild reads /proc/pid/cmdline of mediaserver
-allow rild mediaserver:dir { open read search getattr };
-allow rild mediaserver:file { open read getattr };
+r_dir_file(rild, mediaserver);
 
 # /data/misc/radio/*
 allow rild radio_data_file:dir rw_dir_perms;
@@ -44,10 +38,10 @@ allow rild radio_data_file:file create_file_perms;
 allow rild radio_data_file:lnk_file r_file_perms;
 
 # sdcard/SDET_PLMN/input/MNCMCC.txt
-allow rild storage_file:dir { r_dir_perms };
-allow rild storage_file:lnk_file { r_file_perms };
-allow rild mnt_user_file:dir { r_dir_perms };
-allow rild mnt_user_file:lnk_file { r_file_perms };
+allow rild storage_file:dir r_dir_perms;
+allow rild storage_file:lnk_file r_file_perms;
+allow rild mnt_user_file:dir r_dir_perms;
+allow rild mnt_user_file:lnk_file r_file_perms;
 
 # Modem firmware download
 allow rild radio_block_device:blk_file r_file_perms;
@@ -59,4 +53,4 @@ set_prop(modemloader, radio_prop)
 allow rild knox_device:chr_file r_file_perms;
 
 # /data/media/0
-allow rild media_rw_data_file:dir { open read search };
+allow rild media_rw_data_file:dir r_dir_perms;

diff --git a/sepolicy/sswap.te b/sepolicy/sswap.te
index a6316906dbca4aac911af2595afa9d684ec8c8fe..49a9ec174a09ccfbe7700cddbb38906bc7adaea7 100644 (file)
--- a/sepolicy/sswap.te
+++ b/sepolicy/sswap.te
@@ -4,18 +4,15 @@ type sswap_device, dev_type;
 
 init_daemon_domain(sswap);
 
-allow sswap sswap_device:blk_file { read write open };
-allow sswap rootfs:file { entrypoint read };
+allow sswap sswap_device:blk_file rw_file_perms;
+allow sswap sysfs_sswap:file rw_file_perms;
 allow sswap block_device:dir search;
 allow sswap self:capability sys_admin;
 
-allow sswap proc:file { open getattr read };
-allow sswap proc_meminfo:file { open read getattr };
-allow sswap property_socket:sock_file write;
-allow sswap init:unix_stream_socket connectto;
+allow sswap proc:file r_file_perms;
+allow sswap proc_meminfo:file r_file_perms;
 
-allow sswap properties_device:dir { read open };
-allow sswap proc_stat:dir { read open getattr };
-allow sswap proc_stat:file { read open getattr };
+allow sswap properties_device:dir r_dir_perms;
+r_dir_file(sswap, proc_stat);
 
 set_prop(sswap, sswap_prop)

diff --git a/sepolicy/storaged.te b/sepolicy/storaged.te
deleted file mode 100644 (file)
index 03de562..0000000
--- a/sepolicy/storaged.te
+++ /dev/null
@@ -1 +0,0 @@
-#TODO: r_dir_file(storaged, sysfs_mmc)

diff --git a/sepolicy/surfaceflinger.te b/sepolicy/surfaceflinger.te
index e09e0e46b188001d79a7b25d99cbd3b67dc2457c..7d0f0a8bbf102de0f548a49649852dc10bf0dac7 100644 (file)
--- a/sepolicy/surfaceflinger.te
+++ b/sepolicy/surfaceflinger.te
@@ -1,4 +1,4 @@
 # HWC
 allow surfaceflinger secmem_device:chr_file rw_file_perms;
-allow surfaceflinger sysfs_graphics:file { rw_file_perms };
+allow surfaceflinger sysfs_graphics:file rw_file_perms;
 r_dir_file(surfaceflinger, sysfs_graphics)
\ No newline at end of file

diff --git a/sepolicy/system_server.te b/sepolicy/system_server.te
index 6ea261ecb62ecfbf5d47b77c771489d3f6fbc896..19e3bb4116a60d900b252140f17bf347c3628105 100644 (file)
--- a/sepolicy/system_server.te
+++ b/sepolicy/system_server.te
@@ -1,6 +1,6 @@
 # /dev/mbin0
 allow system_server emmcblk_device:dir search;
-allow system_server emmcblk_device:blk_file { getattr ioctl open read write };
+allow system_server emmcblk_device:blk_file rw_file_perms;
 
 # /efs
 allow system_server efs_file:dir r_dir_perms;
@@ -26,7 +26,7 @@ allow system_server app_efs_file:dir r_dir_perms;
 allow system_server app_efs_file:file r_file_perms;
 
 # WifiMachine
-allow system_server self:capability { sys_module };
+allow system_server self:capability sys_module;
 allow system_server wifi_efs_file:dir r_dir_perms;
 allow system_server wifi_efs_file:file r_file_perms;
 
