[Detail]
There are some selinux violation for app in MTBF,
need to add some sepolicy for them.
[Solution]
1.Add sepolicy
2.Move sepolicy of untrusted_app_* to untrusted_app_*.te
3.Modify sepolicy
MTK-Commit-Id: 62b5c74c6d1d85acf0184fc18fca0b40c4a8e60c
Change-Id: Icac33ccc54b691ee0e4ab7088f77adb1c1a4a549
CR-Id: ALPS04640303
Feature: [Android Default] SELinux, SEAndroid, and SE-MTK
[Detail]
There is a workaround for bring-up,
now it needs to be modified.
[Solution]
1.Split workaround to sepcial *.te
2.Modify ged sepolicy
3.Modify mistake
4.Add sepolicy
MTK-Commit-Id: 5a2b7e3fdc826a7ca6bc70a3810f14c1661e7d79
Change-Id: I0894de45e014a5eae754e35b57fbc9b21bc4bf90
CR-Id: ALPS04639771
Feature: [Android Default] SELinux, SEAndroid, and SE-MTK
[Detail]
For Andorid Q, there is a more stringent restriction
for ioctl, app need to access pipe by ioctlcmd=0x5402.
avc: denied { ioctl } for comm="kd" path="pipe:[7173861]"
dev="pipefs" ino=7173861 ioctlcmd=0x5402
scontext=u:r:untrusted_app_25:s0:c512,c768
tcontext=u:r:untrusted_app_25:s0:c512,c768
tclass=fifo_file permissive=0 app=com.tencent.qqpimsecure
[Solution]
Add sepolicy for app to access pipe by ioctlcmd=0x5402
MTK-Commit-Id: d38b9f7f97aab7b23d80d0f3aac8e25a790c8c91
Change-Id: I5ac20bf2dffa0c297b32aaebd75db9e04c35cc79
CR-Id: ALPS04654001
Feature: [Android Default] SELinux, SEAndroid, and SE-MTK
[Detail]
In kernel 4.14, selinux security need to check if the process has the
map permission of mmap inode. App need the map permission to
read radio_data_file.
[Solution]
Add map permission for app to read radio_data_file.
MTK-Commit-Id: 698e603818ff37a59212a37a41ecbec8e8e30233
Change-Id: I8982ddbff40cfd7280c0a3dc5e8d2f6b6394e747
CR-Id: ALPS04653992
Feature: [Android Default] SELinux, SEAndroid, and SE-MTK
[Detail]
For Andorid Q, there is a more stringent restriction
for ioctl, app need to access proc_ged by ioctlcmds.
[Solution]
Add sepolicy for app to access proc_ged by ioctlcmds.
MTK-Commit-Id: 630cfe13e5928346453bb3800b75439d5e9e1235
Change-Id: I1bde81017e78d5b70fc78dd5fa148667360d2af4
CR-Id: ALPS04501651
Feature: Power Management
[Detail]
For Andorid Q, there is a more stringent restriction for ioctl,
app need some permissions to access proc_ged by ioctlcmd.
[Solution]
Add sepolicy for app to access proc_ged by
ioctlcmd=GED_BRIDGE_IO_BOOST_GPU_FREQ.
MTK-Commit-Id: 1d7bd0172f33336abcc94349978bbbd008f5fe9d
Change-Id: I62f422f072dc0881ea4c9f082a4c548b7164d58d
CR-Id: ALPS04449311
Feature: Power Management
[Detail]
For Andorid Q, there is a more stringent restriction for ioctl,
app need some permissions to access proc_ged by ioctlcmd.
[Solution]
Group existing sepolicies for different types app to access
proc_ged by ioctlcmd together in appdomain.
MTK-Commit-Id: e9ba9a00dbbc063388c8120048a72fd8f7ce497c
Change-Id: I24a4671259a68a0fda756d37c16b7e61801e6cc8
CR-Id: ALPS04428389
Feature: [Android Default] SELinux, SEAndroid, and SE-MTK
