Evolution-X-Tensor/device_google_gs-common
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Move dauntless settings to gs-common

Browse source 
Bug: 242479757
Test: build pass on all Gchip devices
Change-Id: Idfd52a88a420f04169b273a1ef575f10b92874c1
This commit is contained in:
Adam Shih 2022-08-30 11:54:49 +08:00
parent 03c4764838
commit 33aa7718bc
13 changed files with 100 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

19
dauntless/gsc.mk
View file

@ -1,2 +1,19 @@
PRODUCT_PACKAGES += dump_gsc.sh
# Dauntless
BOARD_VENDOR_SEPOLICY_DIRS += device/google/gs-common/dauntless/sepolicy
PRODUCT_SOONG_NAMESPACES += vendor/google_nos/init/dauntless
PRODUCT_PACKAGES += \
citadeld \
citadel_updater \
android.hardware.weaver@1.0-service.citadel \
android.hardware.identity@1.0-service.citadel \
init_citadel \
android.hardware.strongbox_keystore.xml \
android.hardware.security.keymint-service.citadel \
dump_gsc.sh
# USERDEBUG ONLY: Install test packages
PRODUCT_PACKAGES_DEBUG += citadel_integration_tests \
pwntest \
nugget_targeted_tests \
CitadelProvision

6
dauntless/sepolicy/citadel_provision.te Normal file
View file

@ -0,0 +1,6 @@
type citadel_provision, domain;
type citadel_provision_exec, exec_type, vendor_file_type, file_type;
userdebug_or_eng(`
init_daemon_domain(citadel_provision)
')

13
dauntless/sepolicy/citadeld.te Normal file
View file

@ -0,0 +1,13 @@
type citadeld, domain;
type citadeld_exec, exec_type, vendor_file_type, file_type;
init_daemon_domain(citadeld)
add_service(citadeld, citadeld_service)
binder_use(citadeld)
vndbinder_use(citadeld)
binder_call(citadeld, system_server)
allow citadeld citadel_device:chr_file rw_file_perms;
allow citadeld fwk_stats_service:service_manager find;
allow citadeld hal_power_stats_vendor_service:service_manager find;

1
dauntless/sepolicy/device.te Normal file
View file

@ -0,0 +1 @@
type citadel_device, dev_type;

1
dauntless/sepolicy/file.te Normal file
View file

@ -0,0 +1 @@
type citadel_updater, vendor_file_type, file_type;

11
dauntless/sepolicy/file_contexts
View file

@ -1 +1,10 @@
/vendor/bin/dump/dump_gsc\.sh u:object_r:dump_gsc_exec:s0
/vendor/bin/dump/dump_gsc\.sh u:object_r:dump_gsc_exec:s0
/vendor/bin/CitadelProvision u:object_r:citadel_provision_exec:s0
/vendor/bin/hw/init_citadel u:object_r:init_citadel_exec:s0
/vendor/bin/hw/android\.hardware\.security\.keymint-service\.citadel u:object_r:hal_keymint_citadel_exec:s0
/vendor/bin/hw/android\.hardware\.weaver@1\.0-service\.citadel u:object_r:hal_weaver_citadel_exec:s0
/vendor/bin/hw/android\.hardware\.identity@1\.0-service\.citadel u:object_r:hal_identity_citadel_exec:s0
/vendor/bin/hw/citadel_updater u:object_r:citadel_updater:s0
/vendor/bin/hw/citadeld u:object_r:citadeld_exec:s0
/dev/gsc0 u:object_r:citadel_device:s0

11
dauntless/sepolicy/hal_identity_citadel.te Normal file
View file

@ -0,0 +1,11 @@
type hal_identity_citadel, domain;
type hal_identity_citadel_exec, exec_type, vendor_file_type, file_type;
vndbinder_use(hal_identity_citadel)
binder_call(hal_identity_citadel, citadeld)
allow hal_identity_citadel citadeld_service:service_manager find;
allow hal_identity_citadel hal_keymint_citadel:binder call;
hal_server_domain(hal_identity_citadel, hal_identity)
hal_server_domain(hal_identity_citadel, hal_keymint)
init_daemon_domain(hal_identity_citadel)

9
dauntless/sepolicy/hal_keymint_citadel.te Normal file
View file

@ -0,0 +1,9 @@
type hal_keymint_citadel, domain;
type hal_keymint_citadel_exec, exec_type, vendor_file_type, file_type;
hal_server_domain(hal_keymint_citadel, hal_keymint)
init_daemon_domain(hal_keymint_citadel)
vndbinder_use(hal_keymint_citadel)
get_prop(hal_keymint_citadel, vendor_security_patch_level_prop)
allow hal_keymint_citadel citadeld_service:service_manager find;
binder_call(hal_keymint_citadel, citadeld)

11
dauntless/sepolicy/hal_weaver_citadel.te Normal file
View file

@ -0,0 +1,11 @@
type hal_weaver_citadel, domain;
type hal_weaver_citadel_exec, exec_type, vendor_file_type, file_type;
init_daemon_domain(hal_weaver_citadel)
hal_server_domain(hal_weaver_citadel, hal_weaver)
hal_server_domain(hal_weaver_citadel, hal_oemlock)
hal_server_domain(hal_weaver_citadel, hal_authsecret)
vndbinder_use(hal_weaver_citadel)
binder_call(hal_weaver_citadel, citadeld)
allow hal_weaver_citadel citadeld_service:service_manager find;

15
dauntless/sepolicy/init_citadel.te Normal file
View file

@ -0,0 +1,15 @@
type init_citadel, domain;
type init_citadel_exec, exec_type, vendor_file_type, file_type;
init_daemon_domain(init_citadel)
# Citadel communication must be via citadeld
vndbinder_use(init_citadel)
binder_call(init_citadel, citadeld)
allow init_citadel citadeld_service:service_manager find;
# Many standard utils are actually vendor_toolbox (like xxd)
allow init_citadel vendor_toolbox_exec:file rx_file_perms;
# init_citadel needs to invoke citadel_updater
allow init_citadel citadel_updater:file rx_file_perms;

3
dauntless/sepolicy/service_contexts Normal file
View file

@ -0,0 +1,3 @@
android.hardware.security.keymint.IKeyMintDevice/strongbox u:object_r:hal_keymint_service:s0
android.hardware.security.sharedsecret.ISharedSecret/strongbox u:object_r:hal_sharedsecret_service:s0
android.hardware.security.keymint.IRemotelyProvisionedComponent/strongbox u:object_r:hal_remotelyprovisionedcomponent_service:s0

1
dauntless/sepolicy/vndservice.te Normal file
View file

@ -0,0 +1 @@
type citadeld_service, vndservice_manager_type;

1
dauntless/sepolicy/vndservice_contexts Normal file
View file

@ -0,0 +1 @@
android.hardware.citadel.ICitadeld u:object_r:citadeld_service:s0