From 8312513ba541afde1a3d25a3afcb2af8d1cb83d6 Mon Sep 17 00:00:00 2001 From: Soeren Schoenbrod Date: Fri, 13 May 2022 12:04:28 +0200 Subject: [PATCH 1/8] Address mpdecision and storaged selinux denials --- rootdir/etc/init.qcom.rc | 2 +- sepolicy/private/file.te | 2 ++ sepolicy/private/permissioncontroller_app.te | 1 + sepolicy/private/storaged.te | 2 ++ sepolicy/private/system_app.te | 2 ++ sepolicy/vendor/mm-qcamerad.te | 2 ++ sepolicy/vendor/mpdecision.te | 16 ++++++++++++---- sepolicy/vendor/thermal-engine.te | 2 +- 8 files changed, 23 insertions(+), 6 deletions(-) create mode 100644 sepolicy/private/file.te create mode 100644 sepolicy/private/permissioncontroller_app.te create mode 100644 sepolicy/private/storaged.te create mode 100644 sepolicy/private/system_app.te diff --git a/rootdir/etc/init.qcom.rc b/rootdir/etc/init.qcom.rc index 442ebea..d66cbd5 100644 --- a/rootdir/etc/init.qcom.rc +++ b/rootdir/etc/init.qcom.rc @@ -392,7 +392,7 @@ service netmgrd /system/bin/netmgrd service mpdecision /system/bin/mpdecision --no_sleep --avg_comp class main user root - group root readproc + group root system readproc wakelock disabled service qcamerasvr /system/bin/mm-qcamera-daemon diff --git a/sepolicy/private/file.te b/sepolicy/private/file.te new file mode 100644 index 0000000..2e11585 --- /dev/null +++ b/sepolicy/private/file.te @@ -0,0 +1,2 @@ +type sysfs_disk_pre_eol_info, fs_type, sysfs_type; +type sysfs_disk_rev, fs_type, sysfs_type; diff --git a/sepolicy/private/permissioncontroller_app.te b/sepolicy/private/permissioncontroller_app.te new file mode 100644 index 0000000..f006c72 --- /dev/null +++ b/sepolicy/private/permissioncontroller_app.te @@ -0,0 +1 @@ +allow permissioncontroller_app tethering_service:service_manager find; diff --git a/sepolicy/private/storaged.te b/sepolicy/private/storaged.te new file mode 100644 index 0000000..f3512ff --- /dev/null +++ b/sepolicy/private/storaged.te @@ -0,0 +1,2 @@ +r_dir_file(storaged, sysfs_disk_pre_eol_info) +r_dir_file(storaged, sysfs_disk_rev) diff --git a/sepolicy/private/system_app.te b/sepolicy/private/system_app.te new file mode 100644 index 0000000..592626c --- /dev/null +++ b/sepolicy/private/system_app.te @@ -0,0 +1,2 @@ +binder_call(system_app, storaged) +binder_call(system_app, system_suspend) diff --git a/sepolicy/vendor/mm-qcamerad.te b/sepolicy/vendor/mm-qcamerad.te index 8e77c3f..a54482a 100644 --- a/sepolicy/vendor/mm-qcamerad.te +++ b/sepolicy/vendor/mm-qcamerad.te @@ -14,9 +14,11 @@ allow mm-qcamerad device:chr_file { ioctl open read write }; allow mm-qcamerad sysfs:file { getattr open read write }; allow mm-qcamerad system_data_root_file:sock_file unlink; allow mm-qcamerad system_lib_file:file execmod; +allow mm-qcamerad mpctl_socket:sock_file w_file_perms; allow mm-qcamerad { audioserver cameraserver surfaceflinger mediaserver }:fd use; allow mm-qcamerad { hal_graphics_allocator hal_camera_default }:fd use; allow mm-qcamerad hal_renderscript_hwservice:hwservice_manager find; binder_call(mm-qcamerad, servicemanager); +unix_socket_connect(mm-qcamerad, mpdecision, mpdecision) \ No newline at end of file diff --git a/sepolicy/vendor/mpdecision.te b/sepolicy/vendor/mpdecision.te index bf3ef09..d9e5f49 100644 --- a/sepolicy/vendor/mpdecision.te +++ b/sepolicy/vendor/mpdecision.te @@ -1,13 +1,21 @@ -allow mpdecision mpdecision:netlink_kobject_uevent_socket { create setopt bind read }; +binder_use(mpdecision) + +type_transition mpdecision socket_device:sock_file mpctl_socket; +type_transition mpdecision system_data_file:file mpctl_data_file; +allow mpdecision mpctl_data_file:dir w_dir_perms; +allow mpdecision mpctl_data_file:sock_file create_file_perms; allow mpdecision mpdecision_socket:dir w_dir_perms; allow mpdecision mpdecision_socket:sock_file create_file_perms; +allow mpdecision socket_device:dir w_dir_perms; +allow mpdecision sysfs_devices_system_cpu:file rw_file_perms; +allow mpdecision sysfs_soc_id:file r_file_perms; +allow mpdecision system_data_file:dir w_dir_perms; -type_transition mpdecision system_data_file:file mpctl_data_file; +allow mpdecision mpdecision:netlink_kobject_uevent_socket { create setopt bind read }; unix_socket_connect(mpdecision, thermal, thermal-engine) -allow mpdecision system_data_file:dir w_dir_perms; allow mpdecision sysfs:file rw_file_perms; allow mpdecision mediaserver:dir search; @@ -16,4 +24,4 @@ allow mpdecision mediaserver:file { read open }; r_dir_file(mpdecision, mediaserver) r_dir_file(mpdecision, cameraserver) r_dir_file(mpdecision, audioserver) -r_dir_file(mpdecision, domain) +r_dir_file(mpdecision, domain) \ No newline at end of file diff --git a/sepolicy/vendor/thermal-engine.te b/sepolicy/vendor/thermal-engine.te index 92e4033..8821977 100644 --- a/sepolicy/vendor/thermal-engine.te +++ b/sepolicy/vendor/thermal-engine.te @@ -1,3 +1,3 @@ allow thermal-engine self:capability { chown net_admin }; allow thermal-engine init:unix_stream_socket connectto; -allow thermal-engine mpdecision_socket:dir create_dir_perms; +allow thermal-engine mpdecision_socket:dir rw_dir_perms; \ No newline at end of file From 1ec05bbfc78dcd49104da9a67d3db51b56e35030 Mon Sep 17 00:00:00 2001 From: Soeren Schoenbrod Date: Fri, 13 May 2022 12:29:41 +0200 Subject: [PATCH 2/8] Remove sysfs_soc_id selinux type --- sepolicy/vendor/mpdecision.te | 1 - 1 file changed, 1 deletion(-) diff --git a/sepolicy/vendor/mpdecision.te b/sepolicy/vendor/mpdecision.te index d9e5f49..7f477e6 100644 --- a/sepolicy/vendor/mpdecision.te +++ b/sepolicy/vendor/mpdecision.te @@ -9,7 +9,6 @@ allow mpdecision mpdecision_socket:dir w_dir_perms; allow mpdecision mpdecision_socket:sock_file create_file_perms; allow mpdecision socket_device:dir w_dir_perms; allow mpdecision sysfs_devices_system_cpu:file rw_file_perms; -allow mpdecision sysfs_soc_id:file r_file_perms; allow mpdecision system_data_file:dir w_dir_perms; allow mpdecision mpdecision:netlink_kobject_uevent_socket { create setopt bind read }; From c4dce51b78e6e4f69ea3f408ba60ecaf179f810d Mon Sep 17 00:00:00 2001 From: Soeren Schoenbrod Date: Fri, 13 May 2022 14:36:21 +0200 Subject: [PATCH 3/8] Label mpdecision --- sepolicy/vendor/file_contexts | 1 + sepolicy/vendor/mpdecision.te | 2 ++ 2 files changed, 3 insertions(+) diff --git a/sepolicy/vendor/file_contexts b/sepolicy/vendor/file_contexts index 817257c..06cbc96 100644 --- a/sepolicy/vendor/file_contexts +++ b/sepolicy/vendor/file_contexts @@ -59,6 +59,7 @@ # /data/system/default_values u:object_r:mpctl_data_file:s0 /dev/socket/mpctl u:object_r:mpctl_socket:s0 +/(system|vendor|system/vendor)/bin/mpdecision u:object_r:mpdecision_exec:s0 ################################### # Rootfs Symlinks diff --git a/sepolicy/vendor/mpdecision.te b/sepolicy/vendor/mpdecision.te index 7f477e6..bb537b5 100644 --- a/sepolicy/vendor/mpdecision.te +++ b/sepolicy/vendor/mpdecision.te @@ -1,3 +1,5 @@ +init_daemon_domain(mpdecision) + binder_use(mpdecision) type_transition mpdecision socket_device:sock_file mpctl_socket; From 6ee90877fca9abd2ac824f21442eb19c0b72e2e2 Mon Sep 17 00:00:00 2001 From: Soeren Schoenbrod Date: Fri, 13 May 2022 16:02:18 +0200 Subject: [PATCH 4/8] Allow mpdecision to search memory --- sepolicy/vendor/mpdecision.te | 1 + 1 file changed, 1 insertion(+) diff --git a/sepolicy/vendor/mpdecision.te b/sepolicy/vendor/mpdecision.te index bb537b5..adcd284 100644 --- a/sepolicy/vendor/mpdecision.te +++ b/sepolicy/vendor/mpdecision.te @@ -12,6 +12,7 @@ allow mpdecision mpdecision_socket:sock_file create_file_perms; allow mpdecision socket_device:dir w_dir_perms; allow mpdecision sysfs_devices_system_cpu:file rw_file_perms; allow mpdecision system_data_file:dir w_dir_perms; +allow mpdecision sysfs_memory:dir search; allow mpdecision mpdecision:netlink_kobject_uevent_socket { create setopt bind read }; From 9ab18584c10d813e5ff6b219a9d156b7de0e9993 Mon Sep 17 00:00:00 2001 From: Soeren Schoenbrod Date: Fri, 13 May 2022 17:31:32 +0200 Subject: [PATCH 5/8] Allow storaged to open and read --- sepolicy/vendor/storaged.te | 1 + 1 file changed, 1 insertion(+) create mode 100644 sepolicy/vendor/storaged.te diff --git a/sepolicy/vendor/storaged.te b/sepolicy/vendor/storaged.te new file mode 100644 index 0000000..b3643cb --- /dev/null +++ b/sepolicy/vendor/storaged.te @@ -0,0 +1 @@ +allow storaged sysfs:file { getattr open read }; \ No newline at end of file From 9fbfd79620950fab6611b3d94247138ec660c60f Mon Sep 17 00:00:00 2001 From: Soeren Schoenbrod Date: Fri, 13 May 2022 17:48:10 +0200 Subject: [PATCH 6/8] Revert "Allow storaged to open and read" This reverts commit 9ab18584c10d813e5ff6b219a9d156b7de0e9993. --- sepolicy/vendor/storaged.te | 1 - 1 file changed, 1 deletion(-) delete mode 100644 sepolicy/vendor/storaged.te diff --git a/sepolicy/vendor/storaged.te b/sepolicy/vendor/storaged.te deleted file mode 100644 index b3643cb..0000000 --- a/sepolicy/vendor/storaged.te +++ /dev/null @@ -1 +0,0 @@ -allow storaged sysfs:file { getattr open read }; \ No newline at end of file From ff53a9e890de2b1a38e904a8144e6381c29394a9 Mon Sep 17 00:00:00 2001 From: Soeren Schoenbrod Date: Fri, 13 May 2022 18:02:36 +0200 Subject: [PATCH 7/8] Allow storaged to open and read again --- sepolicy/vendor/storaged.te | 4 ++++ 1 file changed, 4 insertions(+) create mode 100644 sepolicy/vendor/storaged.te diff --git a/sepolicy/vendor/storaged.te b/sepolicy/vendor/storaged.te new file mode 100644 index 0000000..488ae0c --- /dev/null +++ b/sepolicy/vendor/storaged.te @@ -0,0 +1,4 @@ +type storaged, domain; +type storaged_exec, exec_type, file_type; + +allow storaged sysfs:file { getattr open read }; \ No newline at end of file From 339cd2563cc7deae1233163fb1895ba5bf4d6cae Mon Sep 17 00:00:00 2001 From: Soeren Schoenbrod Date: Fri, 13 May 2022 18:14:56 +0200 Subject: [PATCH 8/8] Revert "Allow storaged to open and read again" This reverts commit ff53a9e890de2b1a38e904a8144e6381c29394a9. --- sepolicy/vendor/storaged.te | 4 ---- 1 file changed, 4 deletions(-) delete mode 100644 sepolicy/vendor/storaged.te diff --git a/sepolicy/vendor/storaged.te b/sepolicy/vendor/storaged.te deleted file mode 100644 index 488ae0c..0000000 --- a/sepolicy/vendor/storaged.te +++ /dev/null @@ -1,4 +0,0 @@ -type storaged, domain; -type storaged_exec, exec_type, file_type; - -allow storaged sysfs:file { getattr open read }; \ No newline at end of file