From b7d0b3a15df948228007756cbaac8489024d2de2 Mon Sep 17 00:00:00 2001 From: Soeren Schoenbrod Date: Tue, 24 May 2022 08:44:33 +0200 Subject: [PATCH 01/40] Label mpdecision --- sepolicy/vendor/file_contexts | 1 + 1 file changed, 1 insertion(+) diff --git a/sepolicy/vendor/file_contexts b/sepolicy/vendor/file_contexts index 817257c..06cbc96 100644 --- a/sepolicy/vendor/file_contexts +++ b/sepolicy/vendor/file_contexts @@ -59,6 +59,7 @@ # /data/system/default_values u:object_r:mpctl_data_file:s0 /dev/socket/mpctl u:object_r:mpctl_socket:s0 +/(system|vendor|system/vendor)/bin/mpdecision u:object_r:mpdecision_exec:s0 ################################### # Rootfs Symlinks From 1c8bf129d9a15ed5bbd9dbf677668e74adb1f90a Mon Sep 17 00:00:00 2001 From: Soeren Schoenbrod Date: Tue, 24 May 2022 10:27:44 +0200 Subject: [PATCH 02/40] Allow mpdecision search memory and set attribute --- sepolicy/vendor/mpdecision.te | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/sepolicy/vendor/mpdecision.te b/sepolicy/vendor/mpdecision.te index bf3ef09..349dee9 100644 --- a/sepolicy/vendor/mpdecision.te +++ b/sepolicy/vendor/mpdecision.te @@ -3,10 +3,16 @@ allow mpdecision mpdecision:netlink_kobject_uevent_socket { create setopt bind r allow mpdecision mpdecision_socket:dir w_dir_perms; allow mpdecision mpdecision_socket:sock_file create_file_perms; +type_transition mpdecision socket_device:sock_file mpctl_socket; type_transition mpdecision system_data_file:file mpctl_data_file; unix_socket_connect(mpdecision, thermal, thermal-engine) +allow mpdecision mpctl_data_file:dir w_dir_perms; +allow mpdecision mpctl_data_file:sock_file create_file_perms; +allow mpdecision socket_device:dir w_dir_perms; +allow mpdecision sysfs_devices_system_cpu:file rw_file_perms; +allow mpdecision sysfs_memory:dir search; allow mpdecision system_data_file:dir w_dir_perms; allow mpdecision sysfs:file rw_file_perms; @@ -16,4 +22,4 @@ allow mpdecision mediaserver:file { read open }; r_dir_file(mpdecision, mediaserver) r_dir_file(mpdecision, cameraserver) r_dir_file(mpdecision, audioserver) -r_dir_file(mpdecision, domain) +r_dir_file(mpdecision, domain) \ No newline at end of file From f954c9d67d42ea59d13fd0521a3d6e44cff26385 Mon Sep 17 00:00:00 2001 From: Soeren Schoenbrod Date: Sat, 28 May 2022 13:51:36 +0200 Subject: [PATCH 03/40] Maybe fix error black screen --- configs/wpa_supplicant_overlay.conf | 1 + sepolicy/vendor/ueventd.te | 12 +++++++----- 2 files changed, 8 insertions(+), 5 deletions(-) diff --git a/configs/wpa_supplicant_overlay.conf b/configs/wpa_supplicant_overlay.conf index 793caab..0438c37 100644 --- a/configs/wpa_supplicant_overlay.conf +++ b/configs/wpa_supplicant_overlay.conf @@ -5,3 +5,4 @@ interworking=1 hs20=1 auto_interworking=0 driver_param=use_p2p_group_interface=1 +pmf=0 \ No newline at end of file diff --git a/sepolicy/vendor/ueventd.te b/sepolicy/vendor/ueventd.te index 52ebe64..b06e3b5 100755 --- a/sepolicy/vendor/ueventd.te +++ b/sepolicy/vendor/ueventd.te @@ -1,6 +1,8 @@ +allow ueventd exfat:dir search; +allow ueventd exfat:file r_file_perms; +allow ueventd self:capability sys_nice; +allow ueventd sysfs_graphics:file getattr; +allow ueventd sysfs_keypad:file getattr; +allow ueventd sysfs_mdnie:file getattr; allow ueventd vfat:dir search; -allow ueventd vfat:file { getattr open read }; -allow ueventd exfat:dir rw_dir_perms; -allow ueventd exfat:file { getattr rw_file_perms }; -allow ueventd unlabeled:dir rw_dir_perms; -allow ueventd unlabeled:file rw_file_perms; +allow ueventd vfat:file r_file_perms; From b11526f69dc5c904c1b8a07641b72d9179ca21e3 Mon Sep 17 00:00:00 2001 From: Soeren Schoenbrod Date: Sat, 28 May 2022 14:11:08 +0200 Subject: [PATCH 04/40] Maybe fix error black screen 2 --- sepolicy/vendor/ueventd.te | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/sepolicy/vendor/ueventd.te b/sepolicy/vendor/ueventd.te index b06e3b5..99a4d0a 100755 --- a/sepolicy/vendor/ueventd.te +++ b/sepolicy/vendor/ueventd.te @@ -1,8 +1,8 @@ +allow ueventd unlabeled:dir rw_dir_perms; +allow ueventd unlabeled:file rw_file_perms; + allow ueventd exfat:dir search; allow ueventd exfat:file r_file_perms; allow ueventd self:capability sys_nice; -allow ueventd sysfs_graphics:file getattr; -allow ueventd sysfs_keypad:file getattr; -allow ueventd sysfs_mdnie:file getattr; allow ueventd vfat:dir search; allow ueventd vfat:file r_file_perms; From 511587ec8a7291da31ba925327238bc8fb7d4b56 Mon Sep 17 00:00:00 2001 From: Soeren Schoenbrod Date: Sat, 28 May 2022 15:38:26 +0200 Subject: [PATCH 05/40] Remove unlabeled sepolicy --- sepolicy/vendor/mdm_helper.te | 2 -- sepolicy/vendor/system_server.te | 2 -- sepolicy/vendor/ueventd.te | 3 --- 3 files changed, 7 deletions(-) diff --git a/sepolicy/vendor/mdm_helper.te b/sepolicy/vendor/mdm_helper.te index bf92b90..57ad00d 100644 --- a/sepolicy/vendor/mdm_helper.te +++ b/sepolicy/vendor/mdm_helper.te @@ -11,8 +11,6 @@ allow mdm_helper exfat:file { getattr open read }; allow mdm_helper exfat:dir create_dir_perms; allow mdm_helper sysfs:file getattr; allow mdm_helper system_data_file:lnk_file { getattr open read }; -allow mdm_helper unlabeled:dir rw_dir_perms; -allow mdm_helper unlabeled:file rwx_file_perms; set_prop(mdm_helper, radio_prop) diff --git a/sepolicy/vendor/system_server.te b/sepolicy/vendor/system_server.te index eb41bec..18f90af 100644 --- a/sepolicy/vendor/system_server.te +++ b/sepolicy/vendor/system_server.te @@ -7,8 +7,6 @@ allow system_server init:binder { call transfer }; allow system_server proc:file { getattr open read }; allow system_server doubletap2wake_sysfs:dir search; allow system_server doubletap2wake_sysfs:file rw_file_perms; -allow system_server unlabeled:file { rw_file_perms unlink }; -allow system_server unlabeled:dir rw_dir_perms; allow system_server tombstones_file:dir rw_dir_perms; allow system_server hal_light_default:process signal; diff --git a/sepolicy/vendor/ueventd.te b/sepolicy/vendor/ueventd.te index 99a4d0a..b8a4b85 100755 --- a/sepolicy/vendor/ueventd.te +++ b/sepolicy/vendor/ueventd.te @@ -1,6 +1,3 @@ -allow ueventd unlabeled:dir rw_dir_perms; -allow ueventd unlabeled:file rw_file_perms; - allow ueventd exfat:dir search; allow ueventd exfat:file r_file_perms; allow ueventd self:capability sys_nice; From 7bc24a9707628a56b2e7b1875bfb259224cdf0cf Mon Sep 17 00:00:00 2001 From: Soeren Schoenbrod Date: Sat, 28 May 2022 16:42:46 +0200 Subject: [PATCH 06/40] Label for qseecom --- sepolicy/vendor/file_contexts | 6 +++++- sepolicy/vendor/qseecomd.te | 9 +++++++++ 2 files changed, 14 insertions(+), 1 deletion(-) diff --git