From 2e08559c2bb6237307d7c8107f6ff6c02bc53ce0 Mon Sep 17 00:00:00 2001 From: Aayush Gupta Date: Mon, 28 Dec 2020 18:10:00 +0530 Subject: [PATCH] non_plat: Label /data/vendor/thh and allow tee to manage it TEE stores its file in /data/vendor/thh/. Allow it required permissions to do so. Denials observed without this change: 12-28 16:42:11.556 416 416 I teei_daemon: type=1400 audit(0.0:394): avc: denied { open } for path="/data/vendor/thh/7778c03fc30c4dd0a319ea29643d4d4b." dev="sdc46" ino=2490455 scontext=u:r:tee:s0 tcontext=u:object_r:vendor_data_file:s0 tclass=dir permissive=1 Test: Boot and notice that denials have resolved Signed-off-by: Aayush Gupta Change-Id: I1a608ebac628c8ce9c35ece1566e049236321a4b --- non_plat/file.te | 3 +++ non_plat/file_contexts | 2 ++ non_plat/tee.te | 3 +++ 3 files changed, 8 insertions(+) diff --git a/non_plat/file.te b/non_plat/file.te index 5cd6420..dfe514a 100644 --- a/non_plat/file.te +++ b/non_plat/file.te @@ -443,3 +443,6 @@ type sysfs_concurrency_scenario, fs_type, sysfs_type; # Camera file types type camera_vendor_data_file, file_type, data_file_type; + +# TEE +type vendor_teei_data_file, file_type, data_file_type; diff --git a/non_plat/file_contexts b/non_plat/file_contexts index c832054..743a906 100644 --- a/non_plat/file_contexts +++ b/non_plat/file_contexts @@ -698,6 +698,8 @@ /dev/emmcrpmb0 u:object_r:teei_rpmb_device:s0 /dev/tz_vfs u:object_r:teei_vfs_device:s0 +/data/vendor/thh(/.*)? u:object_r:vendor_teei_data_file:s0 + /(vendor|system\/vendor)/bin/teei_daemon u:object_r:tee_exec:s0 /(vendor|system\/vendor)/bin/teei_loader u:object_r:tee_exec:s0 diff --git a/non_plat/tee.te b/non_plat/tee.te index eb6e5c2..e0dbc77 100644 --- a/non_plat/tee.te +++ b/non_plat/tee.te @@ -4,3 +4,6 @@ allow tee teei_rpmb_device:chr_file rw_file_perms; allow tee teei_rpmb_device:blk_file { read write ioctl open }; allow tee teei_vfs_device:chr_file rw_file_perms; + +allow tee vendor_teei_data_file:dir create_dir_perms; +allow tee vendor_teei_data_file:file create_file_perms;