Evolution-X-Tensor/device_google_gs101
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
1414 commits 1 branch 0 tags 494 MiB
Commit graph

48 commits

Author SHA1 Message Date
Jack Wu
d6c1a50bba sepolicy: gs101: allows pixelstat to access pca file nodes 
07-23 14:24:45.512  1000  3001  3001 I pixelstats-vend: type=1400 audit(0.0:10): avc: denied { open } for path="/sys/devices/platform/10d50000.hsi2c/i2c-5/5-0057/chg_stats" dev="sysfs" ino=72245 scontext=u:r:pixelstats_vendor:s0 tcontext=u:object_r:sysfs:s0 tclass=file permissive=1
07-23 14:24:45.512  1000  3001  3001 I pixelstats-vend: type=1400 audit(0.0:11): avc: denied { getattr } for path="/sys/devices/platform/10d50000.hsi2c/i2c-5/5-0057/chg_stats" dev="sysfs" ino=72245 scontext=u:r:pixelstats_vendor:s0 tcontext=u:object_r:sysfs:s0 tclass=file permissive=1
07-23 14:24:57.536  1000  3001  3001 I pixelstats-vend: type=1400 audit(0.0:12): avc: denied { read } for name="chg_stats" dev="sysfs" ino=72245 scontext=u:r:pixelstats_vendor:s0 tcontext=u:object_r:sysfs:s0 tclass=file permissive=1
07-23 14:24:57.536  1000  3001  3001 I pixelstats-vend: type=1400 audit(0.0:13): avc: denied { open } for path="/sys/devices/platform/10d50000.hsi2c/i2c-5/5-0057/chg_stats" dev="sysfs" ino=72245 scontext=u:r:pixelstats_vendor:s0 tcontext=u:object_r:sysfs:s0 tclass=file permissive=1
07-23 14:24:57.536  1000  3001  3001 I pixelstats-vend: type=1400 audit(0.0:14): avc: denied { getattr } for path="/sys/devices/platform/10d50000.hsi2c/i2c-5/5-0057/chg_stats" dev="sysfs" ino=72245 scontext=u:r:pixelstats_vendor:s0 tcontext=u:object_r:sysfs:s0 tclass=file permissive=1
07-23 14:24:57.536  1000  3001  3001 I pixelstats-vend: type=1400 audit(0.0:15): avc: denied { write } for name="chg_stats" dev="sysfs" ino=72245 scontext=u:r:pixelstats_vendor:s0 tcontext=u:object_r:sysfs:s0 tclass=file permissive=1

Bug: 194386750
Test: manually test, no avc: denied
Signed-off-by: Jack Wu <wjack@google.com>
Change-Id: I1a16edb5bb7820f62b3ce598aa50eba2d9455927
 2021-07-24 06:42:39 +00:00
Badhri Jagan Sridharan
49804d8d6f Merge "Update Usb hal permissions to allow pushing overheat suez events" into sc-dev 2021-07-22 20:31:13 +00:00
Badhri Jagan Sridharan
1ebd84703b Update Usb hal permissions to allow pushing overheat suez events 
Usb hal now pushes the Usb port overheat event through statsd.
Usb hal also accesses usbc-throttling stats to gather info.

Bug: 193615568
Signed-off-by: Badhri Jagan Sridharan <badhri@google.com>
Change-Id: I4918458bc7a8a25d7655b66d1fe40eafc7ccb070
 2021-07-21 14:38:55 -07:00
Stephane Lee
c7342a7824 odpm: Rename the odpm_config sepolicies to be more consistent 
Test: Ensure that there are no sepolicy errors on odpm_config
Bug: 192674986
Change-Id: I3043a544511c8c3051e1bd10e9f6b668b251cf5f
 2021-07-14 16:11:51 -07:00
Ilya Matyukhin
f9828a9944 Merge "raviole: transition SystemUI to use HWC for LHBM" into sc-dev 2021-06-25 01:12:52 +00:00
Ilya Matyukhin
2460cdcc9f raviole: transition SystemUI to use HWC for LHBM 
This change removes direct access to the LHBM sysfs node from SystemUI,
but allows SystemUI to make binder calls to the hardware composer (HWC),
which can be used to enable or disable LHBM.

Bug: 191132545
Bug: 190563896
Bug: 184768835
Test: no avc denials
Change-Id: I5417377ff096e869ad772e4fd2fb23f8c1fd4f1e
 2021-06-23 23:38:27 -07:00
Adam Shih
8b326703e1 modularize dmd 
Bug: 190331463
Test: build ROM and make sure dmd is launched
Change-Id: If1e51b6bc100e870a15a40f5e0d93a75fe68bac3
 2021-06-24 14:17:29 +08:00
Adam Shih
d74e989739 modulize init.radio.sh 
Bug: 190331600
Test: build ROM and make sure the file is there and functional.
Change-Id: Icb3e0e590ae315d53eb5251fd5e74d6aacab1fe2
 2021-06-23 01:07:26 +00:00
Craig Dooley
7fe9d053e8 Merge "Allow hal_dumpstate to collect AoC statistics" into sc-dev 2021-06-17 16:32:38 +00:00
Craig Dooley
3031b077a3 Allow hal_dumpstate to collect AoC statistics 
Bug: 188114650
Signed-off-by: Craig Dooley <dooleyc@google.com>
Change-Id: Iba5525af2c651070b9a5f7769c0439ef320d666b
 2021-06-16 17:18:55 +00:00
Adam Shih
d0bb828434 remove vcd from user ROM 
Bug: 190331325
Test: build all ROM variants with only user ROM without vcd
Change-Id: If9dc555ee8582b605ccdf9d60c3a9c89cd6634d8
 2021-06-11 11:46:22 +08:00
Rick Yiu
797b646234 gs101-sepolicy: Fix avc denial for sysfs_vendor_sched 
Fix mediaprovider_app and bluetooth

Bug: 190563839
Bug: 190563916
Test: build pass
Change-Id: I477325ee812d1362db4d5005e999cba989a44216
 2021-06-10 04:10:24 +00:00
Adam Shih
22fae537b5 Merge "organize EdgeTPU modules and sepolicy" into sc-dev 2021-06-10 02:53:28 +00:00
Adam Shih
e7ed46c52c organize EdgeTPU modules and sepolicy 
Bug: 190331327
Bug: 190331548
Bug: 189895600
Bug: 190331108
Bug: 182524105
Bug: 183935302
Test: build ROM and check if the modules and sepolicy are still there
Change-Id: I40391a239a16c4fe79d58fab209dcbd1a8f25ede
 2021-06-09 10:39:04 +08:00
Yu(Swim) Chih Ren
d45ada475b Add sysfs_camera label for powerhint flow to access intcam & tnr clock 
Test: 1. build selinux and push related files to phone
      2. Use ls -Z "file" to check if selinux content of file is
      expected
      3. P21 camera checklist
Bug: 168654554

Change-Id: Ie757dd3e8adc151c6340e9ca662efbdf0ccb6110
 2021-06-07 06:31:09 +00:00
Peter Csaszar
7ea6a44719 pixel-selinux: Add mlstrustedobject for SJTAG 
This CL adds the "mlstrustedobject" to types for files involved in the
SJTAG authentication flow, in order to address MLS-based AVC denials.

Bug: 189466122
Test: No more AVC denials when activating SJTAG in BetterBug
Signed-off-by: Peter Csaszar <pcsaszar@google.com>
Change-Id: Ieb88653830ce95751eee5cf26c26fd6302067bce
 2021-06-02 12:23:01 -07:00
Aaron Ding
2dbe515943 remove sysfs_type from vendor_page_pinner_debugfs 
Bug: 186500818
Change-Id: If97126a3d46d96342faf89b9698218b6a480a84b
 2021-06-01 17:38:28 +08:00
Rick Yiu
5aeb1b9e45 gs101-sepolicy: Allow dumping vendor groups values 
Fix:
avc: denied { read } for name="vendor_sched" dev="sysfs" ino=45566 scontext=u:r:hal_dumpstate_default:s0 tcontext=u:object_r:sysfs:s0 tclass=dir permissive=0

avc: denied { read } for name="dump_task_group_ta" dev="proc" ino=4026532542 scontext=u:r:hal_dumpstate_default:s0 tcontext=u:object_r:proc:s0 tclass=file permissive=0

Bug: 172112042
Test: dump data as expected
Change-Id: I9945953dba4afddd34c1535c12193b1f00fdcef9
 2021-05-22 21:30:47 +08:00
Peter Csaszar
8fd76cee44 pixel-selinux: add SJTAG policies 
These are the SELinux policies for the sysfs files of the SJTAG
kernel interface. The files are in the following directories:

  /sys/devices/platform/sjtag_ap/interface/
  /sys/devices/platform/sjtag_gsa/interface/

Bug: 184768605
Signed-off-by: Peter Csaszar <pcsaszar@google.com>
Change-Id: I4ecf5cec5bbd08a44d7dbf88de5f3bc58b6c4fe5
 2021-05-20 00:00:30 -07:00
Minchan Kim
304a32c17e sepolicy: gs101: allow duump page_pinner 
Provide necessary sepolicy for dumpreport to access page_pinner
information in /sys/kernel/debug/page_pinner/{longterm_pinner,
alloc_contig_failed}

Bug: 187552095
Test: Run "adb bugreport <zip>" and verify it contains the output
      from page_pinner.
Signed-off-by: Minchan Kim <minchan@google.com>
Change-Id: I2abc48f2a156718fd4bed3b51bdd285c6bf9f175
 2021-05-17 09:18:50 -07:00
Hridya Valsaraju
9e6528da08 Label debugfs files correctly 
A few debugfs files are labelled as belonging to both debugfs_type and
sysfs_type. Hence, any client that is provided access to sysfs_type will
automatically be provided access to these files. This patch corrects the
labelling for these files to prevent this.

Test: build
Bug: 186500818
Change-Id: I364a73a960824cc9051610032179fd5caeca09de
 2021-05-11 17:35:17 -07:00
Peter Csaszar
bc525e1a49 pixel-selinux: add SJTAG policies 
These are the SELinux policies for the DebugFS files of the SJTAG
kernel interface.

Bug: 184768605
Signed-off-by: Peter Csaszar <pcsaszar@google.com>
Change-Id: I36996d6fd5fe09adb7a36be573cf57f15ea35756
 2021-05-10 17:58:04 -07:00
TreeHugger Robot
577f562727 Merge "wlc fwupdate implementation" into sc-dev 2021-05-06 05:41:01 +00:00
Chris Kuiper
d0d0304443 Merge "sepolicy: gs101: allow usf_reg_edit to run" into sc-dev 2021-05-04 22:33:57 +00:00
Yu-Chi Cheng
b844190a34 Added the SELinux rule for the EdgeTPU vendor service. 
To comply with the GSI compliance test, this change
splits the compiler part of the edgetpu_service into a
separate edgetpu_vendor_service under vendor.

The edgetpu_service locates under /system_ext/ and used
to be connected by both applications and vendor clients.
With this change, vendor clients could talk to the vendor
part of this service directly without having to cross
the system and vendor boundary.

Applications will still talk to the system_ext one, which
will forward the requests to the vendor service.

Bug: 185432427
Test: tested on Oriole + GCA.
Change-Id: I1ee47946f1fc3694d5f8b5325c192d6bd720a76e
 2021-05-04 10:36:21 -07:00
Ted Lin
69c8212a41 wlc fwupdate implementation 
Fix sepolicy problems.

Bug: 183465596
Test: logcat/dmesg grep wlc.
Signed-off-by: Ted Lin <tedlin@google.com>
Change-Id: I834f4d83f822b8189a576ac198bae9a7d77a3e10
 2021-05-04 02:09:32 +00:00
Chris Kuiper
db03875ebe sepolicy: gs101: allow usf_reg_edit to run 
Provide necessary permissions to run usf_reg_edit from bugreport.

