tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

allow all domain search permission for aconfig_storage_metadata_file dir

Browse source 
Just allow aconfig_storage_metadata_file:file read permission is not
enough to read the pb file, we also need
aconfig_storage_metadata_file:dir search permission.

Bug: b/312459182
Test: audit2allow after having demo app access the file
Change-Id: I1790ea84a56e83f43313af82378f245e2bb6597e
This commit is contained in:
Dennis Shen 2024-03-19 17:50:16 +00:00
parent 2fa70270a2
commit cd560f115b
2 changed files with 3 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
private/domain.te
View file

@ -815,5 +815,5 @@ neverallow { domain -init } kcmdlinectrl:process { dyntransition transition };
neverallow { domain -gmscore_app -init -vold_prepare_subdirs } checkin_data_file:{dir file} *;
# Do not allow write access to aconfig flag value files except init and aconfigd
neverallow { domain -init -aconfigd -system_server } aconfig_storage_metadata_file:dir *;
neverallow { domain -init -aconfigd -system_server } aconfig_storage_metadata_file:dir no_w_dir_perms;
neverallow { domain -init -aconfigd -system_server } aconfig_storage_metadata_file:file no_w_file_perms;

3
public/domain.te
View file

@ -346,7 +346,8 @@ get_prop(domain, device_config_media_native_prop)
# The boot copy of the flag value files serves flag read traffic for all processes, thus
# needs to be readable by everybody. Also, the metadata directory will contain pb file
# that records where flag storage files are, so also needs to be readable by everbody.
allow domain { aconfig_storage_metadata_file }:file r_file_perms;
allow domain aconfig_storage_metadata_file:file r_file_perms;
allow domain aconfig_storage_metadata_file:dir r_dir_perms;
###
### neverallow rules