Skip to content
Snippets Groups Projects
  • Jeff Vander Stoep's avatar
    5c41d40e
    system_server: allow writing to timerslack_ns · 5c41d40e
    Jeff Vander Stoep authored
    The only file in /proc/<pid>/ that is world writeable is
    /proc/<pid>/timerslack_ns so granting selinux write permission to
    a process's /proc/<pid>/ file only allows writing to timerslack_ns
    (unless the process is running as system UID).
    
    Addresses denials such as:
    avc: denied { write } for comm="Binder:1117_2" name="timerslack_ns"
    dev="proc" ino=27908 scontext=u:r:system_server:s0
    tcontext=u:r:priv_app:s0 tclass=file permissive=1
    
    Bug: 30675296
    Test: build
    Change-Id: I2cee8ce73a0dc05d771881c36da2fde5411859fb
    5c41d40e
    History
    system_server: allow writing to timerslack_ns
    Jeff Vander Stoep authored
    The only file in /proc/<pid>/ that is world writeable is
    /proc/<pid>/timerslack_ns so granting selinux write permission to
    a process's /proc/<pid>/ file only allows writing to timerslack_ns
    (unless the process is running as system UID).
    
    Addresses denials such as:
    avc: denied { write } for comm="Binder:1117_2" name="timerslack_ns"
    dev="proc" ino=27908 scontext=u:r:system_server:s0
    tcontext=u:r:priv_app:s0 tclass=file permissive=1
    
    Bug: 30675296
    Test: build
    Change-Id: I2cee8ce73a0dc05d771881c36da2fde5411859fb