Selinux denials and uevent permissions

configs/wpa_supplicant_overlay.conf

@@ -4,4 +4,4 @@ tdls_external_control=1
 interworking=1
 hs20=1
 auto_interworking=0
-driver_param=use_p2p_group_interface=1
+driver_param=use_p2p_group_interface=1

overlay/frameworks/base/core/res/res/values/config.xml

@@ -75,12 +75,30 @@
            <item>"bt-pan"</item>
     </string-array>
 
-    <!-- Boolean indicating whether the wifi chipset has dual frequency band support -->
-    <bool translatable="false" name="config_wifi_dual_band_support">true</bool>
+    <!-- boolean indicating whether the WiFi chipset has 5GHz band support.
+         Note: This config is replacing the config_wifi_dual_band_support
+         since more bands may now be supported (such as 6GHz), the naming dual_band
+         is no longer indicative, and a separate config now exists for each band -->
+    <bool translatable="false" name ="config_wifi5ghzSupport">true</bool>
+
+    <!-- boolean indicating whether the WiFi chipset has 6GHz band support -->
+    <bool translatable="false" name ="config_wifi6ghzSupport">false</bool>
+
+    <!-- boolean indicating whether the WiFi chipset has 60GHz band support -->
+    <bool translatable="false" name ="config_wifi60ghzSupport">false</bool>
+
+    <!-- Indicates that 11ax mode is supported on this device
+           Note that if this flag is set to true, then 11ax is assumed to be supported.
+           However, if it is left to the default value of false, the 11ax support will
+           be checked via NL80211 interface -->
+    <bool translatable="false" name="config_wifi11axSupportOverride">false</bool>
 
     <!-- Boolean indicating whether the wifi chipset has background scan support -->
     <bool translatable="false" name="config_wifi_background_scan_support">true</bool>
 
+    <!-- Enable WPA2 to WPA3 auto-upgrade -->
+    <bool translatable="false" name="config_wifiSaeUpgradeEnabled">false</bool>
+
     <!-- Flag indicating whether we should enable the automatic brightness in Settings.
          config_hardware_automatic_brightness_available is not set, so we will use software implementation -->
     <bool name="config_automatic_brightness_available">true</bool>

rootdir/etc/init.qcom.rc

@@ -365,6 +365,12 @@ on boot
     # Bluetooth MAC address
     chown bluetooth bluetooth /sys/module/htc_bdaddress/parameters/bdaddress
 
+    # Set subsystem restart level
+    # 1 = SOC
+    # 2 = COUPLED
+    # 3 = INDEPENDENT
+    write /sys/module/subsystem_restart/parameters/restart_level 3
+
     # Wifi firmware reload path
     chown wifi wifi /sys/module/bcmdhd/parameters/firmware_path
 
@@ -392,19 +398,19 @@ service netmgrd /system/bin/netmgrd
 service mpdecision /system/bin/mpdecision --no_sleep --avg_comp
     class main
     user root
-    group root readproc
+    group root system readproc wakelock
     disabled
 
 service qcamerasvr /system/bin/mm-qcamera-daemon
     class late_start
     user camera
-    group camera system inet graphics
+    group camera system inet input graphics
 
 # QMUX must be in multiple groups to support external process connections
 service qmuxd /system/bin/qmuxd
     class core
     user root
-    group radio audio gps wakelock oem_2950
+    group radio audio bluetooth gps diag wakelock log oem_2950
 
 service qseecomd /system/bin/qseecomd
     class core

rootdir/etc/ueventd.qcom.rc

@@ -1,17 +1,17 @@
-/dev/rtc0                 0600   system     system
+/dev/rtc0                 0660   system     system
 
 # the DIAG device node is world writable/readable.
-/dev/diag                 0666   root       root
+/dev/diag                 0666   root       diag
 
 # the genlock client device node is world writable/readable.
-/dev/genlock              0666   root      root
+/dev/genlock              0666   system      system
 
 # gpu driver for adreno200 is globally accessible
-/dev/kgsl                 0666   root       root
-/dev/kgsl-3d0             0666   root       root
+/dev/kgsl                 0666   system       system
+/dev/kgsl-3d0             0666   system       system
 /dev/kgsl-2d0             0666   root       root
 /dev/kgsl-2d1             0666   root       root
-/dev/msm_rotator          0660   system     graphics
+/dev/msm_rotator          0660   system     system
 
