Evolution-X-Devices/device_xiaomi_raphael
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

raphael: Import seccomp policies

Browse Source 
* From V12.5.4.0.RFKCNXM.

Signed-off-by: TH779 <i@779.moe>
Change-Id: I8b346fbb3c40b4b1d917a58373faeac067f49868
This commit is contained in:
TH779
2021-06-05 15:21:39 +08:00
parent ec7629df2f
commit c876956dac
6 changed files with 208 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
device.mk
View File

@@ -304,6 +304,13 @@ PRODUCT_PACKAGES += \
librmnetctl \
libxml2
# Seccomp
PRODUCT_COPY_FILES += \
$(LOCAL_PATH)/seccomp/codec2.vendor.base.policy:$(TARGET_COPY_OUT_VENDOR)/etc/seccomp_policy/codec2.vendor.base.policy \
$(LOCAL_PATH)/seccomp/codec2.vendor.ext.policy:$(TARGET_COPY_OUT_VENDOR)/etc/seccomp_policy/codec2.vendor.ext.policy \
$(LOCAL_PATH)/seccomp/mediacodec.policy:$(TARGET_COPY_OUT_VENDOR)/etc/seccomp_policy/mediacodec.policy \
$(LOCAL_PATH)/seccomp/qti-systemd.policy:$(TARGET_COPY_OUT_VENDOR)/etc/seccomp_policy/qti-systemd.policy
# Sensors
PRODUCT_PACKAGES += \
android.hardware.sensors@1.0-impl \

5
proprietary-files.txt
View File

@@ -23,6 +23,7 @@ vendor/lib64/libacdbrtac.so
# ADSP
vendor/bin/adsprpcd
vendor/etc/init/vendor.qti.adsprpc-service.rc
vendor/etc/seccomp_policy/vendor.qti.hardware.dsp.policy
vendor/lib/vendor.qti.hardware.dsp@1.0.so
vendor/lib/libadsp_default_listener.so
vendor/lib/libadsprpc.so
@@ -934,6 +935,7 @@ vendor/etc/init/qcrild.rc
vendor/etc/init/ssgtzd.rc
vendor/etc/init/vendor.qti.rmt_storage.rc
vendor/etc/init/vendor.qti.tftp.rc
vendor/etc/seccomp_policy/atfwd@2.0.policy
vendor/etc/ssg/ta_config.json
vendor/etc/ssg/tz_whitelist.json
vendor/lib64/deviceInfoServiceModule.so
@@ -1009,6 +1011,7 @@ vendor/etc/init/ims_rtp_daemon.rc
vendor/etc/init/imsdatadaemon.rc
vendor/etc/init/imsqmidaemon.rc
vendor/etc/init/imsrcsd.rc
vendor/etc/seccomp_policy/imsrtp.policy
vendor/lib64/com.qualcomm.qti.imscmservice@1.0.so
vendor/lib64/com.qualcomm.qti.imscmservice@2.0.so
vendor/lib64/com.qualcomm.qti.imscmservice@2.1.so
@@ -1280,6 +1283,7 @@ vendor/bin/nv_mac
system_ext/bin/wfdservice
system_ext/etc/init/wfdservice.rc
system_ext/etc/permissions/wfd-system-ext-privapp-permissions-qti.xml
system_ext/etc/seccomp_policy/wfdservice.policy
system_ext/etc/wfdconfigsink.xml
system_ext/lib/com.qualcomm.qti.wifidisplayhal@1.0.so
system_ext/lib/libmmrtpdecoder.so
@@ -1323,6 +1327,7 @@ system_ext/lib/vendor.qti.hardware.wifidisplaysession@1.0.so
system_ext/lib64/vendor.qti.hardware.wifidisplaysession@1.0.so
vendor/bin/wifidisplayhalservice
vendor/etc/init/com.qualcomm.qti.wifidisplayhal@1.0-service.rc
vendor/etc/seccomp_policy/wifidisplayhalservice.policy
vendor/etc/wfdconfig.xml
vendor/lib/libFileMux_proprietary.so
vendor/lib/libhdcp1prov.so

