Commit Graph

62 Commits

Author SHA1 Message Date
chrisl7 8f99859250 sepolicy: bengal: Add pwr and powermodule sepolicy rules
[1] - From Kalama

Change-Id: Idff6ec9ce21ac4dc02b6ebfebc72dfdb0067fa8e
Signed-off-by: chrisl7 <wandersonrodriguesf1@gmail.com>
2023-09-10 10:51:43 +05:30
Kunmun 49e886f064 Revert "common: sepolicy: Add back vendor/vm-system sepolicy rules"
This reverts commit a418e39350.

Reason for revert: Already present in sepolicy_vndr hence conflicts with the build and don't really seem any point in having it.

Change-Id: I6ef50d7e7e57c7478b42526cb6aa386ece78c639
2023-09-03 06:56:19 +00:00
Pritama Biswas 7e737118ec Revert "sepolicy: add sysfs for eDP in sysfs_graphics"
This reverts commit eae6a85528090134fec879839bc69dd313cff553.

Change-Id: I5894038a408465cb480917dee323d360aa06b995
2023-08-31 12:06:56 +00:00
Padmanabham Bodda 13e7fa6b4f common: sepolicy_vndr: Add sepolicy for libOpenCL_adreno
Add sepolicy to fix avc denial

CRs-Fixed: 3565678
Change-Id: If96a27728c09bcbd4d4d81a5dca60ce8ed864826
Signed-off-by: chrisl7 <wandersonrodriguesf1@gmail.com>
2023-08-31 12:05:52 +00:00
Arian cfb22b79fe common: sepolicy: Revert "QAPEService: Remove old perf_qesdk_client label"
This reverts commit 842b0284a827680a68c152f3c9ef5be8c2822eec.

[1] - https://gerrit.aospa.co/c/AOSPA/android_device_qcom_sepolicy_vndr/+/33656

Change-Id: I337605ed33e90a8a86d451ccdcf7e953da4d58a3
Signed-off-by: chrisl7 <wandersonrodriguesf1@gmail.com>
2023-08-31 12:05:33 +00:00
chrisl7 a418e39350 common: sepolicy: Add back vendor/vm-system sepolicy rules
Change-Id: Icfc80b7ac526b7cb3c8fcad2e1ddc2f3e7ab9bec
Signed-off-by: chrisl7 <wandersonrodriguesf1@gmail.com>
2023-08-31 12:04:25 +00:00
chrisl7 4b61c9162e common: sepolicy: kona: Remove duplicate sepolicy
[1] - bedc30ef74 (diff-09112ee2412ac4f3dccef5052cfbb1b943415434585d17d7d523bf06452c29bcR130)

Change-Id: Ic2bdb81c658bb4bccbac54ee15b2596a5f77a7ab
Signed-off-by: chrisl7 <wandersonrodriguesf1@gmail.com>
2023-08-19 23:39:13 +00:00
Gokul 2ccd0dbb2e Revert "sepolicy: generic: Label more discard_max_bytes sysfs" for Kona
Partially reverts commit: 2e80055990

Change-Id: I90905f82566c90996618c4b5b463798f86a08a19
2023-07-12 04:10:28 +00:00
Quallenauge d9da0846c1 sepolicy: generic: Allow qti_init_shell to set proc_watermark_scale_factor.
Change-Id: I4a4812393c50ffec9d64dc1ad13514551c47985e
Signed-off-by: chrisl7 <wandersonrodriguesf1@gmail.com>
2023-06-26 13:05:55 +00:00
Michael Bestas 2e80055990 sepolicy: generic: Label more discard_max_bytes sysfs
Change-Id: I43e2c93d5915157c7a87a8f0799c45a54e251040
Signed-off-by: chrisl7 <wandersonrodriguesf1@gmail.com>
2023-06-26 13:05:39 +00:00
dianlujitao e4a3635313 sepolicy: generic: Allow init write to discard_max_bytes
Change-Id: If22a1fe0036f49d5cfb3f3c21cd9c44b96ac6ae8
Signed-off-by: chrisl7 <wandersonrodriguesf1@gmail.com>
2023-06-26 13:05:30 +00:00
Michael Bestas f058740ce4 sepolicy: generic: msmnile: Add some misc wakeup nodes for msmnile
* Can't have them in hardware/oplus/sepolicy/qti/vendor/genfs_contexts
   because it conflicts with generic/vendor/lahaina/genfs_contexts here.

