| -rwxr-xr-x | config.sh | 16 | ||||
| -rw-r--r-- | iio-qipcrtr.pp | bin | 1288 -> 0 bytes | |||
| -rw-r--r-- | iio-qipcrtr.te | 20 | ||||
| -rw-r--r-- | root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/etc/systemd/system/hexagonrpc.service | 2 | ||||
| -rw-r--r-- | root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/etc/udev/rules.d/61-sensors-surface-pro-12-inch.rules | 3 | ||||
| -rw-r--r-- | root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/usr/local/share/selinux/iio-qipcrtr.te | 19 |
6 files changed, 2 insertions, 58 deletions
@@ -644,22 +644,6 @@ install -Dm644 /tmp/SayaAndy/surface-pro-12-inch-linux-fedora/etc/systemd/system # hexagonrpc.service in through the drop-in above. systemctl enable hexagonrpc.service -# Fedora's SELinux policy has no qipcrtr_socket permissions for -# iiosensorproxy_t; the libssc backend needs them to probe the QRTR bus, and -# without them the daemon exits with "No sensors or missing kernel drivers". -# Compile and install the local module that grants them (see the .te for -# details). checkmodule/semodule_package come from checkpolicy; it stays -# installed because removing it takes policycoreutils-python-utils -# (semanage, audit2allow) with it. -dnf install -y checkpolicy -install -Dm644 /tmp/SayaAndy/surface-pro-12-inch-linux-fedora/usr/local/share/selinux/iio-qipcrtr.te \ - /usr/local/share/selinux/iio-qipcrtr.te -checkmodule -M -m -o /usr/local/share/selinux/iio-qipcrtr.mod \ - /usr/local/share/selinux/iio-qipcrtr.te -semodule_package -o /usr/local/share/selinux/iio-qipcrtr.pp \ - -m /usr/local/share/selinux/iio-qipcrtr.mod -semodule -i /usr/local/share/selinux/iio-qipcrtr.pp - # Cameras (msm/camss). Nothing has to be wired up at boot. libcamera's "simple" # pipeline handler claims qcom-camss and builds the media graph itself in # configure(), including flipping the csiphy -> msm_csid0 link between the rear diff --git a/iio-qipcrtr.pp b/iio-qipcrtr.pp Binary files differdeleted file mode 100644 index 9eedadb..0000000 --- a/iio-qipcrtr.pp +++ /dev/null diff --git a/iio-qipcrtr.te b/iio-qipcrtr.te deleted file mode 100644 index 5ea7434..0000000 --- a/iio-qipcrtr.te +++ /dev/null @@ -1,20 +0,0 @@ - -module iio-qipcrtr 1.0; - -require { - type iiosensorproxy_t; - type systemd_userdbd_t; - type xdm_var_run_t; - class sock_file read; - class qipcrtr_socket { create getattr getopt setopt }; -} - -#============= iiosensorproxy_t ============== - -#!!!! This avc is allowed in the current policy -allow iiosensorproxy_t self:qipcrtr_socket { create getattr getopt setopt }; - -#============= systemd_userdbd_t ============== - -#!!!! This avc is allowed in the current policy -allow systemd_userdbd_t xdm_var_run_t:sock_file read; diff --git a/root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/etc/systemd/system/hexagonrpc.service b/root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/etc/systemd/system/hexagonrpc.service index 413e84c..2e3cf82 100644 --- a/root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/etc/systemd/system/hexagonrpc.service +++ b/root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/etc/systemd/system/hexagonrpc.service @@ -2,7 +2,7 @@ Description=HexagonRPC Service [Service] -# The kernel-surface fastrpc driver creates /dev/fastrpc-adsp (no -secure +ExecStart=/usr/local/bin/hexagonrpcd -f /dev/fastrpc-adsp-secure -s Restart=on-failure [Install] diff --git a/root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/etc/udev/rules.d/61-sensors-surface-pro-12-inch.rules b/root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/etc/udev/rules.d/61-sensors-surface-pro-12-inch.rules index 064ff05..e6ddb1f 100644 --- a/root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/etc/udev/rules.d/61-sensors-surface-pro-12-inch.rules +++ b/root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/etc/udev/rules.d/61-sensors-surface-pro-12-inch.rules @@ -1,2 +1 @@ -ACTION=="add|change", SUBSYSTEM=="misc", KERNEL=="fastrpc-adsp*", ENV{ACCEL_MOUNT_MATRIX}="-1, 0, 0; 0, -1, 0; 0, 0, 1" -SUBSYSTEM=="misc", KERNEL=="fastrpc-adsp*", ENV{IIO_SENSOR_PROXY_TYPE}+="ssc-accel" +ACTION=="add|change", SUBSYSTEM=="misc", KERNEL=="fastrpc-adsp-secure", ENV{ACCEL_MOUNT_MATRIX}="-1, 0, 0; 0, -1, 0; 0, 0, 1" diff --git a/root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/usr/local/share/selinux/iio-qipcrtr.te b/root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/usr/local/share/selinux/iio-qipcrtr.te deleted file mode 100644 index d92dc21..0000000 --- a/root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/usr/local/share/selinux/iio-qipcrtr.te +++ /dev/null @@ -1,19 +0,0 @@ -module iio-qipcrtr 1.0; - -// Fedora's policy grants iiosensorproxy_t no qipcrtr_socket permissions at -// all: the class exists but nothing allows it, because upstream -// iio-sensor-proxy talks to sensors over IIO and never needed QRTR. The SSC -// backend libssc brings in here reaches the Qualcomm Sensor Core over the -// QRTR bus (libssc probes AF_QIPCRTR first; the fastrpc/hexagonrpcd path is -// what actually serves this board, but the probe alone gets the daemon -// killed by "QRTR bus unavailable" + "No sensors" without these perms). -// -// Hand-written rather than audit2allow'd per-incident: create/bind/... is -// the full client lifecycle, so a policy reload or libssc update cannot -// surface a new denied perm one at a time. -require { - type iiosensorproxy_t; - class qipcrtr_socket { create bind connect read write getattr setattr getopt setopt shutdown }; -} - -allow iiosensorproxy_t self:qipcrtr_socket { create bind connect read write getattr setattr getopt setopt shutdown }; |