sepolicy: cleanup move to minimal sepolicy custom source

- cleanup and not required sepolicy causing issues - Structured the clo way [Co-author commit included in squash] - include github.com/ahnet-69/hardware_sony/commit/568a6c97df1b7917c7bf213fea89da9be306b01f Co-authored-by: adithya2306 <[email protected]> Signed-off-by: hpnightowl <[email protected]>
P-404 · Dec 22, 2024 · 2bc2999 · 2bc2999
1 parent a3d7e9d
commit 2bc2999
Show file tree

Hide file tree

Showing 60 changed files with 75 additions and 328 deletions.
diff --git a/P404Sepolicy.mk b/P404Sepolicy.mk
@@ -0,0 +1,13 @@
+#
+# This policy configuration will be used by all qcom products
+# that inherit from 404
+#
+
+SYSTEM_EXT_PRIVATE_SEPOLICY_DIRS += \
+    device/404/sepolicy/private
+
+SYSTEM_EXT_PUBLIC_SEPOLICY_DIRS += \
+    device/404/sepolicy/public
+
+BOARD_VENDOR_SEPOLICY_DIRS += \
+    device/404/sepolicy/vendor
diff --git a/common/dynamic/file.te b/common/dynamic/file.te
diff --git a/common/dynamic/genfs_contexts b/common/dynamic/genfs_contexts
diff --git a/common/dynamic/hal_lineage_camera_motor.te b/common/dynamic/hal_lineage_camera_motor.te
diff --git a/common/dynamic/hal_lineage_powershare.te b/common/dynamic/hal_lineage_powershare.te
diff --git a/common/dynamic/hwservice.te b/common/dynamic/hwservice.te
diff --git a/common/dynamic/hwservice_contexts b/common/dynamic/hwservice_contexts
diff --git a/common/private/backuptool.te b/common/private/backuptool.te
diff --git a/common/private/cameraserver.te b/common/private/cameraserver.te
diff --git a/common/private/file.te b/common/private/file.te
diff --git a/common/private/file_contexts b/common/private/file_contexts
diff --git a/common/private/gallery_app.te b/common/private/gallery_app.te
diff --git a/common/private/genfs_contexts b/common/private/genfs_contexts
diff --git a/common/private/platform_app.te b/common/private/platform_app.te
diff --git a/common/private/priv_app.te b/common/private/priv_app.te
diff --git a/common/private/recovery.te b/common/private/recovery.te
diff --git a/common/private/seapp_contexts b/common/private/seapp_contexts
diff --git a/common/private/service.te b/common/private/service.te
diff --git a/common/private/service_contexts b/common/private/service_contexts
diff --git a/common/private/snap_app.te b/common/private/snap_app.te
diff --git a/common/private/system_server.te b/common/private/system_server.te
diff --git a/common/private/updater_app.te b/common/private/updater_app.te
diff --git a/common/public/attributes b/common/public/attributes
diff --git a/common/public/file.te b/common/public/file.te
diff --git a/common/public/shell.te b/common/public/shell.te
diff --git a/common/public/te_macros b/common/public/te_macros
diff --git a/common/sepolicy.mk b/common/sepolicy.mk
diff --git a/common/system-only/file_contexts b/common/system-only/file_contexts
diff --git a/common/vendor/file_contexts b/common/vendor/file_contexts
diff --git a/common/vendor/hal_lineage_camera_motor_default.te b/common/vendor/hal_lineage_camera_motor_default.te
diff --git a/common/vendor/hal_lineage_powershare_default.te b/common/vendor/hal_lineage_powershare_default.te
diff --git a/legacy-common/public/legacy-camera-hal1/mediaserver.te b/legacy-common/public/legacy-camera-hal1/mediaserver.te
diff --git a/legacy-common/sepolicy.mk b/legacy-common/sepolicy.mk
diff --git a/private/appdomain.te b/private/appdomain.te
@@ -0,0 +1 @@
+get_prop(appdomain, pih_disable_prop)
diff --git a/private/bootanim.te b/private/bootanim.te
@@ -0,0 +1,3 @@
+# Allow bootanimation to call mediametrics.
+allow bootanim mediametrics_service:service_manager find;
+binder_call(bootanim, mediametrics)
diff --git a/private/genfs_contexts b/private/genfs_contexts
@@ -0,0 +1,8 @@
+# Dirty writeback tunables
+genfscon proc /sys/vm/dirty_background_bytes u:object_r:proc_dirty:s0
+#genfscon proc /sys/vm/dirty_background_ratio u:object_r:proc_dirty:s0
+genfscon proc /sys/vm/dirty_bytes u:object_r:proc_dirty:s0
+genfscon proc /sys/vm/dirty_ratio u:object_r:proc_dirty:s0
+#genfscon proc /sys/vm/dirty_expire_centisecs u:object_r:proc_dirty:s0
+genfscon proc /sys/vm/dirty_writeback_centisecs u:object_r:proc_dirty:s0
+genfscon proc /sys/vm/dirtytime_expire_seconds u:object_r:proc_dirty:s0
diff --git a/private/platform_app.te b/private/platform_app.te
@@ -0,0 +1 @@
+binder_use(platform_app)
diff --git a/private/property.te b/private/property.te
@@ -0,0 +1,5 @@
+# PIHooks
+system_public_prop(pih_disable_prop)
+
+# Tethering
+system_internal_prop(device_config_tethering_prop)
diff --git a/private/property_contexts b/private/property_contexts
@@ -0,0 +1,5 @@
+# PIHooks
+persist.sys.pihooks.disable.            u:object_r:pih_disable_prop:s0
+
+# Tethering
+persist.device_config.tethering.        u:object_r:device_config_tethering_prop:s0
diff --git a/common/private/rootfs.te → private/rootfs.te b/common/private/rootfs.te → private/rootfs.te
diff --git a/common/private/sdcardfs.te → private/sdcardfs.te b/common/private/sdcardfs.te → private/sdcardfs.te
diff --git a/private/shell.te b/private/shell.te
@@ -0,0 +1,5 @@
+# Allow shell to get LMKD's stats
+get_prop(shell, system_lmk_prop)
+
+# Allow shell to disable PIHooks
+set_prop(shell, pih_disable_prop)
diff --git a/private/system_server.te b/private/system_server.te
@@ -0,0 +1,5 @@
+# Set tethering properties
+set_prop(system_server, device_config_tethering_prop)
+
+# CachedAppOptimizer
+allow system_server zygote_tmpfs:file rw_file_perms;
diff --git a/common/private/update_engine.te → private/update_engine.te b/common/private/update_engine.te → private/update_engine.te
@@ -1,13 +1,9 @@
 # Allow update_engine to call the callback function provided by updater_app
-binder_call(update_engine, updater_app)
+binder_call(update_engine, hub_app)
 
