# ============================================== # Policy File of /vendor/bin/meta_tst Executable File # ============================================== # Type Declaration # ============================================== type meta_tst, domain; type meta_tst_exec , exec_type, file_type, vendor_file_type; init_daemon_domain(meta_tst) # ============================================== # MTK Policy Rule # ============================================== # Date: WK16.12 # Operation : Migration # Purpose : for meta mode device node USB allow meta_tst ttyGS_device:chr_file rw_file_perms; # Date: WK16.12 # Operation : Migration # Purpose : for meta mode device node UART allow meta_tst ttyMT_device:chr_file rw_file_perms; # Date: WK17.12 # Operation : Migration # Purpose : for meta mode device node UART allow meta_tst ttyS_device:chr_file rw_file_perms; # Date: WK16.12 # Operation : Migration # Purpose : for meta mode device node CCCI allow meta_tst ccci_device:chr_file rw_file_perms; allow meta_tst eemcs_device:chr_file rw_file_perms; allow meta_tst emd_device:chr_file rw_file_perms; allow meta_tst ttyACM_device:chr_file rw_file_perms; allow meta_tst mdlog_device:chr_file rw_file_perms; # Data: WK15.07 # Purpose : SDIO allow meta_tst ttySDIO_device:chr_file rw_file_perms; # Date: WK16.12 # Operation : Migration # Purpose : for meta mode file system allow meta_tst bootdevice_block_device:blk_file rw_file_perms; allow meta_tst mmcblk1_block_device:blk_file rw_file_perms; allow meta_tst userdata_block_device:blk_file rw_file_perms; allow meta_tst cache_block_device:blk_file rw_file_perms; # Date: WK16.12 # Operation : Migration # Purpose : for meta mode nvram allow meta_tst nvram_data_file:dir create_dir_perms; allow meta_tst nvram_data_file:file create_file_perms; allow meta_tst nvram_data_file:lnk_file r_file_perms; allow meta_tst nvdata_file:lnk_file r_file_perms; allow meta_tst nvdata_file:dir create_dir_perms; allow meta_tst nvdata_file:file create_file_perms; allow meta_tst nvram_device:chr_file rw_file_perms; allow meta_tst nvram_device:blk_file rw_file_perms; allow meta_tst nvdata_device:blk_file rw_file_perms; # Date: WK14.47 # Operation : Migration # Purpose : for meta mode audio allow meta_tst audio_device:chr_file rw_file_perms; allow meta_tst audio_device:dir r_dir_perms; allow meta_tst audio_ipi_device:chr_file rw_file_perms; set_prop(meta_tst, vendor_mtk_audiohal_prop) # Date: WK16.12 # Operation : Migration # Purpose : for meta mode RTC and PMIC allow meta_tst rtc_device:chr_file r_file_perms; allow meta_tst MT_pmic_adc_cali_device:chr_file rw_file_perms; # Date: WK14.46 # Operation : Migration # Purpose : Camera allow meta_tst devmap_device:chr_file rw_file_perms; allow meta_tst camera_pipemgr_device:chr_file rw_file_perms; allow meta_tst MTK_SMI_device:chr_file rw_file_perms; allow meta_tst camera_isp_device:chr_file rw_file_perms; allow meta_tst camera_sysram_device:chr_file r_file_perms; allow meta_tst kd_camera_flashlight_device:chr_file rw_file_perms; allow meta_tst kd_camera_hw_device:chr_file rw_file_perms; allow meta_tst AD5820AF_device:chr_file rw_file_perms; allow meta_tst DW9714AF_device:chr_file rw_file_perms; allow meta_tst DW9714A_device:chr_file rw_file_perms; allow meta_tst LC898122AF_device:chr_file rw_file_perms; allow meta_tst LC898212AF_device:chr_file rw_file_perms; allow meta_tst BU6429AF_device:chr_file rw_file_perms; allow meta_tst DW9718AF_device:chr_file rw_file_perms; allow meta_tst BU64745GWZAF_device:chr_file rw_file_perms; allow meta_tst MAINAF_device:chr_file rw_file_perms; allow meta_tst MAIN2AF_device:chr_file rw_file_perms; allow meta_tst MAIN3AF_device:chr_file rw_file_perms; allow meta_tst MAIN4AF_device:chr_file rw_file_perms; allow meta_tst SUBAF_device:chr_file rw_file_perms; allow meta_tst SUB2AF_device:chr_file rw_file_perms; # Date: WK16.12 # Operation : Migration # Purpose : meta mode LCM allow meta_tst graphics_device:chr_file rw_file_perms; allow