Update SEPolicy

sepolicy/private/audioserver.te

@@ -0,0 +1 @@
+allow audioserver vendor_default_prop:file { getattr map open read };

sepolicy/private/batterysecret.te

@@ -0,0 +1,2 @@
+type batterysecret;
+allow batterysecret kmsg_device:chr_file getattr;

sepolicy/private/cameraserver.te

@@ -0,0 +1 @@
+allow cameraserver vendor_default_prop:file { getattr map open read };

sepolicy/private/ccci_mdinit.te

@@ -0,0 +1,3 @@
+type ccci_mdinit;
+type sysfs_boot_mode;
+allow ccci_mdinit sysfs_boot_mode:file { open read };

sepolicy/private/em_app.te

@@ -0,0 +1,4 @@
+allow em_app content_capture_service:service_manager find;
+allow em_app game_service:service_manager find;
+allow em_app netstats_service:service_manager find;
+

sepolicy/private/fuelgauged_nvram.te

@@ -0,0 +1,3 @@
+type fuelgauged_nvram;
+allow fuelgauged_nvram sysfs_dt_firmware_android:dir { search };
+allow fuelgauged_nvram sysfs_dt_firmware_android:file { getattr open read };

sepolicy/private/gsm0710muxd.te

@@ -0,0 +1,2 @@
+type gsm0710muxd;
+allow gsm0710muxd ctl_stop_prop:property_service set;

sepolicy/private/hal_audio_sysbta.te

@@ -8,3 +8,5 @@ hal_client_domain(hal_audio_sysbta, hal_allocator)
 
 # allow audioserver to call hal_audio dump with its own fd to retrieve status
 allow hal_audio_sysbta audioserver:fifo_file write;
+allow hal_audio_sysbta vendor_default_prop:file { read getattr map open };
+

sepolicy/private/hal_citsensorservice_xiaomi_default.te

@@ -0,0 +1,3 @@
+type hal_citsensorservice_xiaomi_default;
+allow hal_citsensorservice_xiaomi_default sysfs_leds:dir { search open read };
+allow hal_citsensorservice_xiaomi_default sysfs_led_lcd_bl:file read;

sepolicy/private/hal_mtdservice_default.te

@@ -0,0 +1,12 @@
+type hal_mtdservice_default;
+type persist_subsys_file;
+type vendor_fingerprint_data_file;
+type mediadrm_vendor_data_file;
+type camera_persist_file;
+allow hal_mtdservice_default file_contexts_file:file { read getattr open };
+allow hal_mtdservice_default persist_subsys_file:dir { getattr };
+allow hal_mtdservice_default vendor_fingerprint_data_file:dir { getattr };
+allow hal_mtdservice_default media_rw_data_file:file { getattr };
+allow hal_mtdservice_default camera_persist_file:dir { getattr };
+allow hal_mtdservice_default hal_mtdservice_default:capability { dac_read_search dac_override sys_admin };
+allow hal_mtdservice_default mediadrm_vendor_data_file:dir search;

sepolicy/private/hal_vibratorfeature_default.te

@@ -0,0 +1,2 @@
+type hal_vibratorfeature_default;
+allow hal_vibratorfeature_default sysfs_vibrator:file { getattr };

sepolicy/private/hal_wifi_default.te

@@ -0,0 +1,2 @@
+type hal_wifi_default;
+allow hal_wifi_default persist_vendor_debug_wifi_prop:file { getattr map open read };

sepolicy/private/init.te

@@ -1,6 +1,14 @@
+type init_shell;
 allow init { 
     hwservicemanager
     hal_fingerprint_default
     hal_touchfeature_xiaomi_default
 }:binder { call transfer };
-
+allow init socket_device:sock_file { create setattr };
+allow init sysfs:dir add_name;
+allow init sysfs:file create;
+allow init sysfs_devices_block:dir add_name;
+allow init sysfs_devices_block:file { open write };
+allow init sysfs_dm:dir add_name;
+allow init sysfs_led_lcd_bl:file setattr;
+allow init_shell toolbox_exec:file { execute execute_no_trans getattr map open read };

sepolicy/private/mediacodec.te

@@ -0,0 +1,2 @@
+type mediacodec;
+allow mediacodec default_prop:file { getattr map open read };

sepolicy/private/mnld.te

@@ -0,0 +1,3 @@
+type mnld;
+type sysfs_led_lcd_bl;
+allow mnld sysfs_led_lcd_bl:file { getattr open read };

sepolicy/private/mtk_hal_audio.te

@@ -0,0 +1,4 @@
+type mtk_hal_audio;
+type persist_data_file;
+allow mtk_hal_audio persist_data_file:dir { search };
+allow mtk_hal_audio persist_data_file:file { getattr open read };

sepolicy/private/mtk_hal_camera.te

@@ -0,0 +1,3 @@
+type mtk_hal_camera;
+allow mtk_hal_camera default_prop:file { read getattr map open };
+allow mtk_hal_camera proc_stat:file { read open };

sepolicy/private/mtk_hal_light.te

@@ -0,0 +1,2 @@
+type mtk_hal_light;
+allow mtk_hal_light default_prop:file { getattr map open read };

sepolicy/private/mtk_hal_nvramagent.te

@@ -0,0 +1,4 @@
+type mtk_hal_nvramagent;
+allow mtk_hal_nvramagent proc_cmdline:file { getattr open read };
+allow mtk_hal_nvramagent sysfs_dt_firmware_android:dir search;
+allow mtk_hal_nvramagent sysfs_dt_firmware_android:file { getattr open read };

sepolicy/private/netd.te

@@ -0,0 +1,4 @@
+allow netd proc_net:dir add_name;
+allow netd proc_net:file create;
+allow netd sysfs_net:dir add_name;
+allow netd sysfs_net:file create;

sepolicy/private/netutils_wrapper.te

@@ -0,0 +1,6 @@
+type ccci_vts_device;
+type ccci_wifi_proxy_device;
+type ccci_device;
+allow netutils_wrapper ccci_vts_device:chr_file { read write };
+allow netutils_wrapper ccci_wifi_proxy_device:chr_file { read write };
+allow netutils_wrapper ccci_device:chr_file { read write };

sepolicy/private/network_stack.te

@@ -0,0 +1 @@
+allow network_stack fs_bpf:file { read write };

sepolicy/private/nvram_daemon.te

@@ -0,0 +1,4 @@
+type nvram_daemon;
+allow nvram_daemon proc_cmdline:file { getattr open read };
+allow nvram_daemon sysfs_dt_firmware_android:dir search;
+allow nvram_daemon sysfs_dt_firmware_android:file { getattr open read };

