Skip to content
Snippets Groups Projects
Commit 3efd41df authored by Sami Tolvanen's avatar Sami Tolvanen Committed by Android Git Automerger
Browse files

am bd7da3eb: am 9d87c647: Allow init to execute /sbin/slideshow 

* commit 'bd7da3eb':
  Allow init to execute /sbin/slideshow
parents ca77ce09 bd7da3eb
No related branches found
No related tags found
No related merge requests found
Show whitespace changes
Inline Side-by-side
domain.te
+ 1
− 1
View file @ 3efd41df
...@@ -180,7 +180,7 @@ neverallow { domain -init -recovery } unlabeled:dir_file_class_set create; ...@@ -180,7 +180,7 @@ neverallow { domain -init -recovery } unlabeled:dir_file_class_set create;
neverallow { domain -debuggerd -vold -dumpstate -system_server } self:capability sys_ptrace; neverallow { domain -debuggerd -vold -dumpstate -system_server } self:capability sys_ptrace;
# Limit device node creation to these whitelisted domains. # Limit device node creation to these whitelisted domains.
neverallow { domain -kernel -init -recovery -ueventd -watchdogd -healthd -vold -uncrypt } self:capability mknod; neverallow { domain -kernel -init -recovery -ueventd -watchdogd -healthd -vold -uncrypt -slideshow } self:capability mknod;
# Limit raw I/O to these whitelisted domains. # Limit raw I/O to these whitelisted domains.
neverallow { domain -kernel -init -recovery -ueventd -watchdogd -healthd -vold -uncrypt -tee } self:capability sys_rawio; neverallow { domain -kernel -init -recovery -ueventd -watchdogd -healthd -vold -uncrypt -tee } self:capability sys_rawio;
......
init.te
+ 1
− 0
View file @ 3efd41df
...@@ -140,6 +140,7 @@ allow init sysfs_type:file w_file_perms; ...@@ -140,6 +140,7 @@ allow init sysfs_type:file w_file_perms;
# Transitions to seclabel processes in init.rc # Transitions to seclabel processes in init.rc
domain_trans(init, rootfs, adbd) domain_trans(init, rootfs, adbd)
domain_trans(init, rootfs, healthd) domain_trans(init, rootfs, healthd)
domain_trans(init, rootfs, slideshow)
recovery_only(` recovery_only(`
domain_trans(init, rootfs, recovery) domain_trans(init, rootfs, recovery)
') ')
......
slideshow.te 0 → 100644
+ 13
− 0
View file @ 3efd41df
# slideshow seclabel is specified in init.rc since
# it lives in the rootfs and has no unique file type.
type slideshow, domain;
write_klog(slideshow)
allow slideshow device:dir r_dir_perms;
allow slideshow self:capability { mknod sys_tty_config };
allow slideshow graphics_device:dir r_dir_perms;
allow slideshow graphics_device:chr_file rw_file_perms;
allow slideshow input_device:dir r_dir_perms;
allow slideshow input_device:chr_file r_file_perms;
allow slideshow tty_device:chr_file rw_file_perms;
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment