nx: sepolicy: Initial support

* Was tested on odin, modin, frig, and vali. * Note: Due to the various sensors configurations across SKUs, sensors will likely need additional labeling after test release. Change-Id: I0f8b159acc0ae14e8e4c7d8ec29a0cb406d3bff8
2024-03-20 19:52:49 +00:00
1 parent c5b488c9de
commit 96ad89b7d6
@@ -83,6 +83,10 @@ TARGET_RECOVERY_UPDATER_LIBS += librecovery_updater_nx
 # Security Patch Level
 VENDOR_SECURITY_PATCH := 2022-04-05

+# SELinux
+BOARD_VENDOR_SEPOLICY_DIRS += device/nintendo/nx/sepolicy/vendor
+SYSTEM_EXT_PRIVATE_SEPOLICY_DIRS += device/nintendo/nx/sepolicy/private
+
 # Treble
 BOARD_PROPERTY_OVERRIDES_SPLIT_ENABLED := true
 BOARD_VNDK_VERSION                     := current
@@ -0,0 +1,2 @@
+# wifi_reset.sh
+type wifi_reset_exec, exec_type, file_type, system_file_type;
@@ -0,0 +1,2 @@
+# wifi_reset.sh
+/system/bin/wifi_reset.sh u:object_r:wifi_reset_exec:s0
@@ -0,0 +1,8 @@
+allow init servicemanager:binder { call transfer };
+allow init system_server:binder { call transfer };
+
+# neverallow wifi_reset.sh
+#allow init settings_service:service_manager find;
+
+# wifi_reset.sh
+allow init wifi_reset_exec:file execute;
@@ -0,0 +1,4 @@
+# neverallow wifi_reset.sh
+#allow system_server init:binder { call transfer };
+
+allow system_server init:fifo_file rw_file_perms;
@@ -0,0 +1,2 @@
+# Block Device Types
+type factory_block_device, dev_type;
@@ -0,0 +1,2 @@
+# Allow jc_setup init scripts to mount hos_data and relabel
+allow factory_file self:filesystem associate;
@@ -0,0 +1,5 @@
+# HDMI CEC permission symlink
+type permission_vendor_data_file, file_type, data_file_type;
+
+# Serial sysfs (JoyCons)
+type sysfs_serial, fs_type, sysfs_type;
@@ -0,0 +1,44 @@
+# HDMI CEC permissions symlink
+/data/vendor/permissions/android.hardware.hdmi.cec.xml u:object_r:permission_vendor_data_file:s0
+
+# Backlight sysfs (Panel)
+/sys/devices/backlight/backlight/pwm-backlight/brightness u:object_r:sysfs_class_backlight:s0
+
+# Block Devices
+/dev/block/platform/(sdhci-tegra|tegra-xhci).[0-9]/by-name/boot             u:object_r:boot_block_device:s0
+/dev/block/platform/(sdhci-tegra|tegra-xhci).[0-9]/by-name/cache            u:object_r:cache_block_device:s0
+/dev/block/platform/(sdhci-tegra|tegra-xhci).[0-9]/by-name/dtb              u:object_r:dtb_block_device:s0
+/dev/block/platform/(sdhci-tegra|tegra-xhci).[0-9]/by-name/hos_data         u:object_r:factory_block_device:s0
+/dev/block/platform/(sdhci-tegra|tegra-xhci).[0-9]/by-name/misc             u:object_r:misc_block_device:s0
+/dev/block/platform/(sdhci-tegra|tegra-xhci).[0-9]/by-name/recovery         u:object_r:recovery_block_device:s0
+/dev/block/platform/(sdhci-tegra|tegra-xhci).[0-9]/by-name/super            u:object_r:super_block_device:s0
+/dev/block/platform/(sdhci-tegra|tegra-xhci).[0-9]/by-name/userdata         u:object_r:userdata_block_device:s0
+
+# Extcon sysfs (USB)
+/sys/devices/usb_cd/extcon/extcon[0-9]+/cable.[0-9]+/name             u:object_r:sysfs_extcon_name:s0
+/sys/devices/7000c000.i2c/i2c-0/0-0018/extcon/extcon[0-1]/name        u:object_r:sysfs_extcon_name:s0
+/sys/devices/7000c000.i2c/i2c-0/0-006b/extcon/extcon[0-1]/name        u:object_r:sysfs_extcon_name:s0
+
+# IIO sysfs (Sensors)
+/sys/devices/7000c400.i2c/i2c-1/1-0029/iio:device[0-9]                          u:object_r:sysfs_iio:s0
+/sys/devices/7000c400.i2c/i2c-1/1-0029/iio:device[0-9](/.*)?                    u:object_r:sysfs_iio:s0
+/sys/devices/7000da00.spi/spi_master/spi3/spi3.0/iio:device0(/.*)?              u:object_r:sysfs_iio:s0
+
+# jc_setup
+/vendor/bin/jc_setup.sh u:object_r:jc_setup_exec:s0
+
