[Galaxy Tab S General] eousphoros:
Thank you for the positive feedback. Helps keep me going.

For an update, it does indeed look like selinux was what broke youtube as its working for me again. It also appears to be whats breaking netflix.

E/wv_dash ( 2255): s5p-smem open error!!. errno(13)

--

/dev/s5p-smem u:object_r:secmem_device:s0

This is going to take more reading.

-----

D/WVCdm ( 2255): Instantiating CDM.

I/WVCdm ( 2255): Level3 Library Nov 20 2013 18:09:31

E/wv_dash ( 2255): chunk TEE virt: 0x200e08

D/WVCdm ( 2255): OEMCrypto_Initialize Level 1 success. I will use level 1.

I/WVCdm ( 2255): CdmEngine::QueryStatus

Well that worked, but I can't release that as it would be a security vuln so big you could drive a skyscraper thru.

---

The serules I was able to find for the s5p_smem device out of the stock policy. (related to media, total there are 886 rules applied to s5p_smem)

allow mediaserver s5p_smem_device : file { ioctl read write create getattr setattr lock relabelfrom relabelto append unlink link rename execute swapon quotaon mounton execute_no_trans entrypoint execmod open audit_access };

allow mediaserver s5p_smem_device : dir { ioctl read write create getattr setattr lock relabelfrom relabelto append unlink link rename execute swapon quotaon mounton add_name remove_name reparent search rmdir open audit_access execmod };

allow mediaserver s5p_smem_device : lnk_file { ioctl read write create getattr setattr lock relabelfrom relabelto append unlink link rename execute swapon quotaon mounton open audit_access execmod };

allow mediaserver s5p_smem_device : chr_file { ioctl read write create getattr setattr lock relabelfrom relabelto append unlink link rename execute swapon quotaon mounton execute_no_trans entrypoint execmod open audit_access };

allow mediaserver s5p_smem_device : blk_file { ioctl read write create getattr setattr lock relabelfrom relabelto append unlink link rename execute swapon quotaon mounton open audit_access execmod };

allow mediaserver s5p_smem_device : sock_file { ioctl read write create getattr setattr lock relabelfrom relabelto append unlink link rename execute swapon quotaon mounton open audit_access execmod };

allow mediaserver s5p_smem_device : fifo_file { ioctl read write create getattr setattr lock relabelfrom relabelto append unlink link rename execute swapon quotaon mounton open audit_access execmod };

allow media_app s5p_smem_device : file { ioctl read write create getattr setattr lock relabelfrom relabelto append unlink link rename execute swapon quotaon mounton execute_no_trans entrypoint execmod open audit_access };

allow media_app s5p_smem_device : dir { ioctl read write create getattr setattr lock relabelfrom relabelto append unlink link rename execute swapon quotaon mounton add_name remove_name reparent search rmdir open audit_access execmod };

allow media_app s5p_smem_device : lnk_file { ioctl read write create getattr setattr lock relabelfrom relabelto append unlink link rename execute swapon quotaon mounton open audit_access execmod };

allow media_app s5p_smem_device : chr_file { ioctl read write create getattr setattr lock relabelfrom relabelto append unlink link rename execute swapon quotaon mounton execute_no_trans entrypoint execmod open audit_access };

allow media_app s5p_smem_device : blk_file { getattr };

allow media_app s5p_smem_device : sock_file { ioctl read write create getattr setattr lock relabelfrom relabelto append unlink link rename execute swapon quotaon mounton open audit_access execmod };

allow media_app s5p_smem_device : fifo_file { ioctl read write create getattr setattr lock relabelfrom relabelto append unlink link rename execute swapon quotaon mounton open audit_access execmod };

---

And the stock sepolicy prohibits relableto.. man wtf is samsung doing with their seandroid stuff.

Must.. resist.. urge.. to.. disable selinux

--

On a more positive note, ssh/sftp/scp clients are now included by default in the build.

---

Ooh we can't forget about the drm side of the seandroid stuff

pbuckley@flatru:~/android/aosp$ grep drm se.out | wc -l

17652

I need a drink.