9a3e3a0501
- cgcap.ko: cpif CP-frame capture via kprobe/kallsyms, stock-GKI build - ratlock.sh: hold modem to LTE+NR(5G), block 2G/3G downgrade - cgdetect.sh: always-on behavioral cell-site-simulator detection - cgctl.sh + WebUI: block/detect toggles, status + alerts - build-stock-gki.sh: reproducible stock-GKI module build pipeline
18 lines
567 B
Plaintext
18 lines
567 B
Plaintext
# CellGuard SELinux rules.
|
|
# KernelSU-Next usually flips SELinux to permissive, but these let the
|
|
# module coexist with enforcing mode too.
|
|
|
|
# Shannon / modem AT channels
|
|
allow su umts_device chr_file { open read write ioctl getattr }
|
|
allow su radio_device chr_file { open read write ioctl getattr }
|
|
|
|
# Our own /dev/cellguard char device
|
|
allow su device chr_file { open read write ioctl getattr }
|
|
|
|
# Insmod / rmmod
|
|
allow su kernel system { module_load module_request }
|
|
allow su self capability sys_module
|
|
|
|
# /proc/cellguard/*
|
|
allow su proc file { open read getattr }
|