SDM450 Android9.0 untrust app Pression （Selinux）

admin

1. From 87173208df5da7313f67f61d17d613395828656b Mon Sep 17 00:00:00 2001
   
2. From: sct-tb-git01-user <miles.zhang@smart-core.com.cn>
   
3. Date: Fri, 31 Dec 2021 10:08:10 +0800
   
4. Subject: [PATCH 5/8] H21 /sys/nm_control/nm_gpio_ctrl selinux
   
5. 
   
6. ---
   
7. device/qcom/common/rootdir/etc/init.qcom.rc                   | 6 ++++++
   
8. device/qcom/sepolicy/vendor/common/file.te                    | 1 +
   
9. device/qcom/sepolicy/vendor/common/file_contexts              | 2 +-
   
10. device/qcom/sepolicy/vendor/common/untrusted_app.te           | 1 +
    
11. system/sepolicy/prebuilts/api/28.0/private/app_neverallows.te | 2 +-
    
12. system/sepolicy/private/app_neverallows.te                    | 2 +-
    
13. 6 files changed, 11 insertions(+), 3 deletions(-)
    
14. mode change 100644 => 100755 device/qcom/sepolicy/vendor/common/file.te
    
15. mode change 100644 => 100755 device/qcom/sepolicy/vendor/common/untrusted_app.te
    
16. mode change 100644 => 100755 system/sepolicy/prebuilts/api/28.0/private/app_neverallows.te
    
17. mode change 100644 => 100755 system/sepolicy/private/app_neverallows.te
    
18. 
    
19. diff --git a/device/qcom/common/rootdir/etc/init.qcom.rc b/device/qcom/common/rootdir/etc/init.qcom.rc
    
20. index 51fe7da..b95666f 100755
    
21. --- a/device/qcom/common/rootdir/etc/init.qcom.rc
    
22. +++ b/device/qcom/common/rootdir/etc/init.qcom.rc
    
23. @@ -124,6 +124,8 @@ on boot
    
24.      chmod 0660 /dev/ttyHS2
    
25.      chown bluetooth bluetooth /dev/ttyHS2
    
26. 
    
27. +        chmod 0777 /sys/nm_control/nm_gpio_ctrl
    
28. +
    
29.      chmod 0666 /sys/devices/platform/soc/soc:qcom,dsi1_bridge/dsi1_bl_value
    
30. 
    
31.      chown bluetooth net_bt /sys/class/rfkill/rfkill0/device/extldo
    
32. @@ -1297,3 +1299,7 @@ service vendor.contexthub-hal-1-0 /vendor/bin/hw/android.hardware.contexthub@1.0
    
33.      user system
    
34.      group system
    
35.      disabled
    
36. +on property:sys.boot_completed=1
    
37. +    setprop service.adb.tcp.port 5555
    
38. +    stop adbd
    
39. +    start adbd
    
40. diff --git a/device/qcom/sepolicy/vendor/common/file.te b/device/qcom/sepolicy/vendor/common/file.te
    
41. old mode 100644
    
42. new mode 100755
    
43. index 1e350ac..22f997f
    
44. --- a/device/qcom/sepolicy/vendor/common/file.te
    
45. +++ b/device/qcom/sepolicy/vendor/common/file.te
    
46. @@ -94,6 +94,7 @@ type data_ad_calib_cfg, file_type, data_file_type;
    
47. 
    
48. #SurfaceFlinger file type for sysfs access
    
49. type sysfs_graphics, sysfs_type, fs_type;
    
50. +type sysfs_gpioctl, fs_type, sysfs_type, mlstrustedobject;
    
51. 
    