Bug: 187081112
Test: Run "adb bugreport <zip>" and verify it contains the output
      from "usf_reg_edit save -".
Change-Id: Iade132d93105d461d51273d19fe570d48cce46fe
 2021-05-03 16:34:58 -07:00
Roger Fang
66634d4d20 sepolicy: gs101: allows pixelstat to access audio metrics nodes 
audio.service: type=1400 audit(0.0:30): avc: denied { read write } for name="amcs" dev="tmpfs" ino=739 scontext=u:r:hal_audio_default:s0 tcontext=u:object_r:amcs_device:s0 tclass=chr_file permissive=0

pixelstats-vend: type=1400 audit(0.0:9): avc: denied { read } for name="speaker_impedance" dev="sysfs" ino=67611 scontext=u:r:pixelstats_vendor:s0 tcontext=u:object_r:sysfs:s0 tclass=file permissive=0

HwBinder:696_2: type=1400 audit(0.0:8): avc: denied { open } for path="/dev/amcs" dev="tmpfs" ino=766 scontext=u:r:hal_audio_default:s0 tcontext=u:object_r:amcs_device:s0 tclass=chr_file permissive=0

Bug: 171854614
Test: manually test, no avc: denied.
Change-Id: I82ebd22f167200ab3cf59e6525ef43c0be8f722a
 2021-04-28 10:52:06 +08:00
Adam Shih
99988c4c5f remove obsolete domains 
Bug: 168013500
Test: Check that abox and rpmbd are not in ROM anywhere in oriole, raven user,
userdebug and factory ROM

Change-Id: Ie091a1036ba6c25a3c7f0ef0b8f69cc9fc4e306a
 2021-04-19 11:14:54 +08:00
eddielan
75a9ea1ee4 sepolicy: fix fingerprint sepolicy 
04-16 01:56:07.948  1039  1039 W fingerprint@2.1: type=1400 audit(0.0:110):
avc: denied { write } for name="wakeup_enable" dev="sysfs" ino=69197
scontext=u:r:hal_fingerprint_default:s0
tcontext=u:object_r:sysfs:s0
tclass=file permissive=0

Bug: 185538163
Test: Build Pass
Change-Id: I8f75daf22577e6a68f3b2a0250eebebd1873ea28
 2021-04-16 15:17:20 +08:00
Max Shi
55bd05960f Add sepolicy for sensor HAL accessing AOC reset sysfs node. 
Bug: 184858369
Test: Verify sensor HAL process can write to the sysfs node.
Change-Id: I9700323bafa413b88f25e4117499bcc936bce9c6
 2021-04-15 23:37:15 +00:00
Roshan Pius
8119d482ed Uwb: Create a new Uwb system service 
Move the vendor service to a different name which will be used by AOSP
uwb service.

Also, create a new domain for the UWB vendor app which can expose this
vendor service.

Denials:
04-12 16:38:38.282   411   411 E SELinux : avc:  denied  { find } for pid=2964
uid=1000 name=tethering scontext=u:r:uwb_vendor_app:s0:c232,c259,c512,c768
tcontext=u:object_r:tethering_service:s0 tclass=service_manager permissive=0

04-12 17:56:49.320   411   411 E SELinux : avc:  denied  { find } for pid=2964
uid=1000 name=hardware.qorvo.uwb.IUwb/default scontext=u:r:uwb_vendor_app:s0:c232,c259,c512,c768
tcontext=u:object_r:hal_uwb_service:s0 tclass=service_manager permissive=0

04-12 20:13:37.952  3034  3034 W com.qorvo.uwb: type=1400 audit(0.0:8): avc: denied
{ getattr } for path="/data/user/0/com.qorvo.uwb" dev="dm-11" ino=7176
scontext=u:r:uwb_vendor_app:s0:c232,c259,c512,c768 tcontext=u:object_r:system_app_data_file:s0
tclass=dir permissive=0

04-12 20:13:38.003   408   408 E SELinux : avc:  denied  { find } for pid=3034
uid=1000 name=content_capture scontext=u:r:uwb_vendor_app:s0:c232,c259,c512,c768
tcontext=u:object_r:content_capture_service:s0 tclass=service_manager permissive=0

04-12 21:25:03.244  2992  2992 W com.qorvo.uwb: type=1400 audit(0.0:7): avc: denied
{ getattr } for path="/data/user/0/com.qorvo.uwb" dev="dm-11" ino=7176
scontext=u:r:uwb_vendor_app:s0:c232,c259,c512,c768 tcontext=u:object_r:
system_app_data_file:s0:c232,c259,c512,c768 tclass=dir permissive=0

