Evolution-X-Tensor/device_google_gs101
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add sepolicy rules for fingerprint hal

Browse source 
Fixes the following avc denials:
03-18 11:23:15.692   956   956 I android.hardwar: type=1400 audit(0.0:7): avc: denied { read write } for name="trusty-ipc-dev0" dev="tmpfs" ino=691 scontext=u:r:hal_fingerprint_default:s0 tcontext=u:object_r:tee_device:s0 tclass=chr_file permissive=1
03-18 11:23:15.692   956   956 I android.hardwar: type=1400 audit(0.0:8): avc: denied { open } for path="/dev/trusty-ipc-dev0" dev="tmpfs" ino=691 scontext=u:r:hal_fingerprint_default:s0 tcontext=u:object_r:tee_device:s0 tclass=chr_file permissive=1
03-18 11:23:15.692   956   956 I android.hardwar: type=1400 audit(0.0:9): avc: denied { ioctl } for path="/dev/trusty-ipc-dev0" dev="tmpfs" ino=691 ioctlcmd=0x7280 scontext=u:r:hal_fingerprint_default:s0 tcontext=u:object_r:tee_device:s0 tclass=chr_file permissive=1
03-18 11:40:56.072   973   973 I fingerprint@2.1: type=1400 audit(0.0:39): avc: denied { search } for name="battery" dev="sysfs" ino=66502 scontext=u:r:hal_fingerprint_default:s0 tcontext=u:object_r:sysfs_batteryinfo:s0 tclass=dir permissive=1
03-18 11:40:56.072   973   973 I fingerprint@2.1: type=1400 audit(0.0:40): avc: denied { read } for name="temp" dev="sysfs" ino=66520 scontext=u:r:hal_fingerprint_default:s0 tcontext=u:object_r:sysfs_batteryinfo:s0 tclass=file permissive=1
03-18 11:40:56.072   973   973 I fingerprint@2.1: type=1400 audit(0.0:41): avc: denied { open } for path="/sys/devices/platform/google,battery/power_supply/battery/temp" dev="sysfs" ino=66520 scontext=u:r:hal_fingerprint_default:s0 tcontext=u:object_r:sysfs_batteryinfo:s0 tclass=file permissive=1
03-18 14:11:23.476   979   979 I fingerprint@2.1: type=1400 audit(0.0:13): avc: denied { search } for name="battery" dev="sysfs" ino=66502 scontext=u:r:hal_fingerprint_default:s0 tcontext=u:object_r:sysfs_batteryinfo:s0 tclass=dir permissive=1
03-18 12:03:08.248   978   978 I android.hardwar: type=1400 audit(0.0:9): avc: denied { create } for scontext=u:r:hal_fingerprint_default:s0 tcontext=u:r:hal_fingerprint_default:s0 tclass=netlink_socket permissive=1
03-18 12:03:08.248   978   978 I android.hardwar: type=1400 audit(0.0:10): avc: denied { bind } for scontext=u:r:hal_fingerprint_default:s0 tcontext=u:r:hal_fingerprint_default:s0 tclass=netlink_socket permissive=1
03-18 12:03:08.248   978   978 I android.hardwar: type=1400 audit(0.0:11): avc: denied { write } for scontext=u:r:hal_fingerprint_default:s0 tcontext=u:r:hal_fingerprint_default:s0 tclass=netlink_socket permissive=1
03-18 12:03:08.248   978   978 I android.hardwar: type=1400 audit(0.0:12): avc: denied { read } for scontext=u:r:hal_fingerprint_default:s0 tcontext=u:r:hal_fingerprint_default:s0 tclass=netlink_socket permissive=1
03-18 12:56:30.446   404   404 E SELinux : avc:  denied  { add } for interface=vendor.goodix.hardware.biometrics.fingerprint::IGoodixFingerprintDaemon sid=u:r:hal_fingerprint_default:s0 pid=967 scontext=u:r:hal_fingerprint_default:s0 tcontext=u:object_r:default_android_hwservice:s0 tclass=hwservice_manager permissive=1

Bug: 171943101
Test: No above avc denials in logcat.
Change-Id: I67b397f86c39625b77ebe6d32d37e42cd87b3f93
This commit is contained in:
Kris Chen 2021-03-18 19:34:42 +08:00 • committed by KRIS CHEN
parent 10fda56cd1
commit 09996bc810
4 changed files with 11 additions and 53 deletions
Download patch file Download diff file Expand all files Collapse all files

