f798441035
[Detail] Because Android P impose so many restrictions, it is difficult for meta mode or factory mode to format partitions. A new design is adopted as follows: 1. Meta mode or factory mode write all 0 to first 4KB of target partition. 2. When entering kernel booting, the partition mount process in the original init flow find that XXX partition is wiped and automatically format XXX partition. In step-1 described above, selinux rules shall be added for meta_tst or factory. In step-2 described above, selinux rules shall be added for mke2fs. MTK-Commit-Id: 7e9bbd418ca6353ba89ecffdc016c78504583bf3 Change-Id: I3dd869c57107b0ebebf3134f69c50744df8f8ff9 CR-Id: ALPS03957630 Feature: SP META Tool
395 lines
14 KiB
Plaintext
395 lines
14 KiB
Plaintext
# ==============================================
|
|
# Policy File of /vendor/bin/meta_tst Executable File
|
|
|
|
|
|
|
|
# ==============================================
|
|
# Type Declaration
|
|
# ==============================================
|
|
type meta_tst, domain;
|
|
type meta_tst_exec , exec_type, file_type, vendor_file_type;
|
|
init_daemon_domain(meta_tst)
|
|
|
|
# ==============================================
|
|
# MTK Policy Rule
|
|
# ==============================================
|
|
|
|
# Date: WK16.12
|
|
# Operation : Migration
|
|
# Purpose : for meta mode device node USB
|
|
allow meta_tst ttyGS_device:chr_file rw_file_perms;
|
|
|
|
# Date: WK16.12
|
|
# Operation : Migration
|
|
# Purpose : for meta mode device node UART
|
|
allow meta_tst ttyMT_device:chr_file rw_file_perms;
|
|
|
|
# Date: WK17.12
|
|
# Operation : Migration
|
|
# Purpose : for meta mode device node UART
|
|
allow meta_tst ttyS_device:chr_file rw_file_perms;
|
|
|
|
# Date: WK16.12
|
|
# Operation : Migration
|
|
# Purpose : for meta mode device node CCCI
|
|
allow meta_tst ccci_device:chr_file rw_file_perms;
|
|
allow meta_tst eemcs_device:chr_file rw_file_perms;
|
|
allow meta_tst emd_device:chr_file rw_file_perms;
|
|
allow meta_tst ttyACM_device:chr_file rw_file_perms;
|
|
allow meta_tst mdlog_device:chr_file rw_file_perms;
|
|
|
|
# Data: WK15.07
|
|
# Purpose : SDIO
|
|
allow meta_tst ttySDIO_device:chr_file rw_file_perms;
|
|
|
|
# Date: WK16.12
|
|
# Operation : Migration
|
|
# Purpose : for meta mode file system
|
|
allow meta_tst bootdevice_block_device:blk_file rw_file_perms;
|
|
allow meta_tst mmcblk1_block_device:blk_file rw_file_perms;
|
|
allow meta_tst userdata_block_device:blk_file rw_file_perms;
|
|
allow meta_tst cache_block_device:blk_file rw_file_perms;
|
|
|
|
# Date: WK16.12
|
|
# Operation : Migration
|
|
# Purpose : for meta mode nvram
|
|
allow meta_tst nvram_data_file:dir create_dir_perms;
|
|
allow meta_tst nvram_data_file:file create_file_perms;
|
|
allow meta_tst nvram_data_file:lnk_file r_file_perms;
|
|
allow meta_tst nvdata_file:lnk_file r_file_perms;
|
|
allow meta_tst nvdata_file:dir create_dir_perms;
|
|
allow meta_tst nvdata_file:file create_file_perms;
|
|
allow meta_tst nvram_device:chr_file rw_file_perms;
|
|
allow meta_tst nvram_device:blk_file rw_file_perms;
|
|
allow meta_tst nvdata_device:blk_file rw_file_perms;
|
|
|
|
# Date: WK14.47
|
|
# Operation : Migration
|
|
# Purpose : for meta mode audio
|
|
allow meta_tst audio_device:chr_file rw_file_perms;