 # these should not be world writable
 /dev/ttyHS0               0660   bluetooth  bluetooth
@@ -24,8 +24,8 @@
 /dev/msm_camera/*         0660   system     camera
 /dev/radio0               0640   system     system
 /dev/i2c-0                0664   root       system
-/dev/i2c-1                0664   root       system
 /dev/i2c-2                0664   root       system
+/dev/i2c-3                0664   root       system
 /dev/i2c-4                0664   root       system
 /dev/msm_mvs              0660   system     audio
 /dev/msm_voicememo        0660   system     audio
@@ -38,7 +38,7 @@
 /dev/smd2                 0660   bluetooth  bluetooth
 /dev/smd5                 0660   system     system
 /dev/smd6                 0660   system     system
-/dev/smd7                 0640   radio      radio
+/dev/smd7                 0660   radio      radio
 /dev/smd11                0660   radio      radio
 /dev/smdcntl0             0640   radio      radio
 /dev/smdcntl1             0640   radio      radio
@@ -73,7 +73,6 @@
 /dev/mdm                  0660   system     radio
 /dev/ttyHSL1              0660   system     system
 /dev/tty_sdio_00          0660   system     system
-/dev/block/mmcblk0p17     0660   system     system
 /dev/block/mmcblk0p18     0660   system     system
 /dev/config*              0660   system     camera
 /dev/video*               0660   system     camera
@@ -106,7 +105,7 @@
 /dev/msm_qcelp_in         0660  system       audio
 /dev/msm_evrc_in          0660  system       audio
 /dev/msm_preproc_ctl      0660  system       audio
-/dev/msm_a2dp_in          0640  system       audio
+/dev/msm_a2dp_in          0660  system       audio
 /dev/msm_amrnb_in         0660  system       audio
 /dev/msm_amrwb_in         0660  system       audio
 /sys/devices/virtual/smdpkt/smdcntl*       open_timeout   0664 radio radio
@@ -142,13 +141,13 @@
 # MPU3050
 /dev/mpu                  0664  system       system
 /dev/mpuirq               0664  system       system
-/dev/timerirq             0644  system       system
+/dev/timerirq             0664  system       system
 
 # AKM8963
 /dev/akm8963_dev          0660  system       system
 
 # Bluetooth
-/dev/btlock               0600  bluetooth    bluetooth
+/dev/btlock               0660  bluetooth    bluetooth
 
 # keystore
 /dev/qseecom              0660  system       drmrpc
@@ -162,3 +161,38 @@
 /sys/devices/virtual/optical_sensors/lightsensor    ls_poll_delay  0660    input    system
 /sys/devices/virtual/input/input*                   poll           0660    input    system
 /sys/devices/virtual/input/input*                   pollrate_ms    0660    input    system
+
+
+# From samsung jv
+/dev/qmi0                 0640   radio      radio
+/dev/qmi1                 0640   radio      radio
+/dev/qmi2                 0640   radio      radio
+/dev/smdcnt_rev0          0640   radio      radio
+/dev/smdcnt_rev1          0640   radio      radio
+/dev/smdcnt_rev2          0640   radio      radio
+/dev/smdcnt_rev3          0640   radio      radio
+/dev/smdcnt_rev4          0640   radio      radio
+/dev/smdcnt_rev5          0640   radio      radio
+/dev/smdcnt_rev6          0640   radio      radio
+/dev/smdcnt_rev7          0640   radio      radio
+/dev/smdcnt_rev8          0640   radio      radio
+/dev/v4l-subdev*          0660   system     camera
+/dev/graphics/*           0660   system     system
+/dev/tun                  0660   system     vpn
+/dev/smd_cxm_qmi          0640   radio      radio
+/dev/msm_amrwbplus        0660   system     audio
+/dev/msm_mp3              0660   system     audio
+/dev/msm_sps              0660   system     audio
+
+/sys/class/graphics/fb*     format_3d                0664    system  graphics
+/sys/class/graphics/fb*     hpd                      0664    system  graphics
+/sys/class/graphics/fb*     msm_fb_fps_level         0664    system  graphics
+/sys/class/graphics/fb*     pa                       0664    system  graphics
+/sys/class/graphics/fb*     product_description      0664    system  graphics
+/sys/class/graphics/fb*     vendor_name              0664    system  graphics
+/sys/class/graphics/fb*     video_mode               0664    system  graphics
+
+/sys/class/graphics/fb0     mode                     0664    system  graphics
+/sys/class/graphics/fb0     modes                    0664    system  graphics
+
+/dev/block/mmcblk0p*     0660   system     radio

sepolicy/private/dumpstate.te

@@ -0,0 +1,3 @@
+allow dumpstate adbroot_exec:file getattr;
+allow dumpstate apexd_exec:file getattr;
+allow dumpstate atrace_exec:file getattr;

sepolicy/private/file.te

@@ -0,0 +1,2 @@
+type sysfs_disk_pre_eol_info, fs_type, sysfs_type;
+type sysfs_disk_rev, fs_type, sysfs_type;

sepolicy/private/incidentd.te

@@ -0,0 +1,3 @@
+allow incidentd bluetooth_prop:file { open read };
+allow incidentd proc:file { open read };
+allow incident dumpstate:fifo_file write;

sepolicy/private/storaged.te

@@ -0,0 +1,3 @@
+r_dir_file(storaged, sysfs_disk_pre_eol_info)
+r_dir_file(storaged, sysfs_disk_rev)
+allow storaged sysfs:file { read open getattr };

sepolicy/private/system_app.te

@@ -0,0 +1,2 @@
+binder_call(system_app, storaged)
+binder_call(system_app, system_suspend)

sepolicy/vendor/device.te

@@ -1,2 +1,2 @@
 type bluetooth_device, dev_type;
-type cir_device, dev_type;
+type cir_device, dev_type;

sepolicy/vendor/dumpstate.te

@@ -0,0 +1,5 @@
+allow dumpstate akmd_exec:file getattr;
+allow dumpstate firmware_file:dir search;
+allow dumpstate proc:file { open read };
+allow dumpstate unlabeled:dir getattr;
+allow dumpstate unlabeled:filesystem getattr;

sepolicy/vendor/file_contexts

@@ -59,6 +59,7 @@
 #
 /data/system/default_values     u:object_r:mpctl_data_file:s0
 /dev/socket/mpctl               u:object_r:mpctl_socket:s0
+/(system|vendor|system/vendor)/bin/mpdecision          u:object_r:mpdecision_exec:s0
 
 ###################################
 # Rootfs Symlinks
@@ -108,4 +109,7 @@
 /(vendor|system/vendor)/bin/hw/vendor\.lineage\.touch@1\.0-service\.htc8960      u:object_r:hal_lineage_touch_default_exec:s0
 
 # TapToWake
-/sys/android_touch/doubletap2wake                         u:object_r:doubletap2wake_sysfs:s0 
+/sys/android_touch/doubletap2wake                         u:object_r:doubletap2wake_sysfs:s0
+
+# Qualcomm
+/system/bin/qseecomd                            u:object_r:qseecomd_exec:s0

sepolicy/vendor/gpuservice.te

@@ -0,0 +1 @@
+allow gpuservice graphics_config_prop:file { read  r_file_perms };

sepolicy/vendor/hwservicemanager.te

@@ -0,0 +1 @@
+allow hwservicemanager dumpstate:fd use;

sepolicy/vendor/isolated_app.te

@@ -1,2 +1,2 @@
 allow isolated_app sysfs:dir open;
-
+allow isolated_app app_data_file:file setattr;

sepolicy/vendor/keystore.te

@@ -1,3 +1,3 @@
 allow keystore firmware_file:dir search;
 allow keystore firmware_file:file { getattr open read };
-
+allow keystore tee_device:chr_file { read write ioctl open };

sepolicy/vendor/mm-qcamerad.te

@@ -1,7 +1,8 @@
 type_transition mm-qcamerad system_data_file:sock_file camera_socket "cam_socket0";
 
 allow mm-qcamerad camera_device:dir search;
-allow mm-qcamerad { camera_device gpu_device video_device }:chr_file rw_file_perms;
+allow mm-qcamerad { gpu_device video_device }:chr_file rw_file_perms;
+allow mm-qcamerad camera_device:chr_file { open read write ioctl };
 
 allow mm-qcamerad camera_socket:sock_file setattr;
 allow mm-qcamerad system_data_file:dir { add_name remove_name };
@@ -19,4 +20,3 @@ allow mm-qcamerad { audioserver cameraserver surfaceflinger mediaserver }:fd use
 allow mm-qcamerad { hal_graphics_allocator hal_camera_default }:fd use;
 allow mm-qcamerad hal_renderscript_hwservice:hwservice_manager find;
 binder_call(mm-qcamerad, servicemanager);
-

sepolicy/vendor/mpdecision.te

@@ -3,17 +3,24 @@ allow mpdecision mpdecision:netlink_kobject_uevent_socket { create setopt bind r
 allow mpdecision mpdecision_socket:dir w_dir_perms;
 allow mpdecision mpdecision_socket:sock_file create_file_perms;
 
+type_transition mpdecision socket_device:sock_file mpctl_socket;
 type_transition mpdecision system_data_file:file mpctl_data_file;
 
 unix_socket_connect(mpdecision, thermal, thermal-engine)
 