@@ -35,9 +35,6 @@ allow system_server sysfs_mdnie:lnk_file rw_file_perms;
 #allow system_server sysfs_mdnie:dir rw_dir_perms;
 allow system_server sysfs_mdnie:file rw_file_perms;
 
-# Lights
-allow system_server sysfs_light:file rw_file_perms;
-
 # memtrack HAL
 allow system_server debugfs:dir r_dir_perms;
 allow system_server debugfs:file r_file_perms;
@@ -52,7 +49,7 @@ allow system_server sysfs_sensors:file rw_file_perms;
 allow system_server gps_data_file:file create_file_perms;
 
 # Bluetooth buildprop
-allow system_server bluetooth_prop:file read;
+get_prop(system_server, bluetooth_prop)
 
 # Grpahics sysfs
 allow system_server sysfs_graphics:file rw_file_perms;
@@ -60,4 +57,6 @@ allow system_server sysfs_graphics:file rw_file_perms;
 # Input sysfs
 allow system_server sysfs_input:file rw_file_perms;
 
+allow system_server proc_input_devices:file r_file_perms;
+
 unix_socket_connect(system_server, property, gpsd)

diff --git a/sepolicy/tee.te b/sepolicy/tee.te
index 5d1f446d099997615b9ef5e7b3ab4a5d43b845b9..e2f5141583e00300f05d1b9a9fe3ab5a8595eea1 100644 (file)
--- a/sepolicy/tee.te
+++ b/sepolicy/tee.te
@@ -1,5 +1,3 @@
-# mobicore
-
 # /efs
 allow tee { efs_file prov_efs_file }:dir r_dir_perms;
 allow tee { efs_file prov_efs_file }:file r_file_perms;

diff --git a/sepolicy/ueventd.te b/sepolicy/ueventd.te
index 18a8855dffa24b451b962740473c269cd404467c..a252eb691a4b47ca86ac18e60730c99cd8986e9e 100644 (file)
--- a/sepolicy/ueventd.te
+++ b/sepolicy/ueventd.te
@@ -1,13 +1,11 @@
 # /dev/block/mmcblk0p[0-9]
-allow ueventd emmcblk_device:blk_file { ioctl read write create getattr setattr lock append unlink open };
+allow ueventd emmcblk_device:blk_file { relabelfrom relabelto create setattr unlink rw_file_perms };
 
 # /sys/devices/virtual/misc/multipdp/uevent
 allow ueventd sysfs_multipdp:file rw_file_perms;
 
-allow ueventd emmcblk_device:blk_file { relabelfrom relabelto create setattr unlink };
-
 # read/chown camera firmware
-allow ueventd sysfs_camera:file { relabelto getattr rw_file_perms };
+allow ueventd sysfs_camera:file { relabelto rw_file_perms };
 allow ueventd sysfs_camera:filesystem associate;
 
 allow ueventd sysfs_usb_supply:file w_file_perms;

diff --git a/sepolicy/vold.te b/sepolicy/vold.te
index 71e91f5adc9bf6631423d452b0ffdbf3f4bdfe7d..4da2966de99f4605d45af4ceaf188478c9a4c838 100644 (file)
--- a/sepolicy/vold.te
+++ b/sepolicy/vold.te
@@ -2,7 +2,7 @@
 allow vold efs_file:dir r_dir_perms;
 # /dev/block/mmcblk0p[0-9]
 allow vold emmcblk_device:dir create_dir_perms;
-allow vold emmcblk_device:blk_file { ioctl read write create getattr setattr lock append unlink open };
+allow vold emmcblk_device:blk_file { setattr unlink rw_file_perms };
 
 allow vold sysfs_mmc:file w_file_perms;
 r_dir_file(vold, proc_dt_firmware)

diff --git a/sepolicy/wifiloader.te b/sepolicy/wifiloader.te
index c93ed122ab7b016d72a9c9d6e23ea4b315ad73bb..1eca507d1b5440a8e6300e85153b2bc5bdb81a1c 100644 (file)
--- a/sepolicy/wifiloader.te
+++ b/sepolicy/wifiloader.te
@@ -8,16 +8,15 @@ unix_socket_connect(wifiloader, property, init)
 
 allow wifiloader proc:file r_file_perms;
 allow wifiloader sysfs_wlan_fwpath:file setattr;
-allow wifiloader wifi_prop:property_service set;
-allow wifiloader wifi_data_file:file { open read write };
+allow wifiloader wifi_data_file:file rw_file_perms;
+set_prop(wifiloader, wifi_prop);
 
 # /efs
 allow wifiloader efs_file:dir search;
 
 # /efs/wifi
 allow wifiloader wifi_efs_file:dir search;
-allow wifiloader wifi_efs_file:file { open read };
+allow wifiloader wifi_efs_file:file r_file_perms;
 
 # load .ko modules
-allow kernel self:capability sys_module;
 allow wifiloader self:capability { chown sys_module };