From 0393e7fbe6619fb10191a43f02b8f32c89e177a1 Mon Sep 17 00:00:00 2001 From: Welly Hsu Date: Tue, 3 Sep 2024 09:32:25 +0000 Subject: [PATCH 1/2] gs-common: add rules for euiccpixel_app 09-11 21:19:25.452 345 345 I auditd : avc: denied { find } for pid=14141 uid=10246 name=activity scontext=u:r:euiccpixel_app:s0:c246,c256,c512,c768 tcontext=u:object_r:activity_service:s0 tclass=service_manager permissive=0 09-11 21:20:57.035 345 345 I auditd : avc: denied { find } for pid=17450 uid=10246 name=netstats scontext=u:r:euiccpixel_app:s0:c246,c256,c512,c768 tcontext=u:object_r:netstats_service:s0 tclass=service_manager permissive=1 09-11 21:20:57.055 345 345 I auditd : avc: denied { find } for pid=17450 uid=10246 name=content_capture scontext=u:r:euiccpixel_app:s0:c246,c256,c512,c768 tcontext=u:object_r:content_capture_service:s0 tclass=service_manager permissive=1 09-11 21:20:57.064 345 345 I auditd : avc: denied { find } for pid=17450 uid=10246 name=activity_task scontext=u:r:euiccpixel_app:s0:c246,c256,c512,c768 tcontext=u:object_r:activity_task_service:s0 tclass=service_manager permissive=1 09-11 21:20:57.111 345 345 I auditd : avc: denied { find } for pid=17450 uid=10246 name=gpu scontext=u:r:euiccpixel_app:s0:c246,c256,c512,c768 tcontext=u:object_r:gpu_service:s0 tclass=service_manager permissive=1 09-11 21:20:57.182 345 345 I auditd : avc: denied { find } for pid=17450 uid=10246 name=voiceinteraction scontext=u:r:euiccpixel_app:s0:c246,c256,c512,c768 tcontext=u:object_r:voiceinteraction_service:s0 tclass=service_manager permissive=1 09-11 21:20:57.184 345 345 I auditd : avc: denied { find } for pid=17450 uid=10246 name=autofill scontext=u:r:euiccpixel_app:s0:c246,c256,c512,c768 tcontext=u:object_r:autofill_service:s0 tclass=service_manager permissive=1 09-11 21:20:57.190 345 345 I auditd : avc: denied { find } for pid=17450 uid=10246 name=sensitive_content_protection_service scontext=u:r:euiccpixel_app:s0:c246,c256,c512,c768 tcontext=u:object_r:sensitive_content_protection_service:s0 tclass=service_manager permissive=1 09-11 21:20:57.193 345 345 I auditd : avc: denied { find } for pid=17450 uid=10246 name=performance_hint scontext=u:r:euiccpixel_app:s0:c246,c256,c512,c768 tcontext=u:object_r:hint_service:s0 tclass=service_manager permissive=1 09-11 21:21:09.436 345 345 I auditd : avc: denied { find } for pid=17450 uid=10246 name=audio scontext=u:r:euiccpixel_app:s0:c246,c256,c512,c768 tcontext=u:object_r:audio_service:s0 tclass=service_manager permissive=1 09-11 21:21:09.449 345 345 I auditd : avc: denied { find } for pid=17450 uid=10246 name=batterystats scontext=u:r:euiccpixel_app:s0:c246,c256,c512,c768 tcontext=u:object_r:batterystats_service:s0 tclass=service_manager permissive=1 09-11 21:21:09.454 345 345 I auditd : avc: denied { find } for pid=17450 uid=10246 name=batteryproperties