a/sepolicy/vendor/file_contexts b/sepolicy/vendor/file_contexts index 06cbc96..8dc21b8 100644 --- a/sepolicy/vendor/file_contexts +++ b/sepolicy/vendor/file_contexts @@ -109,4 +109,8 @@ /(vendor|system/vendor)/bin/hw/vendor\.lineage\.touch@1\.0-service\.htc8960 u:object_r:hal_lineage_touch_default_exec:s0 # TapToWake -/sys/android_touch/doubletap2wake u:object_r:doubletap2wake_sysfs:s0 +/sys/android_touch/doubletap2wake u:object_r:doubletap2wake_sysfs:s0 + +# Qualcomm +/system/bin/qseecomd u:object_r:qseecomd_exec:s0 +/dev/qseecom u:object_r:qseecom_device:s0 \ No newline at end of file diff --git a/sepolicy/vendor/qseecomd.te b/sepolicy/vendor/qseecomd.te index ddd36fa..9291355 100644 --- a/sepolicy/vendor/qseecomd.te +++ b/sepolicy/vendor/qseecomd.te @@ -1,3 +1,12 @@ +type qseecomd, domain; +type qseecomd_exec, exec_type, file_type; +init_daemon_domain(qseecomd) + +allow qseecomd block_device:dir search; +allow qseecomd self:capability { setgid setuid dac_override }; +allow qseecomd firmware_file:dir search; +allow qseecomd qseecom_device:chr_file { read write ioctl open }; + allow tee system_file:file execmod; allow tee vendor_file:file execmod; binder_use(tee) From f183b9547b586003968e8808d7faf2604f29357e Mon Sep 17 00:00:00 2001 From: Soeren Schoenbrod Date: Sat, 28 May 2022 16:55:53 +0200 Subject: [PATCH 07/40] Revert "Remove unlabeled sepolicy" This reverts commit 511587ec8a7291da31ba925327238bc8fb7d4b56. --- sepolicy/vendor/mdm_helper.te | 2 ++ sepolicy/vendor/system_server.te | 2 ++ sepolicy/vendor/ueventd.te | 3 +++ 3 files changed, 7 insertions(+) diff --git a/sepolicy/vendor/mdm_helper.te b/sepolicy/vendor/mdm_helper.te index 57ad00d..bf92b90 100644 --- a/sepolicy/vendor/mdm_helper.te +++ b/sepolicy/vendor/mdm_helper.te @@ -11,6 +11,8 @@ allow mdm_helper exfat:file { getattr open read }; allow mdm_helper exfat:dir create_dir_perms; allow mdm_helper sysfs:file getattr; allow mdm_helper system_data_file:lnk_file { getattr open read }; +allow mdm_helper unlabeled:dir rw_dir_perms; +allow mdm_helper unlabeled:file rwx_file_perms; set_prop(mdm_helper, radio_prop) diff --git a/sepolicy/vendor/system_server.te b/sepolicy/vendor/system_server.te index 18f90af..eb41bec 100644 --- a/sepolicy/vendor/system_server.te +++ b/sepolicy/vendor/system_server.te @@ -7,6 +7,8 @@ allow system_server init:binder { call transfer }; allow system_server proc:file { getattr open read }; allow system_server doubletap2wake_sysfs:dir search; allow system_server doubletap2wake_sysfs:file rw_file_perms; +allow system_server unlabeled:file { rw_file_perms unlink }; +allow system_server unlabeled:dir rw_dir_perms; allow system_server tombstones_file:dir rw_dir_perms; allow system_server hal_light_default:process signal; diff --git a/sepolicy/vendor/ueventd.te b/sepolicy/vendor/ueventd.te index b8a4b85..99a4d0a 100755 --- a/sepolicy/vendor/ueventd.te +++ b/sepolicy/vendor/ueventd.te @@ -1,3 +1,6 @@ +allow ueventd unlabeled:dir rw_dir_perms; +allow ueventd unlabeled:file rw_file_perms; + allow ueventd exfat:dir search; allow ueventd exfat:file r_file_perms; allow ueventd self:capability sys_nice; From b07bc2d8a4f3b491031433e85778e33a7f0febc8 Mon Sep 17 00:00:00 2001 From: Soeren Schoenbrod Date: Sat, 28 May 2022 17:33:34 +0200 Subject: [PATCH 08/40] Some more labels --- sepolicy/vendor/device.te | 10 ++++++++++ sepolicy/vendor/file_contexts | 8 +++++++- sepolicy/vendor/keystore.te | 2 +- sepolicy/vendor/mpdecision.te | 1 + sepolicy/vendor/qmuxd.te | 2 ++ sepolicy/vendor/system_app.te | 3 ++- sepolicy/vendor/vold.te | 3 ++- 7 files changed, 25 insertions(+), 4 deletions(-) diff --git a/sepolicy/vendor/device.te b/sepolicy/vendor/device.te index fa58aa8..0f2784d 100644 --- a/sepolicy/vendor/device.te +++ b/sepolicy/vendor/device.te @@ -1,2 +1,12 @@ type bluetooth_device, dev_type; type cir_device, dev_type; +type qseecom_device, dev_type; + +#Define mpdecision device +type device_latency, dev_type; + +#Define the hsic device +type hsic_device, dev_type; + +#Added for fm_radio device +type fm_radio_device, dev_type; \ No newline at end of file diff --git a/sepolicy/vendor/file_contexts b/sepolicy/vendor/file_contexts index 8dc21b8..406dc99 100644 --- a/sepolicy/vendor/file_contexts +++ b/sepolicy/vendor/file_contexts @@ -19,6 +19,7 @@ /data/cam_socket.* u:object_r:camera_socket:s0 /dev/gemini.* u:object_r:camera_device:s0 /dev/rawchip.* u:object_r:camera_device:s0 +/dev/v4l-subdev.* u:object_r:camera_device:s0 /(system|vendor|system/vendor)/bin/mm-qcamera-daemon u:object_r:mm-qcamerad_exec:s0 ################################### @@ -113,4 +114,9 @@ # Qualcomm /system/bin/qseecomd u:object_r:qseecomd_exec:s0 -/dev/qseecom u:object_r:qseecom_device:s0 \ No newline at end of file +/dev/qseecom u:object_r:qseecom_device:s0 + +/dev/cpu_dma_latency u:object_r:device_latency:s0 +/dev/kgsl-3d0 u:object_r:gpu_device:s0 +/dev/hsicctl.* u:object_r:hsic_device:s0 +/dev/radio0 u:object_r:fm_radio_device:s0 \ No newline at end of file diff --git a/sepolicy/vendor/keystore.te b/sepolicy/vendor/keystore.te index 5b4ac67..a7e2174 100755 --- a/sepolicy/vendor/keystore.te +++ b/sepolicy/vendor/keystore.te @@ -1,3 +1,3 @@ allow keystore firmware_file:dir search; allow keystore firmware_file:file { getattr open read }; - +allow keystore qseecom_device:chr_file { read write ioctl open }; diff --git a/sepolicy/vendor/mpdecision.te b/sepolicy/vendor/mpdecision.te index 349dee9..2823bb0 100644 --- a/sepolicy/vendor/mpdecision.te +++ b/sepolicy/vendor/mpdecision.te @@ -15,6 +15,7 @@ allow mpdecision sysfs_devices_system_cpu:file rw_file_perms; allow mpdecision sysfs_memory:dir search; allow mpdecision system_data_file:dir w_dir_perms; allow mpdecision sysfs:file rw_file_perms; +allow mpdecision device_latency:chr_file w_file_perms; allow mpdecision mediaserver:dir search; allow mpdecision mediaserver:file { read open }; diff --git a/sepolicy/vendor/qmuxd.te b/sepolicy/vendor/qmuxd.te index fb9ca08..fbc34c4 100644 --- a/sepolicy/vendor/qmuxd.te +++ b/sepolicy/vendor/qmuxd.te @@ -3,4 +3,6 @@ allow qmuxd self:capability { dac_override setpcap setuid fsetid}; allow qmuxd sysfs:file { getattr }; allow qmuxd sysfs:file rw_file_perms; +allow qmuxd hsic_device:chr_file { rw_file_perms }; + wakelock_use(qmuxd) diff --git a/sepolicy/vendor/system_app.te b/sepolicy/vendor/system_app.te index ef6c052..d5c1211 100755 --- a/sepolicy/vendor/system_app.te +++ b/sepolicy/vendor/system_app.te @@ -10,4 +10,5 @@ allow system_app doubletap2wake_sysfs:file rw_file_perms; allow system_app sysfs:file rw_file_perms; allow system_app doubletap2wake_sysfs:dir