08d4c8fa6e
This commit adds fake 31.0 prebuilt. The prebuilt is based on AOSP policy, but slightly modified so the set of types and attributes is a subset of real 31.0 prebuilt (sc-dev policy). Steps taken to make the fake prebuilt: 1) build plat_sepolicy.cil both on AOSP and sc-dev, with lunch target aosp_arm64-eng. 2) diff both outputs to find out which types and attributes don't exist. 3) remove all relevant files and statements. As a result, the following types are removed. artd artd_exec artd_service power_stats_service transformer_service virtualizationservice virtualizationservice_data_file virtualizationservice_exec Bug: 189161483 Test: N/A, will do after adding 31.0 mapping files. Change-Id: Ia957fc32b1838dae730d9dd7bd917d684d4a24cf Merged-In: Ia4ea2999f4bc8ae80f13e51d99fba3e98e293447
41 lines
897 B
Text
41 lines
897 B
Text
typeattribute logd coredomain;
|
|
|
|
init_daemon_domain(logd)
|
|
|
|
# Access device logging gating property
|
|
get_prop(logd, device_logging_prop)
|
|
|
|
# logd is not allowed to write anywhere other than /data/misc/logd, and then
|
|
# only on userdebug or eng builds
|
|
neverallow logd {
|
|
file_type
|
|
-runtime_event_log_tags_file
|
|
userdebug_or_eng(`-coredump_file -misc_logd_file')
|
|
with_native_coverage(`-method_trace_data_file')
|
|
}:file { create write append };
|
|
|
|
# protect the event-log-tags file
|
|
neverallow {
|
|
domain
|
|
-appdomain # covered below
|
|
-bootstat
|
|
-dumpstate
|
|
-init
|
|
-logd
|
|
userdebug_or_eng(`-logpersist')
|
|
-servicemanager
|
|
-system_server
|
|
-surfaceflinger
|
|
-zygote
|
|
} runtime_event_log_tags_file:file no_rw_file_perms;
|
|
|
|
neverallow {
|
|
appdomain
|
|
-bluetooth
|
|
-platform_app
|
|
-priv_app
|
|
-radio
|
|
-shell
|
|
userdebug_or_eng(`-su')
|
|
-system_app
|
|
} runtime_event_log_tags_file:file no_rw_file_perms;
|