Merge "Disallow sysfs_leds to coredomains." am: 5d5284ad93

am: abe248d14d Change-Id: Id7202a1c4a991e0f130bf34a0adb7f913434a617
2018-01-19 08:01:58 +00:00 · 2018-01-19 08:01:58 +00:00 · 977949e360
commit 977949e360
parent 0399f1e452 abe248d14d
1 changed files with 15 additions and 0 deletions
--- a/private/coredomain.te
+++ b/private/coredomain.te
@ -1,2 +1,17 @@
 get_prop(coredomain, pm_prop)
 get_prop(coredomain, exported_pm_prop)
+
+full_treble_only(`
+neverallow {
+    coredomain
+    -init
+    -vendor_init
+
+    # generic access to sysfs_type
+    -ueventd
+    -vold
+    -priv_app
+    -storaged
+    -system_app
+} sysfs_leds:file *;
+')