platform_system_sepolicy/public/modprobe.te
Tri Vo e55424941e modprobe: shouldn't load kernel modules from /system
Kernel modules are not permitted to be on /system partition.
That was one of Treble requirements in O:
https://source.android.com/devices/architecture/kernel/modular-kernels#file-locations

Bug: 74069409
Test: pixel/nexus devices don't have LKMs in /system, so this change
shoudl be harmless.
Test: walleye boots without issues from modprobe.
Merged-In: I8b3aeb55aacb3c99e0486224161d09a64bb52cd1
Change-Id: I8b3aeb55aacb3c99e0486224161d09a64bb52cd1

(cherry picked from commit 6ef9f5232e)
2018-03-23 14:16:25 -07:00

9 lines
271 B
Text

type modprobe, domain;
allow modprobe proc_modules:file r_file_perms;
allow modprobe self:global_capability_class_set sys_module;
allow modprobe kernel:key search;
recovery_only(`
allow modprobe rootfs:system module_load;
allow modprobe rootfs:file r_file_perms;
')