diff --git a/tracking_denials/bootanim.te b/tracking_denials/bootanim.te index e15c110c..a0346b1c 100644 --- a/tracking_denials/bootanim.te +++ b/tracking_denials/bootanim.te @@ -1,2 +1,9 @@ # b/260522279 dontaudit bootanim system_data_file:dir { search }; +# b/261105374 +dontaudit bootanim default_android_service:service_manager { find }; +dontaudit bootanim vendor_file:file { execute }; +dontaudit bootanim vendor_file:file { getattr }; +dontaudit bootanim vendor_file:file { map }; +dontaudit bootanim vendor_file:file { open }; +dontaudit bootanim vendor_file:file { read }; diff --git a/tracking_denials/bootdevice_sysdev.te b/tracking_denials/bootdevice_sysdev.te new file mode 100644 index 00000000..6aebfd9f --- /dev/null +++ b/tracking_denials/bootdevice_sysdev.te @@ -0,0 +1,2 @@ +# b/261105238 +dontaudit bootdevice_sysdev sysfs:filesystem { associate }; diff --git a/tracking_denials/chre.te b/tracking_denials/chre.te index 218bea4d..e8b2cf03 100644 --- a/tracking_denials/chre.te +++ b/tracking_denials/chre.te @@ -5,3 +5,11 @@ dontaudit chre aoc_device:chr_file { read write }; dontaudit chre chre:capability2 { block_suspend }; dontaudit chre device:dir { read }; dontaudit chre device:dir { watch }; +# b/261105224 +dontaudit chre hal_system_suspend_service:service_manager { find }; +dontaudit chre servicemanager:binder { call }; +dontaudit chre sysfs_aoc:dir { search }; +dontaudit chre sysfs_aoc_boottime:file { getattr }; +dontaudit chre sysfs_aoc_boottime:file { open }; +dontaudit chre sysfs_aoc_boottime:file { read }; +dontaudit chre system_suspend_server:binder { call }; diff --git a/tracking_denials/hal_contexthub_default.te b/tracking_denials/hal_contexthub_default.te new file mode 100644 index 00000000..4e0f17dd --- /dev/null +++ b/tracking_denials/hal_contexthub_default.te @@ -0,0 +1,3 @@ +# b/261105182 +dontaudit hal_contexthub_default chre:unix_stream_socket { connectto }; +dontaudit hal_contexthub_default chre_socket:sock_file { write }; diff --git a/tracking_denials/hal_fingerprint_default.te b/tracking_denials/hal_fingerprint_default.te new file mode 100644 index 00000000..51dd2105 --- /dev/null +++ b/tracking_denials/hal_fingerprint_default.te @@ -0,0 +1,31 @@ +# b/261105164 +dontaudit hal_fingerprint_default block_device:dir { search }; +dontaudit hal_fingerprint_default dmabuf_system_heap_device:chr_file { ioctl }; +dontaudit hal_fingerprint_default dmabuf_system_heap_device:chr_file { open }; +dontaudit hal_fingerprint_default dmabuf_system_heap_device:chr_file { read }; +dontaudit hal_fingerprint_default fingerprint_device:chr_file { ioctl }; +dontaudit hal_fingerprint_default fingerprint_device:chr_file { open }; +dontaudit hal_fingerprint_default fingerprint_device:chr_file { read write }; +dontaudit hal_fingerprint_default fwk_stats_service:service_manager { find }; +dontaudit hal_fingerprint_default hal_fingerprint_default:netlink_socket { bind }; +dontaudit hal_fingerprint_default hal_fingerprint_default:netlink_socket { create }; +dontaudit hal_fingerprint_default hal_fingerprint_default:netlink_socket { read }; +dontaudit hal_fingerprint_default hal_fingerprint_default:netlink_socket { write }; +dontaudit hal_fingerprint_default hal_power_default:binder { call }; +dontaudit hal_fingerprint_default hal_power_service:service_manager { find }; +dontaudit hal_fingerprint_default mfg_data_block_device:blk_file { open }; +dontaudit hal_fingerprint_default mfg_data_block_device:blk_file { read write }; +dontaudit hal_fingerprint_default