tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Merge "Revert "silence innocuous denials to /proc and /sys""

Browse source
This commit is contained in:
Tri Vo 2018-03-21 16:50:08 +00:00 committed by Gerrit Code Review
commit 341d34b582
2 changed files with 2 additions and 13 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

11
public/domain.te
View file

@ -1319,14 +1319,3 @@ neverallow {
-zygote
} self:capability dac_override;
neverallow domain self:capability dac_read_search;
# If an already existing file is opened with O_CREATE, the kernel might generate
# a false report of a create denial. Silence these denials and make sure that
# inappropriate permissions are not granted.
neverallow domain {
proc_type
sysfs_type
}:dir { add_name create link remove_name rename reparent rmdir write };
dontaudit domain proc_type:dir write;
dontaudit domain sysfs_type:dir write;

4
public/file.te
View file

@ -83,10 +83,10 @@ type sysfs_net, fs_type, sysfs_type;
type sysfs_power, fs_type, sysfs_type;
type sysfs_rtc, fs_type, sysfs_type;
type sysfs_switch, fs_type, sysfs_type;
type sysfs_usb, fs_type, sysfs_type;
type sysfs_usb, sysfs_type, file_type, mlstrustedobject;
type sysfs_wakeup_reasons, fs_type, sysfs_type;
type sysfs_fs_ext4_features, sysfs_type, fs_type;
type fs_bpf, fs_type;
type fs_bpf, fs_type, sysfs_type;
type configfs, fs_type;
# /sys/devices/system/cpu
type sysfs_devices_system_cpu, fs_type, sysfs_type;