From 13c79a303cbd80efd90fea750ee3e00e3966acb9 Mon Sep 17 00:00:00 2001 From: LuK1337 Date: Mon, 17 Apr 2017 11:48:04 +0200 Subject: [PATCH] Update OMS patches --- ...-service-overlay-to-service_contexts.patch | 4 +- ...sepolicy-exceptions-for-theme-assets.patch | 4 +- ...3-sepolicy-fix-themed-boot-animation.patch | 4 +- .../0004-sepolicy-fix-themed-sounds.patch | 4 +- ...dits-for-masquerade-to-operate-rootl.patch | 4 +- ...masquerade-domain-and-allow-JobServi.patch | 4 +- ...asquerade-to-read-and-write-theme-as.patch | 4 +- ...icy-Fix-application-of-bootanimation.patch | 4 +- .../0009-sepolicy-Redo-masquerade-rules.patch | 4 +- ...0010-Welcome-to-Theme-Interfacer-2-2.patch | 4 +- ...-file-and-domain-trans-to-interfacer.patch | 38 +++++++++++++++++++ 11 files changed, 58 insertions(+), 20 deletions(-) create mode 100644 patches/system/sepolicy/0011-sepolicy-add-file-and-domain-trans-to-interfacer.patch diff --git a/patches/system/sepolicy/0001-OMS7-N-Add-service-overlay-to-service_contexts.patch b/patches/system/sepolicy/0001-OMS7-N-Add-service-overlay-to-service_contexts.patch index 6f86da9..49cad43 100644 --- a/patches/system/sepolicy/0001-OMS7-N-Add-service-overlay-to-service_contexts.patch +++ b/patches/system/sepolicy/0001-OMS7-N-Add-service-overlay-to-service_contexts.patch @@ -1,7 +1,7 @@ -From 68afbfc6637b4eb999991512e39e2753dce216fc Mon Sep 17 00:00:00 2001 +From 1feca61b0366caa178889d9dd905c0f35c4c4351 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?M=C3=A5rten=20Kongstad?= Date: Mon, 22 Jun 2015 09:31:25 +0200 -Subject: [PATCH 01/10] OMS7-N: Add service 'overlay' to service_contexts +Subject: [PATCH 01/11] OMS7-N: Add service 'overlay' to service_contexts The 'overlay' service is the Overlay Manager Service, which tracks packages and their Runtime Resource Overlay overlay packages. diff --git a/patches/system/sepolicy/0002-Introduce-sepolicy-exceptions-for-theme-assets.patch b/patches/system/sepolicy/0002-Introduce-sepolicy-exceptions-for-theme-assets.patch index 023beb4..ef5d7ca 100644 --- a/patches/system/sepolicy/0002-Introduce-sepolicy-exceptions-for-theme-assets.patch +++ b/patches/system/sepolicy/0002-Introduce-sepolicy-exceptions-for-theme-assets.patch @@ -1,7 +1,7 @@ -From 7ecfcd842717ee20c0736b6b7251f9a7edafe287 Mon Sep 17 00:00:00 2001 +From 9e49f50fa1a4fcab0d9458c3406fe70b66218fde Mon Sep 17 00:00:00 2001 From: d34d Date: Wed, 4 Jan 2017 10:29:34 -0800 -Subject: [PATCH 02/10] Introduce sepolicy exceptions for theme assets +Subject: [PATCH 02/11] Introduce sepolicy exceptions for theme assets Assets such as composed icons and ringtones need to be accessed by apps. This patch adds the policy needed to facilitate this. diff --git a/patches/system/sepolicy/0003-sepolicy-fix-themed-boot-animation.patch b/patches/system/sepolicy/0003-sepolicy-fix-themed-boot-animation.patch index 659a337..761a1fc 100644 --- a/patches/system/sepolicy/0003-sepolicy-fix-themed-boot-animation.patch +++ b/patches/system/sepolicy/0003-sepolicy-fix-themed-boot-animation.patch @@ -1,7 +1,7 @@ -From 7f4af920165c7d80018b199388d4309a6c450f88 Mon Sep 17 00:00:00 2001 +From a29c592adf45bdd1042d9339d3b0047e7032c78e Mon Sep 17 00:00:00 2001 From: bigrushdog Date: Wed, 4 Jan 2017 10:31:29 -0800 -Subject: [PATCH 03/10] sepolicy: fix themed boot animation +Subject: [PATCH 03/11] sepolicy: fix themed boot animation W BootAnimation: type=1400 audit(0.0:42): avc: denied { open } for uid=1003 path="/data/system/theme/bootanimation.zip" dev="mmcblk0p42" ino=1657697 scontext=u:r:bootanim:s0 tcontext=u:object_r:system_data_file:s0 tclass=file permissive=0 diff --git a/patches/system/sepolicy/0004-sepolicy-fix-themed-sounds.patch