scontext=u:r:euiccpixel_app:s0:c246,c256,c512,c768 tcontext=u:object_r:batteryproperties_service:s0 tclass=service_manager permissive=1 09-11 23:21:26.678 345 345 I auditd : avc: denied { find } for pid=17450 uid=10246 name=permission_checker scontext=u:r:euiccpixel_app:s0:c246,c256,c512,c768 tcontext=u:object_r:permission_checker_service:s0 tclass=service_manager permissive=1 09-03 16:29:54.032 351 351 E SELinux : avc: denied { find } for pid=3914 uid=10217 name=phone scontext=u:r:euiccpixel_app:s0:c217,c256,c512,c768 tcontext=u:object_r:radio_service:s0 tclass=service_manager permissive=1 09-03 17:35:07.453 351 351 E SELinux : avc: denied { find } for pid=3914 uid=10217 name=nfc scontext=u:r:euiccpixel_app:s0:c217,c256,c512,c768 tcontext=u:object_r:nfc_service:s0 tclass=service_manager permissive=1 09-11 21:20:57.108 17450 17450 I auditd : type=1400 audit(0.0:1055): avc: denied { read } for comm="RenderThread" name="uevent" dev="sysfs" ino=46479 scontext=u:r:euiccpixel_app:s0:c246,c256,c512,c768 tcontext=u:object_r:sysfs:s0 tclass=file permissive=1 app=com.google.euiccpixel 09-11 21:20:57.108 17450 17450 I auditd : type=1400 audit(0.0:1056): avc: denied { open } for comm="RenderThread" path="/sys/devices/platform/34f00000.gpu0/uevent" dev="sysfs" ino=46479 scontext=u:r:euiccpixel_app:s0:c246,c256,c512,c768 tcontext=u:object_r:sysfs:s0 tclass=file permissive=1 app=com.google.euiccpixel 09-11 21:20:57.108 17450 17450 I auditd : type=1400 audit(0.0:1057): avc: denied { getattr } for comm="RenderThread" path="/sys/devices/platform/34f00000.gpu0/uevent" dev="sysfs" ino=46479 scontext=u:r:euiccpixel_app:s0:c246,c256,c512,c768 tcontext=u:object_r:sysfs:s0 tclass=file permissive=1 app=com.google.euiccpixel 09-11 21:21:48.494 12343 12343 I auditd : type=1400 audit(0.0:23): avc: denied { read write } for comm=4173796E635461736B202331 name="st54spi" dev="tmpfs" ino=1573 scontext=u:r:euiccpixel_app:s0:c3,c257,c522,c768 tcontext=u:object_r:st54spi_device:s0 tclass=chr_file permissive=1 09-11 21:20:57.108 17450 17450 I auditd : type=1400 audit(0.0:1056): avc: denied { read open } for comm="RenderThread" path="/sys/devices/platform/34f00000.gpu0/uevent" dev="sysfs" ino=46479 scontext=u:r:euiccpixel_app:s0:c246,c256,c512,c768 tcontext=u:object_r:sysfs:s0 tclass=file permissive=1 app=com.google.euiccpixel 09-11 21:20:57.108 17450 17450 I auditd : type=1400 audit(0.0:1057): avc: denied { getattr } for comm="RenderThread" path="/sys/devices/platform/34f00000.gpu0/uevent" dev="sysfs" ino=46479 scontext=u:r:euiccpixel_app:s0:c246,c256,c512,c768 tcontext=u:object_r:sysfs:s0 tclass=file permissive=1 app=com.google.euiccpixel 09-13 17:55:20.904 3776 3776 I auditd : type=1400 audit(0.0:1087): avc: denied { read } for comm="RenderThread" name="uevent" dev="sysfs" ino=46480 