rw_dir_perms; allow system_app vold:binder call; -allow system_app wificond:binder call; \ No newline at end of file +allow system_app wificond:binder call; +allow system_app fm_radio_device:chr_file { read open ioctl}; \ No newline at end of file diff --git a/sepolicy/vendor/vold.te b/sepolicy/vendor/vold.te index 6369ce7..ecbe96f 100755 --- a/sepolicy/vendor/vold.te +++ b/sepolicy/vendor/vold.te @@ -1,3 +1,4 @@ allow vold hal_bootctl_hwservice:hwservice_manager find; allow vold block_device:blk_file rw_file_perms; -allow vold sysfs_mmc_host:file w_file_perms; \ No newline at end of file +allow vold sysfs_mmc_host:file w_file_perms; +allow vold qseecom_device:chr_file rw_file_perms; \ No newline at end of file From 486eea70f3b0fc4ddd7cc751397de526cb53be61 Mon Sep 17 00:00:00 2001 From: Soeren Schoenbrod Date: Sat, 28 May 2022 17:42:52 +0200 Subject: [PATCH 09/40] Remove device_latency --- sepolicy/vendor/device.te | 3 --- 1 file changed, 3 deletions(-) diff --git a/sepolicy/vendor/device.te b/sepolicy/vendor/device.te index 0f2784d..28853c5 100644 --- a/sepolicy/vendor/device.te +++ b/sepolicy/vendor/device.te @@ -2,9 +2,6 @@ type bluetooth_device, dev_type; type cir_device, dev_type; type qseecom_device, dev_type; -#Define mpdecision device -type device_latency, dev_type; - #Define the hsic device type hsic_device, dev_type; From 820252bdc42f8f5b43f7d917d7d10f68a940f311 Mon Sep 17 00:00:00 2001 From: Soeren Schoenbrod Date: Sat, 28 May 2022 17:49:00 +0200 Subject: [PATCH 10/40] Remove hsic_device --- sepolicy/vendor/device.te | 3 --- 1 file changed, 3 deletions(-) diff --git a/sepolicy/vendor/device.te b/sepolicy/vendor/device.te index 28853c5..67d5b52 100644 --- a/sepolicy/vendor/device.te +++ b/sepolicy/vendor/device.te @@ -2,8 +2,5 @@ type bluetooth_device, dev_type; type cir_device, dev_type; type qseecom_device, dev_type; -#Define the hsic device -type hsic_device, dev_type; - #Added for fm_radio device type fm_radio_device, dev_type; \ No newline at end of file From f6555ee1bc52ae8f1830fd6c3409e5398fb63e1a Mon Sep 17 00:00:00 2001 From: Soeren Schoenbrod Date: Sat, 28 May 2022 17:56:32 +0200 Subject: [PATCH 11/40] Remove fm_radio_device --- sepolicy/vendor/device.te | 5 +---- sepolicy/vendor/file_contexts | 3 +-- 2 files changed, 2 insertions(+), 6 deletions(-) diff --git a/sepolicy/vendor/device.te b/sepolicy/vendor/device.te index 67d5b52..44b1af7 100644 --- a/sepolicy/vendor/device.te +++ b/sepolicy/vendor/device.te @@ -1,6 +1,3 @@ type bluetooth_device, dev_type; type cir_device, dev_type; -type qseecom_device, dev_type; - -#Added for fm_radio device -type fm_radio_device, dev_type; \ No newline at end of file +type qseecom_device, dev_type; \ No newline at end of file diff --git a/sepolicy/vendor/file_contexts b/sepolicy/vendor/file_contexts index 406dc99..3df47ed 100644 --- a/sepolicy/vendor/file_contexts +++ b/sepolicy/vendor/file_contexts @@ -118,5 +118,4 @@ /dev/cpu_dma_latency u:object_r:device_latency:s0 /dev/kgsl-3d0 u:object_r:gpu_device:s0 -/dev/hsicctl.* u:object_r:hsic_device:s0 -/dev/radio0 u:object_r:fm_radio_device:s0 \ No newline at end of file +/dev/hsicctl.* u:object_r:hsic_device:s0 \ No newline at end of file From 0693e2f9c3ea2b06036ecd48d5f157630dbca413 Mon Sep 17 00:00:00 2001 From: Soeren Schoenbrod Date: Sat, 28 May 2022 18:17:29 +0200 Subject: [PATCH 12/40] Remove multiple specifications of the same label --- sepolicy/vendor/device.te | 3 +-- sepolicy/vendor/file_contexts | 8 +------- sepolicy/vendor/keystore.te | 2 +- sepolicy/vendor/mm-qcamerad.te | 2 +- sepolicy/vendor/qseecomd.te | 2 +- sepolicy/vendor/vold.te | 2 +- 6 files changed, 6 insertions(+), 13 deletions(-) diff --git a/sepolicy/vendor/device.te b/sepolicy/vendor/device.te index 44b1af7..ea917bd 100644 --- a/sepolicy/vendor/device.te +++ b/sepolicy/vendor/device.te @@ -1,3 +1,2 @@ type bluetooth_device, dev_type; -type cir_device, dev_type; -type qseecom_device, dev_type; \ No newline at end of file +type cir_device, dev_type; \ No newline at end of file diff --git a/sepolicy/vendor/file_contexts b/sepolicy/vendor/file_contexts index 3df47ed..fabe702 100644 --- a/sepolicy/vendor/file_contexts +++ b/sepolicy/vendor/file_contexts @@ -19,7 +19,6 @@ /data/cam_socket.* u:object_r:camera_socket:s0 /dev/gemini.* u:object_r:camera_device:s0 /dev/rawchip.* u:object_r:camera_device:s0 -/dev/v4l-subdev.* u:object_r:camera_device:s0 /(system|vendor|system/vendor)/bin/mm-qcamera-daemon u:object_r:mm-qcamerad_exec:s0 ################################### @@ -113,9 +112,4 @@ /sys/android_touch/doubletap2wake u:object_r:doubletap2wake_sysfs:s0 # Qualcomm -/system/bin/qseecomd u:object_r:qseecomd_exec:s0 -/dev/qseecom u:object_r:qseecom_device:s0 - -/dev/cpu_dma_latency u:object_r:device_latency:s0 -/dev/kgsl-3d0 u:object_r:gpu_device:s0 -/dev/hsicctl.* u:object_r:hsic_device:s0 \ No newline at end of file +/system/bin/qseecomd u:object_r:qseecomd_exec:s0 \ No newline at end of file diff --git a/sepolicy/vendor/keystore.te b/sepolicy/vendor/keystore.te index a7e2174..15bc434 100755 --- a/sepolicy/vendor/keystore.te +++ b/sepolicy/vendor/keystore.te @@ -1,3 +1,3 @@ allow keystore firmware_file:dir search; allow keystore firmware_file:file { getattr open read }; -allow keystore qseecom_device:chr_file { read write ioctl open }; +allow keystore tee_device:chr_file { read write ioctl open }; diff --git a/sepolicy/vendor/mm-qcamerad.te b/sepolicy/vendor/mm-qcamerad.te index 8e77c3f..fc58a94 100644 --- a/sepolicy/vendor/mm-qcamerad.te +++ b/sepolicy/vendor/mm-qcamerad.te @@ -1,7 +1,7 @@ type_transition mm-qcamerad system_data_file:sock_file camera_socket "cam_socket0"; allow mm-qcamerad camera_device:dir search; -allow mm-qcamerad { camera_device gpu_device video_device }:chr_file rw_file_perms; +allow mm-qcamerad { gpu_device video_device }:chr_file rw_file_perms; allow mm-qcamerad camera_socket:sock_file setattr; allow mm-qcamerad system_data_file:dir { add_name remove_name }; diff --git a/sepolicy/vendor/qseecomd.te b/sepolicy/vendor/qseecomd.te index 9291355..a6889d4 100644 --- a/sepolicy/vendor/qseecomd.te +++ b/sepolicy/vendor/qseecomd.te @@ -5,7 +5,7 @@ init_daemon_domain(qseecomd) allow qseecomd block_device:dir search; allow qseecomd self:capability { setgid setuid dac_override }; allow qseecomd firmware_file:dir search; -allow qseecomd qseecom_device:chr_file { read write ioctl open }; +allow qseecomd tee_device:chr_file { read write ioctl open }; allow tee system_file:file execmod; allow tee vendor_file:file execmod; diff --git a/sepolicy/vendor/vold.te b/sepolicy/vendor/vold.te