Merge "Revert "Revert "Move fstab files to /vendor/etc/."""
diff --git a/device-common.mk b/device-common.mk
index d59e14a..3ace81f 100644
--- a/device-common.mk
+++ b/device-common.mk
@@ -231,9 +231,10 @@
frameworks/native/data/etc/android.hardware.sensor.stepdetector.xml:$(TARGET_COPY_OUT_VENDOR)/etc/permissions/android.hardware.sensor.stepdetector.xml \
frameworks/native/data/etc/android.hardware.sensor.hifi_sensors.xml:$(TARGET_COPY_OUT_VENDOR)/etc/permissions/android.hardware.sensor.hifi_sensors.xml
-# Other hardware-specific features
+# VR features
PRODUCT_COPY_FILES += \
- frameworks/native/data/etc/android.hardware.vr.high_performance.xml:$(TARGET_COPY_OUT_VENDOR)/etc/permissions/android.hardware.vr.high_performance.xml
+ frameworks/native/data/etc/android.hardware.vr.high_performance.xml:$(TARGET_COPY_OUT_VENDOR)/etc/permissions/android.hardware.vr.high_performance.xml \
+ frameworks/native/data/etc/android.hardware.vr.headtracking-0.xml:$(TARGET_COPY_OUT_VENDOR)/etc/permissions/android.hardware.vr.headtracking.xml \
# For SPN display
PRODUCT_COPY_FILES += \
@@ -368,8 +369,6 @@
INIT_COMMON_DIAG_RC := $(TARGET_COPY_OUT_VENDOR)/etc/init/init.diag.rc
-$(call inherit-product-if-exists, vendor/fpc/device/device.mk)
-
# Modem debugger
ifneq (,$(filter userdebug eng, $(TARGET_BUILD_VARIANT)))
PRODUCT_COPY_FILES += \
diff --git a/init.common.rc b/init.common.rc
index cf28de5..5a60c78 100644
--- a/init.common.rc
+++ b/init.common.rc
@@ -512,13 +512,13 @@
group bluetooth diag system
disabled
-service per_mgr /system/bin/pm-service
+service per_mgr /vendor/bin/pm-service
class core
user system
group system
ioprio rt 4
-service per_proxy /system/bin/pm-proxy
+service per_proxy /vendor/bin/pm-proxy
class core
user system
group system
@@ -551,18 +551,18 @@
user root
group root
-service adsprpcd /system/bin/adsprpcd
+service adsprpcd /vendor/bin/adsprpcd
class main
user media
group media
-service imsqmidaemon /system/bin/imsqmidaemon
+service imsqmidaemon /vendor/bin/imsqmidaemon
class main
user system
socket ims_qmid stream 0660 system radio
group radio log diag
-service imsdatadaemon /system/bin/imsdatadaemon
+service imsdatadaemon /vendor/bin/imsdatadaemon
class main
user system
socket ims_datad stream 0660 system radio
@@ -572,14 +572,14 @@
on property:sys.ims.QMI_DAEMON_STATUS=1
start imsdatadaemon
-service ims_rtp_daemon /system/bin/ims_rtp_daemon
+service ims_rtp_daemon /vendor/bin/ims_rtp_daemon
class main
user system
socket ims_rtpd stream 0660 system radio
group radio diag inet log
disabled
-service imscmservice /system/bin/imscmservice
+service imscmservice /vendor/bin/imscmservice
class main
user system
group radio diag diag log
@@ -589,13 +589,13 @@
start ims_rtp_daemon
start imscmservice
-service ssr_setup /system/bin/ssr_setup
+service ssr_setup /vendor/bin/ssr_setup
class main
user root
group root system
oneshot
-service ss_ramdump /system/bin/subsystem_ramdump
+service ss_ramdump /vendor/bin/subsystem_ramdump
class main
user root
group root system
@@ -615,36 +615,36 @@
group root
disabled
-service cnd /system/bin/cnd
+service cnd /vendor/bin/cnd
user root
group root inet wakelock
class late_start
socket cnd stream 660 root inet
-service irsc_util /system/bin/irsc_util "/vendor/etc/sec_config"
+service irsc_util /vendor/bin/irsc_util "/vendor/etc/sec_config"
class core
user root
oneshot
-service rmt_storage /system/bin/rmt_storage
+service rmt_storage /vendor/bin/rmt_storage
class core
user root
group root system wakelock
ioprio rt 1
-service port-bridge /system/bin/port-bridge
+service port-bridge /vendor/bin/port-bridge
class main
user radio
group radio system inet
oneshot
-service qmiproxy /system/bin/qmiproxy
+service qmiproxy /vendor/bin/qmiproxy
class main
user radio
group radio diag
disabled
-service netmgrd /system/bin/netmgrd
+service netmgrd /vendor/bin/netmgrd
class main
user root
group root wifi wakelock radio inet
@@ -676,7 +676,7 @@
user system
group system inet wifi
-service loc_launcher /system/bin/loc_launcher
+service loc_launcher /vendor/bin/loc_launcher
#loc_launcher will start as root and set its uid to gps
class late_start
group gps inet diag wifi
diff --git a/marlin/android_filesystem_config.h b/marlin/android_filesystem_config.h
index 8fa87e7..d4b1e34 100644
--- a/marlin/android_filesystem_config.h
+++ b/marlin/android_filesystem_config.h
@@ -33,9 +33,9 @@
*/
static const struct fs_path_config android_device_files[] = {
{ 00700, AID_CAMERA, AID_SHELL, (1ULL << CAP_SYS_NICE), "system/bin/mm-qcamera-daemon" },
- { 00755, AID_SYSTEM, AID_SYSTEM, (1ULL << CAP_NET_BIND_SERVICE), "system/bin/pm-service" },
- { 00755, AID_SYSTEM, AID_SYSTEM, (1ULL << CAP_NET_BIND_SERVICE), "system/bin/imsdatadaemon" },
- { 00755, AID_SYSTEM, AID_RADIO, (1ULL << CAP_NET_BIND_SERVICE), "system/bin/ims_rtp_daemon" },
+ { 00755, AID_SYSTEM, AID_SYSTEM, (1ULL << CAP_NET_BIND_SERVICE), "vendor/bin/pm-service" },
+ { 00755, AID_SYSTEM, AID_SYSTEM, (1ULL << CAP_NET_BIND_SERVICE), "vendor/bin/imsdatadaemon" },
+ { 00755, AID_SYSTEM, AID_RADIO, (1ULL << CAP_NET_BIND_SERVICE), "vendor/bin/ims_rtp_daemon" },
{ 00755, AID_SYSTEM, AID_SYSTEM, (1ULL << CAP_NET_BIND_SERVICE), "system/bin/cnss-daemon"},
#ifdef NO_ANDROID_FILESYSTEM_CONFIG_DEVICE_DIRS
{ 00000, AID_ROOT, AID_ROOT, 0, "system/etc/fs_config_dirs" },
diff --git a/sailfish/android_filesystem_config.h b/sailfish/android_filesystem_config.h
index 8fa87e7..d4b1e34 100644
--- a/sailfish/android_filesystem_config.h
+++ b/sailfish/android_filesystem_config.h
@@ -33,9 +33,9 @@
*/
static const struct fs_path_config android_device_files[] = {
{ 00700, AID_CAMERA, AID_SHELL, (1ULL << CAP_SYS_NICE), "system/bin/mm-qcamera-daemon" },
- { 00755, AID_SYSTEM, AID_SYSTEM, (1ULL << CAP_NET_BIND_SERVICE), "system/bin/pm-service" },