scontext=u:r:euiccpixel_app:s0:c225,c256,c512,c768 tcontext=u:object_r:sysfs_gpu_uevent:s0 tclass=file permissive=0 app=com.google.euiccpixel 09-13 18:18:26.988 4029 4029 I auditd : type=1400 audit(0.0:1077): avc: denied { open getattr } for comm="RenderThread" path="/sys/devices/platform/34f00000.gpu0/uevent" dev="sysfs" ino=46480 scontext=u:r:euiccpixel_app:s0:c225,c256,c512,c768 tcontext=u:object_r:sysfs_gpu_uevent:s0 tclass=file permissive=0 app=com.google.euiccpixel 09-13 17:55:20.996 3776 3776 I auditd : type=1400 audit(0.0:1090): avc: denied { read } for comm="ogle.euiccpixel" name="u:object_r:default_prop:s0" dev="tmpfs" ino=164 scontext=u:r:euiccpixel_app:s0:c225,c256,c512,c768 tcontext=u:object_r:default_prop:s0 tclass=file permissive=0 app=com.google.euiccpixel Bug: 361092897 Test: make selinux_policy, flash and test on 25' project Flag: EXEMPT NDK Change-Id: I8850fe0c1eae7dc575cb323d1f4a9234b7df82db --- euiccpixel_app/euiccpixel_app_st54.mk | 3 ++ .../common/certs/EuiccSupportPixel.x509.pem | 29 +++++++++++++++++++ .../sepolicy/common/euiccpixel_app.te | 27 +++++++++++++++++ euiccpixel_app/sepolicy/common/file.te | 2 ++ euiccpixel_app/sepolicy/common/genfs_contexts | 1 + euiccpixel_app/sepolicy/common/keys.conf | 2 ++ .../sepolicy/common/mac_permissions.xml | 27 +++++++++++++++++ euiccpixel_app/sepolicy/common/seapp_contexts | 2 ++ .../sepolicy/st54/euiccpixel_app.te | 8 +++++ 9 files changed, 101 insertions(+) create mode 100644 euiccpixel_app/euiccpixel_app_st54.mk create mode 100644 euiccpixel_app/sepolicy/common/certs/EuiccSupportPixel.x509.pem create mode 100644 euiccpixel_app/sepolicy/common/euiccpixel_app.te create mode 100644 euiccpixel_app/sepolicy/common/file.te create mode 100644 euiccpixel_app/sepolicy/common/genfs_contexts create mode 100644 euiccpixel_app/sepolicy/common/keys.conf create mode 100644 euiccpixel_app/sepolicy/common/mac_permissions.xml create mode 100644 euiccpixel_app/sepolicy/common/seapp_contexts create mode 100644 euiccpixel_app/sepolicy/st54/euiccpixel_app.te diff --git a/euiccpixel_app/euiccpixel_app_st54.mk b/euiccpixel_app/euiccpixel_app_st54.mk new file mode 100644 index 0000000..e96d06c --- /dev/null +++ b/euiccpixel_app/euiccpixel_app_st54.mk @@ -0,0 +1,3 @@ +BOARD_VENDOR_SEPOLICY_DIRS += device/google/gs-common/euiccpixel_app/sepolicy/common +BOARD_VENDOR_SEPOLICY_DIRS += device/google/gs-common/euiccpixel_app/sepolicy/st54 +PRODUCT_PACKAGES += EuiccSupportPixel-P23 diff --git a/euiccpixel_app/sepolicy/common/certs/EuiccSupportPixel.x509.pem b/euiccpixel_app/sepolicy/common/certs/EuiccSupportPixel.x509.pem new file mode 100644 index 0000000..be303df --- /dev/null +++ b/euiccpixel_app/sepolicy/common/certs/EuiccSupportPixel.x509.pem @@ -0,0 +1,29 @@ +-----BEGIN CERTIFICATE----- +MIIF2zCCA8OgAwIBAgIVAIFP2e+Gh4wn4YFsSI7fRB6AXjIsMA0GCSqGSIb3DQEBCwUAMH4xCzAJ +BgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1Nb3VudGFpbiBWaWV3MRQw +EgYDVQQKEwtHb29nbGUgSW5jLjEQMA4GA1UECxMHQW5kcm9pZDEaMBgGA1UEAxMRRXVpY2NTdXBw +b3J0UGl4ZWwwHhcNMTkwMjI4MTkyMjE4WhcNNDkwMjI4MTkyMjE4WjB+MQswCQYDVQQGEwJVUzET +MBEGA1UECBMKQ2FsaWZvcm5pYTEWMBQGA1UEBxMNTW91bnRhaW4gVmlldzEUMBIGA1UEChMLR29v +Z2xlIEluYy4xEDAOBgNVBAsTB0FuZHJvaWQxGjAYBgNVBAMTEUV1aWNjU3VwcG9ydFBpeGVsMIIC +IjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAqklePqeltzqnyXVch9eJRXFBRQQIBIJWhcXb +WIP/kZ28ISnQ2SrZisdxqtvRIeInxb7lU1rRQDfqCFSp/vMZ3l25Ryn6OVLFP4bxV1vO797t7Ef/ +amYA1mFKBsD4KLaIGj0/2RpGesneCOb0jWl2yRgIO2Ez7Y4YgWU/IoickZDLp1u6/7e7E/Qq9OXK +aXvtBSzooGrYC7eyKn7O21FOfz5cQRo4BipjJqXG5Ez8Vi+m/dL1IFRZheYttEf3v390vBcb0oJ0 +oYPzLxmnb1LchjZC3yLAknRA0hNt8clvJ3tjXFjtzCGKsQsT4rnvvGFFABJTCf3EdEiwBNS5U4ho ++9+EtH7PpuoC+uVv2rLv/Gb7stlGQGx32KmK2CfKED3PdNqoT7WRx6nvVjCk3i7afdUcxQxcS9td +5r80CB1bQEhS2sWLWB21PJrfMugWUJO5Bwz6u0es8dP+4FAHojIaF6iwB5ZYIuHGcEaOviHm4jOK +rrGMlLqTwuEhq2aVIP55u7XRV98JLs2hlE5DJOWCIsPxybUDiddFvR+yzi/4FimsxJlEmaQAQcki +uJ9DceVP03StPzFJSDRlqa4yF6xkZW5piNoANQ4MyI67V2Qf8g/L1UPYAi4hUMxQGo7Clw2hBRag +ZTm65Xc7+ovBYxl5YaXAmNoJbss34Lw8tdrn4EECAwEAAaNQME4wDAYDVR0TBAUwAwEB/zAdBgNV +HQ4EFgQU+hQdFrOGuCDI+bbebssw9TL5FcYwHwYDVR0jBBgwFoAU+hQdFrOGuCDI+bbebssw9TL5 +FcYwDQYJKoZIhvcNAQELBQADggIBAGmyZHXddei/zUUMowiyi/MTtqXf9hKDEN4zhAXkuiuHxqA9 +Ii0J1Sxz2dd5NkqMmtePKYFSGA884yVm1KAne/uoCWj57IK3jswiRYnKhXa293DxA/K9wY27IGbp +ulSuuxbpjjV2tqGUuoNQGKX7Oy6s0GcibyZFc+LpD7ttGk5QoLC9qQdpXZgUv/yG2B99ERSXLCaL +EWMNP/oVZQOCQGfsFM1fPLn3X0ZuCOQg9bljxFf3jTl+H6PIAhpCjKeeUQYLc41eQkCyR/f67aRB +GvO4YDpXLn9eH23B+26rjPyFiVtMJ/jJZ7UEPeJ3XBj1COS/X7p9gGRS5rtfr9z7XxuMxvG0JU9U +XA+bMfOOfCqflvw6IyUg+oxjBFIhgiP4fxna51+BqpctvB0OeRwUm6y4nN06AwqtD8SteQrEn0b0 +IDWOKlVeh0lJWrDDEHr55dXSF+CbOPUDmMxmGoulOEOy/qSWIQi8BfvdX+e88CmracNRYVffLuQj +pRYN3TeiCJd+6/X9/x1Q8VLW7vOAb6uRyE2lOjX40DYBxK3xSq6J7Vp38f6z0vtQm2sAAQ4xqqon +A9tB5p+nJlYHgSxXOZx3C13Rs/eMmiGCKkSpCTnGCgBC7PfJDdMK6SLw5Gn4oyGoZo4fXbADuHrU +0JD1T1qdCm3aUSEmFgEA4rOL/0K3 +-----END CERTIFICATE----- diff --git a/euiccpixel_app/sepolicy/common/euiccpixel_app.te b/euiccpixel_app/sepolicy/common/euiccpixel_app.te new file mode 100644 index 0000000..8093b49 --- /dev/null +++ b/euiccpixel_app/sepolicy/common/euiccpixel_app.te @@ -0,0 +1,27 @@ +# Euiccpixel_app +type euiccpixel_app, domain; +app_domain(euiccpixel_app) + +allow euiccpixel_app activity_service:service_manager find; +allow euiccpixel_app netstats_service:service_manager find; +allow euiccpixel_app content_capture_service:service_manager find; +allow euiccpixel_app activity_task_service:service_manager find; +allow euiccpixel_app gpu_service:service_manager find; +allow euiccpixel_app voiceinteraction_service:service_manager find; +allow euiccpixel_app autofill_service:service_manager find; +allow euiccpixel_app