index ecbe96f..3fd59d9 100755 --- a/sepolicy/vendor/vold.te +++ b/sepolicy/vendor/vold.te @@ -1,4 +1,4 @@ allow vold hal_bootctl_hwservice:hwservice_manager find; allow vold block_device:blk_file rw_file_perms; allow vold sysfs_mmc_host:file w_file_perms; -allow vold qseecom_device:chr_file rw_file_perms; \ No newline at end of file +allow vold tee_device:chr_file rw_file_perms; \ No newline at end of file From b1b04c5f2581dcace5afd8731048606587eee3eb Mon Sep 17 00:00:00 2001 From: Soeren Schoenbrod Date: Sat, 28 May 2022 20:24:14 +0200 Subject: [PATCH 13/40] Allow qseecomd to execmod vendor_file --- sepolicy/vendor/mm-qcamerad.te | 2 +- sepolicy/vendor/qseecomd.te | 1 + 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/sepolicy/vendor/mm-qcamerad.te b/sepolicy/vendor/mm-qcamerad.te index fc58a94..15aabd7 100644 --- a/sepolicy/vendor/mm-qcamerad.te +++ b/sepolicy/vendor/mm-qcamerad.te @@ -2,6 +2,7 @@ type_transition mm-qcamerad system_data_file:sock_file camera_socket "cam_socket allow mm-qcamerad camera_device:dir search; allow mm-qcamerad { gpu_device video_device }:chr_file rw_file_perms; +allow mm-qcamerad camera_device:chr_file { read write }; allow mm-qcamerad camera_socket:sock_file setattr; allow mm-qcamerad system_data_file:dir { add_name remove_name }; @@ -19,4 +20,3 @@ allow mm-qcamerad { audioserver cameraserver surfaceflinger mediaserver }:fd use allow mm-qcamerad { hal_graphics_allocator hal_camera_default }:fd use; allow mm-qcamerad hal_renderscript_hwservice:hwservice_manager find; binder_call(mm-qcamerad, servicemanager); - diff --git a/sepolicy/vendor/qseecomd.te b/sepolicy/vendor/qseecomd.te index a6889d4..ba5ea45 100644 --- a/sepolicy/vendor/qseecomd.te +++ b/sepolicy/vendor/qseecomd.te @@ -6,6 +6,7 @@ allow qseecomd block_device:dir search; allow qseecomd self:capability { setgid setuid dac_override }; allow qseecomd firmware_file:dir search; allow qseecomd tee_device:chr_file { read write ioctl open }; +allow qseecomd vendor_file:file execmod; allow tee system_file:file execmod; allow tee vendor_file:file execmod; From 99aa45075c9cbcb2596fea109f1fd48afdab31d8 Mon Sep 17 00:00:00 2001 From: Soeren Schoenbrod Date: Sat, 28 May 2022 21:58:50 +0200 Subject: [PATCH 14/40] Address more denials --- sepolicy/vendor/mm-qcamerad.te | 2 +- sepolicy/vendor/qseecomd.te | 1 + 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/sepolicy/vendor/mm-qcamerad.te b/sepolicy/vendor/mm-qcamerad.te index 15aabd7..17a79b9 100644 --- a/sepolicy/vendor/mm-qcamerad.te +++ b/sepolicy/vendor/mm-qcamerad.te @@ -2,7 +2,7 @@ type_transition mm-qcamerad system_data_file:sock_file camera_socket "cam_socket allow mm-qcamerad camera_device:dir search; allow mm-qcamerad { gpu_device video_device }:chr_file rw_file_perms; -allow mm-qcamerad camera_device:chr_file { read write }; +allow mm-qcamerad camera_device:chr_file { open read write }; allow mm-qcamerad camera_socket:sock_file setattr; allow mm-qcamerad system_data_file:dir { add_name remove_name }; diff --git a/sepolicy/vendor/qseecomd.te b/sepolicy/vendor/qseecomd.te index ba5ea45..533161c 100644 --- a/sepolicy/vendor/qseecomd.te +++ b/sepolicy/vendor/qseecomd.te @@ -7,6 +7,7 @@ allow qseecomd self:capability { setgid setuid dac_override }; allow qseecomd firmware_file:dir search; allow qseecomd tee_device:chr_file { read write ioctl open }; allow qseecomd vendor_file:file execmod; +allow qseecomd ion_device:chr_file read; allow tee system_file:file execmod; allow tee vendor_file:file execmod; From 405cbdbc1d6922853e4a35ece285900bf9571c38 Mon Sep 17 00:00:00 2001 From: Soeren Schoenbrod Date: Tue, 24 May 2022 08:40:00 +0200 Subject: [PATCH 15/40] Subsystem silent restart and selinux: isolated_app --- sepolicy/vendor/isolated_app.te | 2 +- system_prop.mk | 4 ++++ 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/sepolicy/vendor/isolated_app.te b/sepolicy/vendor/isolated_app.te index 86ffdff..b9ae6d7 100755 --- a/sepolicy/vendor/isolated_app.te +++ b/sepolicy/vendor/isolated_app.te @@ -1,2 +1,2 @@ allow isolated_app sysfs:dir open; - +allow isolated_app app_data_file:file setattr; diff --git a/system_prop.mk b/system_prop.mk index 4b72ff5..afa715f 100644 --- a/system_prop.mk +++ b/system_prop.mk @@ -17,3 +17,7 @@ PRODUCT_PROPERTY_OVERRIDES += \ # Vendor security patch level PRODUCT_PROPERTY_OVERRIDES += \ ro.lineage.build.vendor_security_patch=2015-08-05 + +# Subsystem silent restart +PRODUCT_PROPERTY_OVERRIDES += \ + persist.vendor.sys.ssr.restart_level=modem,adsp,slpi \ No newline at end of file From 43136af68dc11b7f67eceaf67a83433c39cbf512 Mon Sep 17 00:00:00 2001 From: Soeren Schoenbrod Date: Sat, 28 May 2022 23:32:31 +0200 Subject: [PATCH 16/40] Allow qseecomd to open ion_device --- sepolicy/vendor/qseecomd.te | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sepolicy/vendor/qseecomd.te b/sepolicy/vendor/qseecomd.te index 533161c..36ffc1a 100644 --- a/sepolicy/vendor/qseecomd.te +++ b/sepolicy/vendor/qseecomd.te @@ -7,7 +7,7 @@ allow qseecomd self:capability { setgid setuid dac_override }; allow qseecomd firmware_file:dir search; allow qseecomd tee_device:chr_file { read write ioctl open }; allow qseecomd vendor_file:file execmod; -allow qseecomd ion_device:chr_file read; +allow qseecomd ion_device:chr_file { open read }; allow tee system_file:file execmod; allow tee vendor_file:file execmod; From 278393e526ca5f3324ea353443c881ed5d357bc1 Mon Sep 17 00:00:00 2001 From: Soeren Schoenbrod Date: Sun, 29 May 2022 09:44:10 +0200 Subject: [PATCH 17/40] Allow qseecomd to ioctl ion_device --- sepolicy/vendor/qseecomd.te | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sepolicy/vendor/qseecomd.te b/sepolicy/vendor/qseecomd.te index 36ffc1a..ae13f16 100644 --- a/sepolicy/vendor/qseecomd.te +++ b/sepolicy/vendor/qseecomd.te @@ -7,7 +7,7 @@ allow qseecomd self:capability { setgid setuid dac_override }; allow qseecomd firmware_file:dir search; allow qseecomd tee_device:chr_file { read write ioctl open }; allow qseecomd vendor_file:file execmod; -allow qseecomd ion_device:chr_file { open read }; +allow qseecomd ion_device:chr_file { ioctl open read }; allow tee system_file:file execmod; allow tee vendor_file:file execmod; From b36497318b0638b3f953e6c37540153b08726872 Mon Sep 17 00:00:00 2001 From: Soeren Schoenbrod Date: Sun, 29 May 2022 10:50:11 +0200 Subject: [PATCH 18/40] Allow storaged --- sepolicy/private/file.te | 2 ++ sepolicy/private/storaged.te | 2 ++ sepolicy/private/system_app.te | 2 ++ 3 files changed, 6 insertions(+) create mode 100644 sepolicy/private/file.te create mode 100644 sepolicy/private/storaged.te