add sepolicy to run intel evs app

sepolicy is needed for running intel evs app intel evs app is customized version of default evs app to support camera virtio. Tests Done : Tested EVS app for surround view and different gear conditions Tracked-On: OAM-123219 Signed-off-by: shivasku82 <[email protected]>
projectceladon · Aug 26, 2024 · 226e2bd · 226e2bd
1 parent dc663f9
commit 226e2bd
Show file tree

Hide file tree

Showing 3 changed files with 43 additions and 0 deletions.
diff --git a/car/evs_intel_app.te b/car/evs_intel_app.te
@@ -0,0 +1,36 @@
+# evs app
+type evs_intel_app, domain, coredomain;
+hal_client_domain(evs_intel_app, hal_evs)
+hal_client_domain(evs_intel_app, hal_vehicle)
+hal_client_domain(evs_intel_app, hal_configstore)
+hal_client_domain(evs_intel_app, hal_graphics_allocator)
+
+# allow init to launch processes in this context
+type evs_intel_app_exec, exec_type, file_type, system_file_type;
+init_daemon_domain(evs_intel_app)
+
+# gets access to its own files on disk
+type evs_intel_app_files, file_type, system_file_type;
+allow evs_intel_app evs_intel_app_files:file { getattr open read };
+allow evs_intel_app evs_intel_app_files:dir search;
+
+# Allow use of gralloc buffers and EGL
+allow evs_intel_app gpu_device:chr_file rw_file_perms;
+allow evs_intel_app ion_device:chr_file r_file_perms;
+allow evs_intel_app system_file:dir r_dir_perms;
+allow evs_intel_app gpu_device:dir search;
+allow evs_intel_app self:process execmem;
+
+# Allow use of binder and find surfaceflinger
+binder_use(evs_intel_app);
+allow evs_intel_app surfaceflinger_service:service_manager find;
+
+# Allow get a list of available services
+allow evs_intel_app servicemanager:service_manager list;
+
+# Allow find evsmanagerd service
+allow evs_intel_app evsmanagerd_service:service_manager find;
+
+allow evs_intel_app gpu_device:dir { read open};
+allow evs_intel_app sysfs_app_readable:file { read open getattr};
+allow evs_intel_app sysfs_gpu:dir { search read };
diff --git a/car/evsmanagerd.te b/car/evsmanagerd.te
@@ -1,2 +1,5 @@
 allow evsmanagerd hal_graphics_allocator_default_tmpfs:file rw_file_perms;
 allow evsmanagerd { appdomain -isolated_app_all }:fd use;
+binder_call(evs_intel_app, evsmanagerd)
+binder_call(evsmanagerd, evs_intel_app)
+
diff --git a/car/file_contexts b/car/file_contexts
@@ -3,3 +3,7 @@
 
 /vendor/bin/hw/android.hardware.broadcastradio@intel-service u:object_r:hal_broadcastradio_default_exec:s0
 /vendor/bin/hw/android.hardware.automotive.audiocontrol@1.0-service.intel u:object_r:hal_audiocontrol_default_exec:s0
+
+/system/bin/evs_intel_app                                             u:object_r:evs_intel_app_exec:s0
+/system/bin/evs_app_support_lib                                 u:object_r:evs_intel_app_exec:s0
+/system/etc/automotive/evs(/.*)?                                u:object_r:evs_intel_app_files:s0