Skip to content
Snippets Groups Projects
Commit 02530e2c authored by Nick Kralevich's avatar Nick Kralevich Committed by android-build-merger
Browse files

Merge "fine-grained policy for access to /proc/zoneinfo" am: 89a8ed4e am: 9cb9c4bd 

am: 1cf57199

Change-Id: I8e47035f7f931d9567fdd8bb6caa7f717036c626
parents dee4a9e6 1cf57199
Branches
Tags
No related merge requests found
Hide whitespace changes
Inline Side-by-side
dumpstate.te
+ 1
− 0
View file @ 02530e2c
...@@ -182,3 +182,4 @@ allow dumpstate atrace_exec:file rx_file_perms; ...@@ -182,3 +182,4 @@ allow dumpstate atrace_exec:file rx_file_perms;
# accesses to the underlying FS. # accesses to the underlying FS.
allow dumpstate media_rw_data_file:dir getattr; allow dumpstate media_rw_data_file:dir getattr;
allow dumpstate proc_interrupts:file r_file_perms; allow dumpstate proc_interrupts:file r_file_perms;
allow dumpstate proc_zoneinfo:file r_file_perms;
file.te
+ 1
− 0
View file @ 02530e2c
...@@ -22,6 +22,7 @@ type proc_sysrq, fs_type; ...@@ -22,6 +22,7 @@ type proc_sysrq, fs_type;
type proc_timer, fs_type; type proc_timer, fs_type;
type proc_uid_cputime_showstat, fs_type; type proc_uid_cputime_showstat, fs_type;
type proc_uid_cputime_removeuid, fs_type; type proc_uid_cputime_removeuid, fs_type;
type proc_zoneinfo, fs_type;
type selinuxfs, fs_type, mlstrustedobject; type selinuxfs, fs_type, mlstrustedobject;
type cgroup, fs_type, mlstrustedobject; type cgroup, fs_type, mlstrustedobject;
type sysfs, fs_type, sysfs_type, mlstrustedobject; type sysfs, fs_type, sysfs_type, mlstrustedobject;
......
genfs_contexts
+ 1
− 0
View file @ 02530e2c
...@@ -31,6 +31,7 @@ genfscon proc /timer_list u:object_r:proc_timer:s0 ...@@ -31,6 +31,7 @@ genfscon proc /timer_list u:object_r:proc_timer:s0
genfscon proc /timer_stats u:object_r:proc_timer:s0 genfscon proc /timer_stats u:object_r:proc_timer:s0
genfscon proc /uid_cputime/show_uid_stat u:object_r:proc_uid_cputime_showstat:s0 genfscon proc /uid_cputime/show_uid_stat u:object_r:proc_uid_cputime_showstat:s0
genfscon proc /uid_cputime/remove_uid_range u:object_r:proc_uid_cputime_removeuid:s0 genfscon proc /uid_cputime/remove_uid_range u:object_r:proc_uid_cputime_removeuid:s0
genfscon proc /zoneinfo u:object_r:proc_zoneinfo:s0
# selinuxfs booleans can be individually labeled. # selinuxfs booleans can be individually labeled.
genfscon selinuxfs / u:object_r:selinuxfs:s0 genfscon selinuxfs / u:object_r:selinuxfs:s0
......
lmkd.te
+ 2
− 0
View file @ 02530e2c
...@@ -34,6 +34,8 @@ allow lmkd cgroup:dir { remove_name rmdir }; ...@@ -34,6 +34,8 @@ allow lmkd cgroup:dir { remove_name rmdir };
# Set self to SCHED_FIFO # Set self to SCHED_FIFO
allow lmkd self:capability sys_nice; allow lmkd self:capability sys_nice;
allow lmkd proc_zoneinfo:file r_file_perms;
### neverallow rules ### neverallow rules
# never honor LD_PRELOAD # never honor LD_PRELOAD
......
shell.te
+ 1
− 0
View file @ 02530e2c
...@@ -100,6 +100,7 @@ allow shell proc_interrupts:file r_file_perms; ...@@ -100,6 +100,7 @@ allow shell proc_interrupts:file r_file_perms;
allow shell proc_meminfo:file r_file_perms; allow shell proc_meminfo:file r_file_perms;
allow shell proc_stat:file r_file_perms; allow shell proc_stat:file r_file_perms;
allow shell proc_timer:file r_file_perms; allow shell proc_timer:file r_file_perms;
allow shell proc_zoneinfo:file r_file_perms;
r_dir_file(shell, cgroup) r_dir_file(shell, cgroup)
allow shell domain:dir { search open read getattr }; allow shell domain:dir { search open read getattr };
allow shell domain:{ file lnk_file } { open read getattr }; allow shell domain:{ file lnk_file } { open read getattr };
......
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment