From 4041f814bed47dcefb9d40d1aa6b8b5176fe0d9e Mon Sep 17 00:00:00 2001 From: Peter Csaszar Date: Mon, 14 Feb 2022 20:29:23 -0800 Subject: [PATCH] pixel-selinux: add SJTAG policies These are the SELinux policies for the sysfs files of the SJTAG kernel interface. The files are in the following directories: /sys/devices/platform/sjtag_ap/interface/ /sys/devices/platform/sjtag_gsa/interface/ Bug: 207571417 Signed-off-by: Peter Csaszar Change-Id: I5ec50d9ff7cd0e08ade7acce21e73751e93a0aff --- whitechapel_pro/file.te | 11 +++++++++++ whitechapel_pro/genfs_contexts | 4 ++++ whitechapel_pro/shell.te | 5 +++++ whitechapel_pro/ssr_detector.te | 5 +++++ 4 files changed, 25 insertions(+) create mode 100644 whitechapel_pro/shell.te diff --git a/whitechapel_pro/file.te b/whitechapel_pro/file.te index 971e4657..e4248525 100644 --- a/whitechapel_pro/file.te +++ b/whitechapel_pro/file.te @@ -91,3 +91,14 @@ type sysfs_st33spi, sysfs_type, fs_type; # GPU type sysfs_gpu, sysfs_type, fs_type; + +# Vendor sched files +userdebug_or_eng(` + typeattribute sysfs_vendor_sched mlstrustedobject; +') + +# SJTAG +type sysfs_sjtag, fs_type, sysfs_type; +userdebug_or_eng(` + typeattribute sysfs_sjtag mlstrustedobject; +') diff --git a/whitechapel_pro/genfs_contexts b/whitechapel_pro/genfs_contexts index ba3dc909..f7f43487 100644 --- a/whitechapel_pro/genfs_contexts +++ b/whitechapel_pro/genfs_contexts @@ -210,3 +210,7 @@ genfscon sysfs /devices/platform/100b0000.TPU u:obje # Camera genfscon sysfs /devices/platform/17000030.devfreq_intcam/devfreq/17000030.devfreq_intcam/min_freq u:object_r:sysfs_camera:s0 genfscon sysfs /devices/platform/17000060.devfreq_tnr/devfreq/17000060.devfreq_tnr/min_freq u:object_r:sysfs_camera:s0 + +# SJTAG +genfscon sysfs /devices/platform/sjtag_ap/interface u:object_r:sysfs_sjtag:s0 +genfscon sysfs /devices/platform/sjtag_gsa/interface u:object_r:sysfs_sjtag:s0 diff --git a/whitechapel_pro/shell.te b/whitechapel_pro/shell.te new file mode 100644 index 00000000..978a5426 --- /dev/null +++ b/whitechapel_pro/shell.te @@ -0,0 +1,5 @@ +# Allow access to the SJTAG kernel interface from the shell +userdebug_or_eng(` + allow shell sysfs_sjtag:dir r_dir_perms; + allow shell sysfs_sjtag:file rw_file_perms; +') diff --git a/whitechapel_pro/ssr_detector.te b/whitechapel_pro/ssr_detector.te index ff3c40f9..793e51b6 100644 --- a/whitechapel_pro/ssr_detector.te +++ b/whitechapel_pro/ssr_detector.te @@ -12,6 +12,11 @@ userdebug_or_eng(` allow ssr_detector_app sscoredump_vendor_data_coredump_file:dir r_dir_perms; allow ssr_detector_app sscoredump_vendor_data_coredump_file:file r_file_perms; get_prop(ssr_detector_app, vendor_aoc_prop) + allow ssr_detector_app sysfs_sjtag:dir r_dir_perms; + allow ssr_detector_app sysfs_sjtag:file rw_file_perms; + allow ssr_detector_app sysfs_vendor_sched:dir search; + allow ssr_detector_app sysfs_vendor_sched:file rw_file_perms; + allow ssr_detector_app cgroup:file write; ') get_prop(ssr_detector_app, vendor_ssrdump_prop)