diff --git a/public/domain.te b/public/domain.te index f0867a4c4b803496a4d87090620d7041b362a1df..7c772b44113a0e77b52be12ac49e1d0cc25d9083 100644 --- a/public/domain.te +++ b/public/domain.te @@ -560,7 +560,7 @@ neverallow { } serialno_prop:file r_file_perms; # Do not allow reading the last boot timestamp from system properties -neverallow { domain -init -system_server } firstboot_prop:file r_file_perms; +neverallow { domain -init -system_server -dumpstate } firstboot_prop:file r_file_perms; neverallow { domain diff --git a/public/dumpstate.te b/public/dumpstate.te index 8906f5dcf4c8431ec3aacc0a8fc502519fb29a85..9d7743c3bf1c7223f4d0e1ae20433e9237030008 100644 --- a/public/dumpstate.te +++ b/public/dumpstate.te @@ -233,16 +233,8 @@ set_prop(dumpstate, exported_dumpstate_prop) # dumpstate_options_prop is used to pass extra command-line args. set_prop(dumpstate, dumpstate_options_prop) -# Read device's serial number from system properties -get_prop(dumpstate, serialno_prop) - -# Read state of logging-related properties -get_prop(dumpstate, device_logging_prop) - -# Read state of boot reason properties -get_prop(dumpstate, bootloader_boot_reason_prop) -get_prop(dumpstate, last_boot_reason_prop) -get_prop(dumpstate, system_boot_reason_prop) +# Read any system properties +get_prop(dumpstate, property_type) # Access to /data/media. # This should be removed if sdcardfs is modified to alter the secontext for its diff --git a/public/netd.te b/public/netd.te index 0e9e08ca7f0772f62d97d17a0a87b9e8d7ecb082..18113e75662d686d79a4982211a5853b4288f70d 100644 --- a/public/netd.te +++ b/public/netd.te @@ -141,7 +141,7 @@ neverallow netd { appdomain userdebug_or_eng(`-su') }:binder call; # persist.netd.stable_secret contains RFC 7217 secret key which should never be # leaked to other processes. Make sure it never leaks. -neverallow { domain -netd -init } netd_stable_secret_prop:file r_file_perms; +neverallow { domain -netd -init -dumpstate } netd_stable_secret_prop:file r_file_perms; # We want to ensure that no other process ever tries tampering with persist.netd.stable_secret, # the RFC 7217 secret key managed by netd. Doing so could compromise user privacy.