Evolution-X-Tensor/device_google_gs101
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Move coredomain seapp ctx and types to system_ext

Browse source 
Coredomain apps shouldn't be labeled with vendor sepolicy, due to Treble
violation.

Bug: 280547417
Test: build bluejay and boot test
Change-Id: I48441749de4eb1de90ce5a307b1d47ae3cb9592d
This commit is contained in:
Inseob Kim 2023-08-04 14:26:21 +09:00
parent 92fb9538a2
commit fb3a116366
8 changed files with 27 additions and 32 deletions
Download patch file Download diff file Expand all files Collapse all files

7
system_ext/private/con_monitor.te Normal file
View file

@ -0,0 +1,7 @@
typeattribute con_monitor_app coredomain;
app_domain(con_monitor_app)
set_prop(con_monitor_app, radio_prop)
allow con_monitor_app app_api_service:service_manager find;
allow con_monitor_app radio_service:service_manager find;

11
system_ext/private/hbmsvmanager_app.te Normal file
View file

@ -0,0 +1,11 @@
typeattribute hbmsvmanager_app coredomain;
app_domain(hbmsvmanager_app);
allow hbmsvmanager_app proc_vendor_sched:dir r_dir_perms;
allow hbmsvmanager_app proc_vendor_sched:file w_file_perms;
# Standard system services
allow hbmsvmanager_app app_api_service:service_manager find;
allow hbmsvmanager_app cameraserver_service:service_manager find;

6
system_ext/private/seapp_contexts
View file

@ -1,2 +1,8 @@
# Domain for EuiccGoogle
user=_app isPrivApp=true name=com.google.android.euicc domain=euicc_app type=privapp_data_file levelFrom=user
# Domain for connectivity monitor
user=_app isPrivApp=true seinfo=platform name=com.google.android.connectivitymonitor domain=con_monitor_app type=app_data_file levelFrom=all
# HbmSVManager
user=_app seinfo=platform name=com.android.hbmsvmanager domain=hbmsvmanager_app type=app_data_file levelFrom=all

2
system_ext/public/con_monitor.te Normal file
View file

@ -0,0 +1,2 @@
# ConnectivityMonitor app
type con_monitor_app, domain;

1
system_ext/public/hbmsvmanager_app.te Normal file
View file

@ -0,0 +1 @@
type hbmsvmanager_app, domain;

11
whitechapel/vendor/google/con_monitor.te vendored
View file

@ -1,13 +1,2 @@
# ConnectivityMonitor app
type con_monitor_app, domain, coredomain;
# TODO(b/296512193): move con_monitor_app out of vendor sepolicy
typeattribute con_monitor_app vendor_seapp_assigns_coredomain_violators;
app_domain(con_monitor_app)
set_prop(con_monitor_app, radio_prop)
allow con_monitor_app app_api_service:service_manager find;
allow con_monitor_app radio_service:service_manager find;
allow con_monitor_app radio_vendor_data_file:dir rw_dir_perms;
allow con_monitor_app radio_vendor_data_file:file create_file_perms;

15
whitechapel/vendor/google/hbmsvmanager_app.te vendored
View file

@ -1,17 +1,2 @@
type hbmsvmanager_app, domain, coredomain;
# TODO(b/296512193): move hbmsvmanager_app out of vendor sepolicy
typeattribute hbmsvmanager_app vendor_seapp_assigns_coredomain_violators;
app_domain(hbmsvmanager_app);
allow hbmsvmanager_app proc_vendor_sched:dir r_dir_perms;
allow hbmsvmanager_app proc_vendor_sched:file w_file_perms;
allow hbmsvmanager_app hal_pixel_display_service:service_manager find;
binder_call(hbmsvmanager_app, hal_graphics_composer_default)
# Standard system services
allow hbmsvmanager_app app_api_service:service_manager find;
allow hbmsvmanager_app cameraserver_service:service_manager find;

6
whitechapel/vendor/google/seapp_contexts vendored
View file

@ -24,18 +24,12 @@ user=_app seinfo=platform name=com.android.ramdump domain=ramdump_app type=app_d
# grilservice
user=_app isPrivApp=true name=com.google.android.grilservice domain=grilservice_app levelFrom=all
# HbmSVManager
user=_app seinfo=platform name=com.android.hbmsvmanager domain=hbmsvmanager_app type=app_data_file levelFrom=all
# Domain for omadm
user=_app isPrivApp=true seinfo=platform name=com.android.omadm.service domain=omadm_app type=app_data_file levelFrom=all
# Modem Diagnostic System
user=_app isPrivApp=true seinfo=mds name=com.google.mds domain=modem_diagnostic_app type=app_data_file levelFrom=user
# Domain for connectivity monitor
user=_app isPrivApp=true seinfo=platform name=com.google.android.connectivitymonitor domain=con_monitor_app type=app_data_file levelFrom=all
# RIL Config Service
user=radio isPrivApp=true seinfo=platform name=com.google.RilConfigService domain=ril_config_service_app type=app_data_file