sensitive_content_protection_service:service_manager find; +allow euiccpixel_app hint_service:service_manager find; +allow euiccpixel_app audio_service:service_manager find; +allow euiccpixel_app batterystats_service:service_manager find; +allow euiccpixel_app batteryproperties_service:service_manager find; +allow euiccpixel_app permission_checker_service:service_manager find; +allow euiccpixel_app radio_service:service_manager find; +allow euiccpixel_app nfc_service:service_manager find; + +set_prop(euiccpixel_app, vendor_secure_element_prop) +set_prop(euiccpixel_app, vendor_modem_prop) +get_prop(euiccpixel_app, dck_prop) + +# b/265286368 framework UI rendering properties and file access +dontaudit euiccpixel_app default_prop:file { read }; +dontaudit euiccpixel_app sysfs_gpu_uevent:file { read open getattr }; diff --git a/euiccpixel_app/sepolicy/common/file.te b/euiccpixel_app/sepolicy/common/file.te new file mode 100644 index 0000000..e76ee79 --- /dev/null +++ b/euiccpixel_app/sepolicy/common/file.te @@ -0,0 +1,2 @@ +# type for gpu uevent +type sysfs_gpu_uevent, sysfs_type, fs_type; diff --git a/euiccpixel_app/sepolicy/common/genfs_contexts b/euiccpixel_app/sepolicy/common/genfs_contexts new file mode 100644 index 0000000..fc146df --- /dev/null +++ b/euiccpixel_app/sepolicy/common/genfs_contexts @@ -0,0 +1 @@ +genfscon sysfs /devices/platform/34f00000.gpu0/uevent u:object_r:sysfs_gpu_uevent:s0 diff --git a/euiccpixel_app/sepolicy/common/keys.conf b/euiccpixel_app/sepolicy/common/keys.conf new file mode 100644 index 0000000..7071a2a --- /dev/null +++ b/euiccpixel_app/sepolicy/common/keys.conf @@ -0,0 +1,2 @@ +[@EUICCSUPPORTPIXEL] +ALL : device/google/gs-common/euiccpixel_app/sepolicy/common/certs/EuiccSupportPixel.x509.pem diff --git a/euiccpixel_app/sepolicy/common/mac_permissions.xml b/euiccpixel_app/sepolicy/common/mac_permissions.xml new file mode 100644 index 0000000..0eab982 --- /dev/null +++ b/euiccpixel_app/sepolicy/common/mac_permissions.xml @@ -0,0 +1,27 @@ + + + + + + + + + diff --git a/euiccpixel_app/sepolicy/common/seapp_contexts b/euiccpixel_app/sepolicy/common/seapp_contexts new file mode 100644 index 0000000..9501a3a --- /dev/null +++ b/euiccpixel_app/sepolicy/common/seapp_contexts @@ -0,0 +1,2 @@ +# Domain for EuiccSupportPixel +user=_app isPrivApp=true seinfo=EuiccSupportPixel name=com.google.euiccpixel domain=euiccpixel_app type=app_data_file levelFrom=all diff --git a/euiccpixel_app/sepolicy/st54/euiccpixel_app.te b/euiccpixel_app/sepolicy/st54/euiccpixel_app.te new file mode 100644 index 0000000..3d81a57 --- /dev/null +++ b/euiccpixel_app/sepolicy/st54/euiccpixel_app.te @@ -0,0 +1,8 @@ +# euiccpixel requires st54spi for firmware upgrade +userdebug_or_eng(` + net_domain(euiccpixel_app) + + # Access to directly upgrade firmware on st54spi_device used for engineering