Files
device_google_wahoo/sepolicy/hal_usb_default.te
Max Bires 275bad3194 Adding allows to handle the following denials.
denied  { add find } for service=rcs pid=8083 uid=1001
scontext=u:r:radio:s0 tcontext=u:object_r:default_android_service:s0
tclass=service_manager

denied  { find } for service=vendor.qcom.PeripheralManager pid=850
uid=1000 scontext=u:r:wcnss_service:s0
tcontext=u:object_r:per_mgr_service:s0 tclass=service_manager

denied  { find } for service=vendor.qcom.PeripheralManager pid=846
uid=1001 scontext=u:r:rild:s0 tcontext=u:object_r:per_mgr_service:s0
tclass=service_manager

denied  { find } for service=vendor.qcom.PeripheralManager pid=1365
uid=1000 scontext=u:r:system_server:s0
tcontext=u:object_r:per_mgr_service:s0 tclass=service_manager

denied { relabelto } for name="sda20" dev="tmpfs" ino=18344
scontext=u:r:init:s0 tcontext=u:object_r:sda_block_device:s0
tclass=blk_file

denied { getattr } for pid=2911 comm="droid.bluetooth"
path="/storage/emulated" dev="tmpfs" ino=80994 scontext=u:r:bluetooth:s0
tcontext=u:object_r:storage_stub_file:s0 tclass=dir

denied { write } for pid=841 comm="chre" name="socket" dev="tmpfs"
ino=20101 scontext=u:r:chre:s0 tcontext=u:object_r:socket_device:s0
tclass=dir

denied { ioctl } for pid=837 comm="folio_daemon" path="/dev/binder"
dev="tmpfs" ino=20922 ioctlcmd=6201 scontext=u:r:folio_daemon:s0
tcontext=u:object_r:binder_device:s0 tclass=chr_file

denied { create read getattr } for pid=700 comm="android.hardwar"
name="WCD9340_Bluetooth_cal.acdbdelta" scontext=u:r:hal_audio_default:s0
tcontext=u:object_r:audio_data_file:s0 tclass=file

denied { search write add_name } for pid=700 comm="android.hardwar"
name="audio" dev="sda45" ino=639037 scontext=u:r:hal_audio_default:s0
tcontext=u:object_r:audio_data_file:s0 tclass=dir

denied { connectto } for pid=935 comm="HwBinder:823_2"
path="/dev/socket/perfd" scontext=u:r:mediacodec:s0
tcontext=u:r:perfd:s0 tclass=unix_stream_socket

denied { connectto } for pid=1276 comm="writer" path="/dev/socket/perfd"
scontext=u:r:hal_audio_default:s0 tcontext=u:r:perfd:s0
tclass=unix_stream_socket

denied { write } for pid=1276 comm="writer" name="perfd" dev="tmpfs"
ino=24997 scontext=u:r:hal_audio_default:s0
tcontext=u:object_r:perfd_socket:s0 tclass=sock_file

denied { create read getattr } for pid=841 comm="perfd"
name="default_values" scontext=u:r:perfd:s0
tcontext=u:object_r:system_data_file:s0 tclass=file

denied { write add_name } for pid=841 comm="perfd" name="perfd"
dev="sda45" ino=3407877 scontext=u:r:perfd:s0
tcontext=u:object_r:system_data_file:s0 tclass=dir

denied { read } for pid=841 comm="perfd" name="cpus" dev="cgroup" ino=99
scontext=u:r:perfd:s0 tcontext=u:object_r:cgroup:s0 tclass=file

denied { read open getattr } for pid=803 comm="perfd"
name="u:object_r:post_boot_prop:s0" dev="tmpfs" ino=18264
scontext=u:r:perfd:s0 tcontext=u:object_r:post_boot_prop:s0 tclass=file

denied { read open ioctl } for pid=702 comm="android.hardwar"
path="/dev/block/sdb" dev="tmpfs" ino=10114 ioctlcmd=1268
scontext=u:r:hal_bootctl_default:s0 tcontext=u:object_r:block_device:s0
tclass=blk_file

denied { write } for pid=703 comm="android.hardwar" name="sdb"
dev="tmpfs" ino=18208 scontext=u:r:hal_bootctl_default:s0
tcontext=u:object_r:sdb_block_device:s0 tclass=blk_file

denied { connectto } for pid=704 comm="android.hardwar"
path="/dev/socket/perfd" scontext=u:r:hal_power_default:s0
tcontext=u:r:perfd:s0 tclass=unix_stream_socket

