Revert^2 commit 2c99c990d3"

This reverts commit 5d2c755531.

Bug: 297129706
Change-Id: Ia8301a139559e8abf119a0964d7a06914aacf55e

legacy/OWNERS

@@ -0,0 +1,3 @@
+include platform/system/sepolicy:/OWNERS
+
+rurumihong@google.com

legacy/legacy/system_ext/private/property_contexts

@@ -0,0 +1,2 @@
+# Fingerprint (UDFPS) GHBM/LHBM toggle
+persist.fingerprint.ghbm    u:object_r:fingerprint_ghbm_prop:s0    exact    bool

legacy/legacy/system_ext/public/property.te

@@ -0,0 +1,2 @@
+# Fingerprint (UDFPS) GHBM/LHBM toggle
+system_vendor_config_prop(fingerprint_ghbm_prop)

legacy/legacy/whitechapel_pro/device.te

@@ -2,6 +2,3 @@ type sg_device, dev_type;
 type vendor_toe_device, dev_type;
 type lwis_device, dev_type;
 type rls_device, dev_type;
-
-# Raw HID device
-type hidraw_device, dev_type;

legacy/legacy/whitechapel_pro/file.te

@@ -2,8 +2,6 @@
 type updated_wifi_firmware_data_file, file_type, data_file_type;
 type vendor_misc_data_file, file_type, data_file_type;
 type per_boot_file, file_type, data_file_type, core_data_file_type;
-type uwb_vendor_data_file, file_type, data_file_type, app_data_file_type;
-type uwb_data_vendor, file_type, data_file_type;
 type powerstats_vendor_data_file, file_type, data_file_type;
 type sensor_debug_data_file, file_type, data_file_type;
 
@@ -19,7 +17,6 @@ type vendor_regmap_debugfs, fs_type, debugfs_type;
 
 # persist
 type persist_ss_file, file_type, vendor_persist_type;
-type persist_uwb_file, file_type, vendor_persist_type;
 
 # Storage Health HAL
 type proc_f2fs, proc_type, fs_type;

legacy/legacy/whitechapel_pro/file_contexts

@@ -41,13 +41,8 @@
 /data/vendor/misc(/.*)?                                                     u:object_r:vendor_misc_data_file:s0
 /data/per_boot(/.*)?                                                        u:object_r:per_boot_file:s0
 /data/vendor/sensors/registry(/.*)?                                         u:object_r:sensor_reg_data_file:s0
-/data/vendor/uwb(/.*)?                                                      u:object_r:uwb_data_vendor:s0
 /dev/battery_history                                                        u:object_r:battery_history_device:s0
 /data/vendor/powerstats(/.*)?                                               u:object_r:powerstats_vendor_data_file:s0
 
 # Persist
 /mnt/vendor/persist/sensors/registry(/.*)?                                  u:object_r:persist_sensor_reg_file:s0
-/mnt/vendor/persist/uwb(/.*)?                                               u:object_r:persist_uwb_file:s0
-
-# Raw HID device
-/dev/hidraw[0-9]*                        u:object_r:hidraw_device:s0

legacy/legacy/whitechapel_pro/keys.conf

@@ -0,0 +1,5 @@
+[@UWB]
+ALL : device/google/zuma-sepolicy/legacy/whitechapel_pro/certs/com_qorvo_uwb.x509.pem
+
+[@EUICCSUPPORTPIXEL]
+ALL : device/google/zuma-sepolicy/legacy/whitechapel_pro/certs/EuiccSupportPixel.x509.pem

legacy/radio/genfs_contexts

@@ -4,8 +4,5 @@ genfscon sysfs /devices/platform/sjtag_gsa/interface                      u:obje
 
 genfscon sysfs /firmware/devicetree/base/chosen                           u:object_r:sysfs_chosen:s0
 
