From be3ff9b93a8868f45e88f052b0388fc8501dec72 Mon Sep 17 00:00:00 2001 From: Bart Van Assche Date: Mon, 31 Jan 2022 21:33:29 +0000 Subject: [PATCH] Grant system_app permission to access cgroup_v2 directories Without this change, the migration of the blkio controller to the cgroup v2 hierarchy triggers the following denials: 01-31 19:00:59.086 4494 4494 I auditd : type=1400 audit(0.0:7): avc: denied { write } for comm=4173796E635461736B202331 name="pid_4494" dev="cgroup2" ino=3545 scontext=u:r:system_app:s0 tcontext=u:object_r:cgroup_v2:s0 tclass=dir permissive=0 01-31 19:00:59.086 4494 4494 I auditd : type=1400 audit(0.0:8): avc: denied { write } for comm=4173796E635461736B202331 name="pid_4494" dev="cgroup2" ino=3545 scontext=u:r:system_app:s0 tcontext=u:object_r:cgroup_v2:s0 tclass=dir permissive=0 01-31 19:00:59.086 4494 4494 I auditd : type=1400 audit(0.0:7): avc: denied { write } for comm=4173796E635461736B202331 name="pid_4494" dev="cgroup2" ino=3545 scontext=u:r:system_app:s0 tcontext=u:object_r:cgroup_v2:s0 tclass=dir permissive=0 01-31 19:00:59.086 4494 4494 I auditd : type=1400 audit(0.0:8): avc: denied { write } for comm=4173796E635461736B202331 name="pid_4494" dev="cgroup2" ino=3545 scontext=u:r:system_app:s0 tcontext=u:object_r:cgroup_v2:s0 tclass=dir permissive=0 Bug: 213617178 Test: Booted Android in the Cuttlefish emulator. Change-Id: I20f136d5cd58fa4ebabbb5a328fc6001b11110d7 Signed-off-by: Bart Van Assche --- private/system_app.te | 1 + 1 file changed, 1 insertion(+) diff --git a/private/system_app.te b/private/system_app.te index 8c1fdbfa0..77cca3d01 100644 --- a/private/system_app.te +++ b/private/system_app.te @@ -159,6 +159,7 @@ allow system_app { # Settings app writes to /dev/stune/foreground/tasks. allow system_app cgroup:file w_file_perms; allow system_app cgroup_v2:file w_file_perms; +allow system_app cgroup_v2:dir w_dir_perms; control_logd(system_app) read_runtime_log_tags(system_app)