Skip to content
Snippets Groups Projects
Commit 368c7c08 authored by Tri Vo's avatar Tri Vo Committed by Gerrit Code Review
Browse files

Merge "init: access to /dev based on audit results"

parents 10b250df 887ef163
No related branches found
No related tags found
No related merge requests found
Hide whitespace changes
Inline Side-by-side
Showing
with 17 additions and 29 deletions
public/init.te
+ 17
− 29
View file @ 368c7c08
...@@ -251,36 +251,24 @@ allow init { ...@@ -251,36 +251,24 @@ allow init {
}:file { open read setattr }; }:file { open read setattr };
allow init { fs_type -contextmount_type -sdcard_type -rootfs }:dir { open read setattr search }; allow init { fs_type -contextmount_type -sdcard_type -rootfs }:dir { open read setattr search };
# init should not be able to read or open generic devices
# TODO: auditing to see if this can be deleted entirely
allow init { allow init {
dev_type alarm_device
-keychord_device ashmem_device
-kmem_device binder_device
-port_device console_device
-device devpts
-vndbinder_device dm_device
}:chr_file { read open }; hwbinder_device
auditallow init { hw_random_device
dev_type input_device
-alarm_device kmsg_device
-ashmem_device null_device
-binder_device owntty_device
-console_device pmsg_device
-device ptmx_device
-devpts random_device
-dm_device tty_device
-hwbinder_device zero_device
-hw_random_device
-input_device
-kmem_device
-kmsg_device
-null_device
-owntty_device
-port_device
-ptmx_device
-random_device
-zero_device
}:chr_file { read open }; }:chr_file { read open };
# chown/chmod on devices. # chown/chmod on devices.
......
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment