diff --git a/extract-files.py b/extract-files.py index 717afba..7c2656a 100755 --- a/extract-files.py +++ b/extract-files.py @@ -49,7 +49,7 @@ lib_fixups: lib_fixups_user_type = { } blob_fixups: blob_fixups_user_type = { - ('vendor/bin/hw/android.hardware.security.keymint-service', 'vendor/lib64/libskeymint10device.so', 'vendor/lib64/libskeymint_cli.so'): blob_fixup() + ('vendor/bin/hw/android.hardware.security.keymint-service-qti', 'vendor/lib64/libskeymint10device.so', 'vendor/lib64/libskeymint_cli.so'): blob_fixup() .add_needed('android.hardware.security.rkp-V3-ndk.so') .replace_needed('libcrypto.so', 'libcrypto-v33.so') .replace_needed('libcppbor_external.so', 'libcppbor.so'), @@ -73,6 +73,8 @@ blob_fixups: blob_fixups_user_type = { .add_needed('libcodec2_shim.so'), 'vendor/lib64/unihal_android.so': blob_fixup() .add_needed('libui_shim.so'), + 'vendor/etc/init/android.hardware.security.keymint-service.rc': blob_fixup() + .regex_replace('android.hardware.security.keymint-service', 'android.hardware.security.keymint-service-qti'), } # fmt: skip module = ExtractUtilsModule( diff --git a/proprietary-files.txt b/proprietary-files.txt index 4b939c4..a19f783 100644 --- a/proprietary-files.txt +++ b/proprietary-files.txt @@ -925,9 +925,9 @@ vendor/lib64/libqtikeymaster4.so vendor/lib64/libspcom.so # Keymint -vendor/bin/hw/android.hardware.security.keymint-service;MODULE_SUFFIX=.samsung +vendor/bin/hw/android.hardware.security.keymint-service:vendor/bin/hw/android.hardware.security.keymint-service-qti;FIX_SONAME vendor/etc/init/android.hardware.security.keymint-service.rc -vendor/etc/vintf/manifest/android.hardware.security.keymint-service-qti.xml:vendor/etc/vintf/manifest/android.hardware.security.keymint-service.xml +vendor/etc/vintf/manifest/android.hardware.security.keymint-service-qti.xml vendor/lib64/libskeymint10device.so vendor/lib64/libskeymint_cli.so vendor/lib64/vendor.samsung.hardware.keymint-V2-ndk.so diff --git a/sepolicy/vendor/hal_keymint_default.te b/sepolicy/vendor/hal_keymint_default.te index dd3539e..4959b02 100644 --- a/sepolicy/vendor/hal_keymint_default.te +++ b/sepolicy/vendor/hal_keymint_default.te @@ -1,25 +1,24 @@ # Allow keymint HAL to read/write efs_file -allow hal_keymint_default efs_file:dir create_dir_perms; -allow hal_keymint_default efs_file:file create_file_perms; +allow vendor_hal_keymint_qti efs_file:dir create_dir_perms; +allow vendor_hal_keymint_qti efs_file:file create_file_perms; # Allow keymint HAL to read/write dak_efs_file -allow hal_keymint_default dak_efs_file:dir create_dir_perms; -allow hal_keymint_default dak_efs_file:file create_file_perms; +allow vendor_hal_keymint_qti dak_efs_file:dir create_dir_perms; +allow vendor_hal_keymint_qti dak_efs_file:file create_file_perms; # Allow keymint HAL to read/write sec_efs_file -allow hal_keymint_default sec_efs_file:dir create_dir_perms; -allow hal_keymint_default sec_efs_file:file create_file_perms; +allow vendor_hal_keymint_qti sec_efs_file:dir create_dir_perms; +allow vendor_hal_keymint_qti sec_efs_file:file create_file_perms; # Allow keymint HAL to access TZ device -allow hal_keymint_default vendor_dmabuf_qseecom_ta_heap_device:chr_file r_file_perms; -allow hal_keymint_default vendor_dmabuf_qseecom_heap_device:chr_file r_file_perms; -allow hal_keymint_default vendor_dmabuf_secure_sp_tz_heap_device:chr_file r_file_perms; -allow hal_keymint_default vendor_skp_device:chr_file r_file_perms; -allow hal_keymint_default vendor_spcom_device:chr_file rw_file_perms; -allow hal_keymint_default vendor_spss_utils_device:chr_file rw_file_perms; +allow vendor_hal_keymint_qti vendor_dmabuf_qseecom_ta_heap_device:chr_file r_file_perms; +allow vendor_hal_keymint_qti vendor_dmabuf_secure_sp_tz_heap_device:chr_file r_file_perms; +allow vendor_hal_keymint_qti vendor_skp_device:chr_file r_file_perms; +allow vendor_hal_keymint_qti vendor_spcom_device:chr_file rw_file_perms; +allow vendor_hal_keymint_qti vendor_spss_utils_device:chr_file rw_file_perms; -get_prop(hal_keymint_default, vendor_tee_listener_prop) -get_prop(hal_keymint_default, vendor_spcomlib_prop) -allow hal_keymint_default mnt_vendor_file:dir search; +get_prop(vendor_hal_keymint_qti, vendor_spcomlib_prop) -unix_socket_connect(hal_keymint_default, property, hermesd) +allow vendor_hal_keymint_qti mnt_vendor_file:dir search; + +unix_socket_connect(vendor_hal_keymint_qti, property, hermesd) diff --git a/sepolicy/vendor/hermesd.te b/sepolicy/vendor/hermesd.te index e3a1c08..14f1ec9 100644 --- a/sepolicy/vendor/hermesd.te +++ b/sepolicy/vendor/hermesd.te @@ -23,7 +23,7 @@ allow hermesd vendor_dmabuf_qseecom_ta_heap_device:chr_file r_file_perms; allow hermesd vendor_gatekeeper_data_file:dir create_dir_perms; allow hermesd vendor_gatekeeper_data_file:file create_file_perms; -allow hermesd hal_keymint_default:binder transfer; +allow hermesd vendor_hal_keymint_qti:binder transfer; set_prop(hermesd, vendor_securenvm_prop) set_prop(hermesd, vendor_securehw_prop)