Evolution-X-Tensor/device_google_zuma
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add 'sepolicy/' from tag 'android-15.0.0_r1'

Browse source 
git-subtree-dir: sepolicy
git-subtree-mainline: 5ac4bfe691
git-subtree-split: 8c9dd0dbcd
Change-Id: If7ab7a231c42edd022de4786d0e0d92c6e77eef0
This commit is contained in:
Michael Bestas 2024-10-07 14:08:31 +03:00
commit 1f12b7b750
No known key found for this signature in database
GPG key ID: CC95044519BE6669
184 changed files with 3212 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

4
sepolicy/OWNERS Normal file
View file

@ -0,0 +1,4 @@
include device/google/gs-common:/sepolicy/OWNERS
adamshih@google.com

2
sepolicy/legacy/system_ext/private/property_contexts Normal file
View file

@ -0,0 +1,2 @@
# Fingerprint (UDFPS) GHBM/LHBM toggle
persist.fingerprint.ghbm u:object_r:fingerprint_ghbm_prop:s0 exact bool

2
sepolicy/legacy/system_ext/public/property.te Normal file
View file

@ -0,0 +1,2 @@
# Fingerprint (UDFPS) GHBM/LHBM toggle
system_vendor_config_prop(fingerprint_ghbm_prop)

1
sepolicy/legacy/whitechapel_pro/attributes Normal file
View file

@ -0,0 +1 @@
attribute vendor_persist_type;

29
sepolicy/legacy/whitechapel_pro/certs/EuiccSupportPixel.x509.pem Normal file
View file

@ -0,0 +1,29 @@
-----BEGIN CERTIFICATE-----
MIIF2zCCA8OgAwIBAgIVAIFP2e+Gh4wn4YFsSI7fRB6AXjIsMA0GCSqGSIb3DQEBCwUAMH4xCzAJ
BgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1Nb3VudGFpbiBWaWV3MRQw
EgYDVQQKEwtHb29nbGUgSW5jLjEQMA4GA1UECxMHQW5kcm9pZDEaMBgGA1UEAxMRRXVpY2NTdXBw
b3J0UGl4ZWwwHhcNMTkwMjI4MTkyMjE4WhcNNDkwMjI4MTkyMjE4WjB+MQswCQYDVQQGEwJVUzET
MBEGA1UECBMKQ2FsaWZvcm5pYTEWMBQGA1UEBxMNTW91bnRhaW4gVmlldzEUMBIGA1UEChMLR29v
Z2xlIEluYy4xEDAOBgNVBAsTB0FuZHJvaWQxGjAYBgNVBAMTEUV1aWNjU3VwcG9ydFBpeGVsMIIC
IjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAqklePqeltzqnyXVch9eJRXFBRQQIBIJWhcXb
WIP/kZ28ISnQ2SrZisdxqtvRIeInxb7lU1rRQDfqCFSp/vMZ3l25Ryn6OVLFP4bxV1vO797t7Ef/
amYA1mFKBsD4KLaIGj0/2RpGesneCOb0jWl2yRgIO2Ez7Y4YgWU/IoickZDLp1u6/7e7E/Qq9OXK
aXvtBSzooGrYC7eyKn7O21FOfz5cQRo4BipjJqXG5Ez8Vi+m/dL1IFRZheYttEf3v390vBcb0oJ0
oYPzLxmnb1LchjZC3yLAknRA0hNt8clvJ3tjXFjtzCGKsQsT4rnvvGFFABJTCf3EdEiwBNS5U4ho
+9+EtH7PpuoC+uVv2rLv/Gb7stlGQGx32KmK2CfKED3PdNqoT7WRx6nvVjCk3i7afdUcxQxcS9td
5r80CB1bQEhS2sWLWB21PJrfMugWUJO5Bwz6u0es8dP+4FAHojIaF6iwB5ZYIuHGcEaOviHm4jOK
rrGMlLqTwuEhq2aVIP55u7XRV98JLs2hlE5DJOWCIsPxybUDiddFvR+yzi/4FimsxJlEmaQAQcki
uJ9DceVP03StPzFJSDRlqa4yF6xkZW5piNoANQ4MyI67V2Qf8g/L1UPYAi4hUMxQGo7Clw2hBRag
ZTm65Xc7+ovBYxl5YaXAmNoJbss34Lw8tdrn4EECAwEAAaNQME4wDAYDVR0TBAUwAwEB/zAdBgNV
HQ4EFgQU+hQdFrOGuCDI+bbebssw9TL5FcYwHwYDVR0jBBgwFoAU+hQdFrOGuCDI+bbebssw9TL5
FcYwDQYJKoZIhvcNAQELBQADggIBAGmyZHXddei/zUUMowiyi/MTtqXf9hKDEN4zhAXkuiuHxqA9
Ii0J1Sxz2dd5NkqMmtePKYFSGA884yVm1KAne/uoCWj57IK3jswiRYnKhXa293DxA/K9wY27IGbp
ulSuuxbpjjV2tqGUuoNQGKX7Oy6s0GcibyZFc+LpD7ttGk5QoLC9qQdpXZgUv/yG2B99ERSXLCaL
EWMNP/oVZQOCQGfsFM1fPLn3X0ZuCOQg9bljxFf3jTl+H6PIAhpCjKeeUQYLc41eQkCyR/f67aRB
GvO4YDpXLn9eH23B+26rjPyFiVtMJ/jJZ7UEPeJ3XBj1COS/X7p9gGRS5rtfr9z7XxuMxvG0JU9U
XA+bMfOOfCqflvw6IyUg+oxjBFIhgiP4fxna51+BqpctvB0OeRwUm6y4nN06AwqtD8SteQrEn0b0
IDWOKlVeh0lJWrDDEHr55dXSF+CbOPUDmMxmGoulOEOy/qSWIQi8BfvdX+e88CmracNRYVffLuQj
pRYN3TeiCJd+6/X9/x1Q8VLW7vOAb6uRyE2lOjX40DYBxK3xSq6J7Vp38f6z0vtQm2sAAQ4xqqon
A9tB5p+nJlYHgSxXOZx3C13Rs/eMmiGCKkSpCTnGCgBC7PfJDdMK6SLw5Gn4oyGoZo4fXbADuHrU
0JD1T1qdCm3aUSEmFgEA4rOL/0K3
-----END CERTIFICATE-----

29
sepolicy/legacy/whitechapel_pro/certs/com_qorvo_uwb.x509.pem Normal file
View file

@ -0,0 +1,29 @@
-----BEGIN CERTIFICATE-----
MIIF1TCCA72gAwIBAgIVALSpAFqvtr1ntTS7YgB0Y5R6WqEtMA0GCSqGSIb3DQEBCwUAMHoxCzAJ
BgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1Nb3VudGFpbiBWaWV3MRQw
EgYDVQQKEwtHb29nbGUgSW5jLjEQMA4GA1UECxMHQW5kcm9pZDEWMBQGA1UEAwwNY29tX3FvcnZv
X3V3YjAgFw0yMTA1MDQwNTAyMDlaGA8yMDUxMDUwNDA1MDIwOVowejELMAkGA1UEBhMCVVMxEzAR
BgNVBAgTCkNhbGlmb3JuaWExFjAUBgNVBAcTDU1vdW50YWluIFZpZXcxFDASBgNVBAoTC0dvb2ds
ZSBJbmMuMRAwDgYDVQQLEwdBbmRyb2lkMRYwFAYDVQQDDA1jb21fcW9ydm9fdXdiMIICIjANBgkq
hkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAyoe1/UDAyMZd5iWqaKPDKN0cCESsWBTTkuLFpzMfcTEa
IyMORaIYriuAxvWhNzidPQvvRPyw0XQbl7GZLjXLF004G5xPTXFHIdtWv/scuC53INqTerppcHeW
fP4hfJPbZMQNcDB9EHa2bhA0wPdfoJD4cz8T7sgQcbRirdR8KoiOVWYe5UTSdk0df2IbiMZav2DJ
KhFql323emi4QHoDeUMAYy35mTh5vhfJ8NrCRAUwMh0zlw6LwZw/Dr8AbzDXl4Mo6Ij2pTn3/1zW
BPNkJonvONiMvuUUDl6LnP/41qhxYSg9RBp3wBJLknmfD/hEaXxTSLdkJyF43t61sU12mDQbLu4s
ZoiQKeKMJ0VpC56gUzkpnx3pzusq+/bAlTXf8Tfqrm7nizwR/69kntNYp8iaUJnvQQzlChc2lg2X
QNzf6zShPptpPqJIgmWawH6DL8JPHgkpguWyz47dWHCLnTfp8miEZPrQkPKL13SCMYCwxmlNYNWG
gUFPX5UJfnNVH4y2gPpXssROyKQKp/ArZkWb2zURrC1RUvNFADvvFt+hb2iXXVnfVeEtKAkSdhOj
RHwXhc/EtraSMMYUeO/uhUiPmPFR0FVLxCIm6i91/xqgWhKgRN0uatornO3lSNgzk4c7b0JCncEn
iArWJ516/nqWIvEdYjcqIBDAdSx8S1sCAwEAAaNQME4wDAYDVR0TBAUwAwEB/zAdBgNVHQ4EFgQU
EGKtCMO6w0UKLbAmd/laZERZZrkwHwYDVR0jBBgwFoAUEGKtCMO6w0UKLbAmd/laZERZZrkwDQYJ
KoZIhvcNAQELBQADggIBAIRowmuGiFeZdyDsbYi0iYISNW2HID4uLM3Pp8CEx5swlntJu1Z19R9t
fzzY9lvcMgdbdVJYnGrHzUGUCVqbhfDH7GxP9ybg1QUqYxi6AvZU3wrRqjoUoDw7HlecNBXFZI6z
0f2J3XSzST3kq5lCuUaEKGHkU8jVgwqVGMcz1foLGzBXQhMgIKl966c5DWoXsLToBCXrNgDokkHe
cj9tI1ufsWrSxl5/AT0/DMjHkcBmZk78RiTcGJtSZU8YwqNIQa+U2hpDE34iy2LC6YEqMKggjCm0
6nOBbIH0EXnrr0iBX3YJmDM8O4a9eDpI7FSjabPx9YvfQne08pNwYkExOMafibyAwt7Du0cpxNkg
NE3xeDZ+TVr+4I10HF1gKpJ+rQsBOIYVTWLKATO4TMQxLNLY9oy2gt12PcsCdkOIThX4bAHXq1eY
ulAxoA7Hba2xq/wnh2JH5VZIjz3yZBJXX/GyFeHkqv7wFRVrx4DjZC1s5uTdqDh6y8pfM49w9/Zp
BKtz5B+37bC9FmM+ux39MElqx+kbsITzBDtDWa2Q8onWQR0R4WHI43n1mJSvW4cdR6Xf/a1msPXh
NHc3XCJYq4WvlMuXWEGVka20LPJXIjiuU3sB088YpjAG1+roSn//CL8N9iDWHCRXy+UKElIbhWLz
lHV8gmlwBAuAx9ITcTJr
-----END CERTIFICATE-----

3
sepolicy/legacy/whitechapel_pro/device.te Normal file
View file

@ -0,0 +1,3 @@
type vendor_toe_device, dev_type;
type lwis_device, dev_type;
type rls_device, dev_type;

25
sepolicy/legacy/whitechapel_pro/file.te Normal file
View file

@ -0,0 +1,25 @@
# Data
type updated_wifi_firmware_data_file, file_type, data_file_type;
type vendor_misc_data_file, file_type, data_file_type;
type per_boot_file, file_type, data_file_type, core_data_file_type;
type powerstats_vendor_data_file, file_type, data_file_type;
# sysfs
type bootdevice_sysdev, dev_type;
type sysfs_wifi, sysfs_type, fs_type;
type sysfs_bcmdhd, sysfs_type, fs_type;
type sysfs_chargelevel, sysfs_type, fs_type;
type sysfs_camera, sysfs_type, fs_type;
# persist
type persist_ss_file, file_type, vendor_persist_type;
# Storage Health HAL
type proc_f2fs, proc_type, fs_type;
# Vendor tools
type vendor_dumpsys, vendor_file_type, file_type;
# USB-C throttling stats
type sysfs_usbc_throttling_stats, sysfs_type, fs_type;