meta_tst graphics_device:dir search; # Date: WK16.12 # Operation : Migration # Purpose : meta mode sensor allow meta_tst als_ps_device:chr_file r_file_perms; allow meta_tst gsensor_device:chr_file r_file_perms; allow meta_tst msensor_device:chr_file r_file_perms; allow meta_tst gyroscope_device:chr_file r_file_perms; # Date: WK16.12 # Operation : Migration # Purpose : meta mode FM allow meta_tst fm_device:chr_file rw_file_perms; allow meta_tst FM50AF_device:chr_file rw_file_perms; # Date: WK16.12 # Operation : Migration # Purpose : meta mode wifi allow meta_tst wmtWifi_device:chr_file w_file_perms; # Date: WK16.12 # Operation : Migration # Purpose : meta mode BT allow meta_tst stpbt_device:chr_file rw_file_perms; # Date: WK16.12 # Operation : Migration # Purpose : meta mode GPS allow meta_tst gps_data_file:dir { write add_name search remove_name unlink}; allow meta_tst gps_data_file:file { read write open create getattr append setattr unlink lock}; allow meta_tst gps_data_file:lnk_file read; allow meta_tst tmpfs:lnk_file read; allow meta_tst agpsd_data_file:dir search; allow meta_tst agpsd_data_file:sock_file write; allow meta_tst mnld_device:chr_file rw_file_perms; allow meta_tst mnld_exec:file rx_file_perms; set_prop(meta_tst, vendor_mtk_mnld_prop) #Date WK14.49 #Operation : Migration #Purpose : DRM key installation allow meta_tst key_install_data_file:dir w_dir_perms; allow meta_tst key_install_data_file:file create_file_perms; # Date: WK14.51 # Purpose : set/get cryptfs cfg in sys env allow meta_tst misc_device:chr_file rw_file_perms; allow meta_tst proc_lk_env:file rw_file_perms; # Purpose : FT_EMMC_OP_FORMAT_TCARD allow meta_tst block_device:blk_file getattr; allow meta_tst system_block_device:blk_file getattr; # Date: WK15.52 # Purpose : NVRAM related LID allow meta_tst pro_info_device:chr_file rw_file_perms; # Date: WK15.13 # Purpose: for nand project allow meta_tst mtd_device:dir search; allow meta_tst mtd_device:chr_file rw_file_perms; # Date: WK16.17 # Purpose: N Migration For ccci sysfs node allow meta_tst sysfs_ccci:dir search; allow meta_tst sysfs_ccci:file r_file_perms; #Date: W18.22 # Purpose: P Migration meta_tst get com port type/uart port info/boot mode/usb state/usb close allow meta_tst sysfs_comport_type:file rw_file_perms; allow meta_tst sysfs_uart_info:file rw_file_perms; allow meta_tst sysfs_boot_mode:file rw_file_perms; allow meta_tst sysfs_boot_type:file r_file_perms; allow meta_tst sysfs_android_usb:file rw_file_perms; allow meta_tst sysfs_android_usb:dir search; allow meta_tst sysfs_usb_nonplat:file rw_file_perms; allow meta_tst sysfs_usb_nonplat:dir search; allow meta_tst sysfs_batteryinfo:file rw_file_perms; allow meta_tst sysfs_batteryinfo:dir search; #Date: W16.17 # Purpose: N Migration For meta_tst load MD NVRAM database # Detail avc log: [04-23-20:41:58][ 160.687655] <1>.(1)[230:logd.auditd]type= #1400 audit(1262304165.560:24): avc: denied { read } for pid=228 comm= #"meta_tst" name="mddb" dev="mmcblk0p20" ino=664 scontext=u:r:meta_tst: #s0 tcontext=u:object_r:system_file:s0 tclass=dir permissive=0 allow meta_tst system_file:dir r_dir_perms; # Date: WK16.18 # Purpose: for CCCI reboot modem allow meta_tst gsm0710muxd_device:chr_file rw_file_perms; # Date : WK16.35 # Purpose : Update camera flashlight driver device file allow meta_tst flashlight_device:chr_file rw_file_perms; #Date: W16.36 # Purpose: meta_tst use libmeta_rat to write libsysenv # Detail avc log:[ 25.307141] .