Add search permission for dir with context device_t

Change-Id: Iab02928cb17abc24c54da923f78e40b4a815a9ec
CRs-Fixed: 3394867

Add sepolicy rules for sensors changes.

Change-Id: Iaf07588033c7f1eb60bbd55ad5a2884d14992e73
Signed-off-by: Raghava Chowdam <quic_rchowdam@quicinc.com>

Allow xtra-demon telux_access_data_call_ops and
telux_access_tel_private_info_read capability.

Change-Id: Icec099f18eab0c0c424cca1770ff045f1fba901f
CRs-Fixed: 3398857

 Sensor test app initializes TCU Activity Manager which in turn
 uses the underlying QMI that tries to perform a FIFO write.
 Since sensor test app doesn't have the access to power library interface,
 AVC denials are seen.
 Fix-  Adding power lib interface access under sensor client interface.

CRs-Fixed: 3359306

Change-Id: I6c0bc8e20ca8a53f3995ad616c2f8ee8e85cb6e5

Fix qwes_ipc client AVC denials on Telematics LE targets

Change-Id: I1d7bad7e515d7e670d2dce3f939796d26f78ad7e

Selinux policy will support to access the telsdk_console_app,
telux_version_app,telux_power_refd and thermal_test_app.

Change-Id: I609e72f82c3d88101199f055b9b4d3b6372b7a8b
Signed-off-by: quic_venper <quic_venper@quicinc.com>

Add dontaudit rule for dltpipes.

Change-Id: Id12a4f7b46179ab31e6716934d46699e8f36e9d3
Signed-off-by: Nishith Goswami <quic_ngoswami@quicinc.com>

Add permissions to access system-uncached heap memory.

Change-Id: I7d7c32d2855d595576784c8b38da211ab504647f
Signed-off-by: Meghana Reddy Mula <quic_mmula@quicinc.com>

QWESD SE Policy fixes for SA415M.LE.1.8 for the CR 3387393

Change-Id: I081a36e99f61dc0a34c9b7d42912ecb56bbb8c30

chrony-sock sends signal upon system resume from suspend state. Updating policy
to allow the signal to be sent.

Change-Id: I9610a7b5b3f2671cb8cfc32a7d7c550fc86fcffe

This commit adds rule to allow agm server to communicate
with telsdk audio server over dbus.

Adding selinux policy rules to allow post_boot_script to execute correctly.

Change-Id: I35bd01ce7797c145adf328d82acdaa02187f6572
Signed-off-by: Mahesh Reddy Kodidi <quic_mahreddy@quicinc.com>

Telux Power Reference Service can listen for and act on triggers like
SMS, CAN

Change-Id: I3cd4839201c2230f94b9f06133a212be3bd5eed1

tsens-service interacts with thermal-engine via abstract
socket.Though abstract socket are not found on storage,
tsens-service first searches the /dev/socket directory
for it.This will not impact any operation, hence add
a dontaudit rule for the same.

Change-Id: I3b8b7ee3c223c4c653c559815d7150f1a63b21ff

Added rules for proc_t access for create_qwes_ipc init script.

Change-Id: If26a250dbef725e3f4e2cd5fd788be5e2dfd2f9c

Add copy bind permmision for telsdk files (tel.conf), which makes
tel.conf editable without remount operation.

CRs-Fixed: 3381914

Change-Id: I9132874e6c4aa301b47164822a7b20f128078ec7

The underlying location API used by kinematics-server has been updated,
kinematics-server need to update the rules to accommadate the update.

CRs-Fixed: 3379001
Change-Id: Ibab971bb33728124141a73c12da525c59da50d9e

Add rules to allow systemd create kinematics pid file in /run directory.

