From e961483330e6c3d22fd41d200591bbf7b52d7225 Mon Sep 17 00:00:00 2001
From: Tom Cherry <tomcherry@google.com>
Date: Wed, 29 Mar 2017 16:52:19 -0700
Subject: [PATCH] Grant vdc access to kmsg

Init is no longer calling vdc with logwrapper, so it must take care of
logging to kmsg directly.

avc: denied { write } for pid=367 comm="vdc" name="kmsg" dev="tmpfs" ino=11056 scontext=u:r:vdc:s0 tcontext=u:object_r:kmsg_device:s0 tclass=chr_file permissive=0

Bug: 36278706
Test: observe vdc logging in kmsg on boot and stderr on normal usage

(cherry picked from commit bc4d36305dce85a8fd83aec87496e1010c11f56b)

Change-Id: Id7bc2fa87518aa0678c09495267c9e198ca8c968
---
 public/vdc.te | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/public/vdc.te b/public/vdc.te
index 67fb7a3a0..53d7bbe2c 100644
--- a/public/vdc.te
+++ b/public/vdc.te
@@ -22,3 +22,6 @@ allow vdc dumpstate:unix_dgram_socket { read write };
 
 # vdc can be invoked with logwrapper, so let it write to pty
 allow vdc devpts:chr_file rw_file_perms;
+
+# vdc writes directly to kmsg during the boot process
+allow vdc kmsg_device:chr_file w_file_perms;
-- 
GitLab