NekoSakura/android_device_mediatek_sepolicy
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

non_plat: Label /data/vendor/thh and allow tee to manage it

Browse Source 
TEE stores its file in /data/vendor/thh/. Allow it required permissions
to do so.

Denials observed without this change:
12-28 16:42:11.556   416   416 I teei_daemon: type=1400 audit(0.0:394): avc: denied { open } for path="/data/vendor/thh/7778c03fc30c4dd0a319ea29643d4d4b." dev="sdc46" ino=2490455 scontext=u:r:tee:s0 tcontext=u:object_r:vendor_data_file:s0 tclass=dir permissive=1

Test: Boot and notice that denials have resolved

Signed-off-by: Aayush Gupta <aayushgupta219@gmail.com>
Change-Id: I1a608ebac628c8ce9c35ece1566e049236321a4b
This commit is contained in:
Aayush Gupta 2020-12-28 18:10:00 +05:30
parent 174dc137d1
commit 2e08559c2b
3 changed files with 8 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
non_plat/file.te
View File

@ -443,3 +443,6 @@ type sysfs_concurrency_scenario, fs_type, sysfs_type;
# Camera file types
type camera_vendor_data_file, file_type, data_file_type;
# TEE
type vendor_teei_data_file, file_type, data_file_type;

2
non_plat/file_contexts
View File

@ -698,6 +698,8 @@
/dev/emmcrpmb0 u:object_r:teei_rpmb_device:s0
/dev/tz_vfs u:object_r:teei_vfs_device:s0
/data/vendor/thh(/.*)? u:object_r:vendor_teei_data_file:s0
/(vendor|system\/vendor)/bin/teei_daemon u:object_r:tee_exec:s0
/(vendor|system\/vendor)/bin/teei_loader u:object_r:tee_exec:s0

3
non_plat/tee.te
View File

@ -4,3 +4,6 @@ allow tee teei_rpmb_device:chr_file rw_file_perms;
allow tee teei_rpmb_device:blk_file { read write ioctl open };
allow tee teei_vfs_device:chr_file rw_file_perms;
allow tee vendor_teei_data_file:dir create_dir_perms;
allow tee vendor_teei_data_file:file create_file_perms;