Skip to content

Commit 4b1ccc1

Browse files
rohibira-qiplrohibira-qipl
committed
Add SElinux policy for NHX test app
Signed-off-by: rohibira-qipl <rohibira@qti.qualcomm.com>
1 parent 47b0973 commit 4b1ccc1

File tree

2 files changed

+230
-0
lines changed

2 files changed

+230
-0
lines changed

‎dynamic-layers/selinux/recipes-security/refpolicy/refpolicy-targeted/0001-Add-SELinux-policy-for-nhx.sh.patch‎

Lines changed: 225 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,225 @@
1+
From 6eb99a23c15f43e84c88b156a575668180e33b2b Mon Sep 17 00:00:00 2001
2+
From: rohibira <rohibira@qti.qualcomm.com>
3+
Date: Wed, 25 Feb 2026 22:01:44 +0530
4+
Subject: [PATCH] Add SELinux policy for nhx.sh
5+
6+
This adds a new policy module for the nativehaltest camera test application.
7+
8+
Upstream-Status: Inappropriate [Qualcomm specific change]
9+
10+
Signed-off-by: Rohit Biradar <rohibira@qti.qualcomm.com>
11+
---
12+
policy/modules.conf | 6 ++
13+
policy/modules/services/qcom_nhx.fc | 10 +++
14+
policy/modules/services/qcom_nhx.if | 75 +++++++++++++++++
15+
policy/modules/services/qcom_nhx.te | 73 +++++++++++++++++++++++++++++
16+
4 files changed, 246 insertions(+)
17+
create mode 100644 policy/modules.conf
18+
create mode 100644 policy/modules/services/qcom_nhx.fc
19+
create mode 100644 policy/modules/services/qcom_nhx.if
20+
create mode 100644 policy/modules/services/qcom_nhx.te
21+
22+
diff --git a/policy/modules.conf b/policy/modules.conf
23+
new file mode 100644
24+
index 0000000..f2dda81
25+
--- /dev/null
26+
+++ b/policy/modules.conf
27+
@@ -0,0 +1,6 @@
28+
+# Layer: services
29+
+# Module: qcom_nhx
30+
+#
31+
+# Qualcomm NHX camera test launcher
32+
+#
33+
+qcom_nhx = module
34+
diff --git a/policy/modules/services/qcom_nhx.fc b/policy/modules/services/qcom_nhx.fc
35+
new file mode 100644
36+
index 0000000..0fa22b0
37+
--- /dev/null
38+
+++ b/policy/modules/services/qcom_nhx.fc
39+
@@ -0,0 +1,10 @@
40+
+# File contexts for Qualcomm NHX camera test launcher
41+
+
42+
+# Label the nhx.sh launcher script
43+
+/usr/bin/nhx\.sh -- gen_context(system_u:object_r:qcom_nhx_launcher_exec_t,s0)
44+
+
45+
+# Label nativehaltest binaries for different SoC families
46+
+/usr/bin/camx/.*/nativehaltest -- gen_context(system_u:object_r:qcom_nhx_exec_t,s0)
47+
+
48+
+# Label camera cache files
49+
+/var/cache/camera(/.*)? gen_context(system_u:object_r:qcom_camera_cache_t,s0)
50+
diff --git a/policy/modules/services/qcom_nhx.if b/policy/modules/services/qcom_nhx.if
51+
new file mode 100644
52+
index 0000000..58bfd17
53+
--- /dev/null
54+
+++ b/policy/modules/services/qcom_nhx.if
55+
@@ -0,0 +1,75 @@
56+
+## <summary>Qualcomm NHX camera test launcher</summary>
57+
+
58+
+########################################
59+
+## <summary>
60+
+## Execute nhx launcher in the nhx_launcher domain.
61+
+## </summary>
62+
+## <param name="domain">
63+
+## <summary>
64+
+## Domain allowed to transition.
65+
+## </summary>
66+
+## </param>
67+
+#
68+
+interface(`qcom_nhx_launcher_domtrans',`
69+
+ gen_require(`
70+
+ type qcom_nhx_launcher_t, qcom_nhx_launcher_exec_t;
71+
+ ')
72+
+
73+
+ corecmd_search_bin($1)
74+
+ domtrans_pattern($1, qcom_nhx_launcher_exec_t, qcom_nhx_launcher_t)
75+
+')
76+
+
77+
+########################################
78+
+## <summary>
79+
+## Execute nhx launcher in the nhx_launcher domain, and
80+
+## allow the specified role the nhx_launcher domain.
81+
+## </summary>
82+
+## <param name="domain">
83+
+## <summary>
84+
+## Domain allowed to transition.
85+
+## </summary>
86+
+## </param>
87+
+## <param name="role">
88+
+## <summary>
89+
+## Role allowed access.
90+
+## </summary>
91+
+## </param>
92+
+#
93+
+interface(`qcom_nhx_launcher_run',`
94+
+ gen_require(`
95+
+ type qcom_nhx_launcher_t;
96+
+ ')
97+
+
98+
+ qcom_nhx_launcher_domtrans($1)
99+
+ role $2 types qcom_nhx_launcher_t;
100+
+')
101+
+
102+
+########################################
103+
+## <summary>
104+
+## Execute nativehaltest in the nhx domain.
105+
+## </summary>
106+
+## <param name="domain">
107+
+## <summary>
108+
+## Domain allowed to transition.
109+
+## </summary>
110+
+## </param>
111+
+#
112+
+interface(`qcom_nhx_domtrans',`
113+
+ gen_require(`
114+
+ type qcom_nhx_t, qcom_nhx_exec_t;
115+
+ ')
116+
+
117+
+ corecmd_search_bin($1)