Bug: 183904955
Test: atest android.uwb.cts.UwbManagerTest
Change-Id: Iecb871902ebe7d110f2deb9ddb960c1a3945d8e9
 2021-04-13 17:54:42 -07:00
Ilya Matyukhin
acf6b1f5ae Add sepolicy for SystemUIGoogle to write to lhbm 
Bug: 184768835
Bug: 182520014
Test: adb logcat | grep "avc: denied"
Change-Id: Ia200983c87e0b826a0b62052e65cc731453a632f
 2021-04-13 11:26:34 -07:00
Eddie Tashjian
5bbdd82a4e Merge "Add TCP dump permissions." into sc-dev 2021-04-08 18:25:30 +00:00
Craig Dooley
cd888e847f Merge "Fix SELinux errors with aocd" into sc-dev 2021-04-08 17:27:56 +00:00
Craig Dooley
3d4d9159c9 Fix SELinux errors with aocd 
Add inotify support for /dev
Fix the aoc vendor property

Bug: 184173298
Change-Id: I40a71edd56b2d51f848085c43ae1d10a4c2c0c4b
 2021-04-08 03:59:23 +00:00
Eddie Tashjian
b2fb9cdace Add TCP dump permissions. 
Copy selinux policy for tcp dump binary from previous Pixel to support
TCP logging on P21 through PixelLogger.

Bug: 184777243
Test: Check PixelLogger TCP dump works.
Change-Id: Id958c8a3e6375a7aae569d6fc94deb9f8072b57b
 2021-04-08 03:13:55 +00:00
Yabin Cui
05825886f4 Move vendor_kernel_modules to public. 
Bug: 166559473
Bug: 183135316
Test: build
Change-Id: Ib62080d3d12aa197571a0697c17f6fd5d981d653
 2021-04-06 21:46:27 +00:00
Wei Wang
852d1dc3c1 Grant GPU and Fabric node access 
Bug: 183626384
Test: boot
Signed-off-by: Wei Wang <wvw@google.com>
Change-Id: Ibb700110795f81a2da4358352111f61ef987c29b
 2021-04-02 14:22:37 -07:00
Oleg Matcovschi
6862b8e239 vendor: remove sscoredump policies 
Bug: 180760068
Signed-off-by: Oleg Matcovschi <omatcovschi@google.com>
Change-Id: Ib8d360b227286bdea7de00125ef2ed6ad7978e67
 2021-03-28 21:26:34 -07:00
Steven Liu
c6eca53b9e Add sepolicy for the wifi firmware config OTA feature 
Bug: 177083009
Test: the OTA updated files can be updated and applied.
Change-Id: I2f269dbc146aae41cab57abd568af7e26fd23876
 2021-03-24 06:59:08 -07:00
Adam Shih
7314a7b522 permissions required for OTA 
Bug: 183174452
Test: do OTA under enforcing mode
Change-Id: I0edf7703713e24351f57ef0e68096ca03c59e6f8
 2021-03-23 09:49:02 +08:00
George Lee
9c3d77d088 power: Add policy to access sysfs_bcl 
Bug: 180620276
Test: adb bugreport
dumpstate_board.txt shows:
------ BCL (/sys/devices/virtual/pmic/mitigation/triggered_stats) ------
Source    	Count	Last Triggered	Last SOC	Last Voltage
smpl_warn      	0	0		0		0
ocp_cpu1       	0	0		0		0
ocp_cpu2       	0	0		0		0
soft_ocp_cpu1  	0	0		0		0
soft_ocp_cpu2  	0	0		0		0
ocp_tpu        	0	0		0		0
soft_ocp_tpu   	0	0		0		0
pmic_120c      	0	0		0		0
pmic_140c      	0	0		0		0
pmic_overheat  	0	0		0		0
ocp_gpu        	0	0		0		0
soft_ocp_gpu   	0	0		0		0

------ IF PMIC (/sys/devices/virtual/pmic/max77759-mitigation/triggered_stats) ------
Source    	Count	Last Triggered	Last SOC	Last Voltage
VDROOP1        	0	0		0		0
VDROOP2        	0	0		0		0
BATOILO        	0	0		0		0

