tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Merge "domain: grant all domains access to zoneinfo" into oc-dev

Browse source 
am: 386f946025

Change-Id: Ieba3686f331cfa1c3a0907bf15db188a19d3f140
This commit is contained in:
Jeff Vander Stoep 2017-04-01 01:59:50 +00:00 committed by android-build-merger
commit 035a04245f
1 changed files with 11 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

15
public/domain.te
View file

@ -106,8 +106,8 @@ allow domain system_file:lnk_file { getattr read };
allow domain sysfs:lnk_file read; allow domain sysfs:lnk_file read;
# libc references /data/misc/zoneinfo for timezone related information # libc references /data/misc/zoneinfo for timezone related information
not_full_treble(`r_dir_file(domain, zoneinfo_data_file)') # This directory is considered to be a VNDK-stable
r_dir_file({ coredomain appdomain }, zoneinfo_data_file) r_dir_file(domain, zoneinfo_data_file)
# Lots of processes access current CPU information # Lots of processes access current CPU information
r_dir_file(domain, sysfs_devices_system_cpu) r_dir_file(domain, sysfs_devices_system_cpu)
@ -491,7 +491,10 @@ full_treble_only(`
-coredomain -coredomain
-appdomain -appdomain
-coredata_in_vendor_violators -coredata_in_vendor_violators
} core_data_file_type:{ }
core_data_file_type
-zoneinfo_data_file # VNDK stable API provided by libc
:{
file_class_set file_class_set
} ~{ append getattr ioctl read write }; } ~{ append getattr ioctl read write };
# do not allow vendor component access to coredomains data directories. # do not allow vendor component access to coredomains data directories.
@ -502,7 +505,11 @@ full_treble_only(`
-coredomain -coredomain
-appdomain -appdomain
-coredata_in_vendor_violators -coredata_in_vendor_violators
} { core_data_file_type -system_data_file }:dir *; } {
core_data_file_type
-system_data_file
-zoneinfo_data_file # VNDK stable API provided by libc
}:dir *;
neverallow { neverallow {
domain domain
-coredomain -coredomain