|
|
allow meta_tst audio_device:dir r_dir_perms;
|
|
set_prop(meta_tst, audiohal_prop);
|
|
|
|
# Date: WK16.12
|
|
# Operation : Migration
|
|
# Purpose : for meta mode RTC and PMIC
|
|
allow meta_tst rtc_device:chr_file r_file_perms;
|
|
allow meta_tst MT_pmic_adc_cali_device:chr_file rw_file_perms;
|
|
|
|
# Date: WK14.45
|
|
# Operation : Migration
|
|
# Purpose : HDCP
|
|
allow meta_tst persist_data_file:dir create_dir_perms;
|
|
allow meta_tst persist_data_file:file create_file_perms;
|
|
|
|
|
|
# Date: WK14.46
|
|
# Operation : Migration
|
|
# Purpose : Camera
|
|
allow meta_tst cct_data_file:dir create_dir_perms;
|
|
allow meta_tst cct_data_file:file create_file_perms;
|
|
allow meta_tst devmap_device:chr_file rw_file_perms;
|
|
allow meta_tst camera_pipemgr_device:chr_file rw_file_perms;
|
|
allow meta_tst MTK_SMI_device:chr_file rw_file_perms;
|
|
allow meta_tst camera_isp_device:chr_file rw_file_perms;
|
|
allow meta_tst camera_sysram_device:chr_file r_file_perms;
|
|
allow meta_tst kd_camera_flashlight_device:chr_file rw_file_perms;
|
|
allow meta_tst kd_camera_hw_device:chr_file rw_file_perms;
|
|
allow meta_tst AD5820AF_device:chr_file rw_file_perms;
|
|
allow meta_tst DW9714AF_device:chr_file rw_file_perms;
|
|
allow meta_tst DW9714A_device:chr_file rw_file_perms;
|
|
allow meta_tst LC898122AF_device:chr_file rw_file_perms;
|
|
allow meta_tst LC898212AF_device:chr_file rw_file_perms;
|
|
allow meta_tst BU6429AF_device:chr_file rw_file_perms;
|
|
allow meta_tst DW9718AF_device:chr_file rw_file_perms;
|
|
allow meta_tst BU64745GWZAF_device:chr_file rw_file_perms;
|
|
allow meta_tst MAINAF_device:chr_file rw_file_perms;
|
|
allow meta_tst MAIN2AF_device:chr_file rw_file_perms;
|
|
allow meta_tst SUBAF_device:chr_file rw_file_perms;
|
|
|
|
# Date: WK16.12
|
|
# Operation : Migration
|
|
# Purpose : meta mode LCM
|
|
allow meta_tst graphics_device:chr_file rw_file_perms;
|
|
allow meta_tst graphics_device:dir search;
|
|
|
|
# Date: WK16.12
|
|
# Operation : Migration
|
|
# Purpose : meta mode sensor
|
|
allow meta_tst als_ps_device:chr_file r_file_perms;
|
|
allow meta_tst gsensor_device:chr_file r_file_perms;
|
|
allow meta_tst msensor_device:chr_file r_file_perms;
|
|
allow meta_tst gyroscope_device:chr_file r_file_perms;
|
|
|
|
# Date: WK16.12
|
|
# Operation : Migration
|
|
# Purpose : meta mode FM
|
|
allow meta_tst fm_device:chr_file rw_file_perms;
|
|
allow meta_tst FM50AF_device:chr_file rw_file_perms;
|
|
|
|
# Date: WK16.12
|
|
# Operation : Migration
|
|
# Purpose : meta mode wifi
|
|
allow meta_tst wmtWifi_device:chr_file w_file_perms;
|
|
|
|
# Date: WK16.12
|
|
# Operation : Migration
|
|
# Purpose : meta mode BT
|
|
allow meta_tst stpbt_device:chr_file rw_file_perms;
|
|
|
|
# Date: WK16.12
|
|
# Operation : Migration
|
|
# Purpose : meta mode GPS
|
|
#allow meta_tst gps_device:chr_file rw_file_perms;
|
|
#allow meta_tst gps_data_file:file create_file_perms;
|
|
#allow meta_tst gps_data_file:dir rw_dir_perms;
|
|
allow meta_tst gps_data_file:dir { write add_name search remove_name unlink};
|
|
allow meta_tst gps_data_file:file { read write open create getattr append setattr unlink lock};
|
|
allow meta_tst gps_data_file:lnk_file read;
|
|
allow meta_tst tmpfs:lnk_file read;
