Evolution-X-Tensor/device_google_zumapro
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Android 15.0.0 Release 6 (AP4A.241205.013)

Browse source 
-----BEGIN PGP SIGNATURE-----
 
 iF0EABECAB0WIQRDQNE1cO+UXoOBCWTorT+BmrEOeAUCZ1IssQAKCRDorT+BmrEO
 eKA7AJwJzAEjJsFAnNBunzzVHwfc6k7TkwCfc/FFP5sw/Z4oEgjDPAjjxMk00lw=
 =P00m
 -----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
 
 iQJLBAABCgA1FiEEHrBYPudH862glXQBzJUERRm+ZmkFAmdY7dcXHG1rYmVzdGFz
 QGxpbmVhZ2Vvcy5vcmcACgkQzJUERRm+ZmnQIg//RsMCsX8EXfSwirFmHcLqUgRl
 zr4r71c+SJderH03ME18EOtbsagw8MwPpV/U03cfE1AvKwv2UF0QhbkHyLn33YGm
 4LAgG5WTaETGYrZf9hBxAA8SAokhYIsHyfSJ+wwJtGOf02QPlIamPZKS8mLsedCF
 oXFmuwqnIdzGAi8AvNWCZDejrgkUXyK8DVQ06C3+DDljvcuxWve0c2kBNA4xvoeE
 j2XKqK+DBX+IholRFaKAgtkN1wgreqaGPqK/j6KlAnIpTeeRLsTl/CRjE9Ir3idJ
 9M2u11I0XSnJ4pP8JiY7JF2x+Wf5khIjB6sZgy754QnRbT71PZWRpypZIG69/rh5
 2EWNBHBzQrodSIZoF7M5YnbrAiqVUFxeu5Z7eNaEMQborHKTve3GcG/GRt25AIxZ
 WLnyNZFbziGtkV5R4tM3N9NQZ6Uz3tmDgVzBhGZK2c7loKSUfEp5G+LwtyvqQvmC
 FuFKB1T7FTdDnr4cdJlAQ8gQOFq/P3ax1UnFNQrBSlgRG3T8Q83nphQYGMChyXc9
 sp19jDw+B0JzGhfLQ53AJ60Al4wnUp+6eyVtiYgyM5zYnpLZsbVO1WqcjmwPJSo9
 wxNlsUu1Qy85o0y74kAC307sjgyK6b+bRaib8nehfwsDn2OZcC356rOe6NGoPhOZ
 tQ338qQThGg6Ludofns=
 =lZku
 -----END PGP SIGNATURE-----

Merge tag 'android-15.0.0_r6' into staging/lineage-22.0_merge-android-15.0.0_r6

Android 15.0.0 Release 6 (AP4A.241205.013)

# -----BEGIN PGP SIGNATURE-----
#
# iF0EABECAB0WIQRDQNE1cO+UXoOBCWTorT+BmrEOeAUCZ1IssQAKCRDorT+BmrEO
# eKA7AJwJzAEjJsFAnNBunzzVHwfc6k7TkwCfc/FFP5sw/Z4oEgjDPAjjxMk00lw=
# =P00m
# -----END PGP SIGNATURE-----
# gpg: Signature made Fri Dec  6 00:44:01 2024 EET
# gpg:                using DSA key 4340D13570EF945E83810964E8AD3F819AB10E78
# gpg: Good signature from "The Android Open Source Project <initial-contribution@android.com>" [marginal]
# gpg: initial-contribution@android.com: Verified 2483 signatures in the past
#      3 years.  Encrypted 4 messages in the past 2 years.
# gpg: WARNING: This key is not certified with sufficiently trusted signatures!
# gpg:          It is not certain that the signature belongs to the owner.
# Primary key fingerprint: 4340 D135 70EF 945E 8381  0964 E8AD 3F81 9AB1 0E78

# By Wilson Sung (5) and others
# Via Android Build Coastguard Worker (38) and others
* tag 'android-15.0.0_r6': (52 commits)
  Make android.framework.stats-v2-ndk app reachable
  Allow fingerprint to access /dev/fth_fd
  Update SELinux error
  Change vendor_fingerprint_prop to vendor_restricted_prop
  Update SELinux error
  Move euiccpixel_app to vendor
  Allow systemui_app to set 'debug.tracing.desktop_mode_visible_tasks' system property
  storage: move storage related device type to common folder
  Move sepolicy about hal_radioext_default to gs-common
  Allow fingerprint to access sysfs_lhbm
  Update SELinux error
  Update sepolicy for nfc antenna selftest values
  Revert^2 "modem_svc: update sepolicy for UMI"
  Revert "modem_svc: update sepolicy for UMI"
  Update SELinux error
  modem_svc: update sepolicy for UMI
  fix bipchmgr sepolicy
  Label sysfs node power_mode as sysfs_display.
  Label frame_interval and expected_present_time as sysfs_display
  Grant the MDS assess the OemRil service AIDL interface.
  ...

