Skip to content
Snippets Groups Projects
  • Nick Kralevich's avatar
    remove appdomain's ability to examine all of /proc · 0d3f7ddc
    Nick Kralevich authored
    Remove the CTS specific rule which allows appdomain processes
    to view /proc entries for the rest of the system. With this change,
    an SELinux domain will only be able to view it's own /proc
    entries, e.g. untrusted_app can only view /proc entries for other
    untrusted_app, system_app can only view /proc entries for other
    system_apps, etc.
    
    /proc contains sensitive information, and we want to avoid
    leaking this information between app security domains.
    
    Bug: 17254920
    Change-Id: I59da37dde00107a5ab123df3b79a84afa855339f
    0d3f7ddc