NekoSakura/android_device_mediatek_sepolicy
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

non_plat: Label /dev/*rpmb* and grant tee permissions to manage it

Browse Source 
/dev/*rpmb* devices are accessed by tee. Label it and allow tee required
permissions to manage it.

Denial observed without this change:
[   46.559953] .(2)[399:logd.auditd]type=1400 audit(1609128921.644:391): avc: denied { ioctl } for comm="teei_daemon" path="/dev/rpmb0" dev="tmpfs" ino=17454 ioctlcmd=0x6 scontext=u:r:init:s0 tcontext=u:object_r:device:s0 tclass=chr_file permissive=1

Test: Boot and observe that denial no longer appears

Signed-off-by: Aayush Gupta <aayushgupta219@gmail.com>
Change-Id: I3499e2a3ba177b8e69d8cdbb76939daf3f8bbc7b
This commit is contained in:
Aayush Gupta 2020-12-28 12:16:17 +05:30
parent 03fc01b6f6
commit acd62758d9
3 changed files with 8 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
non_plat/device.te
View File

@ -273,7 +273,9 @@ type m_bio_misc_device, dev_type;
# Purpose : Add permission for gpu access
type dri_device, dev_type, mlstrustedobject;
# TEE
type teei_fp_device, dev_type;
type teei_rpmb_device, dev_type;
# Keymaster
type ut_keymaster_device, dev_type;

3
non_plat/file_contexts
View File

@ -694,6 +694,9 @@
# TEE
/dev/teei_fp u:object_r:teei_fp_device:s0
/dev/rpmb0 u:object_r:teei_rpmb_device:s0
/dev/emmcrpmb0 u:object_r:teei_rpmb_device:s0
/(vendor|system\/vendor)/bin/teei_daemon u:object_r:tee_exec:s0
/(vendor|system\/vendor)/bin/teei_loader u:object_r:tee_exec:s0

3
non_plat/tee.te
View File

@ -1 +1,4 @@
allow tee ut_keymaster_device:chr_file rw_file_perms;
allow tee teei_rpmb_device:chr_file rw_file_perms;
allow tee teei_rpmb_device:blk_file { read write ioctl open };