- { 00755, AID_SYSTEM, AID_SYSTEM, (1ULL << CAP_NET_BIND_SERVICE), "system/bin/imsdatadaemon" },
- { 00755, AID_SYSTEM, AID_RADIO, (1ULL << CAP_NET_BIND_SERVICE), "system/bin/ims_rtp_daemon" },
+ { 00755, AID_SYSTEM, AID_SYSTEM, (1ULL << CAP_NET_BIND_SERVICE), "vendor/bin/pm-service" },
+ { 00755, AID_SYSTEM, AID_SYSTEM, (1ULL << CAP_NET_BIND_SERVICE), "vendor/bin/imsdatadaemon" },
+ { 00755, AID_SYSTEM, AID_RADIO, (1ULL << CAP_NET_BIND_SERVICE), "vendor/bin/ims_rtp_daemon" },
{ 00755, AID_SYSTEM, AID_SYSTEM, (1ULL << CAP_NET_BIND_SERVICE), "system/bin/cnss-daemon"},
#ifdef NO_ANDROID_FILESYSTEM_CONFIG_DEVICE_DIRS
{ 00000, AID_ROOT, AID_ROOT, 0, "system/etc/fs_config_dirs" },
diff --git a/sepolicy/atfwd.te b/sepolicy/atfwd.te
index a4f4055..780e967 100644
--- a/sepolicy/atfwd.te
+++ b/sepolicy/atfwd.te
@@ -3,6 +3,8 @@
init_daemon_domain(atfwd)
+# TODO(b/34603782): Remove this once atfwd no longer uses Binder
+typeattribute atfwd binder_in_vendor_violators;
binder_use(atfwd)
allow atfwd atfwd_service:service_manager find;
diff --git a/sepolicy/camera.te b/sepolicy/camera.te
index 938c9be..c4449d2 100644
--- a/sepolicy/camera.te
+++ b/sepolicy/camera.te
@@ -6,6 +6,8 @@
allow camera self:capability sys_nice;
+# TODO(b/36569525): Remove this once camera no longer uses Binder
+typeattribute camera binder_in_vendor_violators;
binder_use(camera)
binder_call(camera, system_server)
binder_call(camera, cameraserver)
diff --git a/sepolicy/cameraserver.te b/sepolicy/cameraserver.te
deleted file mode 100644
index 9480806..0000000
--- a/sepolicy/cameraserver.te
+++ /dev/null
@@ -1,42 +0,0 @@
-# communicate with perfd
-allow cameraserver perfd_data_file:dir search;
-allow cameraserver perfd:unix_stream_socket connectto;
-allow cameraserver perfd_data_file:sock_file write;
-
-# communicate with camera
-allow cameraserver camera:unix_dgram_socket sendto;
-allow cameraserver camera_data_file:sock_file write;
-allow cameraserver camera_device:chr_file rw_file_perms;
-
-allow cameraserver gpu_device:chr_file rw_file_perms;
-
-# access to /dev/input/event{5,10}
-allow cameraserver input_device:dir r_dir_perms;
-allow cameraserver input_device:chr_file r_file_perms;
-
-set_prop(cameraserver, camera_prop)
-
-allow cameraserver sysfs_enable_ps_sensor:file w_file_perms;
-r_dir_file(cameraserver, sysfs_type)
-# find libraries
-allow cameraserver system_file:dir r_dir_perms;
-
-# talk to system_server
-allow cameraserver system_server:unix_stream_socket { read write };
-
-allow cameraserver sensorservice_service:service_manager find;
-
-allow cameraserver self:socket { create ioctl read write };
-
-# Grant access to Qualcomm MSM Interface (QMI) radio sockets
-qmux_socket(cameraserver)
-
-# allow cameraserver to call some socket ioctls
-allowxperm cameraserver self:socket ioctl { IPC_ROUTER_IOCTL_LOOKUP_SERVER IPC_ROUTER_IOCTL_BIND_CONTROL_PORT };
-
-# ignore spurious denial
