diff --git a/private/file_contexts b/private/file_contexts index f1d736d0efb9b9b6f1aa1e666229486f678dde24..e0e9d0814d93c1d2cff825fa17aac97b21827233 100644 --- a/private/file_contexts +++ b/private/file_contexts @@ -134,7 +134,7 @@ /dev/uhid u:object_r:uhid_device:s0 /dev/uinput u:object_r:uhid_device:s0 /dev/uio[0-9]* u:object_r:uio_device:s0 -/dev/urandom u:object_r:urandom_device:s0 +/dev/urandom u:object_r:random_device:s0 /dev/usb_accessory u:object_r:usbaccessory_device:s0 /dev/vcs[0-9a-z]* u:object_r:vcs_device:s0 /dev/video[0-9]* u:object_r:video_device:s0 diff --git a/public/device.te b/public/device.te index b4ca6188dd0616f70f9cde7ff338be505195b53d..f01dc6619bb03c2318b5baffbf0e10cad901d43e 100644 --- a/public/device.te +++ b/public/device.te @@ -40,7 +40,6 @@ type serial_device, dev_type; type socket_device, dev_type; type owntty_device, dev_type, mlstrustedobject; type tty_device, dev_type; -type urandom_device, dev_type, mlstrustedobject; type video_device, dev_type; type vcs_device, dev_type; type zero_device, dev_type, mlstrustedobject; diff --git a/public/domain.te b/public/domain.te index 66b1d8a54adb6183ebf4007b514bbedc56ad4559..7c15ebc7201de570702dd01d5d77f4b438c4e6bd 100644 --- a/public/domain.te +++ b/public/domain.te @@ -76,7 +76,6 @@ allow { domain -hwservicemanager } binder_device:chr_file rw_file_perms; allow { domain -servicemanager } hwbinder_device:chr_file rw_file_perms; allow domain ptmx_device:chr_file rw_file_perms; allow domain alarm_device:chr_file r_file_perms; -allow domain urandom_device:chr_file rw_file_perms; allow domain random_device:chr_file rw_file_perms; allow domain properties_device:dir r_dir_perms; allow domain properties_serial:file r_file_perms; diff --git a/public/init.te b/public/init.te index bef8de744c0aac91e3d457f44411c97780a2b13b..235f70c356b2332cf7ad3667a856ae778da41f3d 100644 --- a/public/init.te +++ b/public/init.te @@ -21,7 +21,6 @@ allow init property_type:file { create_file_perms relabelto }; allow init { device socket_device }:dir relabelto; # /dev/random, /dev/urandom allow init random_device:chr_file relabelto; -allow init urandom_device:chr_file relabelto; # /dev/device-mapper, /dev/block(/.*)? allow init tmpfs:{ chr_file blk_file } relabelfrom; allow init tmpfs:blk_file getattr;