diff --git a/private/file_contexts b/private/file_contexts index 678a705c82e91f4c3bfdbfb93c992f4b583140cc..c17a39da5d69ad331e912be476f04c35ecf15f12 100644 --- a/private/file_contexts +++ b/private/file_contexts @@ -78,7 +78,6 @@ /dev/cam u:object_r:camera_device:s0 /dev/console u:object_r:console_device:s0 /dev/cpuctl(/.*)? u:object_r:cpuctl_device:s0 -/dev/memcg(/.*)? u:object_r:memcg_device:s0 /dev/device-mapper u:object_r:dm_device:s0 /dev/eac u:object_r:audio_device:s0 /dev/event-log-tags u:object_r:runtime_event_log_tags_file:s0 diff --git a/public/device.te b/public/device.te index 15799b89a67905f96cf11e1f6ec21f4ab6035828..4a3bec91f0bd14a6fd2bce9b5c2d05ca06d23833 100644 --- a/public/device.te +++ b/public/device.te @@ -21,7 +21,6 @@ type rtc_device, dev_type; type vold_device, dev_type; type console_device, dev_type; type cpuctl_device, dev_type; -type memcg_device, dev_type; type fscklogs, dev_type; type full_device, dev_type; # GPU (used by most UI apps) diff --git a/public/domain.te b/public/domain.te index 7abffce00cccaf25c4ee620c9b4fb915d7a2fd53..ea63d1c65f0ce7895650c2fc537680ec9a5ac492 100644 --- a/public/domain.te +++ b/public/domain.te @@ -226,9 +226,6 @@ with_asan(`allow domain system_data_file:dir getattr;') ### neverallow rules ### -# Don't allow others to access memcg. -neverallow { domain -init -lmkd userdebug_or_eng(`-domain') } memcg_device:dir_file_class_set *; - # All socket ioctls must be restricted to a whitelist. neverallowxperm domain domain:socket_class_set ioctl { 0 }; diff --git a/public/init.te b/public/init.te index cf9488f87fec769cd37f0fb926b76bd653141cbe..b21c4d09e1354b2cb88c1844b52ab743c0d03f1f 100644 --- a/public/init.te +++ b/public/init.te @@ -77,7 +77,6 @@ allow init tmpfs:dir mounton; allow init cgroup:dir create_dir_perms; r_dir_file(init, cgroup) allow init cpuctl_device:dir { create mounton }; -allow init memcg_device:dir { create mounton }; # /config allow init configfs:dir mounton; diff --git a/public/lmkd.te b/public/lmkd.te index c2dcadd5ff83cbecccad5030959ee9b67de8e31d..f4e6c2d57091273592e66cabbcfa5f51bac20b32 100644 --- a/public/lmkd.te +++ b/public/lmkd.te @@ -21,9 +21,6 @@ allow lmkd system_server:file write; r_dir_file(lmkd, sysfs_type) allow lmkd sysfs_lowmemorykiller:file w_file_perms; -allow lmkd memcg_device:dir search; -allow lmkd memcg_device:file rw_file_perms; - # Send kill signals allow lmkd appdomain:process sigkill; @@ -35,8 +32,6 @@ allow lmkd self:capability sys_nice; allow lmkd proc_zoneinfo:file r_file_perms; -r_dir_file(lmkd, cgroup) - ### neverallow rules # never honor LD_PRELOAD