From 96ad89b7d673a8a2de9d82236bb3628d635b6345 Mon Sep 17 00:00:00 2001 From: Nolen Johnson Date: Tue, 27 Feb 2024 18:03:09 -0500 Subject: [PATCH] nx: sepolicy: Initial support * Was tested on odin, modin, frig, and vali. * Note: Due to the various sensors configurations across SKUs, sensors will likely need additional labeling after test release. Change-Id: I0f8b159acc0ae14e8e4c7d8ec29a0cb406d3bff8 --- BoardConfig.mk | 4 +++ sepolicy/private/file.te | 2 ++ sepolicy/private/file_contexts | 2 ++ sepolicy/private/init.te | 8 +++++ sepolicy/private/system_server.te | 4 +++ sepolicy/vendor/device.te | 2 ++ sepolicy/vendor/factory_file.te | 2 ++ sepolicy/vendor/file.te | 5 +++ sepolicy/vendor/file_contexts | 44 ++++++++++++++++++++++++++ sepolicy/vendor/hal_health_default.te | 5 +++ sepolicy/vendor/hal_sensors_default.te | 6 ++++ sepolicy/vendor/hal_tv_cec_default.te | 2 ++ sepolicy/vendor/init.te | 8 +++++ sepolicy/vendor/jc_setup_exec.te | 16 ++++++++++ sepolicy/vendor/joycond.te | 8 +++++ sepolicy/vendor/platform_app.te | 2 ++ sepolicy/vendor/property.te | 5 +++ sepolicy/vendor/property_contexts | 5 +++ sepolicy/vendor/system_server.te | 5 +++ sepolicy/vendor/vendor_init.te | 4 +++ 20 files changed, 139 insertions(+) create mode 100644 sepolicy/private/file.te create mode 100644 sepolicy/private/file_contexts create mode 100644 sepolicy/private/init.te create mode 100644 sepolicy/private/system_server.te create mode 100644 sepolicy/vendor/device.te create mode 100644 sepolicy/vendor/factory_file.te create mode 100644 sepolicy/vendor/file.te create mode 100644 sepolicy/vendor/file_contexts create mode 100644 sepolicy/vendor/hal_health_default.te create mode 100644 sepolicy/vendor/hal_sensors_default.te create mode 100644 sepolicy/vendor/hal_tv_cec_default.te create mode 100644 sepolicy/vendor/init.te create mode 100644 sepolicy/vendor/jc_setup_exec.te create mode 100644 sepolicy/vendor/joycond.te create mode 100644 sepolicy/vendor/platform_app.te create mode 100644 sepolicy/vendor/property.te create mode 100644 sepolicy/vendor/property_contexts create mode 100644 sepolicy/vendor/system_server.te create mode 100644 sepolicy/vendor/vendor_init.te diff --git a/BoardConfig.mk b/BoardConfig.mk index ddd5cac..e991fa9 100644 --- a/BoardConfig.mk +++ b/BoardConfig.mk @@ -83,6 +83,10 @@ TARGET_RECOVERY_UPDATER_LIBS += librecovery_updater_nx # Security Patch Level VENDOR_SECURITY_PATCH := 2022-04-05 +# SELinux +BOARD_VENDOR_SEPOLICY_DIRS += device/nintendo/nx/sepolicy/vendor +SYSTEM_EXT_PRIVATE_SEPOLICY_DIRS += device/nintendo/nx/sepolicy/private + # Treble BOARD_PROPERTY_OVERRIDES_SPLIT_ENABLED := true BOARD_VNDK_VERSION := current diff --git a/sepolicy/private/file.te b/sepolicy/private/file.te new file mode 100644 index 0000000..9d2d169 --- /dev/null +++ b/sepolicy/private/file.te @@ -0,0 +1,2 @@ +# wifi_reset.sh +type wifi_reset_exec, exec_type, file_type, system_file_type; diff --git a/sepolicy/private/file_contexts b/sepolicy/private/file_contexts new file mode 100644 index 0000000..0b24844 --- /dev/null +++ b/sepolicy/private/file_contexts @@ -0,0 +1,2 @@ +# wifi_reset.sh +/system/bin/wifi_reset.sh u:object_r:wifi_reset_exec:s0 diff --git a/sepolicy/private/init.te b/sepolicy/private/init.te new file mode 100644 index 0000000..45dae34 --- /dev/null +++ b/sepolicy/private/init.te @@ -0,0 +1,8 @@ +allow init servicemanager:binder { call transfer }; +allow init system_server:binder { call transfer }; + +# neverallow wifi_reset.sh +#allow init settings_service:service_manager find; + +# wifi_reset.sh +allow init wifi_reset_exec:file execute; diff --git a/sepolicy/private/system_server.te b/sepolicy/private/system_server.te new file mode 100644 index 0000000..780fc91 --- /dev/null +++ b/sepolicy/private/system_server.te @@ -0,0 +1,4 @@ +# neverallow wifi_reset.sh +#allow system_server init:binder { call transfer }; + +allow system_server init:fifo_file rw_file_perms; diff --git a/sepolicy/vendor/device.te b/sepolicy/vendor/device.te new file mode 100644 index 0000000..a7b14fe --- /dev/null +++ b/sepolicy/vendor/device.te @@ -0,0 +1,2 @@ +# Block Device Types +type factory_block_device, dev_type; diff --git a/sepolicy/vendor/factory_file.te b/sepolicy/vendor/factory_file.te new file mode 100644 index 0000000..af86408 --- /dev/null +++ b/sepolicy/vendor/factory_file.te @@ -0,0 +1,2 @@ +# Allow jc_setup init scripts to mount hos_data and relabel +allow factory_file self:filesystem associate; diff --git a/sepolicy/vendor/file.te b/sepolicy/vendor/file.te new file mode 100644 index 0000000..9e8b364 --- /dev/null +++ b/sepolicy/vendor/file.te @@ -0,0 +1,5 @@ +# HDMI CEC permission symlink +type permission_vendor_data_file, file_type, data_file_type; + +# Serial sysfs (JoyCons) +type sysfs_serial, fs_type, sysfs_type; diff --git a/sepolicy/vendor/file_contexts b/sepolicy/vendor/file_contexts new file mode 100644 index 0000000..7b2ce59 --- /dev/null +++ b/sepolicy/vendor/file_contexts @@ -0,0 +1,44 @@ +# HDMI CEC permissions symlink +/data/vendor/permissions/android.hardware.hdmi.cec.xml u:object_r:permission_vendor_data_file:s0 + +# Backlight sysfs (Panel) +/sys/devices/backlight/backlight/pwm-backlight/brightness u:object_r:sysfs_class_backlight:s0 + +# Block Devices +/dev/block/platform/(sdhci-tegra|tegra-xhci).[0-9]/by-name/boot u:object_r:boot_block_device:s0 +/dev/block/platform/(sdhci-tegra|tegra-xhci).[0-9]/by-name/cache u:object_r:cache_block_device:s0 +/dev/block/platform/(sdhci-tegra|tegra-xhci).[0-9]/by-name/dtb u:object_r:dtb_block_device:s0 +/dev/block/platform/(sdhci-tegra|tegra-xhci).[0-9]/by-name/hos_data u:object_r:factory_block_device:s0 +/dev/block/platform/(sdhci-tegra|tegra-xhci).[0-9]/by-name/misc u:object_r:misc_block_device:s0 +/dev/block/platform/(sdhci-tegra|tegra-xhci).[0-9]/by-name/recovery u:object_r:recovery_block_device:s0 +/dev/block/platform/(sdhci-tegra|tegra-xhci).[0-9]/by-name/super u:object_r:super_block_device:s0 +/dev/block/platform/(sdhci-tegra|tegra-xhci).[0-9]/by-name/userdata u:object_r:userdata_block_device:s0 + +# Extcon sysfs (USB) +/sys/devices/usb_cd/extcon/extcon[0-9]+/cable.