tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Suppress noisy performanced denials in permissive mode.

Browse source 
The sheer volume of these can cause confusion.

Sample denials (repeated for many processes):
denied { getattr } for path="/proc/1/status" dev="proc" ino=24427 scontext=u:r:performanced:s0 tcontext=u:r:init:s0 tclass=file permissive=1
denied { open } for path="/proc/1" dev="proc" ino=18608 scontext=u:r:performanced:s0 tcontext=u:r:init:s0 tclass=dir permissive=1
denied { open } for path="/proc/1/status" dev="proc" ino=24427 scontext=u:r:performanced:s0 tcontext=u:r:init:s0 tclass=file permissive=1
denied { read } for name="status" dev="proc" ino=24427 scontext=u:r:performanced:s0 tcontext=u:r:init:s0 tclass=file permissive=1

Bug: 72643420
Test: Denials no longer present in permissive mode.
Change-Id: Ic07b9b0b59ca2122c4843095b63075ab8fd2c70b
This commit is contained in:
Alan Stokes 2018-02-27 10:42:12 +00:00
parent f98cd4faab
commit cf71a5ae60
1 changed files with 7 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
public/performanced.te
View file

@ -19,5 +19,12 @@ r_dir_file(performanced, { appdomain bufferhubd kernel surfaceflinger })
dontaudit performanced domain:dir read;
allow performanced { appdomain bufferhubd kernel surfaceflinger }:process setsched;
# These /proc accesses only show up in permissive mode but they
# generate a lot of noise in the log.
userdebug_or_eng(`
dontaudit performanced domain:dir open;
dontaudit performanced domain:file { open read getattr };
')
# Access /dev/cpuset/cpuset.cpus
r_dir_file(performanced, cgroup)