diff --git a/sepolicy/vendor/dockservice_app.te b/sepolicy/vendor/dockservice_app.te new file mode 100644 index 0000000..47430d5 --- /dev/null +++ b/sepolicy/vendor/dockservice_app.te @@ -0,0 +1,44 @@ +# dockservice_app +type dockservice_app, domain, coredomain; +typeattribute dockservice_app mlstrustedsubject; + +binder_use(dockservice_app) + +app_domain(dockservice_app) +net_domain(dockservice_app) + +allow dockservice_app servicemanager:service_manager list; + +# Access standard system services +allow dockservice_app{ + activity_service + app_api_service + audioserver_service + cameraserver_service + content_capture_service + drmserver_service + game_service + gpu_service + mediadrmserver_service + mediaextractor_service + mediametrics_service + mediaserver_service + netstats_service + #nvcpl_service + surfaceflinger_service +}:service_manager find; + +binder_call(essential_camera_app, gpuservice) +binder_call(essential_camera_app, hal_graphics_composer_tegra) + +# Allow writting to /dev/stune/foreground/tasks +allow dockservice_app cgroup:file w_file_perms; + +allow dockservice_app dockservice_app_data_file:dir create_dir_perms; +allow dockservice_app dockservice_app_data_file:file create_file_perms; +allow dockservice_app system_app_data_file:file r_file_perms; +allow dockservice_app system_data_file:dir search; + +allow dockservice_app sysfs_disp_dev:file rw_file_perms; +allow dockservice_app sysfs_pwm_fan:file rw_file_perms; +allow dockservice_app sysfs_disp_dev:file rw_file_perms; diff --git a/sepolicy/vendor/file.te b/sepolicy/vendor/file.te index 9e8b364..3d24927 100644 --- a/sepolicy/vendor/file.te +++ b/sepolicy/vendor/file.te @@ -1,5 +1,11 @@ +# DockService data file +type dockservice_app_data_file, file_type, data_file_type, app_data_file_type; + # HDMI CEC permission symlink type permission_vendor_data_file, file_type, data_file_type; # Serial sysfs (JoyCons) type sysfs_serial, fs_type, sysfs_type; + +# USB firmware +type vendor_firmware_usb_file, file_type, vendor_file_type; diff --git a/sepolicy/vendor/file_contexts b/sepolicy/vendor/file_contexts index 9353bd4..8c765d2 100644 --- a/sepolicy/vendor/file_contexts +++ b/sepolicy/vendor/file_contexts @@ -6,6 +6,7 @@ # Battery /sys/devices/70006040.serial/serial[0-9]/serial[0-9]-[0-9]/power_supply/nintendo_switch_controller_battery_serial[0-9]-[0-9]/type u:object_r:sysfs_power_supply:s0 +/sys/devices/70006200.serial/serial[0-9]/serial[0-9]-[0-9]/power_supply/nintendo_switch_controller_battery_serial[0-9]-[0-9]/type u:object_r:sysfs_power_supply:s0 # Block Devices /dev/block/platform/(sdhci-tegra|tegra-xhci).[0-9]/by-name/boot u:object_r:boot_block_device:s0 @@ -17,11 +18,19 @@ /dev/block/platform/(sdhci-tegra|tegra-xhci).[0-9]/by-name/super u:object_r:super_block_device:s0 /dev/block/platform/(sdhci-tegra|tegra-xhci).[0-9]/by-name/userdata u:object_r:userdata_block_device:s0 +# Display sysfs (Panel) +/sys/devices/50000000.host1x/tegradc.0/enable u:object_r:sysfs_disp_dev:s0 +/sys/devices/50000000.host1x/tegradc.0/panel_color_mode u:object_r:sysfs_disp_dev:s0 + # Extcon sysfs (USB) /sys/devices/usb_cd/extcon/extcon[0-9]+/cable.