diff options
| author | Miroslav Tisma <miroslav.tisma@imgtec.com> | 2015-12-10 12:23:40 +0100 |
|---|---|---|
| committer | Miroslav Tisma <miroslav.tisma@imgtec.com> | 2015-12-11 16:21:00 +0100 |
| commit | 36a76ec098404241878a0a8026725187524737df (patch) | |
| tree | 8eb9328473c32651033a0608ce1b20667846b686 | |
| parent | 6950168f1d4bd6ddfd64755c26d7de6ef3709f00 (diff) | |
| download | build-36a76ec098404241878a0a8026725187524737df.tar.gz | |
sepolicy: Fix 'avc denied' issues for the emulators
This commit fixes the avc denied issues in the emulators:
- goldfish_setup is granted for network access
- netd dontaudit for sys_module
- qemu_prop is granted domain for get_prop
Critical issue was that SELinux denied reading the lcd_density property
by SurfaceFlinger via qemu_prop and this commit fixes it.
Change-Id: I633d96f4d2ee6659f18482a53e21f816abde2a5f
Signed-off-by: Miroslav Tisma <miroslav.tisma@imgtec.com>
| -rw-r--r-- | target/board/generic/sepolicy/domain.te | 2 | ||||
| -rw-r--r-- | target/board/generic/sepolicy/goldfish_setup.te | 2 | ||||
| -rw-r--r-- | target/board/generic/sepolicy/netd.te | 1 |
3 files changed, 5 insertions, 0 deletions
diff --git a/target/board/generic/sepolicy/domain.te b/target/board/generic/sepolicy/domain.te index c28ca74f15..201fa8640c 100644 --- a/target/board/generic/sepolicy/domain.te +++ b/target/board/generic/sepolicy/domain.te @@ -1,3 +1,5 @@ # For /sys/qemu_trace files in the emulator. allow domain sysfs_writable:file rw_file_perms; allow domain qemu_device:chr_file rw_file_perms; + +get_prop(domain, qemu_prop) diff --git a/target/board/generic/sepolicy/goldfish_setup.te b/target/board/generic/sepolicy/goldfish_setup.te index b472d2aae7..bce196a7d2 100644 --- a/target/board/generic/sepolicy/goldfish_setup.te +++ b/target/board/generic/sepolicy/goldfish_setup.te @@ -13,6 +13,8 @@ allow goldfish_setup toolbox_exec:file rx_file_perms; allow goldfish_setup self:capability { net_admin net_raw }; allow goldfish_setup self:udp_socket create_socket_perms; +net_domain(goldfish_setup) + # Set net.eth0.dns*, debug.sf.nobootanimation set_prop(goldfish_setup, system_prop) set_prop(goldfish_setup, debug_prop) diff --git a/target/board/generic/sepolicy/netd.te b/target/board/generic/sepolicy/netd.te new file mode 100644 index 0000000000..2b002ec9c6 --- /dev/null +++ b/target/board/generic/sepolicy/netd.te @@ -0,0 +1 @@ +dontaudit netd self:capability sys_module; |