tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

profman/debuggerd: allow libart_file:file r_file_perms

Browse source 
Addresses the following auditallow spam:

avc: granted { read open } for comm="profman"
path="/system/lib/libart.so" dev="dm-0" ino=1368 scontext=u:r:profman:s0
tcontext=u:object_r:libart_file:s0 tclass=file

avc: granted { read open } for comm="debuggerd64"
path="/system/lib64/libart.so" dev="dm-0" ino=1897
scontext=u:r:debuggerd:s0 tcontext=u:object_r:libart_file:s0 tclass=file

avc: granted { getattr } for comm="debuggerd64"
path="/system/lib64/libart.so" dev="dm-0" ino=1837
scontext=u:r:debuggerd:s0 tcontext=u:object_r:libart_file:s0 tclass=file

Test: Policy compiles. Not a tightening of rules.
Change-Id: I501b0a6a343c61b3ca6283647a18a9a15deddf2a
This commit is contained in:
Nick Kralevich 2016-11-08 09:08:55 -08:00
parent 9785f2addd
commit 364fd19782
3 changed files with 9 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
public/debuggerd.te
View file

@ -23,7 +23,7 @@ allow debuggerd tombstone_data_file:file create_file_perms;
allow debuggerd shared_relro_file:dir r_dir_perms;
allow debuggerd shared_relro_file:file r_file_perms;
allow debuggerd domain:process { sigstop sigkill signal };
allow debuggerd exec_type:file r_file_perms;
allow debuggerd { exec_type libart_file }:file r_file_perms;
# Access app library
allow debuggerd system_data_file:file open;
# Allow debuggerd to redirect a dump_backtrace request to itself.

2
public/domain.te
View file

@ -107,8 +107,10 @@ allow domain libart_file:file { execute read open getattr };
auditallow {
domain
-appdomain
-debuggerd
-dex2oat
-dumpstate
-profman
-recovery
-zygote
} libart_file:file { execute read open getattr };

6
public/profman.te
View file

@ -2,6 +2,8 @@
type profman, domain;
type profman_exec, exec_type, file_type;
allow profman libart_file:file r_file_perms;
allow profman user_profile_data_file:file { getattr read write lock };
# Dumping profile info opens the application APK file for pretty printing.
@ -14,4 +16,8 @@ allow profman profman_dump_data_file:file { write };
allow profman installd:fd use;
###
### neverallow rules
###
neverallow profman app_data_file:notdevfile_class_set open;