[0-9]+/name u:object_r:sysfs_extcon_name:s0 /sys/devices/7000c000.i2c/i2c-0/0-0018/extcon/extcon[0-1]/name u:object_r:sysfs_extcon_name:s0 /sys/devices/7000c000.i2c/i2c-0/0-006b/extcon/extcon[0-1]/name u:object_r:sysfs_extcon_name:s0 +# GPU firmware +/vendor/firmware/tegra21x/vic04_ucode.bin u:object_r:vendor_firmware_gpu_file:s0 +/vendor/firmware/tegra21x/nvhost_nvenc050.fw u:object_r:vendor_firmware_gpu_file:s0 + # IIO sysfs (Sensors) /sys/devices/7000c400.i2c/i2c-1/1-0029/iio:device[0-9] u:object_r:sysfs_iio:s0 /sys/devices/7000c400.i2c/i2c-1/1-0029/iio:device[0-9](/.*)? u:object_r:sysfs_iio:s0 @@ -30,6 +39,9 @@ # jc_setup /vendor/bin/jc_setup.sh u:object_r:jc_setup_exec:s0 +# PWM sysfs (Fan) +/sys/devices/thermal-fan-est/fan_profile u:object_r:sysfs_pwm_fan:s0 + # Serial sysfs (JoyCons) /sys/devices/[0-9]+.serial/serial[0-1]/serial[0-1]-[0-1]/power_supply/nintendo_switch_controller_battery_serial[0-1]-[0-1]/scope u:object_r:sysfs_serial:s0 /sys/devices/[0-9]+.serial/serial[0-1]/serial[0-1]-[0-1]/power_supply/nintendo_switch_controller_battery_serial[0-1]-[0-1]/type u:object_r:sysfs_serial:s0 @@ -42,6 +54,10 @@ /sys/devices/7000d000.i2c/i2c-[0-9]+/[0-9]+-[0-9a-f]*/regulator/regulator.[0-9]+/name u:object_r:sysfs_regulator_name:s0 /sys/devices/regulators/regulators:regulator@0x[a-fA-F]+/regulator/regulator.[0-9]+/name u:object_r:sysfs_regulator_name:s0 +# USB firmware +/vendor/firmware/nvidia/tegra210/xusb.bin u:object_r:vendor_firmware_usb_file:s0 +/vendor/firmware/nvidia/tegra210b01/xusb.bin u:object_r:vendor_firmware_usb_file:s0 + # USB sysfs /sys/devices/7000c000.i2c/i2c-0/0-006b/power_supply/usb/online u:object_r:sysfs_usb:s0 /sys/devices/7000c000.i2c/i2c-0/0-006b/power_supply/usb/type u:object_r:sysfs_usb:s0 diff --git a/sepolicy/vendor/hal_health_default.te b/sepolicy/vendor/hal_health_default.te index 2e354fb..927ac13 100644 --- a/sepolicy/vendor/hal_health_default.te +++ b/sepolicy/vendor/hal_health_default.te @@ -3,3 +3,6 @@ r_dir_file(hal_health_default, sysfs_serial) # Access to Sensors r_dir_file(hal_health_default, sysfs_iio) + +# Access to USB firmware +r_dir_file(hal_health_default, vendor_firmware_usb_file) diff --git a/sepolicy/vendor/kernel.te b/sepolicy/vendor/kernel.te new file mode 100644 index 0000000..bdd9952 --- /dev/null +++ b/sepolicy/vendor/kernel.te @@ -0,0 +1,2 @@ +# Access to USB firmware +r_dir_file(kernel, vendor_firmware_usb_file) diff --git a/sepolicy/vendor/nvphsd.te b/sepolicy/vendor/nvphsd.te new file mode 100644 index 0000000..d5911a3 --- /dev/null +++ b/sepolicy/vendor/nvphsd.te @@ -0,0 +1,2 @@ +r_dir_file(nvphsd, sysfs_disp_dev) +allow nvphsd sysfs_disp_dev:file rw_file_perms; diff --git a/sepolicy/vendor/seapp_contexts b/sepolicy/vendor/seapp_contexts new file mode 100644 index 0000000..987cbdb --- /dev/null +++ b/sepolicy/vendor/seapp_contexts @@ -0,0 +1 @@ +user=system seinfo=platform name=org.lineageos.settings.device domain=dockservice_app type=dockservice_app_data_file