44
sepolicy/legacy/whitechapel_pro/file_contexts Normal file
View file

@ -0,0 +1,44 @@
# Binaries
/vendor/bin/dumpsys u:object_r:vendor_dumpsys:s0
/vendor/bin/hw/android\.hardware\.gatekeeper-service\.trusty u:object_r:hal_gatekeeper_default_exec:s0
/vendor/bin/hw/android\.hardware\.gatekeeper@1\.0-service\.trusty u:object_r:hal_gatekeeper_default_exec:s0
/vendor/bin/hw/android\.hardware\.nfc-service\.st u:object_r:hal_nfc_default_exec:s0
# Vendor libraries
/vendor/lib(64)?/libdrm\.so u:object_r:same_process_hal_file:s0
/vendor/lib(64)?/libion_google\.so u:object_r:same_process_hal_file:s0
/vendor/lib(64)?/arm\.graphics-V1-ndk\.so u:object_r:same_process_hal_file:s0
/vendor/lib(64)?/libOpenCL-pixel\.so u:object_r:same_process_hal_file:s0
/vendor/lib(64)?/libOpenCL\.so u:object_r:same_process_hal_file:s0
/vendor/lib(64)?/lib_aion_buffer\.so u:object_r:same_process_hal_file:s0
/vendor/lib(64)?/libGralloc4Wrapper\.so u:object_r:same_process_hal_file:s0
/vendor/lib(64)?/pixel-power-ext-V1-ndk\.so u:object_r:same_process_hal_file:s0
/vendor/lib(64)?/android\.frameworks\.stats-V1-ndk\.so u:object_r:same_process_hal_file:s0
/vendor/lib(64)?/vendor-pixelatoms-cpp\.so u:object_r:same_process_hal_file:s0
/vendor/lib(64)?/libprotobuf-cpp-lite-(\d+\.){2,3}so u:object_r:same_process_hal_file:s0
# Graphics
/vendor/lib(64)?/hw/vulkan\.mali\.so u:object_r:same_process_hal_file:s0
/vendor/lib(64)?/libgpudataproducer\.so u:object_r:same_process_hal_file:s0
# Devices
/dev/ttySAC0 u:object_r:tty_device:s0
/dev/bigwave u:object_r:video_device:s0
/dev/watchdog0 u:object_r:watchdog_device:s0
/dev/dri/card0 u:object_r:graphics_device:s0
/dev/fimg2d u:object_r:graphics_device:s0
/dev/g2d u:object_r:graphics_device:s0
/dev/dit2 u:object_r:vendor_toe_device:s0
/dev/sg1 u:object_r:sg_device:s0
/dev/st21nfc u:object_r:nfc_device:s0
/dev/sys/block/bootdevice(/.*)? u:object_r:bootdevice_sysdev:s0
/dev/socket/chre u:object_r:chre_socket:s0
# Data
/data/vendor/ss(/.*)? u:object_r:tee_data_file:s0
/data/nfc(/.*)? u:object_r:nfc_data_file:s0
/data/vendor/firmware/wifi(/.*)? u:object_r:updated_wifi_firmware_data_file:s0
/data/vendor/misc(/.*)? u:object_r:vendor_misc_data_file:s0
/data/per_boot(/.*)? u:object_r:per_boot_file:s0
/dev/battery_history u:object_r:battery_history_device:s0
/data/vendor/powerstats(/.*)? u:object_r:powerstats_vendor_data_file:s0

77
sepolicy/legacy/whitechapel_pro/genfs_contexts Normal file
View file

@ -0,0 +1,77 @@
genfscon sysfs /devices/soc0/machine u:object_r:sysfs_soc:s0
genfscon sysfs /devices/soc0/revision u:object_r:sysfs_soc:s0
# tracefs
genfscon tracefs /events/dmabuf_heap/dma_heap_stat u:object_r:debugfs_tracing:s0
# WiFi
genfscon sysfs /wifi u:object_r:sysfs_wifi:s0
# Broadcom
genfscon sysfs /module/bcmdhd4389 u:object_r:sysfs_bcmdhd:s0
# GPU
genfscon sysfs /devices/platform/28000000.mali/hint_min_freq u:object_r:sysfs_gpu:s0
genfscon sysfs /devices/platform/28000000.mali/power_policy u:object_r:sysfs_gpu:s0
# Fabric
genfscon sysfs /devices/platform/17000010.devfreq_mif/devfreq/17000010.devfreq_mif/min_freq u:object_r:sysfs_fabric:s0
genfscon sysfs /devices/platform/17000020.devfreq_int/devfreq/17000020.devfreq_int/min_freq u:object_r:sysfs_fabric:s0
genfscon sysfs /devices/platform/17000010.devfreq_mif/devfreq/17000010.devfreq_mif/interactive/target_load u:object_r:sysfs_fabric:s0
# sscoredump (per device)
genfscon sysfs /devices/platform/aoc/sscoredump/sscd_aoc/report_count u:object_r:sysfs_sscoredump_subsystem_report_count:s0
genfscon sysfs /devices/platform/bigocean/sscoredump/sscd_bigocean/report_count u:object_r:sysfs_sscoredump_subsystem_report_count:s0
genfscon sysfs /devices/platform/debugcore/sscoredump/sscd_debugcore/report_count u:object_r:sysfs_sscoredump_subsystem_report_count:s0
genfscon sysfs /devices/platform/mfc-core/sscoredump/sscd_mfc-core/report_count u:object_r:sysfs_sscoredump_subsystem_report_count:s0
genfscon sysfs /devices/platform/wlan/sscoredump/sscd_wlan/report_count u:object_r:sysfs_sscoredump_subsystem_report_count:s0
# Storage
genfscon proc /fs/f2fs u:object_r:proc_f2fs:s0
genfscon proc /sys/vm/swappiness u:object_r:proc_dirty:s0
# Haptics
genfscon sysfs /devices/platform/10970000.hsi2c/i2c-5/i2c-cs40l26a u:object_r:sysfs_vibrator:s0
genfscon sysfs /devices/platform/10970000.hsi2c/i2c-6/i2c-cs40l26a u:object_r:sysfs_vibrator:s0
genfscon sysfs /devices/platform/10970000.hsi2c/i2c-7/i2c-cs40l26a u:object_r:sysfs_vibrator:s0
genfscon sysfs /devices/platform/10970000.hsi2c/i2c-8/i2c-cs40l26a u:object_r:sysfs_vibrator:s0
# Thermal
genfscon sysfs /devices/platform/100a0000.LITTLE u:object_r:sysfs_thermal:s0
genfscon sysfs /devices/platform/100a0000.MID u:object_r:sysfs_thermal:s0
genfscon sysfs /devices/platform/100a0000.BIG u:object_r:sysfs_thermal:s0
genfscon sysfs /devices/platform/100a0000.ISP u:object_r:sysfs_thermal:s0
genfscon sysfs /devices/platform/100b0000.G3D u:object_r:sysfs_thermal:s0
genfscon sysfs /devices/platform/100b0000.TPU u:object_r:sysfs_thermal:s0
genfscon sysfs /devices/platform/100b0000.AUR u:object_r:sysfs_thermal:s0
genfscon sysfs /module/gs_thermal/parameters/tmu_reg_dump_state u:object_r:sysfs_thermal:s0
genfscon sysfs /module/gs_thermal/parameters/tmu_reg_dump_current_temp u:object_r:sysfs_thermal:s0
genfscon sysfs /module/gs_thermal/parameters/tmu_top_reg_dump_rise_thres u:object_r:sysfs_thermal:s0
genfscon sysfs /module/gs_thermal/parameters/tmu_top_reg_dump_fall_thres u:object_r:sysfs_thermal:s0
genfscon sysfs /module/gs_thermal/parameters/tmu_sub_reg_dump_rise_thres u:object_r:sysfs_thermal:s0
genfscon sysfs /module/gs_thermal/parameters/tmu_sub_reg_dump_fall_thres u:object_r:sysfs_thermal:s0
genfscon sysfs /thermal_zone14/mode u:object_r:sysfs_thermal:s0
# Camera
genfscon sysfs /devices/platform/17000030.devfreq_intcam/devfreq/17000030.devfreq_intcam/min_freq u:object_r:sysfs_camera:s0
genfscon sysfs /devices/platform/17000060.devfreq_tnr/devfreq/17000060.devfreq_tnr/max_freq u:object_r:sysfs_camera:s0
genfscon sysfs /devices/platform/17000060.devfreq_tnr/devfreq/17000060.devfreq_tnr/min_freq u:object_r:sysfs_camera:s0
# USB-C throttling stats
genfscon sysfs /devices/platform/google,usbc_port_cooling_dev/cleared_time u:object_r:sysfs_usbc_throttling_stats:s0
genfscon sysfs /devices/platform/google,usbc_port_cooling_dev/hysteresis_time u:object_r:sysfs_usbc_throttling_stats:s0
genfscon sysfs /devices/platform/google,usbc_port_cooling_dev/trip_time u:object_r:sysfs_usbc_throttling_stats:s0
# ARM ETE
genfscon sysfs /devices/platform/ete0 u:object_r:sysfs_devices_cs_etm:s0
genfscon sysfs /devices/platform/ete1 u:object_r:sysfs_devices_cs_etm:s0
genfscon sysfs /devices/platform/ete2 u:object_r:sysfs_devices_cs_etm:s0
genfscon sysfs /devices/platform/ete3 u:object_r:sysfs_devices_cs_etm:s0
genfscon sysfs /devices/platform/ete4 u:object_r:sysfs_devices_cs_etm:s0
genfscon sysfs /devices/platform/ete5 u:object_r:sysfs_devices_cs_etm:s0
genfscon sysfs /devices/platform/ete6 u:object_r:sysfs_devices_cs_etm:s0
genfscon sysfs /devices/platform/ete7 u:object_r:sysfs_devices_cs_etm:s0
genfscon sysfs /devices/platform/ete8 u:object_r:sysfs_devices_cs_etm:s0

2
sepolicy/legacy/whitechapel_pro/hal_input_processor_default.te Normal file
View file

@ -0,0 +1,2 @@
# allow InputProcessor HAL to read the display resolution system property
get_prop(hal_input_processor_default, vendor_display_prop)

5
sepolicy/legacy/whitechapel_pro/keys.conf Normal file
View file

@ -0,0 +1,5 @@
[@UWB]
ALL : device/google/zuma-sepolicy/legacy/whitechapel_pro/certs/com_qorvo_uwb.x509.pem
[@EUICCSUPPORTPIXEL]
ALL : device/google/zuma-sepolicy/legacy/whitechapel_pro/certs/EuiccSupportPixel.x509.pem

30
sepolicy/legacy/whitechapel_pro/mac_permissions.xml Normal file
View file

@ -0,0 +1,30 @@
<?xml version="1.0" encoding="utf-8"?>
<policy>
<!--
* A signature is a hex encoded X.509 certificate or a tag defined in
keys.conf and is required for each signer tag.
* A signer tag may contain a seinfo tag and multiple package stanzas.
* A default tag is allowed that can contain policy for all apps not signed with a
previously listed cert. It may not contain any inner package stanzas.
* Each signer/default/package tag is allowed to contain one seinfo tag. This tag
represents additional info that each app can use in setting a SELinux security
context on the eventual process.
* When a package is installed the following logic is used to determine what seinfo
value, if any, is assigned.
- All signatures used to sign the app are checked first.
- If a signer stanza has inner package stanzas, those stanza will be checked
to try and match the package name of the app. If the package name matches
then that seinfo tag is used. If no inner package matches then the outer
seinfo tag is assigned.
- The default tag is consulted last if needed.
-->
<!-- google apps key -->
<signer signature="@UWB" >
<seinfo value="uwb" />
</signer>
<signer signature="@EUICCSUPPORTPIXEL" >
<seinfo value="EuiccSupportPixel" />
</signer>
</policy>

15
sepolicy/legacy/whitechapel_pro/property.te Normal file
View file

@ -0,0 +1,15 @@
vendor_internal_prop(vendor_nfc_prop)
vendor_internal_prop(vendor_secure_element_prop)
vendor_internal_prop(vendor_battery_profile_prop)
vendor_internal_prop(vendor_camera_prop)
vendor_internal_prop(vendor_camera_fatp_prop)
vendor_internal_prop(vendor_ro_sys_default_prop)
vendor_internal_prop(vendor_persist_sys_default_prop)
vendor_internal_prop(vendor_display_prop)
vendor_internal_prop(vendor_persist_prop)
# UWB calibration
system_vendor_config_prop(vendor_uwb_calibration_prop)
# Trusty storage FS ready
vendor_internal_prop(vendor_trusty_storage_prop)

22
sepolicy/legacy/whitechapel_pro/property_contexts Normal file
View file

@ -0,0 +1,22 @@
# test battery profile
persist.vendor.testing_battery_profile u:object_r:vendor_battery_profile_prop:s0
# NFC
persist.vendor.nfc. u:object_r:vendor_nfc_prop:s0
# SecureElement
persist.vendor.se. u:object_r:vendor_secure_element_prop:s0
# for display
ro.vendor.hwc.drm.device u:object_r:vendor_display_prop:s0
persist.vendor.display. u:object_r:vendor_display_prop:s0
# vendor default
ro.vendor.sys. u:object_r:vendor_ro_sys_default_prop:s0
persist.vendor.sys. u:object_r:vendor_persist_sys_default_prop:s0
#uwb
ro.vendor.uwb.calibration. u:object_r:vendor_uwb_calibration_prop:s0 exact string
# Trusty
ro.vendor.trusty.storage.fs_ready u:object_r:vendor_trusty_storage_prop:s0

1
sepolicy/legacy/whitechapel_pro/service.te Normal file
View file

@ -0,0 +1 @@
type hal_uwb_vendor_service, service_manager_type, hal_service_type;

1
sepolicy/legacy/whitechapel_pro/service_contexts Normal file
View file

@ -0,0 +1 @@
hardware.qorvo.uwb.IUwbVendor/default u:object_r:hal_uwb_vendor_service:s0

