Evolution-X-Tensor/device_google_gs201
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Move coredomain policies to system_ext/product am: da30985fa5 am: 0827b82595

Browse source 
Original change: https://googleplex-android-review.googlesource.com/c/device/google/gs201-sepolicy/+/24354374

Change-Id: I21a6ae897a80a8954639e15ebb16218a0e324350
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
This commit is contained in:
Inseob Kim 2023-08-09 07:35:43 +00:00 • committed by Automerger Merge Worker
commit 0a40b3bb98
16 changed files with 70 additions and 67 deletions
Download patch file Download diff file Expand all files Collapse all files

1
gs201-sepolicy.mk
View file

@ -4,6 +4,7 @@ BOARD_SEPOLICY_DIRS += device/google/gs201-sepolicy/whitechapel_pro
# unresolved SELinux error log with bug tracking # unresolved SELinux error log with bug tracking
BOARD_SEPOLICY_DIRS += device/google/gs201-sepolicy/tracking_denials BOARD_SEPOLICY_DIRS += device/google/gs201-sepolicy/tracking_denials
PRODUCT_PUBLIC_SEPOLICY_DIRS += device/google/gs201-sepolicy/public
PRODUCT_PRIVATE_SEPOLICY_DIRS += device/google/gs201-sepolicy/private PRODUCT_PRIVATE_SEPOLICY_DIRS += device/google/gs201-sepolicy/private
# system_ext # system_ext

16
private/debug_camera_app.te Normal file
View file

@ -0,0 +1,16 @@
typeattribute debug_camera_app coredomain;
userdebug_or_eng(`
app_domain(debug_camera_app)
net_domain(debug_camera_app)
allow debug_camera_app app_api_service:service_manager find;
allow debug_camera_app audioserver_service:service_manager find;
allow debug_camera_app cameraserver_service:service_manager find;
allow debug_camera_app mediaextractor_service:service_manager find;
allow debug_camera_app mediametrics_service:service_manager find;
allow debug_camera_app mediaserver_service:service_manager find;
# Allows camera app to access the PowerHAL.
hal_client_domain(debug_camera_app, hal_power)
')

14
private/google_camera_app.te Normal file
View file

@ -0,0 +1,14 @@
typeattribute google_camera_app coredomain;
app_domain(google_camera_app)
net_domain(google_camera_app)
allow google_camera_app app_api_service:service_manager find;
allow google_camera_app audioserver_service:service_manager find;
allow google_camera_app cameraserver_service:service_manager find;
allow google_camera_app mediaextractor_service:service_manager find;
allow google_camera_app mediametrics_service:service_manager find;
allow google_camera_app mediaserver_service:service_manager find;
# Allows camera app to access the PowerHAL.
hal_client_domain(google_camera_app, hal_power)

11
private/seapp_contexts Normal file
View file

@ -0,0 +1,11 @@
# Google Camera
user=_app isPrivApp=true seinfo=google name=com.google.android.GoogleCamera domain=google_camera_app type=app_data_file levelFrom=all
# Also allow GoogleCameraNext, the fishfood version, the same access as GoogleCamera
user=_app seinfo=CameraFishfood name=com.google.android.apps.googlecamera.fishfood domain=google_camera_app type=app_data_file levelFrom=all
# Google Camera Eng
user=_app seinfo=CameraEng name=com.google.android.GoogleCameraEng domain=debug_camera_app type=app_data_file levelFrom=all
# Also label GoogleCameraNext, built with debug keys as debug_camera_app.
user=_app seinfo=CameraEng name=com.google.android.apps.googlecamera.fishfood domain=debug_camera_app type=app_data_file levelFrom=all

1
public/debug_camera_app.te Normal file
View file

@ -0,0 +1 @@
type debug_camera_app, domain;

1
public/google_camera_app.te Normal file
View file

@ -0,0 +1 @@
type google_camera_app, domain;

7
system_ext/private/con_monitor.te Normal file
View file

@ -0,0 +1,7 @@
typeattribute con_monitor_app coredomain;
app_domain(con_monitor_app)
set_prop(con_monitor_app, radio_prop)
allow con_monitor_app app_api_service:service_manager find;
allow con_monitor_app radio_service:service_manager find;

