Fix SELinux error coming from hal_secure_element_gto and gto_ese2
update hal_secure_element_st54spi/st33spi form gto/gto_ese2
hal_secure_element_gto.te => hal_secure_element_st54spi.te
[ 10.846098] type=1400 audit(1637296724.408:40): avc: denied { map } for comm="android.hardwar" path="/dev/__properties__/u:object_r:vendor_secure_element_prop:s0" dev="tmpfs" ino=327 scontext=u:r:hal_secure_element_gto:s0 tcontext=u:object_r:vendor_secure_element_prop:s0 tclass=file permissive=1
11-19 12:38:44.408 776 776 I android.hardwar: type=1400 audit(0.0:40): avc: denied { map } for path="/dev/__properties__/u:object_r:vendor_secure_element_prop:s0" dev="tmpfs" ino=327 scontext=u:r:hal_secure_element_gto:s0 tcontext=u:object_r:vendor_secure_element_prop:s0 tclass=file permissive=1
11-19 12:38:44.408 776 776 I android.hardwar: type=1400 audit(0.0:39): avc: denied { getattr } for path="/dev/__properties__/u:object_r:vendor_secure_element_prop:s0" dev="tmpfs" ino=327 scontext=u:r:hal_secure_element_gto:s0 tcontext=u:object_r:vendor_secure_element_prop:s0 tclass=file permissive=1
11-19 12:38:44.408 776 776 I android.hardwar: type=1400 audit(0.0:38): avc: denied { open } for path="/dev/__properties__/u:object_r:vendor_secure_element_prop:s0" dev="tmpfs" ino=327 scontext=u:r:hal_secure_element_gto:s0 tcontext=u:object_r:vendor_secure_element_prop:s0 tclass=file permissive=1
11-19 12:38:44.408 776 776 I android.hardwar: type=1400 audit(0.0:37): avc: denied { read } for name="u:object_r:vendor_secure_element_prop:s0" dev="tmpfs" ino=327 scontext=u:r:hal_secure_element_gto:s0 tcontext=u:object_r:vendor_secure_element_prop:s0 tclass=file permissive=1
[ 10.846033] type=1400 audit(1637296724.408:37): avc: denied { read } for comm="android.hardwar" name="u:object_r:vendor_secure_element_prop:s0" dev="tmpfs" ino=327 scontext=u:r:hal_secure_element_gto:s0 tcontext=u:object_r:vendor_secure_element_prop:s0 tclass=file permissive=1
[ 10.846072] type=1400 audit(1637296724.408:38): avc: denied { open } for comm="android.hardwar" path="/dev/__properties__/u:object_r:vendor_secure_element_prop:s0" dev="tmpfs" ino=327 scontext=u:r:hal_secure_element_gto:s0 tcontext=u:object_r:vendor_secure_element_prop:s0 tclass=file permissive=1
[ 10.846086] type=1400 audit(1637296724.408:39): avc: denied { getattr } for comm="android.hardwar" path="/dev/__properties__/u:object_r:vendor_secure_element_prop:s0" dev="tmpfs" ino=327 scontext=u:r:hal_secure_element_gto:s0 tcontext=u:object_r:vendor_secure_element_prop:s0 tclass=file permissive=1
11-11 09:38:59.132 785 785 I secure_element@: type=1400 audit(0.0:100): avc: denied { write } for name="property_service" dev="tmpfs" ino=357 scontext=u:r:hal_secure_element_gto:s0 tcontext=u:object_r:property_socket:s0 tclass=sock_file permissive=1
11-11 09:38:59.132 785 785 I secure_element@: type=1400 audit(0.0:101): avc: denied { connectto } for path="/dev/socket/property_service" scontext=u:r:hal_secure_element_gto:s0 tcontext=u:r:init:s0 tclass=unix_stream_socket permissive=1
[ 19.593472] type=1400 audit(1636594739.132:101): avc: denied { connectto } for comm="secure_element@" path="/dev/socket/property_service" scontext=u:r:hal_secure_element_gto:s0 tcontext=u:r:init:s0 tclass=unix_stream_socket permissive=1
[ 19.593175] type=1400 audit(1636594739.132:100): avc: denied { write } for comm="secure_element@" name="property_service" dev="tmpfs" ino=357 scontext=u:r:hal_secure_element_gto:s0 tcontext=u:object_r:property_socket:s0 tclass=sock_file permissive=1
11-09 12:04:08.620 786 786 I secure_element@: type=1400 audit(0.0:135): avc: denied { open } for path="/dev/st54spi" dev="tmpfs" ino=584 scontext=u:r:hal_secure_element_gto:s0 tcontext=u:object_r:secure_element_device:s0 tclass=chr_file permissive=1
[ 17.142141] type=1400 audit(1636430648.620:135): avc: denied { open } for comm="secure_element@" path="/dev/st54spi" dev="tmpfs" ino=584 scontext=u:r:hal_secure_element_gto:s0 tcontext=u:object_r:secure_element_device:s0 tclass=chr_file permissive=1
