tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

runas: allow pipe communication from the shell

Browse source 
run-as won't communicate with shell via pipes. Allow it.

  nnk@nnk:~$ adb shell "cat /dev/zero | run-as com.google.foo sh -c 'cat'"
  /system/bin/sh: cat: <stdout>: Broken pipe

  <4>[ 1485.483517] type=1400 audit(1402623577.085:25): avc: denied { read } for pid=6026 comm="run-as" path="pipe:[29823]" dev="pipefs" ino=29823 scontext=u:r:runas:s0 tcontext=u:r:shell:s0 tclass=fifo_file

read is definitely needed. Not sure about write, but adding it just
in case.

Change-Id: Ifdf838b0df79a5f1e9559af57c2d1fdb8c41a201
This commit is contained in:
Nick Kralevich 2014-06-12 18:54:10 -07:00
parent b32448c90f
commit 6c9c58884a
1 changed files with 2 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
runas.te
View file

@ -5,6 +5,7 @@ type runas_exec, exec_type, file_type;
domain_auto_trans(shell, runas_exec, runas)
allow runas adbd:process sigchld;
allow runas shell:fd use;
allow runas shell:fifo_file { read write };
allow runas devpts:chr_file { read write ioctl };
# run-as reads package information.