Evolution-X-Tensor/device_google_zuma
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Merge "move mediacodec_samsung build config and sepolicy to gs-common" into udc-dev

Browse source
This commit is contained in:
Ernie Hsu 2023-03-02 08:38:54 +00:00 • committed by Android (Google) Code Review
commit 899ad9c1ab
8 changed files with 0 additions and 46 deletions
Download patch file Download diff file Expand all files Collapse all files

1
legacy/whitechapel_pro/file.te
View file

@ -2,7 +2,6 @@
type updated_wifi_firmware_data_file, file_type, data_file_type;
type tcpdump_vendor_data_file, file_type, data_file_type;
type vendor_camera_data_file, file_type, data_file_type;
type vendor_media_data_file, file_type, data_file_type;
type vendor_misc_data_file, file_type, data_file_type;
type per_boot_file, file_type, data_file_type, core_data_file_type;
type uwb_vendor_data_file, file_type, data_file_type, app_data_file_type;

1
legacy/whitechapel_pro/file_contexts
View file

@ -45,7 +45,6 @@
/data/nfc(/.*)? u:object_r:nfc_data_file:s0
/data/vendor/firmware/wifi(/.*)? u:object_r:updated_wifi_firmware_data_file:s0
/data/vendor/tcpdump_logger(/.*)? u:object_r:tcpdump_vendor_data_file:s0
/data/vendor/media(/.*)? u:object_r:vendor_media_data_file:s0
/data/vendor/misc(/.*)? u:object_r:vendor_misc_data_file:s0
/data/per_boot(/.*)? u:object_r:per_boot_file:s0
/data/vendor/sensors/registry(/.*)? u:object_r:sensor_reg_data_file:s0

1
legacy/whitechapel_pro/vndservice.te
View file

@ -1,2 +1 @@
type rls_service, vndservice_manager_type;
type eco_service, vndservice_manager_type;

1
legacy/whitechapel_pro/vndservice_contexts
View file

@ -1,2 +1 @@
rlsservice u:object_r:rls_service:s0
media.ecoservice u:object_r:eco_service:s0

1
vendor/file.te vendored
View file

@ -5,7 +5,6 @@ type persist_camera_file, file_type, vendor_persist_type;
type persist_sensor_reg_file, file_type, vendor_persist_type;
#sysfs
type sysfs_mfc, sysfs_type, fs_type;
type sysfs_power_dump, sysfs_type, fs_type;
type sysfs_acpm_stats, sysfs_type, fs_type;
type sysfs_write_leds, sysfs_type, fs_type;

1
vendor/file_contexts vendored
View file

@ -13,7 +13,6 @@
/vendor/bin/hw/android\.hardware\.secure_element-service.uicc u:object_r:hal_secure_element_uicc_exec:s0
/vendor/bin/hw/android\.hardware\.qorvo\.uwb\.service u:object_r:hal_uwb_vendor_default_exec:s0
/vendor/bin/hw/android\.hardware\.composer\.hwc3-service\.pixel u:object_r:hal_graphics_composer_default_exec:s0
/vendor/bin/hw/samsung\.hardware\.media\.c2@1\.2-service u:object_r:mediacodec_samsung_exec:s0
/vendor/bin/hw/google\.hardware\.media\.c2@2\.0-service u:object_r:mediacodec_google_exec:s0
/vendor/bin/dump/dump_wlan\.sh u:object_r:dump_wlan_exec:s0
/vendor/bin/dump/dump_cma\.sh u:object_r:dump_cma_exec:s0

3
vendor/genfs_contexts vendored
View file

@ -76,9 +76,6 @@ genfscon sysfs /module/drm/parameters/vblankoffdelay
genfscon sysfs /devices/platform/exynos-drm/tui_status u:object_r:sysfs_display:s0
genfscon sysfs /devices/platform/19440000.drmdsim/19440000.drmdsim.0/backlight/panel0-backlight/als_table u:object_r:sysfs_write_leds:s0
# mediacodec_samsung
genfscon sysfs /devices/platform/mfc/video4linux/video u:object_r:sysfs_mfc:s0
# ACPM
genfscon sysfs /devices/platform/acpm_stats u:object_r:sysfs_acpm_stats:s0

37
vendor/mediacodec_samsung.te vendored
View file

@ -1,37 +0,0 @@
type mediacodec_samsung, domain;
type mediacodec_samsung_exec, vendor_file_type, exec_type, file_type;
init_daemon_domain(mediacodec_samsung)
hal_server_domain(mediacodec_samsung, hal_codec2)
add_service(mediacodec_samsung, eco_service)
vndbinder_use(mediacodec_samsung)
allow mediacodec_samsung video_device:chr_file rw_file_perms;
allow mediacodec_samsung dmabuf_system_heap_device:chr_file r_file_perms;
allow mediacodec_samsung gpu_device:chr_file rw_file_perms;
allow mediacodec_samsung sysfs_mfc:file r_file_perms;
allow mediacodec_samsung sysfs_mfc:dir r_dir_perms;
# can use graphics allocator
hal_client_domain(mediacodec_samsung, hal_graphics_allocator)
binder_call(mediacodec_samsung, hal_camera_default)
crash_dump_fallback(mediacodec_samsung)
# mediacodec_samsung should never execute any executable without a domain transition
neverallow mediacodec_samsung { file_type fs_type }:file execute_no_trans;
# Media processing code is inherently risky and thus should have limited
# permissions and be isolated from the rest of the system and network.
# Lengthier explanation here:
# https://android-developers.googleblog.com/2016/05/hardening-media-stack.html
neverallow mediacodec_samsung domain:{ udp_socket rawip_socket } *;
neverallow mediacodec_samsung { domain userdebug_or_eng(`-su') }:tcp_socket *;
userdebug_or_eng(`
allow mediacodec_samsung vendor_media_data_file:dir rw_dir_perms;
allow mediacodec_samsung vendor_media_data_file:file create_file_perms;
')