2bd9ab2104
[Detail]
For Andorid Q, there is a more stringent restriction
for ioctl, app need to access pipe by ioctlcmd=0x5402.
avc: denied { ioctl } for comm="kd" path="pipe:[7173861]"
dev="pipefs" ino=7173861 ioctlcmd=0x5402
scontext=u:r:untrusted_app_25:s0:c512,c768
tcontext=u:r:untrusted_app_25:s0:c512,c768
tclass=fifo_file permissive=0 app=com.tencent.qqpimsecure
[Solution]
Add sepolicy for app to access pipe by ioctlcmd=0x5402
MTK-Commit-Id: d38b9f7f97aab7b23d80d0f3aac8e25a790c8c91
Change-Id: I5ac20bf2dffa0c297b32aaebd75db9e04c35cc79
CR-Id: ALPS04654001
Feature: [Android Default] SELinux, SEAndroid, and SE-MTK
66 lines
1.8 KiB
Plaintext
66 lines
1.8 KiB
Plaintext
# ==============================================
|
|
# MTK Policy Rule
|
|
# ============
|
|
|
|
# Date : WK16.33
|
|
# Purpose: Allow to access ged for gralloc_extra functions
|
|
allow appdomain proc_ged:file rw_file_perms;
|
|
allowxperm appdomain proc_ged:file ioctl {
|
|
GED_BRIDGE_IO_LOG_BUF_GET
|
|
GED_BRIDGE_IO_LOG_BUF_WRITE
|
|
GED_BRIDGE_IO_LOG_BUF_RESET
|
|
GED_BRIDGE_IO_BOOST_GPU_FREQ
|
|
GED_BRIDGE_IO_MONITOR_3D_FENCE
|
|
GED_BRIDGE_IO_QUERY_INFO
|
|
GED_BRIDGE_IO_NOTIFY_VSYNC
|
|
GED_BRIDGE_IO_DVFS_PROBE
|
|
GED_BRIDGE_IO_DVFS_UM_RETURN
|
|
GED_BRIDGE_IO_EVENT_NOTIFY
|
|
GED_BRIDGE_IO_WAIT_HW_VSYNC
|
|
GED_BRIDGE_IO_QUERY_TARGET_FPS
|
|
GED_BRIDGE_IO_VSYNC_WAIT
|
|
GED_BRIDGE_IO_GPU_HINT_TO_CPU
|
|
GED_BRIDGE_IO_GE_ALLOC
|
|
GED_BRIDGE_IO_GE_GET
|
|
GED_BRIDGE_IO_GE_SET
|
|
GED_BRIDGE_IO_GPU_TIMESTAMP
|
|
GED_BRIDGE_IO_TARGET_FPS
|
|
GED_BRIDGE_IO_GE_INFO
|
|
GED_BRIDGE_IO_GPU_TUNER_STATUS
|
|
};
|
|
|
|
# Date : W16.42
|
|
# Operation : Integration
|
|
# Purpose : DRM / DRI GPU driver required
|
|
allow appdomain gpu_device:dir search;
|
|
|
|
# Date : W17.30
|
|
# Purpose : Allow MDP user access cmdq driver
|
|
allow appdomain mtk_cmdq_device:chr_file {open read ioctl};
|
|
|
|
# Date : W17.41
|
|
# Operation: SQC
|
|
# Purpose : Allow HWUI to access perfmgr
|
|
allow appdomain proc_perfmgr:dir search;
|
|
allow appdomain proc_perfmgr:file { getattr open read ioctl};
|
|
allowxperm appdomain proc_perfmgr:file ioctl {
|
|
PERFMGR_FPSGO_QUEUE
|
|
PERFMGR_FPSGO_DEQUEUE
|
|
PERFMGR_FPSGO_QUEUE_CONNECT
|
|
PERFMGR_FPSGO_BQID
|
|
};
|
|
|
|
# Date : W19.4
|
|
# Purpose : Allow MDP user access mdp driver
|
|
allow appdomain mdp_device:chr_file rw_file_perms;
|
|
|
|
# Date : W19.23
|
|
# Operation : Migration
|
|
# Purpose : For platform app com.android.gallery3d
|
|
allow { appdomain -isolated_app } radio_data_file:file rw_file_perms;
|
|
|
|
# Date : W19.23
|
|
# Operation : Migration
|
|
# Purpose : For app com.tencent.qqpimsecure
|
|
allowxperm appdomain appdomain:fifo_file ioctl SNDCTL_TMR_START;
|