Add 'sepolicy/' from tag 'android-15.0.0_r2'
git-subtree-dir: sepolicy git-subtree-mainline:e3b10c7b99git-subtree-split:b533a0a66dChange-Id: Ib092346a141d5b4455aaade3be274f75c98f40cf
This commit is contained in:
Michael Bestas
commit
bfc5da8a23
23 changed files with 158 additions and 0 deletions
4
sepolicy/OWNERS
Normal file
4
sepolicy/OWNERS
Normal file
|
|
@ -0,0 +1,4 @@
|
|||
include device/google/gs-common:/sepolicy/OWNERS
|
||||
|
||||
adamshih@google.com
|
||||
|
||||
6
sepolicy/comet-sepolicy.mk
Normal file
6
sepolicy/comet-sepolicy.mk
Normal file
|
|
@ -0,0 +1,6 @@
|
|||
# sepolicy exclusively for comet.
|
||||
BOARD_SEPOLICY_DIRS += device/google/comet-sepolicy/vendor
|
||||
|
||||
# system_ext
|
||||
SYSTEM_EXT_PUBLIC_SEPOLICY_DIRS += device/google/comet-sepolicy/system_ext/public
|
||||
SYSTEM_EXT_PRIVATE_SEPOLICY_DIRS += device/google/comet-sepolicy/system_ext/private
|
||||
2
sepolicy/system_ext/private/gmscore_app.te
Normal file
2
sepolicy/system_ext/private/gmscore_app.te
Normal file
|
|
@ -0,0 +1,2 @@
|
|||
# Allow to read setupwizard_feature_prop
|
||||
get_prop(gmscore_app, setupwizard_feature_prop)
|
||||
2
sepolicy/system_ext/private/priv_app.te
Normal file
2
sepolicy/system_ext/private/priv_app.te
Normal file
|
|
@ -0,0 +1,2 @@
|
|||
# Allow to read setupwizard_feature_prop
|
||||
get_prop(priv_app, setupwizard_feature_prop)
|
||||
2
sepolicy/system_ext/private/property_contexts
Normal file
2
sepolicy/system_ext/private/property_contexts
Normal file
|
|
@ -0,0 +1,2 @@
|
|||
# setupwizard
|
||||
setupwizard.feature.provisioning_profile_mode u:object_r:setupwizard_feature_prop:s0
|
||||
2
sepolicy/system_ext/public/property.te
Normal file
2
sepolicy/system_ext/public/property.te
Normal file
|
|
@ -0,0 +1,2 @@
|
|||
# setupwizard
|
||||
system_public_prop(setupwizard_feature_prop)
|
||||
2
sepolicy/tracking_denials/README.txt
Normal file
2
sepolicy/tracking_denials/README.txt
Normal file
|
|
@ -0,0 +1,2 @@
|
|||
This folder stores known errors detected by PTS. Be sure to remove relevant
|
||||
files to reproduce error log on latest ROMs.
|
||||
1
sepolicy/tracking_denials/bug_map
Normal file
1
sepolicy/tracking_denials/bug_map
Normal file
|
|
@ -0,0 +1 @@
|
|||
|
||||
2
sepolicy/vendor/README.txt
vendored
Normal file
2
sepolicy/vendor/README.txt
vendored
Normal file
|
|
@ -0,0 +1,2 @@
|
|||
This folder holds sepolicy exclusively for one device. For example, genfs_contexts
|
||||
paths that are affected by device tree.
