From d30060a0cb378457679cc354613b227f8baa63ea Mon Sep 17 00:00:00 2001
From: Stephen Smalley <sds@tycho.nsa.gov>
Date: Wed, 14 May 2014 08:29:00 -0400
Subject: [PATCH] Allow installd to unlink /data/media files and search
/data/app-asec.
Address recent installd denials resulting from the recent
tightening of installd access to /data file types, including:
avc: denied { unlink } for name="._playmusicid" dev="mmcblk0p30" ino=1038393 scontext=u:r:installd:s0 tcontext=u:object_r:media_rw_data_file:s0 tclass=file
avc: denied { search } for pid=195 comm="installd" name="app-asec" dev="mmcblk0p28" ino=578225 scontext=u:r:installd:s0 tcontext=u:object_r:asec_image_file:s0 tclass=dir
Change-Id: I957738139678699949da9ad09d3bddb91605f8cf
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
---
installd.te | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/installd.te b/installd.te
index cabebc6aa..3ce2c5d08 100644
--- a/installd.te
+++ b/installd.te
@@ -17,6 +17,9 @@ selinux_check_context(installd)
# Read /seapp_contexts and /data/security/seapp_contexts
security_access_policy(installd)
+# Search /data/app-asec.
+allow installd asec_image_file:dir search;
+
# Create /data/user and /data/user/0 if necessary.
# Also required to initially create /data/data subdirectories
# and lib symlinks before the setfilecon call. May want to
@@ -26,6 +29,7 @@ allow installd system_data_file:lnk_file { create setattr unlink };
# Upgrade /data/media for multi-user if necessary.
allow installd media_rw_data_file:dir create_dir_perms;
+allow installd media_rw_data_file:file unlink;
# restorecon new /data/media directory.
allow installd system_data_file:dir relabelfrom;
allow installd media_rw_data_file:dir relabelto;
--
GitLab