sepolicy: Add policy for ion_device

pvr and graphics services uses ion_device now,
update sepolicy to fix denials

Signed-off-by: Praneeth Bajjuri <praneeth@ti.com>

4 files changed, 7 insertions, 0 deletions

diff --git a/sepolicy/hal_graphics_allocator_default.te b/sepolicy/hal_graphics_allocator_default.te
new file mode 100644
index 0000000..02c6d78
--- /dev/null
+++ b/sepolicy/hal_graphics_allocator_default.te
@@ -0,0 +1 @@
+allow hal_graphics_allocator_default ion_device:chr_file write;
diff --git a/sepolicy/hal_graphics_composer_default.te b/sepolicy/hal_graphics_composer_default.te
index 457f945..2a0a6dd 100644
--- a/sepolicy/hal_graphics_composer_default.te
+++ b/sepolicy/hal_graphics_composer_default.te
@@ -1,2 +1,3 @@
 vndbinder_use(hal_graphics_composer_default);
 allow hal_graphics_composer_default self:netlink_kobject_uevent_socket create_socket_perms_no_ioctl;
+allow hal_graphics_composer_default ion_device:chr_file write;
diff --git a/sepolicy/pvr.te b/sepolicy/pvr.te
index 83b3406..53ac238 100644
--- a/sepolicy/pvr.te
+++ b/sepolicy/pvr.te
@@ -8,6 +8,9 @@ init_daemon_domain(pvr)
 # allow access to /dev/dri/
 allow pvr gpu_device:chr_file rw_file_perms;
 
+# Access /dev/ion
+allow pvr ion_device:chr_file rw_file_perms;
+
 # allow graphics driver initialization
 allow pvr self:capability sys_module;
 allow pvr vendor_file:system module_load;
diff --git a/sepolicy/surfaceflinger.te b/sepolicy/surfaceflinger.te
new file mode 100644
index 0000000..fd7dc3f
--- /dev/null
+++ b/sepolicy/surfaceflinger.te
@@ -0,0 +1,2 @@
+hal_server_domain(surfaceflinger, hal_graphics_allocator);
+allow surfaceflinger ion_device:chr_file write;