tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
platform_system_sepolicy/public/modprobe.te

12 lines
367 B
Text
Raw Normal View History

enabled /sbin/modprobe for recovery mode This change defines new policy for modprobe (/sbin/modprobe) that should be used in both recovery and android mode. Denials: [ 16.986440] c0 437 audit: type=1400 audit(6138546.943:5): avc: denied { read } for pid=437 comm="modprobe" name="modules" dev="proc" ino=4026532405 scontext=u:object_r:modprobe:s0 tcontext=u:object_r:proc:s0 tclass=file permissive=1 [ 16.986521] c0 437 audit: type=1400 audit(6138546.943:6): avc: denied { open } for pid=437 comm="modprobe" path="/proc/modules" dev="proc" ino=4026532405 scontext=u:object_r:modprobe:s0 tcontext=u:object_r:proc:s0 tclass=file permissive=1 [ 16.986544] c0 437 audit: type=1400 audit(6138546.943:7): avc: denied { getattr } for pid=437 comm="modprobe" path="/proc/modules" dev="proc" ino=4026532405 scontext=u:object_r:modprobe:s0 tcontext=u:object_r:proc:s0 tclass=file permissive=1 Bug: 35633646 Test: Build and tested it works in sailfish recovery. The modprobe is invoked in init.rc (at the end of 'on init') with following command line exec u:r:modprobe:s0 -- /sbin/modprobe -a nilfs2 ftl Change-Id: Ie70be6f918bea6059f806e2eb38cd48229facafa
2017-03-02 09:02:29 +01:00
type modprobe, domain;
allow modprobe proc_modules:file r_file_perms;
allow modprobe self:capability sys_module;
allow modprobe to load signed kernel modules Modprobe requires this permission or the following denial will prevent loading of signed kernel modules: audit: type=1400 audit(27331649.656:4): avc: denied { search } for pid=448 comm="modprobe" scontext=u:r:modprobe:s0 tcontext=u:r:kernel:s0 tclass=key permissive=0 Bug: 62256697 Test: Verified signed module loading on sailfish. Change-Id: Idde41d1ab58e760398190d6686665a252f1823bb
2017-06-01 19:06:21 +02:00
allow modprobe kernel:key search;
enabled /sbin/modprobe for recovery mode This change defines new policy for modprobe (/sbin/modprobe) that should be used in both recovery and android mode. Denials: [ 16.986440] c0 437 audit: type=1400 audit(6138546.943:5): avc: denied { read } for pid=437 comm="modprobe" name="modules" dev="proc" ino=4026532405 scontext=u:object_r:modprobe:s0 tcontext=u:object_r:proc:s0 tclass=file permissive=1 [ 16.986521] c0 437 audit: type=1400 audit(6138546.943:6): avc: denied { open } for pid=437 comm="modprobe" path="/proc/modules" dev="proc" ino=4026532405 scontext=u:object_r:modprobe:s0 tcontext=u:object_r:proc:s0 tclass=file permissive=1 [ 16.986544] c0 437 audit: type=1400 audit(6138546.943:7): avc: denied { getattr } for pid=437 comm="modprobe" path="/proc/modules" dev="proc" ino=4026532405 scontext=u:object_r:modprobe:s0 tcontext=u:object_r:proc:s0 tclass=file permissive=1 Bug: 35633646 Test: Build and tested it works in sailfish recovery. The modprobe is invoked in init.rc (at the end of 'on init') with following command line exec u:r:modprobe:s0 -- /sbin/modprobe -a nilfs2 ftl Change-Id: Ie70be6f918bea6059f806e2eb38cd48229facafa
2017-03-02 09:02:29 +01:00
recovery_only(`
allow modprobe rootfs:system module_load;
allow modprobe rootfs:file r_file_perms;
')
allow to load kernel modules from vendor partition The kernel modules under /vendor partition has been relabeled to vendor_file. This CL allows for the modprobe to load modules labeled vendor_file. Kernel modules are loaded in init.rc with following commands: exec u:r:modprobe:s0 -- /system/bin/modprobe -d /vendor/lib/modules MODULE Bug: 35653245 Test: tested on sailfish Change-Id: I2132ca4de01c5c60476dad8496e98266de5a1bb7
2017-04-11 05:21:42 +02:00
allow modprobe { system_file vendor_file }:system module_load;
r_dir_file(modprobe, { system_file vendor_file })
Reference in a new issue Copy permalink