aboutsummaryrefslogtreecommitdiff
path: root/sepolicy (follow)
Commit message (Collapse)AuthorAge
* msm8996-common: sepolicy: Give vendor_file the permission to write to sysfsDavide Garberi2019-04-11
| | | | Change-Id: Ie210f27a1dd3d79c50a49c6b024019464227bdd7
* msm8996-common: sepolicy: Remove duplicated CNE typesDavide Garberi2019-03-30
| | | | | | * Added in platform by https://github.com/LineageOS/android_device_qcom_sepolicy/commit/a7143aa372d9004eeeb69a50221a5324d59cb5b6 Change-Id: I328a46b45d651aeb54665c2453390adbb767de20
* msm8996-common: sepolicy: Don't audit dac_override for hal_perf_default eitherDavide Garberi2019-03-24
| | | | Change-Id: I790167bf413bb1166e63972ab321e2278cbabbfc
* msm8996-common: sepolicy: Silence hal_perf_default dac_* denialsdianlujitao2019-03-22
| | | | Change-Id: Icaefcf91ea08813bb84ce33effec44d037bd5145
* msm8996-common: Remove irq related labelsDavide Garberi2019-03-21
| | | | | | * This is useful without msm_irqbalance Change-Id: I500abb9dab85a4132210a9557f7ce3febaceadbb
* msm8996-common: sepolicy: Changes needed for CAF's new haptics driverSubhajeet Muhuri2019-03-17
| | | | | Change-Id: Ib8cbdbd0088ffb9b74e27404937f0387e728e229 Signed-off-by: Davide Garberi <dade.garberi@gmail.com>
* msm8996-common: remove useless NFC referenceskubersharma0012019-03-08
| | | | | | | * z2_plus/row do not support NFC so its useless to have these * fixes random log saying this device has no NFC Change-Id: Idc0d97b42dff1f826efb35808b3998f40be98a7b
* msm8996-common: sepolicy: CleanupDavide Garberi2019-03-03
| | | | | | | | | | * genfs_context cleanup after b5b41d341dd744c40d3908550daaafcee6fe7b4b in which it has randomly been imported from Marlin * Slightly cleanup indentation * Remove a lot of domains which were being used in genfs_context as most of it is already labelled differently in qcom common sepolicy and already addressed * Remove violators where not needed * Remove some old properties we're not using anymore Change-Id: Ic72853dfaf71ba3f0596e75d1bdd5b5c93cd70be
* msm8996-common: Set the hardware wlan mac using wcg_mac_toolDavide Garberi2019-03-02
| | | | | | | | | * Bin extracted from ZUI * Add init.wlan.sh to check if the mac address in wlan_mac.bin is already correct, if not correct it * Run both the bins on boot completed as wcg can't run earlier * Label both the bins and address their denials Change-Id: I7a8001465ec9c3d69bd228efa57dddfdd8e3c6f3
* msm8996-common: Remove readmacDavide Garberi2019-03-02
| | | | | | * We don't need this anymore, no random mac because the real hardware wlan mac works now Change-Id: I13f85f4eb438b2230408d5bad1c694b2cd39a25b
* msm8996-common: Remove aptx supportDavide Garberi2019-02-24
| | | | | | * We don't support this on stoct. Change-Id: Ic690330d1c063cec7f3bca049c0bf27967e7e36c
* msm8996-common: sepolicy: Address healthd denial on offline chargingWang Han2019-02-19
| | | | Change-Id: Ib5d3a671d94012fdcf8926e59821470857d41811
* msm8996-common: Fix a charger neverallowDavide Garberi2019-02-19
| | | | Change-Id: I050c47c495625cc769a2f6549f8f68ed8be07d6a
* msm8996-common: sepolicy: Update for touch HALDavide Garberi2019-02-11
| | | | | Change-Id: Ifec612cc608fcd4b7d72892e7921e238be4672e0 Signed-off-by: Davide Garberi <dade.garberi@gmail.com>
* msm8996-common: Replace KeyDisabler class with Touch HALBruno Martins2019-02-11
| | | | | Change-Id: I7b87ae0ad834ba02a78696afe393d9d4f8920fbd Signed-off-by: Davide Garberi <dade.garberi@gmail.com>
* msm8996-common: sepolicy: Make healthd permissiveDavide Garberi2019-02-07
| | | | | | | | | * Not the best solution but I can't think of any other solution at the moment * It shouldn't anyway be a security problem as this domain is used only for charger * Fixes offline charging completely Signed-off-by: Davide Garberi <dade.garberi@gmail.com> Change-Id: I7379724a0550553e0fd6ab4f470bd9439c093936
* msm8996-common: sepolicy: Address some denialsDavide Garberi2019-02-06
| | | | | | | | * Don't break any neverallows this time * Still healthd missing to fix Signed-off-by: Davide Garberi <dade.garberi@gmail.com> Change-Id: I861eb5dc1f91e7cdea2e7b55c617e55a24ec2e02
* msm8996-common: sepolicy: Label custom camera socketsMichael Bestas2019-02-06
| | | | | | | | | * Normal path is /data/vendor/camera, defined in device/qcom/sepolicy * We have hex edited 6.0 blobs from /data/misc/camera to /data/vendor/qcam because of the new path string being longer than the old one Signed-off-by: Davide Garberi <dade.garberi@gmail.com> Change-Id: Ib96191dd55aea0c20c58a16bf1a91a46f07367e6
* msm8996-common: sepolicy: Nuke the neverallowsDavide Garberi2019-02-06
| | | | | | | * Also fix other general sepolicy errors after stopping to ignore the neverallows Change-Id: I1af3d9f57a0ca6e37420094a53f1c52127f3e187 Signed-off-by: Davide Garberi <dade.garberi@gmail.com>
* msm8996-common: sepolicy: Address some denialsDavide Garberi2019-01-27
| | | | | Signed-off-by: Davide Garberi <dade.garberi@gmail.com> Change-Id: Ibd1ea0a8b32fc4e87bf912a87339f7bc2a31d423
* msm8996-common: sepolicy: Resolve health denials after upreving to 2.0Subhajeet Muhuri2019-01-26
| | | | Signed-off-by: Davide Garberi <dade.garberi@gmail.com>
* msm8996-common: sepolicy: Remove a location adressDavide Garberi2019-01-26
| | | | | | Signed-off-by: Davide Garberi <dade.garberi@gmail.com> Change-Id: Ic8c90812fd61ec921b0bec5ddc2f20555afa4c0c Signed-off-by: Davide Garberi <dade.garberi@gmail.com>
* msm8996-common: Remove CNE HAL entries.Devi Sandeep Endluri V V2019-01-19
| | | | | | | | | CNE Hals moved to Factory Hal implementation. Removing the Hal entries for the same. CRs-Fixed: 2295302 Change-Id: Ifd7b605e3b9824951e111108c664ec0cde37fe83 Signed-off-by: Davide Garberi <dade.garberi@gmail.com>
* msm8996-common: sepolicy: Nuke some charger neverallowsDavide Garberi2019-01-19
| | | | | Change-Id: Ia01969378d79aa6ca1a81ad3bf9cf2acd39be051 Signed-off-by: Davide Garberi <dade.garberi@gmail.com>
* msm8996-common: sepolicy: Remove most neverallowsDavide Garberi2018-12-27
| | | | | Change-Id: Ie5569ba587b47e23aab07108cf5bb483d7177f50 Signed-off-by: Davide Garberi <dade.garberi@gmail.com>
* msm8996-common: Address a dpmQmiMgr denialdavidevinavil2018-12-04
| | | | | Change-Id: Ie829e0ec1e640578bd7c0aa92c32a1caee62dab9 Signed-off-by: Davide Garberi <dade.garberi@gmail.com>
* msm8996-common: Rename Widevine HIDL service to v1.1.Edwin Wong2018-11-20
