Skip to content
Snippets Groups Projects
  • Nick Kralevich's avatar
    5cf3994d
    Revert /proc/net related changes · 5cf3994d
    Nick Kralevich authored
    Revert the tightening of /proc/net access. These changes
    are causing a lot of denials, and I want additional time to
    figure out a better solution.
    
    Addresses the following denials (and many more):
    
      avc: denied { read } for comm="SyncAdapterThre" name="stats" dev="proc" ino=X scontext=u:r:untrusted_app:s0:c512,c768 tcontext=u:object_r:proc_net:s0 tclass=file
      avc: denied { read } for comm="facebook.katana" name="iface_stat_fmt" dev="proc" ino=X scontext=u:r:untrusted_app:s0:c512,c768 tcontext=u:object_r:proc_net:s0 tclass=file
      avc: denied { read } for comm="IntentService[C" name="if_inet6" dev="proc" ino=X scontext=u:r:untrusted_app:s0:c512,c768 tcontext=u:object_r:proc_net:s0 tclass=file
      avc: denied { read } for comm="dumpstate" name="iface_stat_all" dev="proc" ino=X scontext=u:r:dumpstate:s0 tcontext=u:object_r:proc_net:s0 tclass=file
    
    This reverts commit 0f0324cc
    and commit 99940d1a
    
    Bug: 9496886
    Bug: 19034637
    Change-Id: I436a6e3638ac9ed49afbee214e752fe2b0112868
    5cf3994d
    History
    Revert /proc/net related changes
    Nick Kralevich authored
    Revert the tightening of /proc/net access. These changes
    are causing a lot of denials, and I want additional time to
    figure out a better solution.
    
    Addresses the following denials (and many more):
    
      avc: denied { read } for comm="SyncAdapterThre" name="stats" dev="proc" ino=X scontext=u:r:untrusted_app:s0:c512,c768 tcontext=u:object_r:proc_net:s0 tclass=file
      avc: denied { read } for comm="facebook.katana" name="iface_stat_fmt" dev="proc" ino=X scontext=u:r:untrusted_app:s0:c512,c768 tcontext=u:object_r:proc_net:s0 tclass=file
      avc: denied { read } for comm="IntentService[C" name="if_inet6" dev="proc" ino=X scontext=u:r:untrusted_app:s0:c512,c768 tcontext=u:object_r:proc_net:s0 tclass=file
      avc: denied { read } for comm="dumpstate" name="iface_stat_all" dev="proc" ino=X scontext=u:r:dumpstate:s0 tcontext=u:object_r:proc_net:s0 tclass=file
    
    This reverts commit 0f0324cc
    and commit 99940d1a
    
    Bug: 9496886
    Bug: 19034637
    Change-Id: I436a6e3638ac9ed49afbee214e752fe2b0112868