From c4cf98605de285843b3cfdb9afce5ae43b3ae16d Mon Sep 17 00:00:00 2001
From: Nick Kralevich <nnk@google.com>
Date: Tue, 30 Oct 2018 03:30:22 +0000
Subject: [PATCH] Revert "SELinux changes for AppFuse"
This reverts commit 67ed4328eb4835f4404151ee4bbb93d0f4500354.
Reason for revert: Broken CTS test. See b/118642091
Bug: 118642091
Bug: 110379912
Change-Id: I5afd16bf23149c74f2740720cdd248a255ff1497
---
private/system_server.te | 3 ++-
public/app.te | 3 ---
public/vold.te | 2 --
3 files changed, 2 insertions(+), 6 deletions(-)
diff --git a/private/system_server.te b/private/system_server.te
index 8a0fb8eee..42a89d421 100644
--- a/private/system_server.te
+++ b/private/system_server.te
@@ -740,7 +740,8 @@ userdebug_or_eng(`
# For AppFuse.
allow system_server vold:fd use;
allow system_server fuse_device:chr_file { read write ioctl getattr };
-allow system_server app_fuse_file:file { read write getattr };
+allow system_server app_fuse_file:dir rw_dir_perms;
+allow system_server app_fuse_file:file { read write open getattr append };
# For configuring sdcardfs
allow system_server configfs:dir { create_dir_perms };
diff --git a/public/app.te b/public/app.te
index 63fc38880..7f0d5548e 100644
--- a/public/app.te
+++ b/public/app.te
@@ -55,9 +55,6 @@ allow appdomain system_server:fifo_file rw_file_perms;
allow appdomain system_server:unix_stream_socket { read write setopt getattr getopt shutdown };
allow appdomain system_server:tcp_socket { read write getattr getopt shutdown };
-# For AppFuse.
-allow appdomain vold:fd use;
-
# Communication with other apps via fifos
allow appdomain appdomain:fifo_file rw_file_perms;
diff --git a/public/vold.te b/public/vold.te
index 236604fa0..9091b69ad 100644
--- a/public/vold.te
+++ b/public/vold.te
@@ -229,8 +229,6 @@ allow vold fuse_device:chr_file rw_file_perms;
allow vold fuse:filesystem { relabelfrom };
allow vold app_fusefs:filesystem { relabelfrom relabelto };
allow vold app_fusefs:filesystem { mount unmount };
-allow vold app_fuse_file:dir rw_dir_perms;
-allow vold app_fuse_file:file { read write open getattr append };
# MoveTask.cpp executes cp and rm
allow vold toolbox_exec:file rx_file_perms;
--
GitLab