tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Merge "Allow system_server to reopen its own memfd." into main am: ab0272ccb4 am: c488d0bd8f

Browse source 
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/3094247

Change-Id: Icf0ae50e46dae55fab19d14292082f563a9eda5d
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
This commit is contained in:
Treehugger Robot 2024-05-23 14:34:21 +00:00 committed by Automerger Merge Worker
commit 95059f3ae7
1 changed files with 5 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
private/system_server.te
View file

@ -1645,6 +1645,11 @@ neverallow {
# in Pre-reboot Dexopt.
allow system_server pre_reboot_dexopt_file:dir { getattr search };
# Allow system_server to reopen its own memfd.
# system_server needs to copy the new service-art.jar to a memfd and reopen it with the path
# /proc/self/fd/<fd> with a classloader.
allow system_server system_server_tmpfs:file open;
# Do not allow any domain other than init or system server to get or set the property
neverallow { domain -init -system_server } crashrecovery_prop:property_service set;
neverallow { domain -init -dumpstate -system_server } crashrecovery_prop:file no_rw_file_perms;