From 0e6d050fdd2fdb3ba4147dfa91feb91373143b03 Mon Sep 17 00:00:00 2001
From: LuK1337 <priv.luk@gmail.com>
Date: Sat, 28 Mar 2020 17:08:22 +0100
Subject: [PATCH] sdm710-common: sepolicy: Address thermal-engine denials

* <Q blobs require broader sysfs access and we don't
  want to relabel stuff like /sys/class/kgsl.

Resolves:
I auditd  : type=1400 audit(0.0:37): avc: denied { read } for comm="thermal-engine" name="kgsl" dev="sysfs" ino=45578 scontext=u:r:thermal-engine:s0 tcontext=u:object_r:sysfs:s0 tclass=dir permissive=0

Change-Id: I6a821da53686eba33990ae231ccae700de2d7391
---
 sepolicy/vendor/thermal-engine.te | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/sepolicy/vendor/thermal-engine.te b/sepolicy/vendor/thermal-engine.te
index ef381df..33742e6 100644
--- a/sepolicy/vendor/thermal-engine.te
+++ b/sepolicy/vendor/thermal-engine.te
@@ -4,4 +4,8 @@ allow thermal-engine thermal_data_file:file create_file_perms;
 allow thermal-engine self:capability { chown fowner };
 allow thermal-engine sysfs_devfreq:dir r_dir_perms;
 
+# Allow thermal-engine to read files in /sys because <Q blobs require broader
+# sysfs access and we don't want to relabel stuff like /sys/class/kgsl
+r_dir_file(thermal-engine, sysfs)
+
 set_prop(thermal-engine, vendor_thermal_normal_prop)