|
||||
1
sepolicy/vendor/file.te
vendored
Normal file
1
sepolicy/vendor/file.te
vendored
Normal file
|
|
@ -0,0 +1 @@
|
|||
type sysfs_fingerprint, sysfs_type, fs_type;
|
||||
29
sepolicy/vendor/file_contexts
vendored
Normal file
29
sepolicy/vendor/file_contexts
vendored
Normal file
|
|
@ -0,0 +1,29 @@
|
|||
# Devices
|
||||
/dev/lwis-act-cornerfolk u:object_r:lwis_device:s0
|
||||
/dev/lwis-act-jotnar u:object_r:lwis_device:s0
|
||||
/dev/lwis-act-nessie u:object_r:lwis_device:s0
|
||||
/dev/lwis-eeprom-jotnar u:object_r:lwis_device:s0
|
||||
/dev/lwis-eeprom-nessie u:object_r:lwis_device:s0
|
||||
/dev/lwis-eeprom-smaug-imentet u:object_r:lwis_device:s0
|
||||
/dev/lwis-eeprom-smaug-svarog u:object_r:lwis_device:s0
|
||||
/dev/lwis-eeprom-smaug-svarog-outer u:object_r:lwis_device:s0
|
||||
/dev/lwis-flash-lm3644 u:object_r:lwis_device:s0
|
||||
/dev/lwis-ois-jotnar u:object_r:lwis_device:s0
|
||||
/dev/lwis-ois-nessie u:object_r:lwis_device:s0
|
||||
/dev/lwis-sensor-dokkaebi-tele u:object_r:lwis_device:s0
|
||||
/dev/lwis-sensor-imentet u:object_r:lwis_device:s0
|
||||
/dev/lwis-sensor-oksoko u:object_r:lwis_device:s0
|
||||
/dev/lwis-sensor-svarog u:object_r:lwis_device:s0
|
||||
/dev/lwis-sensor-svarog-outer u:object_r:lwis_device:s0
|
||||
/dev/lwis-tof-tarasque u:object_r:lwis_device:s0
|
||||
|
||||
# Services
|
||||
/vendor/bin/init_thermal_config u:object_r:init_thermal_config_exec:s0
|
||||
# FPC AIDL HAL
|
||||
/vendor/bin/hw/android\.hardware\.biometrics\.fingerprint-service\.fpc42_fw49 u:object_r:hal_fingerprint_capacitance_exec:s0
|
||||
|
||||
# FPC HIDL HAL
|
||||
/vendor/bin/hw/android\.hardware\.biometrics\.fingerprint@2\.1-service\.fpc u:object_r:fingerprint_factory_service_exec:s0
|
||||
|
||||
# Touch
|
||||
/dev/touch_offload_outer u:object_r:touch_offload_device:s0
|
||||
3
sepolicy/vendor/fingerprint_factory_service.te
vendored
Normal file
3
sepolicy/vendor/fingerprint_factory_service.te
vendored
Normal file
|
|
@ -0,0 +1,3 @@
|
|||
type fingerprint_factory_service, service_manager_type;
|
||||
type fingerprint_factory_service_exec, exec_type, vendor_file_type, file_type;
|
||||
init_daemon_domain(fingerprint_factory_service)
|
||||
44
sepolicy/vendor/genfs_contexts
vendored
Normal file
44
sepolicy/vendor/genfs_contexts
vendored
Normal file
|
|
@ -0,0 +1,44 @@
|
|||
# Display
|
||||
genfscon sysfs /devices/platform/19450000.drmdsim/19450000.drmdsim.0/available_disp_stats u:object_r:sysfs_display:s0
|
||||
genfscon sysfs /devices/platform/19450000.drmdsim/19450000.drmdsim.0/gamma u:object_r:sysfs_display:s0
|
||||
genfscon sysfs /devices/platform/19450000.drmdsim/19450000.drmdsim.0/min_vrefresh u:object_r:sysfs_display:s0
|
||||
genfscon sysfs /devices/platform/19450000.drmdsim/19450000.drmdsim.0/idle_delay_ms u:object_r:sysfs_display:s0
|
||||
genfscon sysfs /devices/platform/19450000.drmdsim/19450000.drmdsim.0/panel_idle u:object_r:sysfs_display:s0
|
||||
genfscon sysfs /devices/platform/19450000.drmdsim/19450000.drmdsim.0/panel_need_handle_idle_exit u:object_r:sysfs_display:s0
|
||||
genfscon sysfs /devices/platform/19450000.drmdsim/19450000.drmdsim.0/op_hz u:object_r:sysfs_display:s0
|
||||
genfscon sysfs /devices/platform/19450000.drmdsim/hs_clock u:object_r:sysfs_display:s0
|
||||
genfscon sysfs /devices/platform/19450000.drmdsim/19450000.drmdsim.0/backlight u:object_r:sysfs_leds:s0
|
||||
genfscon sysfs /devices/platform/19450000.drmdsim/19450000.drmdsim.0/power_state u:object_r:sysfs_display:s0
|
||||
genfscon sysfs /devices/platform/19450000.drmdsim/19450000.drmdsim.0/panel_extinfo u:object_r:sysfs_display:s0
|
||||
genfscon sysfs /devices/platform/19450000.drmdsim/19450000.drmdsim.0/panel_name u:object_r:sysfs_display:s0
|
||||
