bluejay: Rework sepolicy

Change-Id: Idb0636bce2392beb720e420055a7bcb838725a18
2025-12-02 04:18:21 +02:00
parent dc3e7b6527
commit 5dbe6b8ff0
17 changed files with 30 additions and 34 deletions
--- a/sepolicy/vendor/bug_map
+++ b/sepolicy/vendor/bug_map
@@ -0,0 +1,2 @@
+insmod-sh vendor_edgetpu_debugfs dir b/385858411
+ramdump_app privapp_data_file lnk_file b/385858431
--- a/sepolicy/vendor/device.te
+++ b/sepolicy/vendor/device.te
@@ -0,0 +1 @@
+type fips_block_device, dev_type;
--- a/sepolicy/vendor/dump_stm.te
+++ b/sepolicy/vendor/dump_stm.te
@@ -0,0 +1,8 @@
+get_prop(dump_stm, vendor_touch_dump_path_prop)
+
+pixel_bugreport(dump_stm)
+
+allow dump_stm proc_touch:file rw_file_perms;
+allow dump_stm sysfs_touch:dir search;
+allow dump_stm sysfs_touch:file rw_file_perms;
+allow dump_stm vendor_toolbox_exec:file execute_no_trans;
--- a/sepolicy/vendor/file.te
+++ b/sepolicy/vendor/file.te
@@ -0,0 +1 @@
+type proc_touch, fs_type, proc_type;
--- a/sepolicy/vendor/file_contexts
+++ b/sepolicy/vendor/file_contexts
@@ -0,0 +1,3 @@
+/dev/block/platform/14700000\.ufs/by-name/fips u:object_r:fips_block_device:s0
+/vendor/bin/dump/dump_stm\.sh u:object_r:dump_stm_exec:s0
+/vendor/bin/resku_rescue_kicker u:object_r:tee_exec:s0
--- a/sepolicy/vendor/genfs_contexts
+++ b/sepolicy/vendor/genfs_contexts
@@ -0,0 +1,8 @@
+genfscon proc /fts_ext/driver_test u:object_r:proc_touch:s0
+genfscon proc /fts/driver_test u:object_r:proc_touch:s0
+genfscon sysfs /devices/platform/111d0000.spi/spi_master/spi20/spi20.0 u:object_r:sysfs_touch:s0
+genfscon sysfs /devices/platform/10d40000.spi/spi_master/spi11/spi11.0 u:object_r:sysfs_touch:s0
+genfscon sysfs /devices/platform/10950000.spi/spi_master/spi6/spi6.0 u:object_r:sysfs_touch:s0
+genfscon sysfs /devices/platform/14700000.ufs/vendor u:object_r:sysfs_scsi_devices_0000:s0
+genfscon sysfs /devices/platform/14700000.ufs/model u:object_r:sysfs_scsi_devices_0000:s0
+genfscon sysfs /devices/platform/14700000.ufs/rev u:object_r:sysfs_scsi_devices_0000:s0
--- a/sepolicy/vendor/init.te
+++ b/sepolicy/vendor/init.te
@@ -0,0 +1 @@
+set_prop(vendor_init, vendor_touch_dump_path_prop)
--- a/sepolicy/vendor/property.te
+++ b/sepolicy/vendor/property.te
@@ -0,0 +1 @@
+vendor_internal_prop(vendor_touch_dump_path_prop)
--- a/sepolicy/vendor/property_contexts
+++ b/sepolicy/vendor/property_contexts
@@ -0,0 +1 @@
+ro.vendor.touch.dump. u:object_r:vendor_touch_dump_path_prop:s0
--- a/sepolicy/vendor/ufs_firmware_update.te
+++ b/sepolicy/vendor/ufs_firmware_update.te
@@ -0,0 +1,3 @@
+allow ufs_firmware_update block_device:dir r_dir_perms;
+allow ufs_firmware_update fips_block_device:blk_file rw_file_perms;
+allow ufs_firmware_update sysfs:dir r_dir_perms;
				`@@ -0,0 +1 @@`
				`set_prop(vendor_init, vendor_touch_dump_path_prop)`
				`@@ -0,0 +1 @@`
				`vendor_internal_prop(vendor_touch_dump_path_prop)`
				`@@ -0,0 +1 @@`
				`ro.vendor.touch.dump. u:object_r:vendor_touch_dump_path_prop:s0`