Skip to content
Snippets Groups Projects
Commit 0f7641d8 authored by Stephen Smalley's avatar Stephen Smalley
Browse files

Label all files under /sys/qemu_trace with sysfs_writable.


Otherwise we have different security contexts but the same DAC
permissions:
-rw-rw-rw- root     root              u:object_r:sysfs_writable:s0 process_name
-rw-rw-rw- root     root              u:object_r:sysfs:s0 state
-rw-rw-rw- root     root              u:object_r:sysfs:s0 symbol

This change fixes denials such as:
type=1400 msg=audit(1379096020.770:144): avc:  denied  { write } for  pid=85 comm="SurfaceFlinger" name="symbol" dev="sysfs" ino=47 scontext=u:r:surfaceflinger:s0 tcontext=u:object_r:sysfs:s0 tclass=file

Change-Id: I261c7751da3778ee9241ec6b5476e8d9f96ba5ed
Signed-off-by: default avatarStephen Smalley <sds@tycho.nsa.gov>
parent a24a991d
No related branches found
No related tags found
No related merge requests found
......@@ -208,7 +208,7 @@
#############################
# sysfs files
#
/sys/qemu_trace/process_name -- u:object_r:sysfs_writable:s0
/sys/qemu_trace(/.*)? -- u:object_r:sysfs_writable:s0
/sys/devices/platform/nfc-power/nfc_power -- u:object_r:sysfs_nfc_power_writable:s0
/sys/class/rfkill/rfkill[0-9]*/state -- u:object_r:sysfs_bluetooth_writable:s0
/sys/class/rfkill/rfkill[0-9]*/type -- u:object_r:sysfs_bluetooth_writable:s0
......
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment