Skip to content
Snippets Groups Projects
  • Nick Kralevich's avatar
    23f95178
    Don't grant domain device:dir rw_dir_perms · 23f95178
    Nick Kralevich authored
    write_logd() is allowed for domain, which means that all domains
    are permitted read/write access to /dev. That's overly permissive
    and causes substantial differences between user and userdebug/eng
    devices.
    
    Remove domain device:dir rw_dir_perms access. It's not needed.
    
    Allow all domains to write/append to logd_debug. logd is responsible
    for creating this file if need be. Remove logd_debug file create
    permissions. This also eliminates the need for the type_transition
    rules.
    
    Bug: 15419803
    
    (cherry picked from commit 2bcea0a3)
    
    Change-Id: If430615a3f3118124be331da518afc41f27aab5f
    23f95178
    History
    Don't grant domain device:dir rw_dir_perms
    Nick Kralevich authored
    write_logd() is allowed for domain, which means that all domains
    are permitted read/write access to /dev. That's overly permissive
    and causes substantial differences between user and userdebug/eng
    devices.
    
    Remove domain device:dir rw_dir_perms access. It's not needed.
    
    Allow all domains to write/append to logd_debug. logd is responsible
    for creating this file if need be. Remove logd_debug file create
    permissions. This also eliminates the need for the type_transition
    rules.
    
    Bug: 15419803
    
    (cherry picked from commit 2bcea0a3)
    
    Change-Id: If430615a3f3118124be331da518afc41f27aab5f