NekoSakura/android_device_mediatek_sepolicy
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
1,139 Commits 2 Branches 0 Tags
Commit Graph

10 Commits

Author SHA1 Message Date
Aayush Gupta
5c601a9ada non_plat: Label /dev/ut_keymaster and allow relevant permissions to sources 
/dev/ut_keymaster is used by keymaster. Label it and allow relevant permissions
which domains using it (vold, tee and keymaster) requires.

Denial observed without this change:
[   46.666247] .(2)[399:logd.auditd]type=1400 audit(1609128921.744:392): avc: denied { ioctl } for comm="keymaster@3.0-s" path="/dev/ut_keymaster" dev="tmpfs" ino=17464 ioctlcmd=0x5402 scontext=u:r:hal_keymaster_default:s0 tcontext=u:object_r:device:s0 tclass=chr_file permissive=1

Test: Boot and notice that denial no longer appears

Signed-off-by: Aayush Gupta <aayushgupta219@gmail.com>
Change-Id: Iee0126d637a139397db8857d8a780277c3ea4576
 2020-12-30 16:14:46 +05:30
Aayush Gupta
590a77d53d non_plat: Allow vold to manage sysfs_mmcblk device 
During init, vold needs rw permissions in order to manage block devices.
This change allows the required permissions.

Denial observed without this change:
[    7.574441] .(1)[397:logd.auditd]type=1400 audit(1608975791.836:9): avc: denied { write } for comm="Binder:379_2" name="uevent" dev="sysfs" ino=35884 scontext=u:r:vold:s0 tcontext=u:object_r:sysfs_mmcblk:s0 tclass=file permissive=1

Test: Boot and observe that denial has disappeared

Signed-off-by: Aayush Gupta <aayushgupta219@gmail.com>
Change-Id: I3fa256cf5957f0af3fa2628833820f0f9fcf298b
 2020-12-28 00:45:07 +05:30
Denis Hsu
315c48bc5f [ALPS04667690] Add policy for format as internal 
add some policy to prevent form selinux violation
when formatting as internal.

MTK-Commit-Id: 11a1e82eea3751a833fdf92aea8b31012f948bdc

Change-Id: I44ea4c0b3eb2699a51d0cdf3881e2b4971c0c3cd
CR-Id: ALPS04667690
Feature: [Android Default] Download Manager
 2020-01-18 10:17:18 +08:00
Denis Hsu
346ca0c012 [ALPS04631260] skip selinux violation log for fstrim vendor folder 
vold cannot do fstrim on vendor folders (ex: nvdata, protect_f)
because of never allow rule.
Thus, skip selinux violation log for fstrim vendor folder.

MTK-Commit-Id: cf15f3ec6ae93e65c1f13b22f044e766a63eaece

Change-Id: I9c26ee000b8554df7abb03141ecf73a78d727f87
CR-Id: ALPS04631260
Feature: [Android Default] SELinux, SEAndroid, and SE-MTK
 2020-01-18 10:15:00 +08:00
bo.shang
84b0b8448d [ALPS04027460] Add selinux permission 
create mdlog folder in data for meta mode

MTK-Commit-Id: 0996cc7cf243909b06862c32f11b43194f20ca0c

Change-Id: I4e0f5aaab5cf5b363a0214b5ea8ce6e994dec69f
CR-Id: ALPS04027460
Feature: Modem Log Tool
 2020-01-18 10:05:34 +08:00
mtk12101
b086e609ac [ALPS03825066] Remove unused sepolicy 
[Detail] Because "ro.vendor.net.upload.benchmark.default"
is unlabeled property, so all use it will have name of
vendor_default_prop

[Solution] Need owner to relabel the property of
"ro.vendor.net.upload.benchmark.default"

MTK-Commit-Id: 3a772e2b252536c9bbe9829b75f3464c2df68248

Change-Id: I42f341bf01cea16a16a0e73d13e0c03b5c270dad
CR-Id: ALPS03825066
Feature: [Android Default] SELinux, SEAndroid, and SE-MTK
 2020-01-18 09:50:11 +08:00
mtk12101
78d7f51370 [ALPS03825066] Fix boot fail 
[Detail] System processes have no permission to access
vendor_default_prop

[Solution] Add get vendor_default_prop rule for system
processes

MTK-Commit-Id: 412119fb578fc32e9f046c09a13817cf3c755515

Change-Id: I791997e6bb44c61b69d32c6da0cc80c6f2a9759e
CR-Id: ALPS03825066
Feature: [Android Default] SELinux, SEAndroid, and SE-MTK
 2020-01-18 09:47:42 +08:00
Denis Hsu
977ad3f552 [ALPS03891225] Modify vold related policy 
[Detail]
1. remove md_ctrl.te because we dont use md_ctrl in P.
2. remove debugfs_tracing policy
3. remove nvdata, protect_f, protect_s policy

MTK-Commit-Id: d4e5c9893970f0b214b518cba5f9300f130eace9

Change-Id: Iaafc30124fd69ef2b989b9e4e51d71a37d9571e9
CR-Id: ALPS03891225
Feature: Multi-Storage
 2020-01-18 09:40:17 +08:00
Bo Ye
5849c224e3 [ALPS03825066] P migration selinux build failed fix 
1. Mark polices which accessing proc/sysfs file system
    2. Add violator attribute to modules violate vendor/system rule.

MTK-Commit-Id: 3954cad7a1428cda694d8428c2235a78aa6e7cc8

Change-Id: I401ae5b87eb9a03f324bef83c6678149606b15a8
CR-Id: ALPS03825066
Feature: [Android Default] SELinux, SEAndroid, and SE-MTK
 2020-01-18 09:29:36 +08:00
Chunyan Zhang
37e0caa36e import from mediatek/master to mediatek/alps-mp-o1.mp1 
Change-Id: Ic78db8195c5c51f85c9c6fd3ef8333489afd6e79
MTK-Commit-Id: 848bf57127be9d01fd1df4aab95737855456afee
 2020-01-18 09:29:32 +08:00