sysfs_chosen:dir { search }; +dontaudit hal_fingerprint_default sysfs_chosen:file { open }; +dontaudit hal_fingerprint_default sysfs_chosen:file { read }; +dontaudit hal_fingerprint_default sysfs_display:file { getattr }; +dontaudit hal_fingerprint_default sysfs_display:file { open }; +dontaudit hal_fingerprint_default sysfs_display:file { read }; +dontaudit hal_fingerprint_default tee_device:chr_file { ioctl }; +dontaudit hal_fingerprint_default tee_device:chr_file { open }; +dontaudit hal_fingerprint_default tee_device:chr_file { read write }; +dontaudit hal_fingerprint_default vendor_fingerprint_prop:file { getattr }; +dontaudit hal_fingerprint_default vendor_fingerprint_prop:file { map }; +dontaudit hal_fingerprint_default vendor_fingerprint_prop:file { open }; +dontaudit hal_fingerprint_default vendor_fingerprint_prop:file { read }; +dontaudit hal_fingerprint_default vendor_fingerprint_prop:property_service { set }; diff --git a/tracking_denials/hal_graphics_composer_default.te b/tracking_denials/hal_graphics_composer_default.te index daec6471..628a9665 100644 --- a/tracking_denials/hal_graphics_composer_default.te +++ b/tracking_denials/hal_graphics_composer_default.te @@ -14,3 +14,41 @@ dontaudit hal_graphics_composer_default sysfs_leds:file { getattr }; dontaudit hal_graphics_composer_default sysfs_leds:file { open }; dontaudit hal_graphics_composer_default sysfs_leds:file { read }; dontaudit hal_graphics_composer_default vndbinder_device:chr_file { ioctl }; +# b/261105029 +dontaudit hal_graphics_composer_default boot_status_prop:file { getattr }; +dontaudit hal_graphics_composer_default boot_status_prop:file { map }; +dontaudit hal_graphics_composer_default boot_status_prop:file { open }; +dontaudit hal_graphics_composer_default boot_status_prop:file { read }; +dontaudit hal_graphics_composer_default device_config_surface_flinger_native_boot_prop:file { getattr }; +dontaudit hal_graphics_composer_default device_config_surface_flinger_native_boot_prop:file { map }; +dontaudit hal_graphics_composer_default device_config_surface_flinger_native_boot_prop:file { open }; +dontaudit hal_graphics_composer_default device_config_surface_flinger_native_boot_prop:file { read }; +dontaudit hal_graphics_composer_default hal_graphics_composer_default:netlink_kobject_uevent_socket { bind }; +dontaudit hal_graphics_composer_default hal_graphics_composer_default:netlink_kobject_uevent_socket { create }; +dontaudit hal_graphics_composer_default hal_pixel_display_service:service_manager { add }; +dontaudit hal_graphics_composer_default hal_power_service:service_manager { find }; +dontaudit hal_graphics_composer_default mnt_vendor_file:dir { search }; +dontaudit hal_graphics_composer_default persist_display_file:dir { search }; +dontaudit hal_graphics_composer_default persist_display_file:file { getattr }; +dontaudit hal_graphics_composer_default persist_display_file:file { open }; +dontaudit hal_graphics_composer_default persist_display_file:file { read }; +dontaudit hal_graphics_composer_default persist_file:dir { search }; +dontaudit hal_graphics_composer_default sysfs_display:file { getattr }; +dontaudit hal_graphics_composer_default sysfs_display:file { open }; +dontaudit hal_graphics_composer_default sysfs_display:file { read }; +dontaudit hal_graphics_composer_default sysfs_display:file { write }; +dontaudit hal_graphics_composer_default sysfs_leds:file { write }; +dontaudit hal_graphics_composer_default vendor_display_prop:file { getattr }; +dontaudit