/dev/tee* are accessed by domains that interact with TEE and thus
require access to them too.
Test: Boot and observe that denials are not visible in logs anymore
Signed-off-by: Aayush Gupta <aayushgupta219@gmail.com>
Change-Id: I7b0944a1063da8561d2928e4110674ce4845ecea
/dev/*rpmb* devices are accessed by tee. Label it and allow tee required
permissions to manage it.
Denial observed without this change:
[ 46.559953] .(2)[399:logd.auditd]type=1400 audit(1609128921.644:391): avc: denied { ioctl } for comm="teei_daemon" path="/dev/rpmb0" dev="tmpfs" ino=17454 ioctlcmd=0x6 scontext=u:r:init:s0 tcontext=u:object_r:device:s0 tclass=chr_file permissive=1
Test: Boot and observe that denial no longer appears
Signed-off-by: Aayush Gupta <aayushgupta219@gmail.com>
Change-Id: I3499e2a3ba177b8e69d8cdbb76939daf3f8bbc7b
/dev/ut_keymaster is used by keymaster. Label it and allow relevant permissions
which domains using it (vold, tee and keymaster) requires.
Denial observed without this change:
[ 46.666247] .(2)[399:logd.auditd]type=1400 audit(1609128921.744:392): avc: denied { ioctl } for comm="keymaster@3.0-s" path="/dev/ut_keymaster" dev="tmpfs" ino=17464 ioctlcmd=0x5402 scontext=u:r:hal_keymaster_default:s0 tcontext=u:object_r:device:s0 tclass=chr_file permissive=1
Test: Boot and notice that denial no longer appears
Signed-off-by: Aayush Gupta <aayushgupta219@gmail.com>
Change-Id: Iee0126d637a139397db8857d8a780277c3ea4576
/dev/teei_fp is used by fingerprint to communicate with Microtrust TEE drivers to
store fingerprint data on the device. Label it and allow relevant source required
permissions.
Denial observed without this change:
[ 17.672144] .(4)[397:logd.auditd]type=1400 audit(1608975801.860:326): avc: denied { ioctl } for comm="fingerprint@2.1" path="/dev/teei_fp" dev="tmpfs" ino=15742 ioctlcmd=0x5402 scontext=u:r:hal_fingerprint_default:s0 tcontext=u:object_r:device:s0 tclass=chr_file permissive=1
Test: Boot and notice denials have disappeared
Signed-off-by: Aayush Gupta <aayushgupta219@gmail.com>
Change-Id: I8a7445400be241e81f8bf21347967b85381ed3ec
[Detail]
New ST NFC stack for Android compatible with native SecureElement service.
Added also SE HAL for ST54H (SPI) support.
SE HAL files are for internal reference only.
MTK-Commit-Id: 1ad8ab131a2acbdf66133db290e4206627a5f50b
Change-Id: Ief43e503b7147ab96185100ae3c02ecb2ce82640
CR-Id: ALPS04709027
Feature: NFC Chipset Capability
[Detail]
Only BASIC Sepolicy need to be applyed for BASIC,
we separate basic/bsp sepolicy for BASIC.
This workaround is for fixing the build errors that
cause by the declarations were defined in bsp/ dir
and neverallow rules.
MTK-Commit-Id: f1ed54e84b85f73e20dcc8c2ac5f0c42fddedc77
Change-Id: I568873fcc272d04b018efc4be00924b751bb3775
CR-Id: ALPS04340791
Feature: [Android Default] SELinux, SEAndroid, and SE-MTK
[Detail]
Add sepolicy access right for Hifi3 adsp device.
Mobilelog and AED will need these access right.
MTK-Commit-Id: 06ac39d7cebbab2bcb3468fcf14f19b7e1489819
Change-Id: Ic834ac687b4423500ef6036824a6d6f75e57ccb3
CR-Id: ALPS03738758
Feature: [Module]Audio OpenDSP
[Detail]
Add poilcy for update_engine and vbmeta so that A/B
system update can work well.
MTK-Commit-Id: de7ad7a48111b4e02f042600c6e65484d03ac87f
Change-Id: I79346615ad1be4c5ea33343c1fce73c22be1f82f
CR-Id: ALPS03783870
Feature: Secure Boot
[Detail]add a mtk_mdp_device lable and a allow rule for VP
[Solution]add a mtk_mdp_device lable and a allow rule for VP
MTK-Commit-Id: d015c8eba69f036e0f4770e045b1c99bd4d6c8c5
Change-Id: I9b72360ae4a31d849d8e6ada94d4ee8c49f36b1b
CR-Id: ALPS03598446
Feature: [Module]MDP Driver
(cherry picked from commit e10343315224b4b166767bc7e19fa0b14cc06892)
[Detail]
add dev policy for fw_log_gps
[Solution]
add dev policy for fw_log_gps
MTK-Commit-Id: 4435dfa949ec7886ca9015a93bcf175568ab1621
Change-Id: I88a56ee23d456e5d43036fba79acd34ce024d35d
CR-Id: ALPS03866092
Feature: MTKLogger
(cherry picked from commit aa7953e06029de4ad0bcc0e615aef842eedc6460)
(cherry picked from commit ffa21f0c868c50daeff539f7be970d5398d8c3e6)
