3dfef1fdd3
(cherry picked from commit 8486f4e601)
Grant observed permissions
Addresses:
init
avc: granted { use } for pid=1 comm="init" path="/sys/fs/selinux/null" dev="selinuxfs" ino=22 scontext=u:r:init:s0 tcontext=u:r:kernel:s0 tclass=fd
mediaextractor
avc: granted { getattr } for pid=582 comm="mediaextractor" path="/proc/meminfo" dev="proc" ino=4026535447 scontext=u:r:mediaextractor:s0 tcontext=u:object_r:proc_meminfo:s0 tclass=file
avc: granted { read } for pid=582 comm="mediaextractor" name="meminfo" dev="proc" ino=4026535447 scontext=u:r:mediaextractor:s0 tcontext=u:object_r:proc_meminfo:s0 tclass=file
avc: granted { read open } for pid=582 comm="mediaextractor" path="/proc/meminfo" dev="proc" ino=4026535447 scontext=u:r:mediaextractor:s0 tcontext=u:object_r:proc_meminfo:s0 tclass=file
uncrypt
avc: granted { getattr } for pid=6750 comm="uncrypt" path="/fstab.angler" dev="rootfs" ino=9809 scontext=u:r:uncrypt:s0 tcontext=u:object_r:rootfs:s0 tclass=file
avc: granted { read } for pid=6750 comm="uncrypt" name="fstab.angler" dev="rootfs" ino=9809 scontext=u:r:uncrypt:s0 tcontext=u:object_r:rootfs:s0 tclass=file
avc: granted { read open } for pid=6750 comm="uncrypt" path="/fstab.angler" dev="rootfs" ino=9809 scontext=u:r:uncrypt:s0 tcontext=u:object_r:rootfs:s0 tclass=file
Bug: 28760354
Change-Id: Ibd51473c55d957aa7375de60da67cdc6504802f9
25 lines
769 B
Text
25 lines
769 B
Text
# mediaextractor - multimedia daemon
|
|
type mediaextractor, domain, domain_deprecated;
|
|
type mediaextractor_exec, exec_type, file_type;
|
|
|
|
typeattribute mediaextractor mlstrustedsubject;
|
|
|
|
init_daemon_domain(mediaextractor)
|
|
|
|
binder_use(mediaextractor)
|
|
binder_call(mediaextractor, binderservicedomain)
|
|
binder_call(mediaextractor, appdomain)
|
|
binder_service(mediaextractor)
|
|
|
|
allow mediaextractor mediaextractor_service:service_manager add;
|
|
|
|
###
|
|
### neverallow rules
|
|
###
|
|
|
|
# mediaextractor should never execute any executable without a
|
|
# domain transition
|
|
neverallow mediaextractor { file_type fs_type }:file execute_no_trans;
|
|
|
|
# mediaextractor should never need network access. Disallow network sockets.
|
|
neverallow mediaextractor domain:{ tcp_socket udp_socket rawip_socket } *;
|