Something went wrong on our end
-
Dan Cashman authored
Due to the massively increased number of attributes in SELinux policy as part of the treble changes, we have had to remove attributes from policy for performance reasons. Unfortunately, some attributes are required to be in policy to ensure that our neverallow rules are being properly enforced. Usually this is not a problem, since neverallow rules indicate that an attribute should be kept, but this is not currently the case when the attribute is part of a negation in a group. This is particularly problematic with treble since some attributes may exist for HALs that have no implementation, and thus no types. In particular, this has caused an issue with the neverallows added in our macros. Add an extraneous neverallow rule to each of those auto-generated neverallow rules to make sure that they are not removed from policy, until the policy compiler is fixed to avoid this. Also add corresponding rules for other types which have been removed due to no corresponding rules. Bug: 62591065 Bug: 62658302 Test: Attributes present in policy and CTS passes. sepolicy-analyze also works on platform-only policy. Change-Id: Ic3fc034cdbd04a94167f8240cf562297e8d7c762
Dan Cashman authoredDue to the massively increased number of attributes in SELinux policy as part of the treble changes, we have had to remove attributes from policy for performance reasons. Unfortunately, some attributes are required to be in policy to ensure that our neverallow rules are being properly enforced. Usually this is not a problem, since neverallow rules indicate that an attribute should be kept, but this is not currently the case when the attribute is part of a negation in a group. This is particularly problematic with treble since some attributes may exist for HALs that have no implementation, and thus no types. In particular, this has caused an issue with the neverallows added in our macros. Add an extraneous neverallow rule to each of those auto-generated neverallow rules to make sure that they are not removed from policy, until the policy compiler is fixed to avoid this. Also add corresponding rules for other types which have been removed due to no corresponding rules. Bug: 62591065 Bug: 62658302 Test: Attributes present in policy and CTS passes. sepolicy-analyze also works on platform-only policy. Change-Id: Ic3fc034cdbd04a94167f8240cf562297e8d7c762