8b51674b2d
Now that we set /sys/fs/selinux/checkreqprot via init.rc, restrict the ability to set it to only the kernel domain. Change-Id: I975061fd0e69c158db9bdb23e6ba77948e3fead1 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
14 lines
459 B
Text
14 lines
459 B
Text
# Life begins with the kernel.
|
|
type kernel, domain;
|
|
# The kernel is unconfined.
|
|
unconfined_domain(kernel)
|
|
relabelto_domain(kernel)
|
|
|
|
allow kernel {fs_type dev_type file_type}:dir_file_class_set relabelto;
|
|
allow kernel unlabeled:filesystem mount;
|
|
|
|
# Initial setenforce by init prior to switching to init domain.
|
|
allow kernel self:security setenforce;
|
|
|
|
# Set checkreqprot by init.rc prior to switching to init domain.
|
|
allow kernel self:security setcheckreqprot;
|