> ## Documentation Index
> Fetch the complete documentation index at: https://qualcomm-3.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Customize security services

Customization is supported for memory and SEPolicy. For a large-size trusted application, you can customize the memory regions.

## **Customize memory**

To customize memory, this feature is available to licensed users with authorized access. If you have access, see [Qualcomm Linux Security Guide - Addendum](https://docs.qualcomm.com/bundle/resource/topics/80-80021-11A/customize-fru.html).

## **Customize SEPolicy**

Qualcomm SEPolicy depends on the upstream SEPolicy. Therefore, the upstream SEPolicy’s make system is used for building and customizing the SEPolicy.

Customization to upstream selinux policy:

* Create a Pull Request on [SELinuxProject/refpolicy](https://github.com/SELinuxProject/refpolicy/).
* Store changes as patch in `meta-qcom-distro/recipes-security/refpolicy/refpolicy-targeted/` directory and include patch in SRC\_URI `meta-qcom-distro/recipes-security/refpolicy/refpolicy-targeted_git.bbappend`
* Create a Pull Request on [qualcomm-linux/meta-qcom-distro](https://github.com/qualcomm-linux/meta-qcom-distro)
* Send patch to \[meta-selinux][https://github.com/ni/meta-selinux](https://github.com/ni/meta-selinux). Refer to \[Steps to send patches to meta-selinux][https://github.com/ni/meta-selinux/blob/nilrt/master/scarthgap/MAINTAINERS](https://github.com/ni/meta-selinux/blob/nilrt/master/scarthgap/MAINTAINERS). This step is optional as changes are automatically synced from upstream refpolicy on meta-selinux upgrade.

Customization to ostree selinux policy:

* Create a Patch on top of existing sepolicy code.
* Store changes as patch in `meta-updater/dynamic-layers/selinux/recipes-security/refpolicy/refpolicy-targeted/` directory and include patch in SRC\_URI `meta-updater/dynamic-layers/selinux/recipes-security/refpolicy/refpolicy-targeted_git.bbappend`
* Create a Pull Request on [uptane/meta-updater](https://github.com/uptane/meta-updater)

Customization to qualcomm selinux policy:

* Create a Patch on top of exisiting sepolicy code.
* Store changes as patch in `meta-qcom/dynamic-layers/selinux/recipes-security/refpolicy/refpolicy-targeted/` directory and include patch in SRC\_URI `meta-qcom/dynamic-layers/selinux/recipes-security/refpolicy/refpolicy-targeted_git.bbappend`
* Create a Pull Request on [qualcomm-linux/meta-qcom](https://github.com/qualcomm-linux/meta-qcom)

Adding sepolicy for new service/module:

* Create new `<module_name>.fc`, `<module_name>.if`, `<module_name>.te` files on top of existing selinux policy and add required selinux rules.
* Upstream the new module to [SELinuxProject/refpolicy](https://github.com/SELinuxProject/refpolicy/). Skip this step if service/module is private.
* Determine the yocto layer where service/module exist. Inside that layer, create `dynamic-layers/.../refpolicy-targeted/` for keeping sepolicy as patches and `dynamic-layers/.../refpolicy-targeted_git.bbappend` recipe to include patches.

The Qualcomm code is configured to the modular SEPolicy mode and SELinux types as targeted. To modify the SEPolicy mode and the SELinux types, do the following:

> * To change the SELinux type and mode, you can edit the [Selinux base file](https://github.com/qualcomm-linux/meta-qcom-distro/blob/main/conf/distro/include/qcom-distro-selinux.inc).

### **Compile SEPolicy**

1. Set up the build environment. For instructions, see [Qualcomm Linux Build Guide](https://dragonwingdocs.qualcomm.com/Key-Documents/Firmware-Guide/build-firmware).
2. Compiling only selinux distro:
   ```text theme={null}
   kas build meta-qcom/ci/<machine-name>.yml:meta-qcom/ci/qcom-distro-selinux.yml
   ```
3. Compiling catchall distro (This distro contains selinu with some other distro features):
   ```text theme={null}
   kas build meta-qcom/ci/<machine-name>.yml:meta-qcom/ci/qcom-distro-catchall.yml
   ```

### **Modify and build**

You can also modify and build incrementally.

The audit2allow and research tools on Ubuntu don’t support policy version35. You can run audit2allow by installing policycoreutils-python-utils.

```text theme={null}
sudo apt install policycoreutils-python-utils
```

Then run audit2allow on this shell .

Pull the policy version35 from the target `/etc/selinux/targeted/policy/policy.35`. This policy is also available in the build tree: `build/tmp/sysroots-components/<machine_name>/refpolicy-targeted/etc/selinux/targeted/policy/policy.35`

### **Capture denials**

If `denials.txt` is a file capturing the denials, use the following command to solve the denials:

```text theme={null}
audit2allow -i denails.txt -p policy.35
```

## **Provision replay protected memory block**

Replay protected memory block (RPMB) provisioning is a one time process for lifetime of the device and it’s irreversible.

* Provision RPMB for secure boot devices:
  > * RPMB is automatically provisioned with production keys during the secure boot process.
  > * Don’t provision RPMB before enabling secure boot.
  > * Don’t follow any explicit steps to provision RPMB for secure boot devices.
* Provision RPMB for non-secure boot devices:
  > * You can provision RPMB with test keys for testing and exercising certain use cases to observe the functionality similar to secure boot devices. Examples use cases include:
  >   > * Secure file system (SFS) file version information and anti-rollback protection
  >   > * Trusted application anti-rollback protection
  >
  > <Warning>
  >   Secure boot can’t be enabled on a device once RPMB is provisioned with test keys.
  > </Warning>
  >
  > * To provision RPMB with test key, see [Verify RPMB provisioning status](./verify-the-security-configurations-of-qualcomm-linux#verify-rpmb-provisioning-status)

## **Next steps**

* For common logging and debugging techniques, see [Debug Qualcomm TEE and secure devices](./debug-qualcomm-tee-and-secure-devices).
* To learn how to develop and run trusted and client applications, and for sample code and examples, see [Develop trusted and client applications](./develop-trusted-and-client-applications).