NekoSakura/android_device_mediatek_sepolicy
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

non_plat: Label /dev/ut_keymaster and allow relevant permissions to sources

Browse Source 
/dev/ut_keymaster is used by keymaster. Label it and allow relevant permissions
which domains using it (vold, tee and keymaster) requires.

Denial observed without this change:
[   46.666247] .(2)[399:logd.auditd]type=1400 audit(1609128921.744:392): avc: denied { ioctl } for comm="keymaster@3.0-s" path="/dev/ut_keymaster" dev="tmpfs" ino=17464 ioctlcmd=0x5402 scontext=u:r:hal_keymaster_default:s0 tcontext=u:object_r:device:s0 tclass=chr_file permissive=1

Test: Boot and notice that denial no longer appears

Signed-off-by: Aayush Gupta <aayushgupta219@gmail.com>
Change-Id: Iee0126d637a139397db8857d8a780277c3ea4576
This commit is contained in:
Aayush Gupta 2020-12-28 12:07:12 +05:30
parent a15f249346
commit 5c601a9ada
6 changed files with 12 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
non_plat/device.te
View File

@ -274,3 +274,6 @@ type m_bio_misc_device, dev_type;
type dri_device, dev_type, mlstrustedobject;
type teei_fp_device, dev_type;
# Keymaster
type ut_keymaster_device, dev_type;

3
non_plat/file_contexts
View File

@ -694,3 +694,6 @@
# TEE
/dev/teei_fp u:object_r:teei_fp_device:s0
# Keymaster
/dev/ut_keymaster u:object_r:ut_keymaster_device:s0

2
non_plat/hal_keymaster_attestation.te
View File

@ -15,3 +15,5 @@ allow hal_keymaster_attestation tee_device:chr_file { read write open ioctl };
allow hal_keymaster_attestation mnt_vendor_file:dir search;
allow hal_keymaster_attestation persist_data_file:dir { write search add_name };
allow hal_keymaster_attestation persist_data_file:file { write create open getattr };
allow hal_keymaster_attestation ut_keymaster_device:chr_file { read write ioctl open };

1
non_plat/hal_keymaster_default.te Normal file
View File

@ -0,0 +1 @@
allow hal_keymaster_default ut_keymaster_device:chr_file { read write open ioctl};

1
non_plat/tee.te Normal file
View File

@ -0,0 +1 @@
allow tee ut_keymaster_device:chr_file rw_file_perms;

2
non_plat/vold.te
View File

@ -46,3 +46,5 @@ allow vold proc_swaps:file getattr;
allow vold swap_block_device:blk_file getattr;
allow vold sysfs_mmcblk:file rw_file_perms;
allow vold ut_keymaster_device:chr_file { read write open ioctl};