Skip to content
Snippets Groups Projects
  • Tri Vo's avatar
    c4ef3630
    shell: neverallow access to 'proc' label. · c4ef3630
    Tri Vo authored
    Added access to proc_uptime and proc_asound to address these denials:
    
    avc: denied { read } for name="uptime" dev="proc" ino=4026532080
    scontext=u:r:shell:s0 tcontext=u:object_r:proc_uptime:s0 tclass=file
    permissive=1
    
    avc: denied { getattr } for path="/proc/asound/version" dev="proc"
    ino=4026532017 scontext=u:r:shell:s0 tcontext=u:object_r:proc_asound:s0
    tclass=file permissive=1
    
    Bug: 65643247
    Test: device boots with no denial from 'shell' domain.
    Test: lsmod, ps, top, netstat
    Test: No denials triggered from CtsSecurityHostTestCases
    Test: external/toybox/run-tests-on-android.sh does not pass, but triggers
    no denials from 'shell' domain to 'proc' type.
    
    Change-Id: Ia4c26fd616e33e5962c6707a855dc24e338ec153
    c4ef3630
    History
    shell: neverallow access to 'proc' label.
    Tri Vo authored
    Added access to proc_uptime and proc_asound to address these denials:
    
    avc: denied { read } for name="uptime" dev="proc" ino=4026532080
    scontext=u:r:shell:s0 tcontext=u:object_r:proc_uptime:s0 tclass=file
    permissive=1
    
    avc: denied { getattr } for path="/proc/asound/version" dev="proc"
    ino=4026532017 scontext=u:r:shell:s0 tcontext=u:object_r:proc_asound:s0
    tclass=file permissive=1
    
    Bug: 65643247
    Test: device boots with no denial from 'shell' domain.
    Test: lsmod, ps, top, netstat
    Test: No denials triggered from CtsSecurityHostTestCases
    Test: external/toybox/run-tests-on-android.sh does not pass, but triggers
    no denials from 'shell' domain to 'proc' type.
    
    Change-Id: Ia4c26fd616e33e5962c6707a855dc24e338ec153