Merge "DO NOT MERGE: Camera: Add initial Treble camera HAL sepolicy"
diff --git a/CleanSpec.mk b/CleanSpec.mk
index f141e34..a00f863 100644
--- a/CleanSpec.mk
+++ b/CleanSpec.mk
@@ -50,3 +50,10 @@
$(call add-clean-step, rm -rf $(PRODUCT_OUT)/root/file_contexts)
$(call add-clean-step, rm -rf $(PRODUCT_OUT)/recovery/root/file_contexts)
+
+$(call add-clean-step, rm -rf $(PRODUCT_OUT)/root/service_contexts)
+$(call add-clean-step, rm -rf $(PRODUCT_OUT)/recovery/root/service_contexts)
+$(call add-clean-step, rm -rf $(PRODUCT_OUT)/root/nonplat_property_contexts)
+$(call add-clean-step, rm -rf $(PRODUCT_OUT)/recovery/root/nonplat_property_contexts)
+$(call add-clean-step, rm -rf $(PRODUCT_OUT)/root/plat_property_contexts)
+$(call add-clean-step, rm -rf $(PRODUCT_OUT)/recovery/root/plat_property_contexts)
diff --git a/private/genfs_contexts b/private/genfs_contexts
index 6386101..efdfb42 100644
--- a/private/genfs_contexts
+++ b/private/genfs_contexts
@@ -32,6 +32,7 @@
genfscon proc /tty/drivers u:object_r:proc_tty_drivers:s0
genfscon proc /uid_cputime/show_uid_stat u:object_r:proc_uid_cputime_showstat:s0
genfscon proc /uid_cputime/remove_uid_range u:object_r:proc_uid_cputime_removeuid:s0
+genfscon proc /uid_io/stats u:object_r:proc_uid_io_stats:s0
genfscon proc /uid_procstat/set u:object_r:proc_uid_procstat_set:s0
genfscon proc /zoneinfo u:object_r:proc_zoneinfo:s0
diff --git a/private/storaged.te b/private/storaged.te
index 684f617..6b7fa50 100644
--- a/private/storaged.te
+++ b/private/storaged.te
@@ -4,14 +4,14 @@
init_daemon_domain(storaged)
-# Write to /dev/kmsg (opened in init)
-allow storaged kmsg_device:chr_file { write append };
-
# Read access to pseudo filesystems
r_dir_file(storaged, sysfs_type)
r_dir_file(storaged, proc_net)
r_dir_file(storaged, domain)
+# Read /proc/uid_io/stats
+allow storaged proc_uid_io_stats:file r_file_perms;
+
allow storaged self:capability { setgid setuid sys_nice sys_ptrace };
userdebug_or_eng(`
@@ -22,6 +22,8 @@
# Binder permissions
allow storaged storaged_service:service_manager add;
+allow storaged permission_service:service_manager find;
+
binder_use(storaged)
binder_call(storaged, system_server)
diff --git a/public/file.te b/public/file.te
index 99c2a9e..077b25a 100644
--- a/public/file.te
+++ b/public/file.te
@@ -23,6 +23,7 @@
type proc_tty_drivers, fs_type;
type proc_uid_cputime_showstat, fs_type;
type proc_uid_cputime_removeuid, fs_type;
+type proc_uid_io_stats, fs_type;
type proc_uid_procstat_set, fs_type;
type proc_zoneinfo, fs_type;
type selinuxfs, fs_type, mlstrustedobject;