tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

install_recovery: drop toolbox auditallow

Browse source 
Toolbox is definitely used from install_recovery. Addresses
the following denials:

  type=1400 audit(0.0:7): avc: granted { execute } for comm="install-recover" name="toolbox" dev="mmcblk0p41" ino=463 scontext=u:r:install_recovery:s0 tcontext=u:object_r:toolbox_exec:s0 tclass=file
  type=1400 audit(0.0:6): avc: granted { getattr } for comm="install-recover" path="/system/bin/toolbox" dev="mmcblk0p41" ino=463 scontext=u:r:install_recovery:s0 tcontext=u:object_r:toolbox_exec:s0 tclass=file
  type=1400 audit(0.0:13): avc: granted { read } for comm="log" path="/system/bin/toolbox" dev="mmcblk0p41" ino=463 scontext=u:r:install_recovery:s0 tcontext=u:object_r:toolbox_exec:s0 tclass=file
  type=1400 audit(0.0:9): avc: granted { read open } for comm="install-recover" path="/system/bin/toolbox" dev="mmcblk0p41" ino=463 scontext=u:r:install_recovery:s0 tcontext=u:object_r:toolbox_exec:s0 tclass=file

Change-Id: I51d6e474f34afe1f33ea8294a344aa71e41deead
This commit is contained in:
Nick Kralevich 2015-08-28 08:49:49 -07:00
parent 72388335d2
commit 2cc942052d
1 changed files with 0 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
install_recovery.te
View file

@ -13,9 +13,7 @@ allow install_recovery shell_exec:file rx_file_perms;
# Execute /system/bin/applypatch
allow install_recovery system_file:file rx_file_perms;
# XXX Execute toolbox. Might not be needed.
allow install_recovery toolbox_exec:file rx_file_perms;
auditallow install_recovery toolbox_exec:file rx_file_perms;
# Update the recovery block device based off a diff of the boot block device
allow install_recovery block_device:dir search;