diff --git a/non_plat/connsyslogger.te b/non_plat/connsyslogger.te new file mode 100755 index 0000000..5f0aadc --- /dev/null +++ b/non_plat/connsyslogger.te @@ -0,0 +1,83 @@ + +# Policy File of /vendor/bin/connsyslogger Executable File + +# ============================================== +# Type Declaration +# ============================================== +type connsyslogger,domain; +type connsyslogger_exec, exec_type, file_type, vendor_file_type; +typeattribute connsyslogger mlstrustedsubject; + +# ============================================== +# MTK Policy Rule +# ============================================== +init_daemon_domain(connsyslogger) + + +#allow connsyslogger to set property +allow connsyslogger vendor_consyslogger_prop:property_service set; +allow connsyslogger debug_prop:property_service set; +allow connsyslogger persist_mtklog_prop:property_service set; +#allow connsyslogger system_radio_prop:property_service set; + +#stpwmt device for connsyslogger +allow connsyslogger stpwmt_device:chr_file { rw_file_perms }; + + +#for logging sdcard access +allow connsyslogger fuse:dir { create_dir_perms }; +allow connsyslogger fuse:file { create_file_perms }; + +#consys logger access on /data/consyslog +allow connsyslogger consyslog_data_file:dir { create_dir_perms relabelto }; +allow connsyslogger consyslog_data_file:fifo_file { create_file_perms }; +allow connsyslogger consyslog_data_file:file { create_file_perms }; +#allow connsyslogger system_data_file:dir { create_dir_perms relabelfrom}; + +#file_type_auto_trans(connsyslogger, system_data_file, consyslog_data_file) + +#consys logger socket access +allow connsyslogger property_socket:sock_file write; +allow connsyslogger init:unix_stream_socket connectto; +#allow connsyslogger platform_app:unix_stream_socket connectto; +#allow connsyslogger shell_exec:file { rx_file_perms }; +#allow connsyslogger system_file:file execute_no_trans; +#allow connsyslogger zygote_exec:file { rx_file_perms }; + +allow connsyslogger tmpfs:lnk_file { create_file_perms }; + +# purpose: avc: denied { read } for name="plat_file_contexts" +allow connsyslogger file_contexts_file:file { read getattr open }; + +#logger SD logging in factory mode +allow connsyslogger vfat:dir create_dir_perms; +allow connsyslogger vfat:file create_file_perms; + +#logger permission in storage in android M version +allow connsyslogger mnt_user_file:dir search; +allow connsyslogger mnt_user_file:lnk_file read; +allow connsyslogger storage_file:lnk_file read; +#allow connsyslogger self:capability { chown dac_override }; +allow connsyslogger proc:file {setattr write read open}; + +#permission for use SELinux API +allow connsyslogger rootfs:file r_file_perms; + +#permission for storage access storage +allow connsyslogger storage_file:dir { create_dir_perms }; +allow connsyslogger storage_file:file { create_file_perms }; + +#permission for read boot mode +allow connsyslogger sysfs_boot:file { read open }; + +allow connsyslogger fw_log_wifi_device:chr_file {read write open ioctl}; +allow connsyslogger fw_log_bt_device:chr_file {read write open ioctl}; +allow connsyslogger fw_log_gps_device:chr_file {read write open ioctl}; +allow connsyslogger fw_log_wmt_device:chr_file {read write open ioctl}; + +allow connsyslogger sdcardfs:dir { create_dir_perms }; +allow connsyslogger sdcardfs:file { create_file_perms }; +allow connsyslogger rootfs:lnk_file getattr; + +#allow connsyslogger media_rw_data_file:file { create_file_perms }; +#allow connsyslogger media_rw_data_file:dir { create_dir_perms }; diff --git a/non_plat/file.te b/non_plat/file.te index 23f85f7..78dad5f 100644 --- a/non_plat/file.te +++ b/non_plat/file.te @@ -242,3 +242,6 @@ type mddb_data_file, file_type, data_file_type; # Date : WK1814 # Purpose : for factory to get boot mode type sysfs_boot, fs_type, sysfs_type; + +# consys Log folder +type consyslog_data_file, file_type, data_file_type; diff --git a/non_plat/file_contexts b/non_plat/file_contexts index a620887..c900e4a 100644 --- a/non_plat/file_contexts +++ b/non_plat/file_contexts @@ -60,6 +60,7 @@ /data/vendor/audiohal(/.*)? u:object_r:mtk_audiohal_data_file:s0 /data/vendor/powerhal(/.*)? u:object_r:mtk_powerhal_data_file:s0 #/data/vendor/nfc(/.*)? u:object_r:nfc_data_file:s0 +/data/vendor/connsyslog(/.*)? u:object_r:consyslog_data_file:s0 # Misc data #/data/misc/acdapi(/.*)? u:object_r:acdapi_data_file:s0 @@ -539,6 +540,7 @@ /(system\/vendor|vendor)/bin/ccci_mdinit u:object_r:ccci_mdinit_exec:s0 /(system\/vendor|vendor)/bin/mnld u:object_r:mnld_exec:s0 +/(system\/vendor|vendor)/bin/connsyslogger u:object_r:connsyslogger_exec:s0 /(system\/vendor|vendor)/bin/sysenv_daemon u:object_r:sysenv_daemon_exec:s0 /(system\/vendor|vendor)/bin/biosensord_nvram u:object_r:biosensord_nvram_exec:s0 diff --git a/non_plat/property.te b/non_plat/property.te index 3d7f831..2433ca3 100644 --- a/non_plat/property.te +++ b/non_plat/property.te @@ -171,3 +171,7 @@ type atm_mdmode_prop, property_type; #============= atm ip address property ============== type atm_ipaddr_prop, property_type; + +#=============allow consyslogger============== +type vendor_consyslogger_prop, property_type, mtk_core_property_type; + diff --git a/non_plat/property_contexts b/non_plat/property_contexts index 8863fcb..79bf826 100644 --- a/non_plat/property_contexts +++ b/non_plat/property_contexts @@ -180,3 +180,6 @@ persist.atm.mdmode u:object_r:atm_mdmode_prop:s0 #============= atm ip address property(ATM) ============== persist.atm.ipaddress u:object_r:atm_ipaddr_prop:s0 + +#=============allow consyslogger============== +vendor.consyslogger u:object_r:vendor_consyslogger_prop:s0 diff --git a/non_plat/vendor_app.te b/non_plat/vendor_app.te index d738ace..c9004b2 100644 --- a/non_plat/vendor_app.te +++ b/non_plat/vendor_app.te @@ -47,6 +47,7 @@ allow vendor_app vendor_app_file:lnk_file { open getattr read }; unix_socket_connect(vendor_app, mnld, mnld); #============= vendor_app ============== allow vendor_app mnld:unix_stream_socket connectto; +allow vendor_app connsyslogger:unix_stream_socket connectto; # PMTKLoggerProxy need copy exception db from data/vendor folder allow vendor_app aee_exp_data_file:file r_file_perms; allow vendor_app aee_exp_data_file:dir r_dir_perms;