diff --git a/private/app.te b/private/app.te index ef267f232975d3a788594abc8afafb353e1cdf4d..9c4461cc5a9288e0a745628c55171a4aeb221491 100644 --- a/private/app.te +++ b/private/app.te @@ -1,4 +1,3 @@ # TODO: deal with tmpfs_domain pub/priv split properly # Read system properties managed by zygote. allow appdomain zygote_tmpfs:file read; - diff --git a/private/compat/26.0/26.0.cil b/private/compat/26.0/26.0.cil index 064756eb2b821ccd0b1a40961a5ae145def92109..47c58cabd603fdebbf8ac10dde80cb10451cd758 100644 --- a/private/compat/26.0/26.0.cil +++ b/private/compat/26.0/26.0.cil @@ -488,9 +488,7 @@ (typeattributeset proc_meminfo_26_0 (proc_meminfo)) (typeattributeset proc_misc_26_0 (proc_misc)) (typeattributeset proc_modules_26_0 (proc_modules)) -(typeattributeset proc_net_26_0 - ( proc_net - proc_net_xt_qtaguid_stats)) +(typeattributeset proc_net_26_0 (proc_net)) (typeattributeset proc_overcommit_memory_26_0 (proc_overcommit_memory)) (typeattributeset proc_perf_26_0 (proc_perf)) (typeattributeset proc_security_26_0 (proc_security)) diff --git a/private/genfs_contexts b/private/genfs_contexts index 0b3c10256be5f25eaa567a7cd68b100a7ac82f4d..e0cafa48b94a11dfd6df0846fea820d5ef17f99a 100644 --- a/private/genfs_contexts +++ b/private/genfs_contexts @@ -17,7 +17,6 @@ genfscon proc /modules u:object_r:proc_modules:s0 genfscon proc /mounts u:object_r:proc_mounts:s0 genfscon proc /net u:object_r:proc_net:s0 genfscon proc /net/xt_qtaguid/ctrl u:object_r:qtaguid_proc:s0 -genfscon proc /net/xt_qtaguid/stats u:object_r:proc_net_xt_qtaguid_stats:s0 genfscon proc /cpuinfo u:object_r:proc_cpuinfo:s0 genfscon proc /pagetypeinfo u:object_r:proc_pagetypeinfo:s0 genfscon proc /softirqs u:object_r:proc_timer:s0 diff --git a/public/app.te b/public/app.te index ca14afced85655a47a6242d087cb523cb4520d94..3b0495580278f6a2937a9393baf0fe6845c98ad2 100644 --- a/public/app.te +++ b/public/app.te @@ -173,7 +173,6 @@ userdebug_or_eng(` allow appdomain qtaguid_proc:file rw_file_perms; # read /proc/net/xt_qtguid/stats r_dir_file({ appdomain -ephemeral_app}, proc_net) -auditallow appdomain proc_net:file *; # ({ appdomain -ephemeral_app}, proc_net) # Everybody can read the xt_qtaguid resource tracking misc dev. # So allow all apps to read from /dev/xt_qtaguid. allow appdomain qtaguid_device:chr_file r_file_perms; diff --git a/public/domain.te b/public/domain.te index f76ce6ba9f793210060c4a2c6c454945f311474f..f9b66880ea43125881a8fae9fd41360bb5f8e8d8 100644 --- a/public/domain.te +++ b/public/domain.te @@ -24,10 +24,6 @@ allow domain self:process { allow domain self:fd use; allow domain proc:dir r_dir_perms; allow domain proc_net:dir search; -# STOPSHIP remove (b/70722355). This is granted temporarily to gather info -# on uses of /proc/net/. /proc/net/xt_qtaguid/stats is broadly used including -# by apps. -allow domain proc_net_xt_qtaguid_stats:file r_file_perms; r_dir_file(domain, self) allow domain self:{ fifo_file file } rw_file_perms; allow domain self:unix_dgram_socket { create_socket_perms sendto }; diff --git a/public/file.te b/public/file.te index 13067369157b9051ec66f0f3887c4d96a49b1957..be91f4e532666ecf2ada1e4a9372ee908cef222e 100644 --- a/public/file.te +++ b/public/file.te @@ -33,7 +33,6 @@ type proc_misc, fs_type; type proc_modules, fs_type; type proc_mounts, fs_type; type proc_net, fs_type; -type proc_net_xt_qtaguid_stats, fs_type; type proc_overflowuid, fs_type; type proc_page_cluster, fs_type; type proc_pagetypeinfo, fs_type;