refpolicy-targeted: Add AudioReach device labels for pipewire_stack - #123
rchiluka29 wants to merge 1 commit into
Conversation
What? Please fix your Git configuration. Also this PR won't work without extra plumbing, so it wasn't even tested. Please don't open the untested PR. |
4cba441 to
da6a0e9
Compare
Thank you for the review. Apologies for the incorrect author email in the previous commit. corrected. This has been validated in enforcing mode. Both pipewire and pipewire-pulse run confined under pipewire_t, /dev/aud_pasthru_adsp and /dev/msm_audio_mem are correctly labeled sound_device_t and returns no denials. |
da6a0e9 to
58fb36f
Compare
|
AudioReach/audioreach.triage This pull request has been marked as stale due to 30 days of inactivity. |
58fb36f to
be9f790
Compare
|
This PR has been updated post upstream PR merge. |
be9f790 to
d4f658f
Compare
Label Qualcomm AudioReach-specific device nodes as sound_device_t so that pipewire_t can access them via the existing dev_read_sound and dev_write_sound interfaces without requiring access to the generic device_t. /dev/aud_pasthru.* is the AudioReach GPR passthrough node used by audioreach-graphservices for ADSP communication. /dev/msm_audio_mem.* is the AudioReach shared memory allocator used by ar_osal for ADSP buffer allocation. These device nodes are created by the Qualcomm AudioReach kernel driver and are not present on non-Qualcomm platforms. Also add selinux to LAYERDEPENDS so that BBFILES_DYNAMIC correctly activates the dynamic-layers/selinux entries when the selinux layer is present in the build. Validated on rb3gen2-core-kit in SELinux enforcing mode: - /dev/aud_pasthru_adsp and /dev/msm_audio_mem correctly labelled sound_device_t after restorecon - PipeWire playback and record pass with no AVC denials Upstream-Status: Inappropriate [Qualcomm-specific AudioReach device nodes not present on non-Qualcomm platforms] Signed-off-by: Chiluka Rohith <rchiluka@qti.qualcomm.com>
d4f658f to
e373c70
Compare
|
AudioReach/audioreach.triage This pull request has been marked as stale due to 30 days of inactivity. |
2 participants
Add a dynamic-layers/selinux entry to extend the pipewire_stack SELinux policy with Qualcomm AudioReach specific device node labels.
/dev/aud_pasthru.* (AudioReach GPR passthrough char devices used by audioreach-graphservices for ADSP communication) and /dev/msm_audio_mem.* (AudioReach shared memory allocator used by ar_osal for ADSP buffer allocation, including the CMA variant /dev/msm_audio_mem_cma) are labeled sound_device_t, consistent with the existing /dev/adsp.* labeling convention in devices.fc. This allows pipewire_t to access them via the existing sound_device_t allow rule without broadening access to the generic device_t.
These device nodes are created by the Qualcomm AudioReach kernel driver and are not present on non-Qualcomm platforms, so this policy is kept in meta-audioreach rather than submitted upstream.
Upstream-Status: Inappropriate [Qualcomm-specific AudioReach device nodes not present on non-Qualcomm platforms]