diff --git a/configs/wpa_supplicant_overlay.conf b/configs/wpa_supplicant_overlay.conf index 793caab..93547d0 100644 --- a/configs/wpa_supplicant_overlay.conf +++ b/configs/wpa_supplicant_overlay.conf @@ -4,4 +4,4 @@ tdls_external_control=1 interworking=1 hs20=1 auto_interworking=0 -driver_param=use_p2p_group_interface=1 +driver_param=use_p2p_group_interface=1 \ No newline at end of file diff --git a/overlay/frameworks/base/core/res/res/values/config.xml b/overlay/frameworks/base/core/res/res/values/config.xml index 47e7dec..87495d2 100644 --- a/overlay/frameworks/base/core/res/res/values/config.xml +++ b/overlay/frameworks/base/core/res/res/values/config.xml @@ -75,12 +75,30 @@ "bt-pan" - - true + + true + + + false + + + false + + + false true + + false + true diff --git a/rootdir/etc/init.qcom.rc b/rootdir/etc/init.qcom.rc index 442ebea..97b774b 100644 --- a/rootdir/etc/init.qcom.rc +++ b/rootdir/etc/init.qcom.rc @@ -365,6 +365,12 @@ on boot # Bluetooth MAC address chown bluetooth bluetooth /sys/module/htc_bdaddress/parameters/bdaddress + # Set subsystem restart level + # 1 = SOC + # 2 = COUPLED + # 3 = INDEPENDENT + write /sys/module/subsystem_restart/parameters/restart_level 3 + # Wifi firmware reload path chown wifi wifi /sys/module/bcmdhd/parameters/firmware_path @@ -392,19 +398,19 @@ service netmgrd /system/bin/netmgrd service mpdecision /system/bin/mpdecision --no_sleep --avg_comp class main user root - group root readproc + group root system readproc wakelock disabled service qcamerasvr /system/bin/mm-qcamera-daemon class late_start user camera - group camera system inet graphics + group camera system inet input graphics # QMUX must be in multiple groups to support external process connections service qmuxd /system/bin/qmuxd class core user root - group radio audio gps wakelock oem_2950 + group radio audio bluetooth gps diag wakelock log oem_2950 service qseecomd /system/bin/qseecomd class core diff --git a/rootdir/etc/ueventd.qcom.rc b/rootdir/etc/ueventd.qcom.rc index e332dd2..890bca2 100644 --- a/rootdir/etc/ueventd.qcom.rc +++ b/rootdir/etc/ueventd.qcom.rc @@ -1,17 +1,17 @@ -/dev/rtc0 0600 system system +/dev/rtc0 0660 system system # the DIAG device node is world writable/readable. -/dev/diag 0666 root root +/dev/diag 0666 root diag # the genlock client device node is world writable/readable. -/dev/genlock 0666 root root +/dev/genlock 0666 system system # gpu driver for adreno200 is globally accessible -/dev/kgsl 0666 root root -/dev/kgsl-3d0 0666 root root +/dev/kgsl 0666 system system +/dev/kgsl-3d0 0666 system system /dev/kgsl-2d0 0666 root root /dev/kgsl-2d1 0666 root root -/dev/msm_rotator 0660 system graphics +/dev/msm_rotator 0660 system system # these should not be world writable /dev/ttyHS0 0660 bluetooth bluetooth @@ -24,8 +24,8 @@ /dev/msm_camera/* 0660 system camera /dev/radio0 0640 system system /dev/i2c-0 0664 root system -/dev/i2c-1 0664 root system /dev/i2c-2 0664 root system +/dev/i2c-3 0664 root system /dev/i2c-4 0664 root system /dev/msm_mvs 0660 system audio /dev/msm_voicememo 0660 system audio @@ -38,7 +38,7 @@ /dev/smd2 0660 bluetooth bluetooth /dev/smd5 0660 system system /dev/smd6 0660 system system -/dev/smd7 0640 radio radio +/dev/smd7 0660 radio radio /dev/smd11 0660 radio radio /dev/smdcntl0 0640 radio radio /dev/smdcntl1 0640 radio radio @@ -73,7 +73,6 @@ /dev/mdm 0660 system radio /dev/ttyHSL1 0660 system system /dev/tty_sdio_00 0660 system system -/dev/block/mmcblk0p17 0660 system system /dev/block/mmcblk0p18 0660 system system /dev/config* 0660 system camera /dev/video* 0660 system camera @@ -106,7 +105,7 @@ /dev/msm_qcelp_in 0660 system audio /dev/msm_evrc_in 0660 system audio /dev/msm_preproc_ctl 0660 system audio -/dev/msm_a2dp_in 0640 system audio +/dev/msm_a2dp_in 0660 system audio /dev/msm_amrnb_in 0660 system audio /dev/msm_amrwb_in 0660 system audio /sys/devices/virtual/smdpkt/smdcntl* open_timeout 0664 radio radio @@ -142,13 +141,13 @@ # MPU3050 /dev/mpu 0664 system system /dev/mpuirq 0664 system system -/dev/timerirq 0644 system system +/dev/timerirq 0664 system system # AKM8963 /dev/akm8963_dev 0660 system system # Bluetooth -/dev/btlock 0600 bluetooth bluetooth +/dev/btlock 0660 bluetooth bluetooth # keystore /dev/qseecom 0660 system drmrpc @@ -162,3 +161,38 @@ /sys/devices/virtual/optical_sensors/lightsensor ls_poll_delay 0660 input system /sys/devices/virtual/input/input* poll 0660 input system /sys/devices/virtual/input/input* pollrate_ms 0660 input system + + +# From samsung jv +/dev/qmi0 0640 radio radio +/dev/qmi1 0640 radio radio +/dev/qmi2 0640 radio radio +/dev/smdcnt_rev0 0640 radio radio +/dev/smdcnt_rev1 0640 radio radio +/dev/smdcnt_rev2 0640 radio radio +/dev/smdcnt_rev3 0640 radio radio +/dev/smdcnt_rev4 0640 radio radio +/dev/smdcnt_rev5 0640 radio radio +/dev/smdcnt_rev6 0640 radio radio +/dev/smdcnt_rev7 0640 radio radio +/dev/smdcnt_rev8 0640 radio radio +/dev/v4l-subdev* 0660 system camera +/dev/graphics/* 0660 system system +/dev/tun 0660 system vpn +/dev/smd_cxm_qmi 0640 radio radio +/dev/msm_amrwbplus 0660 system audio +/dev/msm_mp3 0660 system audio +/dev/msm_sps 0660 system audio + +/sys/class/graphics/fb* format_3d 0664 system graphics +/sys/class/graphics/fb* hpd 0664 system graphics +/sys/class/graphics/fb* msm_fb_fps_level 0664 system graphics +/sys/class/graphics/fb* pa 0664 system graphics +/sys/class/graphics/fb* product_description 0664 system graphics +/sys/class/graphics/fb* vendor_name 0664 system graphics +/sys/class/graphics/fb* video_mode 0664 system graphics + +/sys/class/graphics/fb0 mode 0664 system graphics +/sys/class/graphics/fb0 modes 0664 system graphics + +/dev/block/mmcblk0p* 0660 system radio \ No newline at end of file diff --git a/sepolicy/private/dumpstate.te b/sepolicy/private/dumpstate.te new file mode 100644 index 0000000..f87d439 --- /dev/null +++ b/sepolicy/private/dumpstate.te @@ -0,0 +1,3 @@ +allow dumpstate adbroot_exec:file getattr; +allow dumpstate apexd_exec:file getattr; +allow dumpstate atrace_exec:file getattr; \ No newline at end of file diff --git a/sepolicy/private/file.te b/sepolicy/private/file.te new file mode 100644 index 0000000..2e11585 --- /dev/null +++ b/sepolicy/private/file.te @@ -0,0 +1,2 @@ +type sysfs_disk_pre_eol_info, fs_type, sysfs_type; +type sysfs_disk_rev, fs_type, sysfs_type; diff --git a/sepolicy/private/incidentd.te b/sepolicy/private/incidentd.te new file mode 100644 index 0000000..3f16a8e --- /dev/null +++ b/sepolicy/private/incidentd.te @@ -0,0 +1,3 @@ +allow incidentd bluetooth_prop:file { open read }; +allow incidentd proc:file { open read }; +allow incident dumpstate:fifo_file write; \ No newline at end of file diff --git a/sepolicy/private/storaged.te b/sepolicy/private/storaged.te new file mode 100644 index 0000000..18ffdeb --- /dev/null +++ b/sepolicy/private/storaged.te @@ -0,0 +1,3 @@ +r_dir_file(storaged, sysfs_disk_pre_eol_info) +r_dir_file(storaged, sysfs_disk_rev) +allow storaged sysfs:file { read open getattr }; \ No newline at end of file diff --git a/sepolicy/private/system_app.te b/sepolicy/private/system_app.te new file mode 100644 index 0000000..592626c --- /dev/null +++ b/sepolicy/private/system_app.te @@ -0,0 +1,2 @@ +binder_call(system_app, storaged) +binder_call(system_app, system_suspend) diff --git a/sepolicy/vendor/device.te b/sepolicy/vendor/device.te index fa58aa8..ea917bd 100644 --- a/sepolicy/vendor/device.te +++ b/sepolicy/vendor/device.te @@ -1,2 +1,2 @@ type bluetooth_device, dev_type; -type cir_device, dev_type; +type cir_device, dev_type; \ No newline at end of file diff --git a/sepolicy/vendor/dumpstate.te b/sepolicy/vendor/dumpstate.te new file mode 100644 index 0000000..ec67bc2 --- /dev/null +++ b/sepolicy/vendor/dumpstate.te @@ -0,0 +1,5 @@ +allow dumpstate akmd_exec:file getattr; +allow dumpstate firmware_file:dir search; +allow dumpstate proc:file { open read }; +allow dumpstate unlabeled:dir getattr; +allow dumpstate unlabeled:filesystem getattr; \ No newline at end of file diff --git a/sepolicy/vendor/file_contexts b/sepolicy/vendor/file_contexts index 817257c..fabe702 100644 --- a/sepolicy/vendor/file_contexts +++ b/sepolicy/vendor/file_contexts @@ -59,6 +59,7 @@ # /data/system/default_values u:object_r:mpctl_data_file:s0 /dev/socket/mpctl u:object_r:mpctl_socket:s0 +/(system|vendor|system/vendor)/bin/mpdecision u:object_r:mpdecision_exec:s0 ################################### # Rootfs Symlinks @@ -108,4 +109,7 @@ /(vendor|system/vendor)/bin/hw/vendor\.lineage\.touch@1\.0-service\.htc8960 u:object_r:hal_lineage_touch_default_exec:s0 # TapToWake -/sys/android_touch/doubletap2wake u:object_r:doubletap2wake_sysfs:s0 +/sys/android_touch/doubletap2wake u:object_r:doubletap2wake_sysfs:s0 + +# Qualcomm +/system/bin/qseecomd u:object_r:qseecomd_exec:s0 \ No newline at end of file diff --git a/sepolicy/vendor/gpuservice.te b/sepolicy/vendor/gpuservice.te new file mode 100644 index 0000000..3c5842d --- /dev/null +++ b/sepolicy/vendor/gpuservice.te @@ -0,0 +1 @@ +allow gpuservice graphics_config_prop:file { read r_file_perms }; \ No newline at end of file diff --git a/sepolicy/vendor/hwservicemanager.te b/sepolicy/vendor/hwservicemanager.te new file mode 100644 index 0000000..5226d40 --- /dev/null +++ b/sepolicy/vendor/hwservicemanager.te @@ -0,0 +1 @@ +allow hwservicemanager dumpstate:fd use; \ No newline at end of file diff --git a/sepolicy/vendor/isolated_app.te b/sepolicy/vendor/isolated_app.te index 86ffdff..b9ae6d7 100755 --- a/sepolicy/vendor/isolated_app.te +++ b/sepolicy/vendor/isolated_app.te @@ -1,2 +1,2 @@ allow isolated_app sysfs:dir open; - +allow isolated_app app_data_file:file setattr; diff --git a/sepolicy/vendor/keystore.te b/sepolicy/vendor/keystore.te index 5b4ac67..15bc434 100755 --- a/sepolicy/vendor/keystore.te +++ b/sepolicy/vendor/keystore.te @@ -1,3 +1,3 @@ allow keystore firmware_file:dir search; allow keystore firmware_file:file { getattr open read }; - +allow keystore tee_device:chr_file { read write ioctl open }; diff --git