genfscon sysfs /devices/platform/19450000.drmdsim/19450000.drmdsim.0/serial_number u:object_r:sysfs_display:s0
|
||||
genfscon sysfs /devices/platform/19450000.drmdsim/19450000.drmdsim.0/refresh_rate u:object_r:sysfs_display:s0
|
||||
genfscon sysfs /devices/platform/19450000.drmdsim/19450000.drmdsim.0/refresh_ctrl u:object_r:sysfs_display:s0
|
||||
genfscon sysfs /devices/platform/19450000.drmdsim/19450000.drmdsim.0/time_in_state u:object_r:sysfs_display:s0
|
||||
genfscon sysfs /devices/platform/19450000.drmdsim/19450000.drmdsim.0/panel_model u:object_r:sysfs_display:s0
|
||||
genfscon sysfs /devices/platform/19450000.drmdsim/19450000.drmdsim.0/backlight/panel0-backlight/als_table u:object_r:sysfs_write_leds:s0
|
||||
genfscon sysfs /devices/platform/19450000.drmdsim/19450000.drmdsim.0/error_count_te u:object_r:sysfs_display:s0
|
||||
genfscon sysfs /devices/platform/19450000.drmdsim/19450000.drmdsim.0/error_count_unknown u:object_r:sysfs_display:s0
|
||||
genfscon sysfs /devices/platform/19471000.drmdecon/dqe1/atc u:object_r:sysfs_display:s0
|
||||
|
||||
# Battery
|
||||
genfscon sysfs /devices/platform/10ca0000.hsi2c/i2c-10/10-0036/power_supply u:object_r:sysfs_batteryinfo:s0
|
||||
genfscon sysfs /devices/platform/10ca0000.hsi2c/i2c-10/10-0061/power_supply u:object_r:sysfs_batteryinfo:s0
|
||||
genfscon sysfs /devices/platform/google,dual_batt_gauge/power_supply u:object_r:sysfs_batteryinfo:s0
|
||||
|
||||
# wake up nodes
|
||||
genfscon sysfs /devices/platform/108d0000.hsi2c/i2c-6/6-0036/power_supply/maxfg_base/power/wakeup u:object_r:sysfs_wakeup:s0
|
||||
genfscon sysfs /devices/platform/108d0000.hsi2c/i2c-6/6-0036/power_supply/maxfg_base/wakeup u:object_r:sysfs_wakeup:s0
|
||||
genfscon sysfs /devices/platform/10ca0000.hsi2c/i2c-10/10-0036/power/wakeup u:object_r:sysfs_wakeup:s0
|
||||
genfscon sysfs /devices/platform/10ca0000.hsi2c/i2c-10/10-0036/power_supply/maxfg_secondary/power/wakeup u:object_r:sysfs_wakeup:s0
|
||||
genfscon sysfs /devices/platform/10ca0000.hsi2c/i2c-10/10-0036/power_supply/maxfg_secondary/wakeup u:object_r:sysfs_wakeup:s0
|
||||
genfscon sysfs /devices/platform/10ca0000.hsi2c/i2c-10/10-0036/wakeup u:object_r:sysfs_wakeup:s0
|
||||
genfscon sysfs /devices/platform/110f0000.drmdp/wakeup u:object_r:sysfs_wakeup:s0
|
||||
genfscon sysfs /devices/platform/111c0000.spi/spi_master/spi19/spi19.0/synaptics_tcm.0/power/wakeup u:object_r:sysfs_wakeup:s0
|
||||
genfscon sysfs /devices/platform/111c0000.spi/spi_master/spi19/spi19.0/synaptics_tcm.0/wakeup u:object_r:sysfs_wakeup:s0
|
||||
genfscon sysfs /devices/platform/google,dual_batt_gauge/power_supply/dualbatt/power/wakeup u:object_r:sysfs_wakeup:s0
|
||||
genfscon sysfs /devices/platform/google,dual_batt_gauge/power_supply/dualbatt/wakeup u:object_r:sysfs_wakeup:s0
|
||||
genfscon sysfs /devices/platform/odm/odm:fp_fpc1020/wakeup u:object_r:sysfs_wakeup:s0
|
||||
# WLC
|
||||
genfscon sysfs /devices/platform/10ca0000.hsi2c/i2c-10/10-0061 u:object_r:sysfs_wlc:s0
|
||||
genfscon sysfs /devices/platform/odm/odm:fp_fpc1020 u:object_r:sysfs_fingerprint:s0
|
||||
2
sepolicy/vendor/grilservice_app.te
vendored
Normal file
2
sepolicy/vendor/grilservice_app.te
vendored
Normal file
|
|
@ -0,0 +1,2 @@
|
|||
allow grilservice_app gril_antenna_tuning_service:service_manager find;
|
||||
binder_call(grilservice_app, twoshay)
|
||||
36
sepolicy/vendor/hal_fingerprint_capacitance.te
vendored
Normal file
36
sepolicy/vendor/hal_fingerprint_capacitance.te
vendored
Normal file
|
|
@ -0,0 +1,36 @@
|
|||
# hal_fingerprint_capacitance definition
|
||||
type hal_fingerprint_capacitance, domain;
|
||||
hal_server_domain(hal_fingerprint_capacitance, hal_fingerprint)
|
||||
|
||||
type hal_fingerprint_capacitance_exec, exec_type, vendor_file_type, file_type;
|
||||
init_daemon_domain(hal_fingerprint_capacitance)
