tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Merge "init: lock down access to keychord_device"

Browse source 
am: 53cabd6c35

Change-Id: Ic1ae863280e265db56f123e3d006bbaec2a47126
This commit is contained in:
Mark Salyzyn 2018-04-17 13:03:13 -07:00 committed by android-build-merger
commit 27696cae57
1 changed files with 8 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
public/domain.te
View file

@ -363,6 +363,14 @@ neverallow {
-system_server -system_server
-ueventd -ueventd
} hw_random_device:chr_file *; } hw_random_device:chr_file *;
# b/78174219 b/64114943
neverallow {
domain
-init
-shell # stat of /dev, getattr only
-vendor_init
-ueventd
} keychord_device:chr_file *;
# Ensure that all entrypoint executables are in exec_type or postinstall_file. # Ensure that all entrypoint executables are in exec_type or postinstall_file.
neverallow * { file_type -exec_type -postinstall_file }:file entrypoint; neverallow * { file_type -exec_type -postinstall_file }:file entrypoint;