Skip to content
Snippets Groups Projects
Commit 54a42001 authored by Sandeep Patil's avatar Sandeep Patil
Browse files

prop_context: correctly label all property_context files


split property context file in vendor and sytem were left untouched by
the recent changes. This was working accidentally because they were
still accessible to all domains as 'system_file'.

Bug: 36002573
Test: Boot sailfish to observe no new denials.
Test: 'adb sideload' OTA on sailfish successfully

Change-Id: I5bec058b59db83d2a431e9f7e91c5a09af7d2942
Signed-off-by: default avatarSandeep Patil <sspatil@google.com>
parent 4a478c47
No related branches found
No related tags found
No related merge requests found
...@@ -44,8 +44,8 @@ ...@@ -44,8 +44,8 @@
/mapping_sepolicy\.cil u:object_r:rootfs:s0 /mapping_sepolicy\.cil u:object_r:rootfs:s0
/nonplat_sepolicy\.cil u:object_r:rootfs:s0 /nonplat_sepolicy\.cil u:object_r:rootfs:s0
/plat_sepolicy\.cil u:object_r:rootfs:s0 /plat_sepolicy\.cil u:object_r:rootfs:s0
/plat_property_contexts u:object_r:property_contexts:s0 /plat_property_contexts u:object_r:property_contexts_file:s0
/nonplat_property_contexts u:object_r:property_contexts:s0 /nonplat_property_contexts u:object_r:property_contexts_file:s0
/seapp_contexts u:object_r:rootfs:s0 /seapp_contexts u:object_r:rootfs:s0
/nonplat_seapp_contexts u:object_r:rootfs:s0 /nonplat_seapp_contexts u:object_r:rootfs:s0
/plat_seapp_contexts u:object_r:rootfs:s0 /plat_seapp_contexts u:object_r:rootfs:s0
...@@ -249,11 +249,13 @@ ...@@ -249,11 +249,13 @@
/system/bin/virtual_touchpad u:object_r:virtual_touchpad_exec:s0 /system/bin/virtual_touchpad u:object_r:virtual_touchpad_exec:s0
/system/bin/vr_wm u:object_r:vr_wm_exec:s0 /system/bin/vr_wm u:object_r:vr_wm_exec:s0
/system/bin/hw/android\.hidl\.allocator@1\.0-service u:object_r:hal_allocator_default_exec:s0 /system/bin/hw/android\.hidl\.allocator@1\.0-service u:object_r:hal_allocator_default_exec:s0
/system/etc/selinux/plat_property_contexts u:object_r:property_contexts_file:s0
############################# #############################
# Vendor files # Vendor files
# #
/vendor(/.*)? u:object_r:system_file:s0 /vendor(/.*)? u:object_r:system_file:s0
/vendor/etc/selinux/nonplat_property_contexts u:object_r:property_contexts_file:s0
############################# #############################
# OEM and ODM files # OEM and ODM files
......
...@@ -89,7 +89,7 @@ get_prop(domain, core_property_type) ...@@ -89,7 +89,7 @@ get_prop(domain, core_property_type)
# messages to logd. # messages to logd.
get_prop(domain, log_property_type) get_prop(domain, log_property_type)
dontaudit domain property_type:file audit_access; dontaudit domain property_type:file audit_access;
allow domain property_contexts:file r_file_perms; allow domain property_contexts_file:file r_file_perms;
allow domain init:key search; allow domain init:key search;
allow domain vold:key search; allow domain vold:key search;
......
...@@ -257,7 +257,7 @@ type sap_uim_socket, file_type; ...@@ -257,7 +257,7 @@ type sap_uim_socket, file_type;
type gps_control, file_type; type gps_control, file_type;
# property_contexts file # property_contexts file
type property_contexts, file_type; type property_contexts_file, file_type;
# Allow files to be created in their appropriate filesystems. # Allow files to be created in their appropriate filesystems.
allow fs_type self:filesystem associate; allow fs_type self:filesystem associate;
......
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment