Commit Graph

87 Commits

Author SHA1 Message Date
Alex Damaratski
f9616e53aa sdm845-common: sepolicy: update file_contexts for neuralnetworks hal
We are using neuralnetworks 1.2 since f7ec886eb3 but the context is still 1.1

Change-Id: Ic31eb9f145793ab05ba44e46df799df281275b36
Signed-off-by: Alex Damaratski <alexeydomoratsky1@gmail.com>
2021-02-04 17:08:28 +01:00
Luca Stefani
f9642f6da0 sdm845-common: Enable IWLAN assisted mode
Change-Id: Id9d8d9d2ed27dad2754abfa3887ee1a1ff97875a
2021-01-04 22:03:19 +00:00
Vladimir Oltean
76dc2a3f2b sdm845-common: sepolicy: allow uevent to control sysfs_mmc_host via vold
Change-Id: Iafea09efae38fb82f4019c6d3b3b4bb756cdca0b
Signed-off-by: Vladimir Oltean <olteanv@gmail.com>
2021-01-04 17:26:58 +00:00
Bruno Martins
8a6c03cf61 sdm845-common: sepolicy: Resolve additional IMS related denials
Change-Id: I34baa7c7c32bd40c89fc5a2038cdd533b66b91e8
2021-01-04 17:26:58 +00:00
Bruno Martins
09ec37c9eb sdm845-common: sepolicy: Add rules for older IMS blobs
Since Android 10 blobs are being used, org.codeaurora.ims still runs
as phone UID as seen by these denials:

  m.android.phone: type=1400 audit(0.0:2914): avc: denied { read } for name="u:object_r:qcom_ims_prop:s0" dev="tmpfs" ino=13660 scontext=u:r:radio:s0 tcontext=u:object_r:qcom_ims_prop:s0 tclass=file permissive=0
  m.android.phone: type=1400 audit(0.0:473): avc: denied { call } for scontext=u:r:radio:s0 tcontext=u:r:hal_imsrtp:s0 tclass=binder permissive=0

Change-Id: Ic8c1b7996b9e0e7b63ba2a153441c9e8467a8a31
2021-01-01 01:48:23 +01:00
Aayush Gupta
12af2e97e7 sdm845-common: Address init denials regarding socket_device
[    9.346918] type=1400 audit(71454275.960:7): avc: denied { create } for comm="init" name="dpmwrapper" scontext=u:r:init:s0 tcontext=u:object_r:socket_device:s0 tclass=sock_file permissive=0

Ref:
[0]: https://source.codeaurora.org/quic/la/device/qcom/sepolicy/commit/?h=LA.UM.9.2.1.r1-03800-sdm660.0&id=79488292273efa5ab89bc405a5f6ae4dec5d011d

Signed-off-by: Aayush Gupta <aayushgupta219@gmail.com>
Change-Id: I262b06821c0625978b3685d0666bd2cf599fbf98
2020-12-24 13:51:29 +00:00
Bruno Martins
82e74adbd4 sdm845-common: Move telephony packages to /system_ext
Change-Id: I38329f6d4ebb7b1a0b0f01e40918fdb73ccbcba9
2020-11-28 02:54:07 +00:00
Bruno Martins
305dc58668 sdm845-common: sepolicy: Add /product file context for dpmd daemon
This got removed from QCOM sepolicies because DPM was
moved from /product to /system_ext.

Change-Id: Ifdff048d8b68bd9593e9a30394888a966c198f8d
2020-11-24 11:37:09 +00:00
Bruno Martins
8f4decf23c sdm845-common: sepolicy: Fix neverallows
Change-Id: I8370661d862983ac94da1f70bb3b57334147820b
2020-10-09 16:17:34 +01:00
Bruno Martins
d628f0b4c6 sdm845-common: Switch to common QTI power HAL
There's nothing really that different here when compared to the
common HAL except for the specific DT2W handling, which can simply
be supported as a power feature lib.

Change-Id: I4c9c2530c8090e05dab38ed829d59ece5e00e1fb
2020-07-17 01:09:19 +02:00
Bruno Martins
5105108390 sdm845-common: sepolicy: Label additional fingerprint sensor props
Change-Id: I71c2a29668e2cea7b8fbb9f598eefda4d729f040
2020-05-25 22:04:42 +01:00
Demon000
c5afd59f64 sdm845-common: Implement in-screen fingerprint HAL
Change-Id: If38552f7f702c688850bfe778a7fbb08c2835c0e
2020-05-25 21:19:34 +01:00
Michael Bestas
e882c6338d sdm845-common: sepolicy: Label fpc_kpi property
Change-Id: I627b2059af7ef2e879bc730523ac99f69853193d
2020-05-22 10:17:11 +02:00
LuK1337
c036c4f8eb sdm845-common: fingerprint: Don't set ro.boot.fpsensor
* It's useless.

