NekoSakura/android_device_mediatek_sepolicy
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[ALPS04758557] fix aee high risk rules

Browse Source 
1. fix some high risk rules

MTK-Commit-Id: b9c316d9b87f36e958f56273ffec3d6556639bdd

Change-Id: I093cccaa98e2a157da359ef2ebf43134f86ddad2
CR-Id: ALPS04758557
Feature: Android Exception Engine(AEE)
This commit is contained in:
Huaiming Li 2020-01-18 10:21:42 +08:00
parent ffa4ed5121
commit 9e3351da5a
6 changed files with 22 additions and 19 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
r_non_plat/aee_aed.te
View File

@ -11,7 +11,6 @@
allow aee_aed aed_device:chr_file rw_file_perms;
allow aee_aed expdb_device:chr_file rw_file_perms;
allow aee_aed expdb_block_device:blk_file rw_file_perms;
allow aee_aed bootdevice_block_device:blk_file rw_file_perms;
allow aee_aed etb_device:chr_file rw_file_perms;
# open/dev/mtd/mtd12 failed(expdb)

24
r_non_plat/aee_aedv.te
View File

@ -5,6 +5,12 @@
# MTK Policy Rule
# ==============================================
type aee_aedv, domain;
type aee_aedv_exec, exec_type, file_type, vendor_file_type;
typeattribute aee_aedv mlstrustedsubject;
init_daemon_domain(aee_aedv)
# Date : WK14.32
# Operation : AEE UT
@ -18,17 +24,9 @@ allow aee_aedv etb_device:chr_file rw_file_perms;
# AED start: /dev/block/expdb
allow aee_aedv block_device:dir search;
# open/dev/mtd/mtd12 failed(expdb)
allow aee_aedv mtd_device:dir create_dir_perms;
allow aee_aedv mtd_device:chr_file rw_file_perms;
# NE flow: /dev/RT_Monitor
allow aee_aedv RT_Monitor_device:chr_file r_file_perms;
# aee db dir and db files
allow aee_aedv sdcard_type:dir create_dir_perms;
allow aee_aedv sdcard_type:file create_file_perms;
#data/aee_exp
allow aee_aedv aee_exp_vendor_file:dir create_dir_perms;
allow aee_aedv aee_exp_vendor_file:file create_file_perms;
@ -51,13 +49,6 @@ allow aee_aedv domain:lnk_file getattr;
#core-pattern
allow aee_aedv usermodehelper:file r_file_perms;
#property
allow aee_aedv init:unix_stream_socket connectto;
allow aee_aedv property_socket:sock_file write;
allow aee_aedv init:process getsched;
allow aee_aedv kernel:process getsched;
# Date: W15.34
# Operation: Migration
# Purpose: For pagemap & pageflags information in NE DB
@ -283,7 +274,8 @@ allow aee_aedv debugfs_dynamic_debug:file r_file_perms;
# [ 241.001976] <1>.(1)[209:logd.auditd]type=1400 audit(1262304586.172:515): avc: denied { read }
# for pid=1978 comm="aee_aedv64" name="atag,devinfo" dev="sysfs" ino=2349 scontext=u:r:aee_aedv:s0
# tcontext=u:object_r:sysfs:s0 tclass=file permissive=0
allow aee_aedv sysfs:file { r_file_perms write };
allow aee_aedv sysfs:file r_file_perms;
allow aee_aedv sysfs_mrdump_lbaooo:file w_file_perms;
# Purpose: Allow aee_aedv to use HwBinder IPC.
hwbinder_use(aee_aedv)

4
r_non_plat/aee_core_forwarder.te
View File

@ -7,12 +7,12 @@
allow aee_core_forwarder aee_exp_data_file:dir { write add_name search };
allow aee_core_forwarder aee_exp_data_file:file { write create open getattr };
allow aee_core_forwarder hwservicemanager_prop:file { read open getattr };
get_prop(aee_core_forwarder, hwservicemanager_prop)
# Date: 2019/06/14
# Operation : Migration
# Purpose : interface=android.system.suspend::ISystemSuspend for aee_core_forwarder
wakelock_use(aee_core_forwarder)
allow aee_core_forwarder aee_aed:unix_stream_socket connectto;
allow aee_core_forwarder aee_core_data_file:dir read;
allow aee_core_forwarder aee_core_data_file:dir r_dir_perms;
hwbinder_use(aee_core_forwarder)

3
r_non_plat/file.te
View File

@ -408,3 +408,6 @@ type sysfs_fbt_fteh, fs_type, sysfs_type;
# Purpose: Android Migration for video codec driver
type sysfs_device_tree_model, fs_type, sysfs_type;
# Date : 2019/10/22
# Purpose : allow aee_aedv write /sys/module/mrdump/parameters/lbaooo
type sysfs_mrdump_lbaooo, fs_type, sysfs_type;

4
r_non_plat/genfs_contexts
View File

@ -166,6 +166,10 @@ genfscon sysfs /devices/platform/bootdevice/host0/target0:0:0/0:0:0:2/block/sdc
genfscon sysfs /devices/platform/externdevice/mmc_host/mmc0 u:object_r:sysfs_devices_block:s0
genfscon sysfs /devices/platform/externdevice/mmc_host/mmc1 u:object_r:sysfs_devices_block:s0
# Date : 2019/10/22
# Purpose : mrdump_tool(copy_process by aee_aedv) need to write data to lbaooo
genfscon sysfs /module/mrdump/parameters/lbaooo u:object_r:sysfs_mrdump_lbaooo:s0
#############################
# debugfs files
#

5
r_non_plat/vendor_shell.te Normal file
View File

@ -0,0 +1,5 @@
# ==============================================
# MTK Policy Rule
# =============================================
# Purpose : allow vendor_shell to run aeev
allow vendor_shell aee_aedv_exec:file execute_no_trans;