Skip to content
Snippets Groups Projects
Commit 83a06805 authored by Tobias Thierer's avatar Tobias Thierer
Browse files

Revert "Neverallow coredomain to kernel interface files."

This reverts commit 502e43f7.

Reason for revert: Suspected to have broken a build, see b/68792382

Bug: 68792382
Change-Id: Ib5d465b7a50a73e3d8d8edd4e6b3426a7bde4249
parent 502e43f7
No related branches found
No related tags found
No related merge requests found
...@@ -16,119 +16,3 @@ neverallow { ...@@ -16,119 +16,3 @@ neverallow {
# Limit ability to generate hardware unique device ID attestations to priv_apps # Limit ability to generate hardware unique device ID attestations to priv_apps
neverallow { domain -priv_app } *:keystore_key gen_unique_id; neverallow { domain -priv_app } *:keystore_key gen_unique_id;
# Core domains are not permitted to use kernel interfaces which are not
# explicitly labeled.
# TODO(b/65643247): Apply these neverallow rules to all coredomain.
full_treble_only(`
# /proc
neverallow {
coredomain
-dumpstate
-init
-platform_app
-priv_app
-radio
-shell
-system_app
-vold
-vendor_init
} proc:file no_rw_file_perms;
# /sys
neverallow {
coredomain
-charger
-dumpstate
-healthd
-init
-mediaserver
-priv_app
-radio
-storaged
-system_app
-system_server
-ueventd
-update_verifier
-vold
-vendor_init
} sysfs:file no_rw_file_perms;
# /dev
neverallow {
coredomain
-fsck
-init
-shell
-ueventd
-vendor_init
} device:{ blk_file file } no_rw_file_perms;
# debugfs
neverallow {
coredomain
-dumpstate
-init
-system_server
-vendor_init
} debugfs:file no_rw_file_perms;
# tracefs
neverallow {
coredomain
-atrace
-dumpstate
-init
-perfprofd
-shell
-vendor_init
} debugfs_tracing:file no_rw_file_perms;
# inotifyfs
neverallow {
coredomain
-init
-vendor_init
} inotify:file no_rw_file_perms;
# pstorefs
neverallow {
coredomain
-bootstat
-charger
-dumpstate
-healthd
-init
-logd
-logpersist
-recovery_persist
-recovery_refresh
-shell
-system_server
-vendor_init
} pstorefs:file no_rw_file_perms;
# configfs
neverallow {
coredomain
-init
-system_server
-vendor_init
} configfs:file no_rw_file_perms;
# functionfs
neverallow {
coredomain
-adbd
-init
-mediaprovider
-vendor_init
}functionfs:file no_rw_file_perms;
# usbfs and binfmt_miscfs
neverallow {
coredomain
-init
-vendor_init
}{ usbfs binfmt_miscfs }:file no_rw_file_perms;
')
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment