Skip to content
Snippets Groups Projects
Commit 30707a45 authored by Nick Kralevich's avatar Nick Kralevich
Browse files

init.te: remove unactionable auditallow statements

Commit 0d08d472 added two auditallow
statements. The intented purpose of the auditallow statement was:

  auditallow accesses by init to files
  and character devices left in the generic device type so we can monitor
  what is being left there, although it is not necessarily a problem unless
  the file or device should be accessible to others.

As currently written, the auditallow rules aren't actionable. It's not
a problem by itself for init to access a /dev file or chr_file.
Rather, we care about when other domains access such files.

Currently, this generates a number of (expected) audit statements on
boot, which causes unnecessary confusion and makes people believe
that something is broken.

Remove the unactionable auditallow statements.

Change-Id: Ibfe33976505a7dc3f8d15c9eb203c044a39da426
parent 6ae82910
No related branches found
No related tags found
No related merge requests found
...@@ -212,14 +212,12 @@ allow init hw_random_device:chr_file r_file_perms; ...@@ -212,14 +212,12 @@ allow init hw_random_device:chr_file r_file_perms;
# TODO: Move these files into their own type unless they are # TODO: Move these files into their own type unless they are
# only ever accessed by init. # only ever accessed by init.
allow init device:file create_file_perms; allow init device:file create_file_perms;
auditallow init device:file create_file_perms;
# Access character devices without a specific type, # Access character devices without a specific type,
# e.g. /dev/keychord. # e.g. /dev/keychord.
# TODO: Move these devices into their own type unless they # TODO: Move these devices into their own type unless they
# are only ever accessed by init. # are only ever accessed by init.
allow init device:chr_file { rw_file_perms setattr }; allow init device:chr_file { rw_file_perms setattr };
auditallow init device:chr_file { rw_file_perms setattr };
# keychord configuration # keychord configuration
allow init self:capability sys_tty_config; allow init self:capability sys_tty_config;
......
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment