tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Merge "init.te: delete kernel load policy support" into mnc-dev

Browse source
This commit is contained in:
Nick Kralevich 2015-08-02 20:08:56 +00:00 committed by Android (Google) Code Review
commit dde8290372
2 changed files with 2 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
domain.te
View file

@ -208,11 +208,10 @@ neverallow domain self:capability2 mac_override;
# Only recovery needs mac_admin to set contexts not defined in current policy. # Only recovery needs mac_admin to set contexts not defined in current policy.
neverallow { domain -recovery } self:capability2 mac_admin; neverallow { domain -recovery } self:capability2 mac_admin;
# Only init should be able to load SELinux policies. # Nobody should be able to load a new SELinux policy.
# The first load technically occurs while still in the kernel domain, # The first load technically occurs while still in the kernel domain,
# but this does not trigger a denial since there is no policy yet. # but this does not trigger a denial since there is no policy yet.
# Policy reload requires allowing this to the init domain. neverallow domain kernel:security load_policy;
neverallow { domain -init } kernel:security load_policy;
# Only init and the system_server can set selinux.reload_policy 1 # Only init and the system_server can set selinux.reload_policy 1
# to trigger a policy reload. # to trigger a policy reload.

1
init.te
View file

@ -123,7 +123,6 @@ allow init security_file:dir { create setattr };
# Reload policy upon setprop selinux.reload_policy 1. # Reload policy upon setprop selinux.reload_policy 1.
r_dir_file(init, security_file) r_dir_file(init, security_file)
allow init kernel:security load_policy;
# Any operation that can modify the kernel ring buffer, e.g. clear # Any operation that can modify the kernel ring buffer, e.g. clear
# or a read that consumes the messages that were read. # or a read that consumes the messages that were read.