Allow AOSP processes to read pm_prop am: 0f5ad4e5

am: 21ce3450 Change-Id: Ic4cabef801675f28f6fe81c6034cff377ec59791

Allow AOSP processes to read pm_prop am: 0f5ad4e5
4eb9687f · Jeff Vander Stoep · android-build-merger · feabf294 · 21ce3450 · 4eb9687f
Commit 4eb9687f authored 7 years ago by Jeff Vander Stoep Committed by android-build-merger 7 years ago
--- a/private/coredomain.te
+++ b/private/coredomain.te
+get_prop(coredomain, pm_prop)
--- a/public/domain.te
+++ b/public/domain.te
@@ -450,6 +450,10 @@ neverallow * hidl_base_hwservice:hwservice_manager find;
 neverallow { domain -init } default_prop:property_service set;
 neverallow { domain -init } mmc_prop:property_service set;

+# Only core domains are allowed to access package_manager properties
+neverallow { domain -init -system_server } pm_prop:property_service set;
+neverallow { domain -coredomain } pm_prop:file no_rw_file_perms;
+
 # Do not allow reading device's serial number from system properties except form
 # a few whitelisted domains.
 neverallow {