NekoSakura/android_device_mediatek_sepolicy
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
android_device_mediatek_sep.../non_plat/tee.te

7 lines
220 B
Plaintext
Raw Normal View History

non_plat: Label /dev/ut_keymaster and allow relevant permissions to sources /dev/ut_keymaster is used by keymaster. Label it and allow relevant permissions which domains using it (vold, tee and keymaster) requires. Denial observed without this change: [ 46.666247] .(2)[399:logd.auditd]type=1400 audit(1609128921.744:392): avc: denied { ioctl } for comm="keymaster@3.0-s" path="/dev/ut_keymaster" dev="tmpfs" ino=17464 ioctlcmd=0x5402 scontext=u:r:hal_keymaster_default:s0 tcontext=u:object_r:device:s0 tclass=chr_file permissive=1 Test: Boot and notice that denial no longer appears Signed-off-by: Aayush Gupta <aayushgupta219@gmail.com> Change-Id: Iee0126d637a139397db8857d8a780277c3ea4576
2020-12-28 12:07:12 +05:30
allow tee ut_keymaster_device:chr_file rw_file_perms;
non_plat: Label /dev/*rpmb* and grant tee permissions to manage it /dev/*rpmb* devices are accessed by tee. Label it and allow tee required permissions to manage it. Denial observed without this change: [ 46.559953] .(2)[399:logd.auditd]type=1400 audit(1609128921.644:391): avc: denied { ioctl } for comm="teei_daemon" path="/dev/rpmb0" dev="tmpfs" ino=17454 ioctlcmd=0x6 scontext=u:r:init:s0 tcontext=u:object_r:device:s0 tclass=chr_file permissive=1 Test: Boot and observe that denial no longer appears Signed-off-by: Aayush Gupta <aayushgupta219@gmail.com> Change-Id: I3499e2a3ba177b8e69d8cdbb76939daf3f8bbc7b
2020-12-28 12:16:17 +05:30
allow tee teei_rpmb_device:chr_file rw_file_perms;
allow tee teei_rpmb_device:blk_file { read write ioctl open };
non_plat: Label /dev/tz_vfs and grant required perms to tee Signed-off-by: Aayush Gupta <aayushgupta219@gmail.com> Change-Id: I6bb5d9e3f8f3047bfe8285f25b53adadb8b1c1ac
2020-12-28 16:38:13 +05:30
allow tee teei_vfs_device:chr_file rw_file_perms;
Reference in New Issue Copy Permalink