From a58e74ea0635d7547df58aec669fe45b56504df7 Mon Sep 17 00:00:00 2001 From: John Stultz Date: Thu, 14 Apr 2022 23:17:14 +0000 Subject: dragonboard: sepolicy: Add sepolicy rules to fix problems seen adb remount overlays When using adb remount/adb sync, I noticed some new sepolicy failures that prevented some things from working. For instance, if I did adb remount right after flashing a device, on the next bootup I found that wifi would fail to work. This was due to sepolicy failures caused by the file accesses being on the overlayfs. Similarly, when testing a new version of mesa via adb sync, I found surfaceflinger would fail to start, again due to new sepolicy failures These sepolicy changes were suggested by audit2allow to fix the problems, and indeed I now have display and wifi working after adb remount/sync updates. Signed-off-by: John Stultz Change-Id: Ifd819cf34939d1e61b67d8b08c67ec9a2fadd110 --- sepolicy/kernel.te | 6 +++++- sepolicy/surfaceflinger.te | 1 + sepolicy/system_server.te | 2 ++ 3 files changed, 8 insertions(+), 1 deletion(-) diff --git a/sepolicy/kernel.te b/sepolicy/kernel.te index 3fad122..176d6f6 100644 --- a/sepolicy/kernel.te +++ b/sepolicy/kernel.te @@ -2,6 +2,10 @@ allow kernel device:chr_file { create setattr }; allow kernel device:dir { add_name create write }; allow kernel self:capability mknod; -allow kernel vendor_file:file { open read }; +allow kernel vendor_file:file { open read getattr}; +allow kernel vendor_file:dir read; allow kernel self:system module_request; allow vendor_init kernel:system module_request; +allow kernel sepolicy_file:file getattr; +allow kernel system_bootstrap_lib_file:dir getattr; +allow kernel system_bootstrap_lib_file:file getattr; diff --git a/sepolicy/surfaceflinger.te b/sepolicy/surfaceflinger.te index 17b66a8..9bffa3f 100644 --- a/sepolicy/surfaceflinger.te +++ b/sepolicy/surfaceflinger.te @@ -1 +1,2 @@ gpu_access(surfaceflinger) +allow surfaceflinger vendor_file:dir read; diff --git a/sepolicy/system_server.te b/sepolicy/system_server.te index 80957cc..e801436 100644 --- a/sepolicy/system_server.te +++ b/sepolicy/system_server.te @@ -1 +1,3 @@ gpu_access(system_server) +allow system_server wifi_hal_prop:file {open read getattr map}; +allow system_server vendor_file:dir read; -- cgit v1.2.3