tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Remove domain_deprecated from isolated_app

Browse source 
Address denials:
avc: denied { read } for name="meminfo" dev="proc" ino=4026544360 scontext=u:r:isolated_app:s0:c512,c768 tcontext=u:object_r:proc_meminfo:s0 tclass=file permissive=0

Bug: 28722489
Change-Id: I3c55bd95bb82ec54e88e9e9bc42d6392a216a936
This commit is contained in:
Jeff Vander Stoep 2016-05-12 13:22:37 -07:00 committed by Jeffrey Vander Stoep
parent 68339ac337
commit 0b430aba22
3 changed files with 4 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
app.te
View file

@ -205,6 +205,9 @@ allow appdomain console_device:chr_file { read write };
allow { appdomain -isolated_app } ion_device:chr_file rw_file_perms;
# TODO: switch to meminfo service
allow appdomain proc_meminfo:file r_file_perms;
# For app fuse.
allow appdomain app_fuse_file:file { getattr read append write };

2
isolated_app.te
View file

@ -9,7 +9,7 @@
### additional following rules:
###
type isolated_app, domain, domain_deprecated;
type isolated_app, domain;
app_domain(isolated_app)
# Access already open app data files received over Binder or local socket IPC.

3
untrusted_app.te
View file

@ -84,9 +84,6 @@ userdebug_or_eng(`
# gdbserver for ndk-gdb ptrace attaches to app process.
allow untrusted_app self:process ptrace;
# TODO: switch to meminfo service
allow untrusted_app proc_meminfo:file r_file_perms;
# access /proc/net/xt_qtguid/stats
r_dir_file(untrusted_app, proc_net)