Merge "sensors: Move USF related sepolicy to gs-common." into main

sensors/sepolicy/file.te

@@ -1,2 +1,18 @@
+#
+# USF file SELinux type enforcements.
+#
+
 type vendor_usf_stats, vendor_file_type, file_type;
 type vendor_usf_reg_edit, vendor_file_type, file_type;
+
+# Declare the sensor registry persist file type. By convention, persist file
+# types begin with "persist_".
+type persist_sensor_reg_file, file_type, vendor_persist_type;
+
+# Declare the sensor registry data file type. By convention, data file types
+# end with "data_file".
+type sensor_reg_data_file, file_type, data_file_type;
+
+# Declare the sensor debug data file type. By convention, data file types
+# end with "data_file".
+type sensor_debug_data_file, file_type, data_file_type;

sensors/sepolicy/file_contexts

@@ -1,3 +1,16 @@
+#
+# USF SELinux file security contexts.
+#
+
 /vendor/bin/dump/dump_sensors      u:object_r:dump_sensors_exec:s0
 /vendor/bin/usf_stats              u:object_r:vendor_usf_stats:s0
 /vendor/bin/usf_reg_edit           u:object_r:vendor_usf_reg_edit:s0
+
+# Sensor registry persist files.
+/mnt/vendor/persist/sensors/registry(/.*)? u:object_r:persist_sensor_reg_file:s0
+
+# Sensor registry data files.
+/data/vendor/sensors/registry(/.*)? u:object_r:sensor_reg_data_file:s0
+
+# Sensor debug data files.
+/data/vendor/sensors/debug(/.*)? u:object_r:sensor_debug_data_file:s0

sensors/sepolicy/hal_sensors_default.te

@@ -0,0 +1,65 @@
+#
+# USF sensor HAL SELinux type enforcements.
+#
+
+# Allow reading of sensor registry persist files.
+allow hal_sensors_default mnt_vendor_file:dir search;
+allow hal_sensors_default persist_file:dir search;
+allow hal_sensors_default persist_file:file r_file_perms;
+r_dir_file(hal_sensors_default, persist_sensor_reg_file)
+
+# Allow creation and writing of sensor registry data files.
+allow hal_sensors_default sensor_reg_data_file:dir rw_dir_perms;
+allow hal_sensors_default sensor_reg_data_file:file create_file_perms;
+
+userdebug_or_eng(`
+    # Allow creation and writing of sensor debug data files.
+    allow hal_sensors_default sensor_debug_data_file:dir rw_dir_perms;
+    allow hal_sensors_default sensor_debug_data_file:file create_file_perms;
+')
+
+# Allow access to the AoC communication driver.
+allow hal_sensors_default aoc_device:chr_file rw_file_perms;
+
+# Allow access to the AoC clock and kernel boot time sys FS node. This is needed
+# to synchronize the AP and AoC clock timestamps.
+allow hal_sensors_default sysfs_aoc_boottime:file rw_file_perms;
+
+# Allow access to the sysfs_aoc.
+allow hal_sensors_default sysfs_aoc:dir search;
+allow hal_sensors_default sysfs_aoc:file r_file_perms;
+
+# Allow sensor HAL to reset AOC.
+allow hal_sensors_default sysfs_aoc_reset:file rw_file_perms;
+
+# Allow sensor HAL to read AoC dumpstate.
+allow hal_sensors_default sysfs_aoc_dumpstate:file r_file_perms;
+
+# Allow access for AoC properties.
+get_prop(hal_sensors_default, vendor_aoc_prop)
+
+# Allow create thread to watch AOC's device.
+allow hal_sensors_default device:dir r_dir_perms;
+
+# Allow access to sensor service for sensor_listener.
+binder_call(hal_sensors_default, system_server);
+
+# Allow use of the USF low latency transport.
+usf_low_latency_transport(hal_sensors_default)
+
+# Allow sensor HAL to access to display sysfs.
+allow hal_sensors_default sysfs_display:file r_file_perms;
+
+# Allow display_info_service access to the backlight driver.
+allow hal_sensors_default sysfs_leds:dir search;
+allow hal_sensors_default sysfs_leds:file rw_file_perms;
+
+# Allow SensorSuez to connect AIDL stats.
+binder_use(hal_sensors_default);
+allow hal_sensors_default fwk_stats_service:service_manager find;
+
+# Allow access to CHRE socket to connect to nanoapps.
+unix_socket_connect(hal_sensors_default, chre, chre)
+
+# Allow access to the power supply files for MagCC.
+r_dir_file(hal_sensors_default, sysfs_batteryinfo)

sensors/sepolicy/te_macros

@@ -0,0 +1,14 @@
+#
+# USF SELinux type enforcement macros.
+#
+
+#
+# usf_low_latency_transport(domain)
+#
+# Allows domain use of the USF low latency transport.
+#
+define(`usf_low_latency_transport', `
+  allow $1 hal_graphics_mapper_hwservice:hwservice_manager find;
+  hal_client_domain($1, hal_graphics_allocator)
+')
+