dragonboard: sepolicy: Add sepolicy rules to fix problems seen adb remount overlays
When using adb remount/adb sync, I noticed some new sepolicy
failures that prevented some things from working.
For instance, if I did adb remount right after flashing a
device, on the next bootup I found that wifi would fail to work.
This was due to sepolicy failures caused by the file accesses
being on the overlayfs.
Similarly, when testing a new version of mesa via adb sync, I
found surfaceflinger would fail to start, again due to new
sepolicy failures
These sepolicy changes were suggested by audit2allow to fix
the problems, and indeed I now have display and wifi working
after adb remount/sync updates.
Signed-off-by: John Stultz <jstultz@google.com>
Change-Id: Ifd819cf34939d1e61b67d8b08c67ec9a2fadd110
diff --git a/sepolicy/kernel.te b/sepolicy/kernel.te
index 3fad122..176d6f6 100644
--- a/sepolicy/kernel.te
+++ b/sepolicy/kernel.te
@@ -2,6 +2,10 @@
allow kernel device:chr_file { create setattr };
allow kernel device:dir { add_name create write };
allow kernel self:capability mknod;
-allow kernel vendor_file:file { open read };
+allow kernel vendor_file:file { open read getattr};
+allow kernel vendor_file:dir read;
allow kernel self:system module_request;
allow vendor_init kernel:system module_request;
+allow kernel sepolicy_file:file getattr;
+allow kernel system_bootstrap_lib_file:dir getattr;
+allow kernel system_bootstrap_lib_file:file getattr;
diff --git a/sepolicy/surfaceflinger.te b/sepolicy/surfaceflinger.te
index 17b66a8..9bffa3f 100644
--- a/sepolicy/surfaceflinger.te
+++ b/sepolicy/surfaceflinger.te
@@ -1 +1,2 @@
gpu_access(surfaceflinger)
+allow surfaceflinger vendor_file:dir read;
diff --git a/sepolicy/system_server.te b/sepolicy/system_server.te
index 80957cc..e801436 100644
--- a/sepolicy/system_server.te
+++ b/sepolicy/system_server.te
@@ -1 +1,3 @@
gpu_access(system_server)
+allow system_server wifi_hal_prop:file {open read getattr map};
+allow system_server vendor_file:dir read;