tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Add neverallow to prevent reading heap dumps.

Browse source 
Bug: http://b/172518739
Test: mma
Change-Id: I12342015ddd1d8666f62317e027dae6816f53c7e
This commit is contained in:
Josh Gao 2020-12-17 16:50:40 -08:00
parent ab5e7d3671
commit 0f48b76e72
1 changed files with 3 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
public/domain.te
View file

@ -1072,6 +1072,9 @@ neverallow {
neverallow { domain -dumpstate -incidentd -system_server } tombstoned_intercept_socket:sock_file write;
neverallow { domain -dumpstate -incidentd -system_server } tombstoned_intercept_socket:unix_stream_socket connectto;
# Never allow anyone but system_server to read heapdumps in /data/system/heapdump.
neverallow { domain -init -system_server } heapdump_data_file:file read;
# Android does not support System V IPCs.
#
# The reason for this is due to the fact that, by design, they lead to global