tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Make shared_relro policy private.

Browse source 
Nothing should be depending on the details.

I haven't removed public/shared_relro.te entirely - there's a reference to shared_relro in public/app.te, and at least one reference to the domain outside of system policy.

Fix: 175867372
Test: Presubmits
Change-Id: I5fd4090f4b445520c4fa767c1835a5bb4e9cb146
This commit is contained in:
Alan Stokes 2020-12-22 15:43:23 +00:00
parent 726dc022db
commit 5b73b80b0d
2 changed files with 10 additions and 12 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
private/shared_relro.te
View file

@ -3,3 +3,13 @@ typeattribute shared_relro coredomain;
# The shared relro process is a Java program forked from the zygote, so it
# inherits from app to get basic permissions it needs to run.
app_domain(shared_relro)
allow shared_relro shared_relro_file:dir rw_dir_perms;
allow shared_relro shared_relro_file:file create_file_perms;
allow shared_relro activity_service:service_manager find;
allow shared_relro webviewupdate_service:service_manager find;
allow shared_relro package_service:service_manager find;
# StrictMode may attempt to find this service, failure is harmless.
dontaudit shared_relro network_management_service:service_manager find;

12
public/shared_relro.te
View file

@ -1,14 +1,2 @@
# Process which creates/updates shared RELRO files to be used by other apps.
type shared_relro, domain;
# Grant write access to the shared relro files/directory.
allow shared_relro shared_relro_file:dir rw_dir_perms;
allow shared_relro shared_relro_file:file create_file_perms;
# Needs to contact the "webviewupdate" and "activity" services
allow shared_relro activity_service:service_manager find;
allow shared_relro webviewupdate_service:service_manager find;
allow shared_relro package_service:service_manager find;
# StrictMode may attempt to find this service, failure is harmless.
dontaudit shared_relro network_management_service:service_manager find;