11
system_ext/private/hbmsvmanager_app.te Normal file
View file

@ -0,0 +1,11 @@
typeattribute hbmsvmanager_app coredomain;
app_domain(hbmsvmanager_app);
allow hbmsvmanager_app proc_vendor_sched:dir r_dir_perms;
allow hbmsvmanager_app proc_vendor_sched:file w_file_perms;
# Standard system services
allow hbmsvmanager_app app_api_service:service_manager find;
allow hbmsvmanager_app cameraserver_service:service_manager find;

5
system_ext/private/seapp_contexts Normal file
View file

@ -0,0 +1,5 @@
# Domain for connectivity monitor
user=_app isPrivApp=true seinfo=platform name=com.google.android.connectivitymonitor domain=con_monitor_app type=app_data_file levelFrom=all
# HbmSVManager
user=_app seinfo=platform name=com.android.hbmsvmanager domain=hbmsvmanager_app type=app_data_file levelFrom=all

2
system_ext/public/con_monitor.te Normal file
View file

@ -0,0 +1,2 @@
# ConnectivityMonitor app
type con_monitor_app, domain;

1
system_ext/public/hbmsvmanager_app.te Normal file
View file

@ -0,0 +1 @@
type hbmsvmanager_app, domain;

8
whitechapel_pro/con_monitor.te
View file

@ -1,10 +1,2 @@
# ConnectivityMonitor app
type con_monitor_app, domain, coredomain;
app_domain(con_monitor_app)
set_prop(con_monitor_app, radio_prop)
allow con_monitor_app app_api_service:service_manager find;
allow con_monitor_app radio_service:service_manager find;
allow con_monitor_app radio_vendor_data_file:dir rw_dir_perms; allow con_monitor_app radio_vendor_data_file:dir rw_dir_perms;
allow con_monitor_app radio_vendor_data_file:file create_file_perms; allow con_monitor_app radio_vendor_data_file:file create_file_perms;

15
whitechapel_pro/debug_camera_app.te
View file

@ -1,24 +1,9 @@
type debug_camera_app, domain, coredomain;
userdebug_or_eng(` userdebug_or_eng(`
app_domain(debug_camera_app)
net_domain(debug_camera_app)
allow debug_camera_app app_api_service:service_manager find;
allow debug_camera_app audioserver_service:service_manager find;
allow debug_camera_app cameraserver_service:service_manager find;
allow debug_camera_app mediaextractor_service:service_manager find;
allow debug_camera_app mediametrics_service:service_manager find;
allow debug_camera_app mediaserver_service:service_manager find;
# Allows camera app to access the GXP device. # Allows camera app to access the GXP device.
allow debug_camera_app gxp_device:chr_file rw_file_perms; allow debug_camera_app gxp_device:chr_file rw_file_perms;
# Allows camera app to search for GXP firmware file. # Allows camera app to search for GXP firmware file.
allow debug_camera_app vendor_fw_file:dir search; allow debug_camera_app vendor_fw_file:dir search;
# Allows camera app to access the PowerHAL.
hal_client_domain(debug_camera_app, hal_power)
') ')
userdebug_or_eng(` userdebug_or_eng(`
# Allows GCA-Eng to find and access the EdgeTPU. # Allows GCA-Eng to find and access the EdgeTPU.

14
whitechapel_pro/google_camera_app.te
View file

@ -1,23 +1,9 @@
type google_camera_app, domain, coredomain;
app_domain(google_camera_app)
net_domain(google_camera_app)
allow google_camera_app app_api_service:service_manager find;
allow google_camera_app audioserver_service:service_manager find;
allow google_camera_app cameraserver_service:service_manager find;
allow google_camera_app mediaextractor_service:service_manager find;
allow google_camera_app mediametrics_service:service_manager find;
allow google_camera_app mediaserver_service:service_manager find;
# Allows camera app to access the GXP device. # Allows camera app to access the GXP device.
allow google_camera_app gxp_device:chr_file rw_file_perms; allow google_camera_app gxp_device:chr_file rw_file_perms;
# Allows camera app to search for GXP firmware file. # Allows camera app to search for GXP firmware file.
allow google_camera_app vendor_fw_file:dir search; allow google_camera_app vendor_fw_file:dir search;
# Allows camera app to access the PowerHAL.
hal_client_domain(google_camera_app, hal_power)
# Allows GCA to find and access the EdgeTPU. # Allows GCA to find and access the EdgeTPU.
allow google_camera_app edgetpu_app_service:service_manager find; allow google_camera_app edgetpu_app_service:service_manager find;
allow google_camera_app edgetpu_device:chr_file { getattr read write ioctl map }; allow google_camera_app edgetpu_device:chr_file { getattr read write ioctl map };

