Max Bires b387500a64 Fixing the following denials in order to prep ims for enforcing ...

If there is no security issue with having ims write to ims_socket, then
I am fine with granting the permission in order to hurry up the
enforcing status of this domain.

denied { read } for pid=888 comm="imsdatadaemon" name="timestamp_switch"
dev="sysfs" ino=27246 scontext=u:r:ims:s0 tcontext=u:object_r:sysfs:s0
tclass=file

denied { open } for pid=888 comm="imsdatadaemon"
path="/sys/module/diagchar/parameters/timestamp_switch" dev="sysfs"
ino=27246 scontext=u:r:ims:s0 tcontext=u:object_r:sysfs:s0 tclass=file

denied { read } for pid=1326 comm="imsrcsd" name="timestamp_switch"
dev="sysfs" ino=27246 scontext=u:r:hal_rcsservice:s0
tcontext=u:object_r:sysfs:s0 tclass=file

denied { write } for pid=1077 comm="ims_rtp_daemon" name="ims_datad"
dev="tmpfs" ino=27069 scontext=u:r:ims:s0
tcontext=u:object_r:ims_socket:s0 tclass=sock_file

Bug: 34784662
Test: These denials no longer appear
Change-Id: I95d8b62d73fae35fca5e292e6927c4663db76e6f

2017-05-22 10:52:16 -07:00

..

adsprpcd.te

Removing adsprpcd from permissive mode

2017-04-24 22:14:06 -07:00

audioserver.te

Bring up binderized Audio and Soundtrigger services on new Pixels

2017-03-30 11:19:37 -07:00

bluetooth.te

Import common file from device specific directory

2017-03-04 23:34:45 -08:00

bootanim.te

Import common file from device specific directory

2017-03-04 23:34:45 -08:00

cameraserver.te

Adding allows and file_contexts to handle the following camera denials

2017-04-26 03:28:38 +00:00

chre.te

make all vendor exec_types part of vendor_file_type

2017-04-15 19:23:59 -07:00

cnd.te

Fixing load of following denials

2017-05-11 17:07:15 +00:00

dataservice_app.te

security permissions for CNE and UCE service

2017-05-05 16:58:31 -07:00

device.te

Merge "Add eSE daemon."

2017-04-12 12:38:03 +00:00

domain.te

Fixing the following denials

2017-04-11 01:26:29 -07:00

dumpstate.te

Adding allows and context for dumpstate

2017-05-19 11:22:19 -07:00

esed.te

sepolicy: add ese_load and ese data dirs

2017-05-15 15:48:38 -05:00

file_contexts

Fixing the following denials in order to prep ims for enforcing

2017-05-22 10:52:16 -07:00

file.te

Fixing the following denials in order to prep ims for enforcing

2017-05-22 10:52:16 -07:00

folio_daemon.te

Putting folio_daemon into enforcing mode.

2017-05-10 19:04:26 -07:00

gatekeeperd.te

Import common file from device specific directory

2017-03-04 23:34:45 -08:00

genfs_contexts

Revert "power hal: Add power HAL API 1.1 impl for Wahoo"

2017-05-17 15:21:36 -07:00

hal_audio_default.te

Remove unnecessary sepolicy attributes

2017-04-12 18:52:16 -07:00

hal_bluetooth_default.te

allow wcnss_filter CAP_SYS_NICE, Bluetooth HAL binder to system_server

2017-05-01 15:36:10 -07:00

hal_bootctl.te

Fixing Taimen OTAs for enforcing before turning it on globally

2017-05-09 13:17:44 -07:00

hal_camera_default.te

Fixing the following permissions for userdebug/eng builds

2017-05-08 13:18:39 -07:00

hal_camera.te

Add Hexagon permission to hal_camera

2017-05-17 10:50:54 -07:00

hal_contexthub.te

Add binderized context hub HAL

2017-04-03 11:49:09 -07:00

hal_drm_default.te

Adding file_contexts and allows that stopped boot in enforcing.

2017-04-19 15:35:38 -07:00

hal_dumpstate_impl.te

Adding allows and context for dumpstate

2017-05-19 11:22:19 -07:00

hal_fingerprint_default.te

Annotate violators of "no Binder in vendor" rule

2017-03-24 08:40:00 -07:00

hal_fingerprint.te

Adding allows to handle the following denials

2017-04-10 15:39:09 -07:00

hal_gatekeeper_qti.te

Fixing load of following denials

2017-05-11 17:07:15 +00:00

hal_gatekeeper.te

Import common file from device specific directory

2017-03-04 23:34:45 -08:00

hal_gnss_qti.te

Adding vndbinder_use statements to support the new qualcomm patches

2017-05-21 19:32:35 -07:00

hal_graphics_composer_default.te

Fixing load of following denials

2017-05-11 17:07:15 +00:00

hal_keymaster_qti.te

Fixing load of following denials

2017-05-11 17:07:15 +00:00

hal_light_default.te

Fixing the following denials

2017-05-09 13:19:13 -07:00

hal_light.te

whaoo: enable low persist_mode for VR

2017-05-09 16:14:08 +00:00

hal_memtrack_default.te

Fixing the following run and boot time denials

2017-04-02 19:07:17 -07:00

hal_nfc_default.te

nfc: sepolicy: creates data/vendor/nfc/ for HAL specific data

2017-03-31 12:02:03 -07:00

hal_power_default.te

Revert "power hal: Add power HAL API 1.1 impl for Wahoo"

2017-05-17 15:21:36 -07:00

hal_rcsservice.te

Fixing the following denials in order to prep ims for enforcing

2017-05-22 10:52:16 -07:00

hal_sensors_default.te

Add sensor qdsp access

2017-05-03 17:53:14 -07:00

hal_thermal_default.te

Enable binderized Thermal HAL.

2017-04-06 16:23:51 +02:00

hal_usb_default.te

Fix selinux denial for usb hal

2017-05-19 10:28:10 -07:00

hal_vibrator_default.te

Fixing the following denials

2017-04-11 01:26:29 -07:00

hal_vr.te

VR hal to choose thermal config

2017-04-21 11:21:57 -07:00

hal_wifi_default.te

Revert "power hal: Add power HAL API 1.1 impl for Wahoo"

2017-05-17 15:21:36 -07:00

hwservice_contexts

Adding vndbinder_use statements to support the new qualcomm patches

2017-05-21 19:32:35 -07:00

hwservice.te

Grant device-specific hwservicemanager access

2017-04-21 13:06:23 -07:00

ims.te

Fixing the following denials in order to prep ims for enforcing

2017-05-22 10:52:16 -07:00

init_power.te

Removing init_power from individual permissive domain.

2017-04-24 22:06:10 -07:00

init_radio.te

Update init.radio.sh path in file_contexts

2017-05-17 17:06:56 -07:00

init-devstart-sh.te

tag all vendor domains that rely on system executables

2017-04-15 19:30:07 -07:00

init-insmod-sh.te

tag all vendor domains that rely on system executables

2017-04-15 19:30:07 -07:00

init-ipastart-sh.te

tag all vendor domains that rely on system executables

2017-04-15 19:30:07 -07:00

init.te

Fixing the following denials

2017-05-09 13:19:13 -07:00

ioctl_defines

Adding ism service allow rules and according ioctl_define

2017-03-16 22:10:52 +00:00

ioctl_macros

Import common file from device specific directory

2017-03-04 23:34:45 -08:00

irsc_util.te

Removing irsc_util from permissive and into enforcing mode

2017-05-10 19:53:21 -07:00

kernel.te

Revert "power hal: Add power HAL API 1.1 impl for Wahoo"

2017-05-17 15:21:36 -07:00

keystore.te

declare keystore and vold as passthrough HAL clients of keymaster

2017-04-19 15:03:10 -07:00

location.te

Removing location from permissive mode and into enforcing

2017-05-10 19:49:19 -07:00

logger_app.te

Adding init script and SELinux support for qlogd

2017-05-10 09:27:57 -07:00

mediacodec.te

Fixing load of following denials

2017-05-11 17:07:15 +00:00

mediaextractor.te

Fixing load of following denials

2017-05-11 17:07:15 +00:00

netd.te

Fixing load of following denials

2017-05-11 17:07:15 +00:00

netmgrd.te

Merge "Removing netmgrd from permissive mode and into enforcing"

2017-05-20 23:15:46 +00:00

pd_services.te

Removing permissive mode on pd_mapper domain.

2017-04-24 22:07:39 -07:00

per_mgr.te

Merge changes from topic 'merge-msm8998-AU143'

2017-05-22 10:08:09 +00:00

per_proxy.te

Adding vndbinder_use statements to support the new qualcomm patches

2017-05-21 19:32:35 -07:00

perfd.te

Fixing a dac_override for perfd

2017-05-20 14:56:11 -07:00

platform_app.te

Move logging folder from data to data/vendor

2017-04-10 17:25:14 -07:00

port-bridge.te

Removing port-bridge from permissive mode and into enforcing

2017-05-10 19:11:38 -07:00

property_contexts

Merge "Grant system_app write access to tel_mon_prop"

2017-05-19 20:29:10 +00:00

property.te

Grant system_app write access to tel_mon_prop

2017-05-18 17:57:33 -07:00

qlogd.te

Adding init script and SELinux support for qlogd

2017-05-10 09:27:57 -07:00

qmuxd.te

make all vendor exec_types part of vendor_file_type

2017-04-15 19:23:59 -07:00

qti.te

Fixing a qti denial

2017-05-19 17:04:08 +00:00

radio.te

security permissions for CNE and UCE service

2017-05-05 16:58:31 -07:00

ramdump_app.te

sepolicy: Allow ramdump_app to access surfaceflinger_service

2017-04-11 15:23:34 -07:00

ramdump.te

make all vendor exec_types part of vendor_file_type

2017-04-15 19:23:59 -07:00

rfs_access.te

Removing rfs_access from permissive mode

2017-05-21 19:14:54 -07:00

rild.te

Adding vndbinder_use statements to support the new qualcomm patches

2017-05-21 19:32:35 -07:00

rmt_storage.te

Removing rmt_storage from permissive and into enforcing

2017-05-21 17:18:17 -07:00

seapp_contexts

security permissions for CNE and UCE service

2017-05-05 16:58:31 -07:00

sensors.te

Fixed boot issue selinux policy.

2017-04-27 15:39:52 -07:00

service_contexts

Adding vndbinder_use statements to support the new qualcomm patches

2017-05-21 19:32:35 -07:00

service.te

Adding vndbinder_use statements to support the new qualcomm patches

2017-05-21 19:32:35 -07:00

shell.te

Fixing denials that prevented power supply detail access.

2017-05-02 13:20:40 -07:00

smlog_dump.te

Adding allows for smlog and dumpstate

2017-04-25 13:55:49 -07:00

ssr_detector.te

Allow non-ramdump perms on user build

2017-05-05 15:35:47 -07:00

ssr_diag.te

make all vendor exec_types part of vendor_file_type

2017-04-15 19:23:59 -07:00

ssr_setup.te

Removing ssr_setup from permissive mode

2017-04-24 22:30:57 -07:00

subsystem_ramdump.te

make all vendor exec_types part of vendor_file_type

2017-04-15 19:23:59 -07:00

surfaceflinger.te

Adding allow rules and contexts to handle the following denials

2017-04-07 19:57:13 +00:00

system_app.te

Grant system_app write access to tel_mon_prop

2017-05-18 17:57:33 -07:00

system_server.te

Merge "Removing system_server from permissive mode"

2017-05-22 16:04:57 +00:00

tee.te

Fixing load of following denials

2017-05-11 17:07:15 +00:00

thermal-engine.te

Removing thermal-engine from permissive mode

2017-04-24 22:25:44 -07:00

time_daemon.te

make all vendor exec_types part of vendor_file_type

2017-04-15 19:23:59 -07:00

ueventd.te

Fixing denials for easel pmic sysfs

2017-05-05 07:35:46 -07:00

untrusted_app.te

Fixing camera app not launching

2017-04-24 19:56:38 -07:00

update_engine_common.te

Fixing Taimen OTAs for enforcing before turning it on globally

2017-05-09 13:17:44 -07:00

update_verifier.te

Refactoring block device labeling and adding allows.

2017-04-07 16:11:19 -07:00

vndservice_contexts

Adding vndbinder_use statements to support the new qualcomm patches

2017-05-21 19:32:35 -07:00

vndservice.te

Adding vndbinder_use statements to support the new qualcomm patches

2017-05-21 19:32:35 -07:00

vold.te

Fixing boot blocking selinux policy.

2017-04-24 21:54:01 +00:00

wcnss_filter.te

Removing wcnss_filter from permissive mode and into enforcing

2017-05-16 13:07:21 -07:00

wcnss_service.te

Adding vndbinder_use statements to support the new qualcomm patches

2017-05-21 19:32:35 -07:00