| | | | | | | | | | | | | | | Widevine HIDL service added new v1.1 media APIs, the service version is updated to 1.1. Test: Netflix and Play Movies & TV (streaming and offline playback) Test: GTS WidevineH264PlaybackTests test e.g. ANDROID_BUILD_TOP= ./android-gts/toolsefed run gts -m GtsMediaTestCases --test com.google.android.media.gts.WidevineH264PlaybackTests#testL1With480P30 bug: 69674645 Change-Id: I7b8966c5fe2c2ded4a86b4358511548426de76dc Signed-off-by: Davide Garberi <dade.garberi@gmail.com>
* msm8996-common: sepolicy: CleanupDavide Garberi2018-10-31
| | | | | | | * Mostly squash the various macros Change-Id: I1e71a6d728cd4d7e7be057604978264c429aed90 Signed-off-by: Davide Garberi <dade.garberi@gmail.com>
* msm8996-common: sepolicy: Address some denialsDavide Garberi2018-10-31
| | | | | | | * No new neverallows generated Change-Id: If50b0f173fe858470fb98e83d8b7621bcffb64ff Signed-off-by: Davide Garberi <dade.garberi@gmail.com>
* msm8996-common: sepolicy: Move neverallows to neverallows.teDavide Garberi2018-10-19
| | | | | Change-Id: Ie067c2f0f6ec96edd110c79d143de36b20708b47 Signed-off-by: Davide Garberi <dade.garberi@gmail.com>
* msm8996-common: sepolicy Address init denialsCosme Domínguez Díaz2018-10-19
| | | | | | | | | avc: denied { setattr } for pid=1 comm="init" name="scheduler" dev="sysfs" ino=36476 scontext=u:r:init:s0 tcontext=u:object_r:sysfs_scsi_devices_0000:s0 tclass=file permissive=0 avc: denied { setattr } for pid=1 comm="init" name="scheduler" dev="sysfs" ino=36476 scontext=u:r:init:s0 tcontext=u:object_r:sysfs_scsi_devices_0000:s0 tclass=file permissive=0 avc: denied { write } for pid=1 comm="init" name="scheduler" dev="sysfs" ino=36476 scontext=u:r:init:s0 tcontext=u:object_r:sysfs_scsi_devices_0000:s0 tclass=file permissive=0 avc: denied { write } for pid=1 comm="init" name="scheduler" dev="sysfs" ino=36476 scontext=u:r:init:s0 tcontext=u:object_r:sysfs_scsi_devices_0000:s0 tclass=file permissive=0 avc: denied { write } for pid=1 comm="init" name="slice_idle" dev="sysfs" ino=44595 scontext=u:r:init:s0 tcontext=u:object_r:sysfs_scsi_devices_0000:s0 tclass=file permissive=0 avc: denied { write } for pid=1 comm="init" name="slice_idle" dev="sysfs" ino=44595 scontext=u:r:init:s0 tcontext=u:object_r:sysfs_scsi_devices_0000:s0 tclass=file permissive=0
* msm8996-common: sepolicy: Address charger denialsCosme Domínguez Díaz2018-10-19
| | | | | | | | | | | | | avc: denied { dac_override } for pid=463 comm="chargeonlymode" capability=1 scontext=u:r:charger:s0 tcontext=u:r:charger:s0 tclass=capability permissive=1 avc: denied { write } for pid=463 comm="chargeonlymode" name="persist" dev="rootfs" ino=938 scontext=u:r:charger:s0 tcontext=u:object_r:mnt_vendor_file:s0 tclass=dir permissive=1 avc: denied { add_name } for pid=463 comm="chargeonlymode" name="subsys" scontext=u:r:charger:s0 tcontext=u:object_r:mnt_vendor_file:s0 tclass=dir permissive=1 avc: denied { create } for pid=463 comm="chargeonlymode" name="subsys" scontext=u:r:charger:s0 tcontext=u:object_r:mnt_vendor_file:s0 tclass=dir permissive=1 avc: denied { create } for pid=463 comm="chargeonlyiode" name="batt_info.bin" scontext=u:r:charger:s0 tcontext=u:object_r:mnt_vendor_file:s0 tclass=file permissive=1 avc: denied { write open } for pid=463 comm="chargeonlymode" path="/persist/subsys/batt_info.bin" dev="rootfs" ino=948 scontext=u:r:charger:s0 tcontext=u:object_r:mnt_vendor_file:s0 tclass=file permissive=1 avc: denied { setattr } for pid=463 comm="chargeonlymode" name="batt_info.bin" dev="rootfs" ino=948 scontext=u:r:charger:s0 tcontext=u:object_r:mnt_vendor_file:s0 tclass=file permissive=1 avc: denied { chown } for pid=463 comm="chargeonlymode" capability=0 scontext=u:r:charger:s0 tcontext=u:r:charger:s0 tclass=capability permissive=1 avc: denied { read } for pid=463 comm="chargeonlymode" name="type" dev="sysfs" ino=42537 scontext=u:r:charger:s0 tcontext=u:object_r:sysfs_battery_supply:s0 tclass=file permissive=1 avc: denied { open } for pid=463 comm="chargeonlymode" path="/sys/devices/soc/qpnp-smbcharger-16/pnwer_supply/dc/type" dev="sysfs" ino=42537 scontext=u:r:charger:s0 tcontext=u:objectOr:sysfs_battery_supply:s0 tclass=file permissive=1
* msm8996-common: sepolicy: Address hal_audio_default denialsCosme Domínguez Díaz2018-10-19
| | | | | | Change-Id: I79f4f3270de21ea070edc085b12c0d3d64285a3a avc: denied { write } for pid=528 comm="audio@2.0-servi" name="delta" dev="sda10" ino=1410 scontext=u:r:hal_audio_default:s0 tcontext=u:object_r:vendor_data_file:s0 tclass=dir permissive=1 avc: denied { write } for pid=528 comm="audio@2.0-servi" name="delta" dev="sda10" ino=1410 scontext=u:r:hal_audio_default:s0 tcontext=u:object_r:vendor_data_file:s0 tclass=dir permissive=
* msm8996-common: sepolicy: Address rmt_storage denialsCosme Domínguez Díaz2018-10-07
| | | | | | | avc: denied { read } for pid=595 comm="rmt_storage" name="name" dev="sysfs" ino=42161 scontext=u:r:rmt_storage:s0 tcontext=u:object_r:sysfs_msm_subsys:s0 tclass=file permissive=1 avc: denied { read } for pid=595 comm="rmt_storage" name="name" dev="sysfs" ino=42161 scontext=u:r:rmt_storage:s0 tcontext=u:object_r:sysfs_msm_subsys:s0 tclass=file permissive=1 avc: denied { open } for pid=595 comm="rmt_storage" path="/sys/devices/soc/9300000.qcom,lpass/subsys3/name" dev="sysfs" ino=42161 scontext=u:r:rmt_storage:s0 tcontext=u:object_r:sysfs_msm_subsys:s0 tclass=file permissive=1 avc: denied { open } for pid=595 comm="rmt_storage" path="/sys/devices/soc/9300000.qcom,lpass/subsys3/name" dev="sysfs" ino=42161 scontext=u:r:rmt_storage:s0 tcontext=u:object_r:sysfs_msm_subsys:s0 tclass=file permissive=1
* msm8996-common: sepolicy: Address time_daemon denialsCosme Domínguez Díaz2018-10-07
| | | | | | | | | | | | | | | avc: denied { write } for pid=673 comm="time_daemon" name="time" dev="sda10" ino=15159 scontext=u:r:time_daemon:s0 tcontext=u:object_r:time_data_file:s0 tclass=dir permissive=1 avc: denied { write } for pid=673 comm="time_daemon" name="time" dev="sda10" ino=15159 scontext=u:r:time_daemon:s0 tcontext=u:object_r:time_data_file:s0 tclass=dir permissive=1 avc: denied { add_name } for pid=673 comm="time_daemon" name="ats_15" scontext=u:r:time_daemon:s0 tcontext=u:object_r:time_data_file:s0 tclass=dir permissive=1 avc: denied { add_name } for pid=673 comm="time_daemon" name="ats_15" scontext=u:r:time_daemon:s0 tcontext=u:object_r:time_data_file:s0 tclass=dir permissive=1 avc: denied { create } for pid=673 comm="time_daemon" name="ats_15" scontext=u:r:time_daemon:s0 