diff --git a/private/compat/26.0/26.0.cil b/private/compat/26.0/26.0.cil index 4ebb66ee699dbd8b2faf0dd42f9c622472104dd6..1ebab61f49d6ed41460f2f19ca58b0f2839a2f22 100644 --- a/private/compat/26.0/26.0.cil +++ b/private/compat/26.0/26.0.cil @@ -455,6 +455,7 @@ proc_kmsg proc_loadavg proc_mounts + proc_overflowuid proc_page_cluster proc_pagetypeinfo proc_random diff --git a/private/genfs_contexts b/private/genfs_contexts index a6de59a6d13f9ed25441151e688381c62b315d13..ee17d498cd8e4252823f288a8be7757c19807b63 100644 --- a/private/genfs_contexts +++ b/private/genfs_contexts @@ -31,6 +31,7 @@ genfscon proc /sys/kernel/hotplug u:object_r:usermodehelper:s0 genfscon proc /sys/kernel/kptr_restrict u:object_r:proc_security:s0 genfscon proc /sys/kernel/modprobe u:object_r:usermodehelper:s0 genfscon proc /sys/kernel/modules_disabled u:object_r:proc_security:s0 +genfscon proc /sys/kernel/overflowuid u:object_r:proc_overflowuid:s0 genfscon proc /sys/kernel/perf_event_max_sample_rate u:object_r:proc_perf:s0 genfscon proc /sys/kernel/poweroff_cmd u:object_r:usermodehelper:s0 genfscon proc /sys/kernel/random u:object_r:proc_random:s0 diff --git a/public/file.te b/public/file.te index 9057c19764d5b6927d950e2a8abe4ba16e9b3201..37ebde4d618b67ea73527b22f938aceae5fd6261 100644 --- a/public/file.te +++ b/public/file.te @@ -26,6 +26,7 @@ type proc_misc, fs_type; type proc_modules, fs_type; type proc_mounts, fs_type; type proc_net, fs_type; +type proc_overflowuid, fs_type; type proc_page_cluster, fs_type; type proc_pagetypeinfo, fs_type; type proc_perf, fs_type; diff --git a/public/hal_usb.te b/public/hal_usb.te index 9cfd5165d282b0ea21acddda9574b68e7443e4bf..e2e3449b851d23887408c136e78328b71bc61ea1 100644 --- a/public/hal_usb.te +++ b/public/hal_usb.te @@ -15,4 +15,5 @@ allow hal_usb sysfs:file read; allow hal_usb sysfs:file open; allow hal_usb sysfs:file write; allow hal_usb sysfs:file getattr; +allow hal_usb proc_overflowuid:file r_file_perms; diff --git a/public/healthd.te b/public/healthd.te index c0a7bec7bd3d5f02f6562ba0090852e929901c79..e7c92c44183dbb9d93f138d008664b343b7f58f6 100644 --- a/public/healthd.te +++ b/public/healthd.te @@ -55,6 +55,7 @@ allow healthd tty_device:chr_file rw_file_perms; allow healthd ashmem_device:chr_file execute; allow healthd self:process execmem; allow healthd proc_sysrq:file rw_file_perms; +allow healthd proc_overflowuid:file r_file_perms; add_service(healthd, batteryproperties_service) diff --git a/public/init.te b/public/init.te index 2d55aba162dfe9a14c29e2d72f59c65383b0abb0..bc10a82bdb81ff0ee6abb723940b2c8441357016 100644 --- a/public/init.te +++ b/public/init.te @@ -280,6 +280,9 @@ allow init proc_cmdline:file r_file_perms; # Write to /proc/sys/vm/page-cluster allow init proc_page_cluster:file w_file_perms; +# Read /proc/sys/kernel/overflowuid +allow init proc_overflowuid:file r_file_perms; + # Reboot. allow init self:capability sys_boot; diff --git a/public/netd.te b/public/netd.te index a1917b3734bc48073ae6fee1bfe46c6e2b379821..17f60b559bd201469246fbffe0467ec911a0a26e 100644 --- a/public/netd.te +++ b/public/netd.te @@ -37,6 +37,9 @@ r_dir_file(netd, proc_net) # For /proc/sys/net/ipv[46]/route/flush. allow netd proc_net:file rw_file_perms; +# Access for /proc/sys/kernel/overflowuid. +allow netd proc_overflowuid:file r_file_perms; + # Enables PppController and interface enumeration (among others) allow netd sysfs:dir r_dir_perms; r_dir_file(netd, sysfs_net) diff --git a/public/ueventd.te b/public/ueventd.te index 212087e52f9e9b69b90bacedd22dff9d8f8e7bcf..7e1f3fd5fc314767a292ea7e1a797e2043e8a5ae 100644 --- a/public/ueventd.te +++ b/public/ueventd.te @@ -36,6 +36,9 @@ allow ueventd file_contexts_file:file r_file_perms; # Use setfscreatecon() to label /dev directories and files. allow ueventd self:process setfscreate; +# Access for /proc/sys/kernel/overflowuid. +allow ueventd proc_overflowuid:file r_file_perms; + ##### ##### neverallow rules ##### diff --git a/public/vold.te b/public/vold.te index 2c2f14705ac6e7a7c403c167094aba9463c632c9..148f4b541adf98ff6aa16cc7ea21fd8cacedd1df 100644 --- a/public/vold.te +++ b/public/vold.te @@ -24,6 +24,7 @@ allow vold { proc_filesystems proc_meminfo proc_mounts + proc_overflowuid }:file r_file_perms; #Get file contexts