1
sepolicy/legacy/whitechapel_pro/vndservice.te Normal file
View file

@ -0,0 +1 @@
type rls_service, vndservice_manager_type;

18
sepolicy/private/debug_camera_app.te Normal file
View file

@ -0,0 +1,18 @@
typeattribute debug_camera_app coredomain;
userdebug_or_eng(`
app_domain(debug_camera_app)
net_domain(debug_camera_app)
allow debug_camera_app app_api_service:service_manager find;
allow debug_camera_app audioserver_service:service_manager find;
allow debug_camera_app cameraserver_service:service_manager find;
allow debug_camera_app mediaextractor_service:service_manager find;
allow debug_camera_app mediametrics_service:service_manager find;
allow debug_camera_app mediaserver_service:service_manager find;
# Allows GCA_Eng & GCA-Next to access the PowerHAL.
hal_client_domain(debug_camera_app, hal_power)
# Follow priv-app symlinks. This is used for dynamite functionality.
allow debug_camera_app privapp_data_file:lnk_file r_file_perms;
')

19
sepolicy/private/google_camera_app.te Normal file
View file

@ -0,0 +1,19 @@
typeattribute google_camera_app coredomain;
app_domain(google_camera_app)
net_domain(google_camera_app)
allow google_camera_app app_api_service:service_manager find;
allow google_camera_app audioserver_service:service_manager find;
allow google_camera_app cameraserver_service:service_manager find;
allow google_camera_app mediaextractor_service:service_manager find;
allow google_camera_app mediametrics_service:service_manager find;
allow google_camera_app mediaserver_service:service_manager find;
# Allows GCA to access the PowerHAL.
hal_client_domain(google_camera_app, hal_power)
# Library code may try to access vendor properties, but should be denied
dontaudit google_camera_app vendor_default_prop:file { getattr map open };
# Follow priv-app symlinks. This is used for dynamite functionality.
allow google_camera_app privapp_data_file:lnk_file r_file_perms;

11
sepolicy/private/seapp_contexts Normal file
View file

@ -0,0 +1,11 @@
# Google Camera
user=_app isPrivApp=true seinfo=google name=com.google.android.GoogleCamera domain=google_camera_app type=app_data_file levelFrom=all
# Google Camera Eng
user=_app seinfo=CameraEng name=com.google.android.GoogleCameraEng domain=debug_camera_app type=app_data_file levelFrom=all
# Also allow GoogleCameraNext, the fishfood version, the same access as GoogleCamera
user=_app seinfo=CameraFishfood name=com.google.android.apps.googlecamera.fishfood domain=google_camera_app type=app_data_file levelFrom=all
# Also label GoogleCameraNext, built with debug keys as debug_camera_app.
user=_app seinfo=CameraEng name=com.google.android.apps.googlecamera.fishfood domain=debug_camera_app type=app_data_file levelFrom=all

2
sepolicy/private/vendor_init.te Normal file
View file

@ -0,0 +1,2 @@
# b/277300125
dontaudit vendor_init device_config_configuration_prop:property_service { set };

1
sepolicy/public/debug_camera_app.te Normal file
View file

@ -0,0 +1 @@
type debug_camera_app, domain;

1
sepolicy/public/google_camera_app.te Normal file
View file

@ -0,0 +1 @@
type google_camera_app, domain;

9
sepolicy/radio/bipchmgr.te Normal file
View file

@ -0,0 +1,9 @@
type bipchmgr, domain;
type bipchmgr_exec, vendor_file_type, exec_type, file_type;
init_daemon_domain(bipchmgr)
get_prop(bipchmgr, hwservicemanager_prop);
allow bipchmgr hal_exynos_rild_hwservice:hwservice_manager find;
hwbinder_use(bipchmgr)
binder_call(bipchmgr, rild)

8
sepolicy/radio/cat_engine_service_app.te Normal file
View file

@ -0,0 +1,8 @@
type cat_engine_service_app, domain;
userdebug_or_eng(`
app_domain(cat_engine_service_app)
get_prop(cat_engine_service_app, vendor_rild_prop)
allow cat_engine_service_app app_api_service:service_manager find;
allow cat_engine_service_app system_app_data_file:dir r_dir_perms;
')

61
sepolicy/radio/cbd.te Normal file
View file

@ -0,0 +1,61 @@
type cbd, domain;
type cbd_exec, vendor_file_type, exec_type, file_type;
init_daemon_domain(cbd)
set_prop(cbd, vendor_modem_prop)
set_prop(cbd, vendor_cbd_prop)
set_prop(cbd, vendor_rild_prop)
get_prop(cbd, telephony_modem_prop)
allow cbd mnt_vendor_file:dir r_dir_perms;
allow cbd kmsg_device:chr_file rw_file_perms;
allow cbd vendor_shell_exec:file execute_no_trans;
allow cbd vendor_toolbox_exec:file execute_no_trans;
# Allow cbd to access modem block device
allow cbd block_device:dir search;
allow cbd modem_block_device:blk_file r_file_perms;
# Allow cbd to access sysfs chosen files
allow cbd sysfs_chosen:file r_file_perms;
allow cbd sysfs_chosen:dir r_dir_perms;
allow cbd radio_device:chr_file rw_file_perms;
allow cbd proc_cmdline:file r_file_perms;
allow cbd persist_modem_file:dir create_dir_perms;
allow cbd persist_modem_file:file create_file_perms;
allow cbd persist_file:dir search;
allow cbd radio_vendor_data_file:dir create_dir_perms;
allow cbd radio_vendor_data_file:file create_file_perms;
# Allow cbd to operate with modem EFS file/dir
allow cbd modem_efs_file:dir create_dir_perms;
allow cbd modem_efs_file:file create_file_perms;
# Allow cbd to operate with modem userdata file/dir
allow cbd modem_userdata_file:dir create_dir_perms;
allow cbd modem_userdata_file:file create_file_perms;
# Allow cbd to access modem image file/dir
allow cbd modem_img_file:dir r_dir_perms;
allow cbd modem_img_file:file r_file_perms;
allow cbd modem_img_file:lnk_file r_file_perms;
# Allow cbd to collect crash info
allow cbd sscoredump_vendor_data_crashinfo_file:dir create_dir_perms;
allow cbd sscoredump_vendor_data_crashinfo_file:file create_file_perms;
userdebug_or_eng(`
r_dir_file(cbd, vendor_slog_file)
allow cbd kernel:system syslog_read;
allow cbd sscoredump_vendor_data_coredump_file:dir create_dir_perms;
allow cbd sscoredump_vendor_data_coredump_file:file create_file_perms;
')

13
sepolicy/radio/cbrs_setup.te Normal file
View file

@ -0,0 +1,13 @@
# GoogleCBRS app
type cbrs_setup_app, domain;
userdebug_or_eng(`
app_domain(cbrs_setup_app)
net_domain(cbrs_setup_app)
allow cbrs_setup_app app_api_service:service_manager find;
allow cbrs_setup_app cameraserver_service:service_manager find;
allow cbrs_setup_app radio_service:service_manager find;
set_prop(cbrs_setup_app, radio_prop)
set_prop(cbrs_setup_app, vendor_rild_prop)
')

29
sepolicy/radio/certs/com_google_mds.x509.pem Normal file
View file

@ -0,0 +1,29 @@
-----BEGIN CERTIFICATE-----
MIIF1TCCA72gAwIBAgIVAPZ4KZV2jpxRBCoVAidCu62l3cDqMA0GCSqGSIb3DQEBCwUAMHsxCzAJ
BgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1Nb3VudGFpbiBWaWV3MRQw
EgYDVQQKEwtHb29nbGUgSW5jLjEQMA4GA1UECxMHQW5kcm9pZDEXMBUGA1UEAwwOY29tX2dvb2ds
ZV9tZHMwHhcNMTkwNDIyMTQ1NzA1WhcNNDkwNDIyMTQ1NzA1WjB7MQswCQYDVQQGEwJVUzETMBEG
A1UECBMKQ2FsaWZvcm5pYTEWMBQGA1UEBxMNTW91bnRhaW4gVmlldzEUMBIGA1UEChMLR29vZ2xl
IEluYy4xEDAOBgNVBAsTB0FuZHJvaWQxFzAVBgNVBAMMDmNvbV9nb29nbGVfbWRzMIICIjANBgkq
hkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAqgNC0hhI3NzaPUllJfe01hCTuEpl35D02+DKJ5prPFxv
6KGTk6skjZOwV87Zf2pyj/cbnv28ioDjwvqMBe4ntFdKtH9gl2tTAVl69HMKXF4Iny/wnrt2mxzh
WxFUd5PuW+mWug+UQw/NGUuaf5d/yys/RrchHKM1+zBV6aOzH6BXiwDoOF2i43d5GlNQ/tFuMySW
LJftJN0QULFelxNDFFJZhw2P3c4opxjmF2yCoIiDfBEIhTZFKUbHX6YDLXmtUpXl35q+cxK4TCxP
URyzwdfiyheF3TTxagfzhvXNg/ifrY67S4qCGfzoEMPxrTz02gS0u3D6r/2+hl9vAJChLKDNdIs6
TqIw+YnABrELiZLLFnaABnjQ7xC3xv1s3W6dWxaxnoVMtC1YvdgwhC5gSpJ4A+AGcCLv96hoeB1I
IoGV9Yt0Z97MFpXeHFpAxFZ1F9feBqwOCDbu50dmdKZvqGHZ4Ts3uy7ukDQ08dquHpT+NmqkmmW5
GGhkuyZS3HHpU/QeVsZiyJCJBbDe5lz6NGXK56ruuF9ILeGHtldjQm40oYRc01ESScyVjSU0kpMO
C7hn1B7rKAm8xxG7eH04ieQrNnbbee7atOO4C3157W5CqujfLMeo6OCRVtcYkYIuSi8hIPNySu/q
OaEtEP4owVNZR0H6mCHy5pANsyBofMkCAwEAAaNQME4wDAYDVR0TBAUwAwEB/zAdBgNVHQ4EFgQU
gk8pmLx8yP3RILwR5am1G10PBEowHwYDVR0jBBgwFoAUgk8pmLx8yP3RILwR5am1G10PBEowDQYJ
KoZIhvcNAQELBQADggIBAC9iQ1huo6CzjcsB1IIw3WYPYVfHtvG7fiB49QO6cjth8fxM36YOxnMz
K9Zh89cnFx7BeXG4MdbR3lAWO+wTbEpM/5azAQfqHB/ZEEAo1THtqS58C1bTwJ5zxkA+wL/x1ucT
EV0QZtPHC1K5nIV5FuICiJjui5FHfj2HYu2A5a5729rdZ7sL8Vgx6TUFKpEPs5iCrlx5X/E+/wJa
DM5iIjVvrGJJq0VWHHeDJEE+Sw1CDxWYRzvu1WvCvhk149hf4LlfrR0A5t8QJRGx0WwF10DLGgJx
7epMBpzhMIXc529FTIx4Rx2PcufjTZC9EN7PkLgVfYahWEkt/YIfV/0F6U6viLxdNC5O0pimSV57
vT6HIthX1OC34eZca0cPqH1kOuhRDKOhbP4yIgdYX6knpvw8aXsYcyTfAmDyrt0EWffeBPedaxMo
xfijdlsBQUymviUQ8qBbfl1Ew9VoC+VEsiobK7Ubog0IK+82LQ7FOLMoNYnhk5wJ63i1kVvBVAgH
64PMME2KG//BwYFfKK6jUXibabyNke72+1Jr0xpw1BHJPxNJ8Q8yCBLF0wmXmFJSM+9lSDd10Bni
FJeMFMQ0T1Sf8GUSIxYYbMK5pDguRs+JOYkUID02ylJ3L6GAnxXCjGWzpdxw29/WWJc+qsYFEIbP
kKzTUNQHaaLHmcLK22Ht
-----END CERTIFICATE-----

60
sepolicy/radio/copy_efs_files_to_data.te Normal file
View file

@ -0,0 +1,60 @@
type copy_efs_files_to_data, domain;
type copy_efs_files_to_data_exec, exec_type, vendor_file_type, file_type;
init_daemon_domain(copy_efs_files_to_data);
# Allow creating files on /data/vendor/copied
allow copy_efs_files_to_data modem_efs_image_file:dir { create_dir_perms };
allow copy_efs_files_to_data modem_efs_image_file:file { create_file_perms };
allow copy_efs_files_to_data modem_efs_image_file:lnk_file { create_file_perms };
# Allow execute binaries from /vendor/bin
allow copy_efs_files_to_data vendor_toolbox_exec:file rx_file_perms;
allow copy_efs_files_to_data vendor_shell_exec:file rx_file_perms;
# Allow execute /vendor/bin/dump.f2fs
allow copy_efs_files_to_data vendor_file:file { getattr execute_no_trans };
# Allow execute dump.f2fs to dump files from /dev/block/by-name/efs
allow copy_efs_files_to_data block_device:dir search;
allow copy_efs_files_to_data efs_block_device:blk_file r_file_perms;
allow copy_efs_files_to_data modem_userdata_block_device:blk_file r_file_perms;
allow copy_efs_files_to_data persist_block_device:blk_file r_file_perms;
# Allow checking if /data/vendor/copied/[efs/efs_backup/persist] exist
allow copy_efs_files_to_data modem_efs_file:dir getattr;
allow copy_efs_files_to_data modem_userdata_file:dir getattr;
allow copy_efs_files_to_data persist_file:dir getattr;
allow copy_efs_files_to_data sysfs_scsi_devices_0000:dir r_dir_perms;
allow copy_efs_files_to_data sysfs_scsi_devices_0000:file r_file_perms;
# dump.f2fs need to restore file permissions after dumping
# files from an f2fs image
allow copy_efs_files_to_data self:capability chown;
allow copy_efs_files_to_data self:capability fowner;
allow copy_efs_files_to_data kmsg_debug_device:chr_file { w_file_perms ioctl getattr };
# Should not write to any block devices. Only read from block device
# and dump files to /data/vendor/copied
dontaudit copy_efs_files_to_data dev_type:blk_file write;
# Setting xattr requires sys_admin
dontaudit copy_efs_files_to_data self:capability sys_admin;
# dump.f2fs would attempt to restore selinux on dumped files, but we
# will use restorecon to do the job.
dontaudit copy_efs_files_to_data modem_efs_image_file:dir relabelfrom;
dontaudit copy_efs_files_to_data modem_efs_image_file:file relabelfrom;
dontaudit copy_efs_files_to_data modem_efs_file:dir relabelto;
dontaudit copy_efs_files_to_data modem_efs_file:file relabelto;
dontaudit copy_efs_files_to_data modem_userdata_file:dir relabelto;
dontaudit copy_efs_files_to_data modem_userdata_file:file relabelto;
dontaudit copy_efs_files_to_data vendor_persist_type:dir relabelto;
dontaudit copy_efs_files_to_data vendor_persist_type:file relabelto;

4
sepolicy/radio/device.te Normal file
View file

@ -0,0 +1,4 @@
type modem_block_device, dev_type;
type vendor_gnss_device, dev_type;
type modem_userdata_block_device, dev_type;
type efs_block_device, dev_type;

33
sepolicy/radio/dmd.te Normal file
View file

@ -0,0 +1,33 @@
type dmd, domain;
type dmd_exec, vendor_file_type, exec_type, file_type;
init_daemon_domain(dmd)
# Grant to access serial device for external logging tool
allow dmd serial_device:chr_file rw_file_perms;
# Grant to access radio device
allow dmd radio_device:chr_file rw_file_perms;
# Grant to access slog dir/file
allow dmd vendor_slog_file:dir create_dir_perms;
allow dmd vendor_slog_file:file create_file_perms;
# Grant to access tcp socket
allow dmd node:tcp_socket node_bind;
allow dmd self:tcp_socket { create_socket_perms_no_ioctl listen accept bind };
# Grant to access log related properties
set_prop(dmd, vendor_diag_prop)
set_prop(dmd, vendor_slog_prop)
set_prop(dmd, vendor_modem_prop)
get_prop(dmd, vendor_persist_config_default_prop)
# Grant to access hwservice manager
get_prop(dmd, hwservicemanager_prop)
allow dmd hidl_base_hwservice:hwservice_manager add;
allow dmd hal_vendor_oem_hwservice:hwservice_manager { add find };
binder_call(dmd, hwservicemanager)
binder_call(dmd, modem_diagnostic_app)
binder_call(dmd, modem_logging_control)
binder_call(dmd, vendor_telephony_silentlogging_app)
binder_call(dmd, liboemservice_proxy_default)

42
sepolicy/radio/file.te Normal file
View file

@ -0,0 +1,42 @@
# Data
type rild_vendor_data_file, file_type, data_file_type;
type modem_efs_image_file, file_type, data_file_type;
type vendor_gps_file, file_type, data_file_type;
type modem_ml_data_file, file_type, data_file_type;
type modem_stat_data_file, file_type, data_file_type;
type vendor_log_file, file_type, data_file_type;
type vendor_rfsd_log_file, file_type, data_file_type;
type vendor_slog_file, file_type, data_file_type;
userdebug_or_eng(`
typeattribute vendor_gps_file mlstrustedobject;
typeattribute vendor_slog_file mlstrustedobject;
')
# persist
type persist_modem_file, file_type, vendor_persist_type;
# Modem
type modem_efs_file, file_type;
type modem_userdata_file, file_type;
type sysfs_modem, sysfs_type, fs_type;
# Exynos Firmware
type vendor_fw_file, vendor_file_type, file_type;
# vendor extra images
type modem_img_file, contextmount_type, file_type, vendor_file_type;
allow modem_img_file self:filesystem associate;
type modem_config_file, file_type, vendor_file_type;
# sysfs
type sysfs_chosen, sysfs_type, fs_type;
type sysfs_sjtag, fs_type, sysfs_type;
userdebug_or_eng(`
typeattribute sysfs_sjtag mlstrustedobject;
')
# Vendor sched files
userdebug_or_eng(`
typeattribute proc_vendor_sched mlstrustedobject;
')

45
sepolicy/radio/file_contexts Normal file
View file

@ -0,0 +1,45 @@
# Binaries
/vendor/bin/init\.radio\.sh u:object_r:init_radio_exec:s0
/vendor/bin/bipchmgr u:object_r:bipchmgr_exec:s0
/vendor/bin/vcd u:object_r:vcd_exec:s0
/vendor/bin/dmd u:object_r:dmd_exec:s0
/vendor/bin/sced u:object_r:sced_exec:s0
/vendor/bin/rfsd u:object_r:rfsd_exec:s0
/vendor/bin/modem_logging_control u:object_r:modem_logging_control_exec:s0
/vendor/bin/modem_svc_sit u:object_r:modem_svc_sit_exec:s0
/vendor/bin/modem_ml_svc_sit u:object_r:modem_ml_svc_sit_exec:s0
/vendor/bin/cbd u:object_r:cbd_exec:s0
/vendor/bin/hw/rild_exynos u:object_r:rild_exec:s0
/vendor/bin/hw/vendor\.google\.radioext@1\.0-service u:object_r:hal_radioext_default_exec:s0
/vendor/bin/liboemservice_proxy_default u:object_r:liboemservice_proxy_default_exec:s0
/vendor/bin/copy_efs_files_to_data u:object_r:copy_efs_files_to_data_exec:s0
# Config files
/vendor/etc/modem_ml_models\.conf u:object_r:modem_config_file:s0
# Data
/data/vendor/log/rfsd(/.*)? u:object_r:vendor_rfsd_log_file:s0
/data/vendor/log(/.*)? u:object_r:vendor_log_file:s0
/data/vendor/slog(/.*)? u:object_r:vendor_slog_file:s0
/data/vendor/modem_ml(/.*)? u:object_r:modem_ml_data_file:s0
/data/vendor/modem_stat(/.*)? u:object_r:modem_stat_data_file:s0
/data/vendor/rild(/.*)? u:object_r:rild_vendor_data_file:s0
/data/vendor/copied(/.*)? u:object_r:modem_efs_image_file:s0
# vendor extra images
/mnt/vendor/efs(/.*)? u:object_r:modem_efs_file:s0
/mnt/vendor/efs_backup(/.*)? u:object_r:modem_efs_file:s0
/mnt/vendor/modem_img(/.*)? u:object_r:modem_img_file:s0
/mnt/vendor/modem_userdata(/.*)? u:object_r:modem_userdata_file:s0
/mnt/vendor/persist/modem(/.*)? u:object_r:persist_modem_file:s0
# Devices
/dev/ttyGS[0-3] u:object_r:serial_device:s0
/dev/oem_ipc[0-7] u:object_r:radio_device:s0
/dev/oem_test u:object_r:radio_device:s0
/dev/umts_boot0 u:object_r:radio_device:s0
/dev/umts_ipc0 u:object_r:radio_device:s0
/dev/umts_ipc1 u:object_r:radio_device:s0
/dev/umts_rfs0 u:object_r:radio_device:s0
/dev/umts_dm0 u:object_r:radio_device:s0
/dev/umts_router u:object_r:radio_device:s0

4
sepolicy/radio/fsck.te Normal file
View file

@ -0,0 +1,4 @@
allow fsck persist_block_device:blk_file rw_file_perms;
allow fsck efs_block_device:blk_file rw_file_perms;
allow fsck modem_userdata_block_device:blk_file rw_file_perms;

8
sepolicy/radio/genfs_contexts Normal file
View file

@ -0,0 +1,8 @@
# SJTAG
genfscon sysfs /devices/platform/sjtag_ap/interface u:object_r:sysfs_sjtag:s0
genfscon sysfs /devices/platform/sjtag_gsa/interface u:object_r:sysfs_sjtag:s0
genfscon sysfs /firmware/devicetree/base/chosen u:object_r:sysfs_chosen:s0
# Modem
genfscon sysfs /devices/platform/cp-tm1/cp_temp u:object_r:sysfs_modem:s0

7
sepolicy/radio/gpsd.te Normal file
View file

@ -0,0 +1,7 @@
type gpsd, domain;
type gpsd_exec, vendor_file_type, exec_type, file_type;
# Allow gpsd access PixelLogger unix socket in debug build only
userdebug_or_eng(`
typeattribute gpsd mlstrustedsubject;
allow gpsd logger_app:unix_stream_socket connectto;
')

19
sepolicy/radio/grilservice_app.te Normal file
View file

@ -0,0 +1,19 @@
type grilservice_app, domain;
app_domain(grilservice_app)
allow grilservice_app app_api_service:service_manager find;
allow grilservice_app hal_bluetooth_coexistence_hwservice:hwservice_manager find;
allow grilservice_app hal_bluetooth_coexistence_service:service_manager find;
allow grilservice_app hal_radioext_hwservice:hwservice_manager find;
allow grilservice_app hal_wifi_ext_hwservice:hwservice_manager find;
allow grilservice_app hal_wifi_ext_service:service_manager find;
allow grilservice_app hal_audiometricext_hwservice:hwservice_manager find;
allow grilservice_app hal_exynos_rild_hwservice:hwservice_manager find;
allow grilservice_app radio_vendor_data_file:dir create_dir_perms;
allow grilservice_app radio_vendor_data_file:file create_file_perms;
binder_call(grilservice_app, hal_bluetooth_btlinux)
binder_call(grilservice_app, hal_radioext_default)
binder_call(grilservice_app, hal_wifi_ext)
binder_call(grilservice_app, hal_audiometricext_default)
binder_call(grilservice_app, rild)
hal_client_domain(grilservice_app, hal_power_stats)

28
sepolicy/radio/hal_radioext_default.te Normal file
View file

@ -0,0 +1,28 @@
type hal_radioext_default, domain;
type hal_radioext_default_exec, vendor_file_type, exec_type, file_type;
init_daemon_domain(hal_radioext_default)
hwbinder_use(hal_radioext_default)
get_prop(hal_radioext_default, hwservicemanager_prop)
add_hwservice(hal_radioext_default, hal_radioext_hwservice)
binder_call(hal_radioext_default, servicemanager)
binder_call(hal_radioext_default, grilservice_app)
binder_call(hal_radioext_default, hal_bluetooth_btlinux)
# RW /dev/oem_ipc0
allow hal_radioext_default radio_device:chr_file rw_file_perms;
# RW MIPI Freq files
allow hal_radioext_default radio_vendor_data_file:dir create_dir_perms;
allow hal_radioext_default radio_vendor_data_file:file create_file_perms;
# Bluetooth
allow hal_radioext_default hal_bluetooth_coexistence_hwservice:hwservice_manager find;
allow hal_radioext_default hal_bluetooth_coexistence_service:service_manager find;
# Twoshay
binder_use(hal_radioext_default)
allow hal_radioext_default gril_antenna_tuning_service:service_manager find;
binder_call(hal_radioext_default, gril_antenna_tuning_service)
binder_call(hal_radioext_default, twoshay)

9
sepolicy/radio/hwservice.te Normal file
View file

@ -0,0 +1,9 @@
# dmd servcie
type hal_vendor_oem_hwservice, hwservice_manager_type;
# GRIL service
type hal_radioext_hwservice, hwservice_manager_type;
# rild service
type hal_exynos_rild_hwservice, hwservice_manager_type;

8
sepolicy/radio/hwservice_contexts Normal file
View file

@ -0,0 +1,8 @@
# dmd HAL
vendor.samsung_slsi.telephony.hardware.oemservice::IOemService u:object_r:hal_vendor_oem_hwservice:s0
# rild HAL
vendor.samsung_slsi.telephony.hardware.radioExternal::IOemSlsiRadioExternal u:object_r:hal_exynos_rild_hwservice:s0
# GRIL HAL
vendor.google.radioext::IRadioExt u:object_r:hal_radioext_hwservice:s0

1
sepolicy/radio/hwservicemanager.te Normal file
View file

@ -0,0 +1 @@
binder_call(hwservicemanager, bipchmgr)

