7bde36e94e
We don't use MLS in Microdroid, so we don't need MLS rules, nor mlstrusted[subject|object] labels. (We keep one MLS rule to satisfy checkpolicy.) A lot of attributes are unused in Microdroid, so we can remove their declarations and any references to them. (That may not make the compiled policy smaller, since hopefully they get optimised out anyway, but it means there is less policy for humans to deal with.) Remove labels that relate only to apps, which we don't have - MAC permissions, run-as, seapp_contexts. In passing, fix a comment snafu in both system & microdroid policy. Bug: 223596375 Test: Run staged-apex-compile & compos_verify, no denials Test: atest MicrodroidTests MicrodroidHostTestCases Change-Id: Ifd3589945a2d8b4c0361e00eec5678795513fd8c
8 lines
294 B
Text
8 lines
294 B
Text
# init is its own domain.
|
|
type init, domain;
|
|
type init_exec, system_file_type, exec_type, file_type;
|
|
type init_tmpfs, file_type;
|
|
|
|
allow init tmpfs:chr_file relabelfrom;
|
|
allow init kmsg_device:chr_file { getattr write relabelto };
|
|
allow init kmsg_debug_device:chr_file { open write relabelto };
|