Change-Id: I542e7b542aec7a7270095c82bfbd0c22941dc9cd
Signed-off-by: chrisl7 <wandersonrodriguesf1@gmail.com>
2023-06-26 13:05:21 +00:00
LuK1337 71d2e76304 sepolicy: generic: msmnile: Add some misc wakeup nodes for msmnile
* Can't have them in hardware/oplus/sepolicy/qti/vendor/genfs_contexts
   because it conflicts with generic/vendor/kona/genfs_contexts here.

Change-Id: I36d28dc8dc4e2e86b30f623023cf2757d35bccf0
Signed-off-by: chrisl7 <wandersonrodriguesf1@gmail.com>
2023-06-26 13:05:11 +00:00
chrisl7 6c9c88bb3e common: sepolicy: Update SM8450 sepolicy rules
[1] - LA.VENDOR.1.0.r1-22200-WAIPIO.QSSI14.0

Change-Id: I26b9080ec5419d45f3b4d1efe793b61b4708de06
Signed-off-by: chrisl7 <wandersonrodriguesf1@gmail.com>
2023-06-26 13:05:01 +00:00
chrisl7 6847922d6d sepolicy: Update SM8150-8350 sepolicy rules
[1] - LA.UM.9.14.1.r1-10000-QCM6490.QSSI13.0

Change-Id: I724f66c9c0076cfadcbb6ade745c9b83d5992e7f
Signed-off-by: chrisl7 <wandersonrodriguesf1@gmail.com>
2023-06-26 13:03:57 +00:00
Ahmed Harhash 2751d5571c
sepolicy: vendor: kona: Remove duplicate wakeup entries
Change-Id: I013f96dc9d2ec8dfef06f667fc9348e7d11ff3aa
2023-05-29 05:02:25 +03:00
Juhyung Park 1e233bbfc8 sepolicy: location: fix socket accesses
These daemons need connecto vendor_location.

This fixes the following errors:

05-18 17:37:02.904  1487  1487 I LOWI-9.0.0.89.d: [MessageQ_Client] connecting to server [/dev/socket/location/mq/location-mq-s]
05-18 17:37:02.904  1487  1487 E LOWI-9.0.0.89.d: [MessageQ_Client] connect error: 13, [Permission denied]
05-18 17:37:02.904  1487  1487 E LOWI-9.0.0.89.d: [MessageQ_Client] connect failed 3
05-18 17:37:02.904  1487  1487 W LOWI-9.0.0.89.d: [LOWIController] retry count 4
05-18 17:37:02.903  1487  1487 W lowi-server: type=1400 audit(0.0:66): avc: denied { connectto } for path="/dev/socket/location/mq/location-mq-s" scontext=u:r:vendor_location_lowi_server:s0 tcontext=u:r:vendor_location:s0 tclass=unix_stream_socket permissive=0 srawcon="" trawcon=""

Change-Id: Ia5e2a365648f47bc8e6a17baff6e7a580641ffb7
Signed-off-by: Juhyung Park <qkrwngud825@gmail.com>
2023-05-18 19:24:43 +09:00
Juhyung Park cd16ba98c6 sepolicy: vendor_qti_init_shell: allow R/W to UFS nodes
This allows post_boot script to change values related to UFS,
such as clkscale_enable.

Change-Id: I8426971a108755a7f5ecfa87ad1e6bae6a7740ea
Signed-off-by: Juhyung Park <qkrwngud825@gmail.com>
2023-05-18 19:24:43 +09:00
Juhyung Park 4f238d4e15 sepolicy: vendor_qti_init_shell: allow R/W to swap nodes
This allows post_boot script to change values related to swap.