-# GPS
-genfscon sysfs /devices/platform/111e0000.spi/spi_master/spi21/spi21.0/nstandby  u:object_r:sysfs_gps:s0
-
 # Modem
-genfscon sysfs /devices/platform/cp-tm1/cp_temp  u:object_r:sysfs_modem:s0
+genfscon sysfs /devices/platform/cp-tm1/cp_temp u:object_r:sysfs_modem:s0

legacy/radio/grilservice_app.te

@@ -3,6 +3,7 @@ app_domain(grilservice_app)
 
 allow grilservice_app app_api_service:service_manager find;
 allow grilservice_app hal_bluetooth_coexistence_hwservice:hwservice_manager find;
+allow grilservice_app hal_bluetooth_coexistence_service:service_manager find;
 allow grilservice_app hal_radioext_hwservice:hwservice_manager find;
 allow grilservice_app hal_wifi_ext_hwservice:hwservice_manager find;
 allow grilservice_app hal_wifi_ext_service:service_manager find;

legacy/radio/hal_radioext_default.te

@@ -19,6 +19,7 @@ allow hal_radioext_default radio_vendor_data_file:file create_file_perms;
 
 # Bluetooth
 allow hal_radioext_default hal_bluetooth_coexistence_hwservice:hwservice_manager find;
+allow hal_radioext_default hal_bluetooth_coexistence_service:service_manager find;
 
 # Twoshay
 binder_use(hal_radioext_default)

legacy/radio/keys.conf

@@ -0,0 +1,3 @@
+[@MDS]
+ALL : device/google/zuma-sepolicy/radio/certs/com_google_mds.x509.pem
+

legacy/radio/logger_app.te

@@ -5,6 +5,9 @@ userdebug_or_eng(`
   allow logger_app radio_vendor_data_file:file create_file_perms;
   allow logger_app radio_vendor_data_file:dir create_dir_perms;
   allow logger_app sysfs_sscoredump_level:file r_file_perms;
+  allow logger_app hal_exynos_rild_hwservice:hwservice_manager find;
+
+  binder_call(logger_app, rild)
 
   r_dir_file(logger_app, sscoredump_vendor_data_coredump_file)
   r_dir_file(logger_app, sscoredump_vendor_data_crashinfo_file)

legacy/radio/radio.te

@@ -0,0 +1,8 @@
+set_prop(radio, telephony_ril_prop)
+
+allow radio radio_vendor_data_file:dir rw_dir_perms;
+allow radio radio_vendor_data_file:file create_file_perms;
+allow radio vendor_ims_app:udp_socket { getattr read write setopt shutdown };
+allow radio aoc_device:chr_file rw_file_perms;
+allow radio hal_audio_ext_hwservice:hwservice_manager find;
+binder_call(radio, hal_audio_default)

legacy/radio/rild.te

@@ -0,0 +1,42 @@
+set_prop(rild, vendor_rild_prop)
+set_prop(rild, vendor_modem_prop)
+get_prop(rild, vendor_persist_config_default_prop)
+get_prop(rild, vendor_carrier_prop)
+
+get_prop(rild, sota_prop)
+get_prop(rild, system_boot_reason_prop)
+
+set_prop(rild, telephony_ril_prop)
+
+allow rild proc_net:file rw_file_perms;
+allow rild radio_vendor_data_file:dir create_dir_perms;
+allow rild radio_vendor_data_file:file create_file_perms;
+allow rild rild_vendor_data_file:dir create_dir_perms;
+allow rild rild_vendor_data_file:file create_file_perms;
+allow rild vendor_fw_file:file r_file_perms;
+allow rild mnt_vendor_file:dir r_dir_perms;
+
+r_dir_file(rild, modem_img_file)
+
+binder_call(rild, bipchmgr)
+binder_call(rild, gpsd)
+binder_call(rild, hal_audio_default)
+binder_call(rild, modem_svc_sit)
+binder_call(rild, vendor_ims_app)
+binder_call(rild, vendor_rcs_app)
+binder_call(rild, oemrilservice_app)
+binder_call(rild, hal_secure_element_uicc)
+binder_call(rild, grilservice_app)
+binder_call(rild, vendor_engineermode_app)
+binder_call(rild, vendor_telephony_debug_app)
+binder_call(rild, logger_app)
+
+crash_dump_fallback(rild)
+
+# for hal service
+add_hwservice(rild, hal_exynos_rild_hwservice)
+
+# Allow rild to access files on modem img.
+allow rild modem_img_file:dir r_dir_perms;
+allow rild modem_img_file:file r_file_perms;
+allow rild modem_img_file:lnk_file r_file_perms;

legacy/system_ext/private/property_contexts

@@ -1,2 +0,0 @@
-# Fingerprint (UDFPS) GHBM/LHBM toggle
-persist.fingerprint.ghbm    u:object_r:fingerprint_ghbm_prop:s0    exact    bool

legacy/system_ext/private/systemui_app.te

@@ -0,0 +1,20 @@
+
+allow systemui_app app_api_service:service_manager find;
+allow systemui_app network_score_service:service_manager find;
+allow systemui_app overlay_service:service_manager find;
+allow systemui_app color_display_service:service_manager find;
+allow systemui_app audioserver_service:service_manager find;
+allow systemui_app cameraserver_service:service_manager find;
+allow systemui_app mediaserver_service:service_manager find;
+allow systemui_app mediaextractor_service:service_manager find;
+allow systemui_app mediametrics_service:service_manager find;
+allow systemui_app radio_service:service_manager find;
+allow systemui_app vr_manager_service:service_manager find;
+allow systemui_app nfc_service:service_manager find;
+allow systemui_app adb_service:service_manager find;
+allow systemui_app statsmanager_service:service_manager find;
+
+get_prop(systemui_app, keyguard_config_prop)
+set_prop(systemui_app, bootanim_system_prop)
+get_prop(systemui_app, qemu_hw_prop)
+

legacy/system_ext/public/property.te

@@ -1,2 +1,4 @@
-# Fingerprint (UDFPS) GHBM/LHBM toggle
-system_vendor_config_prop(fingerprint_ghbm_prop)
+# Telephony
+userdebug_or_eng(`
+  set_prop(shell, telephony_ril_prop)
+')

legacy/tracking_denials/README.txt

@@ -0,0 +1,2 @@
+This folder stores known errors detected by PTS. Be sure to remove relevant
+files to reproduce error log on latest ROMs.

legacy/tracking_denials/bug_map

@@ -0,0 +1,10 @@
+dump_gxp vendor_gxp_prop file b/287898138
+dumpstate app_zygote process b/288049050
+hal_uwb_default debugfs file b/288049522
+incidentd debugfs_wakeup_sources file b/288049561
+incidentd incidentd anon_inode b/288049561
+insmod-sh insmod-sh key b/274374722
+insmod-sh vendor_regmap_debugfs dir b/274727542
+mtectrl unlabeled dir b/264483752
+systemui_app wm_trace_data_file dir b/288049075
+vendor_init proc file b/289856761

legacy/tracking_denials/kernel.te

@@ -0,0 +1,2 @@
+# b/263185161
+dontaudit kernel kernel:capability { net_bind_service };

legacy/vendor/cccdk_timesync_app.te

@@ -2,6 +2,7 @@ type vendor_cccdktimesync_app, domain;
 app_domain(vendor_cccdktimesync_app)
 
 allow vendor_cccdktimesync_app app_api_service:service_manager find;
+allow vendor_cccdktimesync_app hal_bluetooth_coexistence_hwservice:hwservice_manager find;
+allow vendor_cccdktimesync_app hal_bluetooth_coexistence_service:service_manager find;
 
 binder_call(vendor_cccdktimesync_app, hal_bluetooth_btlinux)
-allow vendor_cccdktimesync_app hal_bluetooth_coexistence_hwservice:hwservice_manager find;

