Evolution-X-Tensor/device_google_zuma
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Mark video secure devices as default dmabuf heaps

Browse source 
Mali driver (and codec HAL as well) require direct access to video
secure dmabuf devices. Mali driver being an SP-HAL cannot explicitly
write blanket rules for all the scontext. So, we piggyback on
dmabuf_system_secure_heap_device to allow all scontext to be able to use
these device nodes.

This is just as secure as dmabuf_system_secure_heap_device in that case.
There is no additional security impact. An app can still use gralloc to
allocate buffers from these heaps and disallowing access to these heaps
to the intended users.

Fix: 278823239
Fix: 278513588
Fix: 275646321
Test: dEQP-VK.memory.allocation
Change-Id: I01a2730fc222efe94d4e48e7ee4c317aa65f0064
This commit is contained in:
Ankit Goyal 2023-04-19 11:34:27 -07:00
parent c1f8b7a872
commit ded9266dd4
3 changed files with 7 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

3
vendor/device.te vendored
View file

@ -12,7 +12,8 @@ type uci_device, dev_type;
# Dmabuf heaps
type sensor_direct_heap_device, dmabuf_heap_device_type, dev_type;
type faceauth_heap_device, dmabuf_heap_device_type, dev_type;
type video_secure_heap_device, dmabuf_heap_device_type, dev_type;
type vscaler_secure_heap_device, dmabuf_heap_device_type, dev_type;
type framebuffer_secure_heap_device, dmabuf_heap_device_type, dev_type;
# SecureElement SPI device
type st54spi_device, dev_type;

6
vendor/file_contexts vendored
View file

@ -164,8 +164,8 @@
/dev/dma_heap/famodel-secure u:object_r:faceauth_heap_device:s0
/dev/dma_heap/faprev-secure u:object_r:faceauth_heap_device:s0
/dev/dma_heap/farawimg-secure u:object_r:faceauth_heap_device:s0
/dev/dma_heap/framebuffer-secure u:object_r:video_secure_heap_device:s0
/dev/dma_heap/vframe-secure u:object_r:video_secure_heap_device:s0
/dev/dma_heap/vscaler-secure u:object_r:video_secure_heap_device:s0
/dev/dma_heap/framebuffer-secure u:object_r:framebuffer_secure_heap_device:s0
/dev/dma_heap/vframe-secure u:object_r:dmabuf_system_secure_heap_device:s0
/dev/dma_heap/vscaler-secure u:object_r:vscaler_secure_heap_device:s0
/dev/dma_heap/vstream-secure u:object_r:dmabuf_system_secure_heap_device:s0
/dev/uci u:object_r:uci_device:s0

3
vendor/hal_graphics_allocator_default.te vendored
View file

@ -1,4 +1,5 @@
allow hal_graphics_allocator_default sensor_direct_heap_device:chr_file r_file_perms;
allow hal_graphics_allocator_default faceauth_heap_device:chr_file r_file_perms;
allow hal_graphics_allocator_default dmabuf_system_secure_heap_device:chr_file r_file_perms;
allow hal_graphics_allocator_default video_secure_heap_device:chr_file r_file_perms;
allow hal_graphics_allocator_default vscaler_secure_heap_device:chr_file r_file_perms;
allow hal_graphics_allocator_default framebuffer_secure_heap_device:chr_file r_file_perms;