Add SEPolicy rule for Widevine v16 upgrade
1. Add node /dev/qce
2. Allow hal_drm_widevine r/w qce_device
3. Allow tee access for secure UI to work
Bug: 136316013
Test: GtsMediaTestCases
Change-Id: I9651a98a14fe9e7ba6c47b9fc495dd1a444fb60b
diff --git a/vendor/qcom/common/device.te b/vendor/qcom/common/device.te
index 60f1373..11ec49b 100644
--- a/vendor/qcom/common/device.te
+++ b/vendor/qcom/common/device.te
@@ -10,6 +10,7 @@
type ipa_dev, dev_type;
type modem_block_device, dev_type;
type persist_block_device, dev_type;
+type qce_device, dev_type;
type qsee_ipc_irq_spss_device, dev_type;
type qdsp_device, dev_type, mlstrustedobject;
type ramdump_device, dev_type;
diff --git a/vendor/qcom/common/file_contexts b/vendor/qcom/common/file_contexts
index b273044..8d6b3e8 100644
--- a/vendor/qcom/common/file_contexts
+++ b/vendor/qcom/common/file_contexts
@@ -34,6 +34,7 @@
/dev/mnh_sm u:object_r:easel_device:s0
/dev/easelcomm-client u:object_r:easel_device:s0
/dev/pn81a u:object_r:secure_element_device:s0
+/dev/qce u:object_r:qce_device:s0
# camera rainbow sensor
/dev/vd6281 u:object_r:camera_device:s0
# pcm device receiving rainbow sensor data
diff --git a/vendor/qcom/common/hal_drm_widevine.te b/vendor/qcom/common/hal_drm_widevine.te
index a5c125e..b4a3c18 100644
--- a/vendor/qcom/common/hal_drm_widevine.te
+++ b/vendor/qcom/common/hal_drm_widevine.te
@@ -15,4 +15,5 @@
allow hal_drm_widevine mediadrm_vendor_data_file:dir create_dir_perms;
allow hal_drm_widevine mediadrm_vendor_data_file:file create_file_perms;
allow hal_drm_widevine hal_display_config_hwservice:hwservice_manager find;
+allow hal_drm_widevine qce_device:chr_file rw_file_perms;
binder_call(hal_drm_widevine, hal_graphics_composer_default)
diff --git a/vendor/qcom/common/tee.te b/vendor/qcom/common/tee.te
index 693d7c8..665fe65 100644
--- a/vendor/qcom/common/tee.te
+++ b/vendor/qcom/common/tee.te
@@ -35,3 +35,6 @@
allowxperm tee rpmb_device:blk_file ioctl MMC_IOC_CMD;
allow tee hal_display_config_hwservice:hwservice_manager find;
+
+# allow tee access for secure UI to work
+allow tee graphics_device:chr_file rw_file_perms;