[ 17.141947] type=1400 audit(1636430648.620:134): avc: denied { read write } for comm="secure_element@" name="st54spi" dev="tmpfs" ino=584 scontext=u:r:hal_secure_element_gto:s0 tcontext=u:object_r:secure_element_device:s0 tclass=chr_file permissive=1
11-09 12:04:08.620 786 786 I secure_element@: type=1400 audit(0.0:134): avc: denied { read write } for name="st54spi" dev="tmpfs" ino=584 scontext=u:r:hal_secure_element_gto:s0 tcontext=u:object_r:secure_element_device:s0 tclass=chr_file permissive=1
11-04 13:27:24.564 1 1 I /system/bin/init: type=1107 audit(0.0:52): uid=0 auid=4294967295 ses=4294967295 subj=u:r:init:s0 msg='avc: denied { set } for property=persist.vendor.se.reset pid=772 uid=1068 gid=1068 scontext=u:r:hal_secure_element_gto:s0 tcontext=u:object_r:vendor_secure_element_prop:s0 tclass=property_service permissive=1'
11-19 10:22:25.052 797 797 I secure_element@: type=1400 audit(0.0:49): avc: denied { read write } for name="st21nfc" dev="tmpfs" ino=708 scontext=u:r:hal_secure_element_st54spi:s0 tcontext=u:object_r:nfc_device:s0 tclass=chr_file permissive=1
11-19 10:22:25.052 797 797 I secure_element@: type=1400 audit(0.0:50): avc: denied { open } for path="/dev/st21nfc" dev="tmpfs" ino=708 scontext=u:r:hal_secure_element_st54spi:s0 tcontext=u:object_r:nfc_device:s0 tclass=chr_file permissive=1
hal_secure_element_gto_ese2 => hal_secure_element_st33spi.te
11-09 12:04:09.140 771 771 I secure_element@: type=1400 audit(0.0:137): avc: denied { open } for path="/dev/st33spi" dev="tmpfs" ino=728 scontext=u:r:hal_secure_element_gto_ese2:s0 tcontext=u:object_r:secure_element_device:s0 tclass=chr_file permissive=1
[ 17.660987] type=1400 audit(1636430649.140:137): avc: denied { open } for comm="secure_element@" path="/dev/st33spi" dev="tmpfs" ino=728 scontext=u:r:hal_secure_element_gto_ese2:s0 tcontext=u:object_r:secure_element_device:s0 tclass=chr_file permissive=1
[ 17.660845] type=1400 audit(1636430649.140:136): avc: denied { read write } for comm="secure_element@" name="st33spi" dev="tmpfs" ino=728 scontext=u:r:hal_secure_element_gto_ese2:s0 tcontext=u:object_r:secure_element_device:s0 tclass=chr_file permissive=1
11-09 12:04:09.140 771 771 I secure_element@: type=1400 audit(0.0:136): avc: denied { read write } for name="st33spi" dev="tmpfs" ino=728 scontext=u:r:hal_secure_element_gto_ese2:s0 tcontext=u:object_r:secure_element_device:s0 tclass=chr_file permissive=1
Bug: 207062261
Bug: 205073164
Bug: 205656951
Bug: 205657039
Bug: 205904452
Test: check avc without secure_element
Change-Id: I312299deb6d6bfa353e7936d41a723e75d3ea06b
This commit is contained in:
George Chang
parent
a1a5f11872
commit
d15185b2d7
7 changed files with 28 additions and 23 deletions
|
|
@ -1,13 +0,0 @@
|
|||
# b/205073164
|
||||
dontaudit hal_secure_element_gto vendor_secure_element_prop:property_service { set };
|
||||
# b/205656951
|
||||
dontaudit hal_secure_element_gto secure_element_device:chr_file { open };
|
||||
dontaudit hal_secure_element_gto secure_element_device:chr_file { read write };
|
||||
# b/205904452
|
||||
dontaudit hal_secure_element_gto init:unix_stream_socket { connectto };
|
||||
dontaudit hal_secure_element_gto property_socket:sock_file { write };
|
||||
# b/207062261
|
||||
dontaudit hal_secure_element_gto vendor_secure_element_prop:file { getattr };
|
||||
dontaudit hal_secure_element_gto vendor_secure_element_prop:file { map };
|
||||
dontaudit hal_secure_element_gto vendor_secure_element_prop:file { open };
|
||||
dontaudit hal_secure_element_gto vendor_secure_element_prop:file { read };
|
||||
|
|
@ -1,3 +0,0 @@
|
|||
# b/205657039
|
||||
dontaudit hal_secure_element_gto_ese2 secure_element_device:chr_file { open };
|
||||
dontaudit hal_secure_element_gto_ese2 secure_element_device:chr_file { read write };
|
||||
|
|
@ -17,3 +17,7 @@ type faceauth_heap_device, dmabuf_heap_device_type, dev_type;
|
|||
type vframe_heap_device, dmabuf_heap_device_type, dev_type;
|
||||
type vscaler_heap_device, dmabuf_heap_device_type, dev_type;
|
||||
|
||||
# SecureElement SPI device
|
||||
type st54spi_device, dev_type;
|
||||
type st33spi_device, dev_type;
|
||||
|
||||
|
|
|
|||
|
|
@ -28,8 +28,8 @@
|
|||
/vendor/bin/hw/android\.hardware\.dumpstate@1\.1-service\.gs201 u:object_r:hal_dumpstate_default_exec:s0
|
||||
/vendor/bin/hw/samsung\.hardware\.media\.c2@1\.0-service u:object_r:mediacodec_samsung_exec:s0
|
||||
/vendor/bin/hw/google\.hardware\.media\.c2@1\.0-service u:object_r:mediacodec_google_exec:s0
|
||||
/vendor/bin/hw/android\.hardware\.secure_element@1\.2-service-gto u:object_r:hal_secure_element_gto_exec:s0
|
||||
/vendor/bin/hw/android\.hardware\.secure_element@1\.2-service-gto-ese2 u:object_r:hal_secure_element_gto_ese2_exec:s0
|
||||
/vendor/bin/hw/android\.hardware\.secure_element@1\.2-service-gto u:object_r:hal_secure_element_st54spi_exec:s0
|
||||
/vendor/bin/hw/android\.hardware\.secure_element@1\.2-service-gto-ese2 u:object_r:hal_secure_element_st33spi_exec:s0
|
||||
/vendor/bin/hw/android\.hardware\.secure_element@1\.2-uicc-service u:object_r:hal_secure_element_uicc_exec:s0
|
||||
/vendor/bin/hw/android\.hardware\.biometrics\.fingerprint@2\.1-service\.goodix u:object_r:hal_fingerprint_default_exec:s0
|
||||
/vendor/bin/hw/android\.hardware\.biometrics\.fingerprint-service\.goodix u:object_r:hal_fingerprint_default_exec:s0
|
||||
|
|
@ -123,8 +123,8 @@
|
|||
/dev/trusty-ipc-dev0 u:object_r:tee_device:s0
|
||||
/dev/sg1 u:object_r:sg_device:s0
|
||||
/dev/st21nfc u:object_r:nfc_device:s0
|
||||
/dev/st54spi u:object_r:secure_element_device:s0
|
||||
/dev/st33spi u:object_r:secure_element_device:s0
|
||||
/dev/st54spi u:object_r:st54spi_device:s0
|
||||
/dev/st33spi u:object_r:st33spi_device:s0
|
||||
/dev/ttyGS[0-3] u:object_r:serial_device:s0
|
||||
/dev/oem_ipc[0-7] u:object_r:radio_device:s0
|
||||
/dev/umts_boot0 u:object_r:radio_device:s0
|
||||
|
|
|
|||
6
whitechapel_pro/hal_secure_element_st33spi.te
Normal file
6
whitechapel_pro/hal_secure_element_st33spi.te
Normal file
|
|
@ -0,0 +1,6 @@
|
|||
type hal_secure_element_st33spi, domain;
|
||||
hal_server_domain(hal_secure_element_st33spi, hal_secure_element)
|
||||
type hal_secure_element_st33spi_exec, exec_type, vendor_file_type, file_type;
|
||||
init_daemon_domain(hal_secure_element_st33spi)
|
||||
allow hal_secure_element_st33spi st33spi_device:chr_file rw_file_perms;
|
||||
|
||||
8
whitechapel_pro/hal_secure_element_st54spi.te
Normal file
8
whitechapel_pro/hal_secure_element_st54spi.te
Normal file
|
|
@ -0,0 +1,8 @@
|
|||
type hal_secure_element_st54spi, domain;
|
||||
hal_server_domain(hal_secure_element_st54spi, hal_secure_element)
|
||||
type hal_secure_element_st54spi_exec, exec_type, vendor_file_type, file_type;
|
||||
init_daemon_domain(hal_secure_element_st54spi)
|
||||
allow hal_secure_element_st54spi st54spi_device:chr_file rw_file_perms;
|
||||
allow hal_secure_element_st54spi nfc_device:chr_file rw_file_perms;
|
||||
set_prop(hal_secure_element_st54spi, vendor_secure_element_prop)
|
||||
|
||||
|
|
@ -11,7 +11,10 @@ userdebug_or_eng(`
|
|||
allow ofl_app radio_service:service_manager find;
|
||||
allow ofl_app surfaceflinger_service:service_manager find;
|
||||
|
||||
# Access to directly update firmware on secure_element
|
||||
typeattribute secure_element_device mlstrustedobject;
|
||||
allow ofl_app secure_element_device:chr_file rw_file_perms;
|
||||
# Access to directly update firmware on st54spi_device
|
||||
typeattribute st54spi_device mlstrustedobject;
|
||||
allow ofl_app st54spi_device:chr_file rw_file_perms;
|
||||
# Access to directly update firmware on st33spi_device
|
||||
typeattribute st33spi_device mlstrustedobject;
|
||||
allow ofl_app st33spi_device:chr_file rw_file_perms;
|
||||
')
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue