Evolution-X-Tensor/device_google_gs101
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fix selinux for RPMB daemon

Browse source 
Secure persistent storage has been moved to persist root.
The corresponding pathes on SELinux policy has to be updated.

Bug: 173971240
Bug: 173032298
Test: Trusty storage tests
Change-Id: I0e7756f3b4d5c6be705a87e1d7d80247df1ec4bb
This commit is contained in:
Wenhao Wang 2021-04-19 17:26:53 -07:00 • committed by Adam Shih
parent 0ae24df58d
commit f5277482c1
3 changed files with 6 additions and 15 deletions
Download patch file Download diff file Expand all files Collapse all files

14
tracking_denials/tee.te
View file

@ -1,14 +0,0 @@
# b/173971240
dontaudit tee persist_file:file { open };
dontaudit tee tee_data_file:lnk_file { read };
dontaudit tee mnt_vendor_file:dir { search };
dontaudit tee persist_file:dir { search };
dontaudit tee persist_file:file { open };
dontaudit tee persist_file:file { read write };
dontaudit tee persist_file:dir { search };
dontaudit tee mnt_vendor_file:dir { search };
dontaudit tee tee_data_file:lnk_file { read };
dontaudit tee persist_file:file { read write };
userdebug_or_eng(`
permissive tee;
')

2
whitechapel/vendor/google/file_contexts vendored
View file

@ -325,7 +325,7 @@
/vendor/bin/hw/android\.hardware\.confirmationui@1\.0-service\.trusty\.vendor u:object_r:hal_confirmationui_default_exec:s0
/dev/trusty-ipc-dev0 u:object_r:tee_device:s0
/data/vendor/ss(/.*)? u:object_r:tee_data_file:s0
/mnt/vendor/persist/data/ss(/.*)? u:object_r:tee_data_file:s0
/mnt/vendor/persist/ss(/.*)? u:object_r:tee_data_file:s0
/dev/sg1 u:object_r:sg_device:s0
# Battery

5
whitechapel/vendor/google/storageproxyd.te vendored
View file

@ -1,4 +1,9 @@
type sg_device, dev_type;
type persist_ss_file, file_type, vendor_persist_type;
allow tee persist_ss_file:dir r_dir_perms;
allow tee persist_file:dir r_dir_perms;
allow tee mnt_vendor_file:dir r_dir_perms;
allow tee tee_data_file:lnk_file r_file_perms;
allow tee sg_device:chr_file rw_file_perms;
allow tee self:capability { setgid setuid };