tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Suppress denials for odsign console

Browse source 
When odsign spawns compos_verify it has our stdin/out connected to its
console. But none of the VM processes use stdin/out at all; they log
to logcat instead.

So instead of allowing the access (which immediately leads to the same
denials in virtualizationmanager), just suppress the audit logs.

Bug: 293259827
Test: Exercise isolated compilation successfully with no denials seen.
Change-Id: I454bb2fe106b656a9695511cbf09350402b30bdd
This commit is contained in:
Alan Stokes 2024-05-14 16:59:51 +01:00
parent 70cf2cd6e3
commit 8b80dacadc
1 changed files with 4 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
private/compos_verify.te
View file

@ -15,9 +15,10 @@ allow compos_verify apex_compos_data_file:file { rw_file_perms create };
allow compos_verify apex_art_data_file:dir search;
allow compos_verify apex_art_data_file:file r_file_perms;
# Allow odsign to redirect our stdout/stderr to log
allow compos_verify odsign:fd use;
allow compos_verify odsign_devpts:chr_file { read write };
# odsign runs us with its console as our stdin/stdout/stderr.
# But we never use them; logs go to logcat. Suppress the useless denials.
dontaudit compos_verify odsign:fd use;
dontaudit compos_verify odsign_devpts:chr_file { read write };
# Only odsign can enter the domain via exec
neverallow { domain -odsign } compos_verify:process transition;