diff --git a/folio_daemon/Android.mk b/folio_daemon/Android.mk index 4ba85126..d62bd741 100755 --- a/folio_daemon/Android.mk +++ b/folio_daemon/Android.mk @@ -17,6 +17,5 @@ LOCAL_CLANG := true LOCAL_MODULE := folio_daemon LOCAL_MODULE_TAGS := optional LOCAL_MODULE_OWNER := google -LOCAL_PROPRIETARY_MODULE := true include $(BUILD_EXECUTABLE) diff --git a/init.hardware.rc b/init.hardware.rc index 6b72df88..fad03bc1 100644 --- a/init.hardware.rc +++ b/init.hardware.rc @@ -415,7 +415,7 @@ service init-radio-sh /vendor/bin/init.radio.sh group root radio oneshot -service folio_daemon /vendor/bin/folio_daemon +service folio_daemon /system/bin/folio_daemon class late_start user system group system diff --git a/sepolicy/private/file_contexts b/sepolicy/private/file_contexts new file mode 100644 index 00000000..f52868dc --- /dev/null +++ b/sepolicy/private/file_contexts @@ -0,0 +1 @@ +/system/bin/folio_daemon u:object_r:folio_daemon_exec:s0 diff --git a/sepolicy/vendor/folio_daemon.te b/sepolicy/private/folio_daemon.te similarity index 55% rename from sepolicy/vendor/folio_daemon.te rename to sepolicy/private/folio_daemon.te index d2a2abeb..0c4d2d3e 100644 --- a/sepolicy/vendor/folio_daemon.te +++ b/sepolicy/private/folio_daemon.te @@ -1,16 +1,11 @@ -type folio_daemon, domain; -type folio_daemon_exec, exec_type, vendor_file_type, file_type; +type folio_daemon, domain, coredomain; +type folio_daemon_exec, exec_type, file_type; init_daemon_domain(folio_daemon) allow folio_daemon binder_device:chr_file rw_file_perms; allow folio_daemon uhid_device:chr_file rw_file_perms; -# TODO(b/35870313): Remove this attribute when the corresponding bug is fixed and the treble -# violations are handled -typeattribute folio_daemon binder_in_vendor_violators; -typeattribute folio_daemon socket_between_core_and_vendor_violators; - allow folio_daemon system_server:unix_stream_socket rw_socket_perms_no_ioctl; binder_use(folio_daemon) diff --git a/sepolicy/private/system_server.te b/sepolicy/private/system_server.te new file mode 100644 index 00000000..389fee02 --- /dev/null +++ b/sepolicy/private/system_server.te @@ -0,0 +1 @@ +binder_call(system_server, folio_daemon) diff --git a/sepolicy/vendor/file_contexts b/sepolicy/vendor/file_contexts index 4779be28..d433606d 100644 --- a/sepolicy/vendor/file_contexts +++ b/sepolicy/vendor/file_contexts @@ -168,7 +168,6 @@ /vendor/bin/hw/android\.hardware\.usb@1\.1-service.wahoo u:object_r:hal_usb_default_exec:s0 /vendor/bin/hw/android\.hardware\.power@1\.1-service.wahoo u:object_r:hal_power_default_exec:s0 /vendor/bin/chre u:object_r:chre_exec:s0 -/vendor/bin/folio_daemon u:object_r:folio_daemon_exec:s0 /vendor/bin/time_daemon u:object_r:time_daemon_exec:s0 /vendor/bin/imsrcsd u:object_r:hal_rcsservice_exec:s0 /vendor/bin/init\.qcom\.devstart\.sh u:object_r:init-qcom-devstart-sh_exec:s0 diff --git a/sepolicy/vendor/system_server.te b/sepolicy/vendor/system_server.te index 2fec31d9..bd7af930 100644 --- a/sepolicy/vendor/system_server.te +++ b/sepolicy/vendor/system_server.te @@ -3,8 +3,6 @@ allowxperm system_server self:socket ioctl msm_sock_ipc_ioctls; # TODO(b/36867326): Remove this once system_server no longer communicates over binder binder_call(system_server, per_mgr) -binder_call(system_server, folio_daemon) - binder_call(system_server, hal_camera_default) allow system_server persist_file:dir search;