mirror of
https://github.com/Evolution-X-Devices/device_google_wahoo
synced 2026-02-01 07:50:47 +00:00
8bfe8965a2
denied { getattr } for pid=580 comm="ueventd" name="sda20" dev="tmpfs"
ino=19514 scontext=u:r:ueventd:s0 tcontext=u:object_r:tmpfs:s0
tclass=blk_file
denied { write } for pid=580 comm="ueventd" name="uevent" dev="sysfs"
ino=44062 scontext=u:r:ueventd:s0
tcontext=u:object_r:sysfs_bluetooth_writable:s0 tclass=file
denied { search } for pid=826 comm="time_daemon" name="msm_subsys"
dev="sysfs" ino=16858 scontext=u:r:time_daemon:s0
tcontext=u:object_r:sysfs_msm_subsys:s0 tclass=dir
denied { write } for pid=2934 comm="Binder:1189_4" name="timerslack_ns"
dev="proc" ino=38677 scontext=u:r:system_server:s0
tcontext=u:r:untrusted_app_25:s0:c512,c768 tclass=file
denied { write } for pid=3936 comm="Binder:1189_C" name="timerslack_ns"
dev="proc" ino=85544 scontext=u:r:system_server:s0
tcontext=u:r:platform_app:s0:c512,c768 tclass=file
denied { write } for pid=1201 comm="Binder:1189_2" name="timerslack_ns"
dev="proc" ino=83223 scontext=u:r:system_server:s0
tcontext=u:r:system_app:s0 tclass=file
denied { write } for pid=1584 comm="Binder:1189_3" name="timerslack_ns"
dev="proc" ino=81248 scontext=u:r:system_server:s0
tcontext=u:r:audioserver:s0 tclass=file
denied { write } for pid=1201 comm="Binder:1189_2" name="timerslack_ns"
dev="proc" ino=38795 scontext=u:r:system_server:s0
tcontext=u:r:priv_app:s0:c512,c768 tclass=file
denied { write } for pid=1584 comm="Binder:1189_3" name="timerslack_ns"
dev="proc" ino=86229 scontext=u:r:system_server:s0
tcontext=u:r:untrusted_app:s0:c512,c768 tclass=file
denied { write } for pid=4624 comm="Binder:1189_E" name="timerslack_ns"
dev="proc" ino=105556 scontext=u:r:system_server:s0
tcontext=u:r:radio:s0 tclass=file
denied { write } for pid=1201 comm="Binder:1189_2" name="timerslack_ns"
dev="proc" ino=26256 scontext=u:r:system_server:s0
tcontext=u:r:hal_audio_default:s0 tclass=file
denied { create } for pid=836 comm="perfd" name="default_values"
scontext=u:r:perfd:s0 tcontext=u:object_r:system_data_file:s0
tclass=file
denied { find } for service=qti.ims.ext pid=3750 uid=1001
scontext=u:r:radio:s0 tcontext=u:object_r:imscm_service:s0
tclass=service_manager
denied { lock } for comm="ip6tables" path="/system/etc/xtables.lock"
dev="sda22" ino=968 scontext=u:r:netmgrd:s0
tcontext=u:object_r:system_file:s0 tclass=file
denied { getattr } for comm="android.hardwar"
path="/sys/devices/soc/c17a000.i2c/i2c-6/6-005a/leds/vibrator/duration"
dev="sysfs" ino=46884 scontext=u:r:hal_vibrator_default:s0
tcontext=u:object_r:sysfs:s0 tclass=file
denied { open } for comm="android.hardwar"
path="/sys/devices/soc/c17a000.i2c/i2c-6/6-005a/leds/vibrator/activate"
dev="sysfs" ino=46883 scontext=u:r:hal_vibrator_default:s0
tcontext=u:object_r:sysfs:s0 tclass=file
denied { read } for comm="android.hardwar" name="vibrator" dev="sysfs"
ino=41304 scontext=u:r:hal_vibrator_default:s0
tcontext=u:object_r:sysfs_leds:s0 tclass=lnk_file
denied { search } for comm="android.hardwar" name="leds" dev="sysfs"
ino=27814 scontext=u:r:hal_vibrator_default:s0
tcontext=u:object_r:sysfs_leds:s0 tclass=dir
denied { add } for
service=com.fingerprints.extension.IFingerprintNavigation pid=884
uid=1000 scontext=u:r:hal_fingerprint_default:s0
tcontext=u:object_r:fingerprint_service:s0 tclass=service_manager
denied { open } for pid=9391 comm="cat"
path="/sys/devices/virtual/thermal/cooling_device0/type" dev="sysfs"
ino=44002 scontext=u:r:hal_dumpstate_impl:s0
tcontext=u:object_r:sysfs_thermal:s0 tclass=file
denied { read } for pid=9391 comm="cat" name="type" dev="sysfs"
ino=44002 scontext=u:r:hal_dumpstate_impl:s0
tcontext=u:object_r:sysfs_thermal:s0 tclass=file
denied { search } for pid=9391 comm="cat" name="thermal" dev="sysfs"
ino=28795 scontext=u:r:hal_dumpstate_impl:s0
tcontext=u:object_r:sysfs_thermal:s0 tclass=dir
denied { getattr } for pid=9381 comm="ls"
path="/sys/kernel/debug/ion/heaps/secure_heap" dev="debugfs" ino=10246
scontext=u:r:hal_dumpstate_impl:s0 tcontext=u:object_r:debugfs:s0
tclass=file
denied { open } for pid=9381 comm="ls"
path="/sys/kernel/debug/ion/heaps" dev="debugfs" ino=9218
scontext=u:r:hal_dumpstate_impl:s0 tcontext=u:object_r:debugfs:s0
tclass=dir
denied { read } for pid=9381 comm="ls" name="heaps" dev="debugfs"
ino=9218 scontext=u:r:hal_dumpstate_impl:s0
tcontext=u:object_r:debugfs:s0 tclass=dir
denied { search } for pid=5401 comm="surfaceflinger" name="clients"
dev="debugfs" ino=8429 scontext=u:r:surfaceflinger:s0
tcontext=u:object_r:debugfs_ion:s0 tclass=dir
denied { search } for pid=5294 comm="android.hardwar" name="clients"
dev="debugfs" ino=8429 scontext=u:r:hal_audio_default:s0
tcontext=u:object_r:debugfs_ion:s0 tclass=dir
denied { write } for comm="android.hardwar" name="activate" dev="sysfs"
ino=46883 scontext=u:r:hal_vibrator_default:s0
tcontext=u:object_r:sysfs_leds:s0 tclass=file
denied { lock execute_no_trans } for comm="rild" path="/vendor/qcril.db"
dev="sda20" ino=1019 scontext=u:r:rild:s0
tcontext=u:object_r:vendor_file:s0 tclass=file
Bug: 34784662
Test: The above denials are no longer occuring
Change-Id: I7931a8c3ed8bdfb7190d6c5c14a11525dca5be3a
53 lines
1.7 KiB
Plaintext
53 lines
1.7 KiB
Plaintext
type netmgrd, domain;
|
|
type netmgrd_exec, exec_type, file_type;
|
|
|
|
net_domain(netmgrd)
|
|
init_daemon_domain(netmgrd)
|
|
|
|
set_prop(netmgrd, net_radio_prop)
|
|
|
|
# communicate with netd
|
|
unix_socket_connect(netmgrd, netd, netd)
|
|
|
|
allow netmgrd netmgrd_socket:dir w_dir_perms;
|
|
allow netmgrd netmgrd_socket:sock_file { create setattr };
|
|
allow netmgrd self:netlink_xfrm_socket { create_socket_perms_no_ioctl nlmsg_write };
|
|
allow netmgrd self:netlink_generic_socket create_socket_perms_no_ioctl;
|
|
allow netmgrd self:netlink_route_socket nlmsg_write;
|
|
allow netmgrd self:netlink_socket create_socket_perms_no_ioctl;
|
|
allow netmgrd self:socket create_socket_perms;
|
|
allowxperm netmgrd self:socket ioctl msm_sock_ipc_ioctls;
|
|
allowxperm netmgrd self:udp_socket ioctl priv_sock_ioctls;
|
|
|
|
allow netmgrd sysfs_net:dir r_dir_perms;
|
|
allow netmgrd sysfs_net:file rw_file_perms;
|
|
allow netmgrd sysfs_soc:dir search;
|
|
allow netmgrd sysfs_soc:file r_file_perms;
|
|
allow netmgrd sysfs_msm_subsys:dir r_dir_perms;
|
|
allow netmgrd sysfs_msm_subsys:file r_file_perms;
|
|
|
|
allow netmgrd system_file:file lock;
|
|
|
|
r_dir_file(netmgrd, sysfs_msm_subsys)
|
|
|
|
wakelock_use(netmgrd)
|
|
|
|
allow netmgrd proc_net:file rw_file_perms;
|
|
# TODO(b/36663482): Remove coredata_in_vendor_violators once
|
|
# netmgrd no longer directly accesses /data outside
|
|
# /data/vendor.
|
|
typeattribute netmgrd coredata_in_vendor_violators;
|
|
allow netmgrd net_data_file:dir r_dir_perms;
|
|
allow netmgrd net_data_file:file r_file_perms;
|
|
allow netmgrd netmgr_data_file:dir rw_dir_perms;
|
|
allow netmgrd netmgr_data_file:file create_file_perms;
|
|
allow netmgrd system_file:file execute_no_trans;
|
|
|
|
allow netmgrd self:capability { net_admin net_raw setgid setpcap setuid };
|
|
|
|
allow netmgrd toolbox_exec:file rx_file_perms;
|
|
|
|
userdebug_or_eng(`
|
|
permissive netmgrd;
|
|
')
|