Change-Id: I7a72d3d0bcd9b57ac9cb75e9d5f5993ac8802778
Signed-off-by: Juhyung Park <qkrwngud825@gmail.com>
2023-05-18 19:24:42 +09:00
Mashopy 994059496a sepolicy: vendor: kona: Remove duplicate entries
Change-Id: Ib9ea4cd6a8b3d57c1c3727f34b3d610307587a33
2023-05-14 19:46:22 +02:00
chrisl7 e27d9d435e sepolicy: Import missing SM8450 sepolicy definition from LA.VENDOR.1.0.r1-21200-WAIPIO.QSSI13.0
Change-Id: I17b7efdd84e3f95fd1db796473a1cc2e926619ad
Signed-off-by: chrisl7 <wandersonrodriguesf1@gmail.com>
2023-05-14 06:52:21 -04:00
Mashopy e6e1d5e363 sepolicy: common: Allow ueventd to search for vendor_persist_wcnss_service_file dir
Change-Id: Iecc01d9a61f8f8ccb2646f3a58aeffc1f7b58ee6
2023-05-11 02:09:31 +00:00
Mashopy 1cb09986ee sepolicy: kona: Fix some sysfs_wakeup node
Found by SuspendSepolicyTests.sh

Change-Id: Ic9abc73025f93f2c40d69d92068c2ceabc085999
2023-05-11 02:09:19 +00:00
chrisl7 909a0dfee4 sepolicy: qva: Add missing hvdcp sepolicy definitions
Change-Id: I1ddcb79c7d4de6276b65d21a14bed1689267c7a1
Signed-off-by: chrisl7 <wandersonrodriguesf1@gmail.com>
2023-04-17 07:35:40 +00:00
chrisl7 c3ae3ca3de common: sepolicy: Import missing sepolicy rules from taro
Change-Id: I2f6f49df4a9113e65c6250801775e452b22c4e90
Signed-off-by: chrisl7 <wandersonrodriguesf1@gmail.com>
2023-03-14 01:16:51 -03:00
chrisl7 ce7ff0e820 common: sepolicy: Adapt sepolicy to LA.VENDOR.13.2.0.r1-13100-KAILUA.0
[1] - Move partally bengal to sepolicy_vndr, keep 4.19 specifc nodes here
[2] - Keep kona here for now
[3] - Import msmsteppe from taro sepolicy_vndr
[4] - Use neuralnetworks on sepolicy_vndr

Change-Id: Icda5ebce28b97d45c8067f08be98d85313ab1474
Signed-off-by: chrisl7 <wandersonrodriguesf1@gmail.com>
2023-03-14 01:16:51 -03:00
Adithya R d88799f3aa sepolicy: Allow NNHAL full read access to {q,x}dsp_device
Required on 5.4 and older platforms.

Change-Id: Ied9eea539b95e21dc1584d671cdfbc59ef73df33
2023-03-07 04:35:15 +00:00
electimon 6e93bc0b99 common: sepolicy: Move AOSPA specific sepolicies to their own folders
* With this, qcom common sepolicy compiles on AOSP based ROMs.

Change-Id: Ie5e2c5660305a859ebfb0ddbec8fd19be3ac11e4
Signed-off-by: electimon <electimon@gmail.com>
2023-03-05 02:01:32 +08:00
chrisl7 7f06544cb0 vendor: telephony Enable singlereg.feature for all 4.14, 4.19 and 5.4
[1] - It appears that Qualcomm has enabled this for all through IQtiRadio 2.7 in descending order, starting with 9.16, 9.15, 9.14...
      all our latest bsp are with IQtiRadio 2.7, so enable it

[2] - Fix IUceService logspam

Change-Id: I24bb664bda3559751b7e3757420be4d290765a59
Signed-off-by: chrisl7 <wandersonrodriguesf1@gmail.com>
2023-02-27 00:00:00 +00:00
Jake Weinstein 82fe1b8dff common: sepolicy: lahaina: Add more wakeup nodes
Test: SuspendSepolicyTests.sh on Nothing Phone (1).

Change-Id: Ifd6de26fd53571e156a8f649350729063097b1e5
2023-02-16 02:23:42 +00:00
chrisl7 6e32a4d4dd sepolicy: Update SM8150-8350 sepolicy
[1] - From LA.UM.9.16.r1-12800-MANNAR.QSSI13.0

Change-Id: I1d78ebd7336b550792a797b3e243472288a73b73
Signed-off-by: chrisl7 <wandersonrodriguesf1@gmail.com>
2023-02-15 20:18:20 +00:00
Adithya R 6b935d9a85 common: sepolicy: Allow mediaswcodec to access gpu_device
Required by Adreno stack.