create mode 100644 sepolicy/private/system_app.te diff --git a/sepolicy/private/file.te b/sepolicy/private/file.te new file mode 100644 index 0000000..2e11585 --- /dev/null +++ b/sepolicy/private/file.te @@ -0,0 +1,2 @@ +type sysfs_disk_pre_eol_info, fs_type, sysfs_type; +type sysfs_disk_rev, fs_type, sysfs_type; diff --git a/sepolicy/private/storaged.te b/sepolicy/private/storaged.te new file mode 100644 index 0000000..f3512ff --- /dev/null +++ b/sepolicy/private/storaged.te @@ -0,0 +1,2 @@ +r_dir_file(storaged, sysfs_disk_pre_eol_info) +r_dir_file(storaged, sysfs_disk_rev) diff --git a/sepolicy/private/system_app.te b/sepolicy/private/system_app.te new file mode 100644 index 0000000..592626c --- /dev/null +++ b/sepolicy/private/system_app.te @@ -0,0 +1,2 @@ +binder_call(system_app, storaged) +binder_call(system_app, system_suspend) From 4b1fe2ad07c1bc2e572695aadd0bd56b3868eb70 Mon Sep 17 00:00:00 2001 From: Soeren Schoenbrod Date: Mon, 30 May 2022 08:57:47 +0200 Subject: [PATCH 19/40] Use default pmf in wpa_supplicant --- configs/wpa_supplicant_overlay.conf | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/configs/wpa_supplicant_overlay.conf b/configs/wpa_supplicant_overlay.conf index 0438c37..93547d0 100644 --- a/configs/wpa_supplicant_overlay.conf +++ b/configs/wpa_supplicant_overlay.conf @@ -4,5 +4,4 @@ tdls_external_control=1 interworking=1 hs20=1 auto_interworking=0 -driver_param=use_p2p_group_interface=1 -pmf=0 \ No newline at end of file +driver_param=use_p2p_group_interface=1 \ No newline at end of file From 0d85771453c01ff3adb6379d445fb77f9b57aeca Mon Sep 17 00:00:00 2001 From: Soeren Schoenbrod Date: Wed, 1 Jun 2022 08:51:08 +0200 Subject: [PATCH 20/40] Address sepolicy denials for vold system_server storaged and untrusted_app --- sepolicy/vendor/storaged.te | 1 + sepolicy/vendor/system_server.te | 1 + sepolicy/vendor/untrusted_app.te | 1 + sepolicy/vendor/vold.te | 3 ++- 4 files changed, 5 insertions(+), 1 deletion(-) create mode 100644 sepolicy/vendor/storaged.te create mode 100644 sepolicy/vendor/untrusted_app.te diff --git a/sepolicy/vendor/storaged.te b/sepolicy/vendor/storaged.te new file mode 100644 index 0000000..b9a05d5 --- /dev/null +++ b/sepolicy/vendor/storaged.te @@ -0,0 +1 @@ +allow storaged sysfs:file read; \ No newline at end of file diff --git a/sepolicy/vendor/system_server.te b/sepolicy/vendor/system_server.te index eb41bec..8efc533 100644 --- a/sepolicy/vendor/system_server.te +++ b/sepolicy/vendor/system_server.te @@ -11,6 +11,7 @@ allow system_server unlabeled:file { rw_file_perms unlink }; allow system_server unlabeled:dir rw_dir_perms; allow system_server tombstones_file:dir rw_dir_perms; allow system_server hal_light_default:process signal; +allow system_server app_zygote:process getpgid; get_prop(system_server, exported_camera_prop); get_prop(system_server, userspace_reboot_config_prop); diff --git a/sepolicy/vendor/untrusted_app.te b/sepolicy/vendor/untrusted_app.te new file mode 100644 index 0000000..ef4ff99 --- /dev/null +++ b/sepolicy/vendor/untrusted_app.te @@ -0,0 +1 @@ +allow untrusted_app exported_camera_prop:file read; \ No newline at end of file diff --git a/sepolicy/vendor/vold.te b/sepolicy/vendor/vold.te index 3fd59d9..6f7fc76 100755 --- a/sepolicy/vendor/vold.te +++ b/sepolicy/vendor/vold.te @@ -1,4 +1,5 @@ allow vold hal_bootctl_hwservice:hwservice_manager find; allow vold block_device:blk_file rw_file_perms; allow vold sysfs_mmc_host:file w_file_perms; -allow vold tee_device:chr_file rw_file_perms; \ No newline at end of file +allow vold tee_device:chr_file rw_file_perms; +allow vold cache_block_device:blk_file getattr; \ No newline at end of file From cd39296aca6a27e031adc08df2ad94eb7f2cf0f4 Mon Sep 17 00:00:00 2001 From: Soeren Schoenbrod Date: Wed, 1 Jun 2022 09:07:20 +0200 Subject: [PATCH 21/40] Allow storaged to read sysfs:file in private folder --- sepolicy/private/storaged.te | 1 + sepolicy/vendor/storaged.te | 1 - 2 files changed, 1 insertion(+), 1 deletion(-) delete mode 100644 sepolicy/vendor/storaged.te diff --git a/sepolicy/private/storaged.te b/sepolicy/private/storaged.te index f3512ff..d5c0b58 100644 --- a/sepolicy/private/storaged.te +++ b/sepolicy/private/storaged.te @@ -1,2 +1,3 @@ r_dir_file(storaged, sysfs_disk_pre_eol_info) r_dir_file(storaged, sysfs_disk_rev) +allow storaged sysfs:file read; \ No newline at end of file diff --git a/sepolicy/vendor/storaged.te b/sepolicy/vendor/storaged.te deleted file mode 100644 index b9a05d5..0000000 --- a/sepolicy/vendor/storaged.te +++ /dev/null @@ -1 +0,0 @@ -allow storaged sysfs:file read; \ No newline at end of file From d40e45f743f38ffe2be422e178a29f674c2a0535 Mon Sep 17 00:00:00 2001 From: Soeren Schoenbrod Date: Wed, 1 Jun 2022 10:16:39 +0200 Subject: [PATCH 22/40] Allow storaged to open sysfs:file in private folder --- sepolicy/private/storaged.te | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sepolicy/private/storaged.te b/sepolicy/private/storaged.te index d5c0b58..ce23206 100644 --- a/sepolicy/private/storaged.te +++ b/sepolicy/private/storaged.te @@ -1,3 +1,3 @@ r_dir_file(storaged, sysfs_disk_pre_eol_info) r_dir_file(storaged, sysfs_disk_rev) -allow storaged sysfs:file read; \ No newline at end of file +allow storaged sysfs:file { read open }; \ No newline at end of file From 9ae7f60e88731754390fa3b516cde13dc42aaa63 Mon Sep 17 00:00:00 2001 From: Soeren Schoenbrod Date: Wed, 1 Jun 2022 11:33:49 +0200 Subject: [PATCH 23/40] Allow storaged to getattr sysfs:file in private folder --- sepolicy/private/storaged.te | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sepolicy/private/storaged.te b/sepolicy/private/storaged.te index ce23206..18ffdeb 100644 --- a/sepolicy/private/storaged.te +++ b/sepolicy/private/storaged.te @@ -1,3 +1,3 @@ r_dir_file(storaged, sysfs_disk_pre_eol_info) r_dir_file(storaged, sysfs_disk_rev) -allow storaged sysfs:file { read open }; \ No newline at end of file +allow storaged sysfs:file { read open getattr }; \ No newline at end of file From b9f5c6d17bf4a5aef63369cfa17041fcc577f494 Mon Sep 17 00:00:00 2001 From: Soeren Schoenbrod Date: Wed, 1 Jun 2022 12:36:21 +0200 Subject: [PATCH 24/40] Address camera sepolicy --- sepolicy/vendor/mm-qcamerad.te | 2 +- sepolicy/vendor/priv-app.te | 1 + 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/sepolicy/vendor/mm-qcamerad.te b/sepolicy/vendor/mm-qcamerad.te index 17a79b9..b01a8d3 100644 --- a/sepolicy/vendor/mm-qcamerad.te +++ b/sepolicy/vendor/mm-qcamerad.te @@ -2,7 +2,7 @@ type_transition mm-qcamerad system_data_file:sock_file camera_socket "cam_socket allow