Skip to content

Commit 68d3191

Browse files
TTTT555TTTT555
committed
Fix some denials
1 parent 71c3dcb commit 68d3191

17 files changed

+22
-15
lines changed

‎rootdir/etc/ueventd.qcom.rc

+3-2
Original file line numberDiff line numberDiff line change
@@ -221,8 +221,9 @@ subsystem msm_camera
221221
# drv2605 LRA vibrator
222222
/dev/drv2605 0660 system system
223223

224-
# Add device block for FRP
225-
/dev/block/bootdevice/by-name/config 0660 system system
224+
# Add device block for FRP (+sd_load)
225+
/dev/block/platform/soc.0/7824900.sdhci/by-name/config 0644 system system
226+
/dev/block/platform/soc.0/7864900.sdhci/by-name/config 0644 system system
226227

227228
# Libprocessgroup permissions
228229
/dev/acct/uid_* 0777 system system

‎sepolicy/vendor/bootanim.te

+1-1
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
allow bootanim vendor_file:file { read open execute getattr };
1+
allow bootanim vendor_file:file { rx_file_perms };

‎sepolicy/vendor/dex2oat.te

+1-1
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
allow dex2oat vendor_file:file { execute read open getattr };
1+
allow dex2oat vendor_file:file { rx_file_perms };

‎sepolicy/vendor/fsck_untrusted.te

+1-1
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
allow fsck_untrusted vendor_file:file { execute read open getattr };
1+
allow fsck_untrusted vendor_file:file { rx_file_perms };

‎sepolicy/vendor/kernel.te

+2
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,5 @@
11
allow kernel domain:process setsched;
22
allow kernel self:capability dac_override;
3+
allow kernel untrusted_app:fd use;
4+
allow kernel untrusted_app_25:fd use;
35
allow kernel untrusted_app_27:fd use;

‎sepolicy/vendor/logpersist.te

+1-1
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
allow logpersist vendor_file:file { execute read open getattr };
1+
allow logpersist vendor_file:file { rx_file_perms };

‎sepolicy/vendor/mediaserver.te

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,3 @@
11
allow mediaserver hal_lineage_camera_motor_hwservice:hwservice_manager { find };
22
allow mediaserver media_rw_data_file:file { read open execute getattr };
3-
allow mediaserver vendor_file:file { read open execute getattr };
3+
allow mediaserver vendor_file:file { rx_file_perms };

‎sepolicy/vendor/platform_app.te

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,2 @@
1-
allow platform_app vendor_file:file { open read getattr };
1+
allow platform_app vendor_file:file { r_file_perms };
22
allow platform_app init:binder { call transfer };

‎sepolicy/vendor/sdcardd.te

+1-1
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
allow sdcardd vendor_file:file { open read getattr execute };
1+
allow sdcardd vendor_file:file { rx_file_perms };

‎sepolicy/vendor/shell.te

+1-1
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
allow shell vendor_file:file { execute read open getattr };
1+
allow shell vendor_file:file { rx_file_perms };

‎sepolicy/vendor/surfaceflinger.te

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,2 @@
11
allow surfaceflinger default_android_service:service_manager { add find };
2-
allow surfaceflinger vendor_file:file { read open getattr execute };
2+
allow surfaceflinger vendor_file:file { rx_file_perms };

‎sepolicy/vendor/system_server.te

+1-1
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,6 @@ allow system_server sysfs_battery_supply:file r_file_perms;
99
allow system_server sysfs_sensors:lnk_file { read };
1010
allow system_server sysfs_sensors:dir { read open };
1111
allow system_server sysfs_vibrator:file r_file_perms;
12-
allow system_server vendor_file:file { execute open read write getattr };
12+
allow system_server vendor_file:file { rwx_file_perms };
1313
allow system_server default_android_hwservice:hwservice_manager { find };
1414
allow system_server init:binder { call };

‎sepolicy/vendor/untrusted_app.te

+2
Original file line numberDiff line numberDiff line change
@@ -28,3 +28,5 @@
2828
unix_socket_connect(untrusted_app,dpmtcm, dpmd);
2929
allow untrusted_app dpmtcm_socket:sock_file w_file_perms;
3030
allow untrusted_app dpmd:unix_stream_socket connectto;
31+
32+
allow untrusted_app vendor_file:file { r_file_perms };

‎sepolicy/vendor/untrusted_app_25.te

+2
Original file line numberDiff line numberDiff line change
@@ -28,3 +28,5 @@
2828
unix_socket_connect(untrusted_app_25,dpmtcm, dpmd);
2929
allow untrusted_app_25 dpmtcm_socket:sock_file w_file_perms;
3030
allow untrusted_app_25 dpmd:unix_stream_socket connectto;
31+
32+
allow untrusted_app_25 vendor_file:file { r_file_perms };

‎sepolicy/vendor/untrusted_app_27.te

+1-1
Original file line numberDiff line numberDiff line change
@@ -29,5 +29,5 @@ unix_socket_connect(untrusted_app_27,dpmtcm, dpmd);
2929
allow untrusted_app_27 dpmtcm_socket:sock_file w_file_perms;
3030
allow untrusted_app_27 dpmd:unix_stream_socket connectto;
3131
allow untrusted_app_27 proc_stat:file { open read getattr };
32-
allow untrusted_app_27 vendor_file:file { open read getattr };
32+
allow untrusted_app_27 vendor_file:file { r_file_perms };
3333
allow untrusted_app_27 sysfs_kgsl:file { open read getattr };

‎sepolicy/vendor/webview_zygote.te

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
11
allow webview_zygote zygote:unix_dgram_socket write;
22
allow webview_zygote proc_cmdline:file r_file_perms;
3-
#allow webview_zygote theme_data_file:dir search;
3+
#allow webview_zygote theme_data_file:dir { search };
44
#allow webview_zygote theme_data_file:file r_file_perms;

‎sepolicy/vendor/zygote.te

+1-1
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
allow zygote vendor_file:file { execute read open getattr };
1+
allow zygote vendor_file:file { rx_file_perms };

0 commit comments

Comments
 (0)