 Conflicts:
	sepolicy/radio/radio.te
	sepolicy/tracking_denials/keys.conf
	sepolicy/vendor/genfs_contexts

Change-Id: I5bc554da77b3317f17a838508e87c7fe84f14191
This commit is contained in:
Michael Bestas 2024-12-11 03:41:42 +02:00
commit 987c1bf308
52 changed files with 177 additions and 66 deletions
Download patch file Download diff file Expand all files Collapse all files

6
sepolicy/legacy/zuma/vendor/device.te vendored
View file

@ -1,7 +1,6 @@
type persist_block_device, dev_type;
# device.te
type custom_ab_block_device, dev_type;
type mfg_data_block_device, dev_type;
type ufs_internal_block_device, dev_type;
type logbuffer_device, dev_type;
type fingerprint_device, dev_type;
type uci_device, dev_type;
@ -12,6 +11,3 @@ type faceauth_heap_device, dmabuf_heap_device_type, dev_type;
type vscaler_secure_heap_device, dmabuf_heap_device_type, dev_type;
type framebuffer_secure_heap_device, dmabuf_heap_device_type, dev_type;
type gcma_camera_heap_device, dmabuf_heap_device_type, dev_type;
# SecureElement SPI device
type st54spi_device, dev_type;

3
sepolicy/legacy/zuma/vendor/hal_bluetooth_btlinux.te vendored
View file

@ -7,3 +7,6 @@ allow hal_bluetooth_btlinux vendor_bt_data_file:file create_file_perms;
# allow the HAL to call cccdktimesync registered callbacks
binder_call(hal_bluetooth_btlinux, vendor_cccdktimesync_app)
# Allow access for AoC properties.
get_prop(hal_bluetooth_btlinux, vendor_aoc_prop)

4
sepolicy/legacy/zuma/vendor/hal_nfc_default.te vendored
View file

@ -1,5 +1,7 @@
# HAL NFC property
get_prop(hal_nfc_default, vendor_nfc_prop)
set_prop(hal_nfc_default, vendor_nfc_prop)
set_prop(hal_nfc_default, vendor_nfc_antenna_prop)
get_prop(untrusted_app, vendor_nfc_antenna_prop)
# SecureElement property
set_prop(hal_nfc_default, vendor_secure_element_prop)

3
sepolicy/legacy/zuma/vendor/hal_power_default.te vendored
View file

@ -4,4 +4,5 @@ allow hal_power_default sysfs_camera:file rw_file_perms;
allow hal_power_default sysfs_em_profile:file rw_file_perms;
allow hal_power_default sysfs_display:file rw_file_perms;
allow hal_power_default sysfs_trusty:file rw_file_perms;
set_prop(hal_power_default, vendor_camera_prop);
set_prop(hal_power_default, vendor_camera_prop);
allow hal_power_default sysfs_vendor_mm:file rw_file_perms;

1
sepolicy/legacy/zuma/vendor/hal_radioext_default.te vendored
View file

@ -1 +0,0 @@
allow hal_radioext_default sysfs_display:file rw_file_perms;

2
sepolicy/legacy/zuma/vendor/hal_secure_element_uicc.te vendored
View file

@ -10,3 +10,5 @@ crash_dump_fallback(hal_secure_element_uicc)
# Allow hal_secure_element_uicc to access rild
binder_call(hal_secure_element_uicc, rild);
allow hal_secure_element_uicc hal_exynos_rild_hwservice:hwservice_manager find;
allow hal_secure_element_uicc hal_vendor_radio_external_service:service_manager find;
binder_call(hal_secure_element_uicc, servicemanager)

2
sepolicy/legacy/zuma/vendor/twoshay.te vendored
View file

@ -1,4 +1,2 @@
# Allow ITouchContextService callback
binder_call(twoshay, systemui_app)
binder_call(twoshay, hal_radioext_default)

5
sepolicy/legacy/zuma/vendor/ufs_firmware_update.te vendored
View file

@ -1,6 +1,4 @@
type ufs_firmware_update, domain;
type ufs_firmware_update_exec, vendor_file_type, exec_type, file_type;
# ufs ffu
userdebug_or_eng(`
init_daemon_domain(ufs_firmware_update)
@ -10,3 +8,4 @@ userdebug_or_eng(`
allow ufs_firmware_update sysfs:dir r_dir_perms;
allow ufs_firmware_update sysfs_scsi_devices_0000:file r_file_perms;
')

3
sepolicy/radio/bipchmgr.te
View file

@ -7,3 +7,6 @@ get_prop(bipchmgr, hwservicemanager_prop);
allow bipchmgr hal_exynos_rild_hwservice:hwservice_manager find;
hwbinder_use(bipchmgr)
binder_call(bipchmgr, rild)
allow bipchmgr hal_vendor_radio_external_service:service_manager find;
binder_call(bipchmgr, servicemanager)
binder_use(bipchmgr)

4
sepolicy/radio/device.te
View file

@ -1,3 +1,3 @@
# radio
type modem_block_device, dev_type;
type modem_userdata_block_device, dev_type;
type efs_block_device, dev_type;

3
sepolicy/radio/dmd.te
View file

@ -30,4 +30,5 @@ binder_call(dmd, hwservicemanager)
binder_call(dmd, modem_diagnostic_app)
binder_call(dmd, modem_logging_control)
binder_call(dmd, vendor_telephony_silentlogging_app)
binder_call(dmd, liboemservice_proxy_default)
add_service(dmd, hal_vendor_modem_logging_service)
binder_call(dmd, servicemanager)

1
sepolicy/radio/file_contexts
View file

@ -9,7 +9,6 @@
/vendor/bin/modem_ml_svc_sit u:object_r:modem_ml_svc_sit_exec:s0
/vendor/bin/cbd u:object_r:cbd_exec:s0
/vendor/bin/hw/rild_exynos u:object_r:rild_exec:s0
/vendor/bin/hw/vendor\.google\.radioext@1\.0-service u:object_r:hal_radioext_default_exec:s0
/vendor/bin/liboemservice_proxy_default u:object_r:liboemservice_proxy_default_exec:s0
/vendor/bin/shared_modem_platform u:object_r:modem_svc_sit_exec:s0

6
sepolicy/radio/grilservice_app.te
View file

@ -1,3 +1,4 @@
# for grilservice_app domain
type grilservice_app, domain;
app_domain(grilservice_app)
@ -12,8 +13,8 @@ allow grilservice_app hal_exynos_rild_hwservice:hwservice_manager find;
allow grilservice_app radio_vendor_data_file:dir create_dir_perms;
allow grilservice_app radio_vendor_data_file:file create_file_perms;
allow grilservice_app gril_antenna_tuning_service:service_manager find;
allow grilservice_app hal_vendor_radio_external_service:service_manager find;
binder_call(grilservice_app, hal_bluetooth_btlinux)
binder_call(grilservice_app, hal_radioext_default)
binder_call(grilservice_app, hal_wifi_ext)
binder_call(grilservice_app, hal_audiometricext_default)
binder_call(grilservice_app, rild)
@ -22,3 +23,6 @@ hal_client_domain(grilservice_app, hal_power_stats)
allow grilservice_app sysfs_irq:dir r_dir_perms;
allow grilservice_app sysfs_irq:file r_file_perms;
get_prop(grilservice_app, telephony_modemtype_prop)
# Set modem logging properties
set_prop(grilservice_app, vendor_logger_prop)
set_prop(grilservice_app, vendor_modem_prop)

24
sepolicy/radio/hal_radioext_default.te
View file

@ -1,24 +0,0 @@
type hal_radioext_default, domain;
type hal_radioext_default_exec, vendor_file_type, exec_type, file_type;
init_daemon_domain(hal_radioext_default)
hwbinder_use(hal_radioext_default)
get_prop(hal_radioext_default, hwservicemanager_prop)
get_prop(hal_radioext_default, telephony_modemtype_prop)
set_prop(hal_radioext_default, vendor_gril_prop)
add_hwservice(hal_radioext_default, hal_radioext_hwservice)
binder_call(hal_radioext_default, servicemanager)
binder_call(hal_radioext_default, grilservice_app)
binder_call(hal_radioext_default, hal_bluetooth_btlinux)
# RW /dev/oem_ipc0
allow hal_radioext_default radio_device:chr_file rw_file_perms;
# RW MIPI Freq files
allow hal_radioext_default radio_vendor_data_file:dir create_dir_perms;
allow hal_radioext_default radio_vendor_data_file:file create_file_perms;
# Bluetooth
allow hal_radioext_default hal_bluetooth_coexistence_hwservice:hwservice_manager find;
allow hal_radioext_default hal_bluetooth_coexistence_service:service_manager find;

3
sepolicy/radio/hwservice_contexts
View file

@ -3,6 +3,3 @@ vendor.samsung_slsi.telephony.hardware.oemservice::IOemService
# rild HAL
vendor.samsung_slsi.telephony.hardware.radioExternal::IOemSlsiRadioExternal u:object_r:hal_exynos_rild_hwservice:s0
# GRIL HAL
vendor.google.radioext::IRadioExt u:object_r:hal_radioext_hwservice:s0

1
sepolicy/radio/modem_diagnostic_app.te
View file

@ -11,6 +11,7 @@ userdebug_or_eng(`
hal_client_domain(modem_diagnostic_app, hal_power_stats);
allow modem_diagnostic_app hal_vendor_radio_external_service:service_manager find;
allow modem_diagnostic_app hal_exynos_rild_hwservice:hwservice_manager find;
binder_call(modem_diagnostic_app, rild)

6
sepolicy/radio/modem_svc_sit.te
View file

@ -48,3 +48,9 @@ perfetto_producer(modem_svc_sit)
allow modem_svc_sit modem_img_file:dir r_dir_perms;
allow modem_svc_sit modem_img_file:file r_file_perms;
allow modem_svc_sit modem_img_file:lnk_file r_file_perms;
# Allow modem_svc_sit to access socket for UMI
userdebug_or_eng(`
allow modem_svc_sit radio_vendor_data_file:sock_file { create unlink };
')

3
sepolicy/radio/oemrilservice_app.te
View file

@ -7,3 +7,6 @@ allow oemrilservice_app radio_service:service_manager find;
binder_call(oemrilservice_app, rild)
set_prop(oemrilservice_app, vendor_rild_prop)
allow oemrilservice_app hal_vendor_radio_external_service:service_manager find;
binder_call(oemrilservice_app, servicemanager)

2
sepolicy/radio/radio.te
View file

@ -8,3 +8,5 @@ allow radio vendor_ims_app:udp_socket { getattr read write setopt shutdown };
allow radio aoc_device:chr_file rw_file_perms;
allow radio scheduling_policy_service:service_manager find;
allow radio hal_exynos_rild_hwservice:hwservice_manager find;
allow radio hal_vendor_radio_external_service:service_manager find;
binder_call(radio, servicemanager)

1
sepolicy/radio/rild.te
View file

@ -37,6 +37,7 @@ crash_dump_fallback(rild)
# for hal service
add_hwservice(rild, hal_exynos_rild_hwservice)
add_service(rild, hal_vendor_radio_external_service)
# Allow rild to access files on modem img.
allow rild modem_img_file:dir r_dir_perms;

2
sepolicy/radio/sced.te
View file

@ -20,4 +20,6 @@ userdebug_or_eng(`
allow sced vendor_slog_file:file create_file_perms;
allow sced hidl_base_hwservice:hwservice_manager add;
allow sced hal_vendor_oem_hwservice:hwservice_manager { add find };
add_service(sced, hal_vendor_tcpdump_service)
binder_call(sced, servicemanager)
')

6
sepolicy/radio/service.te
View file

@ -1,2 +1,6 @@
# Define liboemservice_proxy_service.
type liboemservice_proxy_service, hal_service_type, service_manager_type;
type liboemservice_proxy_service, hal_service_type, service_manager_type;
type hal_vendor_radio_external_service, hal_service_type, protected_service, service_manager_type;
type hal_vendor_modem_logging_service, hal_service_type, protected_service, service_manager_type;
type hal_vendor_tcpdump_service, hal_service_type, protected_service, service_manager_type;

6
sepolicy/radio/service_contexts
View file

@ -1,2 +1,6 @@
# DMD oemservice aidl proxy.
com.google.pixel.modem.logmasklibrary.ILiboemserviceProxy/default u:object_r:liboemservice_proxy_service:s0
com.google.pixel.modem.logmasklibrary.ILiboemserviceProxy/default u:object_r:liboemservice_proxy_service:s0
vendor.samsung_slsi.telephony.hardware.radioExternal.IOemSlsiRadioExternal/default u:object_r:hal_vendor_radio_external_service:s0
vendor.samsung_slsi.telephony.hardware.oemservice.IOemService/dm0 u:object_r:hal_vendor_modem_logging_service:s0
vendor.samsung_slsi.telephony.hardware.oemservice.IOemService/dm1 u:object_r:hal_vendor_modem_logging_service:s0
vendor.samsung_slsi.telephony.hardware.oemservice.IOemService/sced0 u:object_r:hal_vendor_tcpdump_service:s0

2
sepolicy/radio/vendor_engineermode_app.te
View file

@ -5,6 +5,8 @@ binder_call(vendor_engineermode_app, rild)
allow vendor_engineermode_app app_api_service:service_manager find;
allow vendor_engineermode_app hal_exynos_rild_hwservice:hwservice_manager find;
allow vendor_engineermode_app hal_vendor_radio_external_service:service_manager find;
binder_call(vendor_engineermode_app, servicemanager)
userdebug_or_eng(`
dontaudit vendor_engineermode_app default_prop:file r_file_perms;

2
sepolicy/radio/vendor_ims_app.te
View file

@ -21,3 +21,5 @@ get_prop(vendor_ims_app, vendor_imssvc_prop)
userdebug_or_eng(`
get_prop(vendor_ims_app, vendor_ims_tiss_prop)
')
allow vendor_ims_app hal_vendor_radio_external_service:service_manager find;
binder_call(vendor_ims_app, servicemanager)

1
sepolicy/radio/vendor_rcs_app.te
View file

@ -5,5 +5,6 @@ net_domain(vendor_rcs_app)
allow vendor_rcs_app app_api_service:service_manager find;
allow vendor_rcs_app radio_service:service_manager find;
allow vendor_rcs_app hal_exynos_rild_hwservice:hwservice_manager find;
allow vendor_rcs_app hal_vendor_radio_external_service:service_manager find;
binder_call(vendor_rcs_app, rild)

4
sepolicy/radio/vendor_satellite_service.te
View file

@ -3,4 +3,6 @@ type vendor_satellite_service, domain;
app_domain(vendor_satellite_service);
allow vendor_satellite_service app_api_service:service_manager find;
allow vendor_satellite_service hal_exynos_rild_hwservice:hwservice_manager find;
binder_call(vendor_satellite_service, rild)
binder_call(vendor_satellite_service, rild)
allow vendor_satellite_service hal_vendor_radio_external_service:service_manager find;
binder_call(vendor_satellite_service, servicemanager)

3
sepolicy/radio/vendor_telephony_debug_app.te
View file

@ -9,6 +9,9 @@ binder_call(vendor_telephony_debug_app, rild)
# RIL property
set_prop(vendor_telephony_debug_app, vendor_rild_prop)
allow vendor_telephony_debug_app hal_vendor_radio_external_service:service_manager find;
binder_call(vendor_telephony_debug_app, servicemanager)
# Debug property
set_prop(vendor_telephony_debug_app, vendor_telephony_app_prop)

2
sepolicy/radio/vendor_telephony_silentlogging_app.te
View file

@ -11,6 +11,8 @@ allow vendor_telephony_silentlogging_app app_api_service:service_manager find;
allow vendor_telephony_silentlogging_app hal_vendor_oem_hwservice:hwservice_manager find;
binder_call(vendor_telephony_silentlogging_app, dmd)
binder_call(vendor_telephony_silentlogging_app, sced)
allow vendor_telephony_silentlogging_app hal_vendor_modem_logging_service:service_manager find;
binder_call(vendor_telephony_silentlogging_app, servicemanager)
userdebug_or_eng(`
# Silent Logging

2
sepolicy/system_ext/private/systemui_app.te
View file

@ -1,3 +1,4 @@
# SEPolicy for System UI
typeattribute systemui_app coredomain;
app_domain(systemui_app)
allow systemui_app app_api_service:service_manager find;
@ -26,3 +27,4 @@ userdebug_or_eng(`
allow systemui_app wm_trace_data_file:file create_file_perms;
')
set_prop(systemui_app, debug_tracing_desktop_mode_visible_tasks_prop)

