From 301555e6f3445cda4ccec0240c37848a1d3b9d0e Mon Sep 17 00:00:00 2001
From: dcashman <dcashman@google.com>
Date: Mon, 13 Jul 2015 15:31:01 -0700
Subject: [PATCH] Allow domains to read tmpfs symlinks.

Domains have the ability to read normal tmpfs files but not symlinks.
Grant this ability.  In particular, allow domains to read /mnt/sdcard.

Addresses the following denial:
type=1400 audit(0.0:19):avc: denied { read } for comm=4173796E635461736B202333 name="sdcard" dev="tmpfs" ino=7475 scontext=u:r:untrusted_app:s0:c512,c768 tcontext=u:object_r:tmpfs:s0 tclass=lnk_file permissive=0

(cherry-pick of commit: 2b0b8299b2f144165290b18855a9ca256492564c)

Bug: 20755029
Change-Id: Iaa5dc278b34faf33473d3e49f92d8766ae5563c0
---
 domain.te | 1 +
 1 file changed, 1 insertion(+)

diff --git a/domain.te b/domain.te
index 70f8f6a5b..0f6c6dac3 100644
--- a/domain.te
+++ b/domain.te
@@ -6,6 +6,7 @@ allow domain init:process sigchld;
 # Read access to properties mapping.
 allow domain kernel:fd use;
 allow domain tmpfs:file { read getattr };
+allow domain tmpfs:lnk_file { read getattr };
 
 # Search /storage/emulated tmpfs mount.
 allow domain tmpfs:dir r_dir_perms;
-- 
GitLab