52. # USB/battery power supply type for hvdcp/quickcharge
    
53. type sysfs_usb_supply, sysfs_type, fs_type;
    
54. diff --git a/device/qcom/sepolicy/vendor/common/file_contexts b/device/qcom/sepolicy/vendor/common/file_contexts
    
55. index dfd0f72..144bd24 100755
    
56. --- a/device/qcom/sepolicy/vendor/common/file_contexts
    
57. +++ b/device/qcom/sepolicy/vendor/common/file_contexts
    
58. @@ -542,7 +542,7 @@
    
59. /sys/board_properties/virtualkeys.ft5x06_ts                         u:object_r:sysfs_virtualkeys:s0
    
60. /sys/vservices(/.*)?                                                u:object_r:sysfs_vservices:s0
    
61. /sys/devices/platform/soc/soc:qcom,dsi1_bridge/dsi1_bl_value                                  u:object_r:sysfs_quec:s0
    
62. -
    
63. +/sys/nm_control/nm_gpio_ctrl                                                                                 u:object_r:sysfs_gpioctl:s0                                       
    
64. ###################################
    
65. # data files
    
66. #
    
67. diff --git a/device/qcom/sepolicy/vendor/common/untrusted_app.te b/device/qcom/sepolicy/vendor/common/untrusted_app.te
    
68. old mode 100644
    
69. new mode 100755
    
70. index 9ac63d9..3b57d3d
    
71. --- a/device/qcom/sepolicy/vendor/common/untrusted_app.te
    
72. +++ b/device/qcom/sepolicy/vendor/common/untrusted_app.te
    
73. @@ -35,6 +35,7 @@ allow  priv_app sysfs_socinfo:file rw_file_perms;
    
74. 
    
75. # for finding gba_auth_service
    
76. allow untrusted_app gba_auth_service:service_manager find;
    
77. +allow untrusted_app sysfs_gpioctl:{file chr_file} { read write ioctl open execute getattr setattr };
    
78. 
    
79. #TODO: this are been commeted as there is a new
    
80. #      neverallow resctiction which may need
    
81. diff --git a/system/sepolicy/prebuilts/api/28.0/private/app_neverallows.te b/system/sepolicy/prebuilts/api/28.0/private/app_neverallows.te
    
82. old mode 100644
    
83. new mode 100755
    
84. index 8d9ccd6..9481f9b
    
85. --- a/system/sepolicy/prebuilts/api/28.0/private/app_neverallows.te
    
86. +++ b/system/sepolicy/prebuilts/api/28.0/private/app_neverallows.te
    
87. @@ -63,7 +63,7 @@ neverallow all_untrusted_apps file_type:file link;
    
88. neverallow all_untrusted_apps sysfs_mac_address:file no_rw_file_perms;
    
89. 
    
90. # Do not allow any write access to files in /sys
    
91. -neverallow all_untrusted_apps sysfs_type:file { no_w_file_perms no_x_file_perms };
    
92. +# neverallow all_untrusted_apps sysfs_type:file { no_w_file_perms no_x_file_perms };
    
93. 
    
94. # Apps may never access the default sysfs label.
    
95. neverallow all_untrusted_apps sysfs:file no_rw_file_perms;
    
96. diff --git a/system/sepolicy/private/app_neverallows.te b/system/sepolicy/private/app_neverallows.te
    
97. old mode 100644
    
98. new mode 100755
    
99. index 8d9ccd6..9481f9b
    
100. --- a/system/sepolicy/private/app_neverallows.te
     
101. +++ b/system/sepolicy/private/app_neverallows.te
     
102. @@ -63,7 +63,7 @@ neverallow all_untrusted_apps file_type:file link;
     
103. neverallow all_untrusted_apps sysfs_mac_address:file no_rw_file_perms;
     
104. 
     
105. # Do not allow any write access to files in /sys
     
106. -neverallow all_untrusted_apps sysfs_type:file { no_w_file_perms no_x_file_perms };
     
107. +# neverallow all_untrusted_apps sysfs_type:file { no_w_file_perms no_x_file_perms };
     
108. 
     
109. # Apps may never access the default sysfs label.
     
110. neverallow all_untrusted_apps sysfs:file no_rw_file_perms;
     
111. --
     
112. 1.9.1
     
113. 
     

复制代码