fff3fe2f08
Copy the final system sepolicy from oc-dev to its prebuilt dir
corresponding to its version (26.0) so that we can uprev policy and
start maintaining compatibility files, as well as use it for CTS
tests targeting future platforms.
(cherry-pick of commit: 5c6a227ebb)
Bug: 37896931
Bug: 37916906
Test: none, this just copies the old policy.
Change-Id: Ib069d505e42595c467e5d1164fb16fcb0286ab93
39 lines
839 B
Text
39 lines
839 B
Text
typeattribute logd coredomain;
|
|
|
|
init_daemon_domain(logd)
|
|
|
|
# logd is not allowed to write anywhere other than /data/misc/logd, and then
|
|
# only on userdebug or eng builds
|
|
# TODO: deal with tmpfs_domain pub/priv split properly
|
|
neverallow logd {
|
|
file_type
|
|
-logd_tmpfs
|
|
-runtime_event_log_tags_file
|
|
userdebug_or_eng(`-coredump_file -misc_logd_file')
|
|
}:file { create write append };
|
|
|
|
# protect the event-log-tags file
|
|
neverallow {
|
|
domain
|
|
-appdomain # covered below
|
|
-bootstat
|
|
-dumpstate
|
|
-init
|
|
-logd
|
|
userdebug_or_eng(`-logpersist')
|
|
-servicemanager
|
|
-system_server
|
|
-surfaceflinger
|
|
-zygote
|
|
} runtime_event_log_tags_file:file no_rw_file_perms;
|
|
|
|
neverallow {
|
|
appdomain
|
|
-bluetooth
|
|
-platform_app
|
|
-priv_app
|
|
-radio
|
|
-shell
|
|
userdebug_or_eng(`-su')
|
|
-system_app
|
|
} runtime_event_log_tags_file:file no_rw_file_perms;
|