Skip to content
Snippets Groups Projects
  • Nick Kralevich's avatar
    eb43e654
    uncrypt: drop generic block_device allow rules · eb43e654
    Nick Kralevich authored
    Currently, uncrypt has write access to "block_device". This is
    the generic label used for a file in /dev/block which doesn't
    have a more specific label assigned to it.
    
    This is an overly broad grant. Commit a10f789d
    started the process of deprecating "block_device" access in favor
    of "misc_block_device".
    
    This change completes the deprecation and removes the overly
    broad grant. Also update the neverallow rules so that
    this overly broad rule cannot be reintroduced into uncrypt.
    
    Bug: 25091603
    Change-Id: Ifc5fa412db2f95726ae89c32c577a6659885ae55
    eb43e654
    History
    uncrypt: drop generic block_device allow rules
    Nick Kralevich authored
    Currently, uncrypt has write access to "block_device". This is
    the generic label used for a file in /dev/block which doesn't
    have a more specific label assigned to it.
    
    This is an overly broad grant. Commit a10f789d
    started the process of deprecating "block_device" access in favor
    of "misc_block_device".
    
    This change completes the deprecation and removes the overly
    broad grant. Also update the neverallow rules so that
    this overly broad rule cannot be reintroduced into uncrypt.
    
    Bug: 25091603
    Change-Id: Ifc5fa412db2f95726ae89c32c577a6659885ae55