4
sepolicy/radio/init.te Normal file
View file

@ -0,0 +1,4 @@
allow init modem_efs_file:dir mounton;
allow init modem_userdata_file:dir mounton;
allow init modem_img_file:dir mounton;
allow init modem_img_file:filesystem { getattr mount relabelfrom };

8
sepolicy/radio/init_radio.te Normal file
View file

@ -0,0 +1,8 @@
type init_radio, domain;
type init_radio_exec, exec_type, vendor_file_type, file_type;
init_daemon_domain(init_radio);
allow init_radio vendor_toolbox_exec:file execute_no_trans;
allow init_radio radio_vendor_data_file:dir create_dir_perms;
allow init_radio radio_vendor_data_file:file create_file_perms;

3
sepolicy/radio/keys.conf Normal file
View file

@ -0,0 +1,3 @@
[@MDS]
ALL : device/google/zuma-sepolicy/radio/certs/com_google_mds.x509.pem

34
sepolicy/radio/liboemservice_proxy.te Normal file
View file

@ -0,0 +1,34 @@
type liboemservice_proxy_default, domain;
type liboemservice_proxy_default_exec, vendor_file_type, exec_type, file_type;
init_daemon_domain(liboemservice_proxy_default)
# Allow proxy to register as android service.
binder_use(liboemservice_proxy_default);
add_service(liboemservice_proxy_default, liboemservice_proxy_service);
get_prop(liboemservice_proxy_default, hwservicemanager_prop)
binder_call(liboemservice_proxy_default, hwservicemanager)
binder_call(liboemservice_proxy_default, dmd)
allow liboemservice_proxy_default hal_vendor_oem_hwservice:hwservice_manager find;
allow liboemservice_proxy_default radio_vendor_data_file:dir create_dir_perms;
allow liboemservice_proxy_default radio_vendor_data_file:file create_file_perms;
# Grant to access serial device for external logging tool
allow liboemservice_proxy_default serial_device:chr_file rw_file_perms;
# Grant to access radio device
allow liboemservice_proxy_default radio_device:chr_file rw_file_perms;
# Grant to access slog dir/file
allow liboemservice_proxy_default vendor_slog_file:dir create_dir_perms;
allow liboemservice_proxy_default vendor_slog_file:file create_file_perms;
# Grant to access tcp socket
allow liboemservice_proxy_default node:tcp_socket node_bind;
allow liboemservice_proxy_default self:tcp_socket { create_socket_perms_no_ioctl listen accept bind };
# Grant to access log related properties
set_prop(liboemservice_proxy_default, vendor_diag_prop)
set_prop(liboemservice_proxy_default, vendor_slog_prop)
set_prop(liboemservice_proxy_default, vendor_modem_prop)
get_prop(liboemservice_proxy_default, vendor_persist_config_default_prop)

30
sepolicy/radio/logger_app.te Normal file
View file

@ -0,0 +1,30 @@
userdebug_or_eng(`
allow logger_app vendor_gps_file:file create_file_perms;
allow logger_app vendor_gps_file:dir create_dir_perms;
allow logger_app vendor_slog_file:file {r_file_perms unlink};
allow logger_app radio_vendor_data_file:file create_file_perms;
allow logger_app radio_vendor_data_file:dir create_dir_perms;
allow logger_app sysfs_sscoredump_level:file r_file_perms;
allow logger_app hal_exynos_rild_hwservice:hwservice_manager find;
binder_call(logger_app, rild)
r_dir_file(logger_app, sscoredump_vendor_data_coredump_file)
r_dir_file(logger_app, sscoredump_vendor_data_crashinfo_file)
set_prop(logger_app, vendor_audio_prop)
set_prop(logger_app, vendor_gps_prop)
set_prop(logger_app, vendor_logger_prop)
set_prop(logger_app, vendor_modem_prop)
set_prop(logger_app, vendor_ramdump_prop)
set_prop(logger_app, vendor_rild_prop)
set_prop(logger_app, vendor_ssrdump_prop)
set_prop(logger_app, vendor_tcpdump_log_prop)
set_prop(logger_app, vendor_usb_config_prop)
set_prop(logger_app, vendor_wifi_sniffer_prop)
set_prop(logger_app, logpersistd_logging_prop)
set_prop(logger_app, logd_prop)
# b/269383459 framework UI rendering properties
dontaudit logger_app default_prop:file { read };
')

27
sepolicy/radio/mac_permissions.xml Normal file
View file

@ -0,0 +1,27 @@
<?xml version="1.0" encoding="utf-8"?>
<policy>
<!--
* A signature is a hex encoded X.509 certificate or a tag defined in
keys.conf and is required for each signer tag.
* A signer tag may contain a seinfo tag and multiple package stanzas.
* A default tag is allowed that can contain policy for all apps not signed with a
previously listed cert. It may not contain any inner package stanzas.
* Each signer/default/package tag is allowed to contain one seinfo tag. This tag
represents additional info that each app can use in setting a SELinux security
context on the eventual process.
* When a package is installed the following logic is used to determine what seinfo
value, if any, is assigned.
- All signatures used to sign the app are checked first.
- If a signer stanza has inner package stanzas, those stanza will be checked
to try and match the package name of the app. If the package name matches
then that seinfo tag is used. If no inner package matches then the outer
seinfo tag is assigned.
- The default tag is consulted last if needed.
-->
<!-- google apps key -->
<signer signature="@MDS" >
<seinfo value="mds" />
</signer>
</policy>

49
sepolicy/radio/modem_diagnostic_app.te Normal file
View file

@ -0,0 +1,49 @@
type modem_diagnostic_app, domain;
app_domain(modem_diagnostic_app)
net_domain(modem_diagnostic_app)
allow modem_diagnostic_app app_api_service:service_manager find;
allow modem_diagnostic_app radio_service:service_manager find;
userdebug_or_eng(`
allow modem_diagnostic_app sysfs_modem_state:file r_file_perms;
hal_client_domain(modem_diagnostic_app, hal_power_stats);
allow modem_diagnostic_app hal_exynos_rild_hwservice:hwservice_manager find;
binder_call(modem_diagnostic_app, rild)
binder_call(modem_diagnostic_app, dmd)
set_prop(modem_diagnostic_app, vendor_cbd_prop)
set_prop(modem_diagnostic_app, vendor_rild_prop)
set_prop(modem_diagnostic_app, vendor_modem_prop)
allow modem_diagnostic_app sysfs_chosen:dir r_dir_perms;
allow modem_diagnostic_app sysfs_chosen:file r_file_perms;
allow modem_diagnostic_app vendor_fw_file:file r_file_perms;
allow modem_diagnostic_app radio_vendor_data_file:dir create_dir_perms;
allow modem_diagnostic_app radio_vendor_data_file:file create_file_perms;
allow modem_diagnostic_app mnt_vendor_file:dir r_dir_perms;
allow modem_diagnostic_app mnt_vendor_file:file r_file_perms;
allow modem_diagnostic_app modem_img_file:dir r_dir_perms;
allow modem_diagnostic_app modem_img_file:file r_file_perms;
allow modem_diagnostic_app modem_img_file:lnk_file r_file_perms;
allow modem_diagnostic_app hal_vendor_oem_hwservice:hwservice_manager find;
allow modem_diagnostic_app sysfs_batteryinfo:file r_file_perms;
allow modem_diagnostic_app sysfs_batteryinfo:dir search;
dontaudit modem_diagnostic_app default_prop:file r_file_perms;
# Modem Log Mask Library Permissions
allow modem_diagnostic_app liboemservice_proxy_service:service_manager find;
binder_use(modem_diagnostic_app)
binder_call(modem_diagnostic_app, liboemservice_proxy_default)
')

17
sepolicy/radio/modem_logging_control.te Normal file
View file

@ -0,0 +1,17 @@
type modem_logging_control, domain;
type modem_logging_control_exec, vendor_file_type, exec_type, file_type;
init_daemon_domain(modem_logging_control)
hwbinder_use(modem_logging_control)
binder_call(modem_logging_control, dmd)
allow modem_logging_control radio_device:chr_file rw_file_perms;
allow modem_logging_control hal_vendor_oem_hwservice:hwservice_manager find;
allow modem_logging_control radio_vendor_data_file:dir create_dir_perms;
allow modem_logging_control radio_vendor_data_file:file create_file_perms;
allow modem_logging_control vendor_slog_file:dir create_dir_perms;
allow modem_logging_control vendor_slog_file:file create_file_perms;
set_prop(modem_logging_control, vendor_modem_prop)
get_prop(modem_logging_control, hwservicemanager_prop)

26
sepolicy/radio/modem_ml_svc_sit.te Normal file
View file

@ -0,0 +1,26 @@
type modem_ml_svc_sit, domain;
type modem_ml_svc_sit_exec, vendor_file_type, exec_type, file_type;
init_daemon_domain(modem_ml_svc_sit)
binder_use(modem_ml_svc_sit)
# Grant radio device access
allow modem_ml_svc_sit radio_device:chr_file rw_file_perms;
# Grant vendor radio and modem file/dir creation permission
allow modem_ml_svc_sit radio_vendor_data_file:dir create_dir_perms;
allow modem_ml_svc_sit radio_vendor_data_file:file create_file_perms;
# Grant modem ml data file/dir creation permission
allow modem_ml_svc_sit modem_ml_data_file:dir create_dir_perms;
allow modem_ml_svc_sit modem_ml_data_file:file create_file_perms;
# Grant modem ml models config files access
allow modem_ml_svc_sit modem_config_file:file r_file_perms;
# RIL property
get_prop(modem_ml_svc_sit, vendor_rild_prop)
# Access to NNAPI service
hal_client_domain(modem_ml_svc_sit, hal_neuralnetworks)
allow modem_ml_svc_sit edgetpu_nnapi_service:service_manager find;

47
sepolicy/radio/modem_svc_sit.te Normal file
View file

@ -0,0 +1,47 @@
type modem_svc_sit, domain;
type modem_svc_sit_exec, vendor_file_type, exec_type, file_type;
init_daemon_domain(modem_svc_sit)
hwbinder_use(modem_svc_sit)
binder_call(modem_svc_sit, rild)
# Grant sysfs_modem access
allow modem_svc_sit sysfs_modem:file rw_file_perms;
# Grant radio device access
allow modem_svc_sit radio_device:chr_file rw_file_perms;
# Grant vendor radio and modem file/dir creation permission
allow modem_svc_sit radio_vendor_data_file:dir create_dir_perms;
allow modem_svc_sit radio_vendor_data_file:file create_file_perms;
allow modem_svc_sit modem_stat_data_file:dir create_dir_perms;
allow modem_svc_sit modem_stat_data_file:file create_file_perms;
allow modem_svc_sit vendor_fw_file:dir search;
allow modem_svc_sit vendor_fw_file:file r_file_perms;
allow modem_svc_sit mnt_vendor_file:dir r_dir_perms;
allow modem_svc_sit modem_userdata_file:dir create_dir_perms;
allow modem_svc_sit modem_userdata_file:file create_file_perms;
# RIL property
get_prop(modem_svc_sit, vendor_rild_prop)
# Modem property
set_prop(modem_svc_sit, vendor_modem_prop)
# hwservice permission
allow modem_svc_sit hal_exynos_rild_hwservice:hwservice_manager find;
get_prop(modem_svc_sit, hwservicemanager_prop)
# logging property
get_prop(modem_svc_sit, vendor_logger_prop)
# Write trace data to the Perfetto traced daemon. This requires connecting to
# its producer socket and obtaining a (per-process) tmpfs fd.
perfetto_producer(modem_svc_sit)
# Allow modem_svc_sit to access modem image file/dir
allow modem_svc_sit modem_img_file:dir r_dir_perms;
allow modem_svc_sit modem_img_file:file r_file_perms;
allow modem_svc_sit modem_img_file:lnk_file r_file_perms;

9
sepolicy/radio/oemrilservice_app.te Normal file
View file

@ -0,0 +1,9 @@
type oemrilservice_app, domain;
app_domain(oemrilservice_app)
allow oemrilservice_app app_api_service:service_manager find;
allow oemrilservice_app hal_exynos_rild_hwservice:hwservice_manager find;
allow oemrilservice_app radio_service:service_manager find;
binder_call(oemrilservice_app, rild)
set_prop(oemrilservice_app, vendor_rild_prop)

1
sepolicy/radio/private/radio.te Normal file
View file

@ -0,0 +1 @@
add_service(radio, uce_service)

1
sepolicy/radio/private/service_contexts Normal file
View file

@ -0,0 +1 @@
telephony.oem.oemrilhook u:object_r:radio_service:s0

17
sepolicy/radio/property.te Normal file
View file

@ -0,0 +1,17 @@
# P23 vendor properties
vendor_internal_prop(vendor_carrier_prop)
vendor_internal_prop(vendor_cbd_prop)
vendor_internal_prop(vendor_slog_prop)
vendor_internal_prop(vendor_persist_config_default_prop)
vendor_internal_prop(vendor_diag_prop)
vendor_internal_prop(vendor_modem_prop)
vendor_internal_prop(vendor_rild_prop)
vendor_internal_prop(vendor_ssrdump_prop)
vendor_internal_prop(vendor_wifi_version)
vendor_internal_prop(vendor_imssvc_prop)
vendor_internal_prop(vendor_gps_prop)
vendor_internal_prop(vendor_tcpdump_log_prop)
# Telephony debug app
vendor_internal_prop(vendor_telephony_app_prop)