type=1400 audit(0.0:744): avc: denied { read write } for name="kgsl-3d0" dev="tmpfs" ino=1176 scontext=u:r:mediaswcodec:s0 tcontext=u:object_r:gpu_device:s0 tclass=chr_file permissive=0

Signed-off-by: chrisl7 <wandersonrodriguesf1@gmail.com>
Change-Id: Ie04f15ee768d3c070e2c3a8499cd9d8b1e94e06d
2023-01-15 12:59:48 +00:00
chrisl7 ee0ffca982 common: sepolicy: Fix AtCmdFwd related selinux denials
Change-Id: I2c4c82fbc28bfa322eb7fdd737cc8eabb3ec74be
Signed-off-by: chrisl7 <wandersonrodriguesf1@gmail.com>
2023-01-15 03:09:15 +00:00
Adam Shih da0634377e common: Add additional dontaudit lines
Change-Id: Ic2e286d244360784a76673412662cabef02d313a
2022-12-31 06:22:09 +00:00
Adithya R 212e7c739f common: sepolicy: Allow build.prop to set vendor.all.modules.ready
Change-Id: Ia2edd8ff98fa5bbb507fabd32eb5cbd8e9f77cb7
2022-12-30 10:28:52 +00:00
Abhay Singh Gill f19af84df4 common: sepolicy: Label QTI Supplicant AIDL HAL
Change-Id: I390912933f6f27bd24401c8051d60081a817db37
2022-12-23 17:19:08 +00:00
Sarthak Garg 790d9e712c common: sepolicy: sepolicy rules for accessing read_ahead_kb
Adding sepolicy rule to fix avc denials while accessing
read_ahead_kb node for vold.

Change-Id: I078b00b07b31a813a2151595e24332cfa2361901
Signed-off-by: Sarthak Garg <sartgarg@codeaurora.org>

[1] - 10-29 19:13:47.873 W/binder:543_3(543): type=1400 audit(0.0:113): avc: denied { write } for name="read_ahead_kb" dev="sysfs" ino=74683 scontext=u:r:vold:s0 tcontext=u:object_r:vendor_sysfs_mmc_host:s0 tclass=file permissive=0

Change-Id: I8661014f083bddb48808335af5e8b2d2a751851c
Signed-off-by: chrisl7 <wandersonrodriguesf1@gmail.com>
2022-12-16 10:06:23 +00:00
Qi Jin 4c0b6dad30 sepolicy: Add permission for QtiMapperExtension version 1.3
Change-Id: I7591ad02c90aa4ff6aeb5aeaf2ea2b1c156cc3d0
2022-12-16 07:35:19 +00:00
Omkar Chandorkar 23177c217d sepolicy: kona: label vendor_boot partition
- devices like alioth ship with vendor_boot on kona

Signed-off-by: Omkar Chandorkar <gotenksIN@aospa.co>
Change-Id: Icc0ca6d1eaa2602e0ba927a85e1c639ae30c5a5f
2022-11-09 06:45:09 +00:00
Jake Weinstein 2f16a29f0a perf: Set restricted cpuset to the same CPUs as system-background
system-background should only include efficiency cores
and restricted should do the same in order to save
power while the screen is off. Copy system-background
CPUs instead of hardcoding to account for platforms
with varying numbers of efficiency cores.

Change-Id: I3a46190a2fa76eb1e9061a605c6a2e74006975de
2022-11-09 03:38:48 +00:00
UtsavBalar1231 4ba8b00145 common: sepolicy: Allow Perf HAL to read cmdline
Fixes [   30.378433] type=1400 audit(1667805344.191:499): avc: denied { read } for comm=41646170744C61756E636820566D name="cmdline" dev="proc" ino=80996 scontext=u:r:vendor_hal_perf_default:s0 tcontext=u:r:system_server:s0 tclass=file permissive=1

Change-Id: I8f1ddf532a1e4a99aca8fca63c53e34cc716ac99
2022-11-09 03:38:37 +00:00
Jake Weinstein 5d67c870c3 common: sepolicy: Label ipebpsstriping170 for pinner
Change-Id: I75ffd066ff6a5989bb6bd735278f63c7d9e57ea6
2022-11-08 08:17:11 +00:00
Sandeep Singh d9f6752cbb common: sepolicy: Add permission for cnss-daemon to write in persist folder
Add permission for cnss-daemon to create file in
/mnt/vendor/persist/wlan folder.