denied { search } for pid=714 comm="android.hardwar"
name="800f000.qcom,spmi" dev="sysfs" ino=17602
scontext=u:r:hal_usb_default:s0 tcontext=u:object_r:sysfs_msm_subsys:s0
tclass=dir

denied { read open getattr } for pid=714 comm="android.hardwar"
name="current_power_role" dev="sysfs" ino=49071
scontext=u:r:hal_usb_default:s0 tcontext=u:object_r:sysfs_msm_subsys:s0
tclass=file

denied { search } for pid=1062 comm="imsdatadaemon" name="netmgr"
dev="tmpfs" ino=22946 scontext=u:r:ims:s0
tcontext=u:object_r:netmgrd_socket:s0 tclass=dir

denied { create setattr unlink } for pid=818 comm="init" name="chre"
dev="tmpfs" ino=21770 scontext=u:r:init:s0
tcontext=u:object_r:socket_device:s0 tclass=sock_file

denied { connectto } for pid=696 comm="setprop"
path="/dev/socket/property_service" scontext=u:r:init_power:s0
tcontext=u:r:init:s0 tclass=unix_stream_socket

denied { set } for property=sys.post_boot.parsed pid=696 uid=0 gid=0
scontext=u:r:init_power:s0 tcontext=u:object_r:system_prop:s0
tclass=property_service

denied { write } for pid=696 comm="setprop" name="property_service"
dev="tmpfs" ino=21108 scontext=u:r:init_power:s0
tcontext=u:object_r:property_socket:s0 tclass=sock_file

denied { read open write } for pid=836 comm="perfd" name="swap_ratio"
dev="proc" ino=25638 scontext=u:r:perfd:s0 tcontext=u:object_r:proc:s0
tclass=file

denied { read open } for pid=827 comm="perfd"
name="available_frequencies" dev="sysfs" ino=33342 scontext=u:r:perfd:s0
tcontext=u:object_r:sysfs_msm_subsys:s0 tclass=file

denied { search } for pid=827 comm="perfd" name="5000000.qcom,kgsl-3d0"
dev="sysfs" ino=21521 scontext=u:r:perfd:s0
tcontext=u:object_r:sysfs_msm_subsys:s0 tclass=dir

denied { read } for pid=827 comm="perfd" name="devfreq" dev="sysfs"
ino=33377 scontext=u:r:perfd:s0 tcontext=u:object_r:sysfs_msm_subsys:s0
tclass=lnk_file

denied { write } for pid=881 comm="perfd" name="perfd" dev="sda45"
ino=3407877 scontext=u:r:perfd:s0
tcontext=u:object_r:system_data_file:s0 tclass=dir

denied { read } for pid=827 comm="perfd" name="soc_id" dev="sysfs"
ino=49301 scontext=u:r:perfd:s0 tcontext=u:object_r:sysfs_soc:s0
tclass=file

denied { write } for pid=3830 comm=504F5349582074696D65722032
name="perfd" dev="tmpfs" ino=8971 scontext=u:r:perfd:s0
tcontext=u:object_r:perfd_socket:s0 tclass=sock_file

denied { search } for pid=827 comm="perfd" name="soc0" dev="sysfs"
ino=49297 scontext=u:r:perfd:s0 tcontext=u:object_r:sysfs_soc:s0
tclass=dir

denied { kill } for pid=858 comm="perfd" capability=5
scontext=u:r:perfd:s0 tcontext=u:r:perfd:s0 tclass=capability

denied { signull } for pid=858 comm="perfd" scontext=u:r:perfd:s0
tcontext=u:r:mediacodec:s0 tclass=process

denied { call } for pid=924 comm="Binder:732_1" scontext=u:r:per_mgr:s0
tcontext=u:r:wcnss_service:s0 tclass=binder

denied { search } for pid=3670 comm="IFMsg_Rxr" name="qmux_radio"
dev="tmpfs" ino=22942 scontext=u:r:radio:s0
tcontext=u:object_r:qmuxd_socket:s0 tclass=dir

denied { write } for pid=3789 comm="IFMsg_Rxr" name="rild_ims0"
dev="tmpfs" ino=28087 scontext=u:r:radio:s0
tcontext=u:object_r:qmuxd_socket:s0 tclass=sock_file

denied { search } for pid=1405 comm="rild" name="netmgr" dev="tmpfs"
ino=22946 scontext=u:r:rild:s0 tcontext=u:object_r:netmgrd_socket:s0
tclass=dir

