| # ============================================== |
| # Common SEPolicy Rule |
| # ============================================== |
| |
| # Date: WK14.43 |
| # Operation : Migration |
| # Purpose : for bring up |
| allow system_server sf_rtt_file:dir { relabelto r_dir_perms }; |
| |
| # Date: WK14.47 |
| # Operation : MTBF |
| # Purpose : for debug |
| allow system_server sf_rtt_file:file r_file_perms; |
| |
| # Date: WK14.47 |
| # Operation : Sanity |
| # Purpose : for /proc/secmem (TEE enable) |
| allow system_server proc_secmem:file rw_file_perms; |
| |
| # Date: WK16.30 |
| # Operation : Migration |
| # Purpose : for system_server operate /dev/RT_Monitor when enable hang detect |
| allow system_server RT_Monitor_device:chr_file r_file_perms; |
| |
| # Date : WK15.24 |
| # Operation: TEEI integration |
| # Purpose: access for fp device |
| allow system_server teei_fp_device:chr_file rw_file_perms; |
| allow system_server teei_client_device:chr_file r_file_perms; |
| |
| # Date : 2016/07/11 |
| # Operation : Migration |
| # Purpose : Add permission for gpu access |
| allow system_server dri_device:chr_file rw_file_perms; |
| |
| # Date : W17.24 |
| # Purpose: Allow to use HAL PQ |
| hal_client_domain(system_server, hal_mtk_pq) |
| |
| # Date : W17.31 |
| # Purpose: Allow to use Ape swip decoder |
| hal_client_domain(system_server, hal_mtk_codecservice) |
| |
| # Date:W17.33 |
| # Operation : camera hal developing |
| # Purpose : camera hal binder_call permission |
| binder_call(system_server, mtk_hal_camera) |
| |
| # Date:W17.36 |
| # Operation : Migration |
| # Purpose : Allow to send signal |
| allow system_server netd:process signal; |
| |
| # Date:W17.07 |
| # Operation : dfps hal |
| # Purpose : dfps hal interface permission |
| hal_client_domain(system_server, hal_dfps) |
| |
| allow system_server audioserver:file w_file_perms; |
| |
| # Date : 2018/03/06 |
| # Purpose : Add mtk_hal_netdagent_hwservice for EM firewall usage |
| allow system_server mtk_hal_netdagent_hwservice:hwservice_manager find; |
| allow system_server netdagent:binder call; |
| |
| # Date : W18.20 |
| # Operation : Migration |
| # Purpose : for mobicore (Trustonic TEE) |
| allow system_server mobicore_vendor_file:dir r_file_perms; |
| |
| # Date : 6/20/2018 |
| # Operation : MTK fm hal migration |
| # Purpose : MTK fm hal interface permission |
| hal_client_domain(system_server, hal_mtk_fm) |
| |
| # Date : W19.12 |
| # Operation : For DuraSpeed Migration |
| allow system_server proc_cpu_loading:file rw_file_perms; |
| userdebug_or_eng(` |
| allow system_server debugfs_tracing_debug:file r_file_perms; |
| ') |
| allow system_server proc_low_memory_hit:file rw_file_perms; |
| allow system_server duraspeed_data_file:dir create_dir_perms; |
| allow system_server duraspeed_data_file:file create_file_perms; |
| |
| # Date : WK18.36 |
| # Operation : omadm hidl |
| # Purpose : hidl interface permission |
| hal_client_domain(system_server, hal_mtk_omadm) |
| |
| # Date : WK19.29 |
| # Operation : nwk_opt hal |
| # Purpose : nwk_opt hal permission |
| hal_client_domain(system_server, hal_nwk_opt) |
| |
| # Date:2020/08/07 |
| # Operation:R Migration |
| userdebug_or_eng(` allow system_server md_monitor:process signal; ') |
| |
| # Date:2020/08/26 |
| # Operation:kill hal_drm_widevine permission when ANR happened |
| allow system_server hal_drm_widevine:process signal; |
| |
| # Date:2020/09/03 |
| # Operation:R Migration |
| allow system_server proc_ion:dir search; |
| |
| # Date:2020/09/07 |
| # Operation:R Migration |
| allow system_server proc_m4u_dbg:dir search; |
| |
| # Date:2020/09/08 |
| # Operation:R Migration |
| allow system_server proc_displowpower:dir search; |
| allow system_server proc_freqhopping:file getattr; |
| |
| # Date:2020/09/11 |
| # Operation:R Migration |
| allow system_server proc_freqhopping:dir search; |
| |
| # Date:2020/09/18 |
| # Operation:R Migration |
| allow system_server procfs_gpu_img:dir { search getattr }; |
| |
| # Date:2020/09/30 |
| # Operation:R Migration |
| allow system_server procfs_gpu_img:file getattr; |
| |
| # Read/Write /proc/pressure/cpu |
| allow system_server proc_pressure_cpu:file rw_file_perms; |
| |
| # Search /proc/usb/plat |
| allow system_server proc_usb_plat:dir search; |
| |
| # Search /proc/gpufreqv2 |
| allow system_server proc_gpufreqv2:dir search; |
| |
| # Search /proc/mtkfb |
| allow system_server proc_mtkfb:dir search; |
| |
| # Search /proc/stat |
| allow system_server proc_stat:dir search; |
| |
| # Date: 2021/08/10 |
| # Operation: S Migration |
| # Purpose: InputReader read files under power_supply to detect battery device |
| allow system_server sysfs_power_supply:dir {r_dir_perms}; |
| allow system_server sysfs_power_supply:file r_file_perms; |