sepolicy/private/odrefresh.te

@@ -0,0 +1,199 @@
+type vendor_ffu_prop;
+type vendor_mi_ic_prop;
+type vendor_mtk_atci_sys_prop;
+type vendor_mtk_bt_perf_prop;
+type vendor_mtk_c2_log_prop;
+type vendor_mtk_ctl_ccci2_fsd_prop;
+type vendor_mtk_ctl_fusion_ril_mtk_prop;
+type vendor_mtk_ctl_viarild_prop;
+type vendor_mtk_device_prop;
+type vendor_mtk_dmc_prop;
+type vendor_mtk_factory_prop;
+type vendor_mtk_factory_start_prop;
+type vendor_mtk_gbe_prop;
+type vendor_mtk_graphics_hwc_hdr_prop;
+type vendor_mtk_input_report_rate_prop;
+type vendor_mtk_mcf_prop;
+type vendor_mtk_meta_connecttype_prop;
+type vendor_mtk_nfc_nfcstackp_enable_prop;
+type vendor_mtk_powerhal_prop;
+type vendor_mtk_prefer64_prop;
+type vendor_mtk_rpmb_ready_prop;
+type vendor_mtk_soc_prop;
+type vendor_mtk_svp_on_mtee_support_prop;
+type vendor_mtk_telephony_sensitive_prop;
+type vendor_mtk_thermal_config_prop;
+type vendor_mtk_wfc_serv_prop;
+type vendor_panel_info_prop;
+type vendor_slad_prop;
+type vendor_touchfeature_prop;
+
+allow odrefresh aac_drc_prop:file { getattr map open };
+allow odrefresh ab_update_gki_prop:file { getattr map open };
+allow odrefresh adbd_config_prop:file { getattr map open };
+allow odrefresh adbd_prop:file { getattr map open };
+allow odrefresh apexd_config_prop:file { getattr map open };
+allow odrefresh apexd_payload_metadata_prop:file { getattr map open };
+allow odrefresh apexd_prop:file { getattr map open };
+allow odrefresh apk_verity_prop:file { getattr map open };
+allow odrefresh audio_config_prop:file { getattr map open };
+allow odrefresh bluetooth_a2dp_offload_prop:file { getattr map open };
+allow odrefresh bluetooth_audio_hal_prop:file { getattr map open };
+allow odrefresh bluetooth_prop:file { getattr map open };
+allow odrefresh bootanim_config_prop:file { getattr map open };
+allow odrefresh bootloader_boot_reason_prop:file { getattr map open };
+allow odrefresh boottime_prop:file { getattr map open };
+allow odrefresh boottime_public_prop:file { getattr map open };
+allow odrefresh bpf_progs_loaded_prop:file { getattr map open };
+allow odrefresh build_bootimage_prop:file { getattr map open };
+allow odrefresh build_config_prop:file { getattr map open };
+allow odrefresh camera2_extensions_prop:file { getattr map open };
+allow odrefresh camera_calibration_prop:file { getattr map open };
+allow odrefresh camerax_extensions_prop:file { getattr map open };
+allow odrefresh charger_config_prop:file { getattr map open };
+allow odrefresh charger_prop:file { getattr map open };
+allow odrefresh charger_status_prop:file { getattr map open };
+allow odrefresh codec2_config_prop:file { getattr map open };
+allow odrefresh cold_boot_done_prop:file { getattr map open };
+allow odrefresh cpu_variant_prop:file { getattr map open };
+allow odrefresh ctl_adbd_prop:file { getattr map open };
+allow odrefresh ctl_apexd_prop:file { getattr map open };
+allow odrefresh ctl_bootanim_prop:file { getattr map open };
+allow odrefresh ctl_bugreport_prop:file { getattr map open };
+allow odrefresh ctl_console_prop:file { getattr map open };
+allow odrefresh ctl_default_prop:file { getattr map open };
+allow odrefresh ctl_dumpstate_prop:file { getattr map open };
+allow odrefresh ctl_fuse_prop:file { getattr map open };
+allow odrefresh ctl_gsid_prop:file { getattr map open };
+allow odrefresh ctl_interface_restart_prop:file { getattr map open };
+allow odrefresh ctl_interface_start_prop:file { getattr map open };
+allow odrefresh ctl_interface_stop_prop:file { getattr map open };
+allow odrefresh ctl_mdnsd_prop:file { getattr map open };
+allow odrefresh ctl_mediatranscoding_prop:file { getattr map open };
+allow odrefresh ctl_odsign_prop:file { getattr map open };
+allow odrefresh ctl_restart_prop:file { getattr map open };
+allow odrefresh ctl_rildaemon_prop:file { getattr map open };