Change-Id: I798cf2123c891ecafd4c6c6f7d946ff9a007b99b

Provide unix_dgram_socket access to various services
engine_Service, loc_hald_t, slim_daemon

Change-Id: I51de6e01fa6a66ab657a1214cc41aedd514704e0
CRs-Fixed: 3373179

qwesd.fc:
1. Added contexts for /dev/socket/qwes/* & /dev/socket/qwes/qwes_ipc which
are used to create socket node for qwes_ipc.
2. Created context for create_qwes_ipc initscript which is used to initialize
/dev/socket/qwes path and set the permissions & ownerships for it.
qwesd.te:
1. Added types for qwes_mink_socket_t: used to define type for qwes_ipc socket
2. Added types for /dev/dma_heap/qcom,qseecom & /dev/dma_heap/qcom,qseecom-ta,
which are required to load QWES TA using qseecom_start_app_v2 API
3. Added filesystem assosciate permissions for qwes_mink_socket_t to properly assign
contexts for the qwes_ipc node.
4. Added write permission to the qwes_ipc socket to bind to it & access the socket.
5. Added permissions for qwesd to access /dev/dma_heap/qcom,qseecom node to read,ioctl,open the
chr driver node.
6. Added permission for qwesd to process signals
7. Added qwesd permissions for /dev/dma_heap/qcom,qseecom-ta node.
8. Allowing qwesd to be restartable in debug/engg build environments.
9. Added types for create_qwes_ipc init script.
10. Added permissions for create_qwes_ipc script to create the /dev/socket/qwes/ directory.
11. Added permisisons for create_qwes_ipc to write logs to /dev/kmsg
12. Added create_qwes_ipc permissions to write to /etc/ to set the permission & access data using
chmod/chown on the /dev/socket/qwes/ path
vendor.fc:
1. Added context for /dev/dma_heap/qcom,qseecom-ta dev node.
vendor.te:
1. Added types for /dev/dma_heap/qcom,qseecom-ta dev node.

Change-Id: Ic07d9cb8b82ffc5b1b524e39212b1bb6914f06be

Add rules for dhcpcd feature

Change-Id: I74ebaee14c2470ba5346557dbd56436c3502cd32

Enable dbus message sending.

Change-Id: Ib49585e43b29f2ebad7814c4793f1cc7ec2ac9a3

Add sepolicy rules for sensors.
This rule is added as part of signal handler (SIGTERM)
in SHD.

Change-Id: I1b02bae9a099a69f7b1e03f2f32ee374317cc258
Signed-off-by: Raghava Chowdam <quic_rchowdam@quicinc.com>

- Add rules for telux_crypto_accel_app (MVM console app)
- Update rules for telux_crypto_app

Change-Id: I394d40d893a1076f92292c7ac7bb8ff27aaaa39d

telux_allow_loc call new generic macro that include all required
rules for location client, remove redundant rules in chrony-sock.

CRs-Fixed: 3357917

Signed-off-by: yma <quic_yma@quicinc.com>

Add SElinux rule for sensor multi-client framework enablement
for sensors– ASM330,SMI130,SMI230 and IAM20680

Change-Id: I5bfcd1d38f2d5a8bb8d5c04061005aa420db43ea
CRs-Fixed: 3336002

Fix following three avc denials:

avc: denied { search } comm="telux_audio_ser" name="dbus"
dev="tmpfs" ino=96 scontext=system_u:system_r:
telux_audio_server_t:s0-s15:c0.c1023 tcontext=system_u:
object_r:system_dbusd_var_run_t:s0 tclass=dir

avc: denied { write } comm="telux_audio_ser"
name="system_bus_socket" dev="tmpfs" scontext=system_u:
system_r:telux_audio_server_t:s0-s15:c0.c1023 tcontext=
system_u:object_r:system_dbusd_var_run_t:s0 tclass=
sock_file

avc: denied { connectto } comm="telux_audio_ser"
path="/run/dbus/system_bus_socket" scontext=system_u:
system_r:telux_audio_server_t:s0-s15:c0.c1023 tcontext=
system_u:system_r:system_dbusd_t:s0-s15:c0.c1023
tclass=unix_stream_socket

Change-Id: I3bb5122b1edc2da3aa1a1f6c04be227c0d1341ad

Add selinux rule for powermanager daemon.

Change-Id: If4a0429d7545beb76fa48c2b99b12474628ce023