Signed-off-by: George Lee <geolee@google.com>
Change-Id: If7874e19b8202175071d474502e77748168565ce
 2021-03-19 02:56:32 +00:00
Wen Chang Liu
e72c30346f Merge changes Ie0ed96d7,Id7f43fe1 into sc-dev 
* changes:
  Add sepolicy for BigOcean device
  Add sepolicy for MFC device
 2021-03-12 05:41:08 +00:00
wenchangliu
b52121a259 Add sepolicy for MFC device 
- Add sysfs_video type for mfc device
- Allow mediacode to access sysfs_video

avc: denied { read } for name="name" dev="sysfs" ino=62278 \
scontext=u:r:mediacodec:s0 tcontext=u:object_r:sysfs:s0 \
tclass=file permissive=1

avc: denied { open } for path="/sys/devices/platform/mfc/video4linux/video7/name" \
dev="sysfs" ino=62278 scontext=u:r:mediacodec:s0 tcontext=u:object_r:sysfs:s0 \
tclass=file permissive=1

avc: denied { getattr } for path="/sys/devices/platform/mfc/video4linux/video7/name" \
dev="sysfs" ino=62278 scontext=u:r:mediacodec:s0 tcontext=u:object_r:sysfs:s0 \
tclass=file permissive=1

avc: denied { read } for name="name" dev="sysfs" ino=62230 \
scontext=u:r:mediacodec:s0 tcontext=u:object_r:sysfs:s0 \
tclass=file permissive=1

avc: denied { open } for path="/sys/devices/platform/mfc/video4linux/video6/name" \
dev="sysfs" ino=62230 scontext=u:r:mediacodec:s0 tcontext=u:object_r:sysfs:s0 \
tclass=file permissive=1

avc: denied { getattr } for path="/sys/devices/platform/mfc/video4linux/video6/name" \
dev="sysfs" ino=62230 scontext=u:r:mediacodec:s0 tcontext=u:object_r:sysfs:s0 \
tclass=file permissive=1

Bug: 172173484
Test: video playback / camera recording with enforcing mode
Change-Id: Id7f43fe11c9ed089067f43a50d7f765df873d6c6
 2021-03-12 10:51:41 +08:00
Eddie Tashjian
78cd6eb78e Add selinux policies for mounted modem parition 
Bug: 178980032
Bug: 178979986
Bug: 179198083
Bug: 179198085
Bug: 178980065

Test: Check selinux denials
Change-Id: I7f826442d1536946d0e84aadfd80f679c0f4d6da
 2021-03-11 10:16:27 +00:00
SalmaxChang
4d87bc0f2a cbd: Fix avc errors 
avc: denied { write } for comm="cbd" name="ssrdump" dev="dm-9" ino=284 scontext=u:r:cbd:s0 tcontext=u:object_r:sscoredump_vendor_data_crashinfo_file:s0 tclass=dir
avc: denied { add_name } for comm="cbd" name="crashinfo_modem_2021-03-02_10-57-06.txt" scontext=u:r:cbd:s0 tcontext=u:object_r:sscoredump_vendor_data_crashinfo_file:s0 tclass=dir
avc: denied { write } for comm="sh" name="image" dev="dm-9" ino=231 scontext=u:r:cbd:s0 tcontext=u:object_r:radio_vendor_data_file:s0 tclass=dir
avc: denied { read } for comm="cbd" name="u:object_r:radio_prop:s0" dev="tmpfs" ino=206 scontext=u:r:cbd:s0 tcontext=u:object_r:radio_prop:s0 tclass=file
avc: denied { search } for comm="cbd" name="/" dev="sda15" ino=2 scontext=u:r:cbd:s0 tcontext=u:object_r:persist_file:s0 tclass=dir
avc: denied { syslog_read } for comm="cbd" scontext=u:r:cbd:s0 tcontext=u:r:kernel:s0 tclass=system

Bug: 179198083
Bug: 178331928
Bug: 171267363
Change-Id: I8a89e360e6d614ad76ed2eb78467fcbedf1ea0ce
 2021-03-08 06:00:45 +00:00
Robin Peng
5009efa776 Move slider-sepolicy into gs101-sepolicy 
from: 71e609c24c97fc8d44843af30527cbeb90d5dcdf

Bug: 167996145
Change-Id: Ie00e7e0983a3ca695bbd5140c929d07a80144301
 2021-03-06 16:15:39 +08:00