Merge "Grant TUNGETIFF ioctl and revoke SIOCGIFFLAGS ioctl to vmnic" into main
diff --git a/private/compat/34.0/34.0.compat.cil b/private/compat/34.0/34.0.compat.cil
index 76d24c5..18e8ef5 100644
--- a/private/compat/34.0/34.0.compat.cil
+++ b/private/compat/34.0/34.0.compat.cil
@@ -1,3 +1,17 @@
;; complement CIL file for compatibility between ToT policy and 34.0 vendors.
;; will be compiled along with other normal policy files, on 34.0 vendors.
;;
+
+;; This type may or may not already exist in vendor policy. The 202404 sepolicy
+;; (well, the 24Q1 release) added hidraw_device, but existing vendor policy
+;; may still label the relevant devices with the old label.
+;;
+;; Re-define it here (duplicate definitions in CIL will be ignored) - so we can
+;; duplicate the new policy for the old label to keep things working.
+;; (Doing this in 34.0.cil ended up being too messy.)
+;; See b/340923653.
+(type vendor_hidraw_device)
+(typeattributeset dev_type (vendor_hidraw_device))
+
+(allow system_server vendor_hidraw_device (dir (open getattr read search ioctl lock watch watch_reads)))
+(allow system_server vendor_hidraw_device (chr_file (getattr open read ioctl lock map watch watch_reads append write)))
diff --git a/private/statsd.te b/private/statsd.te
index 5820d23..b932bc6 100644
--- a/private/statsd.te
+++ b/private/statsd.te
@@ -19,8 +19,11 @@
# Allow StatsCompanionService to pipe data to statsd.
allow statsd system_server:fifo_file { read write getattr };
-# Allow Statsd to pipe data to privileged apps.
-allow statsd priv_app:fifo_file { read write getattr };
+# Allow any app to pipe data to statsd.
+# Access control to all statsd APIs inherit from system_api_service, so
+# appdomain permissions are granted to avoid listing each individual
+# service that can access system_api_service.
+allow statsd appdomain:fifo_file { read write getattr };
# Allow statsd to retrieve SF statistics over binder
binder_call(statsd, surfaceflinger);