search

mohancm / android_device_lenovo_A7010a48

Device tree for Lenovo K4 Note (MT6753)
13 stars 34 forks source link

denial fixes for fingerprint scanner #4

Closed ganeshi4u closed 7 years ago

mohancm commented 7 years ago

i think, this is not required for us.

ganeshi4u commented 7 years ago

yep not important but might fix some security flaws and also could help in increasing the accuracy of fingerprint scanner. These are the avc denials i found in the logcat.

1|root@:/ # logcat | grep 'avc'                                                                                                                      
02-11 17:57:38.300  8384  8384 I NuPlayerRendere: type=1400 audit(0.0:334): avc: denied { block_suspend } for capability=36 scontext=u:r:mediaserver:s0 tcontext=u:r:mediaserver:s0 tclass=capability2 permissive=1
02-11 17:59:36.310  1778  1778 I fingerprintd: type=1400 audit(0.0:335): avc: denied { ioctl } for path="/dev/teei_fp" dev="tmpfs" ino=567 ioctlcmd=7e02 scontext=u:r:fingerprintd:s0 tcontext=u:object_r:device:s0 tclass=chr_file permissive=1
02-11 17:59:36.330  1778  1778 I fingerprintd: type=1400 audit(0.0:336): avc: denied { write } for name="perftags" dev="tmpfs" ino=549 scontext=u:r:fingerprintd:s0 tcontext=u:object_r:device:s0 tclass=chr_file permissive=1
02-11 17:59:36.330  1778  1778 I fingerprintd: type=1400 audit(0.0:337): avc: denied { open } for path="/dev/perftags" dev="tmpfs" ino=549 scontext=u:r:fingerprintd:s0 tcontext=u:object_r:device:s0 tclass=chr_file permissive=1
02-11 17:59:36.330  1778  1778 I fingerprintd: type=1400 audit(0.0:338): avc: denied { getattr } for path="/dev/perftags" dev="tmpfs" ino=549 scontext=u:r:fingerprintd:s0 tcontext=u:object_r:device:s0 tclass=chr_file permissive=1
02-11 17:59:36.330  1778  1778 I fingerprintd: type=1400 audit(0.0:339): avc: denied { write } for name="clk_enable" dev="sysfs" ino=14703 scontext=u:r:fingerprintd:s0 tcontext=u:object_r:sysfs:s0 tclass=file permissive=1
02-11 18:01:08.870  1778  1778 I fingerprintd: type=1400 audit(0.0:340): avc: denied { write } for name="irq" dev="sysfs" ino=14704 scontext=u:r:fingerprintd:s0 tcontext=u:object_r:sysfs:s0 tclass=file permissive=1
mohancm commented 7 years ago

Still I am running selinux as permissive, once everything seems fine, I will go one with enforcing. Actually, these sepolicies aren't fit for our device. I need some more ! I will gather those once everything sets!

JonnyVR1 commented 7 years ago

This does not explain why mediaserver.te was deleted?

ganeshi4u commented 7 years ago

oops! didn't see, just this line allow mediaserver self:capability2 block_suspend; should be added at the bottom of the existing mediaserver.te file to fix the above mentioned denial shown in the logcat.