device_phh_treble/sepolicy/vndk_detect.te

type vndk_detect, coredomain, domain;
type vndk_detect_exec, exec_type, file_type;

init_daemon_domain(vndk_detect);
allow vndk_detect sepolicy_file:file r_file_perms;
set_prop(vndk_detect,system_prop);
set_prop(vndk_detect,debug_prop);

allow vndk_detect shell_exec:file rx_file_perms;
allow vndk_detect toolbox_exec:file rx_file_perms;
#/system/bin/grep
allow vndk_detect system_file:file rx_file_perms;

#mount -o bind /system/bin/adbd /sbin/adbd
allow vndk_detect adbd_exec:file { getattr read };
allow vndk_detect rootfs:file { mounton getattr };
allow vndk_detect self:capability { sys_admin };

#mount -o bind /system/etc/usb_audio_policy_configuration.xml /vendor/etc/usb_audio_policy_configuration.xml
allow init vendor_configs_file:file { getattr mounton };

#/sys/module/five
allow vndk_detect sysfs:file r_file_perms;
allow vndk_detect sysfs:dir r_dir_perms;

#/proc/filesystems
allow vndk_detect proc_filesystems:file r_file_perms;
Auto detect vndk based on vendor SELinux policy 2018-02-16 21:41:03 +00:00			`type vndk_detect, coredomain, domain;`
			`type vndk_detect_exec, exec_type, file_type;`

			`init_daemon_domain(vndk_detect);`
			`allow vndk_detect sepolicy_file:file r_file_perms;`
			`set_prop(vndk_detect,system_prop);`
Force GPU profiling on Huawei as a work-around for rendering artifacts 2018-05-27 11:14:50 +00:00			`set_prop(vndk_detect,debug_prop);`
Auto detect vndk based on vendor SELinux policy 2018-02-16 21:41:03 +00:00
			`allow vndk_detect shell_exec:file rx_file_perms;`
			`allow vndk_detect toolbox_exec:file rx_file_perms;`
			`#/system/bin/grep`
			`allow vndk_detect system_file:file rx_file_perms;`
mount bind /system/bin/adbd /sbin/adbd before adbd starts This is needed for master on A-only devices 2018-02-18 23:06:31 +00:00
			`#mount -o bind /system/bin/adbd /sbin/adbd`
Override vendor's usb_audio_policy_configuration Android 8.1 added the support for new type of USB Audio devices (USB_HEADSET, instead of old USB_DEVICE) Some older USB devices got converted to this USB_HEADSET while still using the old protocol. There is no driver change needed, but the audio policy needs to be changed. Since vendors are simply using AOSP usb_audio_policy_configuration Override it by ourself. 2018-03-31 22:21:03 +00:00			`allow vndk_detect adbd_exec:file { getattr read };`
mount bind /system/bin/adbd /sbin/adbd before adbd starts This is needed for master on A-only devices 2018-02-18 23:06:31 +00:00			`allow vndk_detect rootfs:file { mounton getattr };`
			`allow vndk_detect self:capability { sys_admin };`
Override vendor's usb_audio_policy_configuration Android 8.1 added the support for new type of USB Audio devices (USB_HEADSET, instead of old USB_DEVICE) Some older USB devices got converted to this USB_HEADSET while still using the old protocol. There is no driver change needed, but the audio policy needs to be changed. Since vendors are simply using AOSP usb_audio_policy_configuration Override it by ourself. 2018-03-31 22:21:03 +00:00
			`#mount -o bind /system/etc/usb_audio_policy_configuration.xml /vendor/etc/usb_audio_policy_configuration.xml`
			`allow init vendor_configs_file:file { getattr mounton };`

Fix adbd on devices with integrity check Some devices (Like Samsung Galaxy J6) has integrity check. This means that all files outside of /system are signed by the OEM. Since we replaced /sbin/adbd, that's an issue. Workaround this by creating a new service, called adbd_system, which will called instead of /sbin/adbd when needed 2018-12-03 20:16:52 +00:00			`#/sys/module/five`
			`allow vndk_detect sysfs:file r_file_perms;`
			`allow vndk_detect sysfs:dir r_dir_perms;`
Update sepolicy to allow more stuff based on S10e testing 2019-07-17 18:07:57 +00:00
			`#/proc/filesystems`
			`allow vndk_detect proc_filesystems:file r_file_perms;`