summaryrefslogtreecommitdiff
path: root/sepolicy
diff options
context:
space:
mode:
authorAlistair Strachan <alistair.strachan@imgtec.com>2016-02-26 17:48:09 -0800
committerNick Desaulniers <ndesaulniers@google.com>2016-03-14 22:07:16 +0000
commit1f261b47a77a48965ec0e6a53651caf5bf89fb88 (patch)
treee7e6ceb4d70a27d7ee6403dfc15e50430e05da99 /sepolicy
parent4f9b9c36ff1ef16b45a99a8ca3e1ea7dd24dd87f (diff)
gpu: Updates to support DDK 1.6.
Removed vp9_interpredict.binary. This is a shader binary which has a layout specific to the GPU DDK revision. It should be provided with the DDK. Removed the pvrsrvctl binary. The GPU is started automatically at the first open() now and the firmware is loaded by the kernel. The sepolicy needed minor tweaks for cameraservice. I removed the permissive rules for the obsolete pvrsrvctl binary to close that security hole. Removed most of the powervr.ini settings. Most of these were already the default, or have been removed from the new DDK. Signed-off-by: Alistair Strachan <alistair.strachan@imgtec.com> Bug: 26592113 Bug: 27643307 Change-Id: Ie20fad85c0373d3ae0510afff65827e8a5ea3ab6
Diffstat (limited to 'sepolicy')
-rw-r--r--sepolicy/appdomain.te2
-rw-r--r--sepolicy/bootanim.te2
-rw-r--r--sepolicy/cameraserver.te2
-rw-r--r--sepolicy/dumpstate.te3
-rw-r--r--sepolicy/file_contexts1
-rw-r--r--sepolicy/mediaserver.te3
-rw-r--r--sepolicy/pvrsrvctl.te19
-rw-r--r--sepolicy/system_server.te3
8 files changed, 15 insertions, 20 deletions
diff --git a/sepolicy/appdomain.te b/sepolicy/appdomain.te
new file mode 100644
index 0000000..762fbdc
--- /dev/null
+++ b/sepolicy/appdomain.te
@@ -0,0 +1,2 @@
+# GPU dynamic fbc feature
+allow appdomain surfaceflinger:fifo_file rw_file_perms;
diff --git a/sepolicy/bootanim.te b/sepolicy/bootanim.te
new file mode 100644
index 0000000..d5b4757
--- /dev/null
+++ b/sepolicy/bootanim.te
@@ -0,0 +1,2 @@
+# GPU dynamic fbc feature
+allow bootanim surfaceflinger:fifo_file rw_file_perms;
diff --git a/sepolicy/cameraserver.te b/sepolicy/cameraserver.te
new file mode 100644
index 0000000..fe6663b
--- /dev/null
+++ b/sepolicy/cameraserver.te
@@ -0,0 +1,2 @@
+# GPU dynamic fbc feature
+allow cameraserver surfaceflinger:fifo_file rw_file_perms;
diff --git a/sepolicy/dumpstate.te b/sepolicy/dumpstate.te
index 9c635b9..a3c754f 100644
--- a/sepolicy/dumpstate.te
+++ b/sepolicy/dumpstate.te
@@ -1,3 +1,6 @@
userdebug_or_eng(`
allow dumpstate atvr_device:chr_file r_file_perms;
')
+
+# GPU dynamic fbc feature
+allow dumpstate surfaceflinger:fifo_file rw_file_perms;
diff --git a/sepolicy/file_contexts b/sepolicy/file_contexts
index 2cd08ef..fd5c53a 100644
--- a/sepolicy/file_contexts
+++ b/sepolicy/file_contexts
@@ -7,7 +7,6 @@
/factory/bt(/.*)? u:object_r:bluetooth_efs_file:s0
/dev/snd_atvr_(.*) u:object_r:atvr_device:s0
-/system/vendor/bin/pvrsrvctl u:object_r:pvrsrvctl_exec:s0
/system/bin/BtFwLoader u:object_r:btfwloader_exec:s0
/sys/devices/pci0000:00/0000:00:01\.3/mmc_host/mmc2/mmc2:0001/mmc2:0001:2/ieee80211/phy[0-9]+/rfkill[0-9]+/type u:object_r:sysfs_bluetooth:s0
diff --git a/sepolicy/mediaserver.te b/sepolicy/mediaserver.te
index 27c7a24..134208c 100644
--- a/sepolicy/mediaserver.te
+++ b/sepolicy/mediaserver.te
@@ -1,2 +1,5 @@
# TODO: investigate cause of this
allow mediaserver graphics_device:dir search;
+
+# GPU dynamic fbc feature
+allow mediaserver surfaceflinger:fifo_file rw_file_perms;
diff --git a/sepolicy/pvrsrvctl.te b/sepolicy/pvrsrvctl.te
deleted file mode 100644
index e8eab79..0000000
--- a/sepolicy/pvrsrvctl.te
+++ /dev/null
@@ -1,19 +0,0 @@
-type pvrsrvctl, domain, domain_deprecated;
-type pvrsrvctl_exec, exec_type, file_type;
-
-# Started by init
-init_daemon_domain(pvrsrvctl)
-
-# allow access to /dev/dri/card0
-allow pvrsrvctl gpu_device:chr_file rw_file_perms;
-
-# allow graphics driver initialization
-allow pvrsrvctl self:capability sys_admin;
-
-# enable pipe communication between appdomain processes and
-# surfaceflinger for gralloc subchannel feature (dynamic fbc)
-allow bootanim surfaceflinger:fifo_file rw_file_perms;
-allow system_server surfaceflinger:fifo_file rw_file_perms;
-allow appdomain surfaceflinger:fifo_file rw_file_perms;
-allow mediaserver surfaceflinger:fifo_file rw_file_perms;
-allow dumpstate surfaceflinger:fifo_file rw_file_perms;
diff --git a/sepolicy/system_server.te b/sepolicy/system_server.te
index 02e07fd..b7c9653 100644
--- a/sepolicy/system_server.te
+++ b/sepolicy/system_server.te
@@ -1,3 +1,6 @@
# Allow system server factory file access
allow system_server efs_file:dir search;
allow system_server efs_file:file r_file_perms;
+
+# GPU dynamic fbc feature
+allow system_server surfaceflinger:fifo_file rw_file_perms;