add sepolicy for set_usb_irq.sh
Bug: 202103325
Test: build pass
(synced from commit 714075eba72067489d08c36b87bfed9656092b2c)
Change-Id: I309e24a5084ed33278d3fbe49e4ad1cc91b1255a
diff --git a/whitechapel_pro/file_contexts b/whitechapel_pro/file_contexts
index f439a18..1d2dd7b 100644
--- a/whitechapel_pro/file_contexts
+++ b/whitechapel_pro/file_contexts
@@ -213,3 +213,6 @@
/mnt/vendor/efs(/.*)? u:object_r:modem_efs_file:s0
/mnt/vendor/efs_backup(/.*)? u:object_r:modem_efs_file:s0
/mnt/vendor/modem_userdata(/.*)? u:object_r:modem_userdata_file:s0
+
+# USB
+/vendor/bin/hw/set_usb_irq\.sh u:object_r:set-usb-irq-sh_exec:s0
diff --git a/whitechapel_pro/set-usb-irq-sh.te b/whitechapel_pro/set-usb-irq-sh.te
new file mode 100644
index 0000000..a00fe3b
--- /dev/null
+++ b/whitechapel_pro/set-usb-irq-sh.te
@@ -0,0 +1,13 @@
+type set-usb-irq-sh, domain;
+type set-usb-irq-sh_exec, vendor_file_type, exec_type, file_type;
+init_daemon_domain(set-usb-irq-sh)
+
+allow set-usb-irq-sh vendor_toolbox_exec:file execute_no_trans;
+
+allow set-usb-irq-sh proc_irq:dir r_dir_perms;
+allow set-usb-irq-sh proc_irq:file w_file_perms;
+
+# AFAICT this happens if /proc/irq updates as we're running
+# and we end up trying to write into non-existing file,
+# which implies creation...
+dontaudit set-usb-irq-sh self:capability dac_override;