a/sepolicy/vendor/mm-qcamerad.te b/sepolicy/vendor/mm-qcamerad.te index 8e77c3f..b01a8d3 100644 --- a/sepolicy/vendor/mm-qcamerad.te +++ b/sepolicy/vendor/mm-qcamerad.te @@ -1,7 +1,8 @@ type_transition mm-qcamerad system_data_file:sock_file camera_socket "cam_socket0"; allow mm-qcamerad camera_device:dir search; -allow mm-qcamerad { camera_device gpu_device video_device }:chr_file rw_file_perms; +allow mm-qcamerad { gpu_device video_device }:chr_file rw_file_perms; +allow mm-qcamerad camera_device:chr_file { open read write ioctl }; allow mm-qcamerad camera_socket:sock_file setattr; allow mm-qcamerad system_data_file:dir { add_name remove_name }; @@ -19,4 +20,3 @@ allow mm-qcamerad { audioserver cameraserver surfaceflinger mediaserver }:fd use allow mm-qcamerad { hal_graphics_allocator hal_camera_default }:fd use; allow mm-qcamerad hal_renderscript_hwservice:hwservice_manager find; binder_call(mm-qcamerad, servicemanager); - diff --git a/sepolicy/vendor/mpdecision.te b/sepolicy/vendor/mpdecision.te index bf3ef09..2823bb0 100644 --- a/sepolicy/vendor/mpdecision.te +++ b/sepolicy/vendor/mpdecision.te @@ -3,12 +3,19 @@ allow mpdecision mpdecision:netlink_kobject_uevent_socket { create setopt bind r allow mpdecision mpdecision_socket:dir w_dir_perms; allow mpdecision mpdecision_socket:sock_file create_file_perms; +type_transition mpdecision socket_device:sock_file mpctl_socket; type_transition mpdecision system_data_file:file mpctl_data_file; unix_socket_connect(mpdecision, thermal, thermal-engine) +allow mpdecision mpctl_data_file:dir w_dir_perms; +allow mpdecision mpctl_data_file:sock_file create_file_perms; +allow mpdecision socket_device:dir w_dir_perms; +allow mpdecision sysfs_devices_system_cpu:file rw_file_perms; +allow mpdecision sysfs_memory:dir search; allow mpdecision system_data_file:dir w_dir_perms; allow mpdecision sysfs:file rw_file_perms; +allow mpdecision device_latency:chr_file w_file_perms; allow mpdecision mediaserver:dir search; allow mpdecision mediaserver:file { read open }; @@ -16,4 +23,4 @@ allow mpdecision mediaserver:file { read open }; r_dir_file(mpdecision, mediaserver) r_dir_file(mpdecision, cameraserver) r_dir_file(mpdecision, audioserver) -r_dir_file(mpdecision, domain) +r_dir_file(mpdecision, domain) \ No newline at end of file diff --git a/sepolicy/vendor/priv-app.te b/sepolicy/vendor/priv-app.te index 39d4505..489b8b4 100755 --- a/sepolicy/vendor/priv-app.te +++ b/sepolicy/vendor/priv-app.te @@ -1,3 +1,4 @@ allow priv_app { camera_prop proc_interrupts }:file { open read }; allow priv_app sysfs:file rw_file_perms; get_prop(priv_app, camera_prop) +allow priv_app exported_camera_prop:file read; \ No newline at end of file diff --git a/sepolicy/vendor/qmuxd.te b/sepolicy/vendor/qmuxd.te index fb9ca08..fbc34c4 100644 --- a/sepolicy/vendor/qmuxd.te +++ b/sepolicy/vendor/qmuxd.te @@ -3,4 +3,6 @@ allow qmuxd self:capability { dac_override setpcap setuid fsetid}; allow qmuxd sysfs:file { getattr }; allow qmuxd sysfs:file rw_file_perms; +allow qmuxd hsic_device:chr_file { rw_file_perms }; + wakelock_use(qmuxd) diff --git a/sepolicy/vendor/qseecomd.te b/sepolicy/vendor/qseecomd.te index ddd36fa..ae13f16 100644 --- a/sepolicy/vendor/qseecomd.te +++ b/sepolicy/vendor/qseecomd.te @@ -1,3 +1,14 @@ +type qseecomd, domain; +type qseecomd_exec, exec_type, file_type; +init_daemon_domain(qseecomd) + +allow