mm-qcamerad camera_device:dir search; allow mm-qcamerad { gpu_device video_device }:chr_file rw_file_perms; -allow mm-qcamerad camera_device:chr_file { open read write }; +allow mm-qcamerad camera_device:chr_file { open read write ioctl }; allow mm-qcamerad camera_socket:sock_file setattr; allow mm-qcamerad system_data_file:dir { add_name remove_name }; diff --git a/sepolicy/vendor/priv-app.te b/sepolicy/vendor/priv-app.te index 39d4505..489b8b4 100755 --- a/sepolicy/vendor/priv-app.te +++ b/sepolicy/vendor/priv-app.te @@ -1,3 +1,4 @@ allow priv_app { camera_prop proc_interrupts }:file { open read }; allow priv_app sysfs:file rw_file_perms; get_prop(priv_app, camera_prop) +allow priv_app exported_camera_prop:file read; \ No newline at end of file From 601877ddfc9ff2d50457f85430fb996866337c93 Mon Sep 17 00:00:00 2001 From: Soeren Schoenbrod Date: Fri, 3 Jun 2022 20:33:16 +0200 Subject: [PATCH 25/40] Allow sepolicy for incidentd gpuservice dumpstate --- sepolicy/private/incidentd.te | 0 sepolicy/vendor/dumpstate.te | 2 ++ sepolicy/vendor/gpuservice.te | 1 + 3 files changed, 3 insertions(+) create mode 100644 sepolicy/private/incidentd.te create mode 100644 sepolicy/vendor/dumpstate.te create mode 100644 sepolicy/vendor/gpuservice.te diff --git a/sepolicy/private/incidentd.te b/sepolicy/private/incidentd.te new file mode 100644 index 0000000..e69de29 diff --git a/sepolicy/vendor/dumpstate.te b/sepolicy/vendor/dumpstate.te new file mode 100644 index 0000000..79f35dd --- /dev/null +++ b/sepolicy/vendor/dumpstate.te @@ -0,0 +1,2 @@ +allow dumpstate firmware_file:dir search; +allow dumpstate proc:file read; \ No newline at end of file diff --git a/sepolicy/vendor/gpuservice.te b/sepolicy/vendor/gpuservice.te new file mode 100644 index 0000000..3c5842d --- /dev/null +++ b/sepolicy/vendor/gpuservice.te @@ -0,0 +1 @@ +allow gpuservice graphics_config_prop:file { read r_file_perms }; \ No newline at end of file From 5babf7ca64057c56b5298deee98ad1facd1a7346 Mon Sep 17 00:00:00 2001 From: Soeren Schoenbrod Date: Fri, 3 Jun 2022 21:52:10 +0200 Subject: [PATCH 26/40] Allow sepolicy for dumpstate hwservicemanager --- sepolicy/vendor/dumpstate.te | 4 ++++ sepolicy/vendor/hwservicemanager.te | 1 + 2 files changed, 5 insertions(+) create mode 100644 sepolicy/vendor/hwservicemanager.te diff --git a/sepolicy/vendor/dumpstate.te b/sepolicy/vendor/dumpstate.te index 79f35dd..65c49fc 100644 --- a/sepolicy/vendor/dumpstate.te +++ b/sepolicy/vendor/dumpstate.te @@ -1,2 +1,6 @@ +allow dumpstate adbroot_exec:file getattr; +allow dumpstate akmd_exec:file getattr; +allow dumpstate apexd_exec:file getattr; +allow dumpstate atrace_exec:file getattr; allow dumpstate firmware_file:dir search; allow dumpstate proc:file read; \ No newline at end of file diff --git a/sepolicy/vendor/hwservicemanager.te b/sepolicy/vendor/hwservicemanager.te new file mode 100644 index 0000000..5226d40 --- /dev/null +++ b/sepolicy/vendor/hwservicemanager.te @@ -0,0 +1 @@ +allow hwservicemanager dumpstate:fd use; \ No newline at end of file From 3f804cb13a7dbe04113c7bafa299e454cd66bf70 Mon Sep 17 00:00:00 2001 From: Soeren Schoenbrod Date: Fri, 3 Jun 2022 22:10:28 +0200 Subject: [PATCH 27/40] Remove adbroot from dumpstate --- sepolicy/private/incidentd.te | 3 +++ sepolicy/vendor/dumpstate.te | 1 - 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/sepolicy/private/incidentd.te b/sepolicy/private/incidentd.te index e69de29..91f5eee 100644 --- a/sepolicy/private/incidentd.te +++ b/sepolicy/private/incidentd.te @@ -0,0 +1,3 @@ +allow incidentd bluetooth_prop:file read; +allow incidentd proc:file read; +allow incident dumpstate:fifo_file write; \ No newline at end of file diff --git a/sepolicy/vendor/dumpstate.te b/sepolicy/vendor/dumpstate.te index 65c49fc..df6586d 100644 --- a/sepolicy/vendor/dumpstate.te +++ b/sepolicy/vendor/dumpstate.te @@ -1,4 +1,3 @@ -allow dumpstate adbroot_exec:file getattr; allow dumpstate akmd_exec:file getattr; allow dumpstate apexd_exec:file getattr; allow dumpstate atrace_exec:file getattr; From 7cbc431e6df4afd71d9ab911cd7b7ddb6aa1cd87 Mon Sep 17 00:00:00 2001 From: Soeren Schoenbrod Date: Fri, 3 Jun 2022 22:25:06 +0200 Subject: [PATCH 28/40] Move dumpstate to private --- sepolicy/{vendor => private}/dumpstate.te | 1 + 1 file changed, 1 insertion(+) rename sepolicy/{vendor => private}/dumpstate.te (82%) diff --git a/sepolicy/vendor/dumpstate.te b/sepolicy/private/dumpstate.te similarity index 82% rename from sepolicy/vendor/dumpstate.te rename to sepolicy/private/dumpstate.te index df6586d..65c49fc 100644 --- a/sepolicy/vendor/dumpstate.te +++ b/sepolicy/private/dumpstate.te @@ -1,3 +1,4 @@ +allow dumpstate adbroot_exec:file getattr; allow dumpstate akmd_exec:file getattr; allow dumpstate apexd_exec:file getattr; allow dumpstate atrace_exec:file getattr; From a34cb78ee37fa94b3956ec9908116b621161ee37 Mon Sep 17 00:00:00 2001 From: Soeren Schoenbrod Date: Fri, 3 Jun 2022 22:43:53 +0200 Subject: [PATCH 29/40] Add akmd_exec --- sepolicy/private/dumpstate.te | 3 +++ 1 file changed, 3 insertions(+) diff --git a/sepolicy/private/dumpstate.te b/sepolicy/private/dumpstate.te index 65c49fc..b54207a 100644 --- a/sepolicy/private/dumpstate.te +++ b/sepolicy/private/dumpstate.te @@ -1,3 +1,6 @@ +type akmd, domain; +type akmd_exec, exec_type, file_type; + allow dumpstate adbroot_exec:file getattr; allow dumpstate akmd_exec:file getattr; allow dumpstate apexd_exec:file getattr; From 2269fc10a0ca93f5e862dce1d745b5978a268cab Mon Sep 17 00:00:00 2001 From: Soeren Schoenbrod Date: Fri, 3 Jun 2022 22:52:32 +0200 Subject: [PATCH 30/40] Split dumpstate into private and vendor --- sepolicy/private/dumpstate.te | 4 ---- sepolicy/vendor/dumpstate.te | 1 + 2 files changed, 1 insertion(+), 4 deletions(-) create mode 100644 sepolicy/vendor/dumpstate.te diff --git a/sepolicy/private/dumpstate.te b/sepolicy/private/dumpstate.te index b54207a..71fbf6f 100644 --- a/sepolicy/private/dumpstate.te +++ b/sepolicy/private/dumpstate.te @@ -1,8 +1,4 @@ -type akmd, domain; -type akmd_exec, exec_type, file_type; - allow dumpstate adbroot_exec:file getattr; -allow dumpstate akmd_exec:file getattr; allow dumpstate apexd_exec:file getattr; allow dumpstate atrace_exec:file getattr; allow dumpstate firmware_file:dir search; diff --git a/sepolicy/vendor/dumpstate.te b/sepolicy/vendor/dumpstate.te new file mode 100644 index 0000000..3e87097 --- /dev/null +++ b/sepolicy/vendor/dumpstate.te @@ -0,0 +1 @@ +allow dumpstate akmd_exec:file getattr; \ No newline at end of file From 83ad1def696a8948b55aefca30d0e9b4903cea21 Mon Sep 17 00:00:00 2001 