tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

silence innocuous denials to /proc and /sys

Browse source 
Bug: 74182216
Test: build bullhead, sailfish sepolicy
Change-Id: I6d0635a49c025870c9ecb46147e6c9a1c407fe16
This commit is contained in:
Tri Vo 2018-03-21 10:43:30 -07:00
parent 341d34b582
commit 422fb98e2e
2 changed files with 13 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

11
public/domain.te
View file

@ -1319,3 +1319,14 @@ neverallow {
-zygote
} self:capability dac_override;
neverallow domain self:capability dac_read_search;
# If an already existing file is opened with O_CREATE, the kernel might generate
# a false report of a create denial. Silence these denials and make sure that
# inappropriate permissions are not granted.
neverallow domain {
proc_type
sysfs_type
}:dir { add_name create link remove_name rename reparent rmdir write };
dontaudit domain proc_type:dir write;
dontaudit domain sysfs_type:dir write;

4
public/file.te
View file

@ -83,10 +83,10 @@ type sysfs_net, fs_type, sysfs_type;
type sysfs_power, fs_type, sysfs_type;
type sysfs_rtc, fs_type, sysfs_type;
type sysfs_switch, fs_type, sysfs_type;
type sysfs_usb, sysfs_type, file_type, mlstrustedobject;
type sysfs_usb, fs_type, sysfs_type;
type sysfs_wakeup_reasons, fs_type, sysfs_type;
type sysfs_fs_ext4_features, sysfs_type, fs_type;
type fs_bpf, fs_type, sysfs_type;
type fs_bpf, fs_type;
type configfs, fs_type;
# /sys/devices/system/cpu
type sysfs_devices_system_cpu, fs_type, sysfs_type;