12
whitechapel_pro/hbmsvmanager_app.te
View file

@ -1,14 +1,2 @@
type hbmsvmanager_app, domain, coredomain;
app_domain(hbmsvmanager_app);
allow hbmsvmanager_app proc_vendor_sched:dir r_dir_perms;
allow hbmsvmanager_app proc_vendor_sched:file w_file_perms;
allow hbmsvmanager_app hal_pixel_display_service:service_manager find; allow hbmsvmanager_app hal_pixel_display_service:service_manager find;
binder_call(hbmsvmanager_app, hal_graphics_composer_default) binder_call(hbmsvmanager_app, hal_graphics_composer_default)
# Standard system services
allow hbmsvmanager_app app_api_service:service_manager find;
allow hbmsvmanager_app cameraserver_service:service_manager find;

18
whitechapel_pro/seapp_contexts
View file

@ -27,15 +27,9 @@ user=_app isPrivApp=true seinfo=platform name=com.thales.device.ofl.app.basicag
# Domain for omadm # Domain for omadm
user=_app isPrivApp=true seinfo=platform name=com.android.omadm.service domain=omadm_app type=app_data_file levelFrom=all user=_app isPrivApp=true seinfo=platform name=com.android.omadm.service domain=omadm_app type=app_data_file levelFrom=all
# HbmSVManager
user=_app seinfo=platform name=com.android.hbmsvmanager domain=hbmsvmanager_app type=app_data_file levelFrom=all
# grilservice # grilservice
user=_app isPrivApp=true name=com.google.android.grilservice domain=grilservice_app levelFrom=all user=_app isPrivApp=true name=com.google.android.grilservice domain=grilservice_app levelFrom=all
# Domain for connectivity monitor
user=_app isPrivApp=true seinfo=platform name=com.google.android.connectivitymonitor domain=con_monitor_app type=app_data_file levelFrom=all
# Modem Diagnostic System # Modem Diagnostic System
user=_app isPrivApp=true seinfo=mds name=com.google.mds domain=modem_diagnostic_app type=app_data_file levelFrom=user user=_app isPrivApp=true seinfo=mds name=com.google.mds domain=modem_diagnostic_app type=app_data_file levelFrom=user
@ -52,18 +46,6 @@ user=_app isPrivApp=true seinfo=EuiccSupportPixel name=com.google.euiccpixel dom
# Sub System Ramdump # Sub System Ramdump
user=system seinfo=platform name=com.google.SSRestartDetector domain=ssr_detector_app type=system_app_data_file levelFrom=user user=system seinfo=platform name=com.google.SSRestartDetector domain=ssr_detector_app type=system_app_data_file levelFrom=user
# Google Camera
user=_app isPrivApp=true seinfo=google name=com.google.android.GoogleCamera domain=google_camera_app type=app_data_file levelFrom=all
# Google Camera Eng
user=_app seinfo=CameraEng name=com.google.android.GoogleCameraEng domain=debug_camera_app type=app_data_file levelFrom=all
# Also allow GoogleCameraNext, the fishfood version, the same access as GoogleCamera
user=_app seinfo=CameraFishfood name=com.google.android.apps.googlecamera.fishfood domain=google_camera_app type=app_data_file levelFrom=all
# Also label GoogleCameraNext, built with debug keys as debug_camera_app.
user=_app seinfo=CameraEng name=com.google.android.apps.googlecamera.fishfood domain=debug_camera_app type=app_data_file levelFrom=all
# Domain for CatEngineService # Domain for CatEngineService
user=system seinfo=platform name=com.google.android.CatEngine domain=cat_engine_service_app type=system_app_data_file levelFrom=all user=system seinfo=platform name=com.google.android.CatEngine domain=cat_engine_service_app type=system_app_data_file levelFrom=all