hal_graphics_composer_default vendor_display_prop:file { map }; +dontaudit hal_graphics_composer_default vendor_display_prop:file { open }; +dontaudit hal_graphics_composer_default vendor_display_prop:file { read }; +dontaudit hal_graphics_composer_default vendor_displaycolor_service:service_manager { add }; +dontaudit hal_graphics_composer_default vendor_displaycolor_service:service_manager { find }; +dontaudit hal_graphics_composer_default vendor_surfaceflinger_vndservice:service_manager { add }; +dontaudit hal_graphics_composer_default vendor_surfaceflinger_vndservice:service_manager { find }; +dontaudit hal_graphics_composer_default vndbinder_device:chr_file { map }; +dontaudit hal_graphics_composer_default vndbinder_device:chr_file { open }; +dontaudit hal_graphics_composer_default vndbinder_device:chr_file { read }; +dontaudit hal_graphics_composer_default vndbinder_device:chr_file { write }; +dontaudit hal_graphics_composer_default vndservicemanager:binder { call }; +dontaudit hal_graphics_composer_default vndservicemanager:binder { transfer }; diff --git a/tracking_denials/hal_power_default.te b/tracking_denials/hal_power_default.te index b01c64be..ab3700c2 100644 --- a/tracking_denials/hal_power_default.te +++ b/tracking_denials/hal_power_default.te @@ -10,3 +10,5 @@ dontaudit hal_power_default sysfs_fabric:file { write }; dontaudit hal_power_default vendor_camera_prop:property_service { set }; # b/260769063 dontaudit hal_power_default hal_graphics_composer_default:binder { transfer }; +# b/261105028 +dontaudit hal_power_default hal_fingerprint_default:binder { transfer }; diff --git a/tracking_denials/hal_power_stats_default.te b/tracking_denials/hal_power_stats_default.te index d507ef93..40f69a0b 100644 --- a/tracking_denials/hal_power_stats_default.te +++ b/tracking_denials/hal_power_stats_default.te @@ -24,3 +24,8 @@ dontaudit hal_power_stats_default sysfs_iio_devices:dir { search }; dontaudit hal_power_stats_default sysfs_leds:dir { search }; dontaudit hal_power_stats_default sysfs_leds:file { open }; dontaudit hal_power_stats_default sysfs_leds:file { read }; +# b/261105152 +dontaudit hal_power_stats_default sysfs_aoc:dir { search }; +dontaudit hal_power_stats_default sysfs_aoc:file { getattr }; +dontaudit hal_power_stats_default sysfs_aoc:file { open }; +dontaudit hal_power_stats_default sysfs_aoc:file { read }; diff --git a/tracking_denials/hal_sensors_default.te b/tracking_denials/hal_sensors_default.te new file mode 100644 index 00000000..4f8ef015 --- /dev/null +++ b/tracking_denials/hal_sensors_default.te @@ -0,0 +1,48 @@ +# b/261105336 +dontaudit hal_sensors_default aoc_device:chr_file { getattr }; +dontaudit hal_sensors_default aoc_device:chr_file { open }; +dontaudit hal_sensors_default aoc_device:chr_file { read write }; +dontaudit hal_sensors_default chre:unix_stream_socket { connectto }; +dontaudit hal_sensors_default chre_socket:sock_file { write }; +dontaudit hal_sensors_default device:dir { open }; +dontaudit hal_sensors_default device:dir { read }; +dontaudit hal_sensors_default device:dir { watch }; +dontaudit hal_sensors_default fwk_stats_service:service_manager { find }; +dontaudit hal_sensors_default hal_graphics_composer_default:binder { call }; +dontaudit hal_sensors_default hal_pixel_display_service:service_manager { find }; +dontaudit hal_sensors_default mnt_vendor_file:dir { search }; +dontaudit hal_sensors_default persist_file:dir { search }; +dontaudit hal_sensors_default persist_sensor_reg_file:dir { getattr }; +dontaudit