59
sepolicy/radio/property_contexts Normal file
View file

@ -0,0 +1,59 @@
# for cbd
vendor.cbd. u:object_r:vendor_cbd_prop:s0
persist.vendor.cbd. u:object_r:vendor_cbd_prop:s0
# for ims service
persist.vendor.ims. u:object_r:vendor_imssvc_prop:s0
# for slog
vendor.sys.silentlog. u:object_r:vendor_slog_prop:s0
vendor.sys.exynos.slog. u:object_r:vendor_slog_prop:s0
persist.vendor.sys.silentlog u:object_r:vendor_slog_prop:s0
# for dmd
persist.vendor.sys.dm. u:object_r:vendor_diag_prop:s0
persist.vendor.sys.diag. u:object_r:vendor_diag_prop:s0
vendor.sys.dmd. u:object_r:vendor_diag_prop:s0
vendor.sys.diag. u:object_r:vendor_diag_prop:s0
persist.vendor.config. u:object_r:vendor_persist_config_default_prop:s0
# for logger app
vendor.pixellogger. u:object_r:vendor_logger_prop:s0
persist.vendor.pixellogger. u:object_r:vendor_logger_prop:s0
# Modem
persist.vendor.modem. u:object_r:vendor_modem_prop:s0
vendor.modem. u:object_r:vendor_modem_prop:s0
vendor.sys.modem. u:object_r:vendor_modem_prop:s0
vendor.sys.modem_reset u:object_r:vendor_modem_prop:s0
ro.vendor.sys.modem. u:object_r:vendor_modem_prop:s0
vendor.sys.exynos.modempath u:object_r:vendor_modem_prop:s0
persist.vendor.sys.modem. u:object_r:vendor_modem_prop:s0
# for rild
persist.vendor.ril. u:object_r:vendor_rild_prop:s0
vendor.ril. u:object_r:vendor_rild_prop:s0
vendor.radio. u:object_r:vendor_rild_prop:s0
vendor.sys.rild_reset u:object_r:vendor_rild_prop:s0
persist.vendor.radio. u:object_r:vendor_rild_prop:s0
ro.vendor.config.build_carrier u:object_r:vendor_carrier_prop:s0
# SSR Detector
vendor.debug.ssrdump. u:object_r:vendor_ssrdump_prop:s0
persist.vendor.sys.ssr. u:object_r:vendor_ssrdump_prop:s0
# WiFi
vendor.wlan.driver.version u:object_r:vendor_wifi_version:s0
vendor.wlan.firmware.version u:object_r:vendor_wifi_version:s0
# for vendor telephony debug app
vendor.config.debug. u:object_r:vendor_telephony_app_prop:s0
# for gps
vendor.gps. u:object_r:vendor_gps_prop:s0
persist.vendor.gps. u:object_r:vendor_gps_prop:s0
# Tcpdump_logger
persist.vendor.tcpdump.log.alwayson u:object_r:vendor_tcpdump_log_prop:s0
vendor.tcpdump. u:object_r:vendor_tcpdump_log_prop:s0

6
sepolicy/radio/radio.te Normal file
View file

@ -0,0 +1,6 @@
set_prop(radio, telephony_ril_prop)
allow radio radio_vendor_data_file:dir rw_dir_perms;
allow radio radio_vendor_data_file:file create_file_perms;
allow radio vendor_ims_app:udp_socket { getattr read write setopt shutdown };
allow radio aoc_device:chr_file rw_file_perms;

37
sepolicy/radio/rfsd.te Normal file
View file

@ -0,0 +1,37 @@
type rfsd, domain;
type rfsd_exec, vendor_file_type, exec_type, file_type;
init_daemon_domain(rfsd)
# Allow to search block device and mnt dir for modem EFS partitions
allow rfsd mnt_vendor_file:dir search;
allow rfsd block_device:dir search;
# Allow to operate with modem EFS file/dir
allow rfsd modem_efs_file:dir create_dir_perms;
allow rfsd modem_efs_file:file create_file_perms;
allow rfsd radio_vendor_data_file:dir r_dir_perms;
allow rfsd radio_vendor_data_file:file r_file_perms;
r_dir_file(rfsd, vendor_fw_file)
# Allow to access rfsd log file/dir
allow rfsd vendor_log_file:dir search;
allow rfsd vendor_rfsd_log_file:dir create_dir_perms;
allow rfsd vendor_rfsd_log_file:file create_file_perms;
# Allow to read/write modem block device
allow rfsd modem_block_device:blk_file rw_file_perms;
# Allow to operate with radio device
allow rfsd radio_device:chr_file rw_file_perms;
# Allow to set rild and modem property
set_prop(rfsd, vendor_modem_prop)
set_prop(rfsd, vendor_rild_prop)
set_prop(rfsd, vendor_cbd_prop)
# Allow rfsd to access modem image file/dir
allow rfsd modem_img_file:dir r_dir_perms;
allow rfsd modem_img_file:file r_file_perms;
allow rfsd modem_img_file:lnk_file r_file_perms;

46
sepolicy/radio/rild.te Normal file
View file

@ -0,0 +1,46 @@
set_prop(rild, vendor_rild_prop)
set_prop(rild, vendor_modem_prop)
get_prop(rild, vendor_persist_config_default_prop)
get_prop(rild, vendor_carrier_prop)
get_prop(rild, sota_prop)
get_prop(rild, system_boot_reason_prop)
set_prop(rild, telephony_ril_prop)
allow rild proc_net:file rw_file_perms;
allow rild radio_vendor_data_file:dir create_dir_perms;
allow rild radio_vendor_data_file:file create_file_perms;
allow rild rild_vendor_data_file:dir create_dir_perms;
allow rild rild_vendor_data_file:file create_file_perms;
allow rild vendor_fw_file:file r_file_perms;
allow rild mnt_vendor_file:dir r_dir_perms;
r_dir_file(rild, modem_img_file)
binder_call(rild, bipchmgr)
binder_call(rild, gpsd)
binder_call(rild, hal_audio_default)
binder_call(rild, modem_svc_sit)
binder_call(rild, vendor_ims_app)
binder_call(rild, vendor_rcs_app)
binder_call(rild, oemrilservice_app)
binder_call(rild, hal_secure_element_uicc)
binder_call(rild, grilservice_app)
binder_call(rild, vendor_engineermode_app)
binder_call(rild, vendor_telephony_debug_app)
binder_call(rild, logger_app)
crash_dump_fallback(rild)
# for hal service
add_hwservice(rild, hal_exynos_rild_hwservice)
# Allow rild to access files on modem img.
allow rild modem_img_file:dir r_dir_perms;
allow rild modem_img_file:file r_file_perms;
allow rild modem_img_file:lnk_file r_file_perms;
userdebug_or_eng(`
binder_call(rild, modem_diagnostic_app)
')

23
sepolicy/radio/sced.te Normal file
View file

@ -0,0 +1,23 @@
type sced, domain;
type sced_exec, vendor_file_type, exec_type, file_type;
userdebug_or_eng(`
init_daemon_domain(sced)
typeattribute sced vendor_executes_system_violators;
hwbinder_use(sced)
binder_call(sced, dmd)
binder_call(sced, vendor_telephony_silentlogging_app)
get_prop(sced, hwservicemanager_prop)
allow sced self:packet_socket create_socket_perms_no_ioctl;
allow sced self:capability net_raw;
allow sced shell_exec:file rx_file_perms;
allow sced tcpdump_exec:file rx_file_perms;
allow sced vendor_shell_exec:file x_file_perms;
allow sced vendor_slog_file:dir create_dir_perms;
allow sced vendor_slog_file:file create_file_perms;
allow sced hidl_base_hwservice:hwservice_manager add;
allow sced hal_vendor_oem_hwservice:hwservice_manager { add find };
')

32
sepolicy/radio/seapp_contexts Normal file
View file

@ -0,0 +1,32 @@
# CBRS setup app
user=_app seinfo=platform name=com.google.googlecbrs domain=cbrs_setup_app type=app_data_file levelFrom=user
# Modem Diagnostic System
user=_app isPrivApp=true seinfo=mds name=com.google.mds domain=modem_diagnostic_app type=app_data_file levelFrom=user
user=_app isPrivApp=true seinfo=platform name=com.google.mds domain=modem_diagnostic_app type=app_data_file levelFrom=user
# grilservice
user=_app isPrivApp=true name=com.google.android.grilservice domain=grilservice_app levelFrom=all
# exynos apps
user=_app isPrivApp=true name=com.samsung.slsi.telephony.oemril domain=oemrilservice_app levelFrom=all
user=_app isPrivApp=true name=com.shannon.qualifiednetworksservice domain=vendor_qualifiednetworks_app levelFrom=all
user=_app isPrivApp=true name=com.shannon.rcsservice domain=vendor_rcs_app levelFrom=all
user=_app isPrivApp=true name=com.shannon.rcsservice:shannonrcsservice domain=vendor_rcs_service_app levelFrom=all
user=_app isPrivApp=true name=com.shannon.imsservice domain=vendor_ims_app levelFrom=all
user=_app isPrivApp=true name=.ShannonImsService domain=vendor_ims_app levelFrom=all
user=_app isPrivApp=true name=com.shannon.imsservice:remote domain=vendor_ims_remote_app levelFrom=all
# slsi logging apps
user=system seinfo=platform name=com.samsung.slsi.telephony.silentlogging domain=vendor_telephony_silentlogging_app levelFrom=all
user=system seinfo=platform name=com.samsung.slsi.telephony.silentlogging:remote domain=vendor_silentlogging_remote_app levelFrom=all
user=system seinfo=platform name=com.samsung.slsi.sysdebugmode domain=vendor_telephony_debug_app levelFrom=all
user=system seinfo=platform name=com.samsung.slsi.telephony.testmode domain=vendor_telephony_test_app levelFrom=all
# Samsung S.LSI engineer mode
user=_app seinfo=platform name=com.samsung.slsi.engineermode domain=vendor_engineermode_app levelFrom=all
# Domain for CatEngineService
user=system seinfo=platform name=com.google.android.CatEngine domain=cat_engine_service_app type=system_app_data_file levelFrom=all

2
sepolicy/radio/service.te Normal file
View file

@ -0,0 +1,2 @@
# define liboemservice_proxy_service
type liboemservice_proxy_service, hal_service_type, service_manager_type;

2
sepolicy/radio/service_contexts Normal file
View file

@ -0,0 +1,2 @@
# DMD oemservice aidl proxy
com.google.pixel.modem.logmasklibrary.ILiboemserviceProxy/default u:object_r:liboemservice_proxy_service:s0

13
sepolicy/radio/vcd.te Normal file
View file

@ -0,0 +1,13 @@
type vcd, domain;
type vcd_exec, vendor_file_type, exec_type, file_type;
userdebug_or_eng(`
init_daemon_domain(vcd)
get_prop(vcd, vendor_rild_prop);
get_prop(vcd, vendor_persist_config_default_prop);
allow vcd serial_device:chr_file rw_file_perms;
allow vcd radio_device:chr_file rw_file_perms;
allow vcd self:tcp_socket { create_socket_perms_no_ioctl listen accept };
allow vcd node:tcp_socket node_bind;
')

12
sepolicy/radio/vendor_engineermode_app.te Normal file
View file

@ -0,0 +1,12 @@
type vendor_engineermode_app, domain;
app_domain(vendor_engineermode_app)
binder_call(vendor_engineermode_app, rild)
allow vendor_engineermode_app app_api_service:service_manager find;
allow vendor_engineermode_app hal_exynos_rild_hwservice:hwservice_manager find;
userdebug_or_eng(`
dontaudit vendor_engineermode_app default_prop:file r_file_perms;
')

20
sepolicy/radio/vendor_ims_app.te Normal file
View file

@ -0,0 +1,20 @@
type vendor_ims_app, domain;
app_domain(vendor_ims_app)
net_domain(vendor_ims_app)
allow vendor_ims_app app_api_service:service_manager find;
allow vendor_ims_app audioserver_service:service_manager find;
allow vendor_ims_app hal_exynos_rild_hwservice:hwservice_manager find;
allow vendor_ims_app radio_service:service_manager find;
allow vendor_ims_app mediaserver_service:service_manager find;
allow vendor_ims_app cameraserver_service:service_manager find;
allow vendor_ims_app mediametrics_service:service_manager find;
allow vendor_ims_app self:udp_socket { create_socket_perms_no_ioctl };
binder_call(vendor_ims_app, rild)
set_prop(vendor_ims_app, vendor_rild_prop)
set_prop(vendor_ims_app, radio_prop)
get_prop(vendor_ims_app, vendor_imssvc_prop)

4
sepolicy/radio/vendor_ims_remote_app.te Normal file
View file

@ -0,0 +1,4 @@
type vendor_ims_remote_app, domain;
app_domain(vendor_ims_remote_app)
allow vendor_ims_remote_app app_api_service:service_manager find;