tcontext=u:object_r:time_data_file:s0 tclass=file permissive=1 avc: denied { create } for pid=673 comm="time_daemon" name="ats_15" scontext=u:r:time_daemon:s0 tcontext=u:object_r:time_data_file:s0 tclass=file permissive=1 avc: denied { write } for pid=673 comm="time_daemon" name="time" dev="sda10" ino=15159 scontext=u:r:time_daemon:s0 tcontext=u:object_r:time_data_file:s0 tclass=dir permissive=1 avc: denied { write } for pid=673 comm="time_daemon" name="time" dev="sda10" ino=15159 scontext=u:r:time_daemon:s0 tcontext=u:object_r:time_data_file:s0 tclass=dir permissive=1 avc: denied { add_name } for pid=673 comm="time_daemon" name="ats_2" scontext=u:r:time_daemon:s0 tcontext=u:object_r:time_data_file:s0 tclass=dir permissive=1 avc: denied { add_name } for pid=673 comm="time_daemon" name="ats_2" scontext=u:r:time_daemon:s0 tcontext=u:object_r:time_data_file:s0 tclass=dir permissive=1 avc: denied { create } for pid=673 comm="time_daemon" name="ats_2" scontext=u:r:time_daemon:s0 tcontext=u:object_r:time_data_file:s0 tclass=file permissive=1 avc: denied { create } for pid=673 comm="time_daemon" name="ats_2" scontext=u:r:time_daemon:s0 tcontext=u:object_r:time_data_file:s0 tclass=file permissive=1
* msm8996-common: sepolicy: Address hal_audio_default denialsCosme Domínguez Díaz2018-10-07
| | | | * From marlin's sepolicy. Adapted to work with device/qcom/sepolicy.
* msm8996-common: Update rmt_storage and tftp_serverDavide Garberi2018-10-07
| | | | | | | | * From LA.UM.7.2.r1-04000-sdm660.0 - B2N_sprout:9/PPR1.180610.011/00WW_3_22C * libqsocket and libqrtr are dependencies of tftp_server Change-Id: Ia88230d5ad5287825e624df337c37aa06a3d9edd Signed-off-by: Davide Garberi <dade.garberi@gmail.com>
* msm8996-common: neverallows: Nuke priv-app and qti denialsDavide Garberi2018-10-07
| | | | | Change-Id: Ifc66eb447953aaa312b7c3a9230a72b70fb78ea7 Signed-off-by: Davide Garberi <dade.garberi@gmail.com>
* msm8996-common: neverallows: Address a scheduler denialDavide Garberi2018-10-07
| | | | | | | * Without this the scheduler (bfq) doesn't get set at boot Change-Id: Ibd59caeabac4cdcfae9060cc16975a54ce12db7c Signed-off-by: Davide Garberi <dade.garberi@gmail.com>
* msm8996-common: sepolicy: Put all the neverallows in a separated fileDavide Garberi2018-10-07
| | | | | | | | * They won't make the build fail anyway * Probably just a temporarely thing Change-Id: I4822b4eeef8cb3381a5721da8cc6b382898e6c4a Signed-off-by: Davide Garberi <dade.garberi@gmail.com>
* msm8996-common: Address CNE IMS and some other denialsdavidevinavil2018-10-07
| | | | | Change-Id: Idd48c93dbfddede327c556cf273520412485295e Signed-off-by: Davide Garberi <dade.garberi@gmail.com>
* msm8996-common: Add pocketmode appfluxi2018-10-07
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Change-Id: I71e47d5f203adb7e28d37447e19a8041a1d02840 msm8996-common: PocketMode: Apply LineageOS rebrand Change-Id: I1de627062f56bd125f430033e8bb7aad8fe48f69 msm8996-common: pocketmode: Bump sdk version Change-Id: Ic521e380868bdc886e15c6a8a472564a98dbc094 msm8996-common: PocketMode: Explicitly include Android support libs * Fixes non-jack build Change-Id: I9d8346193577c7be218e12efb20f52ca9946eb14 msm8996-common: PocketMode: Properly depend on Lineage