tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Merge "Revert "Allow MediaProvider to host FUSE devices.""

Browse source 
am: 34a19b76ce

Change-Id: I1479f5277026410ac294973170f587db79e0dba9
This commit is contained in:
Zimuzo Ezeozue 2020-01-10 14:01:21 -08:00 committed by android-build-merger
commit ff8203a23d
2 changed files with 2 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
private/app_neverallows.te
View file

@ -136,8 +136,8 @@ neverallow { all_untrusted_apps -mediaprovider } {
')
}:dir_file_class_set { create unlink };
# No untrusted component except mediaprovider should be touching /dev/fuse
neverallow { all_untrusted_apps -mediaprovider } fuse_device:chr_file *;
# No untrusted component should be touching /dev/fuse
neverallow all_untrusted_apps fuse_device:chr_file *;
# Do not allow untrusted apps to directly open the tun_device
neverallow all_untrusted_apps tun_device:chr_file open;

3
private/mediaprovider.te
View file

@ -34,9 +34,6 @@ allow mediaprovider ringtone_file:file { getattr read write };
# MtpServer uses /dev/mtp_usb
allow mediaprovider mtp_device:chr_file rw_file_perms;
# Fuse daemon
allow mediaprovider fuse_device:chr_file { read write ioctl getattr };
# MtpServer uses /dev/usb-ffs/mtp
allow mediaprovider functionfs:dir search;
allow mediaprovider functionfs:file rw_file_perms;