Skip to content

Commit 71c3dcb

Browse files
TTTT555TTTT555
committed
Add sepolicy denials for many GSIs
1 parent 85081b2 commit 71c3dcb

14 files changed

+62
-7
lines changed

‎sepolicy/private/priv.te

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
allow system_app storaged:binder call;
2-
allow storaged vendor_file:file { r_file_perms };
2+
allow storaged vendor_file:file { rx_file_perms };
33

44
allow storaged sysfs:file { r_file_perms };
55
allow storaged sysfs_disk_stat:file { r_file_perms };

‎sepolicy/vendor/blkid_untrusted.te

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
allow blkid_untrusted vendor_file:file { rx_file_perms };

‎sepolicy/vendor/cameraserver.te

+1
Original file line numberDiff line numberDiff line change
@@ -70,4 +70,5 @@ allow cameraserver vendor_file:file { rx_file_perms };
7070

7171
allow cameraserver video_device:chr_file { rw_file_perms };
7272
allow cameraserver hidl_allocator_hwservice:hwservice_manager { find };
73+
allow cameraserver default_android_hwservice:hwservice_manager { find };
7374

‎sepolicy/vendor/hwservicemanager.te

+2
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
allow hwservicemanager init:dir { r_dir_perms };
2+
allow hwservicemanager init:file { r_file_perms };

‎sepolicy/vendor/idmap.te

+1-1
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
allow idmap vendor_file:file { read execute getattr };
1+
allow idmap vendor_file:file { rx_file_perms };

‎sepolicy/vendor/init.te

+34-1
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,40 @@
11
allow init sysfs:file setattr;
22
allow init debugfs:file write;
33
allow init proc:file { r_file_perms };
4-
allow init system_file:file mounton;
4+
allow init system_file:file { mounton execute_no_trans };
5+
allow init platform_app:binder { call transfer };
6+
allow init servicemanager:binder { call };
7+
allow init hwservicemanager:binder { call };
8+
allow init system_server:binder { call transfer };
9+
allow init mediacodec:binder { call transfer };
10+
allow init mediaserver_service:service_manager { add find };
11+
allow init cameraserver_service:service_manager { add };
12+
allow init hal_camera_hwservice:hwservice_manager { find };
13+
allow init hidl_allocator_hwservice:hwservice_manager { find };
14+
allow init thermal_socket:sock_file { rw_file_perms };
15+
allow init thermal-engine:unix_stream_socket { connectto };
16+
allow init video_device:chr_file { rw_file_perms };
17+
allow init ion_device:chr_file { rw_file_perms };
18+
allow init mm-qcamerad:unix_dgram_socket { sendto };
19+
allow init hal_omx_hwservice:hwservice_manager { find };
20+
allow init processinfo_service:service_manager { find };
21+
allow init batterystats_service:service_manager { find };
22+
allow init appops_service:service_manager { find };
23+
allow init cameraproxy_service:service_manager { find };
24+
allow init hal_lineage_camera_motor_hwservice:hwservice_manager { find };
25+
allow init permission_service:service_manager { find };
26+
allow init media_rw_data_file:file { x_file_perms };
27+
allow init activity_service:service_manager { find };
28+
allow init vendor_file:file { rx_file_perms };
29+
allow init pmsg_device:chr_file { r_file_perms };
30+
allow init mediaextractor_service:service_manager { find };
31+
allow init mediaextractor:binder { call };
32+
allow init drmserver_service:service_manager { find };
33+
allow init drmserver:drmservice { openDecryptSession };
34+
allow init audioserver_service:service_manager { find };
35+
allow init audioserver:binder { call transfer };
36+
allow init hidl_memory_hwservice:hwservice_manager { find };
37+
allow init mediametrics_service:service_manager { find };
538

639

740
# required for LD_PRELOAD

‎sepolicy/vendor/location.te

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
allow location media_rw_data_file:file { rx_file_perms };

‎sepolicy/vendor/mediacodec.te

+1
Original file line numberDiff line numberDiff line change
@@ -1 +1,2 @@
11
r_dir_file(mediacodec, firmware_file)
2+
allow mediacodec init:binder { transfer };

‎sepolicy/vendor/platform_app.te

+1
Original file line numberDiff line numberDiff line change
@@ -1 +1,2 @@
11
allow platform_app vendor_file:file { open read getattr };
2+
allow platform_app init:binder { call transfer };

‎sepolicy/vendor/servicemanager.te

+5
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
allow servicemanager init:dir { search };
2+
allow servicemanager init:file { r_file_perms };
3+
allow servicemanager init:binder { transfer };
4+
allow servicemanager init:process { getattr };
5+
allow servicemanager init:binder { transfer };

‎sepolicy/vendor/sgdisk.te

+1-1
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
allow sgdisk vendor_file:file { open read getattr };
1+
allow sgdisk vendor_file:file { rx_file_perms };

‎sepolicy/vendor/system_server.te

+1
Original file line numberDiff line numberDiff line change
@@ -11,3 +11,4 @@ allow system_server sysfs_sensors:dir { read open };
1111
allow system_server sysfs_vibrator:file r_file_perms;
1212
allow system_server vendor_file:file { execute open read write getattr };
1313
allow system_server default_android_hwservice:hwservice_manager { find };
14+
allow system_server init:binder { call };

‎sepolicy/vendor/toolbox.te

+9-1
Original file line numberDiff line numberDiff line change
@@ -1 +1,9 @@
1-
allow toolbox vendor_file:file { read open getattr execute };
1+
allow toolbox vendor_file:file { rx_file_perms };
2+
allow toolbox init:fifo_file { rw_file_perms };
3+
allow toolbox property_socket:sock_file { rw_file_perms };
4+
allow toolbox init:unix_stream_socket { connectto };
5+
allow toolbox cache_file:dir { r_dir_perms };
6+
allow toolbox persist_file:dir { r_dir_perms };
7+
allow toolbox proc_filesystems:file { r_file_perms };
8+
allow toolbox vendor_overlay_file:dir { r_dir_perms };
9+
allow toolbox vendor_configs_file:dir { mounton };

‎sepolicy/vendor/vold.te

+3-2
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,3 @@
1-
allow vold vendor_file:file { open read getattr };
2-
allow vold_prepare_subdirs vendor_file:file { open read getattr };
1+
allow vold vendor_file:file { rx_file_perms };
2+
allow vold_prepare_subdirs vendor_file:file { rx_file_perms };
3+

0 commit comments

Comments
 (0)