tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Limit mediaserver access to vendor_app_file

Browse source 
mediaserver is receiving a file passed as a file descriptor. Just read
and map is enough, and open should not be allowed for mediaserver.

Bug: 78436043
This commit is contained in:
Zheng Zhang 2018-08-17 16:15:09 -07:00
parent 50ca0a0d18
commit cc82d194bd
1 changed files with 1 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
public/mediaserver.te
View file

@ -96,7 +96,7 @@ allow mediaserver oemfs:dir search;
allow mediaserver oemfs:file r_file_perms;
# /vendor apk access
allow mediaserver vendor_app_file:file r_file_perms;
allow mediaserver vendor_app_file:file { read map };
use_drmservice(mediaserver)
allow mediaserver drmserver:drmservice {