23a52e6b30
The previous patch wasn't sufficient. Allow the kill signal.
Addresses the following denial:
<5>[ 775.819223] type=1400 audit(1393978653.489:18): avc: denied { sigkill } for pid=118 comm="lmkd" scontext=u:r:lmkd:s0 tcontext=u:r:untrusted_app:s0 tclass=process
Bug: 13084787
Change-Id: I6af1ed4343b590049809a59e4f2797f6049f12e4
20 lines
559 B
Text
20 lines
559 B
Text
# lmkd low memory killer daemon
|
|
type lmkd, domain;
|
|
type lmkd_exec, exec_type, file_type;
|
|
|
|
init_daemon_domain(lmkd)
|
|
|
|
allow lmkd self:capability { dac_override sys_resource kill };
|
|
|
|
## Open and write to /proc/PID/oom_score_adj
|
|
## TODO: maybe scope this down?
|
|
r_dir_file(lmkd, appdomain)
|
|
allow lmkd appdomain:file write;
|
|
r_dir_file(lmkd, system_server)
|
|
allow lmkd system_server:file write;
|
|
|
|
## Writes to /sys/module/lowmemorykiller/parameters/minfree
|
|
allow lmkd sysfs_lowmemorykiller:file w_file_perms;
|
|
|
|
# Send kill signals
|
|
allow lmkd appdomain:process sigkill;
|