118+
+ domtrans_pattern($1, qcom_nhx_exec_t, qcom_nhx_t)
119+
+')
120+
+
121+
+########################################
122+
+## <summary>
123+
+## Execute nativehaltest in the nhx domain, and
124+
+## allow the specified role the nhx domain.
125+
+## </summary>
126+
+## <param name="domain">
127+
+## <summary>
128+
+## Domain allowed to transition.
129+
+## </summary>
130+
+## </param>
131+
+## <param name="role">
132+
+## <summary>
133+
+## Role allowed access.
134+
+## </summary>
135+
+## </param>
136+
+#
137+
+interface(`qcom_nhx_run',`
138+
+ gen_require(`
139+
+ type qcom_nhx_t;
140+
+ ')
141+
+
142+
+ qcom_nhx_domtrans($1)
143+
+ role $2 types qcom_nhx_t;
144+
+')
145+
diff --git a/policy/modules/services/qcom_nhx.te b/policy/modules/services/qcom_nhx.te
146+
new file mode 100644
147+
index 0000000..aad78c5
148+
--- /dev/null
149+
+++ b/policy/modules/services/qcom_nhx.te
150+
@@ -0,0 +1,73 @@
151+
+policy_module(qcom_nhx, 1.0)
152+
+
153+
+########################################
154+
+#
155+
+# Declarations
156+
+#
157+
+
158+
+type qcom_nhx_launcher_t;
159+
+type qcom_nhx_launcher_exec_t;
160+
+init_daemon_domain(qcom_nhx_launcher_t, qcom_nhx_launcher_exec_t)
161+
+
162+
+type qcom_nhx_t;
163+
+type qcom_nhx_exec_t;
164+
+init_daemon_domain(qcom_nhx_t, qcom_nhx_exec_t)
165+
+
166+
+type qcom_camera_cache_t;
167+
+files_type(qcom_camera_cache_t)
168+
+
169+
+########################################
170+
+#
171+
+# qcom_nhx_launcher local policy (nhx.sh)
172+
+#
173+
+
174+
+gen_require(`
175+
+ type initrc_t;
176+
+')
177+
+
178+
+dev_read_sysfs(qcom_nhx_launcher_t)
179+
+files_read_etc_files(qcom_nhx_launcher_t)
180+
+corecmd_exec_shell(qcom_nhx_launcher_t)
181+
+corecmd_exec_bin(qcom_nhx_launcher_t)
182+
+libs_use_ld_so(qcom_nhx_launcher_t)
183+
+libs_use_shared_libs(qcom_nhx_launcher_t)
184+
+allow qcom_nhx_launcher_t qcom_nhx_launcher_t:fifo_file { read write getattr };
185+
+domtrans_pattern(qcom_nhx_launcher_t, qcom_nhx_exec_t, qcom_nhx_t)
186+
+allow qcom_nhx_launcher_t initrc_t:unix_stream_socket { read write ioctl getattr };
187+
+
188+
+########################################
189+
+#
190+
+# qcom_nhx local policy (nativehaltest)
191+
+#
192+
+
193+
+gen_require(`
194+
+ type dma_device_t, fastrpc_device_t, fastrpc_secure_device_t, v4l_device_t;
195+
+ type var_t, debugfs_t, fs_t, default_t;
196+
+')
197+
+
198+
+dev_read_sysfs(qcom_nhx_t)
199+
+allow qcom_nhx_t qcom_nhx_exec_t:file { execute execute_no_trans };
200+
+files_read_etc_files(qcom_nhx_t)
201+
+corecmd_exec_shell(qcom_nhx_t)
202+
+corecmd_exec_bin(qcom_nhx_t)
203+
+libs_use_ld_so(qcom_nhx_t)
204+
+libs_use_shared_libs(qcom_nhx_t)
205+
+allow qcom_nhx_t qcom_nhx_t:fifo_file { read write getattr };
206+
+allow qcom_nhx_t qcom_camera_cache_t:file { read write open getattr create };
207+
+allow qcom_nhx_t qcom_camera_cache_t:dir { search read write add_name open getattr create };
208+
+filetrans_pattern(qcom_nhx_t, var_t, qcom_camera_cache_t, dir, "camera")
209+
+filetrans_pattern(qcom_nhx_t, qcom_camera_cache_t, qcom_camera_cache_t, file)
210+
+files_search_var(qcom_nhx_t)
211+
+allow qcom_nhx_t qcom_nhx_t:unix_dgram_socket { create connect write };
212+
+logging_send_syslog_msg(qcom_nhx_t)
213+
+allow qcom_nhx_t dma_device_t:chr_file { read write open ioctl getattr };
214+
+allow qcom_nhx_t fastrpc_device_t:chr_file { read write open ioctl getattr };
215+
+allow qcom_nhx_t fastrpc_secure_device_t:chr_file { read write open ioctl getattr };
216+
+allow qcom_nhx_t v4l_device_t:chr_file { read write open ioctl getattr };
217+
+allow qcom_nhx_t qcom_nhx_t:capability sys_nice;
218+
+allow qcom_nhx_t qcom_nhx_t:process signal;
219+
+allow qcom_nhx_t initrc_t:unix_stream_socket { read write ioctl getattr };
220+
+allow qcom_nhx_t fs_t:filesystem getattr;
221+
+allow qcom_nhx_t default_t:dir { search read open };
222+
+allow qcom_nhx_t debugfs_t:dir search;
223+
+allow qcom_nhx_t self:process setsched;
224+
--
225+
2.34.1

‎dynamic-layers/selinux/recipes-security/refpolicy/refpolicy-targeted_git.bbappend‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
FILESEXTRAPATHS:prepend := "${THISDIR}/${PN}:"
2+
3+
SRC_URI += " \
4+
file://0001-Add-SELinux-policy-for-nhx.sh.patch \
5+
"

0 commit comments

Comments
 (0)