Rohan Narayanan
afb2839d6e
Add hal_shared_modem_platform to modem_diagnostic_app.te
...
This is needed to access the modem platform HAL.
FLAG: EXEMPT HAL interface change
Test: manual testing of selinux
Bug: 351024952
Change-Id: I95fc6b997e08ae46089ed90a1060c23274f6cd58
2024-12-04 01:57:48 +00:00
mikeyuewang
2ce93afc02
Grant the MDS assess the OemRil service AIDL interface.
...
avc deny:
avc: denied { find } for pid=12125 uid=10269 name=vendor.samsung_slsi.telephony.hardware.radioExternal.IOemSlsiRadioExternal/default scontext=u:r:modem_diagnostic_app:s0:c512,c768 tcontext=u:object_r:hal_vendor_radio_external_service:s0 tclass=service_manager permissive=0
2024-08-09 19:48:22.634 12125-12138 ServiceManager com.google.mds E
Bug: 357488411
Change-Id: I0d1381a7f63679880cdeffe5fe982007691d86fe
2024-08-09 19:49:15 +00:00
mikeyuewang
ed2820a221
Add the selinux policy for MDS to access modem_state file
...
avc deny:
2024-02-20 19:21:35.941 21780-21780 DiagnosticServi com.google.mds I type=1400 audit(0.0:1078): avc: denied { read } for name="modem_state" dev="sysfs" ino=60939 scontext=u:r:modem_diagnostic_app:s0:c512,c768 tcontext=u:object_r:sysfs:s0 tclass=file permissive=1 app=com.google.mds
2024-02-20 19:21:35.941 21780-21780 DiagnosticServi com.google.mds I type=1400 audit(0.0:1079): avc: denied { open } for path="/sys/devices/platform/cpif/modem_state" dev="sysfs" ino=60939 scontext=u:r:modem_diagnostic_app:s0:c512,c768 tcontext=u:object_r:sysfs:s0 tclass=file permissive=1 app=com.google.mds
2024-02-20 19:21:35.941 21780-21780 DiagnosticServi com.google.mds I type=1400 audit(0.0:1080): avc: denied { getattr } for path="/sys/devices/platform/cpif/modem_state" dev="sysfs" ino=60939 scontext=u:r:modem_diagnostic_app:s0:c512,c768 tcontext=u:object_r:sysfs:s0 tclass=file permissive=1 app=com.google.mds
Bug: 331202327
Change-Id: I49bd28e4ae3b311c7e4b98567b929d3b887e0238
2024-03-27 17:50:05 +00:00
kierancyphus
2fbd1edf60
liboemservice_proxy: Add sepolicy
...
This was previously only configured to run on zuma devices, but should
be expanded to this device as well. Since this service should only be
present on these two devices, it's fine to just copy this here instead
of placing it in gs-common.
Test: atest vts_treble_vintf_vendor_test:DeviceManifest/SingleAidlTest
Bug: 321867236
Change-Id: I9f086df735c866ed037307574b38458434a9c486
2024-01-25 17:53:23 +08:00
mikeyuewang
eed49f4c46
Add selinux policy change to allow MDS access Samsung OemRil hal.
...
Bug: 301641283
selinux log:
11-03 15:32:38.850 2643 2643 I auditd : type=1400 audit(0.0:1616): avc: denied { call } for comm="binder:2643_3" scontext=u:r:modem_diagnostic_app:s0:c512,c768 tcontext=u:r:rild:s0 tclass=binder permissive=1 app=com.google.mds
11-03 15:32:38.850 2643 2643 I binder:2643_3: type=1400 audit(0.0:1616): avc: denied { call } for scontext=u:r:modem_diagnostic_app:s0:c512,c768 tcontext=u:r:rild:s0 tclass=binder permissive=1 app=com.google.mds
11-03 15:32:38.854 2643 2643 I auditd : type=1400 audit(0.0:1617): avc: denied { transfer } for comm="binder:2643_3" scontext=u:r:modem_diagnostic_app:s0:c512,c768 tcontext=u:r:rild:s0 tclass=binder permissive=1 app=com.google.mds
11-03 15:32:38.854 2643 2643 I binder:2643_3: type=1400 audit(0.0:1617): avc: denied { transfer } for scontext=u:r:modem_diagnostic_app:s0:c512,c768 tcontext=u:r:rild:s0 tclass=binder permissive=1 app=com.google.mds
11-03 15:32:38.854 1095 1095 I auditd : type=1400 audit(0.0:1618): avc: denied { call } for comm="HwBinder:1095_1" scontext=u:r:rild:s0 tcontext=u:r:modem_diagnostic_app:s0:c512,c768 tclass=binder permissive=1
11-03 15:32:38.854 1095 1095 I HwBinder:1095_1: type=1400 audit(0.0:1618): avc: denied { call } for scontext=u:r:rild:s0 tcontext=u:r:modem_diagnostic_app:s0:c512,c768 tclass=binder permissive=1
Change-Id: Ia71844db230302fd3120b28b3ade2e55443ec078
2023-11-03 07:36:16 +00:00
Mike Wang
72c63096bd
Grant the MDS access to the IPowerStats hal service.
...
ref logs:
09-06 10:07:18.006 536 536 I auditd : avc: denied { find } for pid=22543 uid=10225 name=android.hardware.power.stats.IPowerStats/default scontext=u:r:modem_diagnostic_app:s0:c512,c768 tcontext=u:object_r:hal_power_stats_service:s0 tclass=service_manager permissive=1
09-06 10:07:18.010 22543 22543 I auditd : type=1400 audit(0.0:65): avc: denied { call } for comm="pool-4-thread-1" scontext=u:r:modem_diagnostic_app:s0:c512,c768 tcontext=u:r:hal_power_stats_default:s0 tclass=binder permissive=1 app=com.google.mds
Test: Tested with MDS app and the MDS can get IPowerStats binder and
call the interface.
Bug: 297250368
Change-Id: I7503a86baa01e4391d64f958cd053822de78d8fd
2023-09-28 15:26:21 +00:00
Wilson Sung
c7a757a4ee
Revert "Sync zuma-sepolicy to legacy folder"
...
This reverts commit 355f0df8fd
2023-08-24 08:47:01 +08:00
Wilson Sung
355f0df8fd
Sync zuma-sepolicy to legacy folder
...
Duplicate from zuma-sepolicy 7f3e2b9
Test: make selinux_policy
Bug: 296187211
Change-Id: If686fbdcf058849479019e8b37bb1d57a0215ed6
Signed-off-by: Wilson Sung <wilsonsung@google.com>
2023-08-22 15:37:56 +08:00
Robin Peng
bff99af2da
init zumapro from zuma sha 43d5907677d0f
...
Bug: 272725898
Change-Id: If35d9efdda9dd3b8d8b24008f0738a0cbbe5bd9b
2023-03-31 14:16:57 +00:00