89
seccomp/codec2.vendor.base.policy Normal file
View File

@@ -0,0 +1,89 @@
###################################################################################################
# Copyright (c) 2020 Qualcomm Technologies, Inc.
# All Rights Reserved.
# Confidential and Proprietary - Qualcomm Technologies, Inc.
###################################################################################################
#
# Not a Contribution.
#
# Copyright (C) 2019 The Android Open Source Project
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
futex: 1
# ioctl calls are filtered via the selinux policy.
ioctl: 1
sched_yield: 1
close: 1
dup: 1
ppoll: 1
mprotect: arg2 in ~PROT_EXEC || arg2 in ~PROT_WRITE
mmap2: arg2 in ~PROT_EXEC || arg2 in ~PROT_WRITE
memfd_create: 1
ftruncate: 1
ftruncate64: 1
mremap: arg3 == 3
munmap: 1
prctl: 1
getuid32: 1
writev: 1
sigaltstack: 1
clone: 1
exit: 1
lseek: 1
rt_sigprocmask: 1
openat: 1
open: 1
fstat64: 1
write: 1
nanosleep: 1
setpriority: 1
set_tid_address: 1
getdents64: 1
readlinkat: 1
readlink: 1
read: 1
pread64: 1
fstatfs64: 1
gettimeofday: 1
faccessat: 1
_llseek: 1
fstatat64: 1
ugetrlimit: 1
exit_group: 1
restart_syscall: 1
rt_sigreturn: 1
getrandom: 1
madvise: 1
# crash dump policy additions
sigreturn: 1
clock_gettime: 1
futex: 1
getpid: 1
gettid: 1
pipe2: 1
recvmsg: 1
process_vm_readv: 1
tgkill: 1
rt_sigaction: 1
rt_tgsigqueueinfo: 1
#prctl: arg0 == PR_GET_NO_NEW_PRIVS || arg0 == 0x53564d41
#mprotect: arg2 in 0x1|0x2
#mmap2: arg2 in 0x1|0x2
geteuid32: 1
getgid32: 1
getegid32: 1
getgroups32: 1

9
seccomp/codec2.vendor.ext.policy Normal file
View File

@@ -0,0 +1,9 @@
# device specific syscalls
pselect6: 1
eventfd2: 1
sendto: 1
recvfrom: 1
_llseek: 1
sysinfo: 1
getcwd: 1
getdents64: 1

19
seccomp/mediacodec.policy Normal file
View File

@@ -0,0 +1,19 @@
# device specific syscalls
# extension of services/mediacodec/minijail/seccomp_policy/mediacodec-seccomp-arm.policy
pselect6: 1
eventfd2: 1
sendto: 1
recvfrom: 1
_llseek: 1
sysinfo: 1
getcwd: 1
getdents64: 1
ARM_cacheflush: 1
inotify_init1: 1
inotify_add_watch: 1
inotify_rm_watch: 1
uname: 1
ueventd: 1
timer_create: 1
timer_settime: 1
rt_sigtimedwait: 1

79
seccomp/qti-systemd.policy Normal file
View File

@@ -0,0 +1,79 @@
# Copyright (c) 2020 Qualcomm Technologies, Inc.
# All Rights Reserved.
# Confidential and Proprietary - Qualcomm Technologies, Inc
#
# Not a contribution.
#
# Copyright (C) 2018 The Android Open Source Project
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
mmap: arg2 in ~PROT_EXEC || arg2 in ~PROT_WRITE
munmap: 1
mprotect: arg2 in ~PROT_EXEC || arg2 in ~PROT_WRITE
#prctl: arg0 == 0x37 /* PR_??? */ || arg0 == PR_SET_VMA || arg0 == PR_GET_DUMPABLE || arg0 == PR_SET_SECCOMP || arg0 == PR_CAP_AMBIENT || arg0 == PR_GET_NO_NEW_PRIVS || arg0 == PR_SET_DUMPABLE || arg0 == PR_GET_NAME || arg0 == PR_SET_PTRACER
prctl: 1
openat: 1
read: 1
futex: 1
close: 1
fstat: 1
readlinkat: 1
newfstatat: 1
mremap: 1
fstatfs: 1
pread64: 1
rt_sigprocmask: 1
rt_sigaction: 1
faccessat: 1
#ioctl: arg1 == _IOC(_IOC_NONE
ioctl: 1
clock_gettime: 1
getrandom: 1
nanosleep: 1
fcntl: 1
getuid: 1
sigaltstack: 1
socket: arg0 == AF_QIPCRTR || arg0 == AF_UNIX
writev: 1
execve: 1
getpid: 1
set_tid_address: 1
sched_getscheduler: 1
sigaltstack: 1
sched_getaffinity: 1
connect: 1
pipe2: 1
clone: 1
ppoll: 1
restart_syscall: 1
exit: 1
exit_group: 1
rt_sigreturn: 1
rt_tgsigqueueinfo: 1
getppid: 1
dup: 1
capget: 1
capset: 1
setsid: 1
setitimer: 1
ptrace: 1
recvmsg: 1
exit: 1
restart_syscall: 1
gettid: 1
write: 1
dup3: 1
getdents64: 1
getsockname: 1
recvfrom: 1