fastbootd.te: Delete allowxperm statement
system/sepolicy commit 4c8eaba7, reviewed in https://android-review.googlesource.com/c/platform/system/sepolicy/+/793958 started enforcing explicit ioctl permission checks for all block device files. As part of that commit, the following lines were added to domain.te: # If a domain has access to perform an ioctl on a block device, allow these # very common, benign ioctls allowxperm domain dev_type:blk_file ioctl { BLKGETSIZE64 BLKSSZGET }; In essence, if a domain is granted ioctl access to any device in policy (for example, via adding "ioctl" to the allow rule, or by using the macro "r_file_perms" which includes the ioctl permission), then the two ioctls BLKGETSIZE64 and BLKSSZGET will be automatically allowed. As such, it is redundent for a domain to explicitly request these two ioctls. Delete the now redundant allowxperm rule. Test: policy compiles Change-Id: I1964ed93a7c7601393cc9e2416f3640ea22db51b
Loading
Please register or sign in to comment