From bb7586ac0333f97766c53e7fc72796255a523855 Mon Sep 17 00:00:00 2001 From: Ernie Hsu Date: Tue, 20 Dec 2022 02:55:07 +0000 Subject: [PATCH] mediacodec_samsung: add sepolicy for mfc codec Add necessary sepolicy. Log and reason are added in review comment move sysfs out from legacy setting Bug: 262633502 Bug: 263049105 Bug: 262794577 Bug: 262794578 Bug: 262794634 Test: video playback SELinuxTest#scanBugreport SELinuxTest#scanAvcDeniedLogRightAfterReboot Change-Id: I240f3fc4672a0d3133699f76a808573e172d23f2 --- legacy/whitechapel_pro/file.te | 1 - legacy/whitechapel_pro/genfs_contexts | 3 --- tracking_denials/dumpstate.te | 1 - tracking_denials/mediacodec_samsung.te | 28 -------------------------- vendor/file.te | 3 +++ vendor/genfs_contexts | 3 +++ vendor/mediacodec_samsung.te | 24 ++++++++++++++++++++++ 7 files changed, 30 insertions(+), 33 deletions(-) delete mode 100644 tracking_denials/mediacodec_samsung.te diff --git a/legacy/whitechapel_pro/file.te b/legacy/whitechapel_pro/file.te index db630ebb..3a40bfc2 100644 --- a/legacy/whitechapel_pro/file.te +++ b/legacy/whitechapel_pro/file.te @@ -26,7 +26,6 @@ type sysfs_exynos_bts_stats, sysfs_type, fs_type; type sysfs_bcmdhd, sysfs_type, fs_type; type sysfs_wlc, sysfs_type, fs_type; type sysfs_chargelevel, sysfs_type, fs_type; -type sysfs_mfc, sysfs_type, fs_type; type sysfs_cpu, sysfs_type, fs_type; type sysfs_camera, sysfs_type, fs_type; type sysfs_write_leds, sysfs_type, fs_type; diff --git a/legacy/whitechapel_pro/genfs_contexts b/legacy/whitechapel_pro/genfs_contexts index 9521c47a..f9cdcf10 100644 --- a/legacy/whitechapel_pro/genfs_contexts +++ b/legacy/whitechapel_pro/genfs_contexts @@ -81,9 +81,6 @@ genfscon sysfs /devices/platform/13200000.ufs/pixel/boot_lun_enabled u # Display genfscon sysfs /devices/platform/19440000.drmdsim/19440000.drmdsim.0/backlight/panel0-backlight/als_table u:object_r:sysfs_write_leds:s0 -# mediacodec_samsung -genfscon sysfs /devices/platform/mfc/video4linux/video u:object_r:sysfs_mfc:s0 - # Storage genfscon proc /fs/f2fs u:object_r:proc_f2fs:s0 genfscon proc /sys/vm/swappiness u:object_r:proc_dirty:s0 diff --git a/tracking_denials/dumpstate.te b/tracking_denials/dumpstate.te index 1d3cf67e..ae5728c2 100644 --- a/tracking_denials/dumpstate.te +++ b/tracking_denials/dumpstate.te @@ -19,7 +19,6 @@ dontaudit dumpstate system_data_file:dir { read }; dontaudit dumpstate vold:binder { call }; # b/262633248 dontaudit dumpstate mediacodec_google:process { signal }; -dontaudit dumpstate mediacodec_samsung:process { signal }; dontaudit dumpstate rild:binder { call }; # b/263048776 dontaudit dumpstate hal_usb_impl:binder { call }; diff --git a/tracking_denials/mediacodec_samsung.te b/tracking_denials/mediacodec_samsung.te deleted file mode 100644 index 77896953..00000000 --- a/tracking_denials/mediacodec_samsung.te +++ /dev/null @@ -1,28 +0,0 @@ -# b/262633502 -dontaudit mediacodec_samsung tombstoned:unix_stream_socket { connectto }; -dontaudit mediacodec_samsung tombstoned_crash_socket:sock_file { write }; -# b/262794634 -dontaudit mediacodec_samsung dmabuf_system_heap_device:chr_file { getattr }; -dontaudit mediacodec_samsung eco_service:service_manager { add }; -dontaudit mediacodec_samsung hwservicemanager:binder { call }; -dontaudit mediacodec_samsung hwservicemanager:binder { transfer }; -dontaudit mediacodec_samsung hwservicemanager_prop:file { getattr }; -dontaudit mediacodec_samsung hwservicemanager_prop:file { map }; -dontaudit mediacodec_samsung hwservicemanager_prop:file { open }; -dontaudit mediacodec_samsung hwservicemanager_prop:file { read }; -dontaudit mediacodec_samsung appdomain:binder { transfer }; -dontaudit mediacodec_samsung mediaserver:binder { transfer }; -dontaudit mediacodec_samsung mediaswcodec:binder { transfer }; -dontaudit mediacodec_samsung platform_app:binder { transfer }; -dontaudit mediacodec_samsung system_server:binder { transfer }; -dontaudit mediacodec_samsung vndbinder_device:chr_file { ioctl }; -dontaudit mediacodec_samsung vndbinder_device:chr_file { map }; -dontaudit mediacodec_samsung vndbinder_device:chr_file { open }; -dontaudit mediacodec_samsung vndbinder_device:chr_file { read }; -dontaudit mediacodec_samsung vndbinder_device:chr_file { write }; -dontaudit mediacodec_samsung vndservicemanager:binder { call }; -dontaudit mediacodec_samsung vndservicemanager:binder { transfer }; -# b/263049105 -dontaudit mediacodec_samsung dumpstate:fd { use }; -dontaudit mediacodec_samsung dumpstate:fifo_file { append }; -dontaudit mediacodec_samsung dumpstate:fifo_file { write }; diff --git a/vendor/file.te b/vendor/file.te index 2ce98bb8..3e4f7bef 100644 --- a/vendor/file.te +++ b/vendor/file.te @@ -1,2 +1,5 @@ # persist type persist_display_file, file_type, vendor_persist_type; + +#sysfs +type sysfs_mfc, sysfs_type, fs_type; diff --git a/vendor/genfs_contexts b/vendor/genfs_contexts index f30dc4fd..e671a374 100644 --- a/vendor/genfs_contexts +++ b/vendor/genfs_contexts @@ -36,6 +36,9 @@ genfscon sysfs /devices/platform/19470000.drmdecon/dqe0/atc genfscon sysfs /module/drm/parameters/vblankoffdelay u:object_r:sysfs_display:s0 genfscon sysfs /devices/platform/exynos-drm/tui_status u:object_r:sysfs_display:s0 +# mediacodec_samsung +genfscon sysfs /devices/platform/mfc/video4linux/video u:object_r:sysfs_mfc:s0 + # wake up nodes genfscon sysfs /devices/platform/10c80000.hsi2c/i2c-0/6-0008/wakeup/wakeup u:object_r:sysfs_wakeup:s0 genfscon sysfs /devices/platform/10c90000.hsi2c/i2c-0/7-003c/power_supply/wireless/wakeup u:object_r:sysfs_wakeup:s0 diff --git a/vendor/mediacodec_samsung.te b/vendor/mediacodec_samsung.te index 8aec0da5..efc83d73 100644 --- a/vendor/mediacodec_samsung.te +++ b/vendor/mediacodec_samsung.te @@ -2,6 +2,25 @@ type mediacodec_samsung, domain; type mediacodec_samsung_exec, vendor_file_type, exec_type, file_type; init_daemon_domain(mediacodec_samsung) +hal_server_domain(mediacodec_samsung, hal_codec2) +add_service(mediacodec_samsung, eco_service) + +vndbinder_use(mediacodec_samsung) + +allow mediacodec_samsung video_device:chr_file rw_file_perms; +allow mediacodec_samsung dmabuf_system_heap_device:chr_file r_file_perms; +allow mediacodec_samsung gpu_device:chr_file rw_file_perms; + +allow mediacodec_samsung sysfs_mfc:file r_file_perms; +allow mediacodec_samsung sysfs_mfc:dir r_dir_perms; + +# can use graphics allocator +hal_client_domain(mediacodec_samsung, hal_graphics_allocator) + +binder_call(mediacodec_samsung, hal_camera_default) + +crash_dump_fallback(mediacodec_samsung) + # mediacodec_samsung should never execute any executable without a domain transition neverallow mediacodec_samsung { file_type fs_type }:file execute_no_trans; @@ -11,3 +30,8 @@ neverallow mediacodec_samsung { file_type fs_type }:file execute_no_trans; # https://android-developers.googleblog.com/2016/05/hardening-media-stack.html neverallow mediacodec_samsung domain:{ udp_socket rawip_socket } *; neverallow mediacodec_samsung { domain userdebug_or_eng(`-su') }:tcp_socket *; + +userdebug_or_eng(` + allow mediacodec_samsung vendor_media_data_file:dir rw_dir_perms; + allow mediacodec_samsung vendor_media_data_file:file create_file_perms; +')