diff --git a/non_plat/device.te b/non_plat/device.te index 9251874..460e4a2 100644 --- a/non_plat/device.te +++ b/non_plat/device.te @@ -274,3 +274,6 @@ type m_bio_misc_device, dev_type; type dri_device, dev_type, mlstrustedobject; type teei_fp_device, dev_type; + +# Keymaster +type ut_keymaster_device, dev_type; diff --git a/non_plat/file_contexts b/non_plat/file_contexts index a6b19eb..69e990f 100644 --- a/non_plat/file_contexts +++ b/non_plat/file_contexts @@ -694,3 +694,6 @@ # TEE /dev/teei_fp u:object_r:teei_fp_device:s0 + +# Keymaster +/dev/ut_keymaster u:object_r:ut_keymaster_device:s0 diff --git a/non_plat/hal_keymaster_attestation.te b/non_plat/hal_keymaster_attestation.te index 35b9b71..eae2ddf 100644 --- a/non_plat/hal_keymaster_attestation.te +++ b/non_plat/hal_keymaster_attestation.te @@ -15,3 +15,5 @@ allow hal_keymaster_attestation tee_device:chr_file { read write open ioctl }; allow hal_keymaster_attestation mnt_vendor_file:dir search; allow hal_keymaster_attestation persist_data_file:dir { write search add_name }; allow hal_keymaster_attestation persist_data_file:file { write create open getattr }; + +allow hal_keymaster_attestation ut_keymaster_device:chr_file { read write ioctl open }; diff --git a/non_plat/hal_keymaster_default.te b/non_plat/hal_keymaster_default.te new file mode 100644 index 0000000..cc1dcda --- /dev/null +++ b/non_plat/hal_keymaster_default.te @@ -0,0 +1 @@ +allow hal_keymaster_default ut_keymaster_device:chr_file { read write open ioctl}; diff --git a/non_plat/tee.te b/non_plat/tee.te new file mode 100644 index 0000000..5a67df5 --- /dev/null +++ b/non_plat/tee.te @@ -0,0 +1 @@ +allow tee ut_keymaster_device:chr_file rw_file_perms; diff --git a/non_plat/vold.te b/non_plat/vold.te index 68081dc..1204cba 100644 --- a/non_plat/vold.te +++ b/non_plat/vold.te @@ -46,3 +46,5 @@ allow vold proc_swaps:file getattr; allow vold swap_block_device:blk_file getattr; allow vold sysfs_mmcblk:file rw_file_perms; + +allow vold ut_keymaster_device:chr_file { read write open ioctl};