tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Allow init to mount filesystems on properly labeled folders

Browse source 
Change-Id: I08aaf89e2ef23f9528d107a1c9d66c1c9979b3ac
This commit is contained in:
Daniel Rosenberg 2015-07-23 21:01:13 -07:00
parent d21855824d
commit e244f2d355
2 changed files with 3 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
domain.te
View file

@ -327,7 +327,8 @@ neverallow { domain -recovery } { system_file exec_type }:dir_file_class_set
neverallow { domain -recovery -kernel } { system_file exec_type }:dir_file_class_set relabelto;
# Don't allow mounting on top of /system files or directories
neverallow domain { system_file exec_type }:dir_file_class_set mounton;
neverallow domain exec_type:dir_file_class_set mounton;
neverallow { domain -init } system_file:dir_file_class_set mounton;
# Nothing should be writing to files in the rootfs.
neverallow { domain -recovery } rootfs:file { create write setattr relabelto append unlink link rename };

2
init.te
View file

@ -43,7 +43,7 @@ allow init self:capability sys_admin;
# Create and mount on directories in /.
allow init rootfs:dir create_dir_perms;
allow init rootfs:dir mounton;
allow init { rootfs cache_file cgroup storage_file system_data_file system_file }:dir mounton;
# Mount on /dev/usb-ffs/adb.
allow init device:dir mounton;