From b5c9869a7c44f21b68f99004535de9611003f8af Mon Sep 17 00:00:00 2001 From: Marc Mao Date: Wed, 6 Nov 2024 09:18:16 +0800 Subject: [PATCH] Add vde_display sepolicy Tracked-On: OAM-127103 Signed-off-by: Marc Mao --- graphics/vde_display/file_contexts | 1 + graphics/vde_display/property_contexts | 1 + graphics/vde_display/vde_display.te | 23 +++++++++++++++++++++++ 3 files changed, 25 insertions(+) create mode 100644 graphics/vde_display/file_contexts create mode 100644 graphics/vde_display/property_contexts create mode 100644 graphics/vde_display/vde_display.te diff --git a/graphics/vde_display/file_contexts b/graphics/vde_display/file_contexts new file mode 100644 index 0000000..9a19573 --- /dev/null +++ b/graphics/vde_display/file_contexts @@ -0,0 +1 @@ +(/system)?/vendor/bin/vnc-display u:object_r:vde_display_exec:s0 diff --git a/graphics/vde_display/property_contexts b/graphics/vde_display/property_contexts new file mode 100644 index 0000000..200ea22 --- /dev/null +++ b/graphics/vde_display/property_contexts @@ -0,0 +1 @@ +vendor.hwc_vhal. u:object_r:vendor_graphics_hwcomposer_prop:s0 diff --git a/graphics/vde_display/vde_display.te b/graphics/vde_display/vde_display.te new file mode 100644 index 0000000..fad396f --- /dev/null +++ b/graphics/vde_display/vde_display.te @@ -0,0 +1,23 @@ +type vde_display, domain, halclientdomain, hal_graphics_allocator_client; +type vde_display_exec, exec_type, vendor_file_type, file_type; + +init_daemon_domain(vde_display) + +#============= netd ============== +allow netd vde_display:fd use; +allow netd vde_display:tcp_socket { read write }; + +#============= vde_display ============== +allow vde_display fwmarkd_socket:sock_file write; +allow vde_display netd:unix_stream_socket connectto; +allow vde_display node:tcp_socket node_bind; +allow vde_display port:tcp_socket name_bind; +allow vde_display self:tcp_socket { bind create listen setopt accept getopt getattr read write }; + +allow vde_display hal_graphics_allocator_default:fd use; +allow vde_display hal_graphics_allocator_service:service_manager find; +allow vde_display uhid_device:chr_file { ioctl open write }; +allow vde_display gpu_device:chr_file { map open read write ioctl }; +allow vde_display gpu_device:dir search; +allow vde_display hal_graphics_composer_default:unix_stream_socket connectto; +