|
||||
|
||||
# allow fingerprint to access file
|
||||
allow hal_fingerprint_capacitance tee_device:chr_file rw_file_perms;
|
||||
allow hal_fingerprint_capacitance sysfs_fingerprint:dir r_dir_perms;
|
||||
allow hal_fingerprint_capacitance sysfs_fingerprint:file rw_file_perms;
|
||||
|
||||
# allow fingerprint to access wakeup node
|
||||
allow hal_fingerprint_capacitance sysfs_wakeup:file rw_file_perms;
|
||||
|
||||
# allow fingerprint to access power hal
|
||||
hal_client_domain(hal_fingerprint_capacitance, hal_power);
|
||||
|
||||
# allow fingerprint to find fwk service
|
||||
allow hal_fingerprint_capacitance fwk_stats_service:service_manager find;
|
||||
|
||||
# allow fingerprint to access input_device
|
||||
allow hal_fingerprint_capacitance input_device:dir r_dir_perms;
|
||||
allow hal_fingerprint_capacitance input_device:chr_file rw_file_perms;
|
||||
|
||||
# allow fingerprint to access hwservice
|
||||
add_hwservice(hal_fingerprint_capacitance, hal_fingerprint_capacitance_ext_hwservice)
|
||||
|
||||
# allow fingerprint to access servicemanager
|
||||
binder_call(hal_fingerprint_capacitance, servicemanager)
|
||||
|
||||
# allow fingerprint to access fwk sensor hwservice
|
||||
allow hal_fingerprint_capacitance fwk_sensor_service:service_manager find;
|
||||
|
||||
# allow fingerprint to access fingerprint property
|
||||
set_prop(hal_fingerprint_capacitance, vendor_fingerprint_prop)
|
||||
1
sepolicy/vendor/hwservice.te
vendored
Normal file
1
sepolicy/vendor/hwservice.te
vendored
Normal file
|
|
@ -0,0 +1 @@
|
|||
type hal_fingerprint_capacitance_ext_hwservice, hwservice_manager_type;
|
||||
2
sepolicy/vendor/hwservice_contexts
vendored
Normal file
2
sepolicy/vendor/hwservice_contexts
vendored
Normal file
|
|
@ -0,0 +1,2 @@
|
|||
com.fingerprints42.extension::IFingerprintEngineering u:object_r:hal_fingerprint_capacitance_ext_hwservice:s0
|
||||
com.fingerprints42.extension::IFingerprintSensorTest u:object_r:hal_fingerprint_capacitance_ext_hwservice:s0
|
||||
5
sepolicy/vendor/init_thermal_config.te
vendored
Normal file
5
sepolicy/vendor/init_thermal_config.te
vendored
Normal file
|
|
@ -0,0 +1,5 @@
|
|||
type init_thermal_config, domain;
|
||||
type init_thermal_config_exec, exec_type, vendor_file_type, file_type;
|
||||
init_daemon_domain(init_thermal_config);
|
||||
|
||||
set_prop(init_thermal_config, vendor_thermal_prop)
|
||||
1
sepolicy/vendor/service_contexts
vendored
Normal file
1
sepolicy/vendor/service_contexts
vendored
Normal file
|
|
@ -0,0 +1 @@
|
|||
com.google.hardware.pixel.display.IDisplay/secondary u:object_r:hal_pixel_display_service:s0
|
||||
1
sepolicy/vendor/servicemanager.te
vendored
Normal file
1
sepolicy/vendor/servicemanager.te
vendored
Normal file
|
|
@ -0,0 +1 @@
|
|||
#binder_call(servicemanager, hal_fingerprint_capacitance)
|
||||
2
sepolicy/vendor/system_app.te
vendored
Normal file
2
sepolicy/vendor/system_app.te
vendored
Normal file
|
|
@ -0,0 +1,2 @@
|
|||
# TODO (b/306087355) Remove this and make it specific to the app
|
||||
hal_client_domain(system_app, hal_fingerprint)
|
||||
3
sepolicy/vendor/systemui_app.te
vendored
Normal file
3
sepolicy/vendor/systemui_app.te
vendored
Normal file
|
|
@ -0,0 +1,3 @@
|
|||
# TODO (b/264266705) Remove this and make it specific to the app
|
||||
# allow SystemUIGoogle to access fingerprint hal
|
||||
hal_client_domain(systemui_app, hal_fingerprint)
|
||||
5
sepolicy/vendor/vendor_init.te
vendored
Normal file
5
sepolicy/vendor/vendor_init.te
vendored
Normal file
|
|
@ -0,0 +1,5 @@
|
|||
# Camera vendor property
|
||||
set_prop(vendor_init, vendor_camera_debug_prop)
|
||||
|
||||
# setupwizard
|
||||
set_prop(vendor_init, setupwizard_feature_prop)
|
||||
Loading…
Add table
Add a link
Reference in a new issue