|
|
allow meta_tst agpsd_data_file:dir search;
|
|
allow meta_tst agpsd_data_file:sock_file write;
|
|
allow meta_tst mnld_device:chr_file rw_file_perms;
|
|
set_prop(meta_tst, mnld_prop);
|
|
|
|
# Date: WK16.12
|
|
# Operation : Migration
|
|
# Purpose : meta mode NFC
|
|
allow meta_tst mt6605_device:chr_file rw_file_perms;
|
|
|
|
#Date WK14.49
|
|
#Operation : Migration
|
|
#Purpose : DRM key installation
|
|
#allow meta_tst shell_exec:file rx_file_perms;
|
|
#allow meta_tst system_data_file:dir create;
|
|
allow meta_tst key_install_data_file:dir w_dir_perms;
|
|
allow meta_tst key_install_data_file:file create_file_perms;
|
|
|
|
# Date: WK14.51
|
|
# Purpose : set/get cryptfs cfg in sys env
|
|
allow meta_tst misc_device:chr_file rw_file_perms;
|
|
allow meta_tst proc_lk_env:file rw_file_perms;
|
|
|
|
# Purpose : FT_EMMC_OP_FORMAT_TCARD
|
|
allow meta_tst block_device:blk_file getattr;
|
|
allow meta_tst system_block_device:blk_file getattr;
|
|
#allow meta_tst fuse_device:chr_file getattr;
|
|
#allow meta_tst shell_exec:file r_file_perms;
|
|
|
|
# Date: WK15.52
|
|
# Purpose : NVRAM related LID
|
|
allow meta_tst pro_info_device:chr_file rw_file_perms;
|
|
|
|
# Date: WK15.14
|
|
# Purpose : CCT linker fail
|
|
allow meta_tst self:process execmem;
|
|
|
|
# Date: WK15.13
|
|
# Purpose: for nand project
|
|
allow meta_tst mtd_device:dir search;
|
|
allow meta_tst mtd_device:chr_file rw_file_perms;
|
|
|
|
# Date: WK15.38
|
|
# Purpose: M Migration for CCT linker fail
|
|
allow meta_tst sdcard_type:dir create_dir_perms;
|
|
allow meta_tst sdcard_type:file create_file_perms;
|
|
allow meta_tst mnt_user_file:dir search;
|
|
allow meta_tst mnt_user_file:lnk_file read;
|
|
allow meta_tst storage_file:lnk_file read;
|
|
|
|
# Date: WK16.17
|
|
# Purpose: N Migration For ccci sysfs node
|
|
allow meta_tst sysfs_ccci:dir search;
|
|
allow meta_tst sysfs_ccci:file r_file_perms;
|
|
|
|
#Date: W18.22
|
|
# Purpose: P Migration meta_tst get com port type/uart port info/boot mode/usb state/usb close
|
|
allow meta_tst sysfs_comport_type:file rw_file_perms;
|
|
allow meta_tst sysfs_uart_info:file rw_file_perms;
|
|
allow meta_tst sysfs_boot_mode:file rw_file_perms;
|
|
allow meta_tst sysfs_android_usb:file rw_file_perms;
|
|
allow meta_tst sysfs_android_usb:dir search;
|
|
allow meta_tst sysfs_usb_cmode:file rw_file_perms;
|
|
allow meta_tst sysfs_usb_cmode:dir search;
|
|
|
|
#Date: W16.17
|
|
# Purpose: N Migration For meta_tst load MD NVRAM database
|
|
# Detail avc log: [04-23-20:41:58][ 160.687655] <1>.(1)[230:logd.auditd]type=
|
|
#1400 audit(1262304165.560:24): avc: denied { read } for pid=228 comm=
|
|
#"meta_tst" name="mddb" dev="mmcblk0p20" ino=664 scontext=u:r:meta_tst:
|
|
#s0 tcontext=u:object_r:system_file:s0 tclass=dir permissive=0
|
|
allow meta_tst system_file:dir r_dir_perms;
|
|
|
|
# Date: WK16.18
|
|
# Purpose: for CCCI reboot modem
|
|
allow meta_tst gsm0710muxd_device:chr_file rw_file_perms;
|
|
|
|
# Date: WK16.20
|
|
# Purpose: meta_tst set sys.usb.config
|
|
#set_prop(meta_tst, system_radio_prop);
|
|
|
|
#Date: W16.33
|
|
# Purpose: N Migration For CCT
|
|
#allow meta_tst media_rw_data_file:dir { search read open getattr };
|
|
#allow meta_tst media_rw_data_file:file { write open read};
|
|
|
