tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Hide sys_rawio SELinux denials.

Browse source 
We often see the following denials:

avc: denied { sys_rawio } for comm="update_engine" capability=17 scontext=u:r:update_engine:s0 tcontext=u:r:update_engine:s0 tclass=capability permissive=0
avc: denied { sys_rawio } for comm="boot@1.0-servic" capability=17 scontext=u:r:hal_bootctl_default:s0 tcontext=u:r:hal_bootctl_default:s0 tclass=capability permissive=0

These are benign, so we are hiding them.

Bug: 37778617
Test: Boot device.
Change-Id: Iac196653933d79aa9cdeef7670076f0efc97b44a
This commit is contained in:
Joel Galenson 2018-04-10 10:46:45 -07:00
parent d4dd2f5710
commit bf4afae140
2 changed files with 3 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
public/hal_bootctl.te
View file

@ -4,3 +4,5 @@ binder_call(hal_bootctl_server, hal_bootctl_client)
add_hwservice(hal_bootctl_server, hal_bootctl_hwservice)
allow hal_bootctl_client hal_bootctl_hwservice:hwservice_manager find;
dontaudit hal_bootctl self:capability sys_rawio;

1
public/update_engine.te
View file

@ -19,6 +19,7 @@ wakelock_use(update_engine);
# Ignore these denials.
dontaudit update_engine kernel:process setsched;
dontaudit update_engine self:capability sys_rawio;
# Allow using persistent storage in /data/misc/update_engine.
allow update_engine update_engine_data_file:dir create_dir_perms;