| -rwxr-xr-x | config.sh | 16 | ||||
| -rw-r--r-- | iio-qipcrtr.pp | bin | 0 -> 1288 bytes | |||
| -rw-r--r-- | iio-qipcrtr.te | 20 | ||||
| -rw-r--r-- | root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/etc/systemd/system/hexagonrpc.service | 2 | ||||
| -rw-r--r-- | root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/etc/udev/rules.d/61-sensors-surface-pro-12-inch.rules | 3 | ||||
| -rw-r--r-- | root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/usr/local/share/selinux/iio-qipcrtr.te | 19 |
6 files changed, 58 insertions, 2 deletions
@@ -644,6 +644,22 @@ install -Dm644 /tmp/SayaAndy/surface-pro-12-inch-linux-fedora/etc/systemd/system # hexagonrpc.service in through the drop-in above. systemctl enable hexagonrpc.service +# Fedora's SELinux policy has no qipcrtr_socket permissions for +# iiosensorproxy_t; the libssc backend needs them to probe the QRTR bus, and +# without them the daemon exits with "No sensors or missing kernel drivers". +# Compile and install the local module that grants them (see the .te for +# details). checkmodule/semodule_package come from checkpolicy; it stays +# installed because removing it takes policycoreutils-python-utils +# (semanage, audit2allow) with it. +dnf install -y checkpolicy +install -Dm644 /tmp/SayaAndy/surface-pro-12-inch-linux-fedora/usr/local/share/selinux/iio-qipcrtr.te \ + /usr/local/share/selinux/iio-qipcrtr.te +checkmodule -M -m -o /usr/local/share/selinux/iio-qipcrtr.mod \ + /usr/local/share/selinux/iio-qipcrtr.te +semodule_package -o /usr/local/share/selinux/iio-qipcrtr.pp \ + -m /usr/local/share/selinux/iio-qipcrtr.mod +semodule -i /usr/local/share/selinux/iio-qipcrtr.pp + # Cameras (msm/camss). Nothing has to be wired up at boot. libcamera's "simple" # pipeline handler claims qcom-camss and builds the media graph itself in # configure(), including flipping the csiphy -> msm_csid0 link between the rear diff --git a/iio-qipcrtr.pp b/iio-qipcrtr.pp Binary files differnew file mode 100644 index 0000000..9eedadb --- /dev/null +++ b/iio-qipcrtr.pp diff --git a/iio-qipcrtr.te b/iio-qipcrtr.te new file mode 100644 index 0000000..5ea7434 --- /dev/null +++ b/iio-qipcrtr.te @@ -0,0 +1,20 @@ + +module iio-qipcrtr 1.0; + +require { + type iiosensorproxy_t; + type systemd_userdbd_t; + type xdm_var_run_t; + class sock_file read; + class qipcrtr_socket { create getattr getopt setopt }; +} + +#============= iiosensorproxy_t ============== + +#!!!! This avc is allowed in the current policy +allow iiosensorproxy_t self:qipcrtr_socket { create getattr getopt setopt }; + +#============= systemd_userdbd_t ============== + +#!!!! This avc is allowed in the current policy +allow systemd_userdbd_t xdm_var_run_t:sock_file read; diff --git a/root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/etc/systemd/system/hexagonrpc.service b/root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/etc/systemd/system/hexagonrpc.service index 2e3cf82..413e84c 100644 --- a/root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/etc/systemd/system/hexagonrpc.service +++ b/root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/etc/systemd/system/hexagonrpc.service @@ -2,7 +2,7 @@ Description=HexagonRPC Service [Service] -ExecStart=/usr/local/bin/hexagonrpcd -f /dev/fastrpc-adsp-secure -s +# The kernel-surface fastrpc driver creates /dev/fastrpc-adsp (no -secure Restart=on-failure [Install] diff --git a/root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/etc/udev/rules.d/61-sensors-surface-pro-12-inch.rules b/root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/etc/udev/rules.d/61-sensors-surface-pro-12-inch.rules index e6ddb1f..064ff05 100644 --- a/root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/etc/udev/rules.d/61-sensors-surface-pro-12-inch.rules +++ b/root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/etc/udev/rules.d/61-sensors-surface-pro-12-inch.rules @@ -1 +1,2 @@ -ACTION=="add|change", SUBSYSTEM=="misc", KERNEL=="fastrpc-adsp-secure", ENV{ACCEL_MOUNT_MATRIX}="-1, 0, 0; 0, -1, 0; 0, 0, 1" +ACTION=="add|change", SUBSYSTEM=="misc", KERNEL=="fastrpc-adsp*", ENV{ACCEL_MOUNT_MATRIX}="-1, 0, 0; 0, -1, 0; 0, 0, 1" +SUBSYSTEM=="misc", KERNEL=="fastrpc-adsp*", ENV{IIO_SENSOR_PROXY_TYPE}+="ssc-accel" diff --git a/root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/usr/local/share/selinux/iio-qipcrtr.te b/root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/usr/local/share/selinux/iio-qipcrtr.te new file mode 100644 index 0000000..d92dc21 --- /dev/null +++ b/root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/usr/local/share/selinux/iio-qipcrtr.te @@ -0,0 +1,19 @@ +module iio-qipcrtr 1.0; + +// Fedora's policy grants iiosensorproxy_t no qipcrtr_socket permissions at +// all: the class exists but nothing allows it, because upstream +// iio-sensor-proxy talks to sensors over IIO and never needed QRTR. The SSC +// backend libssc brings in here reaches the Qualcomm Sensor Core over the +// QRTR bus (libssc probes AF_QIPCRTR first; the fastrpc/hexagonrpcd path is +// what actually serves this board, but the probe alone gets the daemon +// killed by "QRTR bus unavailable" + "No sensors" without these perms). +// +// Hand-written rather than audit2allow'd per-incident: create/bind/... is +// the full client lifecycle, so a policy reload or libssc update cannot +// surface a new denied perm one at a time. +require { + type iiosensorproxy_t; + class qipcrtr_socket { create bind connect read write getattr setattr getopt setopt shutdown }; +} + +allow iiosensorproxy_t self:qipcrtr_socket { create bind connect read write getattr setattr getopt setopt shutdown }; |