From: Soeren Schoenbrod Date: Fri, 3 Jun 2022 23:06:44 +0200 Subject: [PATCH 31/40] Move firmware_file and proc from private to vendor --- sepolicy/private/dumpstate.te | 4 +--- sepolicy/vendor/dumpstate.te | 4 +++- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/sepolicy/private/dumpstate.te b/sepolicy/private/dumpstate.te index 71fbf6f..f87d439 100644 --- a/sepolicy/private/dumpstate.te +++ b/sepolicy/private/dumpstate.te @@ -1,5 +1,3 @@ allow dumpstate adbroot_exec:file getattr; allow dumpstate apexd_exec:file getattr; -allow dumpstate atrace_exec:file getattr; -allow dumpstate firmware_file:dir search; -allow dumpstate proc:file read; \ No newline at end of file +allow dumpstate atrace_exec:file getattr; \ No newline at end of file diff --git a/sepolicy/vendor/dumpstate.te b/sepolicy/vendor/dumpstate.te index 3e87097..31f7c79 100644 --- a/sepolicy/vendor/dumpstate.te +++ b/sepolicy/vendor/dumpstate.te @@ -1 +1,3 @@ -allow dumpstate akmd_exec:file getattr; \ No newline at end of file +allow dumpstate akmd_exec:file getattr; +allow dumpstate firmware_file:dir search; +allow dumpstate proc:file read; \ No newline at end of file From e7adc7a0a9935c102cecd5e08ea166b0f651aee5 Mon Sep 17 00:00:00 2001 From: Soeren Schoenbrod Date: Fri, 3 Jun 2022 23:53:33 +0200 Subject: [PATCH 32/40] Reconfigure some permissions for ueventd and set restart level to 3 --- rootdir/etc/init.qcom.rc | 10 ++++++++-- rootdir/etc/ueventd.qcom.rc | 20 ++++++++++---------- system_prop.mk | 6 +----- 3 files changed, 19 insertions(+), 17 deletions(-) diff --git a/rootdir/etc/init.qcom.rc b/rootdir/etc/init.qcom.rc index 442ebea..b63706e 100644 --- a/rootdir/etc/init.qcom.rc +++ b/rootdir/etc/init.qcom.rc @@ -365,6 +365,12 @@ on boot # Bluetooth MAC address chown bluetooth bluetooth /sys/module/htc_bdaddress/parameters/bdaddress + # Set subsystem restart level + # 1 = SOC + # 2 = COUPLED + # 3 = INDEPENDENT + write /sys/module/subsystem_restart/parameters/restart_level 3 + # Wifi firmware reload path chown wifi wifi /sys/module/bcmdhd/parameters/firmware_path @@ -392,7 +398,7 @@ service netmgrd /system/bin/netmgrd service mpdecision /system/bin/mpdecision --no_sleep --avg_comp class main user root - group root readproc + group root system readproc wakelock disabled service qcamerasvr /system/bin/mm-qcamera-daemon @@ -404,7 +410,7 @@ service qcamerasvr /system/bin/mm-qcamera-daemon service qmuxd /system/bin/qmuxd class core user root - group radio audio gps wakelock oem_2950 + group radio audio bluetooth gps diag wakelock log oem_2950 service qseecomd /system/bin/qseecomd class core diff --git a/rootdir/etc/ueventd.qcom.rc b/rootdir/etc/ueventd.qcom.rc index e332dd2..5fd8c2f 100644 --- a/rootdir/etc/ueventd.qcom.rc +++ b/rootdir/etc/ueventd.qcom.rc @@ -1,17 +1,17 @@ -/dev/rtc0 0600 system system +/dev/rtc0 0660 system system # the DIAG device node is world writable/readable. -/dev/diag 0666 root root +/dev/diag 0666 root diag # the genlock client device node is world writable/readable. -/dev/genlock 0666 root root +/dev/genlock 0666 system system # gpu driver for adreno200 is globally accessible -/dev/kgsl 0666 root root -/dev/kgsl-3d0 0666 root root +/dev/kgsl 0666 system system +/dev/kgsl-3d0 0666 system system /dev/kgsl-2d0 0666 root root /dev/kgsl-2d1 0666 root root -/dev/msm_rotator 0660 system graphics +/dev/msm_rotator 0660 system system # these should not be world writable /dev/ttyHS0 0660 bluetooth bluetooth @@ -38,7 +38,7 @@ /dev/smd2 0660 bluetooth bluetooth /dev/smd5 0660 system system /dev/smd6 0660 system system -/dev/smd7 0640 radio radio +/dev/smd7 0660 radio radio /dev/smd11 0660 radio radio /dev/smdcntl0 0640 radio radio /dev/smdcntl1 0640 radio radio @@ -106,7 +106,7 @@ /dev/msm_qcelp_in 0660 system audio /dev/msm_evrc_in 0660 system audio /dev/msm_preproc_ctl 0660 system audio -/dev/msm_a2dp_in 0640 system audio +/dev/msm_a2dp_in 0660 system audio /dev/msm_amrnb_in 0660 system audio /dev/msm_amrwb_in 0660 system audio /sys/devices/virtual/smdpkt/smdcntl* open_timeout 0664 radio radio @@ -142,13 +142,13 @@ # MPU3050 /dev/mpu 0664 system system /dev/mpuirq 0664 system system -/dev/timerirq 0644 system system +/dev/timerirq 0664 system system # AKM8963 /dev/akm8963_dev 0660 system system # Bluetooth -/dev/btlock 0600 bluetooth bluetooth +/dev/btlock 0660 bluetooth bluetooth # keystore /dev/qseecom 0660 system drmrpc diff --git a/system_prop.mk b/system_prop.mk index afa715f..8b162c4 100644 --- a/system_prop.mk +++ b/system_prop.mk @@ -16,8 +16,4 @@ PRODUCT_PROPERTY_OVERRIDES += \ # Vendor security patch level PRODUCT_PROPERTY_OVERRIDES += \ - ro.lineage.build.vendor_security_patch=2015-08-05 - -# Subsystem silent restart -PRODUCT_PROPERTY_OVERRIDES += \ - persist.vendor.sys.ssr.restart_level=modem,adsp,slpi \ No newline at end of file + ro.lineage.build.vendor_security_patch=2015-08-05 \ No newline at end of file From 888e8faed60422bd26c6b9970615d09090373384 Mon Sep 17 00:00:00 2001 From: Soeren Schoenbrod Date: Sat, 4 Jun 2022 12:53:32 +0200 Subject: [PATCH 33/40] Set permissions in ueventd.qcom.rc --- rootdir/etc/ueventd.qcom.rc | 39 +++++++++++++++++++++++++++++++++++-- 1 file changed, 37 insertions(+), 2 deletions(-) diff --git a/rootdir/etc/ueventd.qcom.rc b/rootdir/etc/ueventd.qcom.rc index 5fd8c2f..9cc8b05 100644 --- a/rootdir/etc/ueventd.qcom.rc +++ b/rootdir/etc/ueventd.qcom.rc @@ -24,8 +24,8 @@ /dev/msm_camera/* 0660 system camera /dev/radio0 0640 system system /dev/i2c-0 0664 root system -/dev/i2c-1 0664 root system /dev/i2c-2 0664 root system +/dev/i2c-3 0664 root system /dev/i2c-4 0664 root system /dev/msm_mvs 0660 system audio /dev/msm_voicememo 0660 system audio @@ -73,7 +73,6 @@ /dev/mdm 0660 system radio /dev/ttyHSL1 0660 system system /dev/tty_sdio_00 0660 system system -/dev/block/mmcblk0p17 0660 system system /dev/block/mmcblk0p18 0660 system system /dev/config* 0660 system camera /dev/video* 0660 system camera @@ -162,3 +161,39 @@ /sys/devices/virtual/optical_sensors/lightsensor ls_poll_delay 0660 input system /sys/devices/virtual/input/input* poll 0660 input system /sys/devices/virtual/input/input* pollrate_ms 0660 input system + + +# From samsung jv +/dev/qmi0 0640 radio radio +/dev/qmi1 0640 radio radio +/dev/qmi2 0640 radio radio +/dev/smdcnt_rev0 0640 radio radio +/dev/smdcnt_rev1 0640 radio radio +/dev/smdcnt_rev2 0640 radio radio +/dev/smdcnt_rev3 0640 radio radio +/dev/smdcnt_rev4 0640 radio radio +/dev/smdcnt_rev5 0640 radio radio +/dev/smdcnt_rev6 0640 radio radio +/dev/smdcnt_rev7 0640 radio radio +/dev/smdcnt_rev8 0640 radio radio +/dev/v4l-subdev* 