legacy/vendor/certs/app.x509.pem

@@ -0,0 +1,27 @@
+-----BEGIN CERTIFICATE-----
+MIIEqDCCA5CgAwIBAgIJANWFuGx90071MA0GCSqGSIb3DQEBBAUAMIGUMQswCQYD
+VQQGEwJVUzETMBEGA1UECBMKQ2FsaWZvcm5pYTEWMBQGA1UEBxMNTW91bnRhaW4g
+VmlldzEQMA4GA1UEChMHQW5kcm9pZDEQMA4GA1UECxMHQW5kcm9pZDEQMA4GA1UE
+AxMHQW5kcm9pZDEiMCAGCSqGSIb3DQEJARYTYW5kcm9pZEBhbmRyb2lkLmNvbTAe
+Fw0wODA0MTUyMzM2NTZaFw0zNTA5MDEyMzM2NTZaMIGUMQswCQYDVQQGEwJVUzET
+MBEGA1UECBMKQ2FsaWZvcm5pYTEWMBQGA1UEBxMNTW91bnRhaW4gVmlldzEQMA4G
+A1UEChMHQW5kcm9pZDEQMA4GA1UECxMHQW5kcm9pZDEQMA4GA1UEAxMHQW5kcm9p
+ZDEiMCAGCSqGSIb3DQEJARYTYW5kcm9pZEBhbmRyb2lkLmNvbTCCASAwDQYJKoZI
+hvcNAQEBBQADggENADCCAQgCggEBANbOLggKv+IxTdGNs8/TGFy0PTP6DHThvbbR
+24kT9ixcOd9W+EaBPWW+wPPKQmsHxajtWjmQwWfna8mZuSeJS48LIgAZlKkpFeVy
+xW0qMBujb8X8ETrWy550NaFtI6t9+u7hZeTfHwqNvacKhp1RbE6dBRGWynwMVX8X
+W8N1+UjFaq6GCJukT4qmpN2afb8sCjUigq0GuMwYXrFVee74bQgLHWGJwPmvmLHC
+69EH6kWr22ijx4OKXlSIx2xT1AsSHee70w5iDBiK4aph27yH3TxkXy9V89TDdexA
+cKk/cVHYNnDBapcavl7y0RiQ4biu8ymM8Ga/nmzhRKya6G0cGw8CAQOjgfwwgfkw
+HQYDVR0OBBYEFI0cxb6VTEM8YYY6FbBMvAPyT+CyMIHJBgNVHSMEgcEwgb6AFI0c
+xb6VTEM8YYY6FbBMvAPyT+CyoYGapIGXMIGUMQswCQYDVQQGEwJVUzETMBEGA1UE
+CBMKQ2FsaWZvcm5pYTEWMBQGA1UEBxMNTW91bnRhaW4gVmlldzEQMA4GA1UEChMH
+QW5kcm9pZDEQMA4GA1UECxMHQW5kcm9pZDEQMA4GA1UEAxMHQW5kcm9pZDEiMCAG
+CSqGSIb3DQEJARYTYW5kcm9pZEBhbmRyb2lkLmNvbYIJANWFuGx90071MAwGA1Ud
+EwQFMAMBAf8wDQYJKoZIhvcNAQEEBQADggEBABnTDPEF+3iSP0wNfdIjIz1AlnrP
+zgAIHVvXxunW7SBrDhEglQZBbKJEk5kT0mtKoOD1JMrSu1xuTKEBahWRbqHsXcla
+XjoBADb0kkjVEJu/Lh5hgYZnOjvlba8Ld7HCKePCVePoTJBdI4fvugnL8TsgK05a
+IskyY0hKI9L8KfqfGTl1lzOv2KoWD0KWwtAWPoGChZxmQ+nBli+gwYMzM1vAkP+a
+ayLe0a1EQimlOalO762r0GXO0ks+UeXde2Z4e+8S/pf7pITEI/tP+MxJTALw9QUW
+Ev9lKTk+jkbqxbsh8nfBUapfKqYn0eidpwq2AzVp3juYl7//fKnaPhJD9gs=
+-----END CERTIFICATE-----

legacy/vendor/certs/camera_eng.x509.pem

@@ -0,0 +1,17 @@
+-----BEGIN CERTIFICATE-----
+MIICpzCCAmWgAwIBAgIEUAV8QjALBgcqhkjOOAQDBQAwNzELMAkGA1UEBhMCVVMx
+EDAOBgNVBAoTB0FuZHJvaWQxFjAUBgNVBAMTDUFuZHJvaWQgRGVidWcwHhcNMTIw
+NzE3MTQ1MjUwWhcNMjIwNzE1MTQ1MjUwWjA3MQswCQYDVQQGEwJVUzEQMA4GA1UE
+ChMHQW5kcm9pZDEWMBQGA1UEAxMNQW5kcm9pZCBEZWJ1ZzCCAbcwggEsBgcqhkjO
+OAQBMIIBHwKBgQD9f1OBHXUSKVLfSpwu7OTn9hG3UjzvRADDHj+AtlEmaUVdQCJR
++1k9jVj6v8X1ujD2y5tVbNeBO4AdNG/yZmC3a5lQpaSfn+gEexAiwk+7qdf+t8Yb
++DtX58aophUPBPuD9tPFHsMCNVQTWhaRMvZ1864rYdcq7/IiAxmd0UgBxwIVAJdg
+UI8VIwvMspK5gqLrhAvwWBz1AoGBAPfhoIXWmz3ey7yrXDa4V7l5lK+7+jrqgvlX
+TAs9B4JnUVlXjrrUWU/mcQcQgYC0SRZxI+hMKBYTt88JMozIpuE8FnqLVHyNKOCj
+rh4rs6Z1kW6jfwv6ITVi8ftiegEkO8yk8b6oUZCJqIPf4VrlnwaSi2ZegHtVJWQB
+TDv+z0kqA4GEAAKBgGrRG9fVZtJ69DnALkForP1FtL6FvJmMe5uOHHdUaT+MDUKK
+pPzhEISBOEJPpozRMFJO7/bxNzhjgi+mNymL/k1GoLhmZe7wQRc5AQNbHIBqoxgY
+DTA6qMyeWSPgam+r+nVoPEU7sgd3fPL958+xmxQwOBSqHfe0PVsiK1cGtIuUMAsG
+ByqGSM44BAMFAAMvADAsAhQJ0tGwRwIptb7SkCZh0RLycMXmHQIUZ1ACBqeAULp4
+rscXTxYEf4Tqovc=
+-----END CERTIFICATE-----

legacy/vendor/certs/camera_fishfood.x509.pem

@@ -0,0 +1,15 @@
+-----BEGIN CERTIFICATE-----
+MIICUjCCAbsCBEk0mH4wDQYJKoZIhvcNAQEEBQAwcDELMAkGA1UEBhMCVVMxCzAJ
+BgNVBAgTAkNBMRYwFAYDVQQHEw1Nb3VudGFpbiBWaWV3MRQwEgYDVQQKEwtHb29n
+bGUsIEluYzEUMBIGA1UECxMLR29vZ2xlLCBJbmMxEDAOBgNVBAMTB1Vua25vd24w
+HhcNMDgxMjAyMDIwNzU4WhcNMzYwNDE5MDIwNzU4WjBwMQswCQYDVQQGEwJVUzEL
+MAkGA1UECBMCQ0ExFjAUBgNVBAcTDU1vdW50YWluIFZpZXcxFDASBgNVBAoTC0dv
+b2dsZSwgSW5jMRQwEgYDVQQLEwtHb29nbGUsIEluYzEQMA4GA1UEAxMHVW5rbm93
+bjCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAn0gDGZD5sUcmOE4EU9GPjAu/
+jcd7JQSksSB8TGxEurwArcZhD6a2qy2oDjPy7vFrJqP2uFua+sqQn/u+s/TJT36B
+IqeY4OunXO090in6c2X0FRZBWqnBYX3Vg84Zuuigu9iF/BeptL0mQIBRIarbk3fe
+tAATOBQYiC7FIoL8WA0CAwEAATANBgkqhkiG9w0BAQQFAAOBgQBAhmae1jHaQ4Td
+0GHSJuBzuYzEuZ34teS+njy+l1Aeg98cb6lZwM5gXE/SrG0chM7eIEdsurGb6PIg
+Ov93F61lLY/MiQcI0SFtqERXWSZJ4OnTxLtM9Y2hnbHU/EG8uVhPZOZfQQ0FKf1b
+aIOMFB0Km9HbEZHLKg33kOoMsS2zpA==
+-----END CERTIFICATE-----

