tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

don't allow mounting on top of /system files/directories

Browse source 
Change-Id: If311f53b9e5a1020f188ae2346dbf6466e6129ac
This commit is contained in:
Nick Kralevich 2015-02-05 09:23:13 -08:00
parent 5ec38c49e3
commit 74df7f5934
1 changed files with 3 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
domain.te
View file

@ -297,6 +297,9 @@ neverallow { domain -init } property_data_file:file no_w_file_perms;
neverallow { domain -recovery } { system_file exec_type }:dir_file_class_set
{ create write setattr relabelfrom relabelto append unlink link rename };
# Don't allow mounting on top of /system files or directories
neverallow domain { system_file exec_type }:dir_file_class_set mounton;
# Nothing should be writing to files in the rootfs.
neverallow { domain -recovery } rootfs:file { create write setattr relabelto append unlink link rename };