+allow mpdecision mpctl_data_file:dir w_dir_perms;
+allow mpdecision mpctl_data_file:sock_file create_file_perms;
+allow mpdecision socket_device:dir w_dir_perms;
+allow mpdecision sysfs_devices_system_cpu:file rw_file_perms;
+allow mpdecision sysfs_memory:dir search;
 allow mpdecision system_data_file:dir w_dir_perms;
 allow mpdecision sysfs:file rw_file_perms;
+allow mpdecision device_latency:chr_file w_file_perms;
 
 allow mpdecision mediaserver:dir search;
 allow mpdecision mediaserver:file { read open };
 
 r_dir_file(mpdecision, mediaserver)
 r_dir_file(mpdecision, cameraserver)
 r_dir_file(mpdecision, audioserver)
-r_dir_file(mpdecision, domain)
+r_dir_file(mpdecision, domain)

sepolicy/vendor/priv-app.te

@@ -1,3 +1,4 @@
 allow priv_app { camera_prop proc_interrupts }:file { open read };
 allow priv_app sysfs:file rw_file_perms;
 get_prop(priv_app, camera_prop)
+allow priv_app exported_camera_prop:file read;

sepolicy/vendor/qmuxd.te

@@ -3,4 +3,6 @@ allow qmuxd self:capability { dac_override setpcap setuid fsetid};
 allow qmuxd sysfs:file { getattr };
 allow qmuxd sysfs:file rw_file_perms;
 
+allow qmuxd hsic_device:chr_file { rw_file_perms };
+
 wakelock_use(qmuxd)

sepolicy/vendor/qseecomd.te

@@ -1,3 +1,14 @@
+type qseecomd, domain;
+type qseecomd_exec, exec_type, file_type;
+init_daemon_domain(qseecomd)
+
+allow qseecomd block_device:dir search;
+allow qseecomd self:capability { setgid setuid dac_override };
+allow qseecomd firmware_file:dir search;
+allow qseecomd tee_device:chr_file { read write ioctl open };
+allow qseecomd vendor_file:file execmod;
+allow qseecomd ion_device:chr_file { ioctl open read };
+
 allow tee system_file:file execmod;
 allow tee vendor_file:file execmod;
 binder_use(tee)

sepolicy/vendor/system_app.te

@@ -10,4 +10,5 @@ allow system_app doubletap2wake_sysfs:file rw_file_perms;
 allow system_app sysfs:file rw_file_perms;
 allow system_app doubletap2wake_sysfs:dir rw_dir_perms;
 allow system_app vold:binder call;
-allow system_app wificond:binder call;
+allow system_app wificond:binder call;
+allow system_app fm_radio_device:chr_file { read open ioctl};

sepolicy/vendor/system_server.te

@@ -11,6 +11,7 @@ allow system_server unlabeled:file { rw_file_perms unlink };
 allow system_server unlabeled:dir rw_dir_perms;
 allow system_server tombstones_file:dir rw_dir_perms;
 allow system_server hal_light_default:process signal;
+allow system_server app_zygote:process getpgid;
 
 get_prop(system_server, exported_camera_prop);
 get_prop(system_server, userspace_reboot_config_prop);

sepolicy/vendor/ueventd.te

@@ -1,6 +1,8 @@
-allow ueventd vfat:dir search;
-allow ueventd vfat:file { getattr open read };
-allow ueventd exfat:dir rw_dir_perms;
-allow ueventd exfat:file { getattr rw_file_perms };
 allow ueventd unlabeled:dir rw_dir_perms;
 allow ueventd unlabeled:file rw_file_perms;
+
+allow ueventd exfat:dir search;
+allow ueventd exfat:file r_file_perms;
+allow ueventd self:capability sys_nice;
+allow ueventd vfat:dir search;
+allow ueventd vfat:file r_file_perms;

sepolicy/vendor/untrusted_app.te

@@ -0,0 +1 @@
+allow untrusted_app exported_camera_prop:file read;

sepolicy/vendor/vold.te

@@ -1,3 +1,5 @@
 allow vold hal_bootctl_hwservice:hwservice_manager find;
 allow vold block_device:blk_file rw_file_perms;
-allow vold sysfs_mmc_host:file w_file_perms;
+allow vold sysfs_mmc_host:file w_file_perms;
+allow vold tee_device:chr_file rw_file_perms;
+allow vold cache_block_device:blk_file getattr;

system_prop.mk

@@ -16,4 +16,4 @@ PRODUCT_PROPERTY_OVERRIDES += \
 
 # Vendor security patch level
 PRODUCT_PROPERTY_OVERRIDES += \
-    ro.lineage.build.vendor_security_patch=2015-08-05
+    ro.lineage.build.vendor_security_patch=2015-08-05