From f0c7b46df5e153445bbf85ba61e18bd184534b21 Mon Sep 17 00:00:00 2001
From: Paul Crowley <paulcrowley@google.com>
Date: Fri, 20 Oct 2017 10:07:36 -0700
Subject: [PATCH] C++ version of vold_create_subdirs needs extra permission
10-23 16:40:43.763 7991 7991 I auditd : type=1400 audit(0.0:79): avc: denied { open } for comm="vold_prepare_su" path="/dev/pts/1" dev="devpts" ino=4 scontext=u:r:vold_prepare_subdirs:s0 tcontext=u:object_r:devpts:s0 tclass=chr_file permissive=0
Bug: 67901036
Test: Boot device, create user, create files, remove user, observe logs
Change-Id: I8d33dfd2a0b24611773001f20101db40aeb13632
---
public/vold_prepare_subdirs.te | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/public/vold_prepare_subdirs.te b/public/vold_prepare_subdirs.te
index cc4cdae8f..1476a8c67 100644
--- a/public/vold_prepare_subdirs.te
+++ b/public/vold_prepare_subdirs.te
@@ -8,7 +8,7 @@ typeattribute vold_prepare_subdirs coredomain;
allow vold_prepare_subdirs system_file:file execute_no_trans;
allow vold_prepare_subdirs shell_exec:file rx_file_perms;
allow vold_prepare_subdirs toolbox_exec:file rx_file_perms;
-allow vold_prepare_subdirs devpts:chr_file { ioctl read write };
+allow vold_prepare_subdirs devpts:chr_file rw_file_perms;
allow vold_prepare_subdirs vold:fd use;
allow vold_prepare_subdirs vold:fifo_file { read write };
allow vold_prepare_subdirs file_contexts_file:file r_file_perms;
--
GitLab