ADHOC/replicant-vendor_replicant
3
0
Fork 0
Code Issues 6 Pull Requests Releases Activity
79eda9ebb8
replicant-vendor_replicant/sepolicy/file_contexts

58 lines
2.2 KiB
Plaintext
Raw Normal View History

selinux: Add CM-specific file_contexts Change-Id: Ie70c59acedbb7be2f5b34a83c1d3d011f440ba05
2013-11-06 03:00:16 +00:00
/cache/dalvik-cache(/.*)? u:object_r:dalvikcache_data_file:s0
sepolicy: Split off /cache/recovery's permissions /cache/recovery is used by 2 domains: recovery and updater apps. Separate its perms from the rest of /cache and grant them to those 2 clients Change-Id: Iacde60744c07423f9876c2f8e3da900543e38ddf
2015-02-05 22:33:47 +00:00
/cache/recovery(/.*)? u:object_r:recovery_cache_file:s0
selinux: Add rules for the audit daemon Change-Id: I050a9ef39d58d2592d880d225d45eb64d8a40b7b
2014-11-09 17:20:54 +00:00
# Auditd is a logging daemon. Put it into logd's context
/system/bin/auditd u:object_r:logd_exec:s0
/data/misc/audit(/.*)? u:object_r:auditd_log:s0
selinux: New rw privileges for themes - New theme_data_file context for files under /data/system/theme - Permit systemserver to create files/dirs under /data/resource-cache - Permit systemserver to create files/dirs under /data/system/theme Change-Id: Id597fc20b477ea395a8631623f26a7edde280799
2014-12-16 19:05:54 +00:00
# Themes
sepolicy: Put theme service in its own context Allow the theme manager and its data to be sandboxed in its own context Change-Id: I7898663d1c196bfe04fa4c539d20191a43fde284
2016-07-20 18:02:12 +00:00
/data/system/theme(/.*)? u:object_r:themeservice_app_data_file:s0
selinux: New rw privileges for themes - New theme_data_file context for files under /data/system/theme - Permit systemserver to create files/dirs under /data/resource-cache - Permit systemserver to create files/dirs under /data/system/theme Change-Id: Id597fc20b477ea395a8631623f26a7edde280799
2014-12-16 19:05:54 +00:00
vendor: Update SELinux policy for sysinit Change-Id: I41d4c25d9d6246cd2ca0a8ff3b5a4e114e3bc4d4
2014-11-22 18:33:26 +00:00
/system/bin/sysinit u:object_r:sysinit_exec:s0
sepolicy: allow userinit to set its property Change-Id: I9d8270d889566d169077a1b1fdaee43059d11ee1
2015-02-04 17:17:31 +00:00
/system/etc/init.d/90userinit u:object_r:userinit_exec:s0
sepolicy: Permissions for userinit Change-Id: Icaf9d191841a6214925729e40d84a61a2ebf2296
2015-02-12 21:20:19 +00:00
/data/local/userinit.sh u:object_r:userinit_data_exec:s0
sepolicy: allow userinit to set its property Change-Id: I9d8270d889566d169077a1b1fdaee43059d11ee1
2015-02-04 17:17:31 +00:00
sepolicy: label exfat and ntfs mkfs executables Change-Id: Ic5e32818bc54993f4e8c2377cbec64f9444f6d8a
2015-12-29 20:51:32 +00:00
# For EXFAT/F2FS/NTFS partitions marked "formattable"
/system/bin/mkfs\.exfat u:object_r:mkfs_exec:s0
sepolicy: Add domain for mkfs binaries The init binary must transition to another domain when calling out to executables. Create the mkfs domain for mkfs.f2fs such that init can transition to it when formatting userdata/cache partitions if the "formattable" flag is set. Change-Id: I1046782386d171a59b1a3c5441ed265dc0824977
2015-12-15 21:24:34 +00:00
/system/bin/mkfs\.f2fs u:object_r:mkfs_exec:s0
sepolicy: label exfat and ntfs mkfs executables Change-Id: Ic5e32818bc54993f4e8c2377cbec64f9444f6d8a
2015-12-29 20:51:32 +00:00
/system/bin/mkfs\.ntfs u:object_r:mkfs_exec:s0
sepolicy: Add domain for mkfs binaries The init binary must transition to another domain when calling out to executables. Create the mkfs domain for mkfs.f2fs such that init can transition to it when formatting userdata/cache partitions if the "formattable" flag is set. Change-Id: I1046782386d171a59b1a3c5441ed265dc0824977
2015-12-15 21:24:34 +00:00
cm: sepolicy: Add contexts for cm recovery * Allow setup of secure adb (setup_adbd) * minivold in recovery Change-Id: Id1243154f4016b59e54890404cadea46a2aad212
2014-11-26 21:26:14 +00:00
# For minivold in recovery
/sbin/minivold u:object_r:vold_exec:s0
selinux: Add CM-specific file_contexts Change-Id: Ie70c59acedbb7be2f5b34a83c1d3d011f440ba05
2013-11-06 03:00:16 +00:00
#############################
# performance-related sysfs files (CM)
cm: Remove garbage from sepolicy * Not sure how the -- got here but it causes the rules to be invalid. Change-Id: Ib17217d14f844d7aa27bb554346183e32ff5ae13
2016-04-30 09:30:54 +00:00
/sys/devices/system/cpu.*/cpufreq(/.*)? u:object_r:sysfs_devices_system_cpu:s0
/sys/block/mmcblk.*/queue/scheduler u:object_r:sysfs_devices_system_iosched:s0
selinux: Add CM-specific file_contexts Change-Id: Ie70c59acedbb7be2f5b34a83c1d3d011f440ba05
2013-11-06 03:00:16 +00:00
cm: policy for ipv6 tethering * Enable use of radish via netd for ipv6 tethering Change-Id: Ifa0e85686fc70f59c089ca40a78cea9935820185
2014-05-11 09:57:57 +00:00
/data/hostapd(/.*)? u:object_r:wifi_data_file:s0
Add selinux policies for superuser Change-Id: I878eaa9d25feaedf46e89083f91d6a21f4aff37a
2014-11-26 21:34:15 +00:00
#############
# Superuser's control sockets
sepolicy: Add policies for the new superuser sockets. Change-Id: Ia3e1044616bee95eb4774254fb098487d983b5db
2014-12-16 19:27:32 +00:00
/dev/socket/su-daemon(/.*)? u:object_r:superuser_device:s0
selinux: Add a rule to label the extended keyhandler dex files These should be treated as regular dex cache files, but they're expanded outside of the normal cache dir Change-Id: Id046e1b90116b35d2e7817ed4717fcef78135f08
2014-11-27 18:17:06 +00:00
# Expansion of these hooks is a bit unconventional
/cache/com.cyanogenmod.keyhandler.dex u:object_r:dalvikcache_data_file:s0
cm: add sepolicy entry for lockscreen wallpaper Change-Id: Ie779392ab8118d192873a01ec5c7de3e5938ed17 Signed-off-by: Roman Birg <roman@cyngn.com>
2014-12-08 23:02:48 +00:00
# Lockscreen wallpaper
/data/system/users/[0-9]+/keyguard_wallpaper u:object_r:wallpaper_file:s0
cm: SELinux policy for persistent properties API * Set up persistent properties for devices with a /persist partition. Change-Id: I78974dd4e25831338462c91fc25e36e343795510
2015-09-06 20:53:29 +00:00
# Persistent properties
sepolicy: Underp the context for persistent storage The dir's context need love, too TICKET: CYNGNOS-1185 Change-Id: I659b3ba06079825fe850cf66858a9d98b5f61c46
2015-10-05 18:51:45 +00:00
/persist/properties(/.*)? u:object_r:persist_property_file:s0
cm: sepolicy: Create standard policy for LiveDisplay Change-Id: Icb0047f261861c8fae99ffa4e9053de8d3aa8c73
2015-09-15 11:09:03 +00:00
# LiveDisplay
/sys/devices/virtual/graphics/fb0/aco u:object_r:livedisplay_sysfs:s0
/sys/devices/virtual/graphics/fb0/cabc u:object_r:livedisplay_sysfs:s0
/sys/devices/virtual/graphics/fb0/rgb u:object_r:livedisplay_sysfs:s0
/sys/devices/virtual/graphics/fb0/sre u:object_r:livedisplay_sysfs:s0
cm: Allow LiveDisplay to write to color_enhance The proper permissions for the color_enhance sysfs node weren't being set, rendering the color enhancement switch useless. Set the proper permissions for LiveDisplay to toggle color enhancement. Change-Id: Ic8dba8953b73a497cb01a645834c0e7934092b38
2016-04-30 06:57:22 +00:00
/sys/devices/virtual/graphics/fb0/color_enhance u:object_r:livedisplay_sysfs:s0
sepolicy: Set the context for fsck.exfat/ntfs to fsck_exec This matches the policy for fsck.f2fs, although it still needs to run as fsck_untrusted for public volumes Change-Id: Ia04e7f8902e53a9926a87f0c99e603611cc39c5d
2015-12-07 03:53:52 +00:00
# fsck
/system/bin/fsck\.ntfs u:object_r:fsck_exec:s0
/system/bin/fsck\.exfat u:object_r:fsck_exec:s0
sepolicy: put bash in shell context * Necessary for being able to execute commands such as 'su' from a non-root shell Change-Id: Icbaaa6ff7447add65441011944bdc5d13b788c86
2016-06-06 13:21:44 +00:00
# bash
/system/xbin/bash u:object_r:shell_exec:s0
Reference in New Issue Copy Permalink