diff options
| author | Leo Liou <leoliou@google.com> | 2023-04-17 10:55:02 +0000 |
|---|---|---|
| committer | Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com> | 2023-04-17 10:55:02 +0000 |
| commit | 0f41bbae2a36e48e69abbaad419aceda04872068 (patch) | |
| tree | e37e3fe8164d51b7d332f9e8cf09bc85cfc82f23 | |
| parent | e1ace69d9fee91892cb41bf89d065a7103f046bb (diff) | |
| parent | 3ae91d9c27e1301538b8f1de59067ddc6e63f0b6 (diff) | |
| download | bluejay-sepolicy-0f41bbae2a36e48e69abbaad419aceda04872068.tar.gz | |
Merge "bluejay: add sepolicy for ufs_firmware_update process" into udc-dev am: 23c711561d am: 3ae91d9c27
Original change: https://googleplex-android-review.googlesource.com/c/device/google/bluejay-sepolicy/+/22158745
Change-Id: I2f3ae7593b78331cc25bb65ac10289a35c32bd43
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
| -rw-r--r-- | bluejay/genfs_contexts | 5 | ||||
| -rw-r--r-- | vendor/device.te | 2 | ||||
| -rw-r--r-- | vendor/file_contexts | 5 | ||||
| -rw-r--r-- | vendor/ufs_firmware_update.te | 10 |
4 files changed, 22 insertions, 0 deletions
diff --git a/bluejay/genfs_contexts b/bluejay/genfs_contexts index 0e9b2a8..6b11056 100644 --- a/bluejay/genfs_contexts +++ b/bluejay/genfs_contexts @@ -4,3 +4,8 @@ genfscon sysfs /devices/platform/10970000.hsi2c/i2c-5/i2c-cs40l26a u:object genfscon sysfs /devices/platform/10970000.hsi2c/i2c-6/i2c-cs40l26a u:object_r:sysfs_vibrator:s0 genfscon sysfs /devices/platform/10970000.hsi2c/i2c-7/i2c-cs40l26a u:object_r:sysfs_vibrator:s0 genfscon sysfs /devices/platform/10970000.hsi2c/i2c-8/i2c-cs40l26a u:object_r:sysfs_vibrator:s0 + +# Storage +genfscon sysfs /devices/platform/14700000.ufs/vendor u:object_r:sysfs_scsi_devices_0000:s0 +genfscon sysfs /devices/platform/14700000.ufs/model u:object_r:sysfs_scsi_devices_0000:s0 +genfscon sysfs /devices/platform/14700000.ufs/rev u:object_r:sysfs_scsi_devices_0000:s0 diff --git a/vendor/device.te b/vendor/device.te new file mode 100644 index 0000000..d2a91db --- /dev/null +++ b/vendor/device.te @@ -0,0 +1,2 @@ +# Block Devices +type fips_block_device, dev_type; diff --git a/vendor/file_contexts b/vendor/file_contexts new file mode 100644 index 0000000..a273c79 --- /dev/null +++ b/vendor/file_contexts @@ -0,0 +1,5 @@ +# Binaries +/vendor/bin/ufs_firmware_update\.sh u:object_r:ufs_firmware_update_exec:s0 + +# Devices +/dev/block/platform/14700000\.ufs/by-name/fips u:object_r:fips_block_device:s0 diff --git a/vendor/ufs_firmware_update.te b/vendor/ufs_firmware_update.te new file mode 100644 index 0000000..53ceba5 --- /dev/null +++ b/vendor/ufs_firmware_update.te @@ -0,0 +1,10 @@ +type ufs_firmware_update, domain; +type ufs_firmware_update_exec, vendor_file_type, exec_type, file_type; + +init_daemon_domain(ufs_firmware_update) + +allow ufs_firmware_update vendor_toolbox_exec:file execute_no_trans; +allow ufs_firmware_update block_device:dir r_dir_perms; +allow ufs_firmware_update fips_block_device:blk_file rw_file_perms; +allow ufs_firmware_update sysfs:dir r_dir_perms; +allow ufs_firmware_update sysfs_scsi_devices_0000:file r_file_perms; |