denied { open } for pid=3138 comm=".dataservices"
path="/dev/__properties__/u:object_r:cnd_prop:s0" dev="tmpfs" ino=18241
scontext=u:r:system_app:s0 tcontext=u:object_r:cnd_prop:s0 tclass=file

denied { create read getattr lock unlink } for pid=3134 comm="Thread-5"
name="xtra.sqlite" scontext=u:r:system_server:s0
tcontext=u:object_r:location_data_file:s0 tclass=file

denied { search } for pid=3594 comm="Thread-5" name="netmgr" dev="tmpfs"
ino=22946 scontext=u:r:system_server:s0
tcontext=u:object_r:netmgrd_socket:s0 tclass=dir

denied { search } for pid=1578 comm="system-server-i" name="/"
dev="sdd3" ino=2 scontext=u:r:system_server:s0
tcontext=u:object_r:persist_file:s0 tclass=dir

denied { call } for pid=3134 comm="Thread-5"
scontext=u:r:system_server:s0 tcontext=u:r:per_mgr:s0 tclass=binder

denied { search write add_name create read open remove_name } for
pid=3134 comm="Thread-5" name="location" dev="sda45" ino=639046
scontext=u:r:system_server:s0 tcontext=u:object_r:location_data_file:s0
tclass=dir

denied { transfer } for pid=1445 comm="Binder:1425_1"
scontext=u:r:system_server:s0 tcontext=u:r:folio_daemon:s0 tclass=binder

denied { read create write } for pid=929 comm="time_daemon"
scontext=u:r:time_daemon:s0 tcontext=u:r:time_daemon:s0 tclass=socket

denied { ioctl } for pid=925 comm="time_daemon" path="socket:[18992]"
dev="sockfs" ino=18992 ioctlcmd=c302 scontext=u:r:time_daemon:s0
tcontext=u:r:time_daemon:s0 tclass=socket

denied { ioctl } for pid=859 comm="time_daemon" path="socket:[19003]"
dev="sockfs" ino=19003 ioctlcmd=c304 scontext=u:r:time_daemon:s0
tcontext=u:r:time_daemon:s0 tclass=socket

denied { read open } for pid=827 comm="time_daemon" name="rtc0"
dev="tmpfs" ino=22580 scontext=u:r:time_daemon:s0
tcontext=u:object_r:rtc_device:s0 tclass=chr_file

denied { read open getattr } for pid=860 comm="time_daemon"
name="soc_id" dev="sysfs" ino=49301 scontext=u:r:time_daemon:s0
tcontext=u:object_r:sysfs_soc:s0 tclass=file

denied { read open } for pid=827 comm="time_daemon" name="name"
dev="sysfs" ino=32499 scontext=u:r:time_daemon:s0
tcontext=u:object_r:sysfs_msm_subsys:s0 tclass=file

denied { setgid setuid sys_time } for pid=827 comm="time_daemon"
capability=6 scontext=u:r:time_daemon:s0 tcontext=u:r:time_daemon:s0
tclass=capability

denied { search read open } for pid=827 comm="time_daemon"
name="msm_subsys" dev="sysfs" ino=16858 scontext=u:r:time_daemon:s0
tcontext=u:object_r:sysfs_msm_subsys:s0 tclass=dir

denied { read } for pid=827 comm="time_daemon" name="subsys0"
dev="sysfs" ino=32507 scontext=u:r:time_daemon:s0
tcontext=u:object_r:sysfs_msm_subsys:s0 tclass=lnk_file

denied { search } for pid=860 comm="time_daemon" name="soc0" dev="sysfs"
ino=49297 scontext=u:r:time_daemon:s0 tcontext=u:object_r:sysfs_soc:s0
tclass=dir

denied { getattr setattr } for pid=589 comm="ueventd" name="sda20"
dev="tmpfs" ino=9908 scontext=u:r:ueventd:s0
tcontext=u:object_r:tmpfs:s0 tclass=blk_file

denied { ioctl } for pid=828 comm="cnss_diag" path="socket:[100666]"
dev="sockfs" ino=100666 ioctlcmd=8be5 scontext=u:r:wcnss_service:s0
tcontext=u:r:wcnss_service:s0 tclass=udp_socket

Bug: 34784662
Test: The above denials are no longer present
Change-Id: Iedf0a829a8e9629961104bb350e53224a179d5dd
2017-04-04 16:37:57 +00:00

3 lines
109 B
Plaintext

allow hal_usb_default sysfs_msm_subsys:dir search;
allow hal_usb_default sysfs_msm_subsys:file r_file_perms;