Define policy for /proc/uid_procstat/set. am: 828433c8 am: 7b88514c am: 955aa7aa

am: 0f1a97c5

Change-Id: Ie29f67b5bd8cbcdebe0ca67fa34c337cdd962714

private/genfs_contexts

@@ -32,6 +32,7 @@ genfscon proc /timer_stats u:object_r:proc_timer:s0
 genfscon proc /tty/drivers u:object_r:proc_tty_drivers:s0
 genfscon proc /uid_cputime/show_uid_stat u:object_r:proc_uid_cputime_showstat:s0
 genfscon proc /uid_cputime/remove_uid_range u:object_r:proc_uid_cputime_removeuid:s0
+genfscon proc /uid_procstat/set u:object_r:proc_uid_procstat_set:s0
 genfscon proc /zoneinfo u:object_r:proc_zoneinfo:s0
 
 # selinuxfs booleans can be individually labeled.

public/file.te

@@ -23,6 +23,7 @@ type proc_timer, fs_type;
 type proc_tty_drivers, fs_type;
 type proc_uid_cputime_showstat, fs_type;
 type proc_uid_cputime_removeuid, fs_type;
+type proc_uid_procstat_set, fs_type;
 type proc_zoneinfo, fs_type;
 type selinuxfs, fs_type, mlstrustedobject;
 type cgroup, fs_type, mlstrustedobject;

public/system_server.te

@@ -112,6 +112,9 @@ allow system_server proc_uid_cputime_showstat:file r_file_perms;
 # Write /proc/uid_cputime/remove_uid_range.
 allow system_server proc_uid_cputime_removeuid:file { w_file_perms getattr };
 
+# Write /proc/uid_procstat/set.
+allow system_server proc_uid_procstat_set:file { w_file_perms getattr };
+
 # Write to /proc/sysrq-trigger.
 allow system_server proc_sysrq:file rw_file_perms;