(5)[264:logd.auditd]type=1400 audit(1469438818.570:7): #avc: denied { read write } for pid=312 comm="meta_tst" name="mmcblk0p2" dev="tmpfs" #ino=4561 scontext=u:r:meta_tst:s0 tcontext=u:object_r:para_block_device:s0 tclass=blk_file permissive=0 allow meta_tst para_block_device:blk_file { read write open }; #Date: W16.44 allow meta_tst nvcfg_file:dir { search read open }; #Date: W16.45 # Purpose : Allow unmount sdcardfs mounted on /data/media allow meta_tst sdcard_type:filesystem unmount; allow meta_tst storage_stub_file:dir search; # Date : WK16.19 # Operation: meta_tst set persist.meta.connecttype property # Purpose: Switch meta connect type, set persist.meta.connecttype as "wifi" or "usb". set_prop(meta_tst, vendor_mtk_meta_connecttype_prop) # Date : WK16.23 # Purpose: support meta_tst check key event allow meta_tst input_device:dir r_dir_perms; allow meta_tst input_device:chr_file r_file_perms; # Date : WK16.29 # Purpose: support meta mode show string on screen allow meta_tst ashmem_device:chr_file execute; #Date: W16.50 # Purpose : Allow meta_tst stop service which occupy data partition. set_prop(meta_tst, ctl_default_prop) #Date: W17.25 # Purpose : Allow meta_tst stop service which occupy data partition. set_prop(meta_tst, system_mtk_ctl_emdlogger1_prop) #Date: W17.27 # Purpose: STMicro NFC solution integration allow meta_tst vendor_file:file { getattr execute execute_no_trans read open }; set_prop(meta_tst, hwservicemanager_prop) hwbinder_use(meta_tst); allow meta_tst debugfs_tracing:file { open write }; # Date: W17.29 # Purpose : Allow meta_tst to call vendor.mediatek.hardware.keymaster_attestation@1.0-service. hal_client_domain(meta_tst, mtk_hal_keyattestation) # Date : WK17.30 # Operation : Android O migration # Purpose : add sepolicy for accessing sysfs_leds allow meta_tst sysfs_leds:lnk_file read; allow meta_tst sysfs_leds:file rw_file_perms; allow meta_tst sysfs_leds:dir r_dir_perms; # Date: WK17.43 # Purpose: add permission for meta_tst access md image allow meta_tst md_block_device:blk_file { read open }; allow meta_tst mddb_data_file:file { create open write read getattr}; allow meta_tst mddb_data_file:dir { search write add_name create getattr read open }; # Date: W17.43 # Purpose : Allow meta_tst to call Audio HAL service binder_call(meta_tst, mtk_hal_audio) allow meta_tst mtk_hal_audio:binder call; #allow meta_tst hal_audio_hwservice:hwservice_manager find; allow meta_tst mtk_audiohal_data_file:dir {read search open}; allow meta_tst audio_device:chr_file rw_file_perms; allow meta_tst audio_device:dir w_dir_perms; #Data:W1745 # Purpose : Allow meta_tst to open and read proc/bootprof allow meta_tst proc_bootprof:file {write open read}; # Date:W17.51 # Operation : lbs hal # Purpose : lbs hidl interface permission hal_client_domain(meta_tst, mtk_hal_lbs) # Data:W1750 # Purpose : Allow meta_tst to access mtd device allow meta_tst mtd_device:blk_file rw_file_perms; #Date: W17.51 #Purpose : Allow meta_tst to access pesist.atm.mdmode in ATM. set_prop(meta_tst, vendor_mtk_atm_mdmode_prop) #Date: W17.51 #Purpose : Allow meta_tst to access pesist.atm.ipaddress in ATM. set_prop(meta_tst, vendor_mtk_atm_ipaddr_prop) # Date : WK18.16 # Operation: P migration # Purpose: Allow meta_tst to get vendor_mtk_tel_switch_prop get_prop(meta_tst, vendor_mtk_tel_switch_prop) # Date : WK18.21 # Operation: P migration # Purpose : Allow meta_tst to call nvram hal allow meta_tst nvram_agent_binder_hwservice:hwservice_manager find; allow meta_tst nvram_agent_binder:binder call; # Date : WK18.21 # Operation: P migration # Purpose : Allow meta_tst to write misc partition allow meta_tst block_device:dir search; # Date : W18.24 # Operation: P migration # Purpose : Allow meta_tst to access tpd sysfs nodes for CTP test allow meta_tst sysfs_tpd_setting:dir search; allow meta_tst sysfs_tpd_setting:file { read getattr open }; # Date : WK18.24 # Operation: P migration # Purpose : Allow meta_tst to unmount partition, stop service, and then erase partition allow meta_tst vendor_shell_exec:file { read execute open execute_no_trans }; allow meta_tst vendor_toolbox_exec:file { execute_no_trans }; allow meta_tst labeledfs:filesystem { unmount }; allow meta_tst proc_cmdline:file { read open getattr }; allow meta_tst meta_tst:capability { sys_admin }; allow meta_tst sysfs_dt_firmware_android:file { read open getattr }; allow meta_tst sysfs_dt_firmware_android:dir { read open search }; # Purpose : Allow meta_tst to