[0-9]+/name u:object_r:sysfs_extcon_name:s0 +/sys/devices/7000c000.i2c/i2c-0/0-0018/extcon/extcon[0-1]/name u:object_r:sysfs_extcon_name:s0 +/sys/devices/7000c000.i2c/i2c-0/0-006b/extcon/extcon[0-1]/name u:object_r:sysfs_extcon_name:s0 + +# IIO sysfs (Sensors) +/sys/devices/7000c400.i2c/i2c-1/1-0029/iio:device[0-9] u:object_r:sysfs_iio:s0 +/sys/devices/7000c400.i2c/i2c-1/1-0029/iio:device[0-9](/.*)? u:object_r:sysfs_iio:s0 +/sys/devices/7000da00.spi/spi_master/spi3/spi3.0/iio:device0(/.*)? u:object_r:sysfs_iio:s0 + +# jc_setup +/vendor/bin/jc_setup.sh u:object_r:jc_setup_exec:s0 + +# Serial sysfs (JoyCons) +/sys/devices/[0-9]+.serial/serial[0-1]/serial[0-1]-[0-1]/power_supply/nintendo_switch_controller_battery_serial[0-1]-[0-1]/scope u:object_r:sysfs_serial:s0 +/sys/devices/[0-9]+.serial/serial[0-1]/serial[0-1]-[0-1]/power_supply/nintendo_switch_controller_battery_serial[0-1]-[0-1]/type u:object_r:sysfs_serial:s0 +/sys/devices/[0-9]+.serial/serial[0-1]/serial[0-1]-[0-1]/leds/serial[0-1]-[0-1]:player[0-9]+/brightness u:object_r:sysfs_serial:s0 +/sys/devices/[0-9]+.serial/serial[0-1]/serial[0-1]-[0-1]/leds/serial[0-1]-[0-1]:player[0-9]+/max_brightness u:object_r:sysfs_serial:s0 +/sys/devices/[0-9]+.serial/serial[0-1]/serial[0-1]-[0-1](/.*)? u:object_r:sysfs_serial:s0 + +# Regulators sysfs +/sys/devices/7000c000.i2c/i2c-0/[0-9]+-006b/regulator/regulator.[0-9]+/name u:object_r:sysfs_regulator_name:s0 +/sys/devices/7000d000.i2c/i2c-4/4-[0-9]+/regulator/regulator.[0-9]+/name u:object_r:sysfs_regulator_name:s0 +/sys/devices/regulators/regulators:regulator@0x[a-fA-F]+/regulator/regulator.[0-9]+/name u:object_r:sysfs_regulator_name:s0 + +# USB sysfs +/sys/devices/7000c000.i2c/i2c-0/0-006b/power_supply/usb/online u:object_r:sysfs_usb:s0 +/sys/devices/7000c000.i2c/i2c-0/0-006b/power_supply/usb/type u:object_r:sysfs_usb:s0 diff --git a/sepolicy/vendor/hal_health_default.te b/sepolicy/vendor/hal_health_default.te new file mode 100644 index 0000000..2e354fb --- /dev/null +++ b/sepolicy/vendor/hal_health_default.te @@ -0,0 +1,5 @@ +# Access to JoyCons +r_dir_file(hal_health_default, sysfs_serial) + +# Access to Sensors +r_dir_file(hal_health_default, sysfs_iio) diff --git a/sepolicy/vendor/hal_sensors_default.te b/sepolicy/vendor/hal_sensors_default.te new file mode 100644 index 0000000..2b674b4 --- /dev/null +++ b/sepolicy/vendor/hal_sensors_default.te @@ -0,0 +1,6 @@ +# Access to IIO sensors +allow hal_sensors_default iio_device:chr_file r_file_perms; + +r_dir_file(hal_sensors_default sysfs_iio) + +get_prop(hal_sensors_default, iio_sensors_prop) diff --git a/sepolicy/vendor/hal_tv_cec_default.te b/sepolicy/vendor/hal_tv_cec_default.te new file mode 100644 index 0000000..231551c --- /dev/null +++ b/sepolicy/vendor/hal_tv_cec_default.te @@ -0,0 +1,2 @@ +# Calls out to /dev directly +allow hal_tv_cec_default device:dir r_dir_perms; diff --git a/sepolicy/vendor/init.te b/sepolicy/vendor/init.te new file mode 100644 index 0000000..19bb722 --- /dev/null +++ b/sepolicy/vendor/init.te @@ -0,0 +1,8 @@ +# Allow init to mount and label hos_data +allow init factory_file:filesystem {relabelfrom relabelto associate mount}; + +# jc_setup +allow init jc_setup_exec:file {execute}; + +# HDMI CEC permission symlink +allow init permission_vendor_data_file:lnk_file relabelto; diff --git a/sepolicy/vendor/jc_setup_exec.te b/sepolicy/vendor/jc_setup_exec.te new file mode 100644 index 0000000..a5af4bc --- /dev/null +++ b/sepolicy/vendor/jc_setup_exec.te @@ -0,0 +1,16 @@ +# Type declarations +type jc_setup_exec, exec_type, file_type, vendor_file_type; +type jc_setup, domain; + +# Allow jc_setup to be run +allow jc_setup jc_setup_exec:file { execute_no_trans open }; + +# Declare jc_setup as an init domain +init_daemon_domain(jc_setup) + +# Allow jc_setup to utilize the tools it needs +allow jc_setup vendor_shell_exec:file rx_file_perms; +not_full_treble(`allow jc_setup shell_exec:file rx_file_perms;') + +allow jc_setup vendor_toolbox_exec:file rx_file_perms; +not_full_treble(`allow jc_setup toolbox_exec:file rx_file_perms;') diff --git a/sepolicy/vendor/joycond.te b/sepolicy/vendor/joycond.te new file mode 100644 index 0000000..4861c80 --- /dev/null +++ b/sepolicy/vendor/joycond.te @@ -0,0 +1,8 @@ +# Access to JoyCons +r_dir_file(joycond, sysfs_serial) +allow joycond sysfs_serial:file rw_file_perms; + +# TMP - Access to JoyCons - before LMK labels it +r_dir_file(joycond, sysfs) + +set_prop(joycond, vendor_persist_joycond_prop) diff --git a/sepolicy/vendor/platform_app.te b/sepolicy/vendor/platform_app.te new file mode 100644 index 0000000..7f75956 --- /dev/null +++ b/sepolicy/vendor/platform_app.te @@ -0,0 +1,2 @@ +# neverallow wifi_reset.sh +#allow platform_app vendor_firmware_gpu_file:file r_file_perms; diff --git a/sepolicy/vendor/property.te b/sepolicy/vendor/property.te new file mode 100644 index 0000000..90279ab --- /dev/null +++ b/sepolicy/vendor/property.te @@ -0,0 +1,5 @@ +# IIO Sensors +vendor_public_prop(iio_sensors_prop); + +# JoyCons +vendor_public_prop(vendor_persist_joycond_prop) diff --git a/sepolicy/vendor/property_contexts b/sepolicy/vendor/property_contexts new file mode 100644 index 0000000..03f66b5 --- /dev/null +++ b/sepolicy/vendor/property_contexts @@ -0,0 +1,5 @@ +# IIO Sensors +ro.iio. u:object_r:iio_sensors_prop:s0 + +# JoyCons +persist.joycond. u:object_r:vendor_persist_joycond_prop:s0 diff --git a/sepolicy/vendor/system_server.te b/sepolicy/vendor/system_server.te new file mode 100644 index 0000000..bcc6745 --- /dev/null +++ b/sepolicy/vendor/system_server.te @@ -0,0 +1,5 @@ +# Access to JoyCons +r_dir_file(system_server, sysfs_serial) + +# HDMI CEC permission symlink +allow system_server permission_vendor_data_file:lnk_file read; diff --git a/sepolicy/vendor/vendor_init.te b/sepolicy/vendor/vendor_init.te new file mode 100644 index 0000000..fc3d393 --- /dev/null +++ b/sepolicy/vendor/vendor_init.te @@ -0,0 +1,4 @@ +# HDMI CEC permission symlink +allow vendor_init permission_vendor_data_file:lnk_file {rw_file_perms unlink}; + +set_prop(vendor_init, iio_sensors_prop)