Change-Id: I4d0d8dcea7581cd7a283495b26ab51794b4cfa53

Add sepolicy rules for hibernate feature support
with encryption enabled.

Tests: No AVC denials observed after hibernate exit.

Change-Id: Ic4209a423a1eb2efd22e121c505701abf025b4f8

Remove format error for qseecomd.if

Change-Id: I8db8e17cbfc880257d4b5bec8738513a81d1a0ba
Signed-off-by: jbhalani <quic_jbhalani@quicinc.com>

In order to enable Tunnel Invoke in TVMPrelauncher,
we have to add Sepolicy permission to accessQRTR socket.

Change-Id: I7cf806a4eb2984649003fc836414fa20e489465b

fbe service needs to verify existance of file created
by qseecomd service in /data/vendor/tzstorage to indicate
completion of listener registration.
Test: FBE service up and running.

Change-Id: Ia3fae834a7dc328a8b2fda8f454495913a51878d

Change-Id: I3d647d843d62baea153e3215bf9dea8ee57ec05a

Denials observed:

avc: denied { search } for pid=1554 comm="start_usb"
name="soc0" dev="sysfs" ino=50043 scontext=system_u:
system_r:usb_t:s0-s15:c0.c1023 tcontext=system_u:object_r:
image_variant_sysfs_t:s0 tclass=dir permissive=1

avc: denied { getattr } for pid=1554 comm="start_usb"
path="/sys/devices/soc0/hw_platform" dev="sysfs"
ino=50121 scontext=system_u:system_r:usb_t:s0-s15:c0.c1023
tcontext=system_u:object_r:image_variant_sysfs_t:s0
tclass=file permissive=1

avc: denied { read } for pid=1559 comm="cat"
name="hw_platform" dev="sysfs" ino=50121
scontext=system_u:system_r:usb_t:s0-s15:c0.c1023
tcontext=system_u:object_r:image_variant_sysfs_t:s0
tclass=file permissive=1

avc: denied { open } for pid=1559 comm="cat"
path="/sys/devices/soc0/hw_platform" dev="sysfs"
ino=50121 scontext=system_u:system_r:usb_t:s0-s15:c0.c1023
tcontext=system_u:object_r:image_variant_sysfs_t:s0
tclass=file permissive=1

Change-Id: Idb17a0da5903dbfd115576f81b53e7deb83c597d
Signed-off-by: Krishna Kurapati <quic_kriskura@quicinc.com>

Set sepolicy for wpa_supplicant-2.10 to avoid denial issues.

Change-Id: I0c268ce3343372cba353d738eed776affcd28e32
Signed-off-by: Vatte Vishnuvardhan Reddy <quic_vishnuvr@quicinc.com>
(cherry picked from commit 148b871d)
(cherry picked from commit b743a1ae)

Change-Id: Ifc49c4f5b50127b4009868ca2d3f72a31944ad39

Increase the ms heap number to meet concurrent scenario

Change-Id: I984e746a4d0a97eed8f1f51f5b3ce95cc623a735

Dependency on proprietary layer meta-qti-bsp-prop is causing
parser issue while enabling open source only yocto toolchain
compilation.

Change-Id: Ia9c23f1d4c6a07607c384bf74a95835c4f77a5af

Updated ODL node /dev/ipa_odl_ctl context

Change-Id: Ibbcdd3666a515540c7504f50b3b956eddd580b3b

Context setting for /dev/ipa_odl_ctl node moved to ipacm.fc and added a context for
/dev/ipa_adpl node
Change-Id: I63f6d95387e5d840c5b0cc8e64d57d650931a143
Signed-off-by: Umed Singh Rana <quic_urana@quicinc.com>

- Needed for FR79411
- add getattr rights for iptabes

Change-Id: I1936f8813ef004098a691f8169350beabbc56e4e
(cherry picked from commit a304479a)

Begin to cleanup existing bind mount rules

Change-Id: I2dd9fcca5b31e640d7e647aee3da6994ce69c643

  * qcmap_var_run_t permission extended to read and watch

Change-Id: Ia500916a9e060b6ee519fe1f083a252ffb6f6aae
(cherry picked from commit da17fc54)

Denials are required due to location libraries using le properties
api

Change-Id: I432c12596a0e568159bf2f3a2b58acfa3192d74a
CRs-Fixed: 3694863
(cherry picked from commit 79efc029)

/dev/socket/root and some others in /dev/socket are sockets, not
character files. Use -s instead of -c so that the correct labels
survive restorecon requests.

Change-Id: I97e5bb6ae1be8f60b6d3b7cbac7cab97cdceb782

  * system_data_t permission extended.

Change-Id: I5b16ab71b099ed20f9fb06f75f311a4ecd6657dc
(cherry picked from commit df0b8cc5)

For NTS KE port secure NTP provide connect permission

Change-Id: Idb748791a9957ee48bfbac771f4c6addcdc8572d
CRs-Fixed: 3786172
(cherry picked from commit 1a1de787)

This reverts commit 5860db20.

Reason for revert: Reapply change now that QeSDK has merged

Change-Id: I3f98d1f08b424bda1ff978c3b3d05b6e2f6739da

With recent changes location client will read passwd and nsswitch
to check the uid. Updated the generic loc client policy to allow
this.

Change-Id: I96ed3882e931bd002fc24a07f23069eed30aba25

Change-Id: Icdddff1caa683686273474d9104c33f584c782e8
Signed-off-by: xiangxuy <quic_xiangxuy@quicinc.com>

1: Add qesdk_manager/qesdk-one/qsap_santiy sepolicy
2: Allow test app with unconfined domain to access qesdk.

Change-Id: I038eab00b96675bcf9b6b37855f313061ac6b66d
CRs-Fixed: 3835396

Create a dedicated refpolicy-mls-auto recipe for auto targets.

Change-Id: I01adba5d133fb25f3d0c7c53ee3d120df30703c9

This reverts commit 3726e140.

Reason for revert: TEMP Revert while awaiting QeSDK dependency

Change-Id: I1a1003d056b8059cd8b81d6b44bc96348d627473

Add rules to allow LE DCF HAL to commune with QESDK,
as well as rules to start and stop the daemon.

Change-Id: I16b3d17b937ab170a9ffed0b81e504511a53c840
(cherry picked from commit 355bdd01)

Change adds rules for tui demura heap.

Change-Id: I3b55f60e7f5d6109f88c4c27732690a86b1c542a