tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Don't emit audit logs for dumpstate->keystore

Browse source 
aosp/1696825 added the ability for dumpstate to signal Keystore on
debuggable builds, but this means that there will be an audit denial
message on non-debuggable builds.  Suppress this, in particular so that
the test mentioned below can pass on -user builds.

Bug: 269672964
Test: CtsSecurityHostTestCases:android.security.cts.SELinuxHostTest#testNoBugreportDenial
Change-Id: I68a41f6b94d615f80e4d1490ec4159436693dce2
This commit is contained in:
David Drysdale 2023-03-17 12:21:32 +00:00
parent 6ad15b7c74
commit e1075f7c0c
1 changed files with 2 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
private/dumpstate.te
View file

@ -66,9 +66,11 @@ allow dumpstate {
netd
}:process signal;
# Only allow dumpstate to dump Keystore on debuggable builds.
userdebug_or_eng(`
allow dumpstate keystore:process signal;
')
dontaudit dumpstate keystore:process { signal };
# For collecting bugreports.
no_debugfs_restriction(`