legacy/vendor/certs/com_google_android_apps_camera_services.x509.pem

@@ -0,0 +1,30 @@
+-----BEGIN CERTIFICATE-----
+MIIGCzCCA/OgAwIBAgIVAIHtywgrR7O/EgQ+PeYSfHDaUDt8MA0GCSqGSIb3DQEBCwUAMIGUMQsw
+CQYDVQQGEwJVUzETMBEGA1UECBMKQ2FsaWZvcm5pYTEWMBQGA1UEBxMNTW91bnRhaW4gVmlldzEU
+MBIGA1UEChMLR29vZ2xlIEluYy4xEDAOBgNVBAsTB0FuZHJvaWQxMDAuBgNVBAMMJ2NvbV9nb29n
+bGVfYW5kcm9pZF9hcHBzX2NhbWVyYV9zZXJ2aWNlczAgFw0yMTA2MzAyMzI2MThaGA8yMDUxMDYz
+MDIzMjYxOFowgZQxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1N
+b3VudGFpbiBWaWV3MRQwEgYDVQQKEwtHb29nbGUgSW5jLjEQMA4GA1UECxMHQW5kcm9pZDEwMC4G
+A1UEAwwnY29tX2dvb2dsZV9hbmRyb2lkX2FwcHNfY2FtZXJhX3NlcnZpY2VzMIICIjANBgkqhkiG
+9w0BAQEFAAOCAg8AMIICCgKCAgEAof2MqYxoQkV05oUZULYlNLDIJKryWjC8ha300YUktBNNVBSP
+1y33+ZTBldm7drcBGo54S1JE1lCIP1dMxby0rNTJ8/Zv2bMVMjXX0haF5vULt64itDcR0SqUDfFR
+UsHapPVmRmMpDOMOUYUbN7gjU7iYAc9oWBo6BFfckdpwwKfzYY/sgieen1E/MN7Zpzmefct3WDU5
+4Dc8mpoNsen3oqquieYAgv9FOw5gCIgsDaOfYFBgvAE08Pqo3J/zU6dAuqUJztNH8EhgTNbcaNVL
+jCmofa+iIAjSpmP69jcgaUyfmH0EE3/m55qouVRJzqARvmEO/M7LEr3n1ZKKhDZdO6TJysMzP9g8
+pONPO8/3hTQ+GP+7fOQooNQJEGNgJuZOHSyNL/8nGCgHBZKgZdZPKk8HV2M578UDf8yNyV5AYpx0
+VK1JdoBtNMzp0cv7Q6TTugIuDEzT3jmgGGp6WmXE6B9dJOq+cnVC7cSYva8wctFS3RpoqT79vkW3
+A7g2b26bM5GMQ8KcGC4qm4pJkrX5kKZWZGWXjm0F8gRJQ5D0S/AcUw3B+sG/AmfQzLm8SCK36HhO
+sFnPsQJ/VdL7kg9HHWrQYVexNaQnD/QLOCenk09COUzSwexws+kQhUH45OSbQFjOJwPbS4YAn9qV
+eV+DPlvemZEFYF5+MVlDwOGQ3JsCAwEAAaNQME4wDAYDVR0TBAUwAwEB/zAdBgNVHQ4EFgQUtjMO
+nlaC4nsk4PwT+fcIYpg52JQwHwYDVR0jBBgwFoAUtjMOnlaC4nsk4PwT+fcIYpg52JQwDQYJKoZI
+hvcNAQELBQADggIBABhYDqPD2yWiXNCVtHk6h7Kb2H2U3rc8G7Or1/mwrXSCEgqHnCkpiWeb1h/5
+YNS9fRrexQD+O0hukCpjvIFccQvk8EkZdWpn4kDlrUqfakWpASzlwEqRviS31Hiybn/+QUpYuDTm
+FYorrHzDzPiNttzxVK0ENt4T4ETDWVqiGB7tbTlLPr6tz/oxDjRH8y4iS/For7SkfdI512txJgDr
+njvRVY9WJykySs+AAqwS1PIMXGoI03UmLJUsFNUjHehaqguPS1uiewlKiQq07blWbnQXdcyH7QTI
+hOUPY2rRBh8ciXu4L0Uk4To7+DP/8nHSGC7qXPvP6W3gqW1hj0d6GviMEfJ9fBSUEzaCRF3aL/5e
+JOGQQKxh7Jsl/zZs4+MYg0Q2cyg/BQVNNOhESG4et4OV5go9W+1oAy20FV0NgtdPoeb9ABNoi4T3
+IrKLgxOsbACpoDt3zPhncqiJhX3feFtyVV4oRiylydiiYO927qNdfMGmcnGFSG4814kUxSdpkoCA
+V7WCQD42zfBYj4pkdZwiJW4yZSaPWN/Eodi3PBsV+10Y1O1WOvebJuTGmcvWWMCPGtFQJDijUy4H
+r8rDe3ZmRGQ+vEGPJZC8nx9+qxLQ314ZCzdS0R1HwRRuOji3fCSCnaPQuCFe3YlzhB2j6fRGNf7F
+DB17LhMLl0GxX9j1
+-----END CERTIFICATE-----

legacy/vendor/chre.te

@@ -0,0 +1,16 @@
+type chre, domain;
+type chre_exec, vendor_file_type, exec_type, file_type;
+init_daemon_domain(chre)
+
+# Permit communication with AoC
+allow chre aoc_device:chr_file rw_file_perms;
+
+# Allow CHRE to determine AoC's current clock
+allow chre sysfs_aoc:dir search;
+allow chre sysfs_aoc_boottime:file r_file_perms;
+
+# Allow CHRE to create thread to watch AOC's device
+allow chre device:dir r_dir_perms;
+
+# Allow CHRE to use WakeLock
+wakelock_use(chre)

