tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

am 74df7f59: don\'t allow mounting on top of /system files/directories

Browse source 
* commit '74df7f593494a00dcc3be410b2d82267b6b31ca0':
  don't allow mounting on top of /system files/directories
This commit is contained in:
Nick Kralevich 2015-02-05 20:17:11 +00:00 committed by Android Git Automerger
commit f901c4ccd5
1 changed files with 3 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
domain.te
View file

@ -297,6 +297,9 @@ neverallow { domain -init } property_data_file:file no_w_file_perms;
neverallow { domain -recovery } { system_file exec_type }:dir_file_class_set neverallow { domain -recovery } { system_file exec_type }:dir_file_class_set
{ create write setattr relabelfrom relabelto append unlink link rename }; { create write setattr relabelfrom relabelto append unlink link rename };
# Don't allow mounting on top of /system files or directories
neverallow domain { system_file exec_type }:dir_file_class_set mounton;
# Nothing should be writing to files in the rootfs. # Nothing should be writing to files in the rootfs.
neverallow { domain -recovery } rootfs:file { create write setattr relabelto append unlink link rename }; neverallow { domain -recovery } rootfs:file { create write setattr relabelto append unlink link rename };