7bde36e94e
We don't use MLS in Microdroid, so we don't need MLS rules, nor mlstrusted[subject|object] labels. (We keep one MLS rule to satisfy checkpolicy.) A lot of attributes are unused in Microdroid, so we can remove their declarations and any references to them. (That may not make the compiled policy smaller, since hopefully they get optimised out anyway, but it means there is less policy for humans to deal with.) Remove labels that relate only to apps, which we don't have - MAC permissions, run-as, seapp_contexts. In passing, fix a comment snafu in both system & microdroid policy. Bug: 223596375 Test: Run staged-apex-compile & compos_verify, no denials Test: atest MicrodroidTests MicrodroidHostTestCases Change-Id: Ifd3589945a2d8b4c0361e00eec5678795513fd8c
12 lines
503 B
Text
12 lines
503 B
Text
#################################################
|
|
# MLS policy constraints
|
|
#
|
|
|
|
# We aren't using MLS in Microdroid. But the policy grammar requires
|
|
# at least one MLS declaration, and checkpolicy enforces this. We
|
|
# don't want to disable MLS, since we share some file labels with the
|
|
# host (e.g. files in APEXes) which does have MLS. So we include this
|
|
# fairly harmless constraint.
|
|
|
|
# Process transition: Require equivalence.
|
|
mlsconstrain process { transition dyntransition } (h1 eq h2 and l1 eq l2);
|