legacy/vendor/con_monitor_app.te

@@ -0,0 +1,12 @@
+# ConnectivityMonitor app
+type con_monitor_app, domain;
+app_domain(con_monitor_app);
+
+allow con_monitor_app app_api_service:service_manager find;
+allow con_monitor_app batterystats_service:service_manager find;
+allow con_monitor_app virtual_device_service:service_manager find;
+
+binder_call(con_monitor_app, system_server);
+binder_call(con_monitor_app, servicemanager);
+
+set_prop(con_monitor_app, radio_prop);

legacy/vendor/debug_camera_app.te

@@ -0,0 +1,26 @@
+
+userdebug_or_eng(`
+	app_domain(debug_camera_app)
+	net_domain(debug_camera_app)
+
+	allow debug_camera_app app_api_service:service_manager find;
+	allow debug_camera_app audioserver_service:service_manager find;
+	allow debug_camera_app cameraserver_service:service_manager find;
+	allow debug_camera_app mediaextractor_service:service_manager find;
+	allow debug_camera_app mediametrics_service:service_manager find;
+	allow debug_camera_app mediaserver_service:service_manager find;
+
+	# Allows GCA-Eng & GCA-Next access the GXP device and properties.
+	allow debug_camera_app gxp_device:chr_file rw_file_perms;
+	get_prop(debug_camera_app, vendor_gxp_prop)
+
+	# Allows GCA-Eng & GCA-Next to find and access the EdgeTPU.
+	allow debug_camera_app edgetpu_app_service:service_manager find;
+	allow debug_camera_app edgetpu_device:chr_file { getattr read write ioctl map };
+
+	# Allows GCA_Eng & GCA-Next to access the PowerHAL.
+	hal_client_domain(debug_camera_app, hal_power)
+
+	# Allows  GCA_Eng & GCA-Next to access the hw_jpeg /dev/video12.
+	allow debug_camera_app hw_jpg_device:chr_file rw_file_perms;
+')

legacy/vendor/device.te

@@ -0,0 +1,29 @@
+type persist_block_device, dev_type;
+type tee_persist_block_device, dev_type;
+type custom_ab_block_device, dev_type;
+type devinfo_block_device, dev_type;
+type mfg_data_block_device, dev_type;
+type ufs_internal_block_device, dev_type;
+type logbuffer_device, dev_type;
+type gxp_device, dev_type, mlstrustedobject;
+type hw_jpg_device, dev_type;
+userdebug_or_eng(`
+  typeattribute hw_jpg_device mlstrustedobject;
+')
+type fingerprint_device, dev_type;
+type uci_device, dev_type;
+
+# Dmabuf heaps
+type sensor_direct_heap_device, dmabuf_heap_device_type, dev_type;
+type faceauth_heap_device, dmabuf_heap_device_type, dev_type;
+type vscaler_secure_heap_device, dmabuf_heap_device_type, dev_type;
+type framebuffer_secure_heap_device, dmabuf_heap_device_type, dev_type;
+
+# SecureElement SPI device
+type st54spi_device, dev_type;
+
+# OTA
+type sda_block_device, dev_type;
+
+# Raw HID device
+type hidraw_device, dev_type;

legacy/vendor/disable-contaminant-detection-sh.te

@@ -0,0 +1,7 @@
+type disable-contaminant-detection-sh, domain;
+type disable-contaminant-detection-sh_exec, vendor_file_type, exec_type, file_type;
+init_daemon_domain(disable-contaminant-detection-sh)
+
+allow disable-contaminant-detection-sh vendor_toolbox_exec:file execute_no_trans;
+allow disable-contaminant-detection-sh sysfs_batteryinfo:dir r_dir_perms;
+allow disable-contaminant-detection-sh sysfs_batteryinfo:file rw_file_perms;

legacy/vendor/dump_cma.te

@@ -0,0 +1,7 @@
+pixel_bugreport(dump_cma)
+
+userdebug_or_eng(`
+  allow dump_cma vendor_toolbox_exec:file execute_no_trans;
+  allow dump_cma vendor_cma_debugfs:dir r_dir_perms;
+  allow dump_cma vendor_cma_debugfs:file r_file_perms;
+')