353c72e3b0
This change removes the permissive line from unconfined domains. Unconfined domains can do (mostly) anything, so moving these domains into enforcing should be a no-op. The following domains were deliberately NOT changed: 1) kernel 2) init In the future, this gives us the ability to tighten up the rules in unconfined, and have those tightened rules actually work. When we're ready to tighten up the rules for these domains, we can: 1) Remove unconfined_domain and re-add the permissive line. 2) Submit the domain in permissive but NOT unconfined. 3) Remove the permissive line 4) Wait a few days and submit the no-permissive change. For instance, if we were ready to do this for adb, we'd identify a list of possible rules which allow adbd to work, re-add the permissive line, and then upload those changes to AOSP. After sufficient testing, we'd then move adb to enforcing. We'd repeat this for each domain until everything is enforcing and out of unconfined. Change-Id: If674190de3262969322fb2e93d9a0e734f8b9245
11 lines
296 B
Text
11 lines
296 B
Text
# gpsd - GPS daemon
|
|
type gpsd, domain;
|
|
type gpsd_exec, exec_type, file_type;
|
|
|
|
init_daemon_domain(gpsd)
|
|
net_domain(gpsd)
|
|
unconfined_domain(gpsd)
|
|
# Socket is created by the daemon, not by init, and under /data/gps,
|
|
# not under /dev/socket.
|
|
type_transition gpsd gps_data_file:sock_file gps_socket;
|
|
|