Skip to content
Snippets Groups Projects
Commit 317d6b4d authored by Tri Vo's avatar Tri Vo Committed by android-build-merger
Browse files

init: remove open, read, write access to 'sysfs' type.

am: c2241a8d

Change-Id: I4178c482a6b1241bedbadea1aa721c7b08ae8cb3
parents 54d044c1 c2241a8d
No related branches found
No related tags found
No related merge requests found
...@@ -101,6 +101,7 @@ genfscon sysfs /devices/virtual/net u:object_r:sysfs_net:s0 ...@@ -101,6 +101,7 @@ genfscon sysfs /devices/virtual/net u:object_r:sysfs_net:s0
genfscon sysfs /devices/virtual/switch u:object_r:sysfs_switch:s0 genfscon sysfs /devices/virtual/switch u:object_r:sysfs_switch:s0
genfscon sysfs /firmware/devicetree/base/firmware/android u:object_r:sysfs_dt_firmware_android:s0 genfscon sysfs /firmware/devicetree/base/firmware/android u:object_r:sysfs_dt_firmware_android:s0
genfscon sysfs /fs/ext4/features u:object_r:sysfs_fs_ext4_features:s0 genfscon sysfs /fs/ext4/features u:object_r:sysfs_fs_ext4_features:s0
genfscon sysfs /power/autosleep u:object_r:sysfs_power:s0
genfscon sysfs /power/state u:object_r:sysfs_power:s0 genfscon sysfs /power/state u:object_r:sysfs_power:s0
genfscon sysfs /power/wakeup_count u:object_r:sysfs_power:s0 genfscon sysfs /power/wakeup_count u:object_r:sysfs_power:s0
genfscon sysfs /power/wake_lock u:object_r:sysfs_wake_lock:s0 genfscon sysfs /power/wake_lock u:object_r:sysfs_wake_lock:s0
......
...@@ -211,6 +211,7 @@ allow init { ...@@ -211,6 +211,7 @@ allow init {
-contextmount_type -contextmount_type
-proc -proc
-sdcard_type -sdcard_type
-sysfs
-rootfs -rootfs
}:file { open read setattr }; }:file { open read setattr };
allow init { fs_type -contextmount_type -sdcard_type -rootfs }:dir { open read setattr search }; allow init { fs_type -contextmount_type -sdcard_type -rootfs }:dir { open read setattr search };
...@@ -292,6 +293,24 @@ allow init { ...@@ -292,6 +293,24 @@ allow init {
proc_security proc_security
}:file rw_file_perms; }:file rw_file_perms;
# init access to /sys files.
allow init {
sysfs_android_usb
sysfs_leds
sysfs_power
sysfs_zram
}:file w_file_perms;
# init chmod/chown access to /sys files.
allow init {
sysfs_android_usb
sysfs_devices_system_cpu
sysfs_ipv4
sysfs_leds
sysfs_lowmemorykiller
sysfs_power
}:file setattr;
# Set usermodehelpers. # Set usermodehelpers.
allow init { usermodehelper sysfs_usermodehelper }:file rw_file_perms; allow init { usermodehelper sysfs_usermodehelper }:file rw_file_perms;
...@@ -300,11 +319,6 @@ allow init self:global_capability_class_set net_admin; ...@@ -300,11 +319,6 @@ allow init self:global_capability_class_set net_admin;
# Reboot. # Reboot.
allow init self:global_capability_class_set sys_boot; allow init self:global_capability_class_set sys_boot;
# Write to sysfs nodes.
allow init sysfs_type:dir r_dir_perms;
allow init sysfs_type:lnk_file read;
allow init sysfs_type:file rw_file_perms;
# Init will create /data/misc/logd when the property persist.logd.logpersistd is "logcatd". # Init will create /data/misc/logd when the property persist.logd.logpersistd is "logcatd".
# Init will also walk through the directory as part of a recursive restorecon. # Init will also walk through the directory as part of a recursive restorecon.
allow init misc_logd_file:dir { add_name open create read getattr setattr search write }; allow init misc_logd_file:dir { add_name open create read getattr setattr search write };
...@@ -458,3 +472,6 @@ neverallow init servicemanager:service_manager list; ...@@ -458,3 +472,6 @@ neverallow init servicemanager:service_manager list;
# Init should not be creating subdirectories in /data/local/tmp # Init should not be creating subdirectories in /data/local/tmp
neverallow init shell_data_file:dir { write add_name remove_name }; neverallow init shell_data_file:dir { write add_name remove_name };
# Init should not access sysfs node that are not explicitly labeled.
neverallow init sysfs:file { open read write };
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment