tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

runas: allow pipe communication from the shell

Browse source 
run-as won't communicate with shell via pipes. Allow it.

  nnk@nnk:~$ adb shell "cat /dev/zero | run-as com.google.foo sh -c 'cat'"
  /system/bin/sh: cat: <stdout>: Broken pipe

  <4>[ 1485.483517] type=1400 audit(1402623577.085:25): avc: denied { read } for pid=6026 comm="run-as" path="pipe:[29823]" dev="pipefs" ino=29823 scontext=u:r:runas:s0 tcontext=u:r:shell:s0 tclass=fifo_file

read is definitely needed. Not sure about write, but adding it just
in case.

(cherry picked from commit 6c9c58884a)

Change-Id: Ifed6314588723063531982b45a56b902dfe32ea9
This commit is contained in:
Nick Kralevich 2014-06-12 18:54:10 -07:00
parent 28ca332720
commit f1b92488f5
1 changed files with 2 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
runas.te
View file

@ -4,7 +4,8 @@ type runas_exec, exec_type, file_type;
# ndk-gdb invokes adb shell run-as. # ndk-gdb invokes adb shell run-as.
domain_auto_trans(shell, runas_exec, runas) domain_auto_trans(shell, runas_exec, runas)
allow runas adbd:process sigchld; allow runas adbd:process sigchld;
allow runas shell:fd use; allow runas shell:fd use;
allow runas shell:fifo_file { read write };
allow runas devpts:chr_file { read write ioctl }; allow runas devpts:chr_file { read write ioctl };
# run-as reads package information. # run-as reads package information.