-dontaudit cameraserver graphics_device:dir search;
-
-userdebug_or_eng(`
- allow cameraserver diag_device:chr_file rw_file_perms;
-')
diff --git a/sepolicy/cnd.te b/sepolicy/cnd.te
index 8d0cd24..acd87c9 100644
--- a/sepolicy/cnd.te
+++ b/sepolicy/cnd.te
@@ -9,6 +9,9 @@
net_domain(cnd)
wakelock_use(cnd)
+# TODO(b/36576126): Remove this one cnd stops accessing /dev/binder
+typeattribute cnd binder_in_vendor_violators;
+
# do not grant net_raw, net_admin, or dac_override
allow cnd self:capability { chown fsetid setgid setuid net_bind_service};
diff --git a/sepolicy/file_contexts b/sepolicy/file_contexts
index 2ecfb2c..11fad1d 100644
--- a/sepolicy/file_contexts
+++ b/sepolicy/file_contexts
@@ -77,35 +77,35 @@
# files in firmware
/firmware(/.*)? u:object_r:firmware_file:s0
-# files in /system
-/system/bin/irsc_util u:object_r:irsc_util_exec:s0
-/system/bin/mm-pp-dpps u:object_r:mm-pp-daemon_exec:s0
-/system/bin/pm-service u:object_r:per_mgr_exec:s0
-/system/bin/pm-proxy u:object_r:per_proxy_exec:s0
-/system/bin/rmt_storage u:object_r:rmt_exec:s0
-/system/bin/time_daemon u:object_r:time_exec:s0
-/system/bin/nanoapp_cmd u:object_r:nanoapp_cmd_exec:s0
-/system/bin/netmgrd u:object_r:netmgrd_exec:s0
-/system/bin/qmuxd u:object_r:qmuxd_exec:s0
-/system/bin/mm-qcamera-daemon u:object_r:camera_exec:s0
-/system/bin/port-bridge u:object_r:port-bridge_exec:s0
-/system/bin/loc_launcher u:object_r:location_exec:s0
-/system/bin/location-mq u:object_r:location_exec:s0
-/system/bin/lowi-server u:object_r:location_exec:s0
-/system/bin/cnd u:object_r:cnd_exec:s0
-/system/bin/imsdatadaemon u:object_r:ims_exec:s0
-/system/bin/imsqmidaemon u:object_r:ims_exec:s0
-/system/bin/ims_rtp_daemon u:object_r:ims_exec:s0
-/system/bin/imscmservice u:object_r:imscm_exec:s0
-/system/bin/adsprpcd u:object_r:adsprpcd_exec:s0
-/system/bin/ATFWD-daemon u:object_r:atfwd_exec:s0
-/system/bin/cnss-daemon u:object_r:cnss-daemon_exec:s0
-/system/bin/cnss_diag u:object_r:cnss_diag_exec:s0
-/system/bin/subsystem_ramdump u:object_r:subsystem_ramdump_exec:s0
-/system/bin/ssr_setup u:object_r:ssr_setup_exec:s0
-/system/bin/ramdump u:object_r:htc_ramdump_exec:s0
-/system/bin/smlog_dump u:object_r:smlog_dump_exec:s0
-/system/bin/qsee_logger u:object_r:qsee_logger_exec:s0
+# files in /vendor
+/vendor/bin/irsc_util u:object_r:irsc_util_exec:s0
+/vendor/bin/mm-pp-dpps u:object_r:mm-pp-daemon_exec:s0
+/vendor/bin/pm-service u:object_r:per_mgr_exec:s0
+/vendor/bin/pm-proxy u:object_r:per_proxy_exec:s0
+/vendor/bin/rmt_storage u:object_r:rmt_exec:s0
+/vendor/bin/time_daemon u:object_r:time_exec:s0
+/vendor/bin/nanoapp_cmd u:object_r:nanoapp_cmd_exec:s0
+/vendor/bin/netmgrd u:object_r:netmgrd_exec:s0
+/vendor/bin/qmuxd u:object_r:qmuxd_exec:s0
+/vendor/bin/mm-qcamera-daemon u:object_r:camera_exec:s0
+/vendor/bin/port-bridge u:object_r:port-bridge_exec:s0
+/vendor/bin/loc_launcher u:object_r:location_exec:s0
+/vendor/bin/location-mq u:object_r:location_exec:s0
+/vendor/bin/lowi-server u:object_r:location_exec:s0
+/vendor/bin/cnd u:object_r:cnd_exec:s0
+/vendor/bin/imsdatadaemon u:object_r:ims_exec:s0
+/vendor/bin/imsqmidaemon u:object_r:ims_exec:s0
+/vendor/bin/ims_rtp_daemon u:object_r:ims_exec:s0
+/vendor/bin/imscmservice u:object_r:imscm_exec:s0
+/vendor/bin/adsprpcd u:object_r:adsprpcd_exec:s0
+/vendor/bin/ATFWD-daemon u:object_r:atfwd_exec:s0
+/vendor/bin/cnss-daemon u:object_r:cnss-daemon_exec:s0
+/vendor/bin/cnss_diag u:object_r:cnss_diag_exec:s0
+/vendor/bin/subsystem_ramdump u:object_r:subsystem_ramdump_exec:s0
+/vendor/bin/ssr_setup u:object_r:ssr_setup_exec:s0
+/vendor/bin/ramdump u:object_r:htc_ramdump_exec:s0
+/vendor/bin/smlog_dump u:object_r:smlog_dump_exec:s0
+/vendor/bin/qsee_logger u:object_r:qsee_logger_exec:s0
/system/bin/preloads_copy\.sh u:object_r:preloads_copy_exec:s0
diff --git a/sepolicy/hal_camera.te b/sepolicy/hal_camera.te
index de21e5c..cbe9d1f 100644
--- a/sepolicy/hal_camera.te
+++ b/sepolicy/hal_camera.te
@@ -24,7 +24,7 @@
allow hal_camera system_file:dir r_dir_perms;
# talk over binder to some binder services
-# TODO: Must be moved to HIDL
+# TODO(b/36569385): Must be moved to HIDL
binder_use(hal_camera)
binder_call(hal_camera, binderservicedomain)
diff --git a/sepolicy/hal_camera_default.te b/sepolicy/hal_camera_default.te
new file mode 100644
index 0000000..216eece
--- /dev/null
+++ b/sepolicy/hal_camera_default.te
@@ -0,0 +1,2 @@
+# TODO(b/36569385): Remove once Camera HAL no longer uses Binder
+typeattribute hal_camera_default binder_in_vendor_violators;
diff --git a/sepolicy/hal_drm_widevine.te b/sepolicy/hal_drm_widevine.te
index 4de906c..c76f3cf 100644
--- a/sepolicy/hal_drm_widevine.te
+++ b/sepolicy/hal_drm_widevine.te
@@ -5,5 +5,9 @@
type hal_drm_widevine_exec, exec_type, file_type;
init_daemon_domain(hal_drm_widevine)
+# TODO(b/36576915): Remove this once Widevine-backed DRM HAL stops using Binder services,
+# such as mediametrics service it currently attempts to use
+typeattribute hal_drm_widevine binder_in_vendor_violators;
+
allow hal_drm mediacodec:fd use;
allow hal_drm { appdomain -isolated_app }:fd use;
diff --git a/sepolicy/hal_gnss_defult.te b/sepolicy/hal_gnss_defult.te
new file mode 100644
index 0000000..0250873
--- /dev/null
+++ b/sepolicy/hal_gnss_defult.te
@@ -0,0 +1,2 @@
+# TODO(b/36576569): Remove this once hal_gnss_default stops accessing /dev/binder
+typeattribute hal_gnss_default binder_in_vendor_violators;
diff --git a/sepolicy/hal_graphics_composer_default.te b/sepolicy/hal_graphics_composer_default.te
index 36abbf5..986098a 100644
--- a/sepolicy/hal_graphics_composer_default.te
+++ b/sepolicy/hal_graphics_composer_default.te
@@ -14,7 +14,8 @@
allow hal_graphics_composer_default persist_display_file:file create_file_perms;
# Binder access (for display.qservice)
-# TODO remove after the HAL is fixed
