tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

rs.te: Remove dontaudit statements

Browse source 
These dontaudit rules were in place to suppress SELinux denials due to
file descriptor leakage. The file descriptor leakage has been fixed, so
these rules are no longer necessary. Delete.

Fixes: 120983106
Test: cts-tradefed run cts-dev -m CtsRenderscriptTestCases
Change-Id: I5cad79c3526583bd2b65bd089fee9c490f6beb5e
This commit is contained in:
Nick Kralevich 2019-01-16 10:52:43 -08:00
parent 2b80559518
commit 80eec389e2
1 changed files with 0 additions and 12 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
private/rs.te
View file

@ -28,15 +28,3 @@ allow rs same_process_hal_file:file { r_file_perms execute };
# File descriptors passed from app to renderscript
allow rs untrusted_app_all:fd use;
# TODO: Explain why these dontaudits are needed. Most likely
# these are file descriptors leaking across an exec() boundary
# due to a missing O_CLOEXEC / SOCK_CLOEXEC
dontaudit rs untrusted_app_all:unix_stream_socket { read write };
dontaudit rs untrusted_app_all:fifo_file { read write };
# TODO: Explain why this is necessary. I think this is a zygote
# created logging socket and system server parceled file descriptor
# which is not using the O_CLOEXEC flag.
dontaudit rs zygote:fd use;
dontaudit rs system_server:fd use;