NekoSakura/android_device_mediatek_sepolicy
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

non_plat: Label /dev/tee* and grant required perms to domains

Browse Source 
/dev/tee* are accessed by domains that interact with TEE and thus
require access to them too.

Test: Boot and observe that denials are not visible in logs anymore

Signed-off-by: Aayush Gupta <aayushgupta219@gmail.com>
Change-Id: I7b0944a1063da8561d2928e4110674ce4845ecea
This commit is contained in:
Aayush Gupta 2020-12-30 16:52:24 +05:30
parent 2e08559c2b
commit 22380a4614
16 changed files with 38 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
non_plat/device.te
View File

@ -278,5 +278,8 @@ type teei_fp_device, dev_type;
type teei_rpmb_device, dev_type; type teei_rpmb_device, dev_type;
type teei_vfs_device, dev_type; type teei_vfs_device, dev_type;
type teei_client_device, dev_type;
typeattribute teei_client_device mlstrustedobject;
# Keymaster # Keymaster
type ut_keymaster_device, dev_type; type ut_keymaster_device, dev_type;

2
non_plat/file_contexts
View File

@ -697,6 +697,8 @@
/dev/rpmb0 u:object_r:teei_rpmb_device:s0 /dev/rpmb0 u:object_r:teei_rpmb_device:s0
/dev/emmcrpmb0 u:object_r:teei_rpmb_device:s0 /dev/emmcrpmb0 u:object_r:teei_rpmb_device:s0
/dev/tz_vfs u:object_r:teei_vfs_device:s0 /dev/tz_vfs u:object_r:teei_vfs_device:s0
/dev/tee0 u:object_r:teei_client_device:s0
/dev/teei_client u:object_r:teei_client_device:s0
/data/vendor/thh(/.*)? u:object_r:vendor_teei_data_file:s0 /data/vendor/thh(/.*)? u:object_r:vendor_teei_data_file:s0

1
non_plat/hal_drm_widevine.te
View File

@ -14,3 +14,4 @@ allow hal_drm_widevine hal_allocator_server:fd use;
allow hal_drm_widevine mediadrm_vendor_data_file:dir create_dir_perms; allow hal_drm_widevine mediadrm_vendor_data_file:dir create_dir_perms;
allow hal_drm_widevine mediadrm_vendor_data_file:file create_file_perms; allow hal_drm_widevine mediadrm_vendor_data_file:file create_file_perms;
allow hal_drm_widevine teei_client_device:chr_file rw_file_perms;

2
non_plat/hal_fingerprint_default.te
View File

@ -1 +1,3 @@
allow hal_fingerprint_default teei_fp_device:chr_file { read write open ioctl }; allow hal_fingerprint_default teei_fp_device:chr_file { read write open ioctl };
allow hal_fingerprint_default teei_client_device:chr_file { read write open ioctl };

1
non_plat/hal_gatekeeper_default.te Normal file
View File

@ -0,0 +1 @@
allow hal_gatekeeper_default teei_client_device:chr_file rw_file_perms;

3
non_plat/hal_graphics_allocator_default.te
View File

@ -20,3 +20,6 @@ allow hal_graphics_allocator_default debugfs_tracing:file open;
#============= hal_graphics_allocator_default ============== #============= hal_graphics_allocator_default ==============
allow hal_graphics_allocator_default proc_ged:file r_file_perms; allow hal_graphics_allocator_default proc_ged:file r_file_perms;
allowxperm hal_graphics_allocator_default proc_ged:file ioctl { proc_ged_ioctls }; allowxperm hal_graphics_allocator_default proc_ged:file ioctl { proc_ged_ioctls };
# TEE
allow hal_graphics_allocator_default teei_client_device:chr_file rw_file_perms;

2
non_plat/hal_keymaster_attestation.te
View File

@ -17,3 +17,5 @@ allow hal_keymaster_attestation persist_data_file:dir { write search add_name };
allow hal_keymaster_attestation persist_data_file:file { write create open getattr }; allow hal_keymaster_attestation persist_data_file:file { write create open getattr };
allow hal_keymaster_attestation ut_keymaster_device:chr_file { read write ioctl open }; allow hal_keymaster_attestation ut_keymaster_device:chr_file { read write ioctl open };
allow hal_keymaster_attestation teei_client_device:chr_file { read write open ioctl};