+allow odrefresh ctl_sigstop_prop:file { getattr map open };
+allow odrefresh ctl_snapuserd_prop:file { getattr map open };
+allow odrefresh ctl_start_prop:file { getattr map open };
+allow odrefresh ctl_stop_prop:file { getattr map open };
+allow odrefresh dck_prop:file { getattr map open };
+allow odrefresh debugfs_restriction_prop:file { getattr map open };
+allow odrefresh device_config_activity_manager_native_boot_prop:file { getattr map open };
+allow odrefresh device_config_boot_count_prop:file { getattr map open };
+allow odrefresh device_config_configuration_prop:file { getattr map open };
+allow odrefresh device_config_connectivity_prop:file { getattr map open };
+allow odrefresh device_config_input_native_boot_prop:file { getattr map open };
+allow odrefresh device_config_lmkd_native_prop:file { getattr map open };
+allow odrefresh device_config_media_native_prop:file { getattr map open };
+allow odrefresh device_config_mglru_native_prop:file { getattr map open };
+allow odrefresh device_config_netd_native_prop:file { getattr map open };
+allow odrefresh device_config_nnapi_native_prop:file { getattr map open };
+allow odrefresh device_config_profcollect_native_boot_prop:file { getattr map open };
+allow odrefresh device_config_reset_performed_prop:file { getattr map open };
+allow odrefresh device_config_statsd_native_boot_prop:file { getattr map open };
+allow odrefresh device_config_statsd_native_prop:file { getattr map open };
+allow odrefresh device_config_storage_native_boot_prop:file { getattr map open };
+allow odrefresh device_config_surface_flinger_native_boot_prop:file { getattr map open };
+allow odrefresh device_config_swcodec_native_prop:file { getattr map open };
+allow odrefresh device_config_sys_traced_prop:file { getattr map open };
+allow odrefresh device_config_tethering_prop:file { getattr map open };
+allow odrefresh device_config_vendor_system_native_boot_prop:file { getattr map open };
+allow odrefresh device_config_vendor_system_native_prop:file { getattr map open };
+allow odrefresh device_config_virtualization_framework_native_prop:file { getattr map open };
+allow odrefresh device_config_window_manager_native_boot_prop:file { getattr map open };
+allow odrefresh device_logging_prop:file { getattr map open };
+allow odrefresh dmesgd_start_prop:file { getattr map open };
+allow odrefresh drm_service_config_prop:file { getattr map open };
+allow odrefresh dumpstate_options_prop:file { getattr map open };
+allow odrefresh dynamic_system_prop:file { getattr map open };
+allow odrefresh exported_bluetooth_prop:file { getattr map open };
+allow odrefresh exported_overlay_prop:file { getattr map open };
+allow odrefresh fastbootd_protocol_prop:file { getattr map open };
+allow odrefresh ffs_control_prop:file { getattr map open };
+allow odrefresh firstboot_prop:file { getattr map open };
+allow odrefresh framework_watchdog_config_prop:file { getattr map open };
+allow odrefresh gesture_prop:file { getattr map open };
+allow odrefresh gsid_prop:file { getattr map open };
+allow odrefresh hal_dumpstate_config_prop:file { getattr map open };
+allow odrefresh heapprofd_enabled_prop:file { getattr map open };
+allow odrefresh hwservicemanager_prop:file { getattr map open };
+allow odrefresh hypervisor_prop:file { getattr map open };
+allow odrefresh incremental_prop:file { getattr map open };
+allow odrefresh init_perf_lsm_hooks_prop:file { getattr map open };
+allow odrefresh init_svc_debug_prop:file { getattr map open };
+allow odrefresh keyguard_config_prop:file { getattr map open };
+allow odrefresh keystore_crash_prop:file { getattr map open };
+allow odrefresh keystore_listen_prop:file { getattr open };
+allow odrefresh lmkd_prop:file open;
+allow odrefresh logpersistd_logging_prop:file { getattr open };
+allow odrefresh media_config_prop:file map;
+allow odrefresh mmc_prop:file open;
+allow odrefresh net_dns_prop:file open;
+allow odrefresh nnapi_ext_deny_product_prop:file open;
+allow odrefresh overlay_prop:file map;
+allow odrefresh persist_wm_debug_prop:file map;
+allow odrefresh profcollectd_node_id_prop:file getattr;
+allow odrefresh radio_cdma_ecm_prop:file open;
+allow odrefresh remote_prov_prop:file open;
+allow odrefresh sendbug_config_prop:file open;
+allow odrefresh smart_idle_maint_enabled_prop:file open;
+allow odrefresh storage_config_prop:file getattr;
+allow odrefresh suspend_prop:file open;
+allow odrefresh system_lmk_prop:file map;
+allow odrefresh system_mtk_amsaal_prop:file open;
+allow odrefresh system_mtk_bgdata_disabled_prop:file open;
+allow odrefresh system_mtk_cdma_ecm_prop:file open;
+allow odrefresh system_mtk_cta_set_prop:file open;
+allow odrefresh system_mtk_ctl_emdlogger2_prop:file map;
+allow odrefresh system_mtk_dbg_ims_prop:file open;
+allow odrefresh system_mtk_debug_netlog_prop:file open;
+allow odrefresh system_mtk_gprs_attach_type_prop:file open;
+allow odrefresh system_mtk_init_svc_emdlogger1_prop:file map;
+allow odrefresh system_mtk_mdl_start_prop:file open;
+allow odrefresh system_mtk_opt_in_url_prop:file map;
+allow odrefresh system_mtk_persist_vendor_vzw_device_type_prop:file open;
+allow odrefresh system_mtk_rcs_support_prop:file open;
+allow odrefresh system_mtk_sf_debug_prop:file getattr;
+allow odrefresh system_mtk_telecom_vibrate_prop:file open;
+allow odrefresh system_mtk_usb_tethering_prop:file open;
+allow odrefresh system_mtk_vsim_sys_prop:file open;
+allow odrefresh system_trace_prop:file open;
+allow odrefresh system_user_mode_emulation_prop:file open;
+allow odrefresh test_boot_reason_prop:file map;
+allow odrefresh traced_enabled_prop:file map;
+allow odrefresh vehicle_hal_prop:file { getattr open };
+allow odrefresh vendor_default_prop:file open;
+allow odrefresh vendor_ffu_prop:file open;
+allow odrefresh vendor_mi_ic_prop:file open;
+allow odrefresh vendor_mtk_atci_sys_prop:file { getattr open };
+allow odrefresh vendor_mtk_bt_perf_prop:file { getattr open };
+allow odrefresh vendor_mtk_c2_log_prop:file open;
+allow odrefresh vendor_mtk_ctl_ccci2_fsd_prop:file { getattr open };
+allow odrefresh vendor_mtk_ctl_fusion_ril_mtk_prop:file open;
+allow odrefresh vendor_mtk_ctl_viarild_prop:file open;
+allow odrefresh vendor_mtk_device_prop:file open;
+allow odrefresh vendor_mtk_dmc_prop:file open;
+allow odrefresh vendor_mtk_factory_prop:file { getattr open };
+allow odrefresh vendor_mtk_factory_start_prop:file open;
+allow odrefresh vendor_mtk_gbe_prop:file open;
+allow odrefresh vendor_mtk_graphics_hwc_hdr_prop:file open;
+allow odrefresh vendor_mtk_input_report_rate_prop:file { getattr open };
+allow odrefresh vendor_mtk_mcf_prop:file open;
+allow odrefresh vendor_mtk_meta_connecttype_prop:file { getattr open };
+allow odrefresh vendor_mtk_nfc_nfcstackp_enable_prop:file { getattr map open };
+allow odrefresh vendor_mtk_powerhal_prop:file { getattr map open };
+allow odrefresh vendor_mtk_prefer64_prop:file open;
+allow odrefresh vendor_mtk_rpmb_ready_prop:file { getattr map open };
+allow odrefresh vendor_mtk_soc_prop:file open;
+allow odrefresh vendor_mtk_svp_on_mtee_support_prop:file open;
+allow odrefresh vendor_mtk_telephony_sensitive_prop:file open;
+allow odrefresh vendor_mtk_thermal_config_prop:file open;
+allow odrefresh vendor_mtk_wfc_serv_prop:file { getattr map open };
+allow odrefresh vendor_panel_info_prop:file { getattr map open };
+allow odrefresh vendor_payment_security_prop:file open;
+allow odrefresh vendor_slad_prop:file open;
+allow odrefresh vendor_touchfeature_prop:file open;
+allow odrefresh vold_post_fs_data_prop:file open;
+allow odrefresh wifi_config_prop:file open;
+allow odrefresh zram_control_prop:file open;