Change-Id: I11690dee5383e8555260a1c6bbfa266043ed395e
Signed-off-by: Omkar Chandorkar <gotenksIN@aospa.co>
2022-11-06 14:51:27 +00:00
UtsavBalar1231 39942ef559 common: sepolicy: Allow flipendo to find vendor_hal_perf
This fixes ANDR-PERF-CLIENT-SYS not being accessed by flipendo
E SELinux : avc:  denied  { find } for interface=vendor.qti.hardware.perf::IPerf sid=u:r:flipendo:s0:c199,c256,c512,c768 pid=21903 scontext=u:r:flipendo:s0:c199,c256,c512,c768 tcontext=u:object_r:vendor_hal_perf_hwservice:s0 tclass=hwservice_manager permissive=0
E ANDR-PERF-CLIENT-SYS: IPerf:: Perf HAL Service 2.2 is not available.

Change-Id: I42a582864309f17e183e10baf04cbd01eba04913
Signed-off-by: UtsavBalar1231 <utsavbalar1231@gmail.com>
Signed-off-by: Omkar Chandorkar <gotenksIN@aospa.co>
2022-11-06 14:48:40 +00:00
Omkar Chandorkar 7a8a93d1a4 common: sepolicy: suppress harmless denials
- for cleaner avc logs

Change-Id: I55f0317e38e6a2fc74739db9993f59e628d099c3
Co-authored-by: UtsavBalar1231 <utsavabalar1231@gmail.com>
Signed-off-by: Omkar Chandorkar <gotenksIN@aospa.co>
2022-11-05 17:33:25 +00:00
UtsavBalar1231 f50136a7a6 common: sepolicy: Allow init.qcom.usb.sh to create files in uvc.0 dir
During the UVC conifguration initialiation qcom USB script tries to create multiple folder and symlinks
so allow qcom USB script to succesfully create them without any denials.

This fixes:
W init.qcom.usb.s: type=1400 audit(0.0:10): avc: denied { write } for name="uvc.0" dev="configfs" ino=27535 scontext=u:r:vendor_qti_init_shell:s0 tcontext=u:object_r:configfs:s0 tclass=dir permissive=0
W init.qcom.usb.s: type=1400 audit(0.0:11): avc: denied { write } for name="uvc.0" dev="configfs" ino=27535 scontext=u:r:vendor_qti_init_shell:s0 tcontext=u:object_r:configfs:s0 tclass=dir permissive=0
W mkdir   : type=1400 audit(0.0:12): avc: denied { write } for name="header" dev="configfs" ino=27537 scontext=u:r:vendor_qti_init_shell:s0 tcontext=u:object_r:configfs:s0 tclass=dir permissive=0
W ln      : type=1400 audit(0.0:13): avc: denied { write } for name="fs" dev="configfs" ino=27546 scontext=u:r:vendor_qti_init_shell:s0 tcontext=u:object_r:configfs:s0 tclass=dir permissive=0
W ln      : type=1400 audit(0.0:14): avc: denied { write } for name="ss" dev="configfs" ino=27547 scontext=u:r:vendor_qti_init_shell:s0 tcontext=u:object_r:configfs:s0 tclass=dir permissive=0
W mkdir   : type=1400 audit(0.0:15): avc: denied { write } for name="uncompressed" dev="configfs" ino=27550 scontext=u:r:vendor_qti_init_shell:s0 tcontext=u:object_r:configfs:s0 tclass=dir permissive=0
W mkdir   : type=1400 audit(0.0:16): avc: denied { write } for name="uncompressed" dev="configfs" ino=27550 scontext=u:r:vendor_qti_init_shell:s0 tcontext=u:object_r:configfs:s0 tclass=dir permissive=0
W mkdir   : type=1400 audit(0.0:17): avc: denied { write } for name="mjpeg" dev="configfs" ino=27551 scontext=u:r:vendor_qti_init_shell:s0 tcontext=u:object_r:configfs:s0 tclass=dir permissive=0
W mkdir   : type=1400 audit(0.0:18): avc: denied { write } for name="mjpeg" dev="configfs" ino=27551 scontext=u:r:vendor_qti_init_shell:s0 tcontext=u:object_r:configfs:s0 tclass=dir permissive=0
W mkdir   : type=1400 audit(0.0:19): avc: denied { write } for name="h264" dev="configfs" ino=27552 scontext=u:r:vendor_qti_init_shell:s0 tcontext=u:object_r:configfs:s0 tclass=dir permissive=0
W mkdir   : type=1400 audit(0.0:20): avc: denied { write } for name="h264" dev="configfs" ino=27552 scontext=u:r:vendor_qti_init_shell:s0 tcontext=u:object_r:configfs:s0 tclass=dir permissive=0
W mkdir   : type=1400 audit(0.0:21): avc: denied { write } for name="header" dev="configfs" ino=27549 scontext=u:r:vendor_qti_init_shell:s0 tcontext=u:object_r:configfs:s0 tclass=dir permissive=0
W ln      : type=1400 audit(0.0:22): avc: denied { write } for name="header" dev="configfs" ino=27549 scontext=u:r:vendor_qti_init_shell:s0 tcontext=u:object_r:configfs:s0 tclass=dir permissive=0
W ln      : type=1400 audit(0.0:23): avc: denied { write } for name="header" dev="configfs" ino=27549 scontext=u:r:vendor_qti_init_shell:s0 tcontext=u:object_r:configfs:s0 tclass=dir permissive=0
W ln      : type=1400 audit(0.0:24): avc: denied { write } for name="header" dev="configfs" ino=27549 scontext=u:r:vendor_qti_init_shell:s0 tcontext=u:object_r:configfs:s0 tclass=dir permissive=0
W ln      : type=1400 audit(0.0:25): avc: denied { write } for name="fs" dev="configfs" ino=27556 scontext=u:r:vendor_qti_init_shell:s0 tcontext=u:object_r:configfs:s0 tclass=dir permissive=0
W ln      : type=1400 audit(0.0:26): avc: denied { write } for name="hs" dev="configfs" ino=27557 scontext=u:r:vendor_qti_init_shell:s0 tcontext=u:object_r:configfs:s0 tclass=dir permissive=0
W ln      : type=1400 audit(0.0:27): avc: denied { write } for name="ss" dev="configfs" ino=27558 scontext=u:r:vendor_qti_init_shell:s0 tcontext=u:object_r:configfs:s0 tclass=dir permissive=0

Change-Id: Ic092fe1d6ea0d42f0d4939ac3a4241ec0063697d
Signed-off-by: UtsavBalar1231 <utsavbalar1231@gmail.com>
Signed-off-by: Omkar Chandorkar <gotenksIN@aospa.co>
2022-11-05 17:33:25 +00:00
UtsavBalar1231 522391750b common: sepolicy: Allow init.qcom.post_boot.sh to set
watermark_scale_factor

- addresses
W init.qcom.post_: type=1400 audit(0.0:42): avc: denied { write } for name="watermark_scale_factor" dev="proc" ino=52566 scontext=u:r:vendor_qti_init_shell:s0 tcontext=u:object_r:proc_watermark_scale_factor:s0 tclass=file permissive=0

Change-Id: Ib79c0208e758f03df5ce6652322802354836d6a5
Signed-off-by: UtsavBalar1231 <utsavbalar1231@gmail.com>
Signed-off-by: Omkar Chandorkar <gotenksIN@aospa.co>
2022-11-05 17:33:25 +00:00
UtsavBalar1231 24cc0790bc common: sepolicy: Allow init to modify read_ahead_kb and discard_max_bytes
Change-Id: Ie5eee0883558a489c8cda2e4418f7a7144bf1ae1
Signed-off-by: UtsavBalar1231 <utsavbalar1231@gmail.com>
Signed-off-by: Omkar Chandorkar <gotenksIN@aospa.co>
2022-11-05 17:33:25 +00:00
kocolin 574d2193e2 common: sepolicy: Label libipebpsstriping for pinner
Change-Id: I6806151eee833725e173903d03e9459839333565
Signed-off-by: Omkar Chandorkar <gotenksIN@aospa.co>
2022-11-05 17:33:25 +00:00
Jake Weinstein 4cf4a266c1 common: sepolicy: Remove blank msmsteppe policies
Qualcomm removed them at
"removing some of the target dir from the component.", which
we reverted.

Change-Id: If2d407c03c112099b67bcd88d2ec4b31c0425642
2022-10-30 02:31:07 +09:00