bd6b995087
Due to the nature of RemoteProvisioner being an app, there are many components under the hood of frameworks that make calls out to standard app available services. This change allows remote_prov_app to find any service labeled with app_api_service to avoid the brittleness that has already arisen from generating SELinux denials on boot, and avoid any potential unintended functionality consequences as a result of those. Test: No selinux denials Change-Id: I95fc4d15a196646deb6b9f6040bac88ee00b2a7f
13 lines
377 B
Text
13 lines
377 B
Text
type remote_prov_app, domain;
|
|
typeattribute remote_prov_app coredomain;
|
|
|
|
app_domain(remote_prov_app)
|
|
net_domain(remote_prov_app)
|
|
|
|
# The app needs access to properly build a DeviceInfo package for the verifying server
|
|
get_prop(remote_prov_app, vendor_security_patch_level_prop)
|
|
|
|
allow remote_prov_app {
|
|
app_api_service
|
|
remoteprovisioning_service
|
|
}:service_manager find;
|