NekoSakura/android_device_mediatek_sepolicy
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

non_plat: Label wfca binary and grant required permissions

Browse Source 
Signed-off-by: Aayush Gupta <aayushgupta219@gmail.com>
Change-Id: I22832543e458ad1e3cc597911b8af347c92ccda5
This commit is contained in:
Aayush Gupta 2021-01-02 14:14:55 +05:30
parent 965100d2a9
commit a7d6f83b00
3 changed files with 25 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
non_plat/file.te
View File

@ -450,3 +450,4 @@ type vendor_teei_data_file, file_type, data_file_type;
# IMS
type volte_ua_socket, file_type;
type volte_imcb_socket, file_type;
type wfca_socket, file_type;

2
non_plat/file_contexts
View File

@ -714,9 +714,11 @@
# IMS
/dev/socket/volte_ua(/.*)? u:object_r:volte_ua_socket:s0
/dev/socket/volte_imcb(/.*)? u:object_r:volte_imcb_socket:s0
/dev/socket/wfca(/.*)? u:object_r:wfca_socket:s0
/(system\/vendor|vendor)/bin/bip u:object_r:bip_exec:s0
/(system\/vendor|vendor)/bin/epdg_wod u:object_r:epdg_wod_exec:s0
/(system\/vendor|vendor)/bin/volte_imsm_93 u:object_r:volte_imsm_93_exec:s0
/(system\/vendor|vendor)/bin/volte_md_status u:object_r:volte_md_status_exec:s0
/(system\/vendor|vendor)/bin/volte_ua u:object_r:volte_ua_exec:s0
/(system\/vendor|vendor)/bin/volte_imcb u:object_r:volte_imcb_exec:s0
/(system\/vendor|vendor)/bin/wfca u:object_r:wfca_exec:s0

22
non_plat/wfca.te Normal file
View File

@ -0,0 +1,22 @@
type wfca, domain, netdomain, mtkimsmddomain;
type wfca_exec, exec_type, file_type, vendor_file_type;
init_daemon_domain(wfca)
allow wfca wfca_socket:sock_file write;
allow wfca self:capability2 block_suspend;
allow wfca self:capability { setgid setuid net_admin net_raw };
allow wfca self:udp_socket { ioctl read write create getattr bind setopt shutdown };
allow wfca self:rawip_socket { read write create getattr bind setopt };
allow wfca self:packet_socket { read create setopt };
allow wfca socket_device:sock_file { write create unlink };
allow wfca socket_device:dir { write add_name remove_name };
allow wfca { node port }:{ udp_socket rawip_socket } node_bind;
allow wfca fwmarkd_socket:sock_file write;
allow wfca ccci_device:chr_file { ioctl read write open };
allow wfca sysfs_wake_lock:file { read write open };
dontaudit wfca self:capability dac_override;