Skip to content
Snippets Groups Projects
  • Nick Kralevich's avatar
    8b63356b
    Address auditallow spam from init · 8b63356b
    Nick Kralevich authored
    Init has access to a number of character devices inherited via
    domain.te. Exclude those character devices from the auditallow
    logging.
    
    In addition, init has access to a number of character devices explicitly
    listed in init.te. Exclude those from auditallow logging too.
    
    Addresses various auditallow spam, including:
    
    avc: granted { read open } for comm="init" path="/dev/urandom"
    dev="tmpfs" ino=1197 scontext=u:r:init:s0
    tcontext=u:object_r:random_device:s0 tclass=chr_file
    
    avc: granted { read open } for comm="init" path="/dev/ptmx" dev="tmpfs"
    ino=1294 scontext=u:r:init:s0 tcontext=u:object_r:ptmx_device:s0
    tclass=chr_file
    
    avc: granted { read } for comm="init" name="keychord" dev="tmpfs"
    ino=1326 scontext=u:r:init:s0 tcontext=u:object_r:keychord_device:s0
    tclass=chr_file
    
    avc: granted { read open } for comm="init" path="/dev/keychord"
    dev="tmpfs" ino=1326 scontext=u:r:init:s0
    tcontext=u:object_r:keychord_device:s0 tclass=chr_file
    
    and others not covered above.
    
    Bug: 35197529
    Bug: 33347297
    Test: policy compiles and no auditallow denials.
    Change-Id: Id869404a16c81c779943e9967eb32da226b6047e
    8b63356b
    History
    Address auditallow spam from init
    Nick Kralevich authored
    Init has access to a number of character devices inherited via
    domain.te. Exclude those character devices from the auditallow
    logging.
    
    In addition, init has access to a number of character devices explicitly
    listed in init.te. Exclude those from auditallow logging too.
    
    Addresses various auditallow spam, including:
    
    avc: granted { read open } for comm="init" path="/dev/urandom"
    dev="tmpfs" ino=1197 scontext=u:r:init:s0
    tcontext=u:object_r:random_device:s0 tclass=chr_file
    
    avc: granted { read open } for comm="init" path="/dev/ptmx" dev="tmpfs"
    ino=1294 scontext=u:r:init:s0 tcontext=u:object_r:ptmx_device:s0
    tclass=chr_file
    
    avc: granted { read } for comm="init" name="keychord" dev="tmpfs"
    ino=1326 scontext=u:r:init:s0 tcontext=u:object_r:keychord_device:s0
    tclass=chr_file
    
    avc: granted { read open } for comm="init" path="/dev/keychord"
    dev="tmpfs" ino=1326 scontext=u:r:init:s0
    tcontext=u:object_r:keychord_device:s0 tclass=chr_file
    
    and others not covered above.
    
    Bug: 35197529
    Bug: 33347297
    Test: policy compiles and no auditallow denials.
    Change-Id: Id869404a16c81c779943e9967eb32da226b6047e