sepolicy/private/platform_app.te

@@ -0,0 +1,2 @@
+allow platform_app vendor_default_prop:file { getattr map open };
+

sepolicy/private/proc_cpufreq.te

@@ -0,0 +1,2 @@
+type proc_cpufreq;
+allow proc_cpufreq proc:filesystem associate;

sepolicy/private/proc_perfmgr.te

@@ -0,0 +1,2 @@
+type proc_perfmgr;
+allow proc_perfmgr proc:filesystem associate;

sepolicy/private/radio.te

@@ -1 +1,2 @@
 allow radio default_android_service:service_manager { find };
+allow radio system_mtk_vodata_prop:file { getattr map open read };

sepolicy/private/rild.te

@@ -0,0 +1,2 @@
+type rild;
+allow rild vendor_default_prop:property_service set;

sepolicy/private/surfaceflinger.te

@@ -0,0 +1 @@
+allow surfaceflinger vendor_default_prop:file { getattr map open };

sepolicy/private/system_server.te

@@ -0,0 +1,2 @@
+allow system_server sysfs:file { getattr open read };
+allow system_server vendor_default_prop:file { getattr map open read };

sepolicy/private/system_suspend.te

@@ -0,0 +1,10 @@
+type sysfs_battery_supply;
+type sysfs_usb_supply;
+allow system_suspend sysfs_batteryinfo:dir { read open };
+allow system_suspend sysfs_batteryinfo:file { getattr open read };
+allow system_suspend sysfs_battery_supply:dir { read open };
+allow system_suspend sysfs_battery_supply:file { getattr open read };
+allow system_suspend sysfs:dir { read open };
+allow system_suspend sysfs:file { getattr open read };
+allow system_suspend sysfs_usb_supply:dir { read open };
+allow system_suspend sysfs_usb_supply:file { getattr open read };

sepolicy/private/vendor_init.te

@@ -0,0 +1,25 @@
+type vendor_mtk_atm_mdmode_prop;
+allow vendor_init proc:file { write create };
+allow vendor_init default_prop:file { getattr map open read };
+allow vendor_init proc:dir add_name;
+allow vendor_init proc_cpufreq:dir add_name;
+allow vendor_init proc_cpufreq:file create;
+allow vendor_init proc_perfmgr:dir add_name;
+allow vendor_init proc_perfmgr:file create;
+allow vendor_init sysfs:dir add_name;
+allow vendor_init sysfs:file create;
+allow vendor_init sysfs_android_usb:dir add_name;
+allow vendor_init sysfs_android_usb:file create;
+allow vendor_init sysfs_devices_block:dir add_name;
+allow vendor_init sysfs_devices_block:file create;
+allow vendor_init sysfs_devices_system_cpu:dir add_name;
+allow vendor_init sysfs_devices_system_cpu:file create;
+allow vendor_init sysfs_dm:dir add_name;
+allow vendor_init sysfs_dm:file create;
+allow vendor_init sysfs_net:dir add_name;
+allow vendor_init sysfs_net:file create;
+allow vendor_init sysfs_zram:dir add_name;
+allow vendor_init sysfs_zram:file create;
+allow vendor_init vendor_mtk_atm_mdmode_prop:property_service set;
+allow vendor_init vts_status_prop:file read;
+

sepolicy/private/wlan_assistant.te

@@ -0,0 +1,3 @@
+type wlan_assistant;
+allow wlan_assistant gsi_public_metadata_file:file { getattr open read };
+allow wlan_assistant radio_prop:property_service set;