SDK * This is actually the proper library to include (only spotted while buidling with Jack disabled, because app compilation was failing). Change-Id: Ib61f93704c6411a4cb1f91d9e8693a1775934037 msm8996-common: PocketMode: Remove useless cast Change-Id: I655b0b80ccafdaae422a2464d2b8409f70be0e8c msm8996-common: Adapt to Zuk Change-Id: I9050faac37de0a8392b31fed5c3562d4553c546f msm8996-common: Set LOCAL_SDK_VERSION where possible. This change sets LOCAL_SDK_VERSION for all packages where this is possible without breaking the build, and LOCAL_PRIVATE_PLATFORM_APIS := true otherwise. Setting one of these two will be made required soon, and this is a change in preparation for that. Not setting LOCAL_SDK_VERSION makes the app implicitly depend on the bootclasspath, which is often not required. This change effectively makes depending on private apis opt-in rather than opt-out. Test: make relevant packages Bug: 73535841 Change-Id: Ic906adbd670c4dbfe2cdf0b71cdbeaf9ac08a27e msm8996-common: sepolicy: Address a fingerprint denial Change-Id: I07c75d58357f7eea2dcc68ed80dacbab76bb30f5 Signed-off-by: Davide Garberi <dade.garberi@gmail.com>
* msm8996-common: sepolicy: Address binder denialsDavide Garberi2018-10-06
| | | | | Change-Id: Id73515a55b1082283789cffbd2aafecaada4e06c Signed-off-by: Davide Garberi <dade.garberi@gmail.com>
* msm8996-common: sepolicy: Label sys.post_boot.parsedLuK13372018-09-30
| | | | | | | | * QCOM has moved to `vendor.post_boot.parsed` but our blobs still use `sys.post_boot.parsed`. Change-Id: I881f459aa10f1c55f8a7c3de87f36d42e000f47e Signed-off-by: Davide Garberi <dade.garberi@gmail.com>
* msm8996-common: Update perf blobs from LA.UM.7.2.r1-04000-sdm660.0Davide Garberi2018-09-27
| | | | | | | | * From Nokia 7 plus * Don't update perf configs because we need 8996 ones Change-Id: I0c074af4b01e2198f3f36084177e3fae6b77e64c Signed-off-by: Davide Garberi <dade.garberi@gmail.com>
* msm8996-common: property_contexts: Label perf propsDavide Garberi2018-09-26
| | | | | Change-Id: Ib2e08d365f088e07d30df2c5dfc72660ca839d21 Signed-off-by: Davide Garberi <dade.garberi@gmail.com>
* msm8996-common: sepolicy: Address hal_bluetooth_qti denialsDavide Garberi2018-09-26
| | | | | | | * Fixes the bluetooth crashing when activated Change-Id: Ic4c120319cbc5267fd433ca935e51837946000a6 Signed-off-by: Davide Garberi <dade.garberi@gmail.com>
* msm8996-common: file_contexts: Label light service correctlyDavide Garberi2018-09-25
| | | | | Change-Id: Ia4fa68909a710a904bd796ab53d486b81ee2238a Signed-off-by: Davide Garberi <dade.garberi@gmail.com>
* msm8996-common: readmac: Add back a denial fixDavide Garberi2018-09-25
| | | | | | | | * Partial revert of 2bc563eaed5ab7aec72b3bd929739245cf3de4ab * Even if it generates a neverallow this fixes the readmac crash in enforcing Change-Id: Ib108662c17f456fcdea90b9615e2e4f350755059 Signed-off-by: Davide Garberi <dade.garberi@gmail.com>
* msm8996-common: sepolicy: Fix persist_file related rulesLuK13372018-09-25
| | | | | | | * It has been renamed to mnt_vendor_file in QCOM sepolicy. Change-Id: If16c6d17635ec746fc01c7309854ccbeb1303339 Signed-off-by: Davide Garberi <dade.garberi@gmail.com>
generated by cgit v1.2.3 (git 2.25.1) at 2025-10-19 20:41:25 +0000