nx: sepolicy: Initial dockservice policy

* Also allow a few other odds and ends that popped up
  while docking.

Change-Id: I8be18a812de2eacd57a574164c6c63659e09d46a

sepolicy/vendor/dockservice_app.te

@@ -0,0 +1,44 @@
+# dockservice_app
+type dockservice_app, domain, coredomain;
+typeattribute dockservice_app mlstrustedsubject;
+
+binder_use(dockservice_app)
+
+app_domain(dockservice_app)
+net_domain(dockservice_app)
+
+allow dockservice_app servicemanager:service_manager list;
+
+# Access standard system services
+allow dockservice_app{
+  activity_service
+  app_api_service
+  audioserver_service
+  cameraserver_service
+  content_capture_service
+  drmserver_service
+  game_service
+  gpu_service
+  mediadrmserver_service
+  mediaextractor_service
+  mediametrics_service
+  mediaserver_service
+  netstats_service
+  #nvcpl_service
+  surfaceflinger_service
+}:service_manager find;
+
+binder_call(essential_camera_app, gpuservice)
+binder_call(essential_camera_app, hal_graphics_composer_tegra)
+
+# Allow writting to /dev/stune/foreground/tasks
+allow dockservice_app cgroup:file w_file_perms;
+
+allow dockservice_app dockservice_app_data_file:dir create_dir_perms;
+allow dockservice_app dockservice_app_data_file:file create_file_perms;
+allow dockservice_app system_app_data_file:file r_file_perms;
+allow dockservice_app system_data_file:dir search;
+
+allow dockservice_app sysfs_disp_dev:file rw_file_perms;
+allow dockservice_app sysfs_pwm_fan:file rw_file_perms;
+allow dockservice_app sysfs_disp_dev:file rw_file_perms;

sepolicy/vendor/file.te

@@ -1,5 +1,11 @@
+# DockService data file
+type dockservice_app_data_file, file_type, data_file_type, app_data_file_type;
+
 # HDMI CEC permission symlink
 type permission_vendor_data_file, file_type, data_file_type;
 
 # Serial sysfs (JoyCons)
 type sysfs_serial, fs_type, sysfs_type;
+
+# USB firmware
+type vendor_firmware_usb_file, file_type, vendor_file_type;

sepolicy/vendor/file_contexts

@@ -6,6 +6,7 @@
 
 # Battery
 /sys/devices/70006040.serial/serial[0-9]/serial[0-9]-[0-9]/power_supply/nintendo_switch_controller_battery_serial[0-9]-[0-9]/type u:object_r:sysfs_power_supply:s0
+/sys/devices/70006200.serial/serial[0-9]/serial[0-9]-[0-9]/power_supply/nintendo_switch_controller_battery_serial[0-9]-[0-9]/type u:object_r:sysfs_power_supply:s0
 
 # Block Devices
 /dev/block/platform/(sdhci-tegra|tegra-xhci).[0-9]/by-name/boot             u:object_r:boot_block_device:s0
@@ -17,11 +18,19 @@
 /dev/block/platform/(sdhci-tegra|tegra-xhci).[0-9]/by-name/super            u:object_r:super_block_device:s0
 /dev/block/platform/(sdhci-tegra|tegra-xhci).[0-9]/by-name/userdata         u:object_r:userdata_block_device:s0
 
+# Display sysfs (Panel)
+/sys/devices/50000000.host1x/tegradc.0/enable           u:object_r:sysfs_disp_dev:s0
+/sys/devices/50000000.host1x/tegradc.0/panel_color_mode u:object_r:sysfs_disp_dev:s0
+
 # Extcon sysfs (USB)
 /sys/devices/usb_cd/extcon/extcon[0-9]+/cable.[0-9]+/name             u:object_r:sysfs_extcon_name:s0
 /sys/devices/7000c000.i2c/i2c-0/0-0018/extcon/extcon[0-1]/name        u:object_r:sysfs_extcon_name:s0
 /sys/devices/7000c000.i2c/i2c-0/0-006b/extcon/extcon[0-1]/name        u:object_r:sysfs_extcon_name:s0
 
+# GPU firmware
+/vendor/firmware/tegra21x/vic04_ucode.bin    u:object_r:vendor_firmware_gpu_file:s0
+/vendor/firmware/tegra21x/nvhost_nvenc050.fw u:object_r:vendor_firmware_gpu_file:s0
+
 # IIO sysfs (Sensors)
 /sys/devices/7000c400.i2c/i2c-1/1-0029/iio:device[0-9]                          u:object_r:sysfs_iio:s0
 /sys/devices/7000c400.i2c/i2c-1/1-0029/iio:device[0-9](/.*)?                    u:object_r:sysfs_iio:s0
@@ -30,6 +39,9 @@
 # jc_setup
 /vendor/bin/jc_setup.sh u:object_r:jc_setup_exec:s0
 
+# PWM sysfs (Fan)
+/sys/devices/thermal-fan-est/fan_profile u:object_r:sysfs_pwm_fan:s0
+
 # Serial sysfs (JoyCons)
 /sys/devices/[0-9]+.serial/serial[0-1]/serial[0-1]-[0-1]/power_supply/nintendo_switch_controller_battery_serial[0-1]-[0-1]/scope u:object_r:sysfs_serial:s0
 /sys/devices/[0-9]+.serial/serial[0-1]/serial[0-1]-[0-1]/power_supply/nintendo_switch_controller_battery_serial[0-1]-[0-1]/type  u:object_r:sysfs_serial:s0
@@ -42,6 +54,10 @@
 /sys/devices/7000d000.i2c/i2c-[0-9]+/[0-9]+-[0-9a-f]*/regulator/regulator.[0-9]+/name           u:object_r:sysfs_regulator_name:s0
 /sys/devices/regulators/regulators:regulator@0x[a-fA-F]+/regulator/regulator.[0-9]+/name        u:object_r:sysfs_regulator_name:s0
 
+# USB firmware
+/vendor/firmware/nvidia/tegra210/xusb.bin    u:object_r:vendor_firmware_usb_file:s0
+/vendor/firmware/nvidia/tegra210b01/xusb.bin u:object_r:vendor_firmware_usb_file:s0
+
 # USB sysfs
 /sys/devices/7000c000.i2c/i2c-0/0-006b/power_supply/usb/online u:object_r:sysfs_usb:s0
 /sys/devices/7000c000.i2c/i2c-0/0-006b/power_supply/usb/type u:object_r:sysfs_usb:s0

sepolicy/vendor/hal_health_default.te

@@ -3,3 +3,6 @@ r_dir_file(hal_health_default, sysfs_serial)
 
 # Access to Sensors
 r_dir_file(hal_health_default, sysfs_iio)
+
+# Access to USB firmware
+r_dir_file(hal_health_default, vendor_firmware_usb_file)

sepolicy/vendor/kernel.te

@@ -0,0 +1,2 @@
+# Access to USB firmware
+r_dir_file(kernel, vendor_firmware_usb_file)

sepolicy/vendor/nvphsd.te

@@ -0,0 +1,2 @@
+r_dir_file(nvphsd, sysfs_disp_dev)
+allow nvphsd sysfs_disp_dev:file rw_file_perms;

sepolicy/vendor/seapp_contexts

@@ -0,0 +1 @@
+user=system seinfo=platform name=org.lineageos.settings.device domain=dockservice_app type=dockservice_app_data_file