diff --git a/tracking_denials/hal_sensors_default.te b/tracking_denials/hal_sensors_default.te new file mode 100644 index 00000000..c52d7136 --- /dev/null +++ b/tracking_denials/hal_sensors_default.te @@ -0,0 +1,55 @@ +# b/182086633 +dontaudit hal_sensors_default servicemanager:binder { call }; +dontaudit hal_sensors_default device:dir { read }; +dontaudit hal_sensors_default device:dir { watch }; +dontaudit hal_sensors_default aoc_device:chr_file { read write }; +dontaudit hal_sensors_default aoc_device:chr_file { open }; +dontaudit hal_sensors_default mnt_vendor_file:dir { search }; +dontaudit hal_sensors_default persist_file:dir { search }; +dontaudit hal_sensors_default persist_file:dir { getattr }; +dontaudit hal_sensors_default persist_file:dir { read }; +dontaudit hal_sensors_default persist_file:dir { open }; +dontaudit hal_sensors_default persist_file:file { getattr }; +dontaudit hal_sensors_default persist_file:file { read }; +dontaudit hal_sensors_default persist_file:file { open }; +dontaudit hal_sensors_default vendor_data_file:dir { read }; +dontaudit hal_sensors_default vendor_data_file:dir { open }; +dontaudit hal_sensors_default vendor_data_file:file { getattr }; +dontaudit hal_sensors_default vendor_data_file:file { read }; +dontaudit hal_sensors_default vendor_data_file:file { open }; +dontaudit hal_sensors_default fwk_stats_service:service_manager { find }; +dontaudit hal_sensors_default servicemanager:binder { call }; +dontaudit hal_sensors_default servicemanager:binder { transfer }; +dontaudit hal_sensors_default servicemanager:binder { transfer }; +dontaudit hal_sensors_default servicemanager:binder { call }; +dontaudit hal_sensors_default aoc_device:chr_file { getattr }; +dontaudit hal_sensors_default aoc_device:chr_file { read write }; +dontaudit hal_sensors_default aoc_device:chr_file { open }; +dontaudit hal_sensors_default vendor_data_file:file { write }; +dontaudit hal_sensors_default sysfs_aoc_boottime:file { read }; +dontaudit hal_sensors_default sysfs_aoc_boottime:file { open }; +dontaudit hal_sensors_default sysfs_aoc_boottime:file { getattr }; +dontaudit hal_sensors_default vendor_data_file:file { write }; +dontaudit hal_sensors_default vendor_data_file:file { read }; +dontaudit hal_sensors_default vendor_data_file:file { getattr }; +dontaudit hal_sensors_default persist_file:dir { search }; +dontaudit hal_sensors_default vendor_data_file:dir { open }; +dontaudit hal_sensors_default aoc_device:chr_file { read write }; +dontaudit hal_sensors_default vendor_data_file:dir { read }; +dontaudit hal_sensors_default persist_file:file { open }; +dontaudit hal_sensors_default vendor_data_file:file { open }; +dontaudit hal_sensors_default sysfs_aoc_boottime:file { getattr }; +dontaudit hal_sensors_default sysfs_aoc_boottime:file { open }; +dontaudit hal_sensors_default sysfs_aoc_boottime:file { read }; +dontaudit hal_sensors_default persist_file:file { read }; +dontaudit hal_sensors_default persist_file:file { getattr }; +dontaudit hal_sensors_default device:dir { read }; +dontaudit hal_sensors_default persist_file:dir { open }; +dontaudit hal_sensors_default persist_file:dir { read }; +dontaudit hal_sensors_default persist_file:dir { getattr }; +dontaudit hal_sensors_default vendor_data_file:file { open }; +dontaudit hal_sensors_default mnt_vendor_file:dir { search }; +dontaudit hal_sensors_default device:dir { read }; +dontaudit hal_sensors_default device:dir { watch }; +dontaudit hal_sensors_default servicemanager:binder { transfer }; +dontaudit hal_sensors_default aoc_device:chr_file { open }; diff --git a/tracking_denials/init-insmod-sh.te b/tracking_denials/init-insmod-sh.te new file mode 100644 index 00000000..9f615fab --- /dev/null +++ b/tracking_denials/init-insmod-sh.te @@ -0,0 +1,4 @@ +# b/182086611 +dontaudit init-insmod-sh vendor_regmap_debugfs:dir { search }; +dontaudit init-insmod-sh vendor_regmap_debugfs:dir { search }; +dontaudit