diff --git a/domain_deprecated.te b/domain_deprecated.te index c5d9888e835f83e04c5c67ade696d5f8dd5bfbc7..50249fe7927e134d8ff1b9db4e1fcb2d065cf7dd 100644 --- a/domain_deprecated.te +++ b/domain_deprecated.te @@ -48,8 +48,8 @@ auditallow { domain_deprecated -appdomain -drmserver -init -rild -surfaceflinger # Read files already opened under /data. allow domain_deprecated system_data_file:file { getattr read }; allow domain_deprecated system_data_file:lnk_file r_file_perms; -auditallow { domain_deprecated -appdomain -init -logd -sdcardd -system_server -tee } system_data_file:file { getattr read }; -auditallow { domain_deprecated -appdomain -init -logd -system_server -tee } system_data_file:lnk_file r_file_perms; +auditallow { domain_deprecated -appdomain -init -sdcardd -system_server -tee } system_data_file:file { getattr read }; +auditallow { domain_deprecated -appdomain -init -system_server -tee } system_data_file:lnk_file r_file_perms; # Read apk files under /data/app. allow domain_deprecated apk_data_file:dir { getattr search }; @@ -89,18 +89,18 @@ r_dir_file(domain_deprecated, cgroup) allow domain_deprecated proc_meminfo:file r_file_perms; r_dir_file(domain_deprecated, proc_net) #auditallow domain_deprecated proc:dir r_dir_perms; # r_dir_perms granted in domain -auditallow { domain_deprecated -fsck -fsck_untrusted -init -logd -priv_app -rild -system_server -vold } proc:file r_file_perms; -auditallow { domain_deprecated -fsck -fsck_untrusted -init -logd -priv_app -rild -system_server -vold } proc:lnk_file { open ioctl lock }; # getattr read granted in domain +auditallow { domain_deprecated -fsck -fsck_untrusted -init -priv_app -rild -system_server -vold } proc:file r_file_perms; +auditallow { domain_deprecated -fsck -fsck_untrusted -init -priv_app -rild -system_server -vold } proc:lnk_file { open ioctl lock }; # getattr read granted in domain auditallow { domain_deprecated -bluetooth -fingerprintd -healthd -init -netd -priv_app -rild -system_app -surfaceflinger -system_server -tee -ueventd -vold -wpa } sysfs:dir { open getattr read ioctl lock }; # search granted in domain auditallow { domain_deprecated -bluetooth -fingerprintd -healthd -init -netd -priv_app -rild -system_app -surfaceflinger -system_server -tee -ueventd -vold -wpa } sysfs:file r_file_perms; auditallow { domain_deprecated -bluetooth -fingerprintd -healthd -init -netd -priv_app -rild -system_app -surfaceflinger -system_server -tee -ueventd -vold -wpa } sysfs:lnk_file { getattr open ioctl lock }; # read granted in domain auditallow domain_deprecated inotify:dir r_dir_perms; auditallow domain_deprecated inotify:{ file lnk_file } r_file_perms; -auditallow { domain_deprecated -appdomain -drmserver -fingerprintd -gatekeeperd -healthd -init -inputflinger -installd -keystore -logd -mediaserver -netd -rild -surfaceflinger -system_server -zygote } cgroup:dir r_dir_perms; -auditallow { domain_deprecated -appdomain -drmserver -fingerprintd -gatekeeperd -healthd -init -inputflinger -installd -keystore -logd -mediaserver -netd -rild -surfaceflinger -system_server -zygote } cgroup:{ file lnk_file } r_file_perms; -auditallow { domain_deprecated -appdomain -init -logd -priv_app -surfaceflinger -system_server -vold } proc_meminfo:file r_file_perms; -auditallow { domain_deprecated -appdomain -clatd -init -logd -netd -system_server -vold -wpa -zygote } proc_net:dir { open getattr read ioctl lock }; # search granted in domain -auditallow { domain_deprecated -appdomain -clatd -init -logd -netd -system_server -vold -wpa -zygote } proc_net:{ file lnk_file } r_file_perms; +auditallow { domain_deprecated -appdomain -drmserver -fingerprintd -gatekeeperd -healthd -init -inputflinger -installd -keystore -mediaserver -netd -rild -surfaceflinger -system_server -zygote } cgroup:dir r_dir_perms; +auditallow { domain_deprecated -appdomain -drmserver -fingerprintd -gatekeeperd -healthd -init -inputflinger -installd -keystore -mediaserver -netd -rild -surfaceflinger -system_server -zygote } cgroup:{ file lnk_file } r_file_perms; +auditallow { domain_deprecated -appdomain -init -priv_app -surfaceflinger -system_server -vold } proc_meminfo:file r_file_perms; +auditallow { domain_deprecated -appdomain -clatd -init -netd -system_server -vold -wpa -zygote } proc_net:dir { open getattr read ioctl lock }; # search granted in domain +auditallow { domain_deprecated -appdomain -clatd -init -netd -system_server -vold -wpa -zygote } proc_net:{ file lnk_file } r_file_perms; # Get SELinux enforcing status. allow domain_deprecated selinuxfs:dir r_dir_perms; diff --git a/logd.te b/logd.te index 447fae5757e55cfcb1ce48273a3f45e5d00f6c0c..c9072f381ed2db92cac745d8cf87550450ca8f5e 100644 --- a/logd.te +++ b/logd.te @@ -1,5 +1,5 @@ # android user-space log manager -type logd, domain, domain_deprecated, mlstrustedsubject; +type logd, domain, mlstrustedsubject; type logd_exec, exec_type, file_type; init_daemon_domain(logd)