+# Serial sysfs (JoyCons)
+/sys/devices/[0-9]+.serial/serial[0-1]/serial[0-1]-[0-1]/power_supply/nintendo_switch_controller_battery_serial[0-1]-[0-1]/scope u:object_r:sysfs_serial:s0
+/sys/devices/[0-9]+.serial/serial[0-1]/serial[0-1]-[0-1]/power_supply/nintendo_switch_controller_battery_serial[0-1]-[0-1]/type  u:object_r:sysfs_serial:s0
+/sys/devices/[0-9]+.serial/serial[0-1]/serial[0-1]-[0-1]/leds/serial[0-1]-[0-1]:player[0-9]+/brightness                          u:object_r:sysfs_serial:s0
+/sys/devices/[0-9]+.serial/serial[0-1]/serial[0-1]-[0-1]/leds/serial[0-1]-[0-1]:player[0-9]+/max_brightness                      u:object_r:sysfs_serial:s0
+/sys/devices/[0-9]+.serial/serial[0-1]/serial[0-1]-[0-1](/.*)? u:object_r:sysfs_serial:s0
+
+# Regulators sysfs
+/sys/devices/7000c000.i2c/i2c-0/[0-9]+-006b/regulator/regulator.[0-9]+/name                     u:object_r:sysfs_regulator_name:s0
+/sys/devices/7000d000.i2c/i2c-4/4-[0-9]+/regulator/regulator.[0-9]+/name                        u:object_r:sysfs_regulator_name:s0
+/sys/devices/regulators/regulators:regulator@0x[a-fA-F]+/regulator/regulator.[0-9]+/name        u:object_r:sysfs_regulator_name:s0
+
+# USB sysfs
+/sys/devices/7000c000.i2c/i2c-0/0-006b/power_supply/usb/online u:object_r:sysfs_usb:s0
+/sys/devices/7000c000.i2c/i2c-0/0-006b/power_supply/usb/type u:object_r:sysfs_usb:s0
@@ -0,0 +1,5 @@
+# Access to JoyCons
+r_dir_file(hal_health_default, sysfs_serial)
+
+# Access to Sensors
+r_dir_file(hal_health_default, sysfs_iio)
@@ -0,0 +1,6 @@
+# Access to IIO sensors
+allow hal_sensors_default iio_device:chr_file r_file_perms;
+
+r_dir_file(hal_sensors_default sysfs_iio)
+
+get_prop(hal_sensors_default, iio_sensors_prop)
@@ -0,0 +1,2 @@
+# Calls out to /dev directly
+allow hal_tv_cec_default device:dir r_dir_perms;
@@ -0,0 +1,8 @@
+# Allow init to mount and label hos_data
+allow init factory_file:filesystem {relabelfrom relabelto associate mount};
+
+# jc_setup
+allow init jc_setup_exec:file {execute};
+
+# HDMI CEC permission symlink
+allow init permission_vendor_data_file:lnk_file relabelto;
@@ -0,0 +1,16 @@
+# Type declarations
+type jc_setup_exec, exec_type, file_type, vendor_file_type;
+type jc_setup, domain;
+
+# Allow jc_setup to be run
+allow jc_setup jc_setup_exec:file { execute_no_trans open };
+
+# Declare jc_setup as an init domain
+init_daemon_domain(jc_setup)
+
+# Allow jc_setup to utilize the tools it needs
+allow jc_setup vendor_shell_exec:file rx_file_perms;
+not_full_treble(`allow jc_setup shell_exec:file rx_file_perms;')
+
+allow jc_setup vendor_toolbox_exec:file rx_file_perms;
+not_full_treble(`allow jc_setup toolbox_exec:file rx_file_perms;')
@@ -0,0 +1,8 @@
+# Access to JoyCons
+r_dir_file(joycond, sysfs_serial)
+allow joycond sysfs_serial:file rw_file_perms;
+
+# TMP - Access to JoyCons - before LMK labels it
+r_dir_file(joycond, sysfs)
+
+set_prop(joycond, vendor_persist_joycond_prop)
@@ -0,0 +1,2 @@
+# neverallow wifi_reset.sh
+#allow platform_app vendor_firmware_gpu_file:file r_file_perms;
@@ -0,0 +1,5 @@
+# IIO Sensors
+vendor_public_prop(iio_sensors_prop);
+
+# JoyCons
+vendor_public_prop(vendor_persist_joycond_prop)
@@ -0,0 +1,5 @@
+# IIO Sensors
+ro.iio. u:object_r:iio_sensors_prop:s0
+
+# JoyCons
+persist.joycond. u:object_r:vendor_persist_joycond_prop:s0
@@ -0,0 +1,5 @@
+# Access to JoyCons
+r_dir_file(system_server, sysfs_serial)
+
+# HDMI CEC permission symlink
+allow system_server permission_vendor_data_file:lnk_file read;
@@ -0,0 +1,4 @@
+# HDMI CEC permission symlink
+allow vendor_init permission_vendor_data_file:lnk_file {rw_file_perms unlink};
+
+set_prop(vendor_init, iio_sensors_prop)