7
sepolicy/radio/vendor_init.te Normal file
View file

@ -0,0 +1,7 @@
set_prop(vendor_init, vendor_cbd_prop)
get_prop(vendor_init, telephony_modem_prop)
set_prop(vendor_init, vendor_carrier_prop)
set_prop(vendor_init, vendor_modem_prop)
set_prop(vendor_init, vendor_rild_prop)
set_prop(vendor_init, vendor_logger_prop)
set_prop(vendor_init, vendor_slog_prop)

5
sepolicy/radio/vendor_qualifiednetworks_app.te Normal file
View file

@ -0,0 +1,5 @@
type vendor_qualifiednetworks_app, domain;
app_domain(vendor_qualifiednetworks_app)
allow vendor_qualifiednetworks_app app_api_service:service_manager find;
allow vendor_qualifiednetworks_app radio_service:service_manager find;

9
sepolicy/radio/vendor_rcs_app.te Normal file
View file

@ -0,0 +1,9 @@
type vendor_rcs_app, domain;
app_domain(vendor_rcs_app)
net_domain(vendor_rcs_app)
allow vendor_rcs_app app_api_service:service_manager find;
allow vendor_rcs_app radio_service:service_manager find;
allow vendor_rcs_app hal_exynos_rild_hwservice:hwservice_manager find;
binder_call(vendor_rcs_app, rild)

5
sepolicy/radio/vendor_rcs_service_app.te Normal file
View file

@ -0,0 +1,5 @@
type vendor_rcs_service_app, domain;
app_domain(vendor_rcs_service_app)
allow vendor_rcs_service_app app_api_service:service_manager find;
allow vendor_rcs_service_app radio_service:service_manager find;

13
sepolicy/radio/vendor_silentlogging_remote_app.te Normal file
View file

@ -0,0 +1,13 @@
type vendor_silentlogging_remote_app, domain;
app_domain(vendor_silentlogging_remote_app)
allow vendor_silentlogging_remote_app vendor_slog_file:dir create_dir_perms;
allow vendor_silentlogging_remote_app vendor_slog_file:file create_file_perms;
allow vendor_silentlogging_remote_app app_api_service:service_manager find;
userdebug_or_eng(`
# Silent Logging Remote
dontaudit vendor_silentlogging_remote_app system_app_data_file:dir create_dir_perms;
dontaudit vendor_silentlogging_remote_app system_app_data_file:file create_file_perms;
')

20
sepolicy/radio/vendor_telephony_debug_app.te Normal file
View file

@ -0,0 +1,20 @@
type vendor_telephony_debug_app, domain;
app_domain(vendor_telephony_debug_app)
allow vendor_telephony_debug_app app_api_service:service_manager find;
allow vendor_telephony_debug_app hal_exynos_rild_hwservice:hwservice_manager find;
binder_call(vendor_telephony_debug_app, rild)
# RIL property
set_prop(vendor_telephony_debug_app, vendor_rild_prop)
# Debug property
set_prop(vendor_telephony_debug_app, vendor_telephony_app_prop)
userdebug_or_eng(`
# System Debug Mode
dontaudit vendor_telephony_debug_app system_app_data_file:dir create_dir_perms;
dontaudit vendor_telephony_debug_app system_app_data_file:file create_file_perms;
dontaudit vendor_telephony_debug_app default_prop:file r_file_perms;
')

21
sepolicy/radio/vendor_telephony_silentlogging_app.te Normal file
View file

@ -0,0 +1,21 @@
type vendor_telephony_silentlogging_app, domain;
app_domain(vendor_telephony_silentlogging_app)
set_prop(vendor_telephony_silentlogging_app, vendor_modem_prop)
set_prop(vendor_telephony_silentlogging_app, vendor_slog_prop)
allow vendor_telephony_silentlogging_app vendor_slog_file:dir create_dir_perms;
allow vendor_telephony_silentlogging_app vendor_slog_file:file create_file_perms;
allow vendor_telephony_silentlogging_app app_api_service:service_manager find;
allow vendor_telephony_silentlogging_app hal_vendor_oem_hwservice:hwservice_manager find;
binder_call(vendor_telephony_silentlogging_app, dmd)
binder_call(vendor_telephony_silentlogging_app, sced)
userdebug_or_eng(`
# Silent Logging
dontaudit vendor_telephony_silentlogging_app system_app_data_file:dir create_dir_perms;
dontaudit vendor_telephony_silentlogging_app system_app_data_file:file create_file_perms;
dontaudit vendor_telephony_silentlogging_app default_prop:file { getattr open read map };
allow vendor_telephony_silentlogging_app selinuxfs:file { read open };
')

4
sepolicy/radio/vendor_telephony_test_app.te Normal file
View file

@ -0,0 +1,4 @@
type vendor_telephony_test_app, domain;
app_domain(vendor_telephony_test_app)
allow vendor_telephony_test_app app_api_service:service_manager find;

4
sepolicy/radio/vold.te Normal file
View file

@ -0,0 +1,4 @@
allow vold modem_efs_file:dir rw_dir_perms;
allow vold modem_userdata_file:dir rw_dir_perms;
allow vold efs_block_device:blk_file { getattr };
allow vold modem_userdata_block_device:blk_file { getattr };

11
sepolicy/system_ext/private/pixeldisplayservice_app.te Normal file
View file

@ -0,0 +1,11 @@
typeattribute pixeldisplayservice_app coredomain;
app_domain(pixeldisplayservice_app);
allow pixeldisplayservice_app proc_vendor_sched:dir r_dir_perms;
allow pixeldisplayservice_app proc_vendor_sched:file w_file_perms;
# Standard system services
allow pixeldisplayservice_app app_api_service:service_manager find;
allow pixeldisplayservice_app cameraserver_service:service_manager find;

5
sepolicy/system_ext/private/pixelntnservice_app.te Normal file
View file

@ -0,0 +1,5 @@
typeattribute pixelntnservice_app coredomain;
app_domain(pixelntnservice_app);
allow pixelntnservice_app app_api_service:service_manager find;
set_prop(pixelntnservice_app, telephony_modem_prop)

2
sepolicy/system_ext/private/platform_app.te Normal file
View file

@ -0,0 +1,2 @@
# allow systemui access to fingerprint
hal_client_domain(platform_app, hal_fingerprint)

6
sepolicy/system_ext/private/property_contexts Normal file
View file

@ -0,0 +1,6 @@
# Telephony
telephony.TnNtn.image_switch u:object_r:telephony_modem_prop:s0 exact enum ntn tn
telephony.ril.silent_reset u:object_r:telephony_ril_prop:s0 exact bool
# HDCP setting of the display connected via USB port
persist.sys.hdcp_checking u:object_r:usb_control_prop:s0 exact string

9
sepolicy/system_ext/private/seapp_contexts Normal file
View file

@ -0,0 +1,9 @@
# SystemUI
user=_app seinfo=platform name=com.android.systemui domain=systemui_app type=app_data_file levelFrom=all
user=_app seinfo=platform name=com.android.systemui:* domain=systemui_app type=app_data_file levelFrom=all
# PixelDisplayService
user=_app seinfo=platform name=com.android.pixeldisplayservice domain=pixeldisplayservice_app type=app_data_file levelFrom=all
# PixelNtnService
user=system seinfo=platform name=com.google.android.satellite domain=pixelntnservice_app type=app_data_file levelFrom=all

27
sepolicy/system_ext/private/systemui_app.te Normal file
View file

@ -0,0 +1,27 @@
typeattribute systemui_app coredomain;
app_domain(systemui_app)
allow systemui_app app_api_service:service_manager find;
allow systemui_app network_score_service:service_manager find;
allow systemui_app overlay_service:service_manager find;
allow systemui_app color_display_service:service_manager find;
allow systemui_app audioserver_service:service_manager find;
allow systemui_app cameraserver_service:service_manager find;
allow systemui_app mediaserver_service:service_manager find;
allow systemui_app mediaextractor_service:service_manager find;
allow systemui_app mediametrics_service:service_manager find;
allow systemui_app radio_service:service_manager find;
allow systemui_app vr_manager_service:service_manager find;
allow systemui_app nfc_service:service_manager find;
allow systemui_app adb_service:service_manager find;
allow systemui_app statsmanager_service:service_manager find;
get_prop(systemui_app, keyguard_config_prop)
set_prop(systemui_app, bootanim_system_prop)
get_prop(systemui_app, qemu_hw_prop)
# Allow writing and removing wmshell protolog in /data/misc/wmtrace.
userdebug_or_eng(`
allow systemui_app wm_trace_data_file:dir rw_dir_perms;
allow systemui_app wm_trace_data_file:file create_file_perms;
')

1
sepolicy/system_ext/public/pixeldisplayservice_app.te Normal file
View file

@ -0,0 +1 @@
type pixeldisplayservice_app, domain;

1
sepolicy/system_ext/public/pixelntnservice_app.te Normal file
View file

@ -0,0 +1 @@
type pixelntnservice_app, domain;

7
sepolicy/system_ext/public/property.te Normal file
View file

@ -0,0 +1,7 @@
# Telephony
system_public_prop(telephony_ril_prop)
system_restricted_prop(telephony_modem_prop)
userdebug_or_eng(`
set_prop(shell, telephony_ril_prop)
')

1
sepolicy/system_ext/public/systemui_app.te Normal file
View file

@ -0,0 +1 @@
type systemui_app, domain;

2
sepolicy/tracking_denials/README.txt Normal file
View file

@ -0,0 +1,2 @@
This folder stores known errors detected by PTS. Be sure to remove relevant
files to reproduce error log on latest ROMs.

19
sepolicy/tracking_denials/bug_map Normal file
View file

@ -0,0 +1,19 @@
dumpstate app_zygote process b/288049050
hal_radioext_default radio_vendor_data_file file b/312590044
hal_vibrator_default default_android_service service_manager b/314054292
incidentd debugfs_wakeup_sources file b/288049561
incidentd incidentd anon_inode b/288049561
insmod-sh insmod-sh key b/274374722
kernel dm_device blk_file b/319403445
mtectrl unlabeled dir b/264483752
pixelstats_vendor sysfs file b/299553682
shell sysfs_net file b/330081782
ssr_detector_app default_prop file b/340722729
system_server sysfs_batteryinfo file b/294967729
system_suspend sysfs_batteryinfo dir b/317316633
vendor_init default_prop file b/315104235
vendor_init default_prop file b/315104803
vendor_init default_prop file b/323087197
vendor_init default_prop file b/323087490
vendor_init default_prop property_service b/315104235
vendor_init vendor_volte_mif_off property_service b/316816642

2
sepolicy/tracking_denials/dmd.te Normal file
View file

@ -0,0 +1,2 @@
# b/323471016
dontaudit dmd servicemanager:binder { call };

2
sepolicy/tracking_denials/kernel.te Normal file
View file

@ -0,0 +1,2 @@
# b/263185161
dontaudit kernel kernel:capability { net_bind_service };

2
sepolicy/tracking_denials/rebalance_interrupts_vendor.te Normal file
View file

@ -0,0 +1,2 @@
# b/260366278
dontaudit rebalance_interrupts_vendor rebalance_interrupts_vendor:capability { dac_override };

2
sepolicy/vendor/audioserver.te vendored Normal file
View file

@ -0,0 +1,2 @@
#allow access to ALSA MMAP FDs for AAudio API
allow audioserver audio_device:chr_file r_file_perms;

2
sepolicy/vendor/bootanim.te vendored Normal file
View file

@ -0,0 +1,2 @@
allow bootanim arm_mali_platform_service:service_manager find;
dontaudit bootanim system_data_file:dir { search };

8
sepolicy/vendor/cccdk_timesync_app.te vendored Normal file
View file

@ -0,0 +1,8 @@
type vendor_cccdktimesync_app, domain;
app_domain(vendor_cccdktimesync_app)
allow vendor_cccdktimesync_app app_api_service:service_manager find;
allow vendor_cccdktimesync_app hal_bluetooth_coexistence_hwservice:hwservice_manager find;
allow vendor_cccdktimesync_app hal_bluetooth_coexistence_service:service_manager find;
binder_call(vendor_cccdktimesync_app, hal_bluetooth_btlinux)

