From 967f39a6e88c60b5f65a37397d6619197a1d0514 Mon Sep 17 00:00:00 2001 From: Nick Kralevich Date: Wed, 30 Oct 2013 14:12:21 -0700 Subject: [PATCH] Move sysfs_devices_system_cpu to the central policy. Every device has a CPU. This is not device specific. Allow every domain to read these files/directories. For unknown reasons, these files are accessed by A LOT of processes. Allow ueventd to write to these files. This addresses the following denials seen on mako: <5>[ 4.935602] type=1400 audit(1383167737.512:4): avc: denied { read } for pid=140 comm="ueventd" name="cpu0" dev="sysfs" ino=3163 scontext=u:r:ueventd:s0 tcontext=u:object_r:sysfs_devices_system_cpu:s0 tclass=dir <5>[ 4.935785] type=1400 audit(1383167737.512:5): avc: denied { open } for pid=140 comm="ueventd" name="cpu0" dev="sysfs" ino=3163 scontext=u:r:ueventd:s0 tcontext=u:object_r:sysfs_devices_system_cpu:s0 tclass=dir <5>[ 4.935937] type=1400 audit(1383167737.512:6): avc: denied { search } for pid=140 comm="ueventd" name="cpu0" dev="sysfs" ino=3163 scontext=u:r:ueventd:s0 tcontext=u:object_r:sysfs_devices_system_cpu:s0 tclass=dir <5>[ 4.936120] type=1400 audit(1383167737.512:7): avc: denied { write } for pid=140 comm="ueventd" name="uevent" dev="sysfs" ino=3164 scontext=u:r:ueventd:s0 tcontext=u:object_r:sysfs_devices_system_cpu:s0 tclass=file <5>[ 4.936303] type=1400 audit(1383167737.512:8): avc: denied { open } for pid=140 comm="ueventd" name="uevent" dev="sysfs" ino=3164 scontext=u:r:ueventd:s0 tcontext=u:object_r:sysfs_devices_system_cpu:s0 tclass=file Change-Id: I4766dc571762d8fae06aa8c26828c070b80f5936 --- domain.te | 1 + file_contexts | 1 + ueventd.te | 1 + 3 files changed, 3 insertions(+) diff --git a/domain.te b/domain.te index 6e5e83cc6..f90d80276 100644 --- a/domain.te +++ b/domain.te @@ -106,6 +106,7 @@ allow domain sysfs_writable:file rw_file_perms; # Read access to pseudo filesystems. r_dir_file(domain, proc) r_dir_file(domain, sysfs) +r_dir_file(domain, sysfs_devices_system_cpu) r_dir_file(domain, inotify) r_dir_file(domain, cgroup) diff --git a/file_contexts b/file_contexts index be61f9ca9..5a9f1e209 100644 --- a/file_contexts +++ b/file_contexts @@ -204,6 +204,7 @@ /sys/devices/platform/nfc-power/nfc_power -- u:object_r:sysfs_nfc_power_writable:s0 /sys/class/rfkill/rfkill[0-9]*/state -- u:object_r:sysfs_bluetooth_writable:s0 /sys/class/rfkill/rfkill[0-9]*/type -- u:object_r:sysfs_bluetooth_writable:s0 +/sys/devices/system/cpu(/.*)? u:object_r:sysfs_devices_system_cpu:s0 /sys/power/wake_lock -- u:object_r:sysfs_wake_lock:s0 /sys/power/wake_unlock -- u:object_r:sysfs_wake_lock:s0 ############################# diff --git a/ueventd.te b/ueventd.te index 1562c0e88..275286bd5 100644 --- a/ueventd.te +++ b/ueventd.te @@ -14,6 +14,7 @@ allow ueventd device:chr_file rw_file_perms; allow ueventd sysfs:file rw_file_perms; allow ueventd sysfs:file setattr; allow ueventd sysfs_type:file { relabelfrom relabelto }; +allow ueventd sysfs_devices_system_cpu:file rw_file_perms; allow ueventd tmpfs:chr_file rw_file_perms; allow ueventd dev_type:dir create_dir_perms; allow ueventd dev_type:lnk_file { create unlink };