52
tracking_denials/hal_fingerprint_default.te
View file

@ -1,52 +0,0 @@
# b/174438167
dontaudit hal_fingerprint_default hal_fingerprint_default:netlink_socket { read };
dontaudit hal_fingerprint_default tee_device:chr_file { ioctl };
dontaudit hal_fingerprint_default system_data_root_file:file { read };
dontaudit hal_fingerprint_default system_data_root_file:file { open };
dontaudit hal_fingerprint_default hal_fingerprint_default:netlink_socket { create };
dontaudit hal_fingerprint_default hal_fingerprint_default:netlink_socket { bind };
dontaudit hal_fingerprint_default hal_fingerprint_default:netlink_socket { write };
dontaudit hal_fingerprint_default hal_fingerprint_default:netlink_socket { read };
dontaudit hal_fingerprint_default tee_device:chr_file { open };
dontaudit hal_fingerprint_default tee_device:chr_file { ioctl };
dontaudit hal_fingerprint_default tee_device:chr_file { open };
dontaudit hal_fingerprint_default tee_device:chr_file { read write };
dontaudit hal_fingerprint_default device:chr_file { open };
dontaudit hal_fingerprint_default device:chr_file { read write };
dontaudit hal_fingerprint_default tee_device:chr_file { read write };
dontaudit hal_fingerprint_default device:chr_file { ioctl };
dontaudit hal_fingerprint_default device:chr_file { open };
dontaudit hal_fingerprint_default system_data_root_file:file { read };
dontaudit hal_fingerprint_default system_data_root_file:file { open };
dontaudit hal_fingerprint_default hal_fingerprint_default:netlink_socket { create };
dontaudit hal_fingerprint_default hal_fingerprint_default:netlink_socket { bind };
dontaudit hal_fingerprint_default hal_fingerprint_default:netlink_socket { write };
dontaudit hal_fingerprint_default hal_fingerprint_default:netlink_socket { read };
dontaudit hal_fingerprint_default device:chr_file { ioctl };
dontaudit hal_fingerprint_default device:chr_file { read write };
# b/174714991
dontaudit hal_fingerprint_default system_data_file:file { read };
dontaudit hal_fingerprint_default system_data_file:file { open };
dontaudit hal_fingerprint_default system_data_file:file { read };
dontaudit hal_fingerprint_default system_data_file:file { open };
# b/177966377
dontaudit hal_fingerprint_default default_prop:file { getattr };
dontaudit hal_fingerprint_default default_prop:file { map };
dontaudit hal_fingerprint_default default_prop:file { open };
dontaudit hal_fingerprint_default default_prop:file { read };
dontaudit hal_fingerprint_default default_prop:file { map };
dontaudit hal_fingerprint_default default_prop:file { getattr };
dontaudit hal_fingerprint_default default_android_hwservice:hwservice_manager { add };
dontaudit hal_fingerprint_default default_prop:file { open };
dontaudit hal_fingerprint_default default_prop:file { read };
# b/180655836
dontaudit hal_fingerprint_default system_data_root_file:dir { write };
dontaudit hal_fingerprint_default system_data_root_file:file { write };
dontaudit hal_fingerprint_default system_data_root_file:file { create };
dontaudit hal_fingerprint_default system_data_root_file:dir { create };
dontaudit hal_fingerprint_default system_data_root_file:dir { write };
dontaudit hal_fingerprint_default system_data_root_file:file { write };
dontaudit hal_fingerprint_default system_data_root_file:file { create };
dontaudit hal_fingerprint_default system_data_root_file:dir { create };
dontaudit hal_fingerprint_default system_data_root_file:dir { add_name };
dontaudit hal_fingerprint_default system_data_root_file:dir { add_name };

6
whitechapel/vendor/google/hal_fingerprint_default.te vendored
View file

@ -1,2 +1,6 @@
allow hal_fingerprint_default fingerprint_device:chr_file rw_file_perms; allow hal_fingerprint_default fingerprint_device:chr_file rw_file_perms;
allow hal_fingerprint_default tee_device:chr_file rw_file_perms;
allow hal_fingerprint_default sysfs_batteryinfo:file r_file_perms;
allow hal_fingerprint_default sysfs_batteryinfo:dir search;
allow hal_fingerprint_default self:netlink_socket create_socket_perms_no_ioctl;
add_hwservice(hal_fingerprint_default, hal_fingerprint_ext_hwservice)

3
whitechapel/vendor/google/hwservice.te vendored
View file

@ -18,3 +18,6 @@ type hal_wlc_hwservice, hwservice_manager_type;
# Bluetooth HAL extension # Bluetooth HAL extension
type hal_bluetooth_coexistence_hwservice, hwservice_manager_type, vendor_hwservice_type; type hal_bluetooth_coexistence_hwservice, hwservice_manager_type, vendor_hwservice_type;
# Fingerprint
type hal_fingerprint_ext_hwservice, hwservice_manager_type;

3
whitechapel/vendor/google/hwservice_contexts vendored
View file

@ -26,3 +26,6 @@ vendor.google.wireless_charger::IWirelessCharger u:object_r:hal_w
# Bluetooth HAL extension # Bluetooth HAL extension
hardware.google.bluetooth.bt_channel_avoidance::IBTChannelAvoidance u:object_r:hal_bluetooth_coexistence_hwservice:s0 hardware.google.bluetooth.bt_channel_avoidance::IBTChannelAvoidance u:object_r:hal_bluetooth_coexistence_hwservice:s0
hardware.google.bluetooth.sar::IBluetoothSar u:object_r:hal_bluetooth_coexistence_hwservice:s0 hardware.google.bluetooth.sar::IBluetoothSar u:object_r:hal_bluetooth_coexistence_hwservice:s0
# Fingerprint
vendor.goodix.hardware.biometrics.fingerprint::IGoodixFingerprintDaemon u:object_r:hal_fingerprint_ext_hwservice:s0