2
non_plat/hal_keymaster_default.te
View File

@ -1 +1,3 @@
allow hal_keymaster_default ut_keymaster_device:chr_file { read write open ioctl}; allow hal_keymaster_default ut_keymaster_device:chr_file { read write open ioctl};
allow hal_keymaster_default teei_client_device:chr_file { read write open ioctl};

3
non_plat/init.te
View File

@ -145,3 +145,6 @@ allow init proc_cpu_alignment:file w_file_perms;
# Purpose: Allow to relabelto for selinux_android_restorecon # Purpose: Allow to relabelto for selinux_android_restorecon
allow init boot_block_device:lnk_file relabelto; allow init boot_block_device:lnk_file relabelto;
allow init vbmeta_block_device:lnk_file relabelto; allow init vbmeta_block_device:lnk_file relabelto;
# TEE
allow init teei_client_device:chr_file rw_file_perms;

3
non_plat/kernel.te
View File

@ -87,3 +87,6 @@ allow kernel vendor_file:file r_file_perms;
# Operation: SQC # Operation: SQC
# Purpose: Allow VOW kthread to write debug PCM dump # Purpose: Allow VOW kthread to write debug PCM dump
allow kernel mtk_audiohal_data_file:file write; allow kernel mtk_audiohal_data_file:file write;
# TEE
allow kernel teei_client_device:chr_file rw_file_perms;

3
non_plat/mediacodec.te
View File

@ -157,3 +157,6 @@ allowxperm mediacodec proc_m4u:file ioctl MTK_M4U_T_CONFIG_PORT_ARRAY;
# Purpose : allow media sources to access /sys/bus/platform/drivers/mem_bw_ctrl/* # Purpose : allow media sources to access /sys/bus/platform/drivers/mem_bw_ctrl/*
allow mediacodec sysfs_concurrency_scenario:file rw_file_perms; allow mediacodec sysfs_concurrency_scenario:file rw_file_perms;
allow mediacodec sysfs_concurrency_scenario:dir search; allow mediacodec sysfs_concurrency_scenario:dir search;
# TEE
allow mediacodec teei_client_device:chr_file rw_file_perms;

3
non_plat/meta_tst.te
View File

@ -419,3 +419,6 @@ allow meta_tst adsp_device:chr_file rw_file_perms;
# Operation: P migration # Operation: P migration
# Purpose : audio scp recovery # Purpose : audio scp recovery
allow meta_tst audio_scp_device:chr_file r_file_perms; allow meta_tst audio_scp_device:chr_file r_file_perms;
# TEE
allow meta_tst teei_client_device:chr_file { create setattr unlink rw_file_perms };;

3
non_plat/mtk_hal_camera.te
View File

@ -365,3 +365,6 @@ allow mtk_hal_camera camera_vendor_data_file:dir create_dir_perms;
allow mtk_hal_camera camera_vendor_data_file:file create_file_perms; allow mtk_hal_camera camera_vendor_data_file:file create_file_perms;
allow mtk_hal_camera seninf_device:chr_file rw_file_perms; allow mtk_hal_camera seninf_device:chr_file rw_file_perms;
# TEE
allow mtk_hal_camera teei_client_device:chr_file rw_file_perms;

2
non_plat/system_server.te
View File

@ -278,4 +278,6 @@ allow system_server sf_rtt_file:dir rmdir;
# Operation : Q Migration # Operation : Q Migration
allow system_server storage_stub_file:dir getattr; allow system_server storage_stub_file:dir getattr;
# TEE
allow system_server teei_fp_device:chr_file rw_file_perms; allow system_server teei_fp_device:chr_file rw_file_perms;
allow system_server teei_client_device:chr_file r_file_perms;

2
non_plat/tee.te
View File

@ -7,3 +7,5 @@ allow tee teei_vfs_device:chr_file rw_file_perms;
allow tee vendor_teei_data_file:dir create_dir_perms; allow tee vendor_teei_data_file:dir create_dir_perms;
allow tee vendor_teei_data_file:file create_file_perms; allow tee vendor_teei_data_file:file create_file_perms;
allow tee teei_client_device:chr_file { create setattr unlink rw_file_perms };;

2
non_plat/vold.te
View File

@ -48,3 +48,5 @@ allow vold swap_block_device:blk_file getattr;
allow vold sysfs_mmcblk:file rw_file_perms; allow vold sysfs_mmcblk:file rw_file_perms;
allow vold ut_keymaster_device:chr_file { read write open ioctl}; allow vold ut_keymaster_device:chr_file { read write open ioctl};
allow vold teei_client_device:chr_file { read write open ioctl};