 # Read updates from storage data
 r_dir_file(update_engine, mnt_user_file)
 r_dir_file(update_engine, storage_file)
 
 # Allow mount and unmount of system partition
 allow update_engine labeledfs:filesystem { mount unmount };
-
-# Allow transition to backuptool domain
-allow update_engine self:process setexec;
-domain_trans(update_engine, otapreopt_chroot_exec, backuptool)
diff --git a/public/file.te b/public/file.te
@@ -0,0 +1,2 @@
+# Fastcharge
+type sysfs_fastcharge, sysfs_type, fs_type;
diff --git a/public/te_macros b/public/te_macros
@@ -0,0 +1,17 @@
+#####################################
+# rw_dir_file(domain, type)
+# Allow the specified domain to read directories and read/write files
+# and symbolic links of the specified type.
+define(`rw_dir_file', `
+allow $1 $2:dir r_dir_perms;
+allow $1 $2:{ file lnk_file } rw_file_perms;
+')
+
+#####################################
+# create_dir_file(domain, type)
+# Allow the specified domain to read directories and create files
+# and symbolic links of the specified type.
+define(`create_dir_file', `
+allow $1 $2:dir r_dir_perms;
+allow $1 $2:{ file lnk_file } create_file_perms;
+')
diff --git a/qcom/dynamic/dontaudit.te b/qcom/dynamic/dontaudit.te
diff --git a/qcom/private/property_contexts b/qcom/private/property_contexts
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1,2 @@
		# Fastcharge
		type sysfs_fastcharge, sysfs_type, fs_type;