Explicitly label system_server's dependencies in /proc
Labeled: /proc/asound/cards -> proc_asound_cards /proc/loadavg -> proc_loadavg /proc/pagetypeinfo -> proc_pagetypeinfo /proc/version -> proc_version /proc/vmallocinfo -> proc_vmallocinfo system_server: added access to all new types and removed access to proc label. init: added access to proc_version. dumpstate: added access to proc_pagetypeinfo, proc_version, proc_vmallocinfo. hal_audio: added access to proc_asound_cards. all_untrusted_apps: extended neverallow rule to include new labels. Bug: 65980789 Test: device boots without selinux denials to the newly introduced labels. Test: "adb shell dumpstate" throws no violations to new labels. Change-Id: Ic60facd3d4776e38d5e3ba003d06ada4e52c7dca
Showing
- private/app_neverallows.te 9 additions, 1 deletionprivate/app_neverallows.te
- private/compat/26.0/26.0.cil 1 addition, 1 deletionprivate/compat/26.0/26.0.cil
- private/genfs_contexts 5 additions, 0 deletionsprivate/genfs_contexts
- private/system_server.te 5 additions, 1 deletionprivate/system_server.te
- public/dumpstate.te 3 additions, 0 deletionspublic/dumpstate.te
- public/file.te 5 additions, 0 deletionspublic/file.te
- public/hal_audio.te 1 addition, 0 deletionspublic/hal_audio.te
- public/init.te 3 additions, 0 deletionspublic/init.te
Loading
Please register or sign in to comment