qseecomd block_device:dir search; +allow qseecomd self:capability { setgid setuid dac_override }; +allow qseecomd firmware_file:dir search; +allow qseecomd tee_device:chr_file { read write ioctl open }; +allow qseecomd vendor_file:file execmod; +allow qseecomd ion_device:chr_file { ioctl open read }; + allow tee system_file:file execmod; allow tee vendor_file:file execmod; binder_use(tee) diff --git a/sepolicy/vendor/system_app.te b/sepolicy/vendor/system_app.te index ef6c052..d5c1211 100755 --- a/sepolicy/vendor/system_app.te +++ b/sepolicy/vendor/system_app.te @@ -10,4 +10,5 @@ allow system_app doubletap2wake_sysfs:file rw_file_perms; allow system_app sysfs:file rw_file_perms; allow system_app doubletap2wake_sysfs:dir rw_dir_perms; allow system_app vold:binder call; -allow system_app wificond:binder call; \ No newline at end of file +allow system_app wificond:binder call; +allow system_app fm_radio_device:chr_file { read open ioctl}; \ No newline at end of file diff --git a/sepolicy/vendor/system_server.te b/sepolicy/vendor/system_server.te index eb41bec..8efc533 100644 --- a/sepolicy/vendor/system_server.te +++ b/sepolicy/vendor/system_server.te @@ -11,6 +11,7 @@ allow system_server unlabeled:file { rw_file_perms unlink }; allow system_server unlabeled:dir rw_dir_perms; allow system_server tombstones_file:dir rw_dir_perms; allow system_server hal_light_default:process signal; +allow system_server app_zygote:process getpgid; get_prop(system_server, exported_camera_prop); get_prop(system_server, userspace_reboot_config_prop); diff --git a/sepolicy/vendor/ueventd.te b/sepolicy/vendor/ueventd.te index 52ebe64..99a4d0a 100755 --- a/sepolicy/vendor/ueventd.te +++ b/sepolicy/vendor/ueventd.te @@ -1,6 +1,8 @@ -allow ueventd vfat:dir search; -allow ueventd vfat:file { getattr open read }; -allow ueventd exfat:dir rw_dir_perms; -allow ueventd exfat:file { getattr rw_file_perms }; allow ueventd unlabeled:dir rw_dir_perms; allow ueventd unlabeled:file rw_file_perms; + +allow ueventd exfat:dir search; +allow ueventd exfat:file r_file_perms; +allow ueventd self:capability sys_nice; +allow ueventd vfat:dir search; +allow ueventd vfat:file r_file_perms; diff --git a/sepolicy/vendor/untrusted_app.te b/sepolicy/vendor/untrusted_app.te new file mode 100644 index 0000000..ef4ff99 --- /dev/null +++ b/sepolicy/vendor/untrusted_app.te @@ -0,0 +1 @@ +allow untrusted_app exported_camera_prop:file read; \ No newline at end of file diff --git a/sepolicy/vendor/vold.te b/sepolicy/vendor/vold.te index 6369ce7..6f7fc76 100755 --- a/sepolicy/vendor/vold.te +++ b/sepolicy/vendor/vold.te @@ -1,3 +1,5 @@ allow vold hal_bootctl_hwservice:hwservice_manager find; allow vold block_device:blk_file rw_file_perms; -allow vold sysfs_mmc_host:file w_file_perms; \ No newline at end of file +allow vold sysfs_mmc_host:file w_file_perms; +allow vold tee_device:chr_file rw_file_perms; +allow vold cache_block_device:blk_file getattr; \ No newline at end of file diff --git a/system_prop.mk b/system_prop.mk index 4b72ff5..8b162c4 100644 --- a/system_prop.mk +++ b/system_prop.mk @@ -16,4 +16,4 @@ PRODUCT_PROPERTY_OVERRIDES += \ # Vendor security patch level PRODUCT_PROPERTY_OVERRIDES += \ - ro.lineage.build.vendor_security_patch=2015-08-05 + ro.lineage.build.vendor_security_patch=2015-08-05 \ No newline at end of file