replicant-vendor_replicant/sepolicy/sepolicy.mk

#
# This policy configuration will be used by all products that
# inherit from CM
#

BOARD_SEPOLICY_DIRS += \
    vendor/cm/sepolicy

BOARD_SEPOLICY_UNION += \
    file.te \
    file_contexts \
    genfs_contexts \
    property_contexts \
    seapp_contexts \
    service_contexts \
    adbd.te \
    app.te \
    auditd.te \
    bootanim.te \
    drmserver.te \
    healthd.te \
    hostapd.te \
    installd.te \
    mediaserver.te \
    netd.te \
    property.te \
    recovery.te \
    shell.te \
    su.te \
    sysinit.te \
    system.te \
    system_app.te \
    system_server.te \
    ueventd.te \
    uncrypt.te \
    userinit.te \
    vold.te \
    zygote.te \
    mac_permissions.xml
sepolicy: Start CM Common sepolicy Rather than having to maintain out of tree changes, it is often easier to maintain a hiearchy of changes, starting with the vendors common config file. From there, inheriting products can pick up a base and start to add or remove certain bits from it, making use of the BOARD_SEPOLICY_* functions documented in external/sepolicy/README. Change-Id: I28a4aaf6c126535f0a88001582641b234a750015 2013-08-15 20:08:41 +00:00			`#`
			`# This policy configuration will be used by all products that`
			`# inherit from CM`
			`#`

selinux: CM policies are now inserted last Inclusion of the makefile is done by the build system to enforce the wanted order Change-Id: I86d7c6fb08b6bb1f6e0385e951a54827345aaf84 2013-11-05 22:19:33 +00:00			`BOARD_SEPOLICY_DIRS += \`
sepolicy: Start CM Common sepolicy Rather than having to maintain out of tree changes, it is often easier to maintain a hiearchy of changes, starting with the vendors common config file. From there, inheriting products can pick up a base and start to add or remove certain bits from it, making use of the BOARD_SEPOLICY_* functions documented in external/sepolicy/README. Change-Id: I28a4aaf6c126535f0a88001582641b234a750015 2013-08-15 20:08:41 +00:00			`vendor/cm/sepolicy`

