initial releasecm-13.0

1 files changed, 73 insertions, 0 deletions

diff --git a/sepolicy/nvram_daemon.te b/sepolicy/nvram_daemon.te
new file mode 100644
index 0000000..9e98646
--- /dev/null
+++ b/sepolicy/nvram_daemon.te
@@ -0,0 +1,73 @@
+# ==============================================
+# Policy File of /system/binnvram_daemon Executable File 
+
+
+# ==============================================
+# Type Declaration
+# ==============================================
+
+type nvram_daemon_exec , exec_type, file_type;
+type nvram_daemon ,domain;
+
+# ==============================================
+# Android Policy Rule
+# ==============================================
+
+# ==============================================
+# NSA Policy Rule
+# ==============================================
+
+# ==============================================
+# MTK Policy Rule
+# ==============================================
+
+# permissive nvram_daemon;
+init_daemon_domain(nvram_daemon)
+
+
+
+# Date : WK14.31
+# Operation : Migration 
+# Purpose : the device is used to store Nvram backup data that can not be lost. 
+allow nvram_daemon mmcblk_device:blk_file rw_file_perms;
+allow nvram_daemon platformblk_device:blk_file rw_file_perms;
+
+
+# Date : WK14.34
+# Operation : Migration 
+# Purpose : the option is used to tell that if other processes can access nvram. 
+allow nvram_daemon system_prop:property_service set;
+
+
+# Date : WK14.35
+# Operation : chown folder and file permission 
+# Purpose : ensure nvram user can access nvram file normally when upgrade from KK/KK.AOSP to L. 
+allow nvram_daemon shell_exec:file { x_file_perms read open };
+allow nvram_daemon nvram_data_file:dir create_dir_perms;
+allow nvram_daemon nvram_data_file:file create_file_perms;
+allow nvram_daemon nvram_data_file:lnk_file read;
+allow nvram_daemon nvdata_file:dir create_dir_perms;
+allow nvram_daemon nvdata_file:file create_file_perms;
+
+allow nvram_daemon system_file:file execute_no_trans;
+
+# Date : WK14.43
+allow nvram_daemon als_ps_device:chr_file { read ioctl open };
+allow nvram_daemon mtk-adc-cali_device:chr_file { read write ioctl open };
+allow nvram_daemon gsensor_device:chr_file { read ioctl open };
+allow nvram_daemon gyroscope_device:chr_file { read ioctl open };
+allow nvram_daemon init:unix_stream_socket connectto;
+allow nvram_daemon platformblk_device:dir search;
+
+# Purpose: for property set
+allow nvram_daemon property_socket:sock_file write;
+allow nvram_daemon sysfs:file write;
+allow nvram_daemon self:capability { fowner chown dac_override fsetid };
+
+allow nvram_daemon system_data_file:dir {create write add_name};
+
+# Purpose: for backup
+allow nvram_daemon nvram_device:chr_file {read write open ioctl};
+allow nvram_daemon pro_info_device:chr_file {read write open ioctl};
+
+allow nvram_daemon block_device:dir search;