25
sepolicy/tracking_denials/bug_map
View file

@ -1,14 +1,33 @@
dump_display sysfs file b/322917055
dumpstate image_processing_hal binder b/322916328
dumpstate image_processing_server binder b/322916328
dump_modem sscoredump_vendor_data_coredump_file dir b/361726331
dump_modem sscoredump_vendor_data_logcat_file dir b/361726331
grilservice_app default_android_service service_manager b/366116096
hal_audio_default fwk_stats_service service_manager b/340369535
hal_audio_default traced_producer_socket sock_file b/340369535
hal_bluetooth_btlinux vendor_aoc_prop file b/353262026
hal_bluetooth_btlinux vendor_default_prop property_service b/350830390
hal_bluetooth_btlinux vendor_default_prop property_service b/350830756
hal_bluetooth_btlinux vendor_default_prop property_service b/350830758
hal_gnss_default vendor_gps_prop file b/318310869
hal_power_default hal_power_default capability b/350830411
hal_wlcservice default_prop file b/350830657
hal_wlcservice default_prop file b/350830879
incidentd incidentd anon_inode b/322917075
kernel sepolicy_file file b/353418189
kernel system_bootstrap_lib_file dir b/353418189
kernel system_bootstrap_lib_file file b/353418189
kernel system_dlkm_file dir b/353418189
modem_svc_sit hal_radioext_default process b/368187536
modem_svc_sit hal_radioext_default process b/368188020
modem_svc_sit modem_ml_svc_sit file b/360060680
modem_svc_sit modem_ml_svc_sit file b/360060705
sctd sctd tcp_socket b/309550514
sctd swcnd unix_stream_socket b/309550514
sctd vendor_persist_config_default_prop file b/309550514
shell sysfs_net file b/338347525
spad spad unix_stream_socket b/309550905
swcnd swcnd unix_stream_socket b/309551062
shell sysfs_net file b/338347525
system_suspend sysfs_touch_gti dir b/350830429
system_suspend sysfs_touch_gti dir b/350830680
system_suspend sysfs_touch_gti dir b/350830796

2
sepolicy/tracking_denials/hal_radioext_default.te
View file

@ -1,2 +0,0 @@
# b/315105050
dontaudit hal_radioext_default radio_vendor_data_file:file { ioctl };

2
sepolicy/tracking_denials/keys.conf
View file

@ -10,5 +10,3 @@ ALL : device/google/zumapro/sepolicy/tracking_denials/certs/camera_fishfood.x509
[@CAMERASERVICES]
ALL : device/google/zumapro/sepolicy/tracking_denials/certs/com_google_android_apps_camera_services.x509.pem
[@EUICCSUPPORTPIXEL]
ALL : device/google/zumapro/sepolicy/tracking_denials/certs/EuiccSupportPixel.x509.pem

3
sepolicy/tracking_denials/mac_permissions.xml
View file

@ -33,7 +33,4 @@
<signer signature="@CAMERASERVICES" >
<seinfo value="CameraServices" />
</signer>
<signer signature="@EUICCSUPPORTPIXEL" >
<seinfo value="EuiccSupportPixel" />
</signer>
</policy>

1
sepolicy/tracking_denials/property.te
View file

@ -1,6 +1,7 @@
# b/314065301
vendor_internal_prop(vendor_nfc_prop)
vendor_restricted_prop(vendor_nfc_antenna_prop)
vendor_internal_prop(vendor_battery_profile_prop)
vendor_internal_prop(vendor_camera_fatp_prop)
vendor_internal_prop(vendor_display_prop)

3
sepolicy/tracking_denials/seapp_contexts
View file

@ -1,6 +1,3 @@
# Domain for EuiccSupportPixel
user=_app isPrivApp=true seinfo=EuiccSupportPixel name=com.google.euiccpixel domain=euiccpixel_app type=app_data_file levelFrom=all
# Domain for connectivity monitor
user=_app isPrivApp=true seinfo=platform name=com.google.android.connectivitymonitor domain=con_monitor_app type=app_data_file levelFrom=all

0
sepolicy/tracking_denials/certs/EuiccSupportPixel.x509.pem → sepolicy/vendor/certs/EuiccSupportPixel.x509.pem vendored
View file

4
sepolicy/vendor/device.te vendored
View file

@ -1,4 +1,8 @@
# Device types
type lwis_device, dev_type;
type tee_persist_block_device, dev_type;
type tee_userdata_block_device, dev_type;
type hw_jpg_device, dev_type, mlstrustedobject;
# SecureElement SPI device
type st54spi_device, dev_type;

3
sepolicy/legacy/zuma/vendor/euiccpixel_app.te → sepolicy/vendor/euiccpixel_app.te vendored
View file

@ -1,3 +1,4 @@
# Euiccpixel_app
type euiccpixel_app, domain;
app_domain(euiccpixel_app)
@ -18,4 +19,4 @@ userdebug_or_eng(`
')
# b/265286368 framework UI rendering properties
dontaudit euiccpixel_app default_prop:file { read };
dontaudit euiccpixel_app default_prop:file { read };

1
sepolicy/vendor/file.te vendored
View file

@ -17,6 +17,7 @@ type sysfs_write_leds, sysfs_type, fs_type;
type sysfs_fabric, sysfs_type, fs_type;
type sysfs_em_profile, sysfs_type, fs_type;
type sysfs_ospm, sysfs_type, fs_type;
type sysfs_lhbm, sysfs_type, fs_type;
# debugfs
type vendor_regmap_debugfs, fs_type, debugfs_type;

3
sepolicy/vendor/file_contexts vendored
View file

@ -24,7 +24,6 @@
/vendor/bin/chre u:object_r:chre_exec:s0
/vendor/bin/hw/android\.hardware\.security\.keymint-service\.rust\.trusty u:object_r:hal_keymint_default_exec:s0
/vendor/bin/hw/android\.hardware\.security\.secretkeeper\.trusty u:object_r:hal_secretkeeper_default_exec:s0
/vendor/bin/ufs_firmware_update\.sh u:object_r:ufs_firmware_update_exec:s0
/vendor/bin/hw/qfp-daemon u:object_r:hal_fingerprint_default_exec:s0
/vendor/bin/hw/android\.hardware\.biometrics\.fingerprint@2\.1-service\.goodix u:object_r:hal_fingerprint_default_exec:s0
/vendor/bin/hw/android\.hardware\.biometrics\.fingerprint-service\.goodix u:object_r:hal_fingerprint_default_exec:s0
@ -41,6 +40,7 @@
/vendor/lib64/libhwjpeg\.so u:object_r:same_process_hal_file:s0
/vendor/lib64/pixel-power-ext-V1-ndk\.so u:object_r:same_process_hal_file:s0
/vendor/lib64/android\.frameworks\.stats-V1-ndk\.so u:object_r:same_process_hal_file:s0
/vendor/lib64/android\.frameworks\.stats-V2-ndk\.so u:object_r:same_process_hal_file:s0
/vendor/lib64/vendor-pixelatoms-cpp\.so u:object_r:same_process_hal_file:s0
/vendor/lib64/libprotobuf-cpp-lite-(\d+\.){2,3}so u:object_r:same_process_hal_file:s0
/vendor/lib64/libgpudataproducer\.so u:object_r:same_process_hal_file:s0
@ -164,6 +164,7 @@
/dev/qbt_ipc u:object_r:fingerprint_device:s0
/dev/qbt_fd u:object_r:fingerprint_device:s0
/dev/goodix_fp u:object_r:fingerprint_device:s0
/dev/fth_fd u:object_r:fingerprint_device:s0
/dev/video12 u:object_r:hw_jpg_device:s0
# Data

26
sepolicy/vendor/genfs_contexts vendored
View file

@ -29,6 +29,8 @@ genfscon sysfs /devices/platform/10ca0000.hsi2c/i2c-10/10-003b/power_supply
genfscon sysfs /devices/platform/10ca0000.hsi2c/i2c-10/10-0057/power_supply u:object_r:sysfs_batteryinfo:s0
genfscon sysfs /devices/platform/10ca0000.hsi2c/i2c-10/10-0057/registers_dump u:object_r:sysfs_power_dump:s0
genfscon sysfs /devices/platform/10ca0000.hsi2c/i2c-10/10-0050/eeprom u:object_r:sysfs_batteryinfo:s0
genfscon sysfs /devices/platform/10ca0000.hsi2c/i2c-10/10-005b/power_supply u:object_r:sysfs_batteryinfo:s0
genfscon sysfs /devices/platform/10ca0000.hsi2c/i2c-10/10-005b/registers_dump u:object_r:sysfs_batteryinfo:s0
genfscon sysfs /class/power_supply/wireless/device/version u:object_r:sysfs_batteryinfo:s0
genfscon sysfs /class/power_supply/wireless/device/status u:object_r:sysfs_batteryinfo:s0
genfscon sysfs /class/power_supply/wireless/device/fw_rev u:object_r:sysfs_batteryinfo:s0
@ -101,6 +103,9 @@ genfscon sysfs /devices/platform/10ca0000.hsi2c/i2c-10/10-0057/power_supply/dc-m
genfscon sysfs /devices/platform/10ca0000.hsi2c/i2c-10/10-006e/power_supply/dc-mains/wakeup u:object_r:sysfs_wakeup:s0
genfscon sysfs /devices/platform/10cb0000.hsi2c/i2c-11/11-0025/power_supply/usb/power/wakeup u:object_r:sysfs_wakeup:s0
genfscon sysfs /devices/platform/11210000.usb/11210000.dwc3/wakeup u:object_r:sysfs_wakeup:s0
genfscon sysfs /devices/platform/11210000.usb/11210000.dwc3/xhci-hcd-exynos.7.auto/usb1 u:object_r:sysfs_wakeup:s0
genfscon sysfs /devices/platform/11210000.usb/11210000.dwc3/xhci-hcd-exynos.7.auto/usb2 u:object_r:sysfs_wakeup:s0
genfscon sysfs /devices/platform/11210000.usb/11210000.dwc3/xhci-hcd-exynos.7.auto/wakeup u:object_r:sysfs_wakeup:s0
genfscon sysfs /devices/platform/11210000.usb/11210000.dwc3/xhci-hcd-exynos.8.auto/usb1 u:object_r:sysfs_wakeup:s0
genfscon sysfs /devices/platform/11210000.usb/11210000.dwc3/xhci-hcd-exynos.8.auto/usb2 u:object_r:sysfs_wakeup:s0
genfscon sysfs /devices/platform/11210000.usb/11210000.dwc3/xhci-hcd-exynos.8.auto/wakeup u:object_r:sysfs_wakeup:s0
@ -365,6 +370,8 @@ genfscon sysfs /devices/platform/19440000.drmdsim/19440000.drmdsim.0/refresh_ctr
genfscon sysfs /devices/platform/19440000.drmdsim/19440000.drmdsim.0/te_option u:object_r:sysfs_display:s0
genfscon sysfs /devices/platform/19440000.drmdsim/19440000.drmdsim.0/te_rate_hz u:object_r:sysfs_display:s0
genfscon sysfs /devices/platform/19440000.drmdsim/19440000.drmdsim.0/time_in_state u:object_r:sysfs_display:s0
genfscon sysfs /devices/platform/19440000.drmdsim/19440000.drmdsim.0/frame_interval u:object_r:sysfs_display:s0
genfscon sysfs /devices/platform/19440000.drmdsim/19440000.drmdsim.0/expected_present_time u:object_r:sysfs_display:s0
genfscon sysfs /devices/platform/19470000.drmdecon/dqe0/atc u:object_r:sysfs_display:s0
genfscon sysfs /devices/platform/19470000.drmdecon/hibernation u:object_r:sysfs_display:s0
genfscon sysfs /module/drm/parameters/vblankoffdelay u:object_r:sysfs_display:s0
@ -376,18 +383,33 @@ genfscon sysfs /devices/platform/110f0000.drmdp/drm-displayport/dp_hotplug_error
genfscon sysfs /devices/platform/19440000.drmdsim/19440000.drmdsim.0/te2_rate_hz u:object_r:sysfs_display:s0
genfscon sysfs /devices/platform/19440000.drmdsim/19440000.drmdsim.0/te2_option u:object_r:sysfs_display:s0
genfscon sysfs /devices/platform/19440000.drmdsim/19440000.drmdsim.0/frame_rate u:object_r:sysfs_display:s0
genfscon sysfs /devices/platform/19440000.drmdsim/19440000.drmdsim.0/power_mode u:object_r:sysfs_display:s0
genfscon sysfs /devices/platform/110f0000.drmdp/drm-displayport-stats/link_negotiation_failures u:object_r:sysfs_display:s0
genfscon sysfs /devices/platform/110f0000.drmdp/drm-displayport-stats/edid_read_failures u:object_r:sysfs_display:s0
genfscon sysfs /devices/platform/110f0000.drmdp/drm-displayport-stats/dpcd_read_failures u:object_r:sysfs_display:s0
genfscon sysfs /devices/platform/110f0000.drmdp/drm-displayport-stats/fec_dsc_not_supported u:object_r:sysfs_display:s0
genfscon sysfs /devices/platform/110f0000.drmdp/drm-displayport-stats/fec_dsc_supported u:object_r:sysfs_display:s0
genfscon sysfs /devices/platform/110f0000.drmdp/drm-displayport-stats/edid_invalid_failures u:object_r:sysfs_display:s0
genfscon sysfs /devices/platform/110f0000.drmdp/drm-displayport-stats/sink_count_invalid_failures u:object_r:sysfs_display:s0
genfscon sysfs /devices/platform/110f0000.drmdp/drm-displayport-stats/link_unstable_failures u:object_r:sysfs_display:s0
genfscon sysfs /devices/platform/110f0000.drmdp/drm-displayport-stats/max_res_other u:object_r:sysfs_display:s0
genfscon sysfs /devices/platform/110f0000.drmdp/drm-displayport-stats/max_res_1366_768 u:object_r:sysfs_display:s0
genfscon sysfs /devices/platform/110f0000.drmdp/drm-displayport-stats/max_res_1440_900 u:object_r:sysfs_display:s0
genfscon sysfs /devices/platform/110f0000.drmdp/drm-displayport-stats/max_res_1600_900 u:object_r:sysfs_display:s0
genfscon sysfs /devices/platform/110f0000.drmdp/drm-displayport-stats/max_res_1920_1080 u:object_r:sysfs_display:s0
genfscon sysfs /devices/platform/110f0000.drmdp/drm-displayport-stats/max_res_2560_1080 u:object_r:sysfs_display:s0
genfscon sysfs /devices/platform/110f0000.drmdp/drm-displayport-stats/max_res_2560_1440 u:object_r:sysfs_display:s0
genfscon sysfs /devices/platform/110f0000.drmdp/drm-displayport-stats/max_res_3440_1440 u:object_r:sysfs_display:s0
genfscon sysfs /devices/platform/110f0000.drmdp/drm-displayport-stats/max_res_3840_2160 u:object_r:sysfs_display:s0
genfscon sysfs /devices/platform/110f0000.drmdp/drm-displayport-stats/max_res_5120_2880 u:object_r:sysfs_display:s0
genfscon sysfs /devices/platform/110f0000.drmdp/drm-displayport-stats/max_res_7680_4320 u:object_r:sysfs_display:s0
genfscon sysfs /devices/platform/hdcp/hdcp2_success_count u:object_r:sysfs_display:s0
genfscon sysfs /devices/platform/hdcp/hdcp2_fallback_count u:object_r:sysfs_display:s0
genfscon sysfs /devices/platform/hdcp/hdcp2_fail_count u:object_r:sysfs_display:s0
genfscon sysfs /devices/platform/hdcp/hdcp1_success_count u:object_r:sysfs_display:s0
genfscon sysfs /devices/platform/hdcp/hdcp1_fail_count u:object_r:sysfs_display:s0
genfscon sysfs /devices/platform/hdcp/hdcp0_count u:object_r:sysfs_display:s0
genfscon sysfs /devices/platform/19440000.drmdsim/19440000.drmdsim.0/backlight/panel0-backlight/local_hbm_delay_frames u:object_r:sysfs_lhbm:s0
# ACPM
genfscon sysfs /devices/platform/acpm_stats u:object_r:sysfs_acpm_stats:s0
@ -462,3 +484,7 @@ genfscon sysfs /devices/platform/ete7 u:object_r:sysfs_devices_cs_etm:s0
# Privacy LED
genfscon sysfs /devices/platform/pwmleds/leds/green/brightness u:object_r:sysfs_leds:s0
genfscon sysfs /devices/platform/pwmleds/leds/green/max_brightness u:object_r:sysfs_leds:s0
# CPU
genfscon sysfs /kernel/metrics/cpuidle_histogram/cpuidle_histogram u:object_r:sysfs_cpu:s0
genfscon sysfs /kernel/metrics/cpuidle_histogram/cpucluster_histogram u:object_r:sysfs_cpu:s0

2
sepolicy/vendor/hal_camera_default.te vendored
View file

@ -1,3 +1,4 @@
# for hal_camera_default service
allow hal_camera_default self:global_capability_class_set sys_nice;
allow hal_camera_default kernel:process setsched;
@ -73,7 +74,6 @@ allow hal_camera_default sysfs_display:file r_file_perms;
# Allow camera HAL to query preferred camera frequencies from the radio HAL
# extensions to avoid interference with cellular antennas.
allow hal_camera_default hal_radioext_hwservice:hwservice_manager find;
binder_call(hal_camera_default, hal_radioext_default);
# Allows camera HAL to access the hw_jpeg /dev/video12.
allow hal_camera_default hw_jpg_device:chr_file rw_file_perms;

4
sepolicy/vendor/hal_fingerprint_default.te vendored
View file

@ -1,3 +1,4 @@
# SE policies for fingerprint
allow hal_fingerprint_default fingerprint_device:chr_file rw_file_perms;
allow hal_fingerprint_default tee_device:chr_file rw_file_perms;
allow hal_fingerprint_default self:netlink_socket create_socket_perms_no_ioctl;
@ -56,3 +57,6 @@ allow hal_fingerprint_default persist_fingerprint_file:file create_file_perms;
# TODO: b/297562630 - remove unecessary permissions once not needed
allow hal_fingerprint_default vendor_fingerprint_data_file:dir create_dir_perms;
allow hal_fingerprint_default vendor_fingerprint_data_file:file create_file_perms;
# Allow fingerprint to rw lhbm files
allow hal_fingerprint_default sysfs_lhbm:file rw_file_perms;

3
sepolicy/vendor/hal_graphics_composer_default.te vendored
View file

@ -44,6 +44,9 @@ allow hal_graphics_composer_default vendor_log_file:dir search;
# allow HWC to access powerstats
allow hal_graphics_composer_default hal_power_stats_vendor_service:service_manager find;
allow hal_graphics_composer_default thermal_link_device:dir search;
allow hal_graphics_composer_default sysfs_thermal:dir search;
allow hal_graphics_composer_default sysfs_thermal:file r_file_perms;
binder_call(hal_graphics_composer_default, hal_power_stats_default)
# allow HWC to access IStats AIDL

5
sepolicy/vendor/hal_usb_impl.te vendored
View file

@ -26,3 +26,8 @@ allow hal_usb_impl sysfs_usbc_throttling_stats:file r_file_perms;
allow hal_usb_impl device:dir r_dir_perms;
allow hal_usb_impl usb_device:chr_file rw_file_perms;
allow hal_usb_impl usb_device:dir r_dir_perms;
# For monitoring usb sysfs attributes
allow hal_usb_impl sysfs_wakeup:dir search;
allow hal_usb_impl sysfs_wakeup:file r_file_perms;

3
sepolicy/vendor/keys.conf vendored Normal file
View file

@ -0,0 +1,3 @@
[@EUICCSUPPORTPIXEL]
ALL : device/google/zumapro/sepolicy/vendor/certs/EuiccSupportPixel.x509.pem

27
sepolicy/vendor/mac_permissions.xml vendored Normal file
View file

@ -0,0 +1,27 @@
<?xml version="1.0" encoding="utf-8"?>
<policy>
<!--
* A signature is a hex encoded X.509 certificate or a tag defined in
keys.conf and is required for each signer tag.
* A signer tag may contain a seinfo tag and multiple package stanzas.
* A default tag is allowed that can contain policy for all apps not signed with a
previously listed cert. It may not contain any inner package stanzas.
* Each signer/default/package tag is allowed to contain one seinfo tag. This tag
represents additional info that each app can use in setting a SELinux security
context on the eventual process.
* When a package is installed the following logic is used to determine what seinfo
value, if any, is assigned.
- All signatures used to sign the app are checked first.
- If a signer stanza has inner package stanzas, those stanza will be checked
to try and match the package name of the app. If the package name matches
then that seinfo tag is used. If no inner package matches then the outer
seinfo tag is assigned.
- The default tag is consulted last if needed.
-->
<!-- google apps key -->
<signer signature="@EUICCSUPPORTPIXEL" >
<seinfo value="EuiccSupportPixel" />
</signer>
</policy>

3
sepolicy/vendor/property.te vendored
View file

@ -1,3 +1,4 @@
# Vendor property
vendor_internal_prop(vendor_camera_prop)
vendor_internal_prop(vendor_ro_sys_default_prop)
vendor_internal_prop(vendor_persist_sys_default_prop)
@ -10,7 +11,7 @@ vendor_internal_prop(vendor_secure_element_prop)
vendor_internal_prop(vendor_trusty_storage_prop)
# Fingerprint
vendor_internal_prop(vendor_fingerprint_prop)
vendor_restricted_prop(vendor_fingerprint_prop)
# Battery
vendor_internal_prop(vendor_battery_defender_prop)

4
sepolicy/vendor/property_contexts vendored
View file

@ -5,6 +5,10 @@ vendor.usb. u:object_r:vendor_usb_config_prop:s0
# SecureElement
persist.vendor.se. u:object_r:vendor_secure_element_prop:s0
# NFC
persist.vendor.nfc. u:object_r:vendor_nfc_prop:s0
persist.vendor.nfc.antenna. u:object_r:vendor_nfc_antenna_prop:s0
# vendor default
ro.vendor.sys. u:object_r:vendor_ro_sys_default_prop:s0
persist.vendor.sys. u:object_r:vendor_persist_sys_default_prop:s0

3
sepolicy/vendor/seapp_contexts vendored Normal file
View file

@ -0,0 +1,3 @@
# Domain for EuiccSupportPixel
user=_app isPrivApp=true seinfo=EuiccSupportPixel name=com.google.euiccpixel domain=euiccpixel_app type=app_data_file levelFrom=all

3
sepolicy/vendor/tee.te vendored
View file

@ -1,3 +1,4 @@
allow tee tee_persist_block_device:blk_file rw_file_perms;
allow tee tee_userdata_block_device:blk_file rw_file_perms;
allow tee tee_data_file:lnk_file create;
allow tee tee_data_file:lnk_file { create read };
allow tee persist_ss_file:lnk_file { create read };