tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Allow system_server to read/write /proc/uid_cputime/ module

Browse source 
Bug:20182139
Change-Id: I1829a83c7d8e2698715e424a688a2753d65de868
This commit is contained in:
Adam Lesinski 2015-05-12 17:14:35 -07:00
parent 415f0ba73c
commit 3526a6696f
3 changed files with 11 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
file.te
View file

@ -13,6 +13,8 @@ type proc_bluetooth_writable, fs_type;
type proc_cpuinfo, fs_type;
type proc_net, fs_type;
type proc_sysrq, fs_type;
type proc_uid_cputime_showstat, fs_type;
type proc_uid_cputime_removeuid, fs_type;
type selinuxfs, fs_type, mlstrustedobject;
type cgroup, fs_type, mlstrustedobject;
type sysfs, fs_type, sysfs_type, mlstrustedobject;

3
genfs_contexts
View file

@ -20,6 +20,9 @@ genfscon proc /sys/kernel/randomize_va_space u:object_r:proc_security:s0
genfscon proc /sys/kernel/usermodehelper u:object_r:usermodehelper:s0
genfscon proc /sys/net u:object_r:proc_net:s0
genfscon proc /sys/vm/mmap_min_addr u:object_r:proc_security:s0
genfscon proc /uid_cputime/show_uid_stat u:object_r:proc_uid_cputime_showstat:s0
genfscon proc /uid_cputime/remove_uid_range u:object_r:proc_uid_cputime_removeuid:s0
# selinuxfs booleans can be individually labeled.
genfscon selinuxfs / u:object_r:selinuxfs:s0
genfscon cgroup / u:object_r:cgroup:s0

6
system_server.te
View file

@ -89,6 +89,12 @@ r_dir_file(system_server, domain)
allow system_server qtaguid_proc:file rw_file_perms;
allow system_server qtaguid_device:chr_file rw_file_perms;
# Read /proc/uid_cputime/show_uid_stat.
allow system_server proc_uid_cputime_showstat:file r_file_perms;
# Write /proc/uid_cputime/remove_uid_range.
allow system_server proc_uid_cputime_removeuid:file { w_file_perms getattr };
# Write to /proc/sysrq-trigger.
allow system_server proc_sysrq:file rw_file_perms;