init-insmod-sh vendor_regmap_debugfs:dir { search }; diff --git a/tracking_denials/mediacodec.te b/tracking_denials/mediacodec.te index 2d3f4475..3955ae14 100644 --- a/tracking_denials/mediacodec.te +++ b/tracking_denials/mediacodec.te @@ -4,3 +4,10 @@ dontaudit mediacodec sysfs:file { open }; dontaudit mediacodec sysfs:file { read }; # b/176777184 dontaudit mediacodec default_android_vndservice:service_manager add ; +# b/182086552 +dontaudit mediacodec dmabuf_heap_device:chr_file { open }; +dontaudit mediacodec dmabuf_heap_device:chr_file { read }; +dontaudit mediacodec dmabuf_heap_device:chr_file { ioctl }; +dontaudit mediacodec dmabuf_heap_device:chr_file { read }; +dontaudit mediacodec dmabuf_heap_device:chr_file { open }; +dontaudit mediacodec dmabuf_heap_device:chr_file { ioctl }; diff --git a/tracking_denials/mediaserver.te b/tracking_denials/mediaserver.te new file mode 100644 index 00000000..5b1f85ae --- /dev/null +++ b/tracking_denials/mediaserver.te @@ -0,0 +1,10 @@ +# b/182086686 +dontaudit mediaserver dmabuf_heap_device:chr_file { open }; +dontaudit mediaserver dmabuf_heap_device:chr_file { ioctl }; +dontaudit mediaserver dmabuf_heap_device:chr_file { ioctl }; +dontaudit mediaserver dmabuf_heap_device:chr_file { read }; +dontaudit mediaserver dmabuf_heap_device:chr_file { read }; +dontaudit mediaserver dmabuf_heap_device:chr_file { open }; +dontaudit mediaserver dmabuf_heap_device:chr_file { ioctl }; +dontaudit mediaserver dmabuf_heap_device:chr_file { ioctl }; +dontaudit mediaserver dmabuf_heap_device:chr_file { ioctl }; diff --git a/tracking_denials/mediaswcodec.te b/tracking_denials/mediaswcodec.te new file mode 100644 index 00000000..90396e8d --- /dev/null +++ b/tracking_denials/mediaswcodec.te @@ -0,0 +1,7 @@ +# b/182086550 +dontaudit mediaswcodec dmabuf_heap_device:chr_file { open }; +dontaudit mediaswcodec dmabuf_heap_device:chr_file { read }; +dontaudit mediaswcodec dmabuf_heap_device:chr_file { read }; +dontaudit mediaswcodec dmabuf_heap_device:chr_file { ioctl }; +dontaudit mediaswcodec dmabuf_heap_device:chr_file { open }; +dontaudit mediaswcodec dmabuf_heap_device:chr_file { ioctl }; diff --git a/tracking_denials/nfc.te b/tracking_denials/nfc.te new file mode 100644 index 00000000..c0904dcf --- /dev/null +++ b/tracking_denials/nfc.te @@ -0,0 +1,4 @@ +# b/182086551 +dontaudit nfc dmabuf_heap_device:chr_file { open }; +dontaudit nfc dmabuf_heap_device:chr_file { ioctl }; +dontaudit nfc dmabuf_heap_device:chr_file { read }; diff --git a/tracking_denials/platform_app.te b/tracking_denials/platform_app.te index 6e8841af..2f9c64f4 100644 --- a/tracking_denials/platform_app.te +++ b/tracking_denials/platform_app.te @@ -6,3 +6,7 @@ dontaudit platform_app hal_wlc:binder { call }; dontaudit platform_app hal_wlc_hwservice:hwservice_manager { find }; dontaudit platform_app hal_wlc:binder { call }; dontaudit platform_app hal_wlc:binder { transfer }; +# b/182086482 +dontaudit platform_app dmabuf_heap_device:chr_file { ioctl }; +dontaudit platform_app dmabuf_heap_device:chr_file { read }; +dontaudit platform_app dmabuf_heap_device:chr_file { open }; diff --git a/tracking_denials/servicemanager.te b/tracking_denials/servicemanager.te new file mode 100644 index 00000000..0900dcdf --- /dev/null +++ b/tracking_denials/servicemanager.te @@ -0,0 +1,3 @@ +# b/182086688 +dontaudit servicemanager hal_sensors_default:binder { call }; +dontaudit servicemanager hal_sensors_default:binder { call }; diff --git a/tracking_denials/system_server.te b/tracking_denials/system_server.te index d7e456ab..2f1e9463 100644 --- a/tracking_denials/system_server.te +++ b/tracking_denials/system_server.te @@ -1,2 +1,6 @@ # b/178980142 dontaudit system_server property_type:file *; +# b/182086481 +dontaudit system_server dmabuf_heap_device:chr_file { ioctl }; +dontaudit system_server dmabuf_heap_device:chr_file { open }; +dontaudit system_server dmabuf_heap_device:chr_file { read };