Something went wrong on our end
-
Alex Klyubin authored"tee" domain is a vendor domain. Hence its rules should live on the vendor image. What's left as public API is that: 1. tee domain exists and that it is permitted to sys_rawio capability, 2. tee_device type exists and apps are not permitted to access character devices labeled tee_device. If you were relying on system/sepolicy automatically labeling /dev/tf_driver as tee_device or labeling /system/bin/tf_daemon as tee_exec, then you need to add these rules to your device-specific file_contexts. Test: mmm system/sepolicy Test: bullhead, angler, and sailfish boot up without new denials Bug: 36714625 Bug: 36714625 Bug: 36720355 Change-Id: Ie21619ff3c44ef58675c369061b4afdd7e8501c6
Alex Klyubin authored"tee" domain is a vendor domain. Hence its rules should live on the vendor image. What's left as public API is that: 1. tee domain exists and that it is permitted to sys_rawio capability, 2. tee_device type exists and apps are not permitted to access character devices labeled tee_device. If you were relying on system/sepolicy automatically labeling /dev/tf_driver as tee_device or labeling /system/bin/tf_daemon as tee_exec, then you need to add these rules to your device-specific file_contexts. Test: mmm system/sepolicy Test: bullhead, angler, and sailfish boot up without new denials Bug: 36714625 Bug: 36714625 Bug: 36720355 Change-Id: Ie21619ff3c44ef58675c369061b4afdd7e8501c6
tee.te 959 B
##
# trusted execution environment (tee) daemon
#
typeattribute tee domain_deprecated;
type tee_exec, exec_type, file_type;
init_daemon_domain(tee)
# TODO(b/36714625, b/36715266): Remove this once drmserver, mediaserver, and surfaceflinger no
# longer communicate with tee daemon over sockets
typeattribute tee socket_between_core_and_vendor_violators;
allow tee self:capability { dac_override };
allow tee tee_device:chr_file rw_file_perms;
allow tee tee_data_file:dir rw_dir_perms;
allow tee tee_data_file:file create_file_perms;
allow tee self:netlink_socket create_socket_perms_no_ioctl;
allow tee self:netlink_generic_socket create_socket_perms_no_ioctl;
allow tee ion_device:chr_file r_file_perms;
r_dir_file(tee, sysfs_type)
# TODO(b/36720355): Remove this once tee no longer access non-vendor files
typeattribute tee coredata_in_vendor_violators;
allow tee system_data_file:file { getattr read };
allow tee system_data_file:lnk_file r_file_perms;