b/patches/system/sepolicy/0004-sepolicy-fix-themed-sounds.patch index 048950d..c40cace 100644 --- a/patches/system/sepolicy/0004-sepolicy-fix-themed-sounds.patch +++ b/patches/system/sepolicy/0004-sepolicy-fix-themed-sounds.patch @@ -1,7 +1,7 @@ -From 64b2ac651ecc48a340ae9d12b8a57a98a084fb86 Mon Sep 17 00:00:00 2001 +From 8882f733308ff6ac5e5292eb38253bda7b874427 Mon Sep 17 00:00:00 2001 From: George G Date: Wed, 8 Feb 2017 17:22:44 +0200 -Subject: [PATCH 04/10] sepolicy: fix themed sounds +Subject: [PATCH 04/11] sepolicy: fix themed sounds 02-08 17:26:48.011 18259-18259/? W/SoundPoolThread: type=1400 audit(0.0:31): avc: denied { read } for path="/data/system/theme/audio/ui/Lock.ogg" dev="dm-0" ino=1006317 scontext=u:r:drmserver:s0 tcontext=u:object_r:theme_data_file:s0 tclass=file permissive=0 diff --git a/patches/system/sepolicy/0005-initial-policy-edits-for-masquerade-to-operate-rootl.patch b/patches/system/sepolicy/0005-initial-policy-edits-for-masquerade-to-operate-rootl.patch index 5ceca5f..b062e7d 100644 --- a/patches/system/sepolicy/0005-initial-policy-edits-for-masquerade-to-operate-rootl.patch +++ b/patches/system/sepolicy/0005-initial-policy-edits-for-masquerade-to-operate-rootl.patch @@ -1,7 +1,7 @@ -From 33abb5b8782a3886016eb8e04a3fd5dec97b16c3 Mon Sep 17 00:00:00 2001 +From 3a536ae9574dae37422ec188f119d9769c68355c Mon Sep 17 00:00:00 2001 From: Surge1223 Date: Sat, 18 Feb 2017 08:46:15 -0600 -Subject: [PATCH 05/10] initial policy edits for masquerade to operate rootless +Subject: [PATCH 05/11] initial policy edits for masquerade to operate rootless Change-Id: Iddfc408f206033772b9d49d335ca94e63b5e5210 --- diff --git a/patches/system/sepolicy/0006-sepolicy-rename-masquerade-domain-and-allow-JobServi.patch b/patches/system/sepolicy/0006-sepolicy-rename-masquerade-domain-and-allow-JobServi.patch index d360431..f0fd6da 100644 --- a/patches/system/sepolicy/0006-sepolicy-rename-masquerade-domain-and-allow-JobServi.patch +++ b/patches/system/sepolicy/0006-sepolicy-rename-masquerade-domain-and-allow-JobServi.patch @@ -1,7 +1,7 @@ -From e113da2631251ae612b42de0639ebeba954e2245 Mon Sep 17 00:00:00 2001 +From 95904cb6390312b0e842b5cbb8fda6a28f524f12 Mon Sep 17 00:00:00 2001 From: Surge1223 Date: Tue, 21 Feb 2017 12:28:05 -0600 -Subject: [PATCH 06/10] sepolicy: rename masquerade domain and allow JobService +Subject: [PATCH 06/11] sepolicy: rename masquerade domain and allow JobService in system_server This attempts to address the issue of JobService being unable to process diff --git a/patches/system/sepolicy/0007-sepolicy-allow-masquerade-to-read-and-write-theme-as.patch b/patches/system/sepolicy/0007-sepolicy-allow-masquerade-to-read-and-write-theme-as.patch index be1cae1..9a406f1 100644 --- a/patches/system/sepolicy/0007-sepolicy-allow-masquerade-to-read-and-write-theme-as.patch +++ b/patches/system/sepolicy/0007-sepolicy-allow-masquerade-to-read-and-write-theme-as.patch @@ -1,7 +1,7 @@ -From d64ff088ccf23a17e054abcd101eabc1ae444a40 Mon Sep 17 00:00:00 2001 +From 4fe1775849e375de906ba4ad92d1b3e79d4c8bc3 Mon Sep 17 00:00:00 2001 From: Surge1223 Date: Wed, 22 Feb 2017 20:45:04 -0600 -Subject: [PATCH 07/10] sepolicy: allow masquerade to read and write theme +Subject: [PATCH 07/11] sepolicy: allow masquerade to read and write theme assets Fix for masquerade to handle theme assets including fonts and bootanimation, also diff --git a/patches/system/sepolicy/0008-sepolicy-Fix-application-of-bootanimation.patch b/patches/system/sepolicy/0008-sepolicy-Fix-application-of-bootanimation.patch index 73b7caf..fd79690 100644 --- a/patches/system/sepolicy/0008-sepolicy-Fix-application-of-bootanimation.patch +++ b/patches/system/sepolicy/0008-sepolicy-Fix-application-of-bootanimation.patch @@ -1,7 +1,7 @@ -From 34789475b4bb73b6829c65662f6f54af01a4ad84 Mon Sep 17 00:00:00 2001 +From f5397bc7a0b0483d4fe484fd24c82ca941262ea3 Mon Sep 17 00:00:00 2001 From: Miccia Date: Mon, 27 Feb 2017 12:36:21 +0100 -Subject: [PATCH 08/10] sepolicy: Fix application of bootanimation +Subject: [PATCH 08/11] sepolicy: Fix application of bootanimation Change-Id: I7365d28fecf18b4d1aa42b2210e023b202dd97a5 --- diff --git a/patches/system/sepolicy/0009-sepolicy-Redo-masquerade-rules.patch b/patches/system/sepolicy/0009-sepolicy-Redo-masquerade-rules.patch index 89b263f..5875d10 100644 --- a/patches/system/sepolicy/0009-sepolicy-Redo-masquerade-rules.patch +++ b/patches/system/sepolicy/0009-sepolicy-Redo-masquerade-rules.patch @@ -1,7 +1,7 @@ -From 848c3d6f9aa362f70507fe9508b91a413dbb7a3c Mon Sep 17 00:00:00 2001 +From 542b2618ace4fc577949507829ce3f27d9c0514d Mon Sep 17 00:00:00 2001 From: LuK1337 Date: Wed, 1 Mar 2017 23:11:49 +0100 -Subject: [PATCH 09/10] sepolicy: Redo masquerade rules +Subject: [PATCH 09/11] sepolicy: Redo masquerade rules * Use macros * Label custom properties diff --git a/patches/system/sepolicy/0010-Welcome-to-Theme-Interfacer-2-2.patch b/patches/system/sepolicy/0010-Welcome-to-Theme-Interfacer-2-2.patch index 01bcde2..c81b595 100644 --- a/patches/system/sepolicy/0010-Welcome-to-Theme-Interfacer-2-2.patch +++ b/patches/system/sepolicy/0010-Welcome-to-Theme-Interfacer-2-2.patch @@ -1,7 +1,7 @@ -From 730829b706844e30cda494a22653f13341527d86 Mon Sep 17 00:00:00 2001 +From a0cb9177aff9b17cea5119a9b8fb6770784857cf Mon Sep 17 00:00:00 2001 From: Nathan Chancellor Date: Sat, 4 Mar 2017 19:20:10 -0700 -Subject: [PATCH 10/10] Welcome to Theme Interfacer! [2/2] +Subject: [PATCH 10/11] Welcome to Theme Interfacer! [2/2] Change-Id: I4a28c8840957d385338529540e081eabd3135cc1 Signed-off-by: Nathan Chancellor diff --git a/patches/system/sepolicy/0011-sepolicy-add-file-and-domain-trans-to-interfacer.patch b/patches/system/sepolicy/0011-sepolicy-add-file-and-domain-trans-to-interfacer.patch new file mode 100644 index 0000000..178163c --- /dev/null +++ b/patches/system/sepolicy/0011-sepolicy-add-file-and-domain-trans-to-interfacer.patch @@ -0,0 +1,38 @@ +From a65b9f9786bda8cca29f808cf8669bebb0c59578 Mon Sep 17 00:00:00 2001 +From: Surge Raval +Date: Sun, 16 Apr 2017 05:00:13 +0000 +Subject: [PATCH 11/11] sepolicy: add file and domain trans to interfacer + +This will fix bootanimations not applying on 7.1.2 ROMs + +Change-Id: I3dd752dcb58ee84ac9953252a1fb3c5cd84c90c7 +--- + interfacer.te | 5 +++++ + untrusted_app.te | 1 + + 2 files changed, 6 insertions(+) + +diff --git a/interfacer.te b/interfacer.te +index 45dcd6b..a5ba1d7 100644 +--- a/interfacer.te ++++ b/interfacer.te +@@ -61,3 +61,8 @@ allow interfacer display_service:service_manager find; + allow interfacer mount_service:service_manager find; + allow interfacer network_management_service:service_manager find; + allow interfacer overlay_service:service_manager find; ++ ++# Allow file and type transition for contexts ++type_transition interfacer system_data_file:file theme_data_file "theme"; ++type_transition interfacer system_data_file:dir theme_data_file; ++file_type_auto_trans(interfacer, system_data_file, theme_data_file); +diff --git a/untrusted_app.te b/untrusted_app.te +index c2a5320..8dd0f3f 100644 +--- a/untrusted_app.te ++++ b/untrusted_app.te +@@ -216,3 +216,4 @@ neverallow untrusted_app tun_device:chr_file open; + # Only allow appending to /data/anr/traces.txt (b/27853304, b/18340553) + neverallow untrusted_app anr_data_file:file ~{ open append }; + neverallow untrusted_app anr_data_file:dir ~search; ++allow untrusted_app system_app_data_file:dir getattr; +-- +2.11.1 + -- 2.20.1