0660 system camera +/dev/graphics/* 0660 system system +/dev/tun 0660 system vpn +/dev/smd_cxm_qmi 0640 radio radio +/dev/msm_amrwbplus 0660 system audio +/dev/msm_mp3 0660 system audio +/dev/msm_sps 0660 system audio + +/sys/class/graphics/fb* format_3d 0664 system graphics +/sys/class/graphics/fb* hpd 0664 system graphics +/sys/class/graphics/fb* msm_fb_fps_level 0664 system graphics +/sys/class/graphics/fb* pa 0664 system graphics +/sys/class/graphics/fb* product_description 0664 system graphics +/sys/class/graphics/fb* vendor_name 0664 system graphics +/sys/class/graphics/fb* video_mode 0664 system graphics + +/sys/class/graphics/fb0 mode 0664 system graphics +/sys/class/graphics/fb0 modes 0664 system graphics + +/dev/block/mmcblk0p17 0660 system radio +/dev/block/mmcblk0p31 0660 system radio \ No newline at end of file From 73fed49978a138a37560831d0ab873aab80c18bb Mon Sep 17 00:00:00 2001 From: Soeren Schoenbrod Date: Sat, 4 Jun 2022 14:29:29 +0200 Subject: [PATCH 34/40] Allow more dumpstate evals --- rootdir/etc/init.qcom.rc | 2 +- sepolicy/private/incidentd.te | 4 ++-- sepolicy/vendor/dumpstate.te | 4 +++- 3 files changed, 6 insertions(+), 4 deletions(-) diff --git a/rootdir/etc/init.qcom.rc b/rootdir/etc/init.qcom.rc index b63706e..97b774b 100644 --- a/rootdir/etc/init.qcom.rc +++ b/rootdir/etc/init.qcom.rc @@ -404,7 +404,7 @@ service mpdecision /system/bin/mpdecision --no_sleep --avg_comp service qcamerasvr /system/bin/mm-qcamera-daemon class late_start user camera - group camera system inet graphics + group camera system inet input graphics # QMUX must be in multiple groups to support external process connections service qmuxd /system/bin/qmuxd diff --git a/sepolicy/private/incidentd.te b/sepolicy/private/incidentd.te index 91f5eee..3f16a8e 100644 --- a/sepolicy/private/incidentd.te +++ b/sepolicy/private/incidentd.te @@ -1,3 +1,3 @@ -allow incidentd bluetooth_prop:file read; -allow incidentd proc:file read; +allow incidentd bluetooth_prop:file { open read }; +allow incidentd proc:file { open read }; allow incident dumpstate:fifo_file write; \ No newline at end of file diff --git a/sepolicy/vendor/dumpstate.te b/sepolicy/vendor/dumpstate.te index 31f7c79..ec67bc2 100644 --- a/sepolicy/vendor/dumpstate.te +++ b/sepolicy/vendor/dumpstate.te @@ -1,3 +1,5 @@ allow dumpstate akmd_exec:file getattr; allow dumpstate firmware_file:dir search; -allow dumpstate proc:file read; \ No newline at end of file +allow dumpstate proc:file { open read }; +allow dumpstate unlabeled:dir getattr; +allow dumpstate unlabeled:filesystem getattr; \ No newline at end of file From 4c4f440bdefcba3f258ec557391e9c669449f9e3 Mon Sep 17 00:00:00 2001 From: Soeren Schoenbrod Date: Sat, 4 Jun 2022 18:10:22 +0200 Subject: [PATCH 35/40] Enable FM --- BoardConfigCommon.mk | 3 +++ 1 file changed, 3 insertions(+) diff --git a/BoardConfigCommon.mk b/BoardConfigCommon.mk index b2fc29b..057409a 100644 --- a/BoardConfigCommon.mk +++ b/BoardConfigCommon.mk @@ -51,6 +51,9 @@ BOARD_RECOVERYIMAGE_PARTITION_SIZE := 16776704 # GPS USE_DEVICE_SPECIFIC_GPS := true +# FM +BOARD_HAVE_QCOM_FM := true + # HIDL DEVICE_MANIFEST_FILE += $(LOCAL_PATH)/manifest.xml From ba35097128d3d0ea730402630bfdad4662a8fe63 Mon Sep 17 00:00:00 2001 From: Soeren Schoenbrod Date: Sat, 4 Jun 2022 19:55:27 +0200 Subject: [PATCH 36/40] Enable FM 2 --- BoardConfigCommon.mk | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/BoardConfigCommon.mk b/BoardConfigCommon.mk index 057409a..99ee810 100644 --- a/BoardConfigCommon.mk +++ b/BoardConfigCommon.mk @@ -53,6 +53,11 @@ USE_DEVICE_SPECIFIC_GPS := true # FM BOARD_HAVE_QCOM_FM := true +COMMON_GLOBAL_CFLAGS += -DQCOM_FM_ENABLED + +#ifeq ($(BOARD_HAVE_QCOM_FM),true) +# LOCAL_CFLAGS += -DQCOM_FM_ENABLED +#endif # HIDL DEVICE_MANIFEST_FILE += $(LOCAL_PATH)/manifest.xml From ea91ba2ec68c9bdbf0feddb92febde90768f24b5 Mon Sep 17 00:00:00 2001 From: Soeren Schoenbrod Date: Mon, 6 Jun 2022 09:24:07 +0200 Subject: [PATCH 37/40] Revert "Enable FM 2" This reverts commit ba35097128d3d0ea730402630bfdad4662a8fe63. --- BoardConfigCommon.mk | 5 ----- 1 file changed, 5 deletions(-) diff --git a/BoardConfigCommon.mk b/BoardConfigCommon.mk index 99ee810..057409a 100644 --- a/BoardConfigCommon.mk +++ b/BoardConfigCommon.mk @@ -53,11 +53,6 @@ USE_DEVICE_SPECIFIC_GPS := true # FM BOARD_HAVE_QCOM_FM := true -COMMON_GLOBAL_CFLAGS += -DQCOM_FM_ENABLED - -#ifeq ($(BOARD_HAVE_QCOM_FM),true) -# LOCAL_CFLAGS += -DQCOM_FM_ENABLED -#endif # HIDL DEVICE_MANIFEST_FILE += $(LOCAL_PATH)/manifest.xml From 10a737a05f933a3136ea6c1232abe0747c0f4f0d Mon Sep 17 00:00:00 2001 From: Soeren Schoenbrod Date: Mon, 6 Jun 2022 09:24:18 +0200 Subject: [PATCH 38/40] Revert "Enable FM" This reverts commit 4c4f440bdefcba3f258ec557391e9c669449f9e3. --- BoardConfigCommon.mk | 3 --- 1 file changed, 3 deletions(-) diff --git a/BoardConfigCommon.mk b/BoardConfigCommon.mk index 057409a..b2fc29b 100644 --- a/BoardConfigCommon.mk +++ b/BoardConfigCommon.mk @@ -51,9 +51,6 @@ BOARD_RECOVERYIMAGE_PARTITION_SIZE := 16776704 # GPS USE_DEVICE_SPECIFIC_GPS := true -# FM -BOARD_HAVE_QCOM_FM := true - # HIDL DEVICE_MANIFEST_FILE += $(LOCAL_PATH)/manifest.xml From 9a8cde6b1168a4ec25f9917f024b2751f8efa17d Mon Sep 17 00:00:00 2001 From: Soeren Schoenbrod Date: Tue, 12 Jul 2022 14:16:13 +0200 Subject: [PATCH 39/40] Try to fix wifi problems --- .../base/core/res/res/values/config.xml | 22 +++++++++++++++++-- 1 file changed, 20 insertions(+), 2 deletions(-) diff --git a/overlay/frameworks/base/core/res/res/values/config.xml b/overlay/frameworks/base/core/res/res/values/config.xml index 47e7dec..87495d2 100644 --- a/overlay/frameworks/base/core/res/res/values/config.xml +++ b/overlay/frameworks/base/core/res/res/values/config.xml @@ -75,12 +75,30 @@ "bt-pan" - - true + + true + + + false + + + false + + + false true + + false + true From 8cc4f2792c07da6d8f23bff6842c64507fc90db2 Mon Sep 17 00:00:00 2001 From: Soeren Schoenbrod Date: Sun, 14 Aug 2022 14:14:31 +0200 Subject: [PATCH 40/40] Set permission for all mmcblk0p* to system radio --- rootdir/etc/ueventd.qcom.rc | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/rootdir/etc/ueventd.qcom.rc b/rootdir/etc/ueventd.qcom.rc index 9cc8b05..890bca2 100644 --- a/rootdir/etc/ueventd.qcom.rc +++ b/rootdir/etc/ueventd.qcom.rc @@ -195,5 +195,4 @@ /sys/class/graphics/fb0 mode 0664 system graphics /sys/class/graphics/fb0 modes 0664 system graphics -/dev/block/mmcblk0p17 0660 system radio -/dev/block/mmcblk0p31 0660 system radio \ No newline at end of file +/dev/block/mmcblk0p* 0660 system radio \ No newline at end of file