Skip to content
Snippets Groups Projects
Commit 5f6e9303 authored by Nick Kralevich's avatar Nick Kralevich Committed by Android Git Automerger
Browse files

am f70fcbd8: Merge "sepolicy: remove block_device access from install_recovery" 

* commit 'f70fcbd8':
  sepolicy:  remove block_device access from install_recovery
parents 2714e41a f70fcbd8
No related branches found
No related tags found
No related merge requests found
Hide whitespace changes
Inline Side-by-side
domain.te
+ 1
− 1
View file @ 5f6e9303
...@@ -257,7 +257,7 @@ neverallow domain init:binder *; ...@@ -257,7 +257,7 @@ neverallow domain init:binder *;
# Don't allow raw read/write/open access to block_device # Don't allow raw read/write/open access to block_device
# Rather force a relabel to a more specific type # Rather force a relabel to a more specific type
neverallow { domain -kernel -init -recovery -vold -uncrypt -install_recovery } block_device:blk_file { open read write }; neverallow { domain -kernel -init -recovery -vold -uncrypt } block_device:blk_file { open read write };
# Don't allow raw read/write/open access to generic devices. # Don't allow raw read/write/open access to generic devices.
# Rather force a relabel to a more specific type. # Rather force a relabel to a more specific type.
......
install_recovery.te
+ 0
− 4
View file @ 5f6e9303
...@@ -14,11 +14,7 @@ allow install_recovery shell_exec:file rx_file_perms; ...@@ -14,11 +14,7 @@ allow install_recovery shell_exec:file rx_file_perms;
allow install_recovery system_file:file rx_file_perms; allow install_recovery system_file:file rx_file_perms;
# Update the recovery block device # Update the recovery block device
# TODO: Limit this to only recovery block device when we
# create an appropriate label for it.
allow install_recovery block_device:dir search; allow install_recovery block_device:dir search;
allow install_recovery block_device:blk_file rw_file_perms;
auditallow install_recovery block_device:blk_file rw_file_perms;
allow install_recovery recovery_block_device:blk_file rw_file_perms; allow install_recovery recovery_block_device:blk_file rw_file_perms;
# Create and delete /cache/saved.file # Create and delete /cache/saved.file
......
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment