tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Merge "Label /proc/meminfo." into nyc-dev

Browse source
This commit is contained in:
Daniel Cashman 2016-02-24 15:36:47 +00:00 committed by Android (Google) Code Review
commit edbe1a984a
4 changed files with 7 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
domain_deprecated.te
View file

@ -57,6 +57,7 @@ r_dir_file(domain_deprecated, proc)
r_dir_file(domain_deprecated, sysfs)
r_dir_file(domain_deprecated, inotify)
r_dir_file(domain_deprecated, cgroup)
r_dir_file(domain_deprecated, proc_meminfo)
r_dir_file(domain_deprecated, proc_net)
# Get SELinux enforcing status.

1
file.te
View file

@ -14,6 +14,7 @@ type qtaguid_proc, fs_type, mlstrustedobject;
type proc_bluetooth_writable, fs_type;
type proc_cpuinfo, fs_type;
type proc_iomem, fs_type;
type proc_meminfo, fs_type;
type proc_net, fs_type;
type proc_sysrq, fs_type;
type proc_uid_cputime_showstat, fs_type;

1
genfs_contexts
View file

@ -3,6 +3,7 @@ genfscon rootfs / u:object_r:rootfs:s0
# proc labeling can be further refined (longest matching prefix).
genfscon proc / u:object_r:proc:s0
genfscon proc /iomem u:object_r:proc_iomem:s0
genfscon proc /meminfo u:object_r:proc_meminfo:s0
genfscon proc /net u:object_r:proc_net:s0
genfscon proc /net/xt_qtaguid/ctrl u:object_r:qtaguid_proc:s0
genfscon proc /cpuinfo u:object_r:proc_cpuinfo:s0

7
untrusted_app.te
View file

@ -94,10 +94,11 @@ allow untrusted_app self:process ptrace;
# for files. Suppress the denials when they occur.
dontaudit untrusted_app exec_type:file getattr;
# TODO: access of /proc/meminfo, give specific label or switch to
# using meminfo service
allow untrusted_app proc:file r_file_perms;
# TODO: switch to meminfo service
allow untrusted_app proc_meminfo:file r_file_perms;
# https://code.google.com/p/chromium/issues/detail?id=586021
allow untrusted_app proc:file r_file_perms;
auditallow untrusted_app proc:file r_file_perms;
# access /proc/net/xt_qtguid/stats
r_dir_file(untrusted_app, proc_net)