Something went wrong on our end
Select Git revision
shelldomain.te
-
Nick Kralevich authored
Developers should be able to use systrace with user builds. This requires read access to /sys/kernel/debug/tracing/trace, otherwise the following error occurs: $ atrace capturing trace... done TRACE: error opening /sys/kernel/debug/tracing/trace: Permission denied (13) with the following SELinux denial: <4>[ 79.830542] type=1400 audit(11940551.039:8): avc: denied { read } for pid=1156 comm="atrace" name="trace" dev="debugfs" ino=3024 scontext=u:r:shell:s0 tcontext=u:object_r:debugfs:s0 tclass=file At least on the kernel I've tested this on, debugfs doesn't support setting SELinux file labels. Grant read access to all of debugfs to work around this limitation. Bug: 13904660 Change-Id: Ic494bfccafc8f6887c8a4c8278b91245459aea41
Nick Kralevich authoredDevelopers should be able to use systrace with user builds. This requires read access to /sys/kernel/debug/tracing/trace, otherwise the following error occurs: $ atrace capturing trace... done TRACE: error opening /sys/kernel/debug/tracing/trace: Permission denied (13) with the following SELinux denial: <4>[ 79.830542] type=1400 audit(11940551.039:8): avc: denied { read } for pid=1156 comm="atrace" name="trace" dev="debugfs" ino=3024 scontext=u:r:shell:s0 tcontext=u:object_r:debugfs:s0 tclass=file At least on the kernel I've tested this on, debugfs doesn't support setting SELinux file labels. Grant read access to all of debugfs to work around this limitation. Bug: 13904660 Change-Id: Ic494bfccafc8f6887c8a4c8278b91245459aea41
initial_sid_contexts 973 B
sid kernel u:r:kernel:s0
sid security u:object_r:kernel:s0
sid unlabeled u:object_r:unlabeled:s0
sid fs u:object_r:labeledfs:s0
sid file u:object_r:unlabeled:s0
sid file_labels u:object_r:unlabeled:s0
sid init u:object_r:unlabeled:s0
sid any_socket u:object_r:unlabeled:s0
sid port u:object_r:port:s0
sid netif u:object_r:netif:s0
sid netmsg u:object_r:unlabeled:s0
sid node u:object_r:node:s0
sid igmp_packet u:object_r:unlabeled:s0
sid icmp_socket u:object_r:unlabeled:s0
sid tcp_socket u:object_r:unlabeled:s0
sid sysctl_modprobe u:object_r:unlabeled:s0
sid sysctl u:object_r:proc:s0
sid sysctl_fs u:object_r:unlabeled:s0
sid sysctl_kernel u:object_r:unlabeled:s0
sid sysctl_net u:object_r:unlabeled:s0
sid sysctl_net_unix u:object_r:unlabeled:s0
sid sysctl_vm u:object_r:unlabeled:s0
sid sysctl_dev u:object_r:unlabeled:s0
sid kmod u:object_r:unlabeled:s0
sid policy u:object_r:unlabeled:s0
sid scmp_packet u:object_r:unlabeled:s0
sid devnull u:object_r:null_device:s0