diff --git a/sepolicy/private/ramoops.te b/sepolicy/private/ramoops.te index 57161d95..f7f4aafa 100644 --- a/sepolicy/private/ramoops.te +++ b/sepolicy/private/ramoops.te @@ -1,5 +1,5 @@ type ramoops, domain, coredomain; -type ramoops_data_file, file_type, data_file_type; +type ramoops_data_file, file_type, data_file_type, core_data_file_type; type ramoops_exec, exec_type, file_type; init_daemon_domain(ramoops); diff --git a/sepolicy/public/file.te b/sepolicy/public/file.te index ad98df70..1224e34a 100644 --- a/sepolicy/public/file.te +++ b/sepolicy/public/file.te @@ -1,2 +1,2 @@ -type elabel_data_file, file_type, data_file_type; +type elabel_data_file, file_type, data_file_type, core_data_file_type; type sysfs_pstore, sysfs_type, fs_type; diff --git a/sepolicy/vendor/hal_drm_widevine.te b/sepolicy/vendor/hal_drm_widevine.te index faf47b31..629ba5e9 100644 --- a/sepolicy/vendor/hal_drm_widevine.te +++ b/sepolicy/vendor/hal_drm_widevine.te @@ -15,3 +15,7 @@ allow hal_drm { appdomain -isolated_app }:fd use; # by the HWC HAL. allow hal_drm_widevine qdisplay_service:service_manager { find }; binder_call(hal_drm_widevine, hal_graphics_composer) + +# TODO(b/36601695): Remove data_between_core_and_vendor violators once +# hal_drm no longer directly accesses media_data_file. +typeattribute hal_drm_widevine data_between_core_and_vendor_violators; diff --git a/sepolicy/vendor/tee.te b/sepolicy/vendor/tee.te index 0ddf90ff..98ae1436 100644 --- a/sepolicy/vendor/tee.te +++ b/sepolicy/vendor/tee.te @@ -16,8 +16,10 @@ allow tee persist_drm_file:file create_file_perms; allow tee persist_data_file:dir create_dir_perms; allow tee persist_data_file:file create_file_perms; +# TODO(b/36644492): Remove data_between_core_and_vendor_violators once +# tee no longer directly accesses /data owned by the frameworks. +typeattribute tee data_between_core_and_vendor_violators; allow tee system_data_file:dir r_dir_perms; - allow tee fingerprintd_data_file:dir rw_dir_perms; allow tee fingerprintd_data_file:file create_file_perms;