Skip to content
Snippets Groups Projects
Commit 9702e493 authored by jaejyn.shin's avatar jaejyn.shin Committed by Nick Kralevich
Browse files

DO NOT MERGE: Adding permissions needed to remove cache

During removing cache data using Zipper application, I found violation logs.

avc:  denied  { write } for  pid=198 comm="installd" name="cache" dev="mmcblk0p29" ino=81680 scontext=u:r:installd:s0 tcontext=u:object_r:download_file:s0 tclass=dir
avc:  denied  { remove_name } for  pid=198 comm="installd" name="downloadfile.apk" dev="mmcblk0p29" ino=82247 scontext=u:r:installd:s0 tcontext=u:object_r:download_file:s0 tclass=dir
avc:  denied  { unlink } for  pid=198 comm="installd" name="downloadfile.apk" dev="mmcblk0p29" ino=82247 scontext=u:r:installd:s0 tcontext=u:object_r:download_file:s0 tclass=file

Reproduction path is like below
1. Downloading Zipper application from Google Play (I used Zipper 1.9.9.2)
2. Clicking option and clicking "removing cache" button
3. Select "yes"
4. Violation show up

(cherry picked from commit 9cc6d8d5)

Bug: 13450421
Change-Id: I487ccd1d8d58bf2c590af39a7b1eb448c113670e
parent 2a2a4936
No related branches found
No related tags found
No related merge requests found
...@@ -16,8 +16,8 @@ allow installd apk_data_file:file r_file_perms; ...@@ -16,8 +16,8 @@ allow installd apk_data_file:file r_file_perms;
allow installd apk_tmp_file:file r_file_perms; allow installd apk_tmp_file:file r_file_perms;
allow installd system_file:file x_file_perms; allow installd system_file:file x_file_perms;
allow installd cgroup:dir create_dir_perms; allow installd cgroup:dir create_dir_perms;
allow installd download_file:dir { r_dir_perms }; allow installd download_file:dir { r_dir_perms write remove_name };
allow installd download_file:file { r_file_perms }; allow installd download_file:file { r_file_perms unlink };
dontaudit installd self:capability sys_admin; dontaudit installd self:capability sys_admin;
# Check validity of SELinux context before use. # Check validity of SELinux context before use.
selinux_check_context(installd) selinux_check_context(installd)
......
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment