Merge commit '2931f84c' into HEAD

dumpstate.te

@@ -87,6 +87,9 @@ domain_auto_trans(dumpstate, vdc_exec, vdc)
 # TODO: create a new file class, instead of allowing write access to all of /sys
 allow dumpstate sysfs:file w_file_perms;
 
+# TODO: added to match above sysfs rule. Remove me?
+allow dumpstate sysfs_usb:file w_file_perms;
+
 # Other random bits of data we want to collect
 allow dumpstate qtaguid_proc:file r_file_perms;
 allow dumpstate debugfs:file r_file_perms;
@@ -145,14 +148,6 @@ allow dumpstate cache_recovery_file:file r_file_perms;
 allow dumpstate recovery_data_file:dir r_dir_perms;
 allow dumpstate recovery_data_file:file r_file_perms;
 
-# Access /data/misc/profiles/{cur,ref}/
-userdebug_or_eng(`
-  allow dumpstate user_profile_data_file:dir r_dir_perms;
-  allow dumpstate user_profile_data_file:file r_file_perms;
-  allow dumpstate user_profile_foreign_dex_data_file:dir r_dir_perms;
-  allow dumpstate user_profile_foreign_dex_data_file:file r_file_perms;
-')
-
 # Access /data/misc/logd
 userdebug_or_eng(`
   allow dumpstate misc_logd_file:dir r_dir_perms;

healthd.te

@@ -19,6 +19,9 @@ binder_call(healthd, system_server)
 # TODO:  Split into a separate type?
 allow healthd sysfs:file write;
 
+# TODO: added to match above sysfs rule. Remove me?
+allow healthd sysfs_usb:file write;
+
 allow healthd sysfs_batteryinfo:file r_file_perms;
 
 ###

installd.te

@@ -117,6 +117,9 @@ allow installd user_profile_data_file:dir create_dir_perms;
 allow installd user_profile_data_file:file create_file_perms;
 allow installd user_profile_data_file:dir rmdir;
 allow installd user_profile_data_file:file unlink;
+allow installd user_profile_foreign_dex_data_file:dir { add_name getattr rmdir open read write search remove_name };
+allow installd user_profile_foreign_dex_data_file:file { getattr rename unlink };
+
 # Files created/updated by profman dumps.
 allow installd profman_dump_data_file:dir { search add_name write };
 allow installd profman_dump_data_file:file { create setattr open write };

lmkd.te

@@ -22,6 +22,7 @@ r_dir_file(lmkd, system_server)
 allow lmkd system_server:file write;
 
 ## Writes to /sys/module/lowmemorykiller/parameters/minfree
+r_dir_file(lmkd, sysfs_type)
 allow lmkd sysfs_lowmemorykiller:file w_file_perms;
 
 # Send kill signals

netd.te

@@ -32,6 +32,9 @@ allow netd proc_net:file write;
 # XXX Split into its own type.
 allow netd sysfs:file write;
 
+# TODO: added to match above sysfs rule. Remove me?
+allow netd sysfs_usb:file write;
+
 # Needed to update /data/misc/wifi/hostapd.conf
 # TODO: See what we can do to reduce the need for
 # these capabilities

nfc.te

@@ -17,6 +17,9 @@ allow nfc nfc_data_file:notdevfile_class_set create_file_perms;
 allow nfc sysfs_nfc_power_writable:file rw_file_perms;
 allow nfc sysfs:file write;
 
+# TODO: added to match above sysfs rule. Remove me?
+allow nfc sysfs_usb:file write;
+
 # SoundPool loading and playback
 allow nfc mediaserver_service:service_manager find;
 allow nfc audioserver_service:service_manager find;

radio.te

@@ -31,6 +31,7 @@ allow radio audioserver_service:service_manager find;
 allow radio cameraserver_service:service_manager find;
 allow radio drmserver_service:service_manager find;
 allow radio mediaserver_service:service_manager find;
+allow radio nfc_service:service_manager find;
 allow radio radio_service:service_manager { add find };
 allow radio surfaceflinger_service:service_manager find;
 allow radio app_api_service:service_manager find;

system_server.te

@@ -186,6 +186,9 @@ allow system_server sysfs_mac_address:file r_file_perms;
 allow system_server sysfs_thermal:dir search;
 allow system_server sysfs_thermal:file r_file_perms;
 
+# TODO: added to match above sysfs rule. Remove me?
+allow system_server sysfs_usb:file w_file_perms;
+
 # Access devices.
 allow system_server device:dir r_dir_perms;
 allow system_server mdns_socket:sock_file rw_file_perms;

ueventd.te

@@ -12,6 +12,7 @@ allow ueventd self:capability { chown mknod net_admin setgid fsetid sys_rawio da
 allow ueventd device:file create_file_perms;
 allow ueventd device:chr_file rw_file_perms;
 allow ueventd sysfs:file rw_file_perms;
+allow ueventd sysfs_usb:file w_file_perms;
 allow ueventd sysfs_hwrandom:file w_file_perms;
 allow ueventd sysfs_zram_uevent:file w_file_perms;
 allow ueventd sysfs_type:{ file lnk_file } { relabelfrom relabelto setattr getattr };

vold.te

@@ -90,6 +90,9 @@ allow vold self:capability { sys_ptrace kill };
 # XXX Label sysfs files with a specific type?
 allow vold sysfs:file rw_file_perms;
 
+# TODO: added to match above sysfs rule. Remove me?
+allow vold sysfs_usb:file w_file_perms;
+
 allow vold kmsg_device:chr_file rw_file_perms;
 
 # Run fsck in the fsck domain.