From 33da609157619eed21a136226e6883ca1d20105b Mon Sep 17 00:00:00 2001
From: Stephen Smalley <sds@tycho.nsa.gov>
Date: Thu, 4 Apr 2013 11:48:40 -0400
Subject: [PATCH] Allow all domains to read /dev symlinks.
Change-Id: I448a5553937a98775178b94f289ccb45ae862876
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
---
cts.te | 3 ---
domain.te | 1 +
rild.te | 1 -
vold.te | 1 -
4 files changed, 1 insertion(+), 5 deletions(-)
diff --git a/cts.te b/cts.te
index 11b769833..8ae62daf5 100644
--- a/cts.te
+++ b/cts.te
@@ -23,9 +23,6 @@ allow appdomain file_type:dir_file_class_set getattr;
allow appdomain dev_type:dir_file_class_set getattr;
allow appdomain fs_type:dir_file_class_set getattr;
-# Read permission over link file to devices.
-allow appdomain dev_type:lnk_file read;
-
# Tries to open /dev/alarm for writing but expects failure.
dontaudit appdomain alarm_device:chr_file write;
diff --git a/domain.te b/domain.te
index 9124b0d7d..40bab7604 100644
--- a/domain.te
+++ b/domain.te
@@ -40,6 +40,7 @@ allow domain rootfs:lnk_file { read getattr };
# Device accesses.
allow domain device:dir search;
+allow domain dev_type:lnk_file read;
allow domain devpts:dir search;
allow domain device:file read;
allow domain socket_device:dir search;
diff --git a/rild.te b/rild.te
index e8069bff6..690bfabef 100644
--- a/rild.te
+++ b/rild.te
@@ -22,7 +22,6 @@ allow rild bluetooth_efs_file:file r_file_perms;
allow rild bluetooth_efs_file:dir r_dir_perms;
allow rild radio_data_file:dir r_dir_perms;
allow rild radio_data_file:file rw_file_perms;
-allow rild radio_device:lnk_file r_file_perms;
allow rild sdcard_type:dir r_dir_perms;
allow rild system_data_file:dir create_dir_perms;
allow rild system_data_file:file create_file_perms;
diff --git a/vold.te b/vold.te
index c1b905503..8ffc404d4 100644
--- a/vold.te
+++ b/vold.te
@@ -7,7 +7,6 @@ typeattribute vold mlstrustedsubject;
allow vold system_file:file x_file_perms;
allow vold block_device:dir create_dir_perms;
allow vold block_device:blk_file create_file_perms;
-allow vold block_device:lnk_file read;
allow vold devpts:chr_file rw_file_perms;
allow vold rootfs:dir mounton;
allow vold sdcard_type:dir mounton;
--
GitLab