sepolicy: address current denials

Change-Id: Ied12c2b588856e7cb874e8693da7e07d9b8d0e6c

11 files changed, 38 insertions, 19 deletions

diff --git a/sepolicy/bluetooth.te b/sepolicy/bluetooth.te
deleted file mode 100644
index 07e4a68..0000000
--- a/sepolicy/bluetooth.te
+++ /dev/null
@@ -1,4 +0,0 @@
-# Bluetooth
-allow bluetooth bluetooth_efs_file:file rw_file_perms;
-allow bluetooth efs_block_device:dir { search };
-allow bluetooth sysfs:file rw_file_perms;
diff --git a/sepolicy/cpboot-daemon.te b/sepolicy/cpboot-daemon.te
new file mode 100644
index 0000000..6e38177
--- /dev/null
+++ b/sepolicy/cpboot-daemon.te
@@ -0,0 +1 @@
+type cpboot-daemon, domain;
diff --git a/sepolicy/device.te b/sepolicy/device.te
index 314777b..dcc9d53 100644
--- a/sepolicy/device.te
+++ b/sepolicy/device.te
@@ -2,4 +2,3 @@
 type dock_device, dev_type;
 type smc_device, dev_type;
 type efs_block_device, dev_type;
-type rfkill_device, dev_type; 
diff --git a/sepolicy/file_contexts b/sepolicy/file_contexts
index 44fd317..0a6e40e 100644
--- a/sepolicy/file_contexts
+++ b/sepolicy/file_contexts
@@ -22,21 +22,29 @@
 /dev/gcioctl                                u:object_r:video_device:s0
 
 # Bluetooth
-/dev/ttyO1                                  u:object_r:hci_attach_dev:s0
-/efs/bluetooth(/.*)?                        u:object_r:bluetooth_efs_file:s0
+/dev/ttyO1                                                   u:object_r:hci_attach_dev:s0
+/efs/bluetooth(/.*)?                                         u:object_r:bluetooth_efs_file:s0
+/sys/devices/platform/bcm4330_bluetooth/rfkill/rfkill0/state u:object_r:sysfs_bluetooth_writable:s0
 
 # GPS
 /dev/ttyO0                                  u:object_r:gps_device:s0
 
 # Wifi
-/dev/rfkill                                 u:object_r:rfkill_device:s0
 /efs/wifi/.mac.info                         u:object_r:wifi_data_file:s0
 
-# System binaries
-/system/vendor/bin/pvrsrvctl_SGX540_120     u:object_r:pvrsrvinit_exec:s0
-
 # Firmwares
-/system/vendor/firmware/ducati-m3.bin       u:object_r:firmware_ducati:s0 
+/system/vendor/firmware/ducati-m3.bin       u:object_r:firmware_ducati:s0
 
 # variant setup
 /system/bin/init\.espresso\.variant\.sh     u:object_r:variant_setup_exec:s0
+
+# Block devices
+/dev/block/mmcblk0                                      u:object_r:root_block_device:s0
+/dev/block/platform/omap/omap_hsmmc.1/by-name/KERNEL    u:object_r:boot_block_device:s0
+/dev/block/platform/omap/omap_hsmmc.1/by-name/RECOVERY  u:object_r:recovery_block_device:s0
+/dev/block/platform/omap/omap_hsmmc.1/by-name/FACTORYFS u:object_r:system_block_device:s0
+/dev/block/platform/omap/omap_hsmmc.1/by-name/CACHE     u:object_r:cache_block_device:s0
+/dev/block/platform/omap/omap_hsmmc.1/by-name/DATAFS    u:object_r:userdata_block_device:s0
+
+# Swap
+/dev/block/zram(.*)                                     u:object_r:swap_block_device:s0
diff --git a/sepolicy/fsck.te b/sepolicy/fsck.te
new file mode 100644
index 0000000..d10d9fc
--- /dev/null
+++ b/sepolicy/fsck.te
@@ -0,0 +1,2 @@
+# sadly, the EFS partition is mounted as rw, so it makes sense to check it
+allow fsck efs_block_device:blk_file rw_file_perms;
diff --git a/sepolicy/init.te b/sepolicy/init.te
index 10790dc..61d39c2 100644
--- a/sepolicy/init.te
+++ b/sepolicy/init.te
@@ -1,3 +1,11 @@
-# init
+# allow insmod
 allow init self:capability sys_module;
-allow init self:process execmem;
+
+# chmod/chown rfkill device
+allow init sysfs_bluetooth_writable:file getattr;
+
+# allow creating /sdcard symlink
+allow init tmpfs:lnk_file create;
+
+# For mounting debugfs
+allow init debugfs:dir mounton;
diff --git a/sepolicy/mediaserver.te b/sepolicy/mediaserver.te
new file mode 100644
index 0000000..98a7cb0
--- /dev/null
+++ b/sepolicy/mediaserver.te
@@ -0,0 +1,3 @@
+allow mediaserver system_server:unix_stream_socket { read write };
+
+allow mediaserver sensorservice_service:service_manager find;
diff --git a/sepolicy/sysinit.te b/sepolicy/sysinit.te
deleted file mode 100644
index 2907f73..0000000
--- a/sepolicy/sysinit.te
+++ /dev/null
@@ -1,2 +0,0 @@
-# sysinit
-allow sysinit surfaceflinger_exec:file { getattr };
diff --git a/sepolicy/system_server.te b/sepolicy/system_server.te
new file mode 100644
index 0000000..555792e
--- /dev/null
+++ b/sepolicy/system_server.te
@@ -0,0 +1,6 @@
+allow system_server self:capability sys_module;
+
+allow system_server gps_data_file:dir search;
+allow system_server gps_data_file:fifo_file { write read open setattr };
+
+allow system_server efs_file:dir search;
diff --git a/sepolicy/vold.te b/sepolicy/vold.te
new file mode 100644
index 0000000..04062d3
--- /dev/null
+++ b/sepolicy/vold.te
@@ -0,0 +1 @@
+allow vold efs_file:dir r_dir_perms;
diff --git a/sepolicy/wpa_supplicant.te b/sepolicy/wpa_supplicant.te
deleted file mode 100644
index 6e99dea..0000000
--- a/sepolicy/wpa_supplicant.te
+++ /dev/null
@@ -1,3 +0,0 @@
-# wpa_supplicant
-allow wpa rfkill_device:chr_file rw_file_perms;
-allow wpa_socket wifi_data_file:sock_file unlink;