|
# Date : WK16.35
|
|
# Purpose : Update camera flashlight driver device file
|
|
allow meta_tst flashlight_device:chr_file rw_file_perms;
|
|
|
|
#Date: W16.36
|
|
# Purpose: meta_tst use libmeta_rat to write libsysenv
|
|
# Detail avc log:[ 25.307141] .(5)[264:logd.auditd]type=1400 audit(1469438818.570:7):
|
|
#avc: denied { read write } for pid=312 comm="meta_tst" name="mmcblk0p2" dev="tmpfs"
|
|
#ino=4561 scontext=u:r:meta_tst:s0 tcontext=u:object_r:para_block_device:s0 tclass=blk_file permissive=0
|
|
allow meta_tst para_block_device:blk_file { read write open };
|
|
|
|
#Date: W16.44
|
|
allow meta_tst nvcfg_file:dir { search read open };
|
|
|
|
#Date: W16.45
|
|
# Purpose : Allow unmount sdcardfs mounted on /data/media
|
|
allow meta_tst sdcard_type:filesystem unmount;
|
|
#allow meta_tst toolbox_exec:file { getattr execute execute_no_trans read open };
|
|
allow meta_tst storage_stub_file:dir search;
|
|
|
|
# Date : WK16.19
|
|
# Operation: meta_tst set persist.meta.connecttype property
|
|
# Purpose: Switch meta connect type, set persist.meta.connecttype as "wifi" or "usb".
|
|
set_prop(meta_tst, meta_connecttype_prop);
|
|
|
|
# Date : WK16.23
|
|
# Purpose: support meta_tst check key event
|
|
allow meta_tst input_device:dir r_dir_perms;
|
|
allow meta_tst input_device:chr_file r_file_perms;
|
|
|
|
# Date : WK16.29
|
|
# Purpose: support meta mode show string on screen
|
|
allow meta_tst ashmem_device:chr_file execute;
|
|
|
|
#Date: W16.50
|
|
# Purpose : Allow meta_tst stop service which occupy data partition.
|
|
allow meta_tst ctl_default_prop:property_service set;
|
|
|
|
#Date: W17.25
|
|
# Purpose : Allow meta_tst stop service which occupy data partition.
|
|
allow meta_tst ctl_emdlogger1_prop:property_service set;
|
|
|
|
#Date: W17.27
|
|
# Purpose : Allow meta_tst read /data/nvram link
|
|
#allow meta_tst system_data_file:lnk_file read;
|
|
|
|
#Date: W17.27
|
|
# Purpose: STMicro NFC solution integration
|
|
allow meta_tst st21nfc_device:chr_file { open read write ioctl };
|
|
#allow meta_tst factory_data_file:sock_file { write unlink };
|
|
#allow meta_tst nfc_socket:dir search;
|
|
allow meta_tst vendor_file:file { getattr execute execute_no_trans read open };
|
|
set_prop(meta_tst,hwservicemanager_prop);
|
|
hwbinder_use(meta_tst);
|
|
hal_client_domain(meta_tst, hal_nfc);
|
|
allow meta_tst debugfs_tracing:file { open write };
|
|
|
|
# Date: W17.29
|
|
# Purpose : Allow meta_tst to call vendor.mediatek.hardware.keymaster_attestation@1.0-service.
|
|
hal_client_domain(meta_tst, mtk_hal_keyattestation)
|
|
|
|
# Date : WK17.30
|
|
# Operation : Android O migration
|
|
# Purpose : add sepolicy for accessing sysfs_leds
|
|
allow meta_tst sysfs_leds:lnk_file read;
|
|
allow meta_tst sysfs_leds:file rw_file_perms;
|
|
allow meta_tst sysfs_leds:dir r_dir_perms;
|
|
|
|
# Date: WK17.43
|
|
# Purpose: add permission for meta_tst access md image
|
|
allow meta_tst md_block_device:blk_file { read open };
|
|
allow meta_tst mddb_data_file:file { create open write read getattr};
|
|
allow meta_tst mddb_data_file:dir { search write add_name create getattr read open };
|
|
|
|
# Date: W17.43
|
|
# Purpose : meta connect with mdlogger by socket.
|
|
#allow meta_tst emdlogger:unix_stream_socket connectto;