selinux: CM policies are now inserted last Inclusion of the makefile is done by the build system to enforce the wanted order Change-Id: I86d7c6fb08b6bb1f6e0385e951a54827345aaf84 2013-11-05 22:19:33 +00:00			`BOARD_SEPOLICY_UNION += \`
selinux: Fix asec mounting Change-Id: I92392f3d810dfaf8dfc35f5c9170178a651d28dc 2013-11-12 21:05:31 +00:00			`file.te \`
selinux: Add CM-specific file_contexts Change-Id: Ie70c59acedbb7be2f5b34a83c1d3d011f440ba05 2013-11-06 03:00:16 +00:00			`file_contexts \`
sepolicy: treat fuseblk as sdcard_external Allow fuse-mounted NTFS/exFAT file systems to be written to Change-Id: I1492914dd269a305e27aba58e61064d853adf2bc 2013-11-11 03:47:51 +00:00			`genfs_contexts \`
Allow SystemServer to set service.adb.tcp.* properties Required for network adb enable/disable to function Change-Id: I3e2aacb6b8e9b107dcd229187a5dd76128e20001 2014-11-26 18:33:02 +00:00			`property_contexts \`
selinux: CM policies are now inserted last Inclusion of the makefile is done by the build system to enforce the wanted order Change-Id: I86d7c6fb08b6bb1f6e0385e951a54827345aaf84 2013-11-05 22:19:33 +00:00			`seapp_contexts \`
[1/2] SEPolicy: Add Edgegesture service. Change-Id: Id9fc2d68b954e1cd6792739309a0df40e2dc998c 2014-11-19 08:03:56 +00:00			`service_contexts \`
sepolicy: Fix permissions for service.adb.tcp.port This makes the rule more specific by overriding the upstream sepolicy. Also adds the adbd context which is necessary for "adb tcpip". Change-Id: Ia17eb56fc1682ab248764329e88eebd2a4075c97 2014-12-01 14:33:51 +00:00			`adbd.te \`
sepolicy: Apps need to read themed resources Assets such as composed icons and ringtones need to be accessed by apps. This patch adds the policy needed to facilitate this. Change-Id: If47920b2cc5dbafe8d71a621782bb4a3351bd68c 2015-01-05 23:30:16 +00:00			`app.te \`
			`auditd.te \`
			`bootanim.te \`
sepolicy: Let drmserver scan themes Change-Id: I7675b302723ef8700067ae9ef237daf6346a6627 2015-01-25 19:02:24 +00:00			`drmserver.te \`
selinux: Fix healthd's access to /dev nodes Our healthd's support for power-on alarms adds some steps that imply reading files its user doesn't own. Let it. Change-Id: I3d4735aaab8fbec7acc460f812bc21f1dfa516ab 2014-11-27 22:54:43 +00:00			`healthd.te \`
vendor: add policies for netd Required due to CAF's abc9c0f4fe574ee9847f118e5d2ae8c530bac650 in system/netd Fixes showing how many devices are connected to the tethered hotspot Change-Id: I1d83f7ac0b28efa6973e0baf429de2a398c471e3 2014-11-27 13:18:18 +00:00			`hostapd.te \`
cm: sepolicy: Allow ueventd to properly handle cpufreq changes * We need to allow relabeling since these files can pop in and out if the governor is changed. Change-Id: Id75099290e24dac9962d4fed8148ec2df9e256b2 2014-04-05 21:05:13 +00:00			`installd.te \`
sepolicy: actually include mediaserver.te Added in patch e9c2de0679f16a8ba7291aaf2cd4286bef8b2886 but not included Change-Id: I2ae901a7c80fceb33dba2ed4122d2aa47bff5a51 2015-02-02 19:29:48 +00:00			`mediaserver.te \`
cm: policy for ipv6 tethering * Enable use of radish via netd for ipv6 tethering Change-Id: Ifa0e85686fc70f59c089ca40a78cea9935820185 2014-05-11 09:57:57 +00:00			`netd.te \`
Allow SystemServer to set service.adb.tcp.* properties Required for network adb enable/disable to function Change-Id: I3e2aacb6b8e9b107dcd229187a5dd76128e20001 2014-11-26 18:33:02 +00:00			`property.te \`
cm: sepolicy: Add contexts for cm recovery * Allow setup of secure adb (setup_adbd) * minivold in recovery Change-Id: Id1243154f4016b59e54890404cadea46a2aad212 2014-11-26 21:26:14 +00:00			`recovery.te \`
Allow SystemServer to set service.adb.tcp.* properties Required for network adb enable/disable to function Change-Id: I3e2aacb6b8e9b107dcd229187a5dd76128e20001 2014-11-26 18:33:02 +00:00			`shell.te \`
Add selinux policies for superuser Change-Id: I878eaa9d25feaedf46e89083f91d6a21f4aff37a 2014-11-26 21:34:15 +00:00			`su.te \`
vendor: Update SELinux policy for sysinit Change-Id: I41d4c25d9d6246cd2ca0a8ff3b5a4e114e3bc4d4 2014-11-22 18:33:26 +00:00			`sysinit.te \`
sepolicy: Allow relabeling after wallpaper change Change-Id: I89220fae961f483dad8b92faaee9ed8fe6c8a7cf 2014-05-19 01:16:12 +00:00			`system.te \`
cm: sepolicy: fix performance settings Change-Id: Idea17856b4aef9258688a3ad58d0e5cac6d805a6 2015-01-03 05:44:43 +00:00			`system_app.te \`
sepolicy: Fix denails for flash_recovery service Needed when option is checked to update cm recovery Change-Id: I0b2fbfd7c141ae03ce14b9afeffd3a027d791c80 2015-02-15 16:47:23 +00:00			`system_server.te \`
cm: sepolicy: Allow ueventd to properly handle cpufreq changes * We need to allow relabeling since these files can pop in and out if the governor is changed. Change-Id: Id75099290e24dac9962d4fed8148ec2df9e256b2 2014-04-05 21:05:13 +00:00			`ueventd.te \`
sepolicy: Allow cmupdater/uncrypt access to media_rw_data_file Change-Id: I800584af2919e3397b19d229fc28ad50cc4b2730 2015-01-23 07:44:20 +00:00			`uncrypt.te \`
sepolicy: allow userinit to set its property Change-Id: I9d8270d889566d169077a1b1fdaee43059d11ee1 2015-02-04 17:17:31 +00:00			`userinit.te \`
sepolicy: allow vold to create files on external sdcard This is required for ASEC support. Vold can already create and access directories, but do not yet have the permission for files. Change-Id: I5082bbff692e5dc53c7000e4b3a293e42d33f901 2013-11-14 03:46:26 +00:00			`vold.te \`
sepolicy: Apps need to read themed resources Assets such as composed icons and ringtones need to be accessed by apps. This patch adds the policy needed to facilitate this. Change-Id: If47920b2cc5dbafe8d71a621782bb4a3351bd68c 2015-01-05 23:30:16 +00:00			`zygote.te \`
sepolicy: Start CM Common sepolicy Rather than having to maintain out of tree changes, it is often easier to maintain a hiearchy of changes, starting with the vendors common config file. From there, inheriting products can pick up a base and start to add or remove certain bits from it, making use of the BOARD_SEPOLICY_* functions documented in external/sepolicy/README. Change-Id: I28a4aaf6c126535f0a88001582641b234a750015 2013-08-15 20:08:41 +00:00			`mac_permissions.xml`