Evolution-X-Tensor/device_google_zuma
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

mediacodec_samsung: add sepolicy for mfc codec

Browse source 
Add necessary sepolicy. Log and reason are added in review comment
move sysfs out from legacy setting

Bug: 262633502
Bug: 263049105
Bug: 262794577
Bug: 262794578
Bug: 262794634
Test: video playback
      SELinuxTest#scanBugreport
      SELinuxTest#scanAvcDeniedLogRightAfterReboot
Change-Id: I240f3fc4672a0d3133699f76a808573e172d23f2
This commit is contained in:
Ernie Hsu 2022-12-20 02:55:07 +00:00
parent 2682fc7fc4
commit bb7586ac03
7 changed files with 30 additions and 33 deletions
Download patch file Download diff file Expand all files Collapse all files

1
legacy/whitechapel_pro/file.te
View file

@ -26,7 +26,6 @@ type sysfs_exynos_bts_stats, sysfs_type, fs_type;
type sysfs_bcmdhd, sysfs_type, fs_type;
type sysfs_wlc, sysfs_type, fs_type;
type sysfs_chargelevel, sysfs_type, fs_type;
type sysfs_mfc, sysfs_type, fs_type;
type sysfs_cpu, sysfs_type, fs_type;
type sysfs_camera, sysfs_type, fs_type;
type sysfs_write_leds, sysfs_type, fs_type;

3
legacy/whitechapel_pro/genfs_contexts
View file

@ -81,9 +81,6 @@ genfscon sysfs /devices/platform/13200000.ufs/pixel/boot_lun_enabled u
# Display
genfscon sysfs /devices/platform/19440000.drmdsim/19440000.drmdsim.0/backlight/panel0-backlight/als_table u:object_r:sysfs_write_leds:s0
# mediacodec_samsung
genfscon sysfs /devices/platform/mfc/video4linux/video u:object_r:sysfs_mfc:s0
# Storage
genfscon proc /fs/f2fs u:object_r:proc_f2fs:s0
genfscon proc /sys/vm/swappiness u:object_r:proc_dirty:s0

1
tracking_denials/dumpstate.te
View file

@ -19,7 +19,6 @@ dontaudit dumpstate system_data_file:dir { read };
dontaudit dumpstate vold:binder { call };
# b/262633248
dontaudit dumpstate mediacodec_google:process { signal };
dontaudit dumpstate mediacodec_samsung:process { signal };
dontaudit dumpstate rild:binder { call };
# b/263048776
dontaudit dumpstate hal_usb_impl:binder { call };

28
tracking_denials/mediacodec_samsung.te
View file

@ -1,28 +0,0 @@
# b/262633502
dontaudit mediacodec_samsung tombstoned:unix_stream_socket { connectto };
dontaudit mediacodec_samsung tombstoned_crash_socket:sock_file { write };
# b/262794634
dontaudit mediacodec_samsung dmabuf_system_heap_device:chr_file { getattr };
dontaudit mediacodec_samsung eco_service:service_manager { add };
dontaudit mediacodec_samsung hwservicemanager:binder { call };
dontaudit mediacodec_samsung hwservicemanager:binder { transfer };
dontaudit mediacodec_samsung hwservicemanager_prop:file { getattr };
dontaudit mediacodec_samsung hwservicemanager_prop:file { map };
dontaudit mediacodec_samsung hwservicemanager_prop:file { open };
dontaudit mediacodec_samsung hwservicemanager_prop:file { read };
dontaudit mediacodec_samsung appdomain:binder { transfer };
dontaudit mediacodec_samsung mediaserver:binder { transfer };
dontaudit mediacodec_samsung mediaswcodec:binder { transfer };
dontaudit mediacodec_samsung platform_app:binder { transfer };
dontaudit mediacodec_samsung system_server:binder { transfer };
dontaudit mediacodec_samsung vndbinder_device:chr_file { ioctl };
dontaudit mediacodec_samsung vndbinder_device:chr_file { map };
dontaudit mediacodec_samsung vndbinder_device:chr_file { open };
dontaudit mediacodec_samsung vndbinder_device:chr_file { read };
dontaudit mediacodec_samsung vndbinder_device:chr_file { write };
dontaudit mediacodec_samsung vndservicemanager:binder { call };
dontaudit mediacodec_samsung vndservicemanager:binder { transfer };
# b/263049105
dontaudit mediacodec_samsung dumpstate:fd { use };
dontaudit mediacodec_samsung dumpstate:fifo_file { append };
dontaudit mediacodec_samsung dumpstate:fifo_file { write };

3
vendor/file.te vendored
View file

@ -1,2 +1,5 @@
# persist
type persist_display_file, file_type, vendor_persist_type;
#sysfs
type sysfs_mfc, sysfs_type, fs_type;

3
vendor/genfs_contexts vendored
View file

@ -36,6 +36,9 @@ genfscon sysfs /devices/platform/19470000.drmdecon/dqe0/atc
genfscon sysfs /module/drm/parameters/vblankoffdelay u:object_r:sysfs_display:s0
genfscon sysfs /devices/platform/exynos-drm/tui_status u:object_r:sysfs_display:s0
# mediacodec_samsung
genfscon sysfs /devices/platform/mfc/video4linux/video u:object_r:sysfs_mfc:s0
# wake up nodes
genfscon sysfs /devices/platform/10c80000.hsi2c/i2c-0/6-0008/wakeup/wakeup u:object_r:sysfs_wakeup:s0
genfscon sysfs /devices/platform/10c90000.hsi2c/i2c-0/7-003c/power_supply/wireless/wakeup u:object_r:sysfs_wakeup:s0

24
vendor/mediacodec_samsung.te vendored
View file

@ -2,6 +2,25 @@ type mediacodec_samsung, domain;
type mediacodec_samsung_exec, vendor_file_type, exec_type, file_type;
init_daemon_domain(mediacodec_samsung)
hal_server_domain(mediacodec_samsung, hal_codec2)
add_service(mediacodec_samsung, eco_service)
vndbinder_use(mediacodec_samsung)
allow mediacodec_samsung video_device:chr_file rw_file_perms;
allow mediacodec_samsung dmabuf_system_heap_device:chr_file r_file_perms;
allow mediacodec_samsung gpu_device:chr_file rw_file_perms;
allow mediacodec_samsung sysfs_mfc:file r_file_perms;
allow mediacodec_samsung sysfs_mfc:dir r_dir_perms;
# can use graphics allocator
hal_client_domain(mediacodec_samsung, hal_graphics_allocator)
binder_call(mediacodec_samsung, hal_camera_default)
crash_dump_fallback(mediacodec_samsung)
# mediacodec_samsung should never execute any executable without a domain transition
neverallow mediacodec_samsung { file_type fs_type }:file execute_no_trans;
@ -11,3 +30,8 @@ neverallow mediacodec_samsung { file_type fs_type }:file execute_no_trans;
# https://android-developers.googleblog.com/2016/05/hardening-media-stack.html
neverallow mediacodec_samsung domain:{ udp_socket rawip_socket } *;
neverallow mediacodec_samsung { domain userdebug_or_eng(`-su') }:tcp_socket *;
userdebug_or_eng(`
allow mediacodec_samsung vendor_media_data_file:dir rw_dir_perms;
allow mediacodec_samsung vendor_media_data_file:file create_file_perms;
')