tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Make system_aconfig_storage_file domain-readable

Browse source 
Read access to this file is needed by any process that reads flags.
For now, exclude access to vendors.

Bug: 328444881
Test: m
Change-Id: I1899d2a0c61a6286fc285a532244730ad1e4a0fc
This commit is contained in:
Ted Bauer 2024-03-21 16:33:43 +00:00
parent 78dbd5ea7b
commit a2b17ab856
2 changed files with 3 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
private/aconfigd.te
View file

@ -34,10 +34,6 @@ userdebug_or_eng(`
# allow aconfigd to log to the kernel.
allow aconfigd kmsg_device:chr_file w_file_perms;
# allow aconfigd to read system/system_ext/product partition storage files
allow aconfigd system_aconfig_storage_file:file r_file_perms;
allow aconfigd system_aconfig_storage_file:dir r_dir_perms;
# allow aconfigd to read vendor partition storage files
allow aconfigd vendor_aconfig_storage_file:file r_file_perms;
allow aconfigd vendor_aconfig_storage_file:dir r_dir_perms;

6
private/domain.te
View file

@ -208,12 +208,12 @@ allow {
-hal_omx_server
} {shell_exec toolbox_exec}:file rx_file_perms;
# Allow everyone to read from flag value boot snapshot files and general pb files
# Allow all (except vendor) to read from flag value boot snapshot files and general pb files
# The boot copy of the flag value files serves flag read traffic for all processes, thus
# needs to be readable by everybody. Also, the metadata directory will contain pb file
# that records where flag storage files are, so also needs to be readable by everbody.
allow domain aconfig_storage_metadata_file:file r_file_perms;
allow domain aconfig_storage_metadata_file:dir r_dir_perms;
r_dir_file({ coredomain appdomain }, aconfig_storage_metadata_file);
r_dir_file({ coredomain appdomain }, system_aconfig_storage_file);
# processes needs to access storage file stored at /metadata/aconfig/boot, require search
# permission on /metadata dir