tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Merge "Add domain level neverallow to restrict access to ptrace"

Browse source
This commit is contained in:
Nikita Ioffe 2023-03-29 11:46:26 +00:00 committed by Gerrit Code Review
commit 1b4e9393d3
2 changed files with 4 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
microdroid/system/private/crash_dump.te
View file

@ -63,4 +63,5 @@ userdebug_or_eng(`
}:process { ptrace signal sigchld sigstop sigkill };
')
neverallow crash_dump self:process ptrace;
neverallow crash_dump no_crash_dump_domain:process ptrace;

3
microdroid/system/private/domain.te
View file

@ -538,3 +538,6 @@ neverallow no_crash_dump_domain crash_dump:process { transition dyntransition };
# Ensure that no one can execute from encrypted storage, which is a writable partition in VM.
neverallow domain encryptedstore_file:file no_x_file_perms;
# Only crash_dump is allowed to access ptrace
neverallow { domain -crash_dump } domain:process ptrace;