devices + typeattribute st54spi_device mlstrustedobject; + allow euiccpixel_app st54spi_device:chr_file rw_file_perms; +') From d43a6e1c5a677614ff924bf9b47ed165e908a4de Mon Sep 17 00:00:00 2001 From: "Priyanka Advani (xWF)" Date: Mon, 16 Sep 2024 16:58:16 +0000 Subject: [PATCH 2/2] Revert^2 "Allow devices that use HIDL to find AIDL radio_ext_service" This reverts commit 1685969e605263ad55f1f75e50584dc0f12bd99a. Reason for revert: Droidmonitor created revert due to b/367330939. Change-Id: Idd70cf3d846fad1a25060ebfb6ae6a99599fd861 --- gril/aidl/2.0/gril_aidl.mk | 1 + gril/aidl/2.0/sepolicy/grilservice_app.te | 4 ++-- gril/aidl/2.0/sepolicy/hal_aidl_radio_ext.te | 2 +- gril/aidl/2.0/sepolicy/service.te | 2 -- {modem/radio_ext => gril/common}/sepolicy/service.te | 1 + gril/{aidl/2.0 => common}/sepolicy/service_contexts | 2 +- gril/hidl/1.7/gril_hidl.mk | 1 + gril/hidl/1.7/sepolicy/grilservice_app.te | 2 ++ modem/radio_ext/radio_ext.mk | 1 + 9 files changed, 10 insertions(+), 6 deletions(-) delete mode 100644 gril/aidl/2.0/sepolicy/service.te rename {modem/radio_ext => gril/common}/sepolicy/service.te (68%) rename gril/{aidl/2.0 => common}/sepolicy/service_contexts (64%) diff --git a/gril/aidl/2.0/gril_aidl.mk b/gril/aidl/2.0/gril_aidl.mk index b7d5133..d4fa9e9 100644 --- a/gril/aidl/2.0/gril_aidl.mk +++ b/gril/aidl/2.0/gril_aidl.mk @@ -1,3 +1,4 @@ PRODUCT_PACKAGES += vendor.google.radioext@1.0-service DEVICE_PRODUCT_COMPATIBILITY_MATRIX_FILE += device/google/gs-common/gril/aidl/2.0/compatibility_matrix.xml BOARD_VENDOR_SEPOLICY_DIRS += device/google/gs-common/gril/aidl/2.0/sepolicy +BOARD_VENDOR_SEPOLICY_DIRS += device/google/gs-common/gril/common/sepolicy diff --git a/gril/aidl/2.0/sepolicy/grilservice_app.te b/gril/aidl/2.0/sepolicy/grilservice_app.te index 8f49afa..812c8a2 100644 --- a/gril/aidl/2.0/sepolicy/grilservice_app.te +++ b/gril/aidl/2.0/sepolicy/grilservice_app.te @@ -1,4 +1,4 @@ -# allow grilservice_app to find hal_aidl_radio_ext_service -allow grilservice_app hal_aidl_radio_ext_service:service_manager find; +# allow grilservice_app to find hal_radio_ext_service +allow grilservice_app hal_radio_ext_service:service_manager find; binder_call(grilservice_app, hal_aidl_radio_ext) binder_call(grilservice_app, twoshay) diff --git a/gril/aidl/2.0/sepolicy/hal_aidl_radio_ext.te b/gril/aidl/2.0/sepolicy/hal_aidl_radio_ext.te index ad6c86b..68dd397 100644 --- a/gril/aidl/2.0/sepolicy/hal_aidl_radio_ext.te +++ b/gril/aidl/2.0/sepolicy/hal_aidl_radio_ext.te @@ -12,7 +12,7 @@ binder_call(hal_aidl_radio_ext, servicemanager) binder_call(hal_aidl_radio_ext, grilservice_app) binder_call(hal_aidl_radio_ext, hal_bluetooth_btlinux) -add_service(hal_aidl_radio_ext, hal_aidl_radio_ext_service) +add_service(hal_aidl_radio_ext, hal_radio_ext_service) # RW /dev/oem_ipc0 allow hal_aidl_radio_ext radio_device:chr_file rw_file_perms; diff --git a/gril/aidl/2.0/sepolicy/service.te b/gril/aidl/2.0/sepolicy/service.te deleted file mode 100644 index 24aa71e..0000000 --- a/gril/aidl/2.0/sepolicy/service.te +++ /dev/null @@ -1,2 +0,0 @@ -# Radio Ext AIDL service -type hal_aidl_radio_ext_service, hal_service_type, protected_service, service_manager_type; diff --git a/modem/radio_ext/sepolicy/service.te b/gril/common/sepolicy/service.te similarity index 68% rename from modem/radio_ext/sepolicy/service.te rename to gril/common/sepolicy/service.te index 7288ef1..ee6fb77 100644 --- a/modem/radio_ext/sepolicy/service.te +++ b/gril/common/sepolicy/service.te @@ -1,2 +1,3 @@ # Radio Ext AIDL service +# Shared definition so a single type is referenced type hal_radio_ext_service, hal_service_type, protected_service, service_manager_type; diff --git a/gril/aidl/2.0/sepolicy/service_contexts b/gril/common/sepolicy/service_contexts similarity index 64% rename from gril/aidl/2.0/sepolicy/service_contexts rename to gril/common/sepolicy/service_contexts index 7b96182..7e50c2e 100644 --- a/gril/aidl/2.0/sepolicy/service_contexts +++ b/gril/common/sepolicy/service_contexts @@ -1 +1 @@ -vendor.google.radio_ext.IRadioExt/default u:object_r:hal_aidl_radio_ext_service:s0 +vendor.google.radio_ext.IRadioExt/default u:object_r:hal_radio_ext_service:s0 diff --git a/gril/hidl/1.7/gril_hidl.mk b/gril/hidl/1.7/gril_hidl.mk index fcd5ef8..0008a5d 100644 --- a/gril/hidl/1.7/gril_hidl.mk +++ b/gril/hidl/1.7/gril_hidl.mk @@ -1,3 +1,4 @@ PRODUCT_PACKAGES += vendor.google.radioext@1.0-service DEVICE_PRODUCT_COMPATIBILITY_MATRIX_FILE += device/google/gs-common/gril/hidl/1.7/compatibility_matrix.xml BOARD_VENDOR_SEPOLICY_DIRS += device/google/gs-common/gril/hidl/1.7/sepolicy +BOARD_VENDOR_SEPOLICY_DIRS += device/google/gs-common/gril/common/sepolicy diff --git a/gril/hidl/1.7/sepolicy/grilservice_app.te b/gril/hidl/1.7/sepolicy/grilservice_app.te index 43da795..3a170b8 100644 --- a/gril/hidl/1.7/sepolicy/grilservice_app.te +++ b/gril/hidl/1.7/sepolicy/grilservice_app.te @@ -1,2 +1,4 @@ +# allow grilservice_app to find hal_radio_ext_service +allow grilservice_app hal_radio_ext_service:service_manager find; # allow grilservice_app to binder call hal_radioext_default binder_call(grilservice_app, hal_radioext_default) diff --git a/modem/radio_ext/radio_ext.mk b/modem/radio_ext/radio_ext.mk index 6750fdd..1df3bcc 100644 --- a/modem/radio_ext/radio_ext.mk +++ b/modem/radio_ext/radio_ext.mk @@ -3,3 +3,4 @@ PRODUCT_PACKAGES += vendor.google.radio_ext-service DEVICE_PRODUCT_COMPATIBILITY_MATRIX_FILE += device/google/gs-common/modem/radio_ext/compatibility_matrix.xml BOARD_VENDOR_SEPOLICY_DIRS += device/google/gs-common/modem/radio_ext/sepolicy +BOARD_VENDOR_SEPOLICY_DIRS += device/google/gs-common/gril/common/sepolicy