From 274d2927a7ccbfd266c83d6da5e9e2772805fbd5 Mon Sep 17 00:00:00 2001
From: repo sync <gcondra@google.com>
Date: Wed, 22 May 2013 13:19:58 -0700
Subject: [PATCH] Clean up remaining denials.
Bug: 8424461
Change-Id: I8f0b01cdb19b4a479d5de842f4e4844aeab00622
---
tee.te | 2 +-
unconfined.te | 2 +-
watchdogd.te | 1 +
3 files changed, 3 insertions(+), 2 deletions(-)
diff --git a/tee.te b/tee.te
index 79f8d13cf..2fab2820c 100644
--- a/tee.te
+++ b/tee.te
@@ -7,5 +7,5 @@ type tee_device, dev_type;
type tee_data_file, file_type, data_file_type;
permissive tee;
-unconfined_domain(netd)
+unconfined_domain(tee)
init_daemon_domain(tee)
diff --git a/unconfined.te b/unconfined.te
index 3dbfb59d0..9f100a3e2 100644
--- a/unconfined.te
+++ b/unconfined.te
@@ -14,7 +14,7 @@ allow unconfineddomain fs_type:filesystem *;
allow unconfineddomain {fs_type dev_type file_type}:{ dir blk_file lnk_file sock_file fifo_file } *;
allow unconfineddomain {fs_type dev_type file_type}:{ chr_file file } ~entrypoint;
allow unconfineddomain node_type:node *;
-allow unconfineddomain node_type:{ tcp_socket udp_socket } node_bind;
+allow unconfineddomain node_type:{ tcp_socket udp_socket rawip_socket } node_bind;
allow unconfineddomain netif_type:netif *;
allow unconfineddomain port_type:socket_class_set name_bind;
allow unconfineddomain port_type:{ tcp_socket dccp_socket } name_connect;
diff --git a/watchdogd.te b/watchdogd.te
index 1c14d8f00..3bf9aae1d 100644
--- a/watchdogd.te
+++ b/watchdogd.te
@@ -2,3 +2,4 @@
type watchdogd, domain;
permissive watchdogd;
unconfined_domain(watchdogd)
+allow watchdogd rootfs:file entrypoint;
--
GitLab