tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

neverallow shell file_type:file link

Browse source 
Change-Id: I77ce4331d70edebcecc753b2e67ffab1de3ae98e
This commit is contained in:
Nick Kralevich 2015-04-16 08:43:10 -07:00
parent e96c3abe2e
commit e0c8da253c
1 changed files with 8 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
shell.te
View file

@ -75,3 +75,11 @@ allow shell domain:process getattr;
# and read other files created by init process under /data/bootchart
allow shell bootchart_data_file:dir rw_dir_perms;
allow shell bootchart_data_file:file create_file_perms;
# Do not allow shell to hard link to any files.
# In particular, if shell hard links to app data
# files, installd will not be able to guarantee the deletion
# of the linked to file. Hard links also contribute to security
# bugs, so we want to ensure the shell user never has this
# capability.
neverallow shell file_type:file link;