Change-Id: I29357c1fbbd7752f3631d9b7f1ce63b61bb41cd0
2020-05-21 22:26:56 +01:00
TheScarastic
29005bc46e sdm845-common: parts: Implement dynamic thermal profiles
Change-Id: I4667b24a8a29a418796dc51b245ede0aca51eea6
2020-05-16 11:57:16 +01:00
TheScarastic
8d3b68eacc sdm845-common: parts: Add DiracSound backend
Special thanks to vasishath for his base work on mi3

Change-Id: Id81e60a18dc34c991b82a5a2685c9041222a6ea7
2020-05-16 11:56:42 +01:00
Bruno Martins
91641cb221 sdm845-common: sepolicy: Redo health nodes labelling
Move labels to genfscon to reduce the overhead inevitably
introduced with the extensive regex.

On the other hand, power_supply/dc/* sysfs nodes were already
labelled in device/qcom/sepolicy and changing its labels was
causing undesired denials while /vendor/bin/init.qti.chg_policy.sh
script tried to update the nodes ownership as seen bellow:

  W chown   : type=1400 audit(0.0:25): avc: denied { setattr } for name="current_max" dev="sysfs" ino=57421 scontext=u:r:qti_init_shell:s0 tcontext=u:object_r:sysfs_wireless_supply:s0 tclass=file permissive=0
  W chown   : type=1400 audit(0.0:26): avc: denied { setattr } for name="dc_adapter" dev="sysfs" ino=57426 scontext=u:r:qti_init_shell:s0 tcontext=u:object_r:sysfs_wireless_supply:s0 tclass=file permissive=0
  W chown   : type=1400 audit(0.0:27): avc: denied { setattr } for name="input_current_now" dev="sysfs" ino=57424 scontext=u:r:qti_init_shell:s0 tcontext=u:object_r:sysfs_wireless_supply:s0 tclass=file permissive=0
  W chown   : type=1400 audit(0.0:28): avc: denied { setattr } for name="input_suspend" dev="sysfs" ino=57423 scontext=u:r:qti_init_shell:s0 tcontext=u:object_r:sysfs_wireless_supply:s0 tclass=file permissive=0

Change-Id: Ia763482e9890e232ab0e2ef0afdc3699bcec4fc0
2020-05-15 11:54:10 +02:00
Pig
ba0508a9d2 sdm845-common: sepolicy: Address annoying rild denials
Change-Id: Ied905092ace838eb006abccb2f0eb34f306617a0
2020-05-15 00:48:08 +01:00
Pig
face426417 sdm845-common: sepolicy: Correct some Xiaomi specific labels
Change-Id: Ic97df715647e83ff4b0161a8da8374687995daef
2020-05-15 00:44:40 +01:00
dianlujitao
5bdf0ecf25 sdm845-common: sepolicy: Label Xiaomi specific global props
Change-Id: I00e33e4aaf76fda6a7d60e7b814e08f69956813d
2020-05-15 00:20:17 +01:00
Michael Bestas
d359d7b9c1 sdm845-common: sepolicy: Ignore thermal-engine dac_override
Change-Id: Ie2b9f60e85b334ad3ba809b3bf6de8e70f50743a
2020-05-15 00:20:17 +01:00
Bruno Martins
15e698c8cb sdm845-common: sepolicy: Label sensors prop and allow reading it
Change-Id: Ifc95eaa2767d74c95200c86c92d1d970d8dc1e4c
2020-05-15 00:18:28 +01:00
Bruno Martins
70547f7ea6 sdm845-common: sepolicy: Address thermal-engine denials
Change-Id: I25abb62dc8c46cfc6ce8c85aa532e9e94bdf9622
2020-05-14 23:51:41 +01:00
Michael Bestas
13a0b1236d sdm845-common: sepolicy: Silence harmless QCOM denials
Change-Id: Iad1e2c0e654a4a46da76a57ece63dc4f35761d50
2020-05-14 23:31:41 +01:00
Bruno Martins
78703e0c65 sdm845-common: sepolicy: Silent rild denials
* There's no interest in allowing rild to create tombstones,
   neither to unnecessarily touch qcril.db

Change-Id: I174ce6d9fc0d12a61706922048f9155f190b31a8
2020-05-14 23:31:34 +01:00
palaych
2dee25a738 sdm845-common: sepolicy: Stop with endless debug props logspam
avc: denied { read } for name="u:object_r:sensors_dbg_prop:s0" dev="tmpfs" ino=22687 scontext=u:r:hal_sensors_default:s0 tcontext=u:object_r:sensors_dbg_prop:s0 tclass=file permissive=0
avc: denied { read } for name="u:object_r:sensors_dbg_prop:s0" dev="tmpfs" ino=22687 scontext=u:r:hal_camera_default:s0 tcontext=u:object_r:sensors_dbg_prop:s0 tclass=file permissive=00
libc    : Access denied finding property "persist.vendor.debug.sensors.stats"
libc    : Access denied finding property "persist.vendor.debug.sensors.ssc_latency"

Make those readable only for debug buildtype.

Change-Id: If329c140d6850ed417ae3f1b1f4d7f28f3331c48
2020-05-14 22:24:42 +01:00
Bruno Martins
2d8f882229 sdm845-common: sepolicy: Allow sensors HAL to read ASDP RPC props
This allows the following props to be read by the sensor HAL:

 W sensors@1.0-ser: type=1400 audit(0.0:308): avc: denied { read } for name="u:object_r:adsprpc_prop:s0" dev="tmpfs" ino=13281 scontext=u:r:hal_sensors_default:s0 tcontext=u:object_r:adsprpc_prop:s0 tclass=file permissive=0
 W sensors@1.0-ser: type=1400 audit(0.0:309): avc: denied { read } for name="u:object_r:adsprpc_prop:s0" dev="tmpfs" ino=13281 scontext=u:r:hal_sensors_default:s0 tcontext=u:object_r:adsprpc_prop:s0 tclass=file permissive=0
 E libc    : Access denied finding property "vendor.fastrpc.perf.kernel"
 E libc    : Access denied finding property "vendor.fastrpc.perf.adsp"
 E libc    : Access denied finding property "vendor.fastrpc.perf.freq"

Change-Id: Iadc621e18601285068f9b231497add238f48294b
2020-05-14 22:41:49 +02:00
Jayant Chowdhary
4cc7fba122 sdm845-common: sepolicy: Specify which ro.camera props are labelled camera_ro_prop
As a result, all ro.camera props aren't automatically labelled camera_ro_prop and some props
can be accessed by priv_app and untrusted_app.

Bug: 134899434

Test: GCA record video / audio; logcat | grep ro.camera.sound.forced

Change-Id: I79873591f312fb05786973a470427d5f4ec9bc82
Signed-off-by: Jayant Chowdhary <jchowdhary@google.com>
2020-05-14 22:41:44 +02:00
Zhijun He
5ffd0bb2c3 sdm845-common: sepolicy: camera: allow read camera ro props
Test: Google Camera app recording
Bug: 131428827
Change-Id: Id21daf56cb3a624efd0f43f8b62c2155a89365cc
2020-05-14 22:41:38 +02:00
Demon000
e38ef0410f sdm845-common: sepolicy: label property used by ril
Change-Id: I05e3a823cdfbbd995791769ea3774ebd064f6f12
2020-05-14 22:41:09 +02:00
Demon000
a90a8fba58 sdm845-common: sepolicy: label system manufacturer prop
* Needed by aux camera.
 * Xiaomi disables all camera if the manufacturer isn't Xiaomi.

Change-Id: Ife6587148824cd6b68e634ca0b999d4f380b20ce
2020-05-14 20:51:16 +01:00
palaych
143c4410c2 sdm845-common: sepolicy: Allow every app to read camera props
This makes Google Camera and ANX Camera apps happy.

Change-Id: If7b78e16f8e1f01df581be5e4e726f7e054dcf64
2020-05-14 20:51:16 +01:00
Bruno Martins
d2141e0a18 sdm845-common: sepolicy: Remove undesired camera prop label
This was basically forcing all props starting with vendor.camera. to
be labeled as camera_prop.

The side effect of doing that was the relabel of props that were
supposed to have a particular label for some reason. Take for example
vendor.camera.aux.packagelist which isn't desired to be relabeled
so to avoid having to write additional local sepolicies.

Change-Id: I1b7c952a241688f6517e1742719e77b6141e2cd2
2020-05-14 20:51:16 +01:00
LuK1337
0a5161eaee sdm845-common: Drop SSR blobs and set SSR restart_level in init.qcom.rc
Change-Id: I32fc08c9ad36b9c8ebfc019fc87a19eece18f0b4
2020-05-10 00:52:48 +02:00
argraur
f0a88a841e sdm845-common: IGnss: update to 2.0
Signed-off-by: argraur <argraur@gmail.com>
Change-Id: I91f04e346f23ead5f1e10a3945b14654a8fad9e1
2020-02-02 10:09:14 +00:00
Bruno Martins
37022184cf sdm845-common: Drop no longer needed compat rootfs folders
Change-Id: Ie5ce442be5166a94bc969e5c145927b1283e47ee
2020-02-02 10:09:14 +00:00
Bruno Martins
17726ddac6 sdm845-common: power: Scan input devices for eligible DT2W node
It is no longer a surprise for anyone to see Xiaomi shipping the same
device with different displays and different displays usually mean
different touchscreen drivers.

The current double tap handling in the power HAL only takes into
account one specific node, meant to be set in the device tree.
However, if the touchscreen was registered as a different input device
it would cause the feature to be broken. Address the issue by iterating
through the input devices in order to find one supported touchscreen
input to be used.

Co-authored-by: LuK1337 <priv.luk@gmail.com>
Change-Id: I2f7fb4a8b0c9cd1a16d6c2b93602d285a191f170
2020-02-01 11:37:23 +01:00
Bruno Martins
9c0038d846 sdm845-common: sepolicy: Remove broken rule
Type vendor_camera_prop is no longer defined.

Change-Id: Idc554ae9f4476d820f21b35826b7e36af9b80b11
2020-01-23 22:05:04 +00:00
Bruno Martins
bfeffb6e96 sdm845-common: sepolicy: Label white led sysfs node
Change-Id: I7c51c5d20daa04252e7e0a41bbe698d6081064b3
2019-09-30 17:14:03 +01:00
LuK1337
44e26839b9 sdm845-common: sepolicy: Label ~ legacy ~ neural networks 1.1 HAL
Change-Id: Ib1e95f214310177d089fd41a926c6405a094b6ea
2019-09-30 10:09:41 +02:00
Bruno Martins
0dc7e72545 sdm845-common: Move offline charging daemon to new path and update label
The charger daemon has been moved to /system/bin, so mimic that change
but keep using the nice deamon. Also the service label got changed to charger
and daemon is now labeled as charger_exec, therefore update it accordingly.

Change-Id: I93a88aef41f52837fd0be691e414a5319b689208
2019-09-28 19:25:22 +01:00
Bruno Martins
c7216cdc6f sdm845-common: sepolicy: Label files under extra root folders
These labels are no longer being set in QC sepolicy.

Change-Id: I56c73bdf3125f9b2f73294665626cc9bd7408759
2019-09-21 00:30:11 +02:00
1nfrag
7a4b89b64f sdm845-common: Switch to OSS display HAL
This allows to get rid of Xiaomi's display feature HAL

Change-Id: I3801a603e08547a919e2e7cd90edabfb116dfac8
2019-09-11 13:04:56 +02:00
Bruno Martins
c3b269d55b sdm845-common: sepolicy: Drop init rules for bind mounting
* No longer necessary as the charger service now points
   directly to the daemon.

Change-Id: I9567579239c042b6361cbf83896467af261f1ef6
2019-08-06 17:21:48 +01:00
dianlujitao
10c28ab1ed sdm845-common: sepolicy: Get Alipay fingerprint going
Change-Id: I58a64a1d4b551f24cfb5e589dacb56d72247db84
2019-08-02 15:05:10 +02:00
Ananth Raghavan Subramanian
ac82ace2a3 sdm845-common: power: Introducing PowerHAL binderized service
Moving from the default implementation to a binderized service with no
wrapping.
Now using 1.2 implementation of the IPower interface.

Change-Id: Ibefd916544f51545e6889684a051b2ecc5867fe2
2019-08-02 00:15:04 +02:00
Bruno Martins
86caa0c12a sdm845-common: Bring up initial vendor sepolicy rules
Change-Id: Iaf298cb02696dbe8d83b9040011bd93889cf18ad
2019-08-01 00:28:53 +01:00
Bruno Martins
438104a656 sdm845-common: Switch to vendor variants of the custom HALs
Change-Id: I599ef8b3d143641821b6e42ec41050aedd3f2b37
2019-08-01 00:28:53 +01:00
Bruno Martins
4b586cca2b sdm845-common: Inherit from QC sepolicy and adapt to it
Change-Id: I619038d1a1f5a2b58baf4019372ec4164cca2137
2019-07-30 17:41:49 +01:00
Bruno Martins
5547e73001 sdm845-common: Get rid of prebuilt vendor images' specific hacks
Change-Id: I52cde54e8d38f847f903004ea8d61437bf5efa0a
2019-07-30 17:41:49 +01:00