communicate with driver thru socket allow meta_tst meta_tst:capability { sys_module net_admin net_raw }; allow meta_tst self:udp_socket { create ioctl }; allowxperm meta_tst self:udp_socket ioctl priv_sock_ioctls; # Date : WK18.25 # Operation: P migration # Purpose : GPS test, Allow meta_tst to write/connect tcp socket allow meta_tst node:tcp_socket node_bind; allow meta_tst port:tcp_socket { name_bind name_connect }; allow meta_tst self:capability net_raw; allow meta_tst self:tcp_socket { setopt bind create listen accept connect }; allow meta_tst self:tcp_socket { read write }; allow meta_tst self:udp_socket { write connect }; # Date : WK18.28 # Operation: P migration # Purpose : AUDIO test, Allow meta_tst to write/read asound allow meta_tst proc_asound:dir { read search open }; allow meta_tst proc_asound:file { read open getattr write }; allow meta_tst mtk_audiohal_data_file:dir { read search open }; allow meta_tst sysfs_headset:file { read open }; # Date: W18.05 # Purpose : Allow meta_tst to use socket for listening uevent allow meta_tst meta_tst:netlink_kobject_uevent_socket { read bind create setopt }; # Date : WK18.28 # Operation: P migration # Purpose : set_prop(meta_tst, vendor_mtk_usb_prop) # Date: W18.29 # Operation: Catch log # Purpose : meta connect with loghidlserver by socket. allow meta_tst loghidlvendorservice:unix_stream_socket connectto; # Date: W18.32 # Operation: Android P migration # Purpose : Allow meta_tst to set powerctl property # avc: denied { set } for property=sys.powerctl pid=330 uid=0 gid=1001 scontext=u:r:meta_tst:s0 # tcontext=u:object_r:powerctl_prop:s0 tclass=property_service permissive=0 set_prop(meta_tst, powerctl_prop) # Date: W18.33 # Operation: Android P migration # Purpose : Allow meta_tst to set system clock # avc: denied { sys_time } for capability=25 scontext=u:r:meta_tst:s0 tcontext=u:r:meta_tst:s0 tclass=capability permissive=0 allow meta_tst self:capability sys_time; # Data: W18.35 # Operation: Android P migration # Purpose : check usb online status # avc: denied { search } for name="power_supply" dev="sysfs" ino=8712 scontext=u:r:meta_tst:s0 tcontext=u:object_r:sysfs_batteryinfo:s0 tclass=dir permissive=0 # avc: denied { read } for name="online" dev="sysfs" ino=8764 scontext=u:r:meta_tst:s0 tcontext=u:object_r:sysfs_batteryinfo:s0 tclass=file permissive=0 # avc: denied { open } for path="/sys/devices/platform/mt_charger/power_supply/usb/online" dev="sysfs" ino=8764 scontext=u:r:meta_tst:s0 tcontext=u:object_r:sysfs_batteryinfo:s0 tclass=file permissive=0 allow meta_tst sysfs_batteryinfo:dir search; allow meta_tst sysfs_batteryinfo:file {read open}; # Data: W18.42 # Operation: Android P migration # Purpose : add socket permission for meta allow meta_tst fwmarkd_socket:sock_file write; #Date: W18.42 # Operation: Android P migration # Purpose : Add ATM meta mvram sepolicy allow meta_tst mnt_vendor_file:dir search; # Date : WK18.44 # Operation: P migration # Purpose : adsp allow meta_tst adsp_device:chr_file rw_file_perms; # Date : WK19.08 # Operation: P migration # Purpose : audio scp recovery allow meta_tst audio_scp_device:chr_file r_file_perms; # Date : WK19.50 # Purpose: Allow bt process or tool to control bt_dbg allow meta_tst proc_btdbg:file rw_file_perms; # Date : WK20.07 # Operation: R migration # Purpose : Add permission for new device node. allow meta_tst sysfs_boot_info:file r_file_perms; allow meta_tst proc_bootprof:file getattr; allow meta_tst sysfs_meta_info:file r_file_perms; # Date : WK20.16 # Operation: R migration # Purpose : Allow meta_tst to access /sys/power/* allow meta_tst sysfs_power:file rw_file_perms; allow meta_tst sysfs_power:dir r_dir_perms; allow meta_tst self:capability2 {block_suspend}; # Date : WK20.14 # Purpose: Allow meta connect GPS MNLD allow meta_tst mnld:unix_stream_socket connectto; # Date : WK20.25 # Operation: Android R migration # Purpose : for sensor test allow meta_tst hf_manager_device:chr_file rw_file_perms;