hal_sensors_default persist_sensor_reg_file:dir { open }; +dontaudit hal_sensors_default persist_sensor_reg_file:dir { read }; +dontaudit hal_sensors_default persist_sensor_reg_file:dir { search }; +dontaudit hal_sensors_default persist_sensor_reg_file:file { getattr }; +dontaudit hal_sensors_default persist_sensor_reg_file:file { open }; +dontaudit hal_sensors_default persist_sensor_reg_file:file { read }; +dontaudit hal_sensors_default sensor_reg_data_file:dir { getattr }; +dontaudit hal_sensors_default sensor_reg_data_file:dir { open }; +dontaudit hal_sensors_default sensor_reg_data_file:dir { read }; +dontaudit hal_sensors_default sensor_reg_data_file:dir { search }; +dontaudit hal_sensors_default sensor_reg_data_file:file { getattr }; +dontaudit hal_sensors_default sensor_reg_data_file:file { open }; +dontaudit hal_sensors_default sensor_reg_data_file:file { read }; +dontaudit hal_sensors_default sysfs_aoc:dir { search }; +dontaudit hal_sensors_default sysfs_aoc_boottime:file { getattr }; +dontaudit hal_sensors_default sysfs_aoc_boottime:file { open }; +dontaudit hal_sensors_default sysfs_aoc_boottime:file { read }; +dontaudit hal_sensors_default sysfs_chosen:dir { search }; +dontaudit hal_sensors_default sysfs_chosen:file { open }; +dontaudit hal_sensors_default sysfs_chosen:file { read }; +dontaudit hal_sensors_default sysfs_display:file { getattr }; +dontaudit hal_sensors_default sysfs_display:file { open }; +dontaudit hal_sensors_default sysfs_display:file { read }; +dontaudit hal_sensors_default sysfs_leds:dir { search }; +dontaudit hal_sensors_default sysfs_leds:file { open }; +dontaudit hal_sensors_default sysfs_leds:file { read }; +dontaudit hal_sensors_default sysfs_write_leds:file { open }; +dontaudit hal_sensors_default sysfs_write_leds:file { write }; +dontaudit hal_sensors_default system_server:binder { call }; +dontaudit hal_sensors_default vendor_dynamic_sensor_prop:file { getattr }; +dontaudit hal_sensors_default vendor_dynamic_sensor_prop:file { map }; +dontaudit hal_sensors_default vendor_dynamic_sensor_prop:file { open }; +dontaudit hal_sensors_default vendor_dynamic_sensor_prop:file { read }; diff --git a/tracking_denials/logd.te b/tracking_denials/logd.te new file mode 100644 index 00000000..25ad873d --- /dev/null +++ b/tracking_denials/logd.te @@ -0,0 +1,3 @@ +# b/261105354 +dontaudit logd trusty_log_device:chr_file { open }; +dontaudit logd trusty_log_device:chr_file { read }; diff --git a/tracking_denials/surfaceflinger.te b/tracking_denials/surfaceflinger.te new file mode 100644 index 00000000..ef3a689f --- /dev/null +++ b/tracking_denials/surfaceflinger.te @@ -0,0 +1,7 @@ +# b/261105092 +dontaudit surfaceflinger default_android_service:service_manager { find }; +dontaudit surfaceflinger vendor_file:file { execute }; +dontaudit surfaceflinger vendor_file:file { getattr }; +dontaudit surfaceflinger vendor_file:file { map }; +dontaudit surfaceflinger vendor_file:file { open }; +dontaudit surfaceflinger vendor_file:file { read }; diff --git a/tracking_denials/system_suspend.te b/tracking_denials/system_suspend.te index 48ce0f78..26e48255 100644 --- a/tracking_denials/system_suspend.te +++ b/tracking_denials/system_suspend.te @@ -9,3 +9,5 @@ dontaudit system_suspend_server sysfs_aoc:dir { read }; dontaudit system_suspend_server sysfs_aoc:file { getattr }; dontaudit system_suspend_server sysfs_aoc:file { open }; dontaudit system_suspend_server sysfs_aoc:file { read }; +# b/261105356 +dontaudit system_suspend_server chre:binder { transfer };