40f33c1da1
Init attempts to rm -rf these files, to ensure any that are owned by the old virtualizationservice UID get deleted. This fails for newer directories, now we use the system UID, which is harmless. But rm attempts to chmod the directories since it can't read them, which also fails and generates a spurious audit. So here we suppress that. Bug: 235338094 Test: No denials seen even when there are stale directories present Change-Id: If55fbe151174ee08a12b64b301e4aa86ffc1a5bf
12 lines
515 B
Text
12 lines
515 B
Text
typeattribute toolbox coredomain;
|
|
|
|
init_daemon_domain(toolbox)
|
|
|
|
# rm -rf in /data/misc/virtualizationservice
|
|
allow toolbox virtualizationservice_data_file:dir { rmdir rw_dir_perms };
|
|
allow toolbox virtualizationservice_data_file:file { getattr unlink };
|
|
|
|
# If we can't remove these directories we try to chmod them. That
|
|
# doesn't work, but it doesn't matter as virtualizationservice itself
|
|
# will delete them when it starts. See b/235338094#comment39
|
|
dontaudit toolbox virtualizationservice_data_file:dir setattr;
|