04a85a1ba0
Ignore-AOSP-First: T finalization Bug: 225745567 Test: Build Change-Id: I49fb91c7a60fb1e871bdf3553d978bb16c476fd7 Merged-In: I49fb91c7a60fb1e871bdf3553d978bb16c476fd7
24 lines
1 KiB
Text
24 lines
1 KiB
Text
type fsverity_init, domain, coredomain;
|
|
type fsverity_init_exec, exec_type, file_type, system_file_type;
|
|
|
|
init_daemon_domain(fsverity_init)
|
|
|
|
# Allow to read /proc/keys for searching key id.
|
|
allow fsverity_init proc_keys:file r_file_perms;
|
|
|
|
# Ignore denials to access irrelevant keys, as a side effect to access /proc/keys.
|
|
dontaudit fsverity_init domain:key view;
|
|
allow fsverity_init kernel:key { view search write setattr };
|
|
allow fsverity_init fsverity_init:key { view search write };
|
|
|
|
# Allow init to write to /proc/sys/fs/verity/require_signatures
|
|
allow fsverity_init proc_fs_verity:file w_file_perms;
|
|
|
|
# Read the on-device signing certificate, to be able to add it to the keyring
|
|
allow fsverity_init odsign:fd use;
|
|
allow fsverity_init odsign_data_file:file { getattr read };
|
|
|
|
# When kernel requests an algorithm, the crypto API first looks for an
|
|
# already registered algorithm with that name. If it fails, the kernel creates
|
|
# an implementation of the algorithm from templates.
|
|
dontaudit fsverity_init kernel:system module_request;
|