diff --git a/sepolicy/OWNERS b/sepolicy/OWNERS new file mode 100644 index 0000000..5232bc3 --- /dev/null +++ b/sepolicy/OWNERS @@ -0,0 +1,4 @@ +include device/google/gs-common:/sepolicy/OWNERS + +adamshih@google.com + diff --git a/sepolicy/husky-sepolicy.mk b/sepolicy/husky-sepolicy.mk new file mode 100644 index 0000000..73742a8 --- /dev/null +++ b/sepolicy/husky-sepolicy.mk @@ -0,0 +1,5 @@ +# sepolicy exclusively for husky. +BOARD_SEPOLICY_DIRS += device/google/shusky-sepolicy/husky + +# unresolved SELinux error log with bug tracking +BOARD_SEPOLICY_DIRS += device/google/shusky-sepolicy/tracking_denials diff --git a/sepolicy/husky/README.txt b/sepolicy/husky/README.txt new file mode 100644 index 0000000..67a320f --- /dev/null +++ b/sepolicy/husky/README.txt @@ -0,0 +1,2 @@ +This folder holds sepolicy exclusively for one device. For example, genfs_contexts +paths that are affected by device tree. diff --git a/sepolicy/husky/file_contexts b/sepolicy/husky/file_contexts new file mode 100644 index 0000000..cae0049 --- /dev/null +++ b/sepolicy/husky/file_contexts @@ -0,0 +1,4 @@ +# Bluetooth +/dev/ttySAC18 u:object_r:hci_attach_dev:s0 +/dev/logbuffer_btlpm u:object_r:logbuffer_device:s0 +/dev/logbuffer_tty18 u:object_r:logbuffer_device:s0 diff --git a/sepolicy/husky/genfs_contexts b/sepolicy/husky/genfs_contexts new file mode 100644 index 0000000..632676b --- /dev/null +++ b/sepolicy/husky/genfs_contexts @@ -0,0 +1,8 @@ +# Haptics +genfscon sysfs /devices/platform/10c80000.hsi2c/i2c-0/0-0043 u:object_r:sysfs_vibrator:s0 + +# WLC +genfscon sysfs /devices/platform/10c90000.hsi2c/i2c-9/9-003c u:object_r:sysfs_wlc:s0 + +# GPS +genfscon sysfs /devices/platform/111e0000.spi/spi_master/spi21/spi21.0/nstandby u:object_r:sysfs_gps:s0 diff --git a/sepolicy/husky/radio.te b/sepolicy/husky/radio.te new file mode 100644 index 0000000..a2c40a1 --- /dev/null +++ b/sepolicy/husky/radio.te @@ -0,0 +1 @@ +allow radio scheduling_policy_service:service_manager find; diff --git a/sepolicy/husky/vendor_init.te b/sepolicy/husky/vendor_init.te new file mode 100644 index 0000000..3f4df0e --- /dev/null +++ b/sepolicy/husky/vendor_init.te @@ -0,0 +1,2 @@ +# Display +set_prop(vendor_init, vendor_display_prop) diff --git a/sepolicy/ripcurrent-sepolicy.mk b/sepolicy/ripcurrent-sepolicy.mk new file mode 100644 index 0000000..4207725 --- /dev/null +++ b/sepolicy/ripcurrent-sepolicy.mk @@ -0,0 +1,3 @@ +# sepolicy that are shared among devices using whitechapel +BOARD_SEPOLICY_DIRS += device/google/shusky-sepolicy/ripcurrent + diff --git a/sepolicy/ripcurrent/README.txt b/sepolicy/ripcurrent/README.txt new file mode 100644 index 0000000..67a320f --- /dev/null +++ b/sepolicy/ripcurrent/README.txt @@ -0,0 +1,2 @@ +This folder holds sepolicy exclusively for one device. For example, genfs_contexts +paths that are affected by device tree. diff --git a/sepolicy/ripcurrent/file_contexts b/sepolicy/ripcurrent/file_contexts new file mode 100644 index 0000000..cae0049 --- /dev/null +++ b/sepolicy/ripcurrent/file_contexts @@ -0,0 +1,4 @@ +# Bluetooth +/dev/ttySAC18 u:object_r:hci_attach_dev:s0 +/dev/logbuffer_btlpm u:object_r:logbuffer_device:s0 +/dev/logbuffer_tty18 u:object_r:logbuffer_device:s0 diff --git a/sepolicy/ripcurrent/genfs_contexts b/sepolicy/ripcurrent/genfs_contexts new file mode 100644 index 0000000..ffff32a --- /dev/null +++ b/sepolicy/ripcurrent/genfs_contexts @@ -0,0 +1,10 @@ +# Haptics +genfscon sysfs /devices/platform/10c80000.hsi2c/i2c-0/0-0042 u:object_r:sysfs_vibrator:s0 +genfscon sysfs /devices/platform/10c80000.hsi2c/i2c-0/0-0043 u:object_r:sysfs_vibrator:s0 + +# WLC +genfscon sysfs /devices/platform/10c90000.hsi2c/i2c-9/9-003c u:object_r:sysfs_wlc:s0 +genfscon sysfs /devices/platform/10c90000.hsi2c/i2c-9/9-003b u:object_r:sysfs_wlc:s0 + +# GPS +genfscon sysfs /devices/platform/111e0000.spi/spi_master/spi21/spi21.0/nstandby u:object_r:sysfs_gps:s0 diff --git a/sepolicy/shiba-sepolicy.mk b/sepolicy/shiba-sepolicy.mk new file mode 100644 index 0000000..114c114 --- /dev/null +++ b/sepolicy/shiba-sepolicy.mk @@ -0,0 +1,5 @@ +# sepolicy exclusively for shiba. +BOARD_SEPOLICY_DIRS += device/google/shusky-sepolicy/shiba + +# unresolved SELinux error log with bug tracking +BOARD_SEPOLICY_DIRS += device/google/shusky-sepolicy/tracking_denials diff --git a/sepolicy/shiba/README.txt b/sepolicy/shiba/README.txt new file mode 100644 index 0000000..67a320f --- /dev/null +++ b/sepolicy/shiba/README.txt @@ -0,0 +1,2 @@ +This folder holds sepolicy exclusively for one device. For example, genfs_contexts +paths that are affected by device tree. diff --git a/sepolicy/shiba/file_contexts b/sepolicy/shiba/file_contexts new file mode 100644 index 0000000..cae0049 --- /dev/null +++ b/sepolicy/shiba/file_contexts @@ -0,0 +1,4 @@ +# Bluetooth +/dev/ttySAC18 u:object_r:hci_attach_dev:s0 +/dev/logbuffer_btlpm u:object_r:logbuffer_device:s0 +/dev/logbuffer_tty18 u:object_r:logbuffer_device:s0 diff --git a/sepolicy/shiba/genfs_contexts b/sepolicy/shiba/genfs_contexts new file mode 100644 index 0000000..632676b --- /dev/null +++ b/sepolicy/shiba/genfs_contexts @@ -0,0 +1,8 @@ +# Haptics +genfscon sysfs /devices/platform/10c80000.hsi2c/i2c-0/0-0043 u:object_r:sysfs_vibrator:s0 + +# WLC +genfscon sysfs /devices/platform/10c90000.hsi2c/i2c-9/9-003c u:object_r:sysfs_wlc:s0 + +# GPS +genfscon sysfs /devices/platform/111e0000.spi/spi_master/spi21/spi21.0/nstandby u:object_r:sysfs_gps:s0 diff --git a/sepolicy/shiba/radio.te b/sepolicy/shiba/radio.te new file mode 100644 index 0000000..a2c40a1 --- /dev/null +++ b/sepolicy/shiba/radio.te @@ -0,0 +1 @@ +allow radio scheduling_policy_service:service_manager find; diff --git a/sepolicy/tracking_denials/file.te b/sepolicy/tracking_denials/file.te new file mode 100644 index 0000000..e348a15 --- /dev/null +++ b/sepolicy/tracking_denials/file.te @@ -0,0 +1,2 @@ +# b/301300623 +typeattribute sysfs_touch_gti mlstrustedobject; diff --git a/sepolicy/tracking_denials/priv_app.te b/sepolicy/tracking_denials/priv_app.te new file mode 100644 index 0000000..6e25d2e --- /dev/null +++ b/sepolicy/tracking_denials/priv_app.te @@ -0,0 +1,4 @@ +# b/301300623 +allow priv_app app_api_service:service_manager find; +allow priv_app sysfs_touch_gti:file rw_file_perms; +allow priv_app sysfs_touch_gti:file { getattr open read write };