|
|
|
|
# Date: W17.43
|
|
# Purpose : meta connect with mobilelog by socket.
|
|
#allow meta_tst mobile_log_d:unix_stream_socket connectto;
|
|
|
|
# Date: W17.43
|
|
# Purpose : meta access mobile log.
|
|
#allow meta_tst logtemp_data_file:dir { relabelto create_dir_perms };
|
|
#allow meta_tst logtemp_data_file:file create_file_perms;
|
|
#allow meta_tst data_tmpfs_log_file:dir create_dir_perms;
|
|
#allow meta_tst data_tmpfs_log_file:file create_file_perms;
|
|
|
|
# Date: W17.43
|
|
# Purpose meta access on /data/mdlog
|
|
#allow meta_tst mdlog_data_file:dir { create_dir_perms relabelto };
|
|
#allow meta_tst mdlog_data_file:fifo_file { create_file_perms };
|
|
#allow meta_tst mdlog_data_file:file { create_file_perms };
|
|
#allow meta_tst system_data_file:dir { create_dir_perms relabelfrom};
|
|
|
|
# Date: W17.43
|
|
# Purpose : Allow meta_tst to call android.hardware.audio@2.0-service-mediatek
|
|
binder_call(meta_tst, mtk_hal_audio)
|
|
allow meta_tst mtk_hal_audio:binder call;
|
|
allow meta_tst hal_audio_hwservice:hwservice_manager find;
|
|
allow meta_tst mtk_audiohal_data_file:dir {read search open};
|
|
allow meta_tst proc:file {read open};
|
|
allow meta_tst audio_device:chr_file rw_file_perms;
|
|
allow meta_tst audio_device:dir w_dir_perms;
|
|
allow meta_tst audiohal_prop:property_service set;
|
|
|
|
#Data:W1745
|
|
# Purpose : Allow meta_tst to open and read proc/bootprof
|
|
allow meta_tst proc_bootprof:file {write open read};
|
|
|
|
# Date:W17.51
|
|
# Operation : lbs hal
|
|
# Purpose : lbs hidl interface permission
|
|
hal_client_domain(meta_tst, mtk_hal_lbs)
|
|
|
|
# Data:W1750
|
|
# Purpose : Allow meta_tst to access mtd device
|
|
allow meta_tst mtd_device:blk_file rw_file_perms;
|
|
|
|
#Date: W17.51
|
|
#Purpose : Allow meta_tst to access pesist.atm.mdmode in ATM.
|
|
set_prop(meta_tst, atm_mdmode_prop);
|
|
|
|
#Date: W17.51
|
|
#Purpose : Allow meta_tst to access pesist.atm.ipaddress in ATM.
|
|
set_prop(meta_tst, atm_ipaddr_prop);
|
|
|
|
# Date : WK18.16
|
|
# Operation: P migration
|
|
# Purpose: Allow meta_tst to get tel_switch_prop
|
|
get_prop(meta_tst, tel_switch_prop)
|
|
|
|
# Date : WK18.21
|
|
# Operation: P migration
|
|
# Purpose : Allow meta_tst to call nvram hal
|
|
allow meta_tst nvram_agent_binder_hwservice:hwservice_manager find;
|
|
allow meta_tst nvram_agent_binder:binder call;
|
|
|
|
# Date : WK18.21
|
|
# Operation: P migration
|
|
# Purpose : Allow meta_tst to write misc partition
|
|
allow meta_tst block_device:dir search;
|
|
|
|
# Date : W18.24
|
|
# Operation: P migration
|
|
# Purpose : Allow meta_tst to access tpd sysfs nodes for CTP test
|
|
allow meta_tst sysfs_tpd_setting:dir search;
|
|
allow meta_tst sysfs_tpd_setting:file { read getattr open };
|
|
|
|
# Date : WK18.24
|
|
# Operation: P migration
|
|
# Purpose : Allow meta_tst to unmount partition, stop service, and then erase partition
|
|
allow meta_tst vendor_shell_exec:file { read execute open execute_no_trans };
|
|
allow meta_tst vendor_toolbox_exec:file { execute_no_trans };
|
|
allow meta_tst labeledfs:filesystem { unmount };
|
|
allow meta_tst proc_cmdline:file { read open getattr };
|
|
allow meta_tst meta_tst:capability { sys_admin };
|
|
allow meta_tst sysfs_dt_firmware_android:file { read open getattr };
|
|
allow meta_tst sysfs_dt_firmware_android:dir { read open search }; |