27
sepolicy/vendor/certs/app.x509.pem vendored Normal file
View file

@ -0,0 +1,27 @@
-----BEGIN CERTIFICATE-----
MIIEqDCCA5CgAwIBAgIJANWFuGx90071MA0GCSqGSIb3DQEBBAUAMIGUMQswCQYD
VQQGEwJVUzETMBEGA1UECBMKQ2FsaWZvcm5pYTEWMBQGA1UEBxMNTW91bnRhaW4g
VmlldzEQMA4GA1UEChMHQW5kcm9pZDEQMA4GA1UECxMHQW5kcm9pZDEQMA4GA1UE
AxMHQW5kcm9pZDEiMCAGCSqGSIb3DQEJARYTYW5kcm9pZEBhbmRyb2lkLmNvbTAe
Fw0wODA0MTUyMzM2NTZaFw0zNTA5MDEyMzM2NTZaMIGUMQswCQYDVQQGEwJVUzET
MBEGA1UECBMKQ2FsaWZvcm5pYTEWMBQGA1UEBxMNTW91bnRhaW4gVmlldzEQMA4G
A1UEChMHQW5kcm9pZDEQMA4GA1UECxMHQW5kcm9pZDEQMA4GA1UEAxMHQW5kcm9p
ZDEiMCAGCSqGSIb3DQEJARYTYW5kcm9pZEBhbmRyb2lkLmNvbTCCASAwDQYJKoZI
hvcNAQEBBQADggENADCCAQgCggEBANbOLggKv+IxTdGNs8/TGFy0PTP6DHThvbbR
24kT9ixcOd9W+EaBPWW+wPPKQmsHxajtWjmQwWfna8mZuSeJS48LIgAZlKkpFeVy
xW0qMBujb8X8ETrWy550NaFtI6t9+u7hZeTfHwqNvacKhp1RbE6dBRGWynwMVX8X
W8N1+UjFaq6GCJukT4qmpN2afb8sCjUigq0GuMwYXrFVee74bQgLHWGJwPmvmLHC
69EH6kWr22ijx4OKXlSIx2xT1AsSHee70w5iDBiK4aph27yH3TxkXy9V89TDdexA
cKk/cVHYNnDBapcavl7y0RiQ4biu8ymM8Ga/nmzhRKya6G0cGw8CAQOjgfwwgfkw
HQYDVR0OBBYEFI0cxb6VTEM8YYY6FbBMvAPyT+CyMIHJBgNVHSMEgcEwgb6AFI0c
xb6VTEM8YYY6FbBMvAPyT+CyoYGapIGXMIGUMQswCQYDVQQGEwJVUzETMBEGA1UE
CBMKQ2FsaWZvcm5pYTEWMBQGA1UEBxMNTW91bnRhaW4gVmlldzEQMA4GA1UEChMH
QW5kcm9pZDEQMA4GA1UECxMHQW5kcm9pZDEQMA4GA1UEAxMHQW5kcm9pZDEiMCAG
CSqGSIb3DQEJARYTYW5kcm9pZEBhbmRyb2lkLmNvbYIJANWFuGx90071MAwGA1Ud
EwQFMAMBAf8wDQYJKoZIhvcNAQEEBQADggEBABnTDPEF+3iSP0wNfdIjIz1AlnrP
zgAIHVvXxunW7SBrDhEglQZBbKJEk5kT0mtKoOD1JMrSu1xuTKEBahWRbqHsXcla
XjoBADb0kkjVEJu/Lh5hgYZnOjvlba8Ld7HCKePCVePoTJBdI4fvugnL8TsgK05a
IskyY0hKI9L8KfqfGTl1lzOv2KoWD0KWwtAWPoGChZxmQ+nBli+gwYMzM1vAkP+a
ayLe0a1EQimlOalO762r0GXO0ks+UeXde2Z4e+8S/pf7pITEI/tP+MxJTALw9QUW
Ev9lKTk+jkbqxbsh8nfBUapfKqYn0eidpwq2AzVp3juYl7//fKnaPhJD9gs=
-----END CERTIFICATE-----

17
sepolicy/vendor/certs/camera_eng.x509.pem vendored Normal file
View file

@ -0,0 +1,17 @@
-----BEGIN CERTIFICATE-----
MIICpzCCAmWgAwIBAgIEUAV8QjALBgcqhkjOOAQDBQAwNzELMAkGA1UEBhMCVVMx
EDAOBgNVBAoTB0FuZHJvaWQxFjAUBgNVBAMTDUFuZHJvaWQgRGVidWcwHhcNMTIw
NzE3MTQ1MjUwWhcNMjIwNzE1MTQ1MjUwWjA3MQswCQYDVQQGEwJVUzEQMA4GA1UE
ChMHQW5kcm9pZDEWMBQGA1UEAxMNQW5kcm9pZCBEZWJ1ZzCCAbcwggEsBgcqhkjO
OAQBMIIBHwKBgQD9f1OBHXUSKVLfSpwu7OTn9hG3UjzvRADDHj+AtlEmaUVdQCJR
+1k9jVj6v8X1ujD2y5tVbNeBO4AdNG/yZmC3a5lQpaSfn+gEexAiwk+7qdf+t8Yb
+DtX58aophUPBPuD9tPFHsMCNVQTWhaRMvZ1864rYdcq7/IiAxmd0UgBxwIVAJdg
UI8VIwvMspK5gqLrhAvwWBz1AoGBAPfhoIXWmz3ey7yrXDa4V7l5lK+7+jrqgvlX
TAs9B4JnUVlXjrrUWU/mcQcQgYC0SRZxI+hMKBYTt88JMozIpuE8FnqLVHyNKOCj
rh4rs6Z1kW6jfwv6ITVi8ftiegEkO8yk8b6oUZCJqIPf4VrlnwaSi2ZegHtVJWQB
TDv+z0kqA4GEAAKBgGrRG9fVZtJ69DnALkForP1FtL6FvJmMe5uOHHdUaT+MDUKK
pPzhEISBOEJPpozRMFJO7/bxNzhjgi+mNymL/k1GoLhmZe7wQRc5AQNbHIBqoxgY
DTA6qMyeWSPgam+r+nVoPEU7sgd3fPL958+xmxQwOBSqHfe0PVsiK1cGtIuUMAsG
ByqGSM44BAMFAAMvADAsAhQJ0tGwRwIptb7SkCZh0RLycMXmHQIUZ1ACBqeAULp4
rscXTxYEf4Tqovc=
-----END CERTIFICATE-----

15
sepolicy/vendor/certs/camera_fishfood.x509.pem vendored Normal file
View file

@ -0,0 +1,15 @@
-----BEGIN CERTIFICATE-----
MIICUjCCAbsCBEk0mH4wDQYJKoZIhvcNAQEEBQAwcDELMAkGA1UEBhMCVVMxCzAJ
BgNVBAgTAkNBMRYwFAYDVQQHEw1Nb3VudGFpbiBWaWV3MRQwEgYDVQQKEwtHb29n
bGUsIEluYzEUMBIGA1UECxMLR29vZ2xlLCBJbmMxEDAOBgNVBAMTB1Vua25vd24w
HhcNMDgxMjAyMDIwNzU4WhcNMzYwNDE5MDIwNzU4WjBwMQswCQYDVQQGEwJVUzEL
MAkGA1UECBMCQ0ExFjAUBgNVBAcTDU1vdW50YWluIFZpZXcxFDASBgNVBAoTC0dv
b2dsZSwgSW5jMRQwEgYDVQQLEwtHb29nbGUsIEluYzEQMA4GA1UEAxMHVW5rbm93
bjCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAn0gDGZD5sUcmOE4EU9GPjAu/
jcd7JQSksSB8TGxEurwArcZhD6a2qy2oDjPy7vFrJqP2uFua+sqQn/u+s/TJT36B
IqeY4OunXO090in6c2X0FRZBWqnBYX3Vg84Zuuigu9iF/BeptL0mQIBRIarbk3fe
tAATOBQYiC7FIoL8WA0CAwEAATANBgkqhkiG9w0BAQQFAAOBgQBAhmae1jHaQ4Td
0GHSJuBzuYzEuZ34teS+njy+l1Aeg98cb6lZwM5gXE/SrG0chM7eIEdsurGb6PIg
Ov93F61lLY/MiQcI0SFtqERXWSZJ4OnTxLtM9Y2hnbHU/EG8uVhPZOZfQQ0FKf1b
aIOMFB0Km9HbEZHLKg33kOoMsS2zpA==
-----END CERTIFICATE-----

30
sepolicy/vendor/certs/com_google_android_apps_camera_services.x509.pem vendored Normal file
View file

@ -0,0 +1,30 @@
-----BEGIN CERTIFICATE-----
MIIGCzCCA/OgAwIBAgIVAIHtywgrR7O/EgQ+PeYSfHDaUDt8MA0GCSqGSIb3DQEBCwUAMIGUMQsw
CQYDVQQGEwJVUzETMBEGA1UECBMKQ2FsaWZvcm5pYTEWMBQGA1UEBxMNTW91bnRhaW4gVmlldzEU
MBIGA1UEChMLR29vZ2xlIEluYy4xEDAOBgNVBAsTB0FuZHJvaWQxMDAuBgNVBAMMJ2NvbV9nb29n
bGVfYW5kcm9pZF9hcHBzX2NhbWVyYV9zZXJ2aWNlczAgFw0yMTA2MzAyMzI2MThaGA8yMDUxMDYz
MDIzMjYxOFowgZQxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1N
b3VudGFpbiBWaWV3MRQwEgYDVQQKEwtHb29nbGUgSW5jLjEQMA4GA1UECxMHQW5kcm9pZDEwMC4G
A1UEAwwnY29tX2dvb2dsZV9hbmRyb2lkX2FwcHNfY2FtZXJhX3NlcnZpY2VzMIICIjANBgkqhkiG
9w0BAQEFAAOCAg8AMIICCgKCAgEAof2MqYxoQkV05oUZULYlNLDIJKryWjC8ha300YUktBNNVBSP
1y33+ZTBldm7drcBGo54S1JE1lCIP1dMxby0rNTJ8/Zv2bMVMjXX0haF5vULt64itDcR0SqUDfFR
UsHapPVmRmMpDOMOUYUbN7gjU7iYAc9oWBo6BFfckdpwwKfzYY/sgieen1E/MN7Zpzmefct3WDU5
4Dc8mpoNsen3oqquieYAgv9FOw5gCIgsDaOfYFBgvAE08Pqo3J/zU6dAuqUJztNH8EhgTNbcaNVL
jCmofa+iIAjSpmP69jcgaUyfmH0EE3/m55qouVRJzqARvmEO/M7LEr3n1ZKKhDZdO6TJysMzP9g8
pONPO8/3hTQ+GP+7fOQooNQJEGNgJuZOHSyNL/8nGCgHBZKgZdZPKk8HV2M578UDf8yNyV5AYpx0
VK1JdoBtNMzp0cv7Q6TTugIuDEzT3jmgGGp6WmXE6B9dJOq+cnVC7cSYva8wctFS3RpoqT79vkW3
A7g2b26bM5GMQ8KcGC4qm4pJkrX5kKZWZGWXjm0F8gRJQ5D0S/AcUw3B+sG/AmfQzLm8SCK36HhO
sFnPsQJ/VdL7kg9HHWrQYVexNaQnD/QLOCenk09COUzSwexws+kQhUH45OSbQFjOJwPbS4YAn9qV
eV+DPlvemZEFYF5+MVlDwOGQ3JsCAwEAAaNQME4wDAYDVR0TBAUwAwEB/zAdBgNVHQ4EFgQUtjMO
nlaC4nsk4PwT+fcIYpg52JQwHwYDVR0jBBgwFoAUtjMOnlaC4nsk4PwT+fcIYpg52JQwDQYJKoZI
hvcNAQELBQADggIBABhYDqPD2yWiXNCVtHk6h7Kb2H2U3rc8G7Or1/mwrXSCEgqHnCkpiWeb1h/5
YNS9fRrexQD+O0hukCpjvIFccQvk8EkZdWpn4kDlrUqfakWpASzlwEqRviS31Hiybn/+QUpYuDTm
FYorrHzDzPiNttzxVK0ENt4T4ETDWVqiGB7tbTlLPr6tz/oxDjRH8y4iS/For7SkfdI512txJgDr
njvRVY9WJykySs+AAqwS1PIMXGoI03UmLJUsFNUjHehaqguPS1uiewlKiQq07blWbnQXdcyH7QTI
hOUPY2rRBh8ciXu4L0Uk4To7+DP/8nHSGC7qXPvP6W3gqW1hj0d6GviMEfJ9fBSUEzaCRF3aL/5e
JOGQQKxh7Jsl/zZs4+MYg0Q2cyg/BQVNNOhESG4et4OV5go9W+1oAy20FV0NgtdPoeb9ABNoi4T3
IrKLgxOsbACpoDt3zPhncqiJhX3feFtyVV4oRiylydiiYO927qNdfMGmcnGFSG4814kUxSdpkoCA
V7WCQD42zfBYj4pkdZwiJW4yZSaPWN/Eodi3PBsV+10Y1O1WOvebJuTGmcvWWMCPGtFQJDijUy4H
r8rDe3ZmRGQ+vEGPJZC8nx9+qxLQ314ZCzdS0R1HwRRuOji3fCSCnaPQuCFe3YlzhB2j6fRGNf7F
DB17LhMLl0GxX9j1
-----END CERTIFICATE-----

7
sepolicy/vendor/charger_vendor.te vendored Normal file
View file

@ -0,0 +1,7 @@
# charger_vendor for battery in off-mode charging
allow charger_vendor mnt_vendor_file:dir search;
allow charger_vendor persist_file:dir search;
allow charger_vendor sysfs_batteryinfo:file w_file_perms;
allow charger_vendor sysfs_scsi_devices_0000:file r_file_perms;
dontaudit charger_vendor default_prop:file r_file_perms;
set_prop(charger_vendor, vendor_battery_defender_prop)

Some files were not shown because too many files have changed in this diff Show more