From 2df6227ab7f5a20ebaf7956ce7c095c7d73acedc Mon Sep 17 00:00:00 2001
From: Jeff Vander Stoep <jeffv@google.com>
Date: Fri, 9 Sep 2016 07:25:33 -0700
Subject: [PATCH] Revert "Allow kernel to read proc"
This reverts commit 48d68a6486093e03d4d4915980ac15ec67c8c07b.
Bug: 31364540
Change-Id: I2a83b661e06c84f42c0a7aa566f02d2c135b96c3
---
domain_deprecated.te | 4 ++--
kernel.te | 1 -
2 files changed, 2 insertions(+), 3 deletions(-)
diff --git a/domain_deprecated.te b/domain_deprecated.te
index 5485f8d37..fb115af67 100644
--- a/domain_deprecated.te
+++ b/domain_deprecated.te
@@ -89,8 +89,8 @@ r_dir_file(domain_deprecated, cgroup)
allow domain_deprecated proc_meminfo:file r_file_perms;
r_dir_file(domain_deprecated, proc_net)
#auditallow domain_deprecated proc:dir r_dir_perms; # r_dir_perms granted in domain
-auditallow { domain_deprecated -fsck -fsck_untrusted -init -kernel -logd -priv_app -rild -system_server -vold } proc:file r_file_perms;
-auditallow { domain_deprecated -fsck -fsck_untrusted -init -kernel -logd -priv_app -rild -system_server -vold } proc:lnk_file { open ioctl lock }; # getattr read granted in domain
+auditallow { domain_deprecated -fsck -fsck_untrusted -init -logd -priv_app -rild -system_server -vold } proc:file r_file_perms;
+auditallow { domain_deprecated -fsck -fsck_untrusted -init -logd -priv_app -rild -system_server -vold } proc:lnk_file { open ioctl lock }; # getattr read granted in domain
auditallow { domain_deprecated -bluetooth -fingerprintd -healthd -init -netd -priv_app -rild -system_app -surfaceflinger -system_server -tee -ueventd -vold -wpa } sysfs:dir { open getattr read ioctl lock }; # search granted in domain
auditallow { domain_deprecated -bluetooth -fingerprintd -healthd -init -netd -priv_app -rild -system_app -surfaceflinger -system_server -tee -ueventd -vold -wpa } sysfs:file r_file_perms;
auditallow { domain_deprecated -bluetooth -fingerprintd -healthd -init -netd -priv_app -rild -system_app -surfaceflinger -system_server -tee -ueventd -vold -wpa } sysfs:lnk_file { getattr open ioctl lock }; # read granted in domain
diff --git a/kernel.te b/kernel.te
index 3b7794709..a49295498 100644
--- a/kernel.te
+++ b/kernel.te
@@ -5,7 +5,6 @@ allow kernel self:capability sys_nice;
# Root fs.
r_dir_file(kernel, rootfs)
-r_dir_file(kernel, proc)
# Get SELinux enforcing status.
allow kernel selinuxfs:dir r_dir_perms;
--
GitLab