Files
device_google_wahoo/sepolicy/tee.te
Max Bires f41ff958d8 Fixing the following run and boot time denials
denied { getattr read open } for pid=716 comm="android.hardwar"
path="/dev/block/sdc1" dev="tmpfs" ino=21762
scontext=u:r:hal_bootctl_default:s0 tcontext=u:object_r:block_device:s0
tclass=blk_file

denied { set } for property=htc.camera.sensor.inf pid=717 uid=1047
gid=1005 scontext=u:r:hal_camera_default:s0
tcontext=u:object_r:default_prop:s0 tclass=property_service

denied { read open } for pid=642 comm="qseecomd" name="/" dev="sda45"
ino=2 scontext=u:r:tee:s0 tcontext=u:object_r:system_data_file:s0
tclass=dir

denied { read open search write add_name } for pid=642 comm="qseecomd"
name="fpdata" dev="sda45" ino=3408055 scontext=u:r:tee:s0
tcontext=u:object_r:fingerprintd_data_file:s0 tclass=dir

denied { create read } for pid=642 comm="qseecomd" name="user.db.bak"
scontext=u:r:tee:s0 tcontext=u:object_r:fingerprintd_data_file:s0
tclass=file

denied { read write } for pid=7567 comm="secdiscard" name="sda45"
dev="tmpfs" ino=21749 scontext=u:r:vold:s0
tcontext=u:object_r:sda_block_device:s0 tclass=blk_file

Bug: 34784662
Test: The above denials are no longer present
Change-Id: If5d8fffd2c50e85e22c7bcbbb429bd80bbf1f0fa
2017-04-02 19:07:17 -07:00

16 lines
529 B
Plaintext

allow tee self:capability { chown setgid setuid sys_admin sys_rawio };
allow tee device:dir r_dir_perms;
set_prop(tee, tee_listener_prop)
set_prop(tee, keymaster_prop)
allow tee block_device:dir { getattr search };
allow tee sda_block_device:blk_file rw_file_perms;
allow tee sdd_block_device:blk_file rw_file_perms;
allow tee sg_device:chr_file { rw_file_perms setattr };
allow tee system_data_file:dir r_dir_perms;
allow tee fingerprintd_data_file:dir rw_dir_perms;
allow tee fingerprintd_data_file:file create_file_perms;