+# TODO(35706331): Remove once Graphics Composer HAL stops using Binder
+typeattribute hal_graphics_composer_default binder_in_vendor_violators;
binder_service(hal_graphics_composer_default)
binder_use(hal_graphics_composer_default)
allow hal_graphics_composer_default surfaceflinger_service:service_manager { add find };
diff --git a/sepolicy/imscm.te b/sepolicy/imscm.te
index b095424..f57ddd6 100644
--- a/sepolicy/imscm.te
+++ b/sepolicy/imscm.te
@@ -4,6 +4,9 @@
# Started by init
init_daemon_domain(imscm)
+
+# TODO(b/36569719): Remove this once imscm stops using Binder
+typeattribute imscm binder_in_vendor_violators;
binder_use(imscm)
allow imscm imscm_service:service_manager add;
diff --git a/sepolicy/location.te b/sepolicy/location.te
index f2cf8ee..9dd7ff4 100644
--- a/sepolicy/location.te
+++ b/sepolicy/location.te
@@ -11,6 +11,8 @@
allow location self:capability { setgid setuid };
+# TODO(b/36569343): Remove this once location daemon stops using Binder
+typeattribute location binder_in_vendor_violators;
binder_use(location)
binder_call(location, system_server)
allow location hal_wifi:unix_stream_socket { read write };
@@ -34,7 +36,7 @@
# execute /vendor/bin/slim_daemon
allow location system_file:file rx_file_perms;
-# execute /system/bin/lowi-server
+# execute /vendor/bin/lowi-server
allow location location_exec:file rx_file_perms;
# /data/misc/location
diff --git a/sepolicy/per_mgr.te b/sepolicy/per_mgr.te
index 2dc65a5..8d7e773 100644
--- a/sepolicy/per_mgr.te
+++ b/sepolicy/per_mgr.te
@@ -1,4 +1,4 @@
-# Policy for /system/bin/pm-service
+# Policy for /vendor/bin/pm-service
type per_mgr, domain;
type per_mgr_exec, exec_type, file_type;
@@ -8,6 +8,8 @@
allow per_mgr per_mgr_service:service_manager add;
+# TODO(b/36570300): Remove this once per_mgr stops using Binder
+typeattribute per_mgr binder_in_vendor_violators;
binder_use(per_mgr)
binder_call(per_mgr, system_server)
binder_call(per_mgr, rild)
diff --git a/sepolicy/per_proxy.te b/sepolicy/per_proxy.te
index 72264b0..1c12caa 100644
--- a/sepolicy/per_proxy.te
+++ b/sepolicy/per_proxy.te
@@ -1,9 +1,11 @@
-# Policy for /system/bin/pm-proxy
+# Policy for /vendor/bin/pm-proxy
type per_proxy, domain;
type per_proxy_exec, exec_type, file_type;
init_daemon_domain(per_proxy)
+# TODO(b/36570130): Remove this once per_proxy stops using Binder
+typeattribute per_proxy binder_in_vendor_violators;
allow per_proxy per_mgr_service:service_manager find;
r_dir_file(per_proxy, sysfs_type)
diff --git a/sepolicy/rild.te b/sepolicy/rild.te
index 827586a..c73c32c 100644
--- a/sepolicy/rild.te
+++ b/sepolicy/rild.te
@@ -1,6 +1,8 @@
# Grant access to Qualcomm MSM Interface (QMI) radio sockets
qmux_socket(rild)
+# TODO(b/36443535): Remove this once rild stops using Binder